Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card.

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

share|improve this question
5  
This is not standard. I suggest she declines to do this. I cannot think of a single reason a legit merchant would ask to do this. Only two possible outcomes will come out of this. The first the mercant will use her credit card for fraud, and the second is in 6 months their images of said credit card will be leaked and it will be used by a different criminal. – Ramhound Aug 7 '12 at 17:22
1  
It used to be much more common, but it is still used now in various places. – Rory Alsop Aug 7 '12 at 19:01
    
Did you asked them if you could send an edited photo, with the date, billing number and total price written on the card photo with an image editor? – curiousguy Aug 25 '12 at 3:39
    
If its just a verification on who you are why cant they ask for a different kind of photo ID? It's suspicious when you are asked for either a passport or a drivers license even if you blank out the info – dosao Mar 4 at 0:11
    
No way. While some actually are legit, think about what would happen if that picture of your card was seen by an unhappy employee. – John Apr 28 at 17:53
up vote 12 down vote accepted

I've seen similar requests coming from foreign sites/companies just because of how they handle credit card payments.Think of credit cards imprinters. Some countries/merchants still use them and somehow they assume that an image of the credit card could be just as valid.

In the situations where I've come across this type of request, I have opted to send payment either via Wire transfer, Paypal or similar services. They were wholesale orders where the card could not be charged until the product was manufactured, etc.

share|improve this answer

It's not standard, and it's quite inadvisable.

The PCI security standard, with which any legit merchant will have to comply as part of their merchant account agreement, would require that a photo of the front of a card would have to be transferred using a secure, encrypted upload facility, stored encrypted at the merchant end, and, in the case of Amex cards which have the Card Security Code on the front, securely deleted after the transaction was authorised. It's very unlikely they've managed to get all this right, and if they asked you to send the photo through mail (or MMS etc) then clearly that could not be compliant.

That's not evidence of malice, but openly asking customers to do something non-PCI-compliant is evidence of incompetence, raising questions about their security in general.

share|improve this answer
    
If a company does something that is against the PCI security standard I considering that to be both incompetence and malice to be honest. In other words they are basicaly a stupid criminal in my eyes. I only give people a single chance to get things right in the form of security. – Ramhound Aug 8 '12 at 12:53

No it's not standard practice - in no way, shape or form does sending a photo of your credit card confirm your identity at all. Ignoring the fact that photos can easily be photoshopped, the fact that you physically possess a credit card certainly does not prove that you are who you say you are.

share|improve this answer
1  
Not only that, the photo does not even expire (until the photographed object expires), it trivially could be reused. – curiousguy Aug 25 '12 at 3:37

They tell you to cover most of the information on your card. They just want the last 4 digits, the expiration date, the picture, and your address. They wouldn't be able to do much with that: just a verification of who you are.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.