[indizine]

We did the site a couple of months back and it is not for us to "allow the client" to do something to their website or not.

I am in no position to tell the client what to do, only inform him which I have done, as already stated above.

He has been told quite clearly about PCI DSS compliance and I will be reinforcing this tomorrow when I speak to him again, the possible nasty outcomes this could result in.

However and all that said, the client is sensible and will listen once I clarify what's been confirmed here today, which was why does it work when it shouldn't (after all, it does work and PayPal have said it's fine and approved it so PP Pro works too!) and then what he needs to do to put it right (get x-payments). It's not his fault - he's being told and seeing something to what should actually not be happening but understandably, he wants to know why. He said the PayPal guy was adamant is should work on both sites and \I did say there is a chance this guy was not experienced or up to date on all x-cart versions, x-payments, etc.

There is no risk of him pointing any finger of blame at me, that is for sure. All clients get warned of what they should or should not do.