CVC authentication with registered card stripe

Question

I'm currently using stripe and ask customer to register the card (via stripe).

After the first checkout, the customer has his card registered. This customer can re-use this card for another checkout and I want to ask the CVC / Card Security Code for preventing the low security passwords.

Is there a call to the stripe api for this "CVC authentication" ?

Thank you

Answer 1

There's unfortunately no way to do this with Stripe at the moment. There is no API you could call that would use a saved card and where you would pass the CVC along so that it's sent to the bank and checked again.

You either need to ask for the full card details again or simply rely on the saved card itself. When you create the customer and the card you can check if cvc_check is set to pass to make sure that the CVC was sent and validated by the bank so that you don't have to ask for it again in the future.

Answer 2

This is possible now. From the Stripe docs:

When creating subsequent payments on a saved card, you may want to recollect the CVC of the card as an additional fraud measure to verify the user.

Start by creating a PaymentIntent on your server with the amount, currency, and your Customer ID. List the PaymentMethods associated with your Customer to determine which PaymentMethods to show for CVC recollection.

After passing the PaymentIntent’s client secret to the browser, you’re ready to recollect CVC information with Stripe Elements on your client. Use the cardCvc Element to recollect a CVC value from your user, and then confirm the payment from your client using stripe.confirmCardPayment. Set payment_method to your PaymentMethod ID, and payment_method_options[card][cvc] to your cardCvc Element.

stripe.confirmCardPayment(clientSecret, {
  payment_method: '{{PAYMENT_METHOD_ID}}',
  payment_method_options: {
    card: {
      cvc: cardCvcElement
    }
  },
}).then(function(result) {
  if (result.error) {
    // Show error to your customer
    console.log(result.error.message);
  } else {
    if (result.paymentIntent.status === 'succeeded') {
      // Show a success message to your customer
      // There's a risk of the customer closing the window before callback
      // execution. Set up a webhook or plugin to listen for the
      // payment_intent.succeeded event that handles any business critical
      // post-payment actions.
    }
  }
});