Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

7
votes
4answers
3k views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
1
vote
2answers
77 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
1
vote
2answers
105 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
52
votes
6answers
6k views

Has a benefit been demonstrated for credit card machines asking for ZIP code?

In the U.S., many credit card machines at places like gas stations have started asking for your ZIP (postal) code to use a credit card ostensibly to help verify that you really are the cardholder, ...
3
votes
2answers
170 views

Does Visa Checkout have preventive measures against spoofing?

A few online merchants are offering special deals for using Visa Checkout, a payment service similar to PayPal, so I've been trying to learn something about it before signing up. When you are on a ...
1
vote
2answers
49 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
0
votes
3answers
146 views

Why is using the chip in chip-cards required at manned points of sale?

Chip cards are more secure because they prevent cloning. Chip cards also have the magstripe for backward compatibility. In my recent experience at supermarkets in California, using the chip takes a ...
2
votes
2answers
232 views

How does a debit/credit card reader verify the PIN so quickly?

I understand that the associated PIN for a given card is not stored on the card itself in any way. So I am wondering then, when I use my cards how does it seem to be able to verify the PIN quite ...
3
votes
0answers
65 views

Add a supplementary credit transaction to improve online payment security?

An online company from which I regularly buy goods apparently recently upgraded their security policy. Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
3
votes
1answer
98 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
5
votes
3answers
173 views

My client needs credit card details emailed to them, will an encrypted file work?

I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their ...
2
votes
2answers
136 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
0
votes
5answers
160 views

What steps should I take before using my credit card to buy something online?

I am a private computer user with an internet connection. Assuming that my connection is a standard land line (that I legally own, I'm not free loading) and that my computer is up to date on operating ...
6
votes
5answers
168 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
3
votes
3answers
273 views

Credit card processing in mobile app over Stripe - PCI DSS compiant?

after reading a lot of PCI DSS stuff I'm still not sure whether it would be ok for us to use the following process in our app: Get full credit card data from attached card reader Tokenize it using ...
-1
votes
1answer
65 views

Magnetic stripe credit card [duplicate]

Do ATM in London accept magnetic stripe? If yes can a thief still duplicate a credit card and use it in an ATM which accepts magnetic stripes?
3
votes
1answer
64 views

concern about including credit card form in iframe using dynamically generated url

I'm looking at including a credit card form in a page via iFrame but the form app needs parameters passed from the AngularJS app in the parent page in order to complete the transaction. My concern is ...
1
vote
3answers
1k views

EMV credit card cloning: PIN code known by a malicious person

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code? If the PIN code is changed, can the cloned card still be used?
4
votes
1answer
3k views

How traceable is ATM and point-of-sale credit card use back to you in practice?

A friend said ATM use is traceable easily, while point-of-sale credit card use isn't - this statement goes against my common sense. I searched for the the topic and this is what I have found: ...
4
votes
3answers
180 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
12
votes
3answers
13k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
8
votes
4answers
9k views

Is a 3 or 4 digit CVV enough for online transactions?

Background: The CVV/CVV2 number ("Card Verification Value") on a credit card or debit card is a 3 or 4 digit number printed on the card. It is 3 digits on VISA, MasterCard and Discover branded credit ...
6
votes
6answers
525 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
2
votes
2answers
2k views

No HTTPS on credit card entry form - can it be safe?

I was going to make a purchase on a website, but the page containing the credit card entry form is served via HTTP and not HTTPS. Is it definitely unsafe? The website advertises the use of ...
0
votes
1answer
241 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
3
votes
2answers
817 views

Can expired credit card information be used for fraud?

I have encountered a situation where payment card (debit/credit) information, including name, number, expiration date, and cvc, is being saved by an organization unencrypted in excel spreadsheets on ...
2
votes
2answers
1k views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
4
votes
1answer
458 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
2
votes
3answers
551 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
2
votes
3answers
859 views

How can I protect my eCommerce site from stolen credit cards?

The case would be that someone with stolen credit card registers on my site, and uses the stolen credit card details to purchase services through my site. How can I protect my eCommerce site from ...
2
votes
0answers
228 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
3
votes
1answer
249 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
2
votes
1answer
222 views

Using chip and pin credit card for authentication?

I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (for demo/entertainment purposes only so bulletproof security isn't ...
1
vote
0answers
34 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
107 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. ...
3
votes
3answers
7k views

What are some cards that are vulnerable to RFID theft?

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
3
votes
1answer
148 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
30
votes
3answers
5k views

Why don't popular web services mask the CVV?

Most popular web services like PayPal, Google Wallet, and others do not mask CVV numbers, eg: (<input type="password">). As I read, the CVV is a security feature and it seems logical to mask it ...
0
votes
2answers
85 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are ...
35
votes
7answers
10k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Ideally, I'm ...
3
votes
2answers
174 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
4
votes
3answers
4k views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
5
votes
4answers
2k views

Signature instead of PIN, Visa card

Most of the credit cards require PIN to authorize transaction. Recently upon a transaction the merchant required my signature and not my PIN. I understand this is another sort of authorizing the ...
3
votes
2answers
199 views

Credit Card Fraud Prevention - Why Aren't Simple Things Used?

I use my American Express card every day, sometimes multiple times. I do a mixture of card-present and card-not-present transactions. AMEX has decent fraud detection and I get notified quickly if ...
14
votes
3answers
1k views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
36
votes
5answers
12k views

How does a website know if a certain creditcard number is wrong instantly

I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, ...
2
votes
3answers
207 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
72
votes
5answers
115k views

How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I ...
3
votes
2answers
562 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
0
votes
1answer
508 views

How does SAQ A-EP apply in the situation where no I frames are used

I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know. I use primarily Stripe and Braintree in ...