Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card.

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

share|improve this question
3  
This is not standard. I suggest she declines to do this. I cannot think of a single reason a legit merchant would ask to do this. Only two possible outcomes will come out of this. The first the mercant will use her credit card for fraud, and the second is in 6 months their images of said credit card will be leaked and it will be used by a different criminal. –  Ramhound Aug 7 '12 at 17:22
1  
It used to be much more common, but it is still used now in various places. –  Rory Alsop Aug 7 '12 at 19:01
    
Did you asked them if you could send an edited photo, with the date, billing number and total price written on the card photo with an image editor? –  curiousguy Aug 25 '12 at 3:39
add comment

4 Answers

up vote 5 down vote accepted

I've seen similar requests coming from foreign sites/companies just because of how they handle credit card payments.Think of credit cards imprinters. Some countries/merchants still use them and somehow they assume that an image of the credit card could be just as valid.

In the situations where I've come across this type of request, I have opted to send payment either via Wire transfer, Paypal or similar services. They were wholesale orders where the card could not be charged until the product was manufactured, etc.

share|improve this answer
    
Yes - I have seen this with small companies in various countries. It's odd, and I don't like it, but this practice does exist. –  Rory Alsop Aug 7 '12 at 19:01
    
Fascinating, thankyou! –  JMK Aug 8 '12 at 13:58
add comment

No it's not standard practice - in no way, shape or form does sending a photo of your credit card confirm your identity at all. Ignoring the fact that photos can easily be photoshopped, the fact that you physically possess a credit card certainly does not prove that you are who you say you are.

share|improve this answer
    
Not only that, the photo does not even expire (until the photographed object expires), it trivially could be reused. –  curiousguy Aug 25 '12 at 3:37
add comment

It's not standard, and it's quite inadvisable.

The PCI security standard, with which any legit merchant will have to comply as part of their merchant account agreement, would require that a photo of the front of a card would have to be transferred using a secure, encrypted upload facility, stored encrypted at the merchant end, and, in the case of Amex cards which have the Card Security Code on the front, securely deleted after the transaction was authorised. It's very unlikely they've managed to get all this right, and if they asked you to send the photo through mail (or MMS etc) then clearly that could not be compliant.

That's not evidence of malice, but openly asking customers to do something non-PCI-compliant is evidence of incompetence, raising questions about their security in general.

share|improve this answer
    
If a company does something that is against the PCI security standard I considering that to be both incompetence and malice to be honest. In other words they are basicaly a stupid criminal in my eyes. I only give people a single chance to get things right in the form of security. –  Ramhound Aug 8 '12 at 12:53
add comment

I wouldn't say that it was a standard practice but I have seen it done before, mainly on asian websites where fraud from European & US credit cards is high, its just a security measure to make sure that the person who is making the payment has physical access to the cards and that they are not stolen and in the form of a spread sheet.

The legality of doing this is questionable though, but I suppose of they only ask for the front of the card with name and number and not the reverse with the CVV security code then its pretty safe.

share|improve this answer
    
"pretty safe." you mean: just as inherently unsafe as any such sending of "confidential" informations to unknown persons? –  curiousguy Aug 25 '12 at 3:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.