Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

2
votes
2answers
40 views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
0
votes
1answer
51 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
2
votes
3answers
92 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
3
votes
1answer
92 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
1
vote
0answers
23 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
51 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
1
vote
0answers
31 views

Why don't merchants use chip reader on credit card terminal? [closed]

Most merchants I've been to in the past few years have updated their credit card terminals to accept the chip+pin system. My credit card has had a chip for the past two years. Yet on these new ...
3
votes
1answer
74 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
30
votes
3answers
5k views

Why don't popular web services mask the CVV?

Most popular web services like PayPal, Google Wallet, and others do not mask CVV numbers, eg: (<input type="password">). As I read, the CVV is a security feature and it seems logical to mask it ...
2
votes
1answer
108 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
0
votes
2answers
43 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are ...
5
votes
4answers
180 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
4
votes
2answers
125 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
3
votes
2answers
103 views

Credit Card Fraud Prevention - Why Aren't Simple Things Used?

I use my American Express card every day, sometimes multiple times. I do a mixture of card-present and card-not-present transactions. AMEX has decent fraud detection and I get notified quickly if ...
14
votes
3answers
830 views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
2
votes
3answers
90 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
35
votes
5answers
9k views

How does a website know if a certain creditcard number is wrong instantly

I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, ...
0
votes
1answer
152 views

How does SAQ A-EP apply in the situation where no I frames are used

I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know. I use primarily Stripe and Braintree in ...
3
votes
1answer
122 views

How to mask SEPA (IBAN and BIC) information correctly?

I'm currently developing a payment system where users can use SEPA-debit to pay for the service. The user has the ability to enter the data once and can then select the same payment method when making ...
2
votes
0answers
91 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
0
votes
2answers
71 views

To which entity merchants must report credit card breach?

In the incident that a Marchand like Target or Home Depot, detects credit cards are breached, who they need to notify? Visa recommends informing the merchant bank, and/or Visa Incident Response ...
3
votes
2answers
325 views

Verifying credit card ownership

When a fraudulent credit card CNP (Card Not Present) transaction is made, merchant is liable for the chargeback. For that reason, our company implemented a policy where we ask a photo of customer's ...
0
votes
1answer
37 views

Viewing PCI data via 3rd party sites securely

I'm working on a project that requires PCI protected data (card PIN numbers) to be made visible to customers, via a Third Party (a non PCI compliant) company site. The hierarchy is as follows: Us ...
3
votes
1answer
530 views

visa gift cards untraceable?

I was in a retail store today, and these people were discussing how easy it is for people to use stolen credit cards, and buy those visa gift cards without being traced after they purchase the gift ...
1
vote
2answers
284 views

No HTTPS on Credit Card entry form - Can it be safe?

I was going to make a purchase on a website, but the page containing the credit card entry form is HTTP and not HTTPS. Is it definitely unsafe? The website advertises the use of "RapidSSL" but if I ...
0
votes
1answer
150 views

Lost CVV number automatically virus related?

If my credit card was used on Amazon, doesn't that mean someone has my cvv number? And would that mean I have a virus? Or is there another way they can get a CVV code off a credit card? I know it's ...
41
votes
8answers
6k views

What prevents web shop owners from misusing credit card data?

I don't own a credit card but read much about fraud with stolen credit cards. Since I don't own one, I don't know how you exactly buy online using your credit card, so please correct me, if I am wrong ...
1
vote
2answers
259 views

Does sending credit card info over email violates PCI DSS?

Being in the US, I have noticed that more and more companies ask to send sensitive credit card information (all information that is required to make a transaction) over a plain email. I believe that ...
3
votes
2answers
169 views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
1
vote
1answer
147 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
1
vote
0answers
57 views

Telling the difference between a prepaid card and credit/debit card

In order to stop people abusing free trials, we can make sure new users are not reusing data from existing users and therefore not just signing up with a new account every month. It is reasonably ...
1
vote
0answers
71 views

Collecting Pre-Authorized Debit (PAD) & Credit Card (PACC) Agreements Electronically

I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement ...
0
votes
1answer
116 views

How secure credit card order system with blank mail

I want to know how to secure credit card order with blank mail. My boss instructing to create new site like as below: 1) User send "Blank e-mail" to new site. 2) The site returns mail including ...
0
votes
3answers
160 views

Why do credit cards have chips, if I can purchase online without the chip being read?

Credit cards (and debit cards) are used in three different ways: In person + pin. The seller requires me to insert my card with the chip and input the PIN number to complete the transaction. In ...
4
votes
2answers
1k views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
0
votes
1answer
47 views

credit card security suggested scenario

I need to know the best scenario for a merchant inserting client's credit cards and expiry dates to process recurring payment for these cards. What I have in mind (and want your expert suggestions ...
3
votes
2answers
205 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
2
votes
0answers
102 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
3
votes
3answers
114 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
5
votes
2answers
111 views

Modifying credit cards to increase security

If I use a credit card only for chip&pin/EMV transactions and possibly for contactless transactions, I don't need the following parts of the card. magnetic stripe embossed numbers etc signature ...
4
votes
1answer
165 views

When does an Apple Pay token get converted to a real credit-card

Apple Pay says they store a Token on the phone and use it for transactions. Who issues this token? Who then converts this token to a real credit-card. Where is the mapping from token to real card ...
9
votes
2answers
4k views

Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the ...
3
votes
1answer
99 views

Using chip and pin credit card for authentication?

I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (for demo/entertainment purposes only so bulletproof security isn't ...
2
votes
2answers
66 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
3
votes
1answer
291 views

Storing Credit Card Information on Mobile Phones

I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me. The app allows a user to ...
6
votes
3answers
646 views

How does credit card authorization work

Few days ago I heard a professional scammer explaining how he exploits the banks, I cant find the right word to describe his actions, even the word scam does not fit as he is not breaking the law but ...
2
votes
2answers
67 views

In this instance, is code+security code really more secure than just a longer code?

On credit cards, the security code is printed on the back of the card (usually), on the premise that having a credit-card slip or photo of the front of the card won't allow you to use it fraudulently. ...
53
votes
10answers
16k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
1
vote
1answer
89 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
11
votes
4answers
449 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...