Showing results for 
Search instead for 
Did you mean: 

How to notify for expired cards with hosted CIM option?

I want a way to let my users know if their card is about to expire.  The problem is the expiration date is masked, so there is no way to retrieve it.

I've seen a number of posts on this subject with the common solution being to store a notify date based on the entered expiration date on your own servers.  


But.... how do you do that if you're using the hosted CIM option???  


With the hosted option you never request the the expiration date in a form you control, therefore you cannot store the date or a variation of it as a notification date and you're left with no way to get an unmasked expiration date via xml or soap requests.  


So is there any way to deal with expiring card issues if you're using the hosted CIM option?  Please help.  Thank you.


Update - I have asked support about this issue and they said the only option is to submit a feature request.  I did (request is copied below).  


If this feature would be helpful to you, please also send a feature request so they will hopefully add it soon.  You can send feature requests by logging in to your merchant account and clicking 'feedback' on the top menu.


Feedback text:


I am using CIM with the hosted popup option.  Everything is working great... except there is no way to grab the expiration date since I do not control the form, and the expiration date is masked if I request it, which means there is no way for me to write code to notify a user that their payment method is about to expire and needs to be updated.  This is a major issue.  I have seen solutions offered in the past, but with the new hosted option the solutions are obsolete.  See more at  
Please either add a way to get the expiration date for each payment profile, or a method of getting a bool value if the expiration date is within a specified time period.  
Thank you.

Hmm... just realized the original post is reallly old. That doesn't bode well.


I am in the exact same boat. We are using the CIM gateway and have implemented a hack by storing the expiration date in the fax field - we absolutely need to track expiration date for our customers. The new hosted profile pages are great, but they're useless to us since we have no control over the form fields and can't hack the fax field as we used to.


As I understand it, expiration date is not considered a sensitive field and is not required to be masked for PCI compliance. So why is Anet masking expiration date to begin with?

I don't know where you heard that - as far as I know, expiration date IS a protected value, and storing it means you have to qualify for the most stringent set of security guidelines, something which is virtually impossible. The documentation also makes it fairly clear that passing a protected value in one of the other fields is a serious security violation.


About all I can recommend is that you ask your customers if they want to be reminded when their card is about to expire, and give them a field for putting in a date to be reminded. The date they put in won't technically be a protected value, and you can pass it using a custom field (fax is a messy kludge).