Magento Extension User Guide: Web Services Version 3.6.1

Version 3.6.1 This document explains how to install the official Secure Trading extension on your Magento store. Published: 3 August 2017

Table of Contents 1 Introduction... 3 1.1 Features... 3 1.2 Requirements... 4 1.3 About Magento Extensions... 4 2 Process Overview... 5 3 First-Time Configuration... 6 3.1 Install the extension... 6 3.2 Configure the extension... 9 3.3 Perform a test payment... 12 4 Advanced Configuration... 14 4.1 Optional settings... 14 4.2 Tokenization... 16 4.3 Payment Action Types... 18 4.4 Additional request types... 23 5 Managing Orders... 24 5.1 Order View... 24 5.2 Credit Memo... 31 6 Testing and Maintenance... 32 6.1 Compatibility... 32 6.2 Troubleshooting... 33 6.3 Updating the Extension... 34 6.4 Log files... 34 7 Additional Notes... 35 7.1 Create Web Services Username... 35 7.2 Multishipping purchasing... 35 7.3 Failed payment attempt... 36 7.4 PayPal support... 36 7.5 ideal and Sofort support... 36 7.6 Transaction reporting... 36 7.7 Multi-currency configuration... 37 7.8 Multi-store configuration... 37 8 Further Information and Support... 38 8.1 Secure Trading Support... 38 8.2 Secure Trading Sales... 38 8.3 Useful Documents... 38 Secure Trading Limited 2017 3 August 2017 Page 2 / 38

1 Introduction This Magento Community Edition extension allows you to seamlessly integrate with Secure Trading to process payments on your online store. This document outlines the installation, configuration, testing and interaction of the extension between Secure Trading and Magento. 1.1 Features Magento s one-step checkout process Tokenization Magento s multishipping checkout process Multi-store Multi-currency Support for virtual items Customisable iframe configuration 3-D secure-enabled payments Protect Plus fraud services Account Check feature Payments initiated from the Magento admin area (Mail Order / Telephone Order) Extensive transaction reporting tools Managing transactions from within the Magento admin interface Fully supports UTF-8 character set Secure Trading Limited 2017 3 August 2017 Page 3 / 38

1.2 Requirements You will need to consider the following steps before processing payments using our Magento extension. 1.2.1 Upgrading from an older version If you already have a Secure Trading extension installed on your Magento store, follow the update procedure steps outlined in section 6.3. The STAPI client connection is being discontinued in this version of the extension. In order to continue using this extension, you will need to switch to our Web Services connection to allow the extension to communicate using our APIs. Please refer to our Update Guide for full instructions. This document can be found on our Magento Connect page: http://www.magentocommerce.com/magento-connect/securetrading.html 1.2.2 Magento installation and PHP version You will need to have a web server running a Magento store installation, in order to this extension. The extension has been designed and tested for use with Magento 1.7, 1.8 and 1.9 Community Edition. This version of the extension supports PHP 5.3.10-5.6.15 (tested up to 5.5.15). 1.2.3 Secure Trading account In order to process transactions through Secure Trading s servers, you will need to have an account with us and a site reference. You are provided with a unique site reference when you sign up and this is used to identify your account. It should also be quoted with any correspondence with the Support team. Please note that to process Mail Order/Telephone Order requests, you must request that MOTO is enabled on your site reference by contacting Support (see section 8.1). For more information on becoming a Secure Trading merchant, please contact our Sales team (see section 8.2). If you believe you already have an account with us, but do not know your site reference, please contact our Support team (see section 8.1). 1.3 About Magento Extensions A Magento extension is a collection of files that are packaged together in order to alter or extend the behaviour of Magento. Extensions do not affect core Magento code and instead interact with Magento in several non-disruptive ways: 1. Additional files included in the extension folder will be executed within the Magento workflow. 2. Magento event observers will listen for certain conditions and execute additional predefined operations. Secure Trading Limited 2017 3 August 2017 Page 4 / 38

2 Process Overview C U S T O M E R M A G E N T O S E C U R E T R A D I N G Step 1) The Customer opts to make a payment on Merchant s Magento store using the Secure Trading extension. Step 2) Customer enters payment, billing and delivery information and confirms the order. Step 3) The Magento store generates a request to Secure Trading. Step 4) Secure Trading submits the customer s payment details to the Acquiring Bank over a secure connection. Step 5) Secure Trading interprets response from the Acquiring Bank and submits a response to the Magento store to confirm the result of the transaction. Step 6) The Magento store displays a success message to the customer. C U S T O M E R M A G E N T O S E C U R E T R A D I N G Secure Trading Limited 2017 3 August 2017 Page 5 / 38

3 First-Time Configuration Follow these three easy steps to begin processing payments with the extension: Install the extension on your Magento store. See section 3.1 Configure the extension on your Magento store. See section 3.2 Perform a test payment using the details provided. See section 3.3 3.1 Install the extension Install the extension on your Magento store 1. Access Magento Connect to retrieve the Secure Trading payment extension from the following URL : http://www.magentocommerce.com/magento-connect/securetrading.html 2. Sign in and click the Install Now button. 3. Tick the "I agree to the extension license agreement" note and click the "Get Extension Key" button. 4. Click the "Select Key" button and copy the contents. Secure Trading Limited 2017 3 August 2017 Page 6 / 38

5. Sign into your Magento admin panel and go to System > Magento Connect > Magento Connect Manager using the menus at the top of the page. When prompted, enter your admin credentials to proceed to the Magento Connect Manager. 6. Once signed in to the Magento Connect Manager, you will need to locate the section titled Install new Extensions and paste the copied extension key into the text box (as seen below). 7. Click Install. The installation of the extension will begin. 8. You will be shown a list of current extensions (under Manage Existing Extensions ). From here, you can Cancel Installation or Proceed. Click Proceed to install the extension. Secure Trading Limited 2017 3 August 2017 Page 7 / 38

9. Once the installation has been completed, click Refresh under the console. 10. Please ensure the section titled Manage Existing Extensions has the two extensions listed with Package name(s) of Securetrading_Stpp and Securetrading_Multishipping. The extension is now installed and ready to configure. Secure Trading Limited 2017 3 August 2017 Page 8 / 38

3.2 Configure the extension Install the extension on your Magento store 1. Sign in to the Magento administration area. 2. Hover over System from the options at the top of the page, and then click Configuration from the drop-down menu. 3. On the page that loads, select Payment Methods on the left side menu. In the SecureTrading STPP box, click the Configure button for Secure Trading API. This expands to show two options: Required settings Optional settings If you cannot view Secure Trading settings in this view, please refer to section 6.2. You can hover the cursor over the? icons in the configuration to display further information on a field. Secure Trading Limited 2017 3 August 2017 Page 9 / 38

3.2.1 Required Settings Click Required Settings. This expands to show settings you can configure. Ensure the Enabled field is set to Yes. 3.2.1.1 Site reference You must enter your unique site reference in the Site Reference field. When setting up the Magento extension for the first time, it is strongly recommended that your test site reference (e.g. test_site12345 ) is specified. This allows you to test payments to our test bank (see section 3.3) to ensure your implementation works as expected. When you are ready to go live, you change this to be your live site reference (e.g. site24680 ). 3.2.1.2 Web Services Username and Password Your Web Services credentials are used to both process transactions for customers using your Magento store and also to update existing transactions with changes made in the admin interface. You will need to enter these details into the Connection Configuration. If you do not already have a Web Services username and password, you can create Web Services credentials for your site(s) by following the steps outlined in section 7.1. This process only takes a few minutes. 3.2.1.3 Accepted Cards This multi-select box allows you to select payment types to be displayed to the customer when they are performing a purchase. Secure Trading Limited 2017 3 August 2017 Page 10 / 38

3.2.2 Cron scheduling 3.2.2.1 Process overview This extension makes use of crons to schedule background maintenance tasks on your Magento store. This is required for: Cancelling orders older than 24 hours that are still in the 3D Secure status. These orders are most-likely abandoned and cancelling them releases the stock reserved, allowing purchase by new customers. This runs every hour, on the hour (at *:00). Performing daily checks (at midnight GMT) for orders older than 7 days: o o Cancels orders that haven t been captured. Closes open Transactions (see the Sales > Transactions page in the admin area). Closed Capture transactions indicate the payment is no longer pending settlement. 3.2.2.2 Configuration You must configure a cron job (e.g. by using Linux crontab or Windows Scheduled Tasks) that performs an HTTP GET request to <root_magento_dir>/cron.php at regular intervals (Magento recommends every 15 minutes). Every time the cron.php file is accessed, Magento will check any tasks that need to be run, and schedule any future tasks. This is discussed in detail here: http://merch.docs.magento.com/ce/user_guide/magento_community_edition_user_guide.html #system-operations/cron.html 3.2.3 Save your settings Always be sure to click Save Config when you have finished changing configuration in order to save your preferences. Secure Trading Limited 2017 3 August 2017 Page 11 / 38

3.3 Perform a test payment Perform a test payment using the details provided. You must only perform the following tests using your test site reference (must start with test_ ). Configuring your site reference is outlined in section 3.2.1.1. 1. Add an item(s) to your cart and proceed to checkout. 2. Register/sign in as appropriate and fill out billing and shipping information. 3. If the extension has been configured correctly, it will appear as a payment option in your store (name and description dependent on your configuration settings, see section 4.1.1.1). Select this option (if not already selected), and fields will be shown for entering payment details. Secure Trading Limited 2017 3 August 2017 Page 12 / 38

4. Enter payment details into the fields shown and click Next. The following are test PANs you can use for testing your implementation: Name of payment type Authorisation Decline Security code American Express 340000000000611 340000000000512 1234 Diners 3000000000000111 3000000000000012 123 Discover 6011000000000301 6011000000000202 123 JCB 3528000000000411 3528000000000312 123 Maestro 5000000000000611 5000000000000512 123 MasterCard 5100000000000511 5100000000000412 123 MasterCard Debit 5124990000000101 5124990000000002 123 V PAY 4370000000000061 4370000000000012 123 Visa 4111110000000211 4111110000000112 123 Visa Debit 4310720000000091 4310720000000042 123 Visa Electron 4245190000000311 4245190000000212 123 Visa Purchasing 4484000000000411 4484000000000312 123 5. Confirm your order by clicking Place Order. 6. Providing the test card details you entered were for an authorised response, you will be shown a success message. If you entered declining test card details, an error message will be shown, and you ll be allowed to try different payment details. Secure Trading Limited 2017 3 August 2017 Page 13 / 38

4 Advanced Configuration 4.1 Optional settings The Optional Settings can be found in the same location as the Required Settings as documented in section 3.2. 4.1.1 Display Settings 4.1.1.1 Title and Description You may wish to give the payment module a distinctive name so it will stand out on the checkout page. The name and description are both displayed in your Magento store when the customer is selecting a payment method. 4.1.1.2 Use Iframe By default, the extension uses iframes to redirect your customer to the card issuer s Access Control Server (ACS) as part of 3-D Secure. Iframes are used to display the ACS URL within your Magento store. This is used to create a seamless user experience. If you wish to disable iframes set Use Iframes to No. 4.1.1.3 Show Start Date and Issue Number You can opt to prompt the customer for their card start date and issue number when they are entering their payment details by setting these drop-downs to Yes. This feature is disabled by default. Secure Trading Limited 2017 3 August 2017 Page 14 / 38

4.1.2 Tokenization Settings If you would like to enable Tokenization, set Use Card Store to Yes. Tokenization requires further configuration before customers can use it. This is explained in section 4.2. You can optionally enter custom text into the Save CC details? Question field, which is shown to the customer when asking if they would like to save their card details for future use. The default text if left blank is Save card details? 4.1.2.1 About the Billing Agreement Wizard If the Use Billing Agreement Wizard is set to Yes, this allows you to enter payment details into the Magento admin interface, which can be associated with a customer s user account for future use. For further information on billing agreements, please refer to Magento s own documentation. 4.1.3 Other Settings 4.1.3.1 Applicable Countries This field can be used to restrict purchase to customers with specific billing countries. 4.1.3.2 Payment Action See section 4.3 for a full explanation of both options. 4.1.3.3 Settle Due Date This field specifies how long to wait before settling funds reserved on the customer s account. 4.1.3.4 Verify SSL Certificates (Web Services) When this option is enabled (default), we verify that the root Certificate Authority is trusted and that the verification of the signatures in the certificate chain is successful. This should always be enabled in a production environment and should only be disabled for testing purposes. When enabled, the extension will use the default file path for trusted CAs by default. If you prefer, you can specify the full file path containing the trusted CAs in the field provided. The file should be in.pem/.crt format. 4.1.3.5 Use 3D Secure, Risk Decision and Account Check These settings allow you to enable additional request types on your Magento store. Refer to section 4.4 for information on how these request types are used. 4.1.4 Save your settings Always be sure to click Save Config when you have finished changing configuration in order to save your preferences. Secure Trading Limited 2017 3 August 2017 Page 15 / 38

4.2 Tokenization Tokenization allows customers to save their payment details following their first payment using a particular card, allowing them to process future payments without having to re-enter their payment details. Before saving a card After saving a card Risk Decision and Account Check Requests are NOT performed on tokenization payments. (These checks can be run on the initial payment request) Card details are saved as customer billing agreements in the Magento system. When the customer opts to use a saved card for a new transaction, the payment is made using an API request to Secure Trading. The customer does not need to type in any payment details, as these have been stored as part of the billing agreement (tokenization does not store or send security code details). Configuring tokenization requires you to perform some additional configuration, which is documented in this section. To use tokenization, please ensure it has been enabled in the API settings (see section 4.1.2) before continuing. The tokenization settings can be found in the same location as the API settings, as documented in section 3.2. In the SecureTrading STPP box, click the Configure button for Secure Trading Tokenization. This expands to show two options: Required settings Optional settings Secure Trading Limited 2017 3 August 2017 Page 16 / 38

The following settings are independent of any settings previously configured in the Secure Trading API configuration) 4.2.1 Required settings 4.2.1.1 Enabled This field needs to be set to Yes to enable tokenization. In addition to configuring the extension, you will also need to enable a STORE account on your Secure Trading account. To enable this, contact Support (8.1). 4.2.1.2 Config Inheritance Ensure the Config Inheritance is set to Secure Trading API. This inherits necessary settings from the Secure Trading API configuration. 4.2.1.3 Accepted Cards This section allows you to select card types that you will accept for tokenization. 4.2.2 Optional Settings 4.2.2.1 Title and Description These are both displayed to customers prior to payment. They are only displayed to returning customers who have previously opted to save their payment details for future transactions. 4.2.2.2 Use Iframe By default, the extension uses iframes to redirect your customer to the card issuer s Access Control Server (ACS) as part of 3-D Secure. Iframes are used to display the ACS URL within your Magento store. This is used to create a seamless user experience. If you wish to disable iframes set Use Iframes to No. 4.2.2.3 Applicable Countries This field can be used to restrict tokenization to customers with specific billing countries. 4.2.2.4 Max # of Saved Cards This number defines the maximum number of cards that can be saved per customer account. 4.2.2.5 Use 3D Secure If you would like 3-D Secure to be performed for each tokenization request, set the Use 3D Secure option to Yes. See section 4.4.3 for further information. 4.2.3 Save your settings Always be sure to click Save Config when you have finished changing configuration in order to save your preferences. Only customers registered on your Magento store will be prompted to save card details. Customers will not be prompted if they are registering an account on your site while making their first purchase. Secure Trading Limited 2017 3 August 2017 Page 17 / 38

4.3 Payment Action Types The extension supports two payment action settings: 1. Authorize and Capture Secure Trading sends a request for payment authorisation, and the funds will be captured in a subsequent settlement run (normally within 24 hours). See sections 4.3.1 and 4.3.2. 2. Authorize only Secure Trading sends a request for payment authorisation, but the funds will not be captured without further action from the merchant. See sections 4.3.3 and 4.3.4. Secure Trading Limited 2017 3 August 2017 Page 18 / 38

4.3.1 Diagram of Order Status Flow (using Authorize & Capture Payment Action) The following is a diagrammatic overview of the order status flow in Magento when the customer places an order in your store when payment action is set to Authorize & Capture (described in more detail in section 4.3.2): Step 1) Customer enters their payment details in the Magento store. Step 2) The installed Magento extension submits a request to Secure Trading. Step 3) Secure Trading submits a request to the Acquiring Bank and interprets the response returned. I F E R R O R Customer can amend payment details and start again. I F A U T H O R I S E D Step 4) Magento automatically generates an invoice. I F S U S P I C I O U S E.g. if card security code provided by Customer returns Not Matched response. Order status: Payment Review p Invoice is in Pending status. I F M E R C H A N T A P P R O V E S I F N O T S U S P I C I O U S Order status: Processing Invoice is in Paid status and is sent to the Customer. I F M E R C H A N T D E N I E S I F M E R C H A N T S H I P S Order status: Canceled Payment cancelled by the Merchant. Invoice is in Canceled status. Order status: Completed Product is delivered to Customer. More information can be found over the page. Secure Trading Limited 2017 3 August 2017 Page 19 / 38

4.3.2 Description of Order Status Flow (using Authorize and Capture Payment Action) After the checkout process (one-page or multishipping) hosted by your Magento store, the customer confirms they are ready to perform a payment by clicking Place Order. At this point, the extension sends a request to Secure Trading, which then in turn sends an authorisation request to the acquiring bank. The acquiring bank will contact the card issuer, which will either authorise the payment or decline. If the card issuer declines the payment, the customer will be given the opportunity to amend their details and try again if they wish to do so. If the payment has been authorised and the order is: Not suspicious, an invoice is automatically generated by your Magento store and the order status is set to Processing. Unless you manually update or cancel the transaction, the funds will be captured (settled) in Secure Trading s next settlement run. Suspicious, (e.g. if the security code entered is incorrect) the order status in Magento is set to Payment Review and the generated invoice will be in a pending status. You can review a Payment Review transaction on the Order View page (see section 5.1) and opt to cancel it using the Magento interface. Clicking the Deny Payment button updates the order status to Canceled, preventing the funds from being captured. Alternatively, you can approve the payment by clicking on the Accept Payment button on the Order View page (see section 5.1) and allow the funds to be captured. The invoice is updated to Paid status and the order status is updated to Processing. To dispatch your product, you must manually confirm this in the Magento interface. This is achieved by clicking Ship on the Order View page for the order in question (providing the invoice has been paid). When you have done so, the order status in Magento is updated to Completed. Please note when using Protect Plus, if the checks returns a CHALLENGE or DENY response, the order will enter Payment Review. Please see section 5.1.4 for information on actions that can be performed on orders in status Payment Review. Secure Trading Limited 2017 3 August 2017 Page 20 / 38

4.3.3 Diagram of Order Status Flow (using Authorize Only Payment Action) The following is a diagrammatic overview of the order status flow in Magento when the customer places an order in your store (described in more detail in section 4.3.4): Diagrammatic Overview Step 1) Customer enters their payment details in the Magento store. Step 2) The installed Magento extension submits a request to Secure Trading. Step 3) Secure Trading submits a request to the Acquiring Bank and interprets the response returned. I F E R R O R Customer can amend payment details and start again. I F A U T H O R I S E D Order status: Processing p Payment authorised by the Acquiring Bank and awaits action from Merchant. I F M E R C H A N T G E N E R A T E S I N V O I C E Order status: Processing Merchant opts to generate invoice for the Customer. I F M E R C H A N T S H I P S Order status: Completed Product is delivered to Customer. More information can be found over the page. Secure Trading Limited 2017 3 August 2017 Page 21 / 38

4.3.4 Description of Order Status Flow (using Authorize Only Payment Action) After the checkout process (one-page or multishipping) hosted by your Magento store, the customer confirms they are ready to make a payment by clicking Place Order. At this point, the extension sends a request to Secure Trading, which then in turn sends an authorisation request to the acquiring bank. The acquiring bank will contact the card issuer, which will either authorise the payment or decline. If the card issuer declines the payment, the customer will be given the opportunity to amend their details and try again if they wish to do so. If the payment has been authorised, the order status in Magento is set to Processing. You must manually Invoice or Cancel each payment using the Magento interface: To deny a payment and prevent it from being captured (settled), click Cancel on the Order View page for the order in question This will leave the transaction in a suspended state within Secure Trading that will not be scheduled for capture (settlement). To proceed with the order, generate an invoice within the Magento interface. This is achieved by clicking Invoice on the Order View page. This allows the funds to be captured in Secure Trading s next settlement run by updating the transaction to be scheduled for capture (settlement). To dispatch your product, you must manually confirm this within the Magento interface. This is achieved by clicking Ship on the Order View page for the order in question. Once the item(s) have been shipped, the order status in Magento is updated to Completed. Please note when using Protect Plus, if the checks returns a CHALLENGE or DENY response, the order will enter Payment Review. Please see section 5.1.4 for information on actions that can be performed on orders in status Payment Review. Secure Trading Limited 2017 3 August 2017 Page 22 / 38

4.4 Additional request types You can perform additional requests when processing transactions to help reduce fraud and chargebacks: Risk Decision and Account Check Requests are NOT performed on tokenization payments. (These checks can be run on the initial payment request) 4.4.1 Risk Decision (Protect Plus) The purpose of Risk Decision requests is to minimise fraud by analysing customer details and highlighting possible fraudulent activity by using the Protect Plus system. This is to assist you in making a decision of whether or not to process a customer s transaction, based on the perceived level of risk. This is achieved by checking the industry s largest negative database and also searching for suspicious patterns in user activity. The system uses neural-based fraud assessments that can be configured specifically for your account and is constantly updating the fraud checks used to combat new risks. Based on the decision returned by the Protect Plus system a customer that is deemed as suspicious can be prevented from processing a payment. 4.4.2 Account Check An Account Check is an optional request to help minimise fraud. It allows payment details to be validated, and checks that the details entered by the customer matches those on the card issuer s records. No funds will be reserved or transferred by the Account Check request. Please note that Account Checks are only available for certain Acquiring Banks. Please contact the Support team for more information (see section 8.1). 4.4.3 3-D Secure 3-D Secure is a protocol designed to reduce fraud and Chargebacks during e-commerce Internet transactions. Cardholders are asked to identify themselves at the point of sale before the purchase can be completed. This usually means entering a PIN or other password after entering their credit card details. In the event of a dispute with the transaction at a later date, the card issuer will usually take responsibility of the Chargeback instead of the merchant. The liability issues involved with 3-D Secure transactions are out of the scope of this document. For a detailed indication of the liabilities involved, contact your bank. Please note that only certain payment types support 3-D Secure. 4.4.4 Configuration To enable the aforementioned additional requests on your Secure Trading account: Enable the requests on your Secure Trading account by contacting the Support team (see section 8.1). Enable the requests in your Magento configuration settings (navigate to Secure Trading API > Optional Settings; see section 4.1.3.5). Secure Trading Limited 2017 3 August 2017 Page 23 / 38

5 Managing Orders The extension provides full integration with your Magento store. You are able to manage your orders using the Magento admin interface and any actions taken will instruct us to update transaction(s), as required. Please note that we strongly recommend using the Magento admin interface when managing orders processed by your store. The purpose of this section of the document is to outline the expected behaviour of the extension for Magento when performing default Magento actions on orders processed by your store. These actions are core Magento functions. For up-to-date information on Magento features, please refer to Magento s website. 5.1 Order View On the Magento Order View page, the extension populates additional fields containing relevant information about the processed payment. Secure Trading Limited 2017 3 August 2017 Page 24 / 38

5.1.1 Multishipping Tab By clicking the Related Multishipping Orders from the left side menu (when a customer used multishipping), you will be able to see all other orders that are in the same multishipping transaction. 5.1.2 Payment Information The extension will populate the following fields in the Payment Information box: Field Comment ECOM E-commerce transaction performed by the Account Type customer. Description MOTO Mail Order Telephone Order performed in the Magento admin interface. Transaction Unique reference assigned by Secure Trading to reference the Reference payment. Security Response The result of the Address Verification System (AVS) and security Address code checks on the house number, postcode and card security Security Response code provided by the customer (see the AVS & CVV2 document): Postcode Matched - Billing details matches those on record. Not Matched - Billing details don t match those on record. Security Response Not Checked - Billing details not checked. Security Code Not Given - Billing details missing. Results from the Protect Plus checks performed on the customer s details: (If configured. See section 4.4.1 for further information) Fraud Control ACCEPT The details are not deemed suspicious. Shield Status Code CHALLENGE Further investigation is recommended. DENY The details are suspicious and a transaction should not be performed. Payment Type The payment method used by the customer. e.g. VISA Last 4 Card Digits The last four digits of the card used by the customer. e.g. 1111 (If configured. See section 4.4.3 for further information) Y Card is enrolled in 3-D Secure. 3D Enrolled N Card is not enrolled in 3-D Secure. U Unable to determine if card is enrolled in 3-D Secure. (If configured. See section 4.4.3 for further information) Y Customer authenticated by the card issuer. A An authentication attempt occurred but could not be 3D Status completed. U Unable to perform authentication. N Customer not authenticated. Order was placed The currency the customer used to process the payment. using e.g. GBP Secure Trading Limited 2017 3 August 2017 Page 25 / 38

Clicking the View in MyST hyperlink will open MyST in a new tab/window. After signing in to MyST, you will be displayed the corresponding single transaction view page for the transaction reference associated with the order shown on the Order View page. For more info on viewing transaction information using MyST, please refer to the MyST User Guide All Secure Trading documents can be found on our website. 5.1.3 Orders Not Invoiced (Authorize Only) This section only applies to merchants using Authorize Only payment action status. (See section 4.3.3) Please note that if you wish to process the order you must issue the invoice within 7 days of the payment being authorised. After this time period, we will automatically cancel the transaction as the authorisation code will have expired. Secure Trading Limited 2017 3 August 2017 Page 26 / 38

Orders that are yet to be invoiced (default behaviour when Payment Action is set to Authorize Only for a successfully processed transaction) will have the following actions that can be performed: Action button Edit Comment Click Edit to change details of an order. For non-invoiced orders, this procedure cancels the order and creates a new offline (MOTO) order with the modified details you provide. Secure Trading sends a new request to the card issuer for authorisation with the payment details you provide. Click Cancel to cancel an order. This marks the order as Canceled in the Magento interface. Cancelled orders cannot be resumed using the Magento interface; in such a scenario, you will need to process a new order. Cancel Note 1: Any partial captures that are registered within Magento for an order before it is manually cancelled will still proceed for settlement. Once cancelled no further funds can be accepted from the order. Note 2: It is still possible for credit memo s to be performed on any existing invoices generated for an order that is in a Canceled state. Click Send Email to send an email to the customer. By default, the email is sent to the customer s user account email address. When on the order details page, this will send an order confirmation email if one was not sent initially. Send Email When on the invoice details page, this will send an invoice confirmation. When on the credit memo page, this will send a credit memo confirmation. When clicked on the shipping page, this will send a shipping confirmation. Click Hold to put an order on hold. This prevents subsequent actions such as shipping the product or Hold refunding the order without explicitly unholding the order first. Putting an order on hold will not prevent funds from being captured by the acquiring bank, if this has been previously authorised. Click Unhold to take an order off hold status. Unhold This allows you to perform other actions on the order, such as modification or cancellation, generating an invoice or shipping the product. Click Invoice to generate an invoice for the order and proceed with the payment. Performing this action will allow funds to be captured by the acquiring Invoice bank (usually occurs within 24 hours). Once an invoice has been generated for an order, it is not possible to cancel it. Instead, you will need process a Credit Memo (refund). Credit Memo For information on Credit Memo please see section 5.2. Click Ship to dispatch the product to the customer. This is unrelated to the state of the payment and can be performed at any Ship time after an order has been generated. We strongly recommend waiting for funds to be captured by your acquiring bank before shipping. Click Reorder to create a new order using details of the order being viewed. Reorder You will be presented with a form pre-filled with details of the order, allowing you to process an additional order with the same or different details depending on your requirements. Secure Trading Limited 2017 3 August 2017 Page 27 / 38

5.1.4 Payment Review Orders When an order is in Payment Review status, this is because a transaction has met certain predefined criteria that have led Secure Trading to suspend payment until you have manually reviewed the transaction. By default, this occurs for Authorize and Capture orders when the customer has entered an invalid CVV2 (security code on the customer s card) or any time a Protect Plus (if enabled) returns a CHALLENGE or DENY response. Please note that if you wish to process the order you must issue the invoice within 7 days of the payment being authorised. After this time period,we will automatically cancel the transaction as the authorisation code will have expired. Secure Trading Limited 2017 3 August 2017 Page 28 / 38

Action button Send Email Accept Payment Deny Payment Comment Click Send Email to send an email to the customer. By default, the email is sent to the customer s user account email address. When on the order details page, this will send an order confirmation email if one was not sent initially. When on the invoice details page, this will send an invoice confirmation. When on the credit memo page, this will send a credit memo confirmation. When clicked on the shipping page, this will send a shipping confirmation. This will instruct Secure Trading to accept the payment. If already invoiced (Authorize and Capture): Selecting this option will allow the funds to be captured by the acquiring bank and will set the order status to Processing. If not invoiced (Authorize Only): Selecting this option will allow you to invoice the order and will set the order status to Processing. This will instruct Secure Trading to prevent the funds from being captured by the acquiring bank. This will set the order status to Canceled. 5.1.5 Invoiced Orders Secure Trading Limited 2017 3 August 2017 Page 29 / 38

All orders that have been invoiced will have the following actions that can be performed: Action button Edit Comment Click Edit to change details of an order. For invoiced orders, this procedure creates a new order with the modified details you provide. Secure Trading sends a new request to the card issuer for authorisation with the payment details you provide. Note: The original order and transaction will still be processed unless you opt to override the order. Click Send Email to send an email to the customer. By default, the email is sent to the customer s user account email address. When on the order details page, this will send an order confirmation email if one was not sent initially. Send Email When on the invoice details page, this will send an invoice confirmation. When on the credit memo page, this will send a credit memo confirmation. When clicked on the shipping page, this will send a shipping confirmation. Credit Memo For information on Credit Memo see section 5.2. Click Hold to put an order on hold. This prevents subsequent actions such as shipping the product or Hold refunding the order without explicitly unholding the order first. Putting an order on hold will not prevent funds from being captured by the acquiring bank, if this has been previously authorised. Click Unhold to take an order off hold status. Unhold This allows you to perform other actions, such as shipping the product or refunding the order. Click Ship to dispatch the product to the customer. This is unrelated to the state of the payment and can be performed at any Ship time after an order has been generated. We strongly recommend waiting for funds to be captured by your acquiring bank before shipping. Click Reorder to create a new order using details of the order being viewed. Reorder You will be presented with a form pre-filled with details of the order, allowing you to process an additional order with the same or different details depending on your requirements. Secure Trading Limited 2017 3 August 2017 Page 30 / 38

5.2 Credit Memo There are two types of Credit Memos that can be issued for an order: 1. Offline Credit Memos 2. Online Credit Memos 5.2.1 Offline Credit Memos Offline credit memos will not update the transaction on the Secure Trading system and will only generate the credit memo within Magento. Offline credit memos are issued when a refund is performed when clicking the Refund Offline button. Clicking Credit Memo from the Order View page will lead to issuing an offline credit memo. 5.2.2 Online Credit Memos Online credit memos will update the transaction on the Secure Trading system and will also generate a credit memo within Magento. To generate an online credit memo, please follow the following steps: Step 1 - From within the Magento Administration portal select from the menu: Sales > Orders Step 2 - Choose an Order (by clicking on the order). Step 3 - Select Invoice from the left side menu on the Order View page. Step 4 - Choose an Invoice (by clicking on an invoice). Step 5 - click the Credit Memo button. Step 6 - click the Refund button. Alternatively you could access the invoice, by navigating to Sales > Invoice and continuing from Step 4 mentioned above. Note: Clicking the Refund Offline button when issuing a credit memo will generate an offline credit memo which will NOT update the transaction on Secure Trading's systems. 5.2.3 Credit Memo behaviour The following behaviour is observed when issuing a credit memo for the following conditions: Condition 1: For full refunds where funds have not been captured The extension will cancel the order and the authorised funds will be released back to the customer s account. Condition 2: For full refunds where funds have been captured The extension will initiate a refund for the full amount. Condition 3: For partial refunds where funds have not been captured The extension will reduce the amount that will be captured by the acquiring bank, as required. The remainder of the reserved funds will be released to the customer s bank account. Condition 4: For partial refunds where funds have been captured The extension will initiate a partial refund for the specified amount. Secure Trading Limited 2017 3 August 2017 Page 31 / 38

6 Testing and Maintenance Magento is written in PHP and runs on an HTTP webserver. Secure Trading s typical testing environment is a LAMP (Ubuntu OS) or WAMP (Windows OS) stack. Due to the enormous variety of possible environments that may run this module, (each webserver has its own peculiarities and has its own set of PHP version distributions) we recommend that each installation or upgrade is thoroughly tested on a staging system before being deployed to production. Once the module is deployed to the stage system, we recommend running test cases with a similar workload as is expected on the production system. As with all test systems, we recommend that you replicate the production system in terms of hardware and software setups to eliminate any possible anomalies. After the module is deployed to a production system, we recommend that all available log files are monitored and if any unexpected behaviour is detected, appropriate personnel should be alerted immediately. All production system changes should adhere to a strict change-control process to reduce the likelihood of release issues. 6.1 Compatibility This extension has been tested with a default installation of Magento. We cannot guarantee the behaviour if any core code has been modified or if any additional modules have been enabled. Any functionality not described within this document is not guaranteed to exhibit the expected behaviour. If you have any queries on Magento features not covered in this document and whether the SecureTrading extension supports them, please contact the Support team (section 8.1). Secure Trading Limited 2017 3 August 2017 Page 32 / 38

6.2 Troubleshooting Symptom(s) Click Place Order on the checkout, but payment is not processed. Error message: There was an error processing your order. Please contact us or try again later. Suggested solution(s) In the configuration settings, if Verify SSL Certificates (Web Services) is set to YES, ensure that the file path has been set correctly in the SSL CA FILE (Web Services) field (see section 4.1.3.4). Ensure you have installed the extension correctly, by following the instructions outlined in section 3.1. Payment module not displaying within System > Configuration > Payment Methods If this does not resolve the problem, please change the file permissions / CHMOD settings of the extension (temporarily) to 777. This will give it full access to READ, WRITE and EXECUTE. Ensure the file permissions are set securely before going live (at least 755 ). Cannot see the checkout when you have enabled API checkout. Please ensure you have selected at least one payment type from the Accepted Cards in the configuration settings (see section 3.2.1.3). Customer can t use saved card details with tokenization Please ensure that your Config Inheritance is set to the appropriate connection type (see section 4.2.1.2) and that your Web Services credentials have been entered correctly (see section 3.2.1.2). Transaction not processed in the displayed currency. Magento allows your storefront to display multiple currencies to the customer. Regardless of the currency that the customer is viewing the transaction will be processed in the Base Currency that has been configured for the store. Secure Trading Limited 2017 3 August 2017 Page 33 / 38

6.3 Updating the Extension As part of maintaining and improving the Magento extension, Secure Trading will release updates, periodically. As such, we recommend regularly checking the Magento Connect Manager for new versions of the extension. We have a separate document dedicated to providing information on updating and upgrading our module; you can find a copy of this document here All new versions of the extension will also be available on the Magento Connect website: http://www.magentocommerce.com/magento-connect/securetrading.html Click Follow this extension to be notified when the extension is updated. The STAPI client connection is being discontinued in this version of the extension. In order to continue using this extension, you will need to switch to our Web Services connection to allow the extension to communicate using our APIs. Please refer to our Update Guide for full instructions. This document can be found on our Magento Connect page: http://www.magentocommerce.com/magento-connect/securetrading.html 6.4 Log files It is good practice to monitor your logs regularly. To enable logging, ensure that this is enabled within Magento in the following location: System > Configuration > Developer > Log Settings Two SecureTrading log files will be created: <Magento Directory>/var/log/securetrading.log <Magento Directory>/var/log/securetrading_api.log Logs all interactions between the Magento extension and STPP (Secure Trading Payment Platform). Logs all errors processed through the Secure Trading API, except for error codes 0 (success), 30000 (invalid field) and 70000 (declined). In addition, exceptions will be recorded in the following: <Magento Directory>/var/reports/* or <Magento Directory>/var/log/exception.log as per normal Magento behaviour. Secure Trading Limited 2017 3 August 2017 Page 34 / 38

7 Additional Notes 7.1 Create Web Services Username In order to use Web Services on your Secure Trading account, a user account with the role of Webservices must be assigned to your site(s) using MyST. Sign into your MyST account and click Add new username from the left side menu and fill out the form as follows: Username - Valid email address hosted on your server. Password - Enter a password. Role - Select Webservices. Valid IP/network(s) - Enter your system s IP or range of IPs. Multiple IP addresses can be separated with either a semicolon (;) or a comma (,). Role if invalid IP - Set this to Prevent login. Under the Manage sites tab, select the site reference you use on your Magento store. Then click Save. Once you have installed the new extension, you can go to the configuration settings and enter the Web Services username and password (this is explained in section 3.2.1.2). For more info on managing users on your Secure Trading site, please refer to the MyST User Guide All Secure Trading documents can be found on our website. 7.2 Multishipping purchasing This extension supports multishipping; the ability for the customer to order a number of products at once and have them delivered to more than one address. Please note: An order represents one or more products being delivered to a single address. Therefore, multishipping consists of a single transaction used to fund multiple orders. Please note that cancelling an invoice by clicking the Cancel button on an invoice page will only affect your order in Magento (status changes to Processing), and will not change the state of the payment on Secure Trading s systems. To cancel a payment, you must either click Cancel or Deny Payment at the top of the order view. _ Only the delivery address of the first order is recorded in Secure Trading s systems. For multishipping orders in status Payment Review, accepting any order will ALWAYS accept all associated orders (even if any of the invoices have previously been cancelled), and the customer will pay the full authorisation amount. Likewise, denying any order in a multishipping purchase will ALWAYS deny the other associated orders, and the funds will not be captured. If you would like to only accept part of a multi-shipping purchase, you must accept all the orders by clicking the Accept Payment button in the order view and manually refund the order you wish to cancel (by using credit memo). Secure Trading Limited 2017 3 August 2017 Page 35 / 38

7.3 Failed payment attempt When a payment attempt fails at the checkout, the attempt will not be logged in the order history (in Sales > Orders ). To view details of failed payments (e.g. declines), please refer to your logs (see section 6.4). 7.4 PayPal support PayPal is not supported as a selectable payment type within this extension. 7.5 ideal and Sofort support This extension does not currently support payments processed with ideal or Sofort through Web Services. However, we do provide support for ideal and Sofort transactions in our alternative workflow, which uses our hosted Payment Pages solution. Relevant documentation can be found on our Magento Connect page: https://www.magentocommerce.com/magento-connect/securetrading.html 7.6 Transaction reporting In addition to the transactions being reported within the core Transaction screen Sales > Transactions, the extension adds a Secure Trading customized Transaction page called ST Transactions. Hover over Sales in the options along the top of the page and click ST Transactions to view all ST successful transactions logged within Magento. Alternatively, click the ST Transactions tab on the left side menu when viewing a single order to list all directly related transactions. Transactions are only shown in the transaction page following successful orders. (e.g. declined transactions are not shown). Secure Trading Limited 2017 3 August 2017 Page 36 / 38

7.7 Multi-currency configuration Option Base Currency Default Display Currency Allowed Currencies Comment This can be established per store and is used to configure all other allowed currencies. This is the main currency for the store and will always be used when processing a transaction. This is the currency that will be displayed to the customer when they first view your store. This currency must be one of the Allowed Currencies that you have selected. This is all of the currencies that you want to allow the customer to view your products in. For the option to be visible you must set up a currency conversion rate between the selected currency and the Base Currency. Regardless of the currency that the customer is viewing the transaction will be processed in the Base Currency that has been configured for the store. Further information on currency setup is outside the scope of this document; please refer to chapter 6 of: http://merch.docs.magento.com/ce/user_guide/resources/pdf/magento_community_edition_us er_guide.pdf 7.8 Multi-store configuration Multiple storefront setups are supported by our Web Services module without any further configuration required. To learn more about multi-store, please refer to chapter 7 of: http://merch.docs.magento.com/ce/user_guide/resources/pdf/magento_community_edition_us er_guide.pdf Secure Trading Limited 2017 3 August 2017 Page 37 / 38