Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The case would be that someone with stolen credit card registers on my site, and uses the stolen credit card details to purchase services through my site.

How can I protect my eCommerce site from stolen credit cards? What actions can I take to validate the card before it is used?

share|improve this question
I am not sure what your concern is. Are you concerned that a stolen card would be used and that Visa/Mastercard/Discover/Amex would not honour the payment (you would later get a chargeback due to fraudulent use)? This is what systems like "Verified by Visa" are for. visa.ca/merchant/products-and-services/vbv/vbv-faq.jsp If you use their system you won't ever be chargedback for fraudulent users. Visa takes the hit on that. I am quite sure you could find similar payment systems from teh other card issuers with a little Googling. –  Rod MacPherson Aug 12 '13 at 14:42
add comment

2 Answers

Normally when using the card with an official payment gateway, a reported, stolen credit card should be marked as unusable. The card will be refused by the gateway.

If you really need advanced authentication before allowing a card to be used by the client, you should verify his identity by making the client send you a copy of his ID card or passport and a recent bill (water, electricity,...) which states his name and address. This address should be the same as on the credit card. Do note that this will make transaction a lot more difficult and cumbersome and make some clients go away.

Also make sure that when performing credit card transactions you are completely PCI-DSS compliant if you have to be. If your business is not PCI compliant there are various measures that the card brands can take, ranging from warnings and monetary fines to revoking your ability to process transactions entirely. More importantly, the PCI DSS allows you to assure your customers that you're protecting their credit card data appropriately. In case of a breach you can also be held legally liable by your customers.

share|improve this answer
add comment

I'm not sure how this would be possible. The only way to verify if the card is stolen would be to confirm with the issuer. If the user hasn't reported it stolen, the issuer will not be aware and will allow it to be used. If the user has reported it stolen then the card issuer will block the card.

Whether or not the transaction is successful is your only protection from a stolen card, surely?

share|improve this answer
You could look at additional measure like charging a small amount to the card and asking the user to verify the amount, or attaching a unique reference to the transaction for the user to verify. This would indicate that they have access to the statement but again not total proof it isn't stolen. –  Scott Helme Aug 12 '13 at 10:32
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.