Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Recently i came across one donation site which gets credit card info and makes donations, like the above donation site most of the site broughts donation on their own donation page instead of redirecting to external payment gateway pages My questions are as follows

  • As they are getting info at their domain based page ,i fear they might store our credentials(credit card and other info) before submission to payment gateway if they store the data insense how to protect us from this kind of hidden data storages?
share|improve this question
add comment

closed as primarily opinion-based by NULLZ, TildalWave, Adnan, Lucas Kauffman, Xander Jul 26 '13 at 11:41

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 3 down vote accepted

You can't and you don't need to. Normally if these websites are actually storing your credit card info they are required to be PCI-DSS compliant. If they are not, then it's up to the credit card companies to prosecute them.

Now you might be wondering what in the event someone hacks their database, steals my info and uses it to commit fraud?. Simple You are insured against fraud by your credit card.

All cards with MasterCard Visa logos covered by fraud policies that will not hold you liable for fraudulent transactions if a charge is made through their system. There are however some exceptions you need to take into account as you need to comply to the following ruleset:

  • Your account is in good standing.
  • You have exercised reasonable care in safeguarding your card.
  • You have not reported two or more unauthorized events in the past 12 months.
  • You do not have a commercial (corporate) card
  • Fraud was done by an ATM transaction

And just another golden tip if you don't trust the website, don't give it your credit card details.

Now without knowing or being able to assess the backend system, there is no sure way of saying how these transactions are performed by Charity Water. It could be that they use a backend system which is either PCI compliant or does not store the card details and just passes them on to a payment gateway without you knowing.

share|improve this answer
    
+1 if you don't trust the website, don't give it your credit card details.How to verify the websites are coming under pci dss compliant friend? –  BlueBerry - vignesh4303 Jul 26 '13 at 6:46
    
You can't verify their compliance, and only their credit card processor can tell you that if they've required the company to pass PCI-DSS assessments. This doesn't mean that they actually do pass PCI-DSS requirements as there's a lot of leeway for small operations. –  Fiasco Labs Jul 26 '13 at 7:09
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.