Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

0
votes
1answer
129 views

How secure are credit card readers? [closed]

Can the data be easily intercepted when (or after) the card is swiped? My main concern is at a trusted vendor. There are two possibly different situations: 1) a typical point of sale scanner with a ...
2
votes
3answers
108 views

Are there any reasons to be concerned about the security of “Coin”? [duplicate]

I just came across this: https://onlycoin.com/ A credit-card sized device that not only holds the info for as many credit and debit and membership cards as you want (they claim) but also can ...
2
votes
4answers
396 views

Storing credit cards to use for purchases on customer's behalf

My client physically makes online purchases (through various websites) on his customer's behalf using their credit cards. His clients have basically said "here's my credit card, buy what you need to." ...
0
votes
1answer
200 views

Is it possible that the same VISA debit card numbers could be issued to different people by different banks? [closed]

I'm wondering if is it possible that the same VISA debit card numbers could ever be issued to different people by different banks or companies?
1
vote
2answers
383 views

When paying online with a credit card, what is “3D authentication” and is it reliable?

I tried making a purchase from http://www.laptop-batteries.ca/ but on the very last step the page reloaded with an error. A representative contacted me asking why I didn't complete the order and I ...
3
votes
3answers
579 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
42
votes
10answers
16k views

Can a steel woven wallet prevent RFID scanning of credit card information?

According to the Popular Mechanics article RFID Credit Cards and Theft: Tech Clinic, the fact that many new credit/debit cards have a RFID chip embedded on it, there is a risk (albeit, small according ...
2
votes
1answer
1k views

How safe is the new iOS Keychain that stores credit card numbers?

iOS7 includes iCloud Keychain which syncs your stored passwords across devices. Not only that but it also syncs credit card numbers. The only information I can find about encryption is that they are ...
2
votes
1answer
275 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
1
vote
1answer
228 views

Is it possible for a NFC-enabled device to emulate a Visa card with PayWave?

If someone has access to the physical Visa card (and with that comes the number on the front, the expiry date, and three digits on the back) would it be possible for them to program a NFC-enabled ...
-2
votes
1answer
96 views

What are the security measures to be taken before launching a site with credit card payments? [closed]

We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
0
votes
2answers
817 views

Safe to email images with personal information? or use encryption for images?

It's common knowledge not to email credit card numbers or other personal information. How about emailing photographs that contain personal information, such as a photo of a deposit? Regarding plain ...
0
votes
3answers
388 views

How can I protect my eCommerce site from stolen credit cards?

The case would be that someone with stolen credit card registers on my site, and uses the stolen credit card details to purchase services through my site. How can I protect my eCommerce site from ...
2
votes
3answers
168 views

Alternative to charging 2 small amounts for credit cards authentication?

Currently the client I'm working for charge 2 small amounts on adding credit card to authenticate credit card. After that they ask end-users to check the exact amounts on their monthly statements and ...
3
votes
2answers
208 views

Why would one increment card security code for a new payment card

I have a debit payment card, once it expired I received a new one. The card numbers look like this Old card xxxx xxxx 1111 1111 New card xxxx xxxx 2222 2222 where x are the matching numbers and 1 ...
9
votes
2answers
12k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
1
vote
1answer
356 views

Advantages of using a Digital Signature Scheme (DSS) with Appendix instead of DSS giving Message Recovery

I've been looking at the EMV draft specification (pdf) for using Eliptic Curve Cryptography in payment cards instead of the currently used RSA. One thing I've noticed is that they've moved from using ...
3
votes
2answers
317 views

Storing credit card data on behalf of customers: and transfer the data later

I'm developing a web application for hotels that send offers to the guest's hotels. I want to store the guest's credit card data in a secure way, through a third party service as I don't want to ...
5
votes
2answers
524 views

Why are signatures considered a valid authentication method?

Why are signatures considered valid methods if identification when paying with a check or credit card? For that matter, what do those credit card readers do with my signature when I sign them? Are ...
8
votes
2answers
7k views

Safety of publishing last 4 credit card digits in age of fast computing?

How safe is it to make public the last four digits of a credit card? Credit card numbers have a specific format. Digits tell you what type of institution issued the card, what bank issued the card, ...
8
votes
3answers
693 views

Storing Credit Cards

Okay, so storing digitized credit card information/records is a well documented process when it comes to best practices. I recently got asked how a company can store, retrieve and process physical ...
-4
votes
1answer
161 views

Online POS terminal? [closed]

I need something like physical POS terminal but online, for offline credit card processing without needing CVV code on my site. Does something like this exists?
39
votes
4answers
7k views

Detecting skimmers and other ATM traps

This question has been bothering me ever since I first heard of ATM skimmers: Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM ...
3
votes
2answers
723 views

Unencrypted data over Magnetic Card Reader. What are the security risks?

I am working on evaluating the security of my University's student id card. The ID card contains both a magnetic stripe and a RFID component and is used to make payments as well as to provide access ...
10
votes
4answers
5k views

Make online payments anonymously? [closed]

Is there a service/company which allows you to make anonymous payments online ? This is how i want the service to work - Just like a credit/debit card. When you make the payment online, instead of ...
3
votes
5answers
1k views

Is it ok to cut some digits from the front-face of a credit/debit card?

I'm a European expat living in Asia. I usually hide my credit card at my apartment. However, I'm a bit scared about losing it when I carry it (wallet robbed or lost). That's why I already scrubbed ...
1
vote
1answer
609 views

How does paypal store credit card numbers?

How does Paypal store credit card numbers? Have they published any information this? As for now I would say that they encrypt the card numbers and store the key in an HSM, but this is just a ...
18
votes
4answers
1k views

Credit card forms on HTTP pages a MITM risk?

The other day, there was a web developer mailing list thread about a fundraiser page. One person noted that the page with the credit card form was HTTP, not HTTPS. In response, one person said that ...
2
votes
1answer
313 views

Credit card data - sharing and storage [duplicate]

What is the industry standard for sharing credit card data between client (thin & thick) and server?
1
vote
3answers
1k views

Sending secure information from app with ssl

I'm a web developer, but I occasionally step over into doing some mobile app development here and there. A client recently asked me to help them develop a very simple app. The app is essentially just ...
2
votes
1answer
456 views

Are banks required to be PCI compliant?

Since credit card transactions like cash advance can be performed at most ATMs, are banks required to be PCI DSS compliant?
1
vote
2answers
125 views

Bad transactions in an e-commerce system?

I read an article signifyd-raises-2m-from-andreessen-horowitz-to-help-online-businesses-use-data-to-prevent-payments-fraud which talks about a service that pulls together data to screen the ...
6
votes
1answer
304 views

secure credit card transactions on the internet

I have read about how hopelessly insecure credit cards are, and was wondering if there is, in the uk, a provider of either: One time use credit cards. Text me on transaction cards. Pre paid cards: ...
3
votes
1answer
1k views

How traceable is ATM and point-of-sale credit card use back to you in practice?

A friend said ATM use is traceable easily, while point-of-sale credit card use isn't - this statement goes against my common sense. I searched for the the topic and this is what I have found: ...
2
votes
3answers
407 views

Client is not storing Credit Cards Securily (near plain text). How do I convince client to be more secure?

I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All ...
1
vote
3answers
1k views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
3
votes
4answers
1k views

How to spoof an ATM transaction?

About 20 years ago, a man disappeared, but his ATM card was "supposedly" used the day after the disappearance. However, surveillance footage of the store shows no-one in the store physically used the ...
3
votes
2answers
168 views

Proxying a Credit Card Transaction?

Lets say there is a service that processes a credit card, service X. I want to create a new service (Y) that has a form on it mirroring the fields from service X. I use the credentials entered into ...
2
votes
3answers
266 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
0
votes
1answer
196 views

Why most of the Websites supports only Paypal for online transaction? [closed]

Background : There are several electronic and email based online transaction system worldwide. For example, Paypal, MoneyBooker, Alert Pay and others. My Question : Why most of the Websites supports ...
11
votes
4answers
6k views

Is Visa PayWave secure?

Recently (well, a few months or even a year ago), my bank, here in Australia, introduced this PayWave technology to their Visa debit cards. They claim it's secure, but all they talk about is their ...
-2
votes
1answer
943 views

Credit Card Error. What doe “Bad Track 2” mean? [closed]

I am receiving this error when a customer is trying a transaction. What causes it?
5
votes
4answers
3k views

Is a 3 or 4 digit CVV enough for online transactions?

Background: The CVV/CVV2 number ("Card Verification Value") on a credit card or debit card is a 3 or 4 digit number printed on the card. It is 3 digits on VISA, MasterCard and Discover branded credit ...
4
votes
1answer
318 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
7
votes
3answers
579 views

Credit card fraud prevention

The project that I am working on requires processing of credit cards. Is there any way to detect cloned/counterfeit cards? Are there any proven workarounds to prevent credit card fraud or misuse? We ...
36
votes
5answers
7k views

What's the impact of disclosing the front-face of a credit or debit card?

There are quite a few cases where people are called out for disclosing the front-face of a credit or debit card (e.g. this tweet from Brian Krebs or this twitter account). So I was wondering what the ...
2
votes
2answers
1k views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
43
votes
4answers
53k views

How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I ...
4
votes
1answer
116 views

Giving merchant account information to web programmer

Our web programmer needs our merchant account information to set up our ecommerce site. He is asking for the "processor name", "processor ID" and "merchant ID". If I provide him with the information ...
1
vote
1answer
363 views

Which PCI DSS SAQ applies when you don't store store but transmit CHD?

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...