CVV2 deadlock with linkpoint gateway

[dgray]

It appears to be impossible to place an order after an incorrect CVV2 has been entered, even after correction. (And even if CVV2 values are not required.)

I'm running 8.2.1.1 using the LinkPoint gateway in Authorize and capture mode (I sell software as digital downloads). I have CVV2 displayed but not required, rejected if invalid.

Some customers have complained so I tried a test order with an incorrect 3-digit CVV2 and sure enough there are two problems, one minor, one major.

The minor problem is that the response says please verify Zip/Postal code, Card number and Expiration but no mention of CVV2. Can the message be changed to include verifying CVV2?

The major problem is that if the order is re-submitted with correct information the response is "Error SGS-005003: The order already exists in the database". I tried with the correct CVV2 and with no CVV2 but the duplicate order error is always returned. It's impossible to order at this point. The only solution I found was to empty the cart and start again.

After googling the error code it seems the order number needs to change after the decline to avoid this. I wonder if it also happens after an AVS decline, such as wrong expiration or address?

[dgray]

Since nobody at ShopSite appears to want to respond to this I did some more digging and found a definitive statement of this error at

http://www.error1002.com/api/sgs_errors.php#05003

I think this also affects YourPay which I believe is also based on LinkPoint? Anyhow basically after a decline from linkpoint Shopsite needs to change the linkpoint order ID (a 30 character unique id). Actually you don't even need to specify this - one will be automatically generated by linkpoint. It doesn't seem to be too difficult to get around this and it's a definite bug as I see people using other e-Commerce solutions involving linkpoint have also run into it. The linkpoint reference manual can be found at http://www.linkpoint.com/product_soluti ... Manual.pdf where it discusses the oid (order id) field. Why not just omit it and let LinkPoint choose one?

Please do fix this as I think everyone else using LinkPoint, YourPay, CardService, or other FirstData Merchant services will fall foul of it sooner or later and will lose sales because of it.

To restate the problem, if a customer makes a mistake that causes a DECLINE, they can no longer re-submit the order, even after correcting the mistake. To put it another way - we just lost a sale.