5

CiviCRM 5.17.4 Drupal 7.67 Stripe 6.2.2

Our problem is we have a fairly complicated booking form with quite a few required fields and a stripe payment option.

When a client opts to pay by stripe, but then selects to continue before filling in all required fields, Civi of course warns that not all info has been entered and does not continue but Stripe will authorize the payment and it appears in the stripe dashboard as an uncaptured payment.

Some people simply don't notice the incomplete fields warning and abandon the booking.

They then complain that the money has been taken from their account despite not completing the booking. (From their point of view this is correct as Civi scheduled jobs only cancels uncaptured payments after one day) and they (or we) have no confirmation of the booking (which again is correct because they didn't complete the booking)

Is this behaviour right? We would far prefer it if Stripe didn't authenticate payments if required booking fields were not filled in..

Improve this question
4
  • what do you mean by booking? is this civievent? a donation page?
    – Xavier
    Commented Dec 9, 2019 at 9:02
  • I mean a booking for civi event
    – Dave Florence
    Commented Dec 9, 2019 at 9:37
  • Yeah, that doesn't sound correct to me, either. But is it actually taking the money before completion, or is it just putting a hold on the amount?
    – Alan Dixon
    Commented Dec 9, 2019 at 15:55
  • Its making it an uncaptured payment which is in effect a hold on the amount.. civicrm scheduled tasks runs a script that cancels uncaptured payments every 24 hrs which in effect makes it available to the client again, but they have no access to the amount till then....
    – Dave Florence
    Commented Dec 9, 2019 at 21:42

1 Answer 1

Reset to default
3

I believe this is correct behaviour.

The flow with Stripe is slightly opaque due to the complexity of maintaining a level of PCI compliance while using a CiviCRM form for payment.

The credit card part of the form is actually an iframe hosted with Stripe (that's what allows for the PCI compliance trick), which will take the credentials and test them by trying put a hold on the contribution amount, and then it'll pass back to the form a one-time "token" that can then be used to complete (capture) the payment.

That completion is only performed after the form is submitted, so it needs to have a reliable hold on the funds.

If you want the uncaptured hold to be release earlier, you can likely submit a PR and/or run the scheduled job more often.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.