Tagged Questions

Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

4
votes
1answer
79 views

When does an Apple Pay token get converted to a real credit-card

Apple Pay says they store a Token on the phone and use it for transactions. Who issues this token? Who then converts this token to a real credit-card. Where is the mapping from token to real card ...
5
votes
2answers
96 views

Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the ...
1
vote
0answers
31 views

Using chip and pin credit card for authentication?

I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (it's just a side project with no real use other than securing a ...
2
votes
2answers
43 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
3
votes
1answer
72 views

Storing Credit Card Information on Mobile Phones

I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me. The app allows a user to ...
6
votes
3answers
325 views

How does credit card authorization work

Few days ago I heard a professional scammer explaining how he exploits the banks, I cant find the right word to describe his actions, even the word scam does not fit as he is not breaking the law but ...
2
votes
2answers
50 views

In this instance, is code+security code really more secure than just a longer code?

On credit cards, the security code is printed on the back of the card (usually), on the premise that having a credit-card slip or photo of the front of the card won't allow you to use it fraudulently. ...
52
votes
10answers
11k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
1
vote
1answer
64 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
3
votes
3answers
150 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
-6
votes
1answer
111 views

Is www.cheap-lingerine.com safe to use my credit card on? [closed]

I want to make sure my information is safe. This website is openly china-oriented but says to secure card information with Secure Sockets Layer technology (SSL) on those pages that involve sensitive ...
1
vote
2answers
89 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
0
votes
1answer
69 views

Credit card fraud preventions [duplicate]

Ok lets say some one have clone my debit card here in Greece all debit cards have and stripe and chip and lets say in a way he knows my pin and all my information and he put the info on a blank card ...
1
vote
1answer
133 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
1
vote
2answers
94 views

Does changing credit card numbers provide better security over time?

I've always contacted my bank and credit card provider every year and simply asked to change my credit card number itself (and get a new card). They do so without a hassle and I feel more secure in ...
0
votes
1answer
216 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
1
vote
2answers
58 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
1
vote
2answers
53 views

Isnt the 3D secure system essentially completely ineffective in avoiding fraud?

3D secure is a system where, after you enter your credit card details on a merchants site, you are redirected to a site hosted on the bank servers where you enter a OTP sent via SMS to complete the ...
1
vote
2answers
95 views

How do credit cards with chip+pin securely allow recurring transactions?

In Europe most cards use a chip+pin system to secure the card information. You put the card in te machine and enter a PIN number to decrypt the card information which is stored on the chip. ...
1
vote
2answers
125 views

What Can I Do While I'm Waiting for “Chip and Pin” Credit Cards?

For the second time in 8 weeks, one of my American Express (AMEX) card numbers was stolen. I do use the card online, but only at reputable (and SSL/TLS enabled sites). I use it in the real world, ...
27
votes
7answers
4k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Edit Looking for ...
0
votes
0answers
49 views

How can a website charge my credit card when I entered an incorrect CVV? [duplicate]

I just created a free account on Pluralsight.com and entered my credit card details, but I entered my CVV incorrectly. How can they charge a payment to my credit card even though I entered an ...
1
vote
1answer
107 views

I left my debit card unattended — how exposed am I?

I yesterday visited a restaurant I usually visit, but it seems that after paying with my debit card, I accidentally left it there. Today (almost 24 hours later) I had realized that I didn't have it ...
0
votes
1answer
46 views

TPM-esque Credit Card Solutions?

Lately, there have been a couple of projects which aim to replace all the credit cards in your wallet with a single smart device which will hold all of them, sync with your smartphone, etc. (Namely ...
3
votes
3answers
172 views

What are some cards that are vulnerable to RFID theft?

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
1
vote
4answers
241 views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
1
vote
2answers
94 views

Why is filling up at the gas pump require a quick scan of the Credit/Debit card?

Always wondered about this. I had a friend tell me it's to make sure your information can't be stolen as easily on the credit card, but I will admit I am a bit skeptical of his claims. At most gas ...
6
votes
4answers
349 views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
2
votes
1answer
100 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
5
votes
4answers
271 views

How can I convince my customers not to send Credit Card data over email?

My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process ...
1
vote
1answer
156 views

is it illegal to share customer credit card data

I have an app where users can enter credit card data and it is stored using a 3rd party toservice like BluePay or Authorize.net, I do not and will not save it in my system. Trying to get this point ...
0
votes
2answers
104 views

How do gift card resellers prevent sellers from re-using pin and card numbers

There are multiple gift card reseller sites that buy your gift cards and resell them at discounted price. I was wondering how these sites prevent sellers from reusing the pin and card number after it ...
1
vote
2answers
52 views

Security of Shared Corporate Credit Cards

We are a medium sized company. Recently, one of the representatives of the finance department raised a question about the use of credit cards to shop on-line among different departments in our ...
1
vote
2answers
211 views

Would chip-and-PIN have prevented the Target breach?

Would chip-and-PIN have prevented the Target breach? As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
2
votes
2answers
94 views

What's the point of EMV when only the card is needed to shop online?

In many countries, EMV is used to prevent credit and debit cards being cloned. But given that it's possible to perform online transactions using the details printed on the card, how does it add ...
0
votes
2answers
76 views

Can website see my payment information?

So I decided to purchase a service in website which only accepts payments where I need to enter my debit card information. Now connection is secured with TLS 1.0, so no 3rd party can observe my ...
0
votes
1answer
298 views

What is the point to the IPEK in DUKPT?

I'm trying to understand the DUKPT (Derived Unique Key Per Transaction) system used for PIN devices, but I'm getting hung up on the IPEK. This blog post has an image where the sequence is: BDK ...
3
votes
1answer
130 views

How easy is it to make a malicious bank/identity card?

I recently got a magnetic card reader that plugs into my computer because I was bored. I decided to scan my ID and bank card through it and I was surprised to see my ID number/bank card number show up ...
2
votes
0answers
78 views

Should I cancel my current credit card because of heartbleed vulnerability? [duplicate]

I recently looked at my local credit union bank and they said that their site is not vulnerable to heart bleed. However, I have used my credit card in many websites such as grubhub, amazon, some ...
4
votes
2answers
108 views

Are invalid card numbers under PCI compliance

If a merchant sends an invalid card number to the bank, will the bank have to secure the information to be PCI compliant?
2
votes
1answer
57 views

How to protect myself from future fraud? [closed]

Recently, I had my credit/debit card from my bank "stolen." The thieves somehow got my card number and information and took quite a bit of money from my account. Fortunately, I was able to recover it ...
2
votes
1answer
131 views

EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV

Ok I understand from my research that the Chip Card creates an AC Key(MasterKey+AccNumber) to communicate with the authorizing server securely (3DES key to have encrypted communication) but I don't ...
0
votes
1answer
90 views

Is it safe to recycle unshredded credit card receipts?

Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
0
votes
1answer
88 views

Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form? [closed]

Does anyone know how you can take the encrypted output of a square card reader and insert it directly into a standard web form?
0
votes
1answer
84 views

Credit card data [closed]

I want to scan files for is there any credit card information.I searched for find good product. I used this application card recon Is there any similar product like that for find credit data ...
3
votes
1answer
147 views

Improving magnetic stripe card security with a “magnetic noise” hash?

I was reading the wiki on magnetic stripe cards when I stumbled across this sentence: "Magnetic stripe cloning can be detected by the implementation of magnetic card reader heads and firmware that can ...
0
votes
2answers
512 views

Is it PCI compliant to send credit card details to the server without saving them there?

Considering I use SSL the whole process. I have an IOS client that I want to use to enter the user's credit card details. I want to do the whole charging and processing on the server side, so I send ...
0
votes
3answers
394 views

Bank cards - chips vs mag stripe security

In this thread: Why are chips safer than magnetic stripes? the answers all seem to be that the chip cards are far more secure and difficult to copy. Here is my problem, and my question. A couple of ...
139
votes
5answers
22k views

Why are chips safer than magnetic stripes?

After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip. In what ways are chips safer than stripes?
3
votes
1answer
126 views

PCI Complient Storing Credit Card Data On Offline Tablet

I have a client that does work in rural areas where there are no cellphone or internet connections. They need a way to take credit card information in the field, bring it back to their office where ...