Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

0
votes
1answer
46 views

PCI CVV requirement - encrypt prior to authorisation?

Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorisation has occurred. In other words the restriction on storing sensitive authentication ...
4
votes
1answer
49 views

If my company receives credit card statements showing credit card number, does it have to be PCI compliant?

I understand PCI requirements on the storing, processing and transmitting of credit card information (PAN, expiration date, no on CVV, etc.). However, I found nothing about receiving PAN (no ...
3
votes
1answer
53 views

Is it possible to generate valid track 1 and track 2 data from basic CC info?

We are working on a local security program and need some help. Is it possible to generate valid track 1 and track 2 information contained on your magstripe from your basic CC info? Basic CC info ...
11
votes
1answer
2k views

Properly masking credit cards

I'm wondering if the following masking of credit card would be considered PCI compliant. ######??????#### # Is plaintext ? is redacted Expiration date is available in plaintext Is it ...
3
votes
2answers
82 views

Card number leaked, any consequences?

Someone I know made their credit card number available for a large audience. As described in this question, one can bill without CCV code. So, given the card number and no other info (no CCV, no ...
4
votes
1answer
111 views

Is it possible to clone my contactless debit card while it's in my pocket?

I have a bank account that I never use, someone cloned my debit card and used it to buy something in Brazil in order to make sure the cloning was successful then they started making transactions of £...
2
votes
2answers
91 views

Using browser AJAX to initiate credit card transaction with processor?

Let's say that I have a website where people can make purchases, donations, etc. The entire website is served with https. I store the information regarding the purchases (item, quantity, price) as ...
3
votes
1answer
82 views

Is it PCI compliant to write down credit card information on paper and store it in unattended boxes?

There is a local mom and pop video store that requires new customers to write their names, addresses, and credit card information on 3x5 cards. These cards are actually kept in a recipe cards box that ...
7
votes
2answers
120 views

Is having a piece of paper with 2 fake PINS a good solution to mitigate credit-card theft?

I am planning to travel and thought about credit-card theft. Would it be a good idea to have a piece of paper with 2 fake PINs near my credit-card? The imagined attack goes as follows: The piece ...
2
votes
2answers
46 views

Interaction between cash register and card terminal

A store allows you to join their loyalty club by simply presenting an ID and a credit card. Your identity is somehow linked to your card and automatically registered the next time you pay, no extra ...
30
votes
4answers
5k views

Hotel reservation. How is this secure with only credit card number and expiry date?

Until today I managed to avoid paying online with my credit card (I'm weird, I know...) but somehow I managed to do it. Today though I had to book a hotel room (on booking.com) that required a ...
3
votes
1answer
156 views

How safe is my contactless bank card?

In the past few years Contactless Payment cards have been introduced and I have been reading some articles surrounding security of these cards. The following article "Stealing data from contactless ...
1
vote
1answer
51 views

PCI Compliance requirement when storing card data on user's device

I have an application where I take the user to a PCI compliant payment gateway for completing the payment. I want to give the functionality of "Remember my card" so that the user does not have to ...
6
votes
4answers
114 views

How can I protect my credit card on sites where 2FA is not an option?

I'm using Visa Express, and sometimes when I'm shopping, the store doesn't support Verified by Visa - so that means that there is no 2FA option. Normally when there is that option, it will force me ...
0
votes
0answers
42 views

Best practice for Users to avoid fraud for Direct Debit enabled bank accounts?

Direct Debit or automatic debit transfer system or Bankeinzug (German), seems a common/convenient way to pay in (online shops in) many countries available for many banks. https://en.wikipedia.org/...
5
votes
2answers
156 views

Can I repair a cut-through credit card?

On many cards there's the instruction to, if found, cut it in two pieces and mail them to some address. I'm wondering a bit about the security of this and if I could recover some data. It's not ...
0
votes
1answer
42 views

How to export application metrics out of PCI environment

I am building a credit card tokenization/payment-processing service. As these services need sit in pci-compliant environment, I find it hard to export the application metrics & logs. Anyone knows ...
0
votes
1answer
85 views

PCI-DSS compliance in scope if part of card number and expiry stored only? [duplicate]

If we were to store the following information about a credit card, would we need to be PCI-DSS compliance or are we out of scope? Please assume for the purposes of this question that we only store ...
2
votes
1answer
75 views

Router as MITM to steal data

I was reading a blog post about ATM skimming and the following quote (at the end of the article) caught my eye: Ivanov allegedly used two devices — a router to steal the bank data of customers ...
2
votes
0answers
45 views

Algorithm to generate (and verify) string of 4 quad alpha numeric code

I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
8
votes
1answer
105 views

Is CVV calculated or merely assigned?

Is the 3-digit (4-digit for those acolytes of standardization, American Express!) CVV/CSV/CVC calculated from card number and expiration date, or is it merely assigned? I know that once when I got a ...
2
votes
3answers
147 views

Emailing debit card details to a guesthouse

I'm trying to arrange a holiday out to the Aran Islands, and the guesthouse emailed me back confirming that they do have a room available. But here is the catch: they want me to email my credit card ...
4
votes
1answer
77 views

Wiping magnetic stripe on card with magnet?

I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data. Pretend I am about to ...
0
votes
1answer
101 views

Unauthorized credit card payment

I have a debit card which links to my savings account in a let's call it Bank A. I had never used it for online purchases/transactions (not even interbank transfer). After a while, I purchased virtual ...
0
votes
1answer
104 views

What's the best way to test if an RFID blocking wallet is effective? [closed]

I was recently gifted a wallet that alleges to block RFID signals. As I am sure you fine folks at Information Security are aware, this is to protect the information stored on my contactless bank card ...
9
votes
2answers
2k views

What are the security implications of my credit card number being known by someone else? [duplicate]

I am new to the credit card world. What are the security threats or possibilities, if someone knows my credit/debit card no. Will he be able to misuse it or will he require any additional information ...
9
votes
1answer
199 views

How do EMV contactless cards protect against replay attacks?

I understand that standard RFID cards are vulnerable to replay attacks however, how do smart cards which are also contactless protect against replay attacks? Is this decided by the chip or by the ...
4
votes
2answers
133 views

Does EMV protect against sniffing PAN data from untrusted network?

I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm? To quote from the link below: http://www....
4
votes
0answers
38 views

Major UK company seems to be handling customer & card data recklessly [duplicate]

A company I used to work for is passing customer's personal details as well as card data (number, expiration date, name, CVV2 and the contents of the magstripe thanks to a reader) through Windows XP ...
2
votes
4answers
83 views

Is knowing someone's card expiration date a means of finding info about them?

Card as in debit or credit cards. I heard that even showing someone your debit/CC can be considered an exploit not because of the number or name, but because of the date of expiration. He said that ...
3
votes
3answers
247 views

Creditcard store first six digits PCI reference

I need to store masked PAN with first six digits and last four digits along with the card expiry month and year. Is it safe to do it according to the PCI rules? Regarding four digits has been ...
1
vote
1answer
66 views

Is it dangerous to have a credit card payment page without authentication?

The client wants a payment page that anyone can browse to, put in their information and id from a previous registration, and make a payment. The problem is that the id is from a different system and I ...
2
votes
3answers
84 views

Reporting Credit Card Thieves

Someone is using a client's commerce site to check the validity of lots of credit cards. After dropping IP addresses based on usage whoever is behind it throttled their requests down to 1 request ...
5
votes
3answers
838 views

Cardholder data segmentation for PCI compliance (3.2)

We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B Over channel A (mobile carrier) we collect the first 8 ...
0
votes
0answers
41 views

Hash function for credit card [duplicate]

Hey PCI and hash expert, What hash function is good for hashing credit card and providing collision resistance? Some context: We are building a tokenization service, so each credit card will have ...
4
votes
1answer
397 views

Credit card tokenization algorithm

Just curious, what is the common algorithm used to tokenize a user's credit card? I know lots service use PRNG (random number). Does it just re-gen a random number when there is a confliction? What ...
0
votes
5answers
464 views

Is it safe to tell credit card number to bank employee over a phone?

Recently, I got a new credit card via post. To activate it, it is required to call to the bank (phone number is attached to the card) and confirm, that card was received. For activation purposes, the ...
4
votes
2answers
133 views

How to manually disable the no contact card?

New payment cards in my country are now delivered with the no-contact option that allows pay without putting the card in a machine. The fact is that these cards aren't secured because you can read ...
8
votes
4answers
791 views

When paying for something on line, is paying with a checking account less risky than paying with a credit card?

If I purchase something on line and am given the choice to pay with a checking account (also known as a current account) or a credit card, is the risk of my checking account data being stolen and used ...
4
votes
1answer
227 views

Clone debit or credit card

I would like to make some workshop about Debit or Credit card fraud (Skimming). So I need as much as possible information about it. Is it possible to clone debit or credit card with MagStripe reader ...
3
votes
2answers
167 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
0
votes
2answers
187 views

If I browse a website over HTTPS using a VPN, can the data be sniffed somehow?

I bought yesterday a flight from an American website. In my country, tickets are too expensive. Therefore, I used a IPVanish VPN to browse the airline website. It appears as if I visited it from New ...
1
vote
2answers
88 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
1
vote
2answers
114 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
3
votes
2answers
161 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
52
votes
6answers
6k views

Has a benefit been demonstrated for credit card machines asking for ZIP code?

In the U.S., many credit card machines at places like gas stations have started asking for your ZIP (postal) code to use a credit card ostensibly to help verify that you really are the cardholder, ...
3
votes
2answers
228 views

Does Visa Checkout have preventive measures against spoofing?

A few online merchants are offering special deals for using Visa Checkout, a payment service similar to PayPal, so I've been trying to learn something about it before signing up. When you are on a ...
1
vote
2answers
50 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
1
vote
2answers
73 views

Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card

Our company got a new card printer for employee IDs. It was a bit expensive and we had to undergo a background as it allowed us to print both mag strips and EMV chips. I don't understand enough about ...
4
votes
3answers
565 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To "...