search

capacitor-community / stripe

Stripe Mobile SDK wrapper for Capacitor
MIT License
185 stars 74 forks source link

confirmPaymentIntent with PaymentMethod ID and CVC check #45

Closed stefanotauriello closed 3 years ago

stefanotauriello commented 3 years ago

I’ve saved my card on Customer after a successfull confirmPaymentIntent, I have 2 questions: 1) If I retype the same credit card details of one of my saved card, Stripe save the card another time

2) When i get PaymentMethod list, I need reinsert CVC before confirmPaymentIntent in order to avoid fraud, is it possible?

ihadeed commented 3 years ago

  1. AFAIK that's how Stripe works, at least in dev mode. I didn't try doing that in production. You could add logic to compare the card fingerprint with other cards on file and throw an error. Can't remember if client SDK gives you the fingerprint, might have to do it on server side. Also the "get customer payment methods" isn't implemented on iOS.

  2. I don't think that's possible. If you find that functionality in their SDK let me know and I'll try to implement it. For now the only way to prevent fraud is by using 3DS authentication. It's currently supported by the plug-in/SDK as long as the card supports it. 3DS gets retriggered by payment intents too. Alternatively, you can have extra TOS clause or authentication in a way that helps you fight any dispute by proving that the card holder authorized that transaction.