0

I'm currently building a site where a user can sign up, and amongst other things, opt-in to a paid subscription for a selection of products. Currently, my workflow has the following steps:

  • Sign up (providing name, contact, etc)
  • Confirm account (via email/SMS)
  • (Optionally, maybe later) Opt-in to a subscription, requiring address and credit card details.

Since the primary goal is to have people pay for subscriptions, I'm putting together a streamlined on-boarding workflow that creates the user's account, asks for address and payment details, and subscribes them, all in one process.

My question is, should I allow an unconfirmed user (who hasn't confirmed either their email or phone number) to store credit card details against their account? Instinctively I feel like having a confirmed account should come first, but I can't pin-point why exactly. It's definitely worse for the speed and simplicity of the sign up process, so if I can avoid blocking on confirmation, I'd like to.

Are there any security considerations around doing this? (I'm already using PCI compliant payment provider - so I specifically mean attaching a payment token to an unconfirmed user).

Improve this question
3
  • The only thing I can think of is if somebody provided the wrong email address or phone number by accident, then whoever receives the email or text could log onto their account and access their credit card info.
    – Samuel Bradshaw
    Jun 12, 2017 at 23:46
  • 1
    @SamuelBradshaw, this would be a different security issue, but a system where the whole financial information for the user is freely available would be a terribly designed service. Furthermore, most credit card info is stored in the merchant's or CC processor servers and completely encrypted. I would never use a service where I see my financial info is visible, it breaks all existing security theories. Just imagine "John from Indiana, your CS representative" being able to access all user's financial info!
    – Devin
    Jun 12, 2017 at 23:57
  • @Devin is right - once the card is stored, the full details are never available again, except as 'Visa ending in NNNN'. If the user accidentally uses the wrong address, the mistaken recipient would need to be logged in in order to do anything with their card.
    – Beejamin
    Jun 13, 2017 at 0:44

1 Answer 1

Reset to default
1

Yes, of course

As a matter of fact, one of the most common confirmation methods for anything dealing with payments is to charge a small amount that is credited towards future purchases.

Confirmation by mail is a low level confirmation process that doesn't mean anything special. For example: I have 20-30 Instagram accounts that I needed to create to test something. The only thing I needed was a mail account (now you need a FB account, which is more or less the same). I confirmed all those accounts and used them for some tests we needed to run, but Instagram doesn't know absolutely anything about the account owner. As a matter of fact, they can't even tell these accounts belong to the same person!

On the other hand, confirmation by payment method is a high level confirmation method with added security, runs on secure networks and has a lot of abandonment, for different reasons.

Think about this: my Instagram scenario isn't a real confirmation, I don't care at all and quite honestly I don't remember those accounts and its details. I had no purpose other than testing an app, and the trade-off (providing an account they can spam for years with 0 results) was just right. Let's say this is Level 1, just above a Level 0 which would be a no confirmation scenario.

Your free subscription scenario has more purpose, and people will want to signup to your service, giving their mail addresses in exchange. This is also a fair price the user will be OK with, let's call it Level 2

However, an added value service will require a payment. This requires some thought, the trade off is higher, and the user will need to be convinced to add her credit card info. This would be a Level 3, and you can be sure that anyone doing this is because they're willing to pay, they WANT to pay and they consider the premium service is worth the effort/money

In short

using the credit card IS THE CONFIRMATION. You can't even compare the security levels, so go ahead and let them store their credit card info and create the account at the same time, is the best possible scenario.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.