Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We all know not to do it, but someone emailed my credit card number and cvv code to my gmail.

I'm wondering if the risk is so low I don't have to call to cancel my card.

The email is sent from a reputable ISP's email account, via its ADSL dialup (the ISP is the biggest in the country) to my gmail address. Is it safe to assume that the ISP, connected to the backbone, would deliver the email to gmail server without going through unsecured pc? So I don't need to cancel my card?

share|improve this question
    
This someone is my colleague who is buying something on my behalf. So email folder and account security are not an issue. I'm more worried about it during transit. –  Anddd Oct 5 '11 at 15:37
    
It is certainly a risk, but this incident made me rethink that maybe the risk is much lower than we perceive. Perhaps it is too easy to cancel and replace a credit card we automatic think canceling it is the only right thing to do. –  Anddd Oct 5 '11 at 15:40
1  
Send CCN by e-mail and CCV by SMS or vice versa? Well, if encryption is no-go. –  StupidOne Oct 5 '11 at 16:07
    
check the header to see through which servers the mail is sent and whether a secure line was used. –  ratchet freak Oct 5 '11 at 18:31
6  
Insecure protocols don't magically become secure. If it was insecure before, it is still insecure now. –  Piskvor Oct 6 '11 at 7:34

5 Answers 5

Let's see:

Even if what you say is right and ISP is solid as rock

  1. Do you trust this "someone"? If answer is no - cancel the credit card in any case.

  2. Your credit card number + CVV is now in this person "Sent" folder, if his mailbox will be hacked attacker will have you CC.

  3. Your credit card info will be stored forever on Google servers

  4. I would cancel it
share|improve this answer
4  
+1 for the sent items folder. An attacker can easily perform a search for numbers that resemble CC conventions. –  Wesley Oct 6 '11 at 17:32
2  
Trusting this person also means trusting them to secure their computer against malware. I.e. trust nobody :) –  Stefano Palazzo Oct 10 '11 at 17:51
    
+1 for the google servers. Though it is not feasible/possible to get it from there.. what happens to the copy of the mail when it is deleted from our boxes(trash includes)? though it only makes sense to delete it from the servers, i just want to make sure! –  Karthik Apr 24 '12 at 8:17
    
Who knows? Even if they say they delete it, can you verify that? Even if they've deleted it from their live server, what about backups? –  Stephen Touset Apr 15 '13 at 19:01

Email is not a secure way to share credit card numbers

The method you describe is not secure for a variety of reasons. These include:

Sending numbers in plain text is not secure

The technique you described could have involved you sending your card numbers in plain text (the act of sending the e-mail from the computer to the ISP). This is not secure. It could have been picked up in a variety of ways

E-mails are persisted in multiple places

That credit card number can now exist in multiple places

  • In the 'sent' folder of the computer from which it was sent
  • On the ISPs servers
  • In the Gmail account

Now that is just 3 places it could be stored, when you take in to account backups there could already be many, many copies of your numbers spread about across the world.

share|improve this answer

I think the above answers are correct and sending credit card details over email is insecure. However as you were specifically concerned about interception in transit rather than the various storage points mentioned in the other answers, it is at least worth considering a contrarian viewpoint:

Consider the attack tree:

Fixed networks (inside corporate):

  • An attacker would have to breach physical access controls (or be a photocopy repairman) or be an insider
  • Get past an NAC (but most companies don't have this) or have a workstation
  • In packed switched networks (all modern corporations) you just don't have access to a lot of broadcast traffic
  • So you have to to get access to a router or switch, assuming you are not a network admin this means exploiting a security misconfiguration or vulnerability (fine no problems metasploit exists, most organizations suck at patching especially network devices) but lets say you listen to Cisco/Juniper etc and patch every 3 months (at least the really bad stuff) or so and you at least authenticate everything to a RAS server
  • Even if you can get access, ARP poisoning, DNS cache poisoning whatever, then you have the next problem: volume. There is a hell of a lot of data that goes access a major router or key switch. Many are gigabit enabled now and that means drinking from a firehose. Even with a legit network DLP monitor you need a high performance packet reassembler, good hardware and software and then the ability do effective pattern matching. So getting that CEO's email very tough, getting the odd password probably not so bad
  • This data is also transient - once the packets are gone they are gone (although admin logins can happen often) but there is a limited window of opportunity
  • Alternatively you could do what I talked about earlier which is put the sniffer on the box you want to monitor, again though same problem assuming reasonable access which is a misconfig or security vulnerability, or lack of anti-malware controls. Also with the first two it is a lot more targeted attack

Public networks:

  • Seems like a lot easier target - you can no longer be comfortable about access controls of intermediate boxes or network devices
  • But lets look at something like email - most Mail Transfer Agents (MTA)'s including big ones like Google now use optimistic TLS which means, the majority of your email which arguably holds a your most sensitive info, is likely to be encrypted in transit without you having to do anything more
  • Even shared MPLS networks have VLAN tagging
  • Again you have the firehose problem but a million times worse and the transient information page
  • See how many actual exploited loss incidents you find on datalossdb.org or web app sec incidents on interception of data in transit

Wireless network:

  • Corporate: WPA2 is a de-facto standard, its not perfect but you are getting encryption without doing anything more
  • Home/Starbucks etc: This is a legitimate risk in fact the best and only example that OWASP gives for no. 10 lack of transport encryption is interception on an unsecured home wireless network - hell even Google cars on streetview can do it. But even here most/all corporates that provide remote access provides a VPN so do you need anything more?

Full blog post: http://www.rakkhis.com/2010/08/why-ssl-is-just-not-that-important.html

You should probably still cancel the card, but considering other controls such as the limit on the card, if you have 3D secure (e.g. verified by visa) enabled, you monitor your statements, your banks fraud detection systems; if these make the risk within your risk appetitite you may decide the risk of interception in transit or storage is low enough for you to accept.

share|improve this answer
1  
Correction to "which means the majority of your email (...) is encrypted in transit" - I'd say "which means that the majority of your e-mail could be encrypted in transit - maybe it is, maybe not". –  Piskvor Oct 6 '11 at 7:22
    
@Piskvor ok fair point, if the MTA does not support TLS is will not be encrypted, we investigated about 1000 and found only 1 that did not support opportunistic TLS. Updated wording to likely to be. –  Rakkhi Oct 6 '11 at 22:30
    
Fair point, good to know, and it does reduce the risks somewhat. Thanks for sharing that :) –  Piskvor Oct 11 '11 at 13:18
    
+1 Good answer! –  Yoav Aner Apr 23 '12 at 18:19
    
About the WPA2 WiFi network, just keep present that if WPS is enabled on their access point, then the WPA2 network is substantially easily crackable, see here for more information sviehb.wordpress.com/2011/12/27/… –  Max May 9 '12 at 19:02

Google's mail servers do support AUTH TLS as preferred so there is a good chance that your credit card was in transit encrypted. Again, now you have 'track 2' data stored that shouldn't be, namely your CVV.

If this credit card is actually a debit card, I would most certainly cancel right away. Credit cards have pretty good protection/hassle-free about fraudulent activity. I certainly would feel uneasy, and you too probably feel uneasy as you wouldn't have posted the question, so I would probably just get the credit card re-issued.

If that "someone" is a merchant, you may not want to do business with them if they are so cavalier with your cardholder data. If that person is someone trusted then you need to evaluate the reason why your card was transmitted to you in an e-mail and fix that process.

share|improve this answer

I would still advise you to replace your card to be on the safe side, but if it was MY card, I wouldn't worry about it.

You obviously shouldn't increase the risk to your credit card unnecessarily, but with all that being said, do you replace your card every time you pay in a restaurant and the waiter goes away with your card and brings it back?

When you consider the added risk to your card in this particular case you described, I think it's worth considering other risks to your card during its usage (usually over a span of a few years). Other scenarios of card usage typically include:

  • Restaurants/Bars - have you never paid with a credit card before? How easy it is to write down or memorize your card details
  • Call Centres - have you never given your card details over the phone?
  • Shops (do you ever notice how many shops have CCTV cameras?)
  • Community centres / gyms where you are a member
  • Of course so many websites that you don't have any way to know who has access to those details

There are a lot of places where someone can get both your card number and CVV + expiry date and in many of those situations they might already know something about you like your full name and address and maybe even your date of birth.

So comparing those risks, which pretty much anybody with a credit card has to take, to this one email (and good overview from @Rakkhi about what it means to be able to grab this email): I think the other leak scenarios are far more likely than from Gmail or from someone sniffing the network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.