Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are a medium sized company. Recently, one of the representatives of the finance department raised a question about the use of credit cards to shop on-line among different departments in our company.

His concern relates to cases when a person from Department X requests to make a purchase from a site directly from his/her office computer. The reason for doing so is having direct access to some sensitive data needed right at the moment of purchase.

Currently, a finance representative walks up to the employee's office and provides the CC number.

Obviously, the risk comes from the stored CC information under that session associated to the user profile in the on-line store. Several risk scenarios rises like this if the user accidentally makes more purchases with that CC information, if that information is leaked, or if the user account is compromised.

We have proposed solutions such as using pre-paid credit cards, Verified-by-Visa, or safetypay, which requires accepting purchases (Finance Dpt) by someone else after submitting a purchase order (Dpt. User who purchases). However, not all online stores accept these payment methods not even Verified-by-Visa.

Alternative solution is to make the purchaser sign a form where Dpt. X accepts all the responsibility derived from the use of this corporate credit card. Nevertheless, we think this measure lacks the prevention factor an information security strategy must embrace.

Any help?

share|improve this question
Have the purchaser use their personal credit card, then submit for reimbursement? Every company I have been with has resorted to this option if purchase orders aren't possible. – schroeder May 29 '14 at 15:39

Issue everyone with their own corporate card, so you can link each purchase to an individual.

share|improve this answer

The problem with credit cards is that when the numbers are shared, there is absolutely no way to link a purchase to a specific person. When there is abuse, you will never find out who was it.

Possible solutions:

  • Every employee gets an own company credit card
  • Only selected people from the purchasing department gets access to the credit card numbers. When someone needs to buy something, they mail them the link to the product page of the online shop and the purchasing department buys it.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.