Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

Our web programmer needs our merchant account information to set up our ecommerce site. He is asking for the "processor name", "processor ID" and "merchant ID". If I provide him with the information is he going to be able to access our merchant account and take money out? ie. charging refunds to his credit card.

share|improve this question
2  
You should not give him this information. Have him design the system so this information can be filled by your company at a later time. – Ramhound Sep 13 '12 at 11:16
Well it seems normal that you need some sort of priviliges to setup a system, but why the processor name... Looks like pretexting to me, but that's probably too far-fetched – Luc Sep 13 '12 at 13:52

1 Answer

up vote 4 down vote

Could you be more specific as to your situation? How is the web programmer in question related to your company? Is he a permanent staff or a contractor? A proper contract should protect you reasonably well from such threats.

In more technical terms, there is no reason why your programmer needs your actual credentials. Sites like PayPal provides sandbox environments to test out transactions without actually involving actual money. Your programmer should be able to code the transaction system and provide a configuration interface where you can add in the actual details yourself later on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.