Our organization has a setup with multiple sites set up as subdomains (each representing a different sub-company) with each subdomain (sub-company) having their own Authorize.net Merchant Account. On these sites customers can make purchases that post to that team's Authorize.net account and the orders populate within that sub-company's subdomain. Each site is using the Hosted Form.
We have been experiencing an issue where customers have reported a transaction posting to their account without having received their order. Upon investigating we found that these transactions have resulted in the orders populating in a different sub-company's account. We're working to understand how this happened and are looking for some support to see if there's something wrong with our implementation of the Hosted Form.
Our process is as follows:
- Each of our customers has a unique Profile ID for every site they've made a purchase on that we have received from Authorize.net
- We store this Profile ID and when a customer is using a saved payment profile we query authorize.net using a key specific to the sub-company whose site they are on and the Profile ID to get the saved payment profile back from Authorize.net
- If a customer is using a new payment method a Profile ID, specific to the team whose site they are on, is created
We have found that the issue seems to be around the Profile IDs for the customers:
- Customer placed an order on Sub-Company A's site. The transaction went to Sub-Company B's Authorize.net account but the order was placed on Team A's site.
- Neither Sub-Company A or Sub-Company B had the customer listed in the Authorize.net CIM, even though we had a Profile ID specific to Team A, that we received from Authorize.net, stored in our database.
- Customer placed an order onSub-Company C's site. The transaction went to Sub-Company C's Authorize.net account but the order was placed on Sub-Company D's site.
- The Profile ID we had stored in our database from Authorize.net did not match the Profile ID's saved in the database, that came from Authorize.net, for eitherSub-Company D orSub-Company C.
We're looking for assistance in making sure we understand how the Profile IDs work/can be used, that we are using them correctly, or otherwise what could be happening that the Prodile IDs we are receiving and storing either aren't present or do not match between what we are storing and what is present in the CIM(s).
We are also pursuing this issue through Authorize.net support but hoping someone can help us quicker than that is moving.
