Zipcode (Stripe AVS) Verification

It seems to me the last time I checked this, there was *no* support in Stripe for verification based on address.

According to https://support.stripe.com/questions/what-is-avs it's still pretty mild. Only zipcode verification is provided, only if you have that configured in your Stripe account.

You can enable this setting by heading to your account settings and choosing to “Decline charges that fail zip code verification.“ Note that this setting will only apply to charges where a zip code is provided and the particular bank supports zip code checks.

Since Zip code is not a universal concept (as the article says, "Address checks are primarily used in Canada, the UK, and the US".

So... I could see:

1. Making the postal code section of the Ubercart address somehow required. (I haven't looked to see whether this is possible, certainly not advisable for sites with international users.)
2. Advising site owners that they have the option of turning on AVS.
3. Collecting the address when so-configured
4. Delivering it in the charge.

A problem with this approach is I don't know how to test it well with test charges. According to https://stripe.com/docs/testing there are card numbers that can explicitly fail address check, but not based on an actual address/zip, so it's a bit of a questionable technique.

@sittard, you're in the UK? Is the site with the problem accepting mostly payments in the UK? Is information available about whether a majority of UK banks will do postal code verification?

I'm fine with adding this feature, just not entirely sure it will help many people. But it might. I'm glad to see Stripe has at least added the option of verification.

Here's a simple patch to accomplish what you want.

To use it successfully you must:

1. Add billing info to the Checkout Basic Settings (admin/store/settings/checkout)
2. Make Postal Code a required field in "Countries and Addresses" at admin/store/settings/countries/fields
3. In your Stripe account settings (on stripe.com) set it to decline cards that fail zip code verification. (https://www.evernote.com/l/AA_VuNnstW1H57k5F0TJxRyj1sZvlhyBa4UB/image.png)

You can test sort-of with the CC# 4000000000000036, but I wouldn't count on the results, since it's an automatic fail. Actual testing will require doing some testing with real credit card numbers, as far as I can tell, so this will need community review.

Thanks, those are good review points. (I won't be able to look at this again until next week.)

I recommend doing an actual charge attempt on your live site with a real card to see if the behavior is as expected. You can just refund with the stripe console.

If you have the Ubercart option 'Use the same address for billing and delivery by default.' or if the user has selected 'My billing information is the same as my delivery information'. Then I think an additional check is required to get the post code from the delivery pane rather than the billing pane. Testing if the checkbox 'edit-panes-billing-copy-address' is checked or not should work.

@rfay's patch uses the billing address fields zip code field. Even for deliverable items, the billing address field is present, and I don't think it is correct to submit the deliver address for Stripe validation either.

@sittard, could you please try a purchase with your own credit card, and the wrong postal code? If it succeeds, just use Stripe to refund it. If it fails, that's good.

I'm not sure it's necessary to do that.

From the Stripe dashboard, it's possible to see the Billing Address data (including postcode) being passed through from the website in the Charge API call.

As long as that data is coming through to Stripe correctly, this module is doing it's job. Whether Stripe then successfully block payment when the Zip doesn't match is up to them / up to the settings in the merchant's Stripe account.

I've not got time to run a test just at the moment, but presumably sittard could look at those payments that have gone through, and look at the full Stripe logs, to check that the Billing Address is coming through as it should.

I tested (in test mode) that the billing zip is coming through to stripe, but there's no decent way in test mode to verify the actual behavior when the zip is wrong.

>> there's no decent way in test mode to verify the actual behavior when the zip is wrong

Again, I'd query whether that's an issue for this module.

If the module passes the billing information through to Stripe, then it's doing its job correctly.

Whether Stripe then react correctly to different scenarios is a matter for them, and any problems to be taken up with their support team.

If this patch gets billing data going through to Stripe, then IMO it's RTBC.

This patch tries to handle the various cases where billing and shipping addresses are present. It also adds the "name" field, since that shows up on the Stripe dashboard and is useful.

Committed #15 with minor change to README.txt.

7.x-2.1 should be there in a few minutes.

Thanks!