Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

0
votes
3answers
158 views

Why is using the chip in chip-cards required at manned points of sale?

Chip cards are more secure because they prevent cloning. Chip cards also have the magstripe for backward compatibility. In my recent experience at supermarkets in California, using the chip takes a ...
3
votes
0answers
67 views

Add a supplementary credit transaction to improve online payment security?

An online company from which I regularly buy goods apparently recently upgraded their security policy. Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
3
votes
1answer
130 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
5
votes
3answers
189 views

My client needs credit card details emailed to them, will an encrypted file work?

I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their ...
2
votes
2answers
141 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
3
votes
3answers
317 views

Credit card processing in mobile app over Stripe - PCI DSS compiant?

after reading a lot of PCI DSS stuff I'm still not sure whether it would be ok for us to use the following process in our app: Get full credit card data from attached card reader Tokenize it using ...
-1
votes
1answer
71 views

Magnetic stripe credit card [duplicate]

Do ATM in London accept magnetic stripe? If yes can a thief still duplicate a credit card and use it in an ATM which accepts magnetic stripes?
3
votes
1answer
76 views

concern about including credit card form in iframe using dynamically generated url

I'm looking at including a credit card form in a page via iFrame but the form app needs parameters passed from the AngularJS app in the parent page in order to complete the transaction. My concern is ...
0
votes
5answers
165 views

What steps should I take before using my credit card to buy something online?

I am a private computer user with an internet connection. Assuming that my connection is a standard land line (that I legally own, I'm not free loading) and that my computer is up to date on operating ...
1
vote
3answers
2k views

EMV credit card cloning: PIN code known by a malicious person

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code? If the PIN code is changed, can the cloned card still be used?
5
votes
3answers
332 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
5
votes
3answers
8k views

Is it safe to auto-fill credit card numbers using Chrome?

Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the ...
6
votes
5answers
203 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
1answer
352 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...
3
votes
2answers
1k views

Can expired credit card information be used for fraud?

I have encountered a situation where payment card (debit/credit) information, including name, number, expiration date, and cvc, is being saved by an organization unencrypted in excel spreadsheets on ...
2
votes
2answers
2k views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
0
votes
1answer
270 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
2
votes
3answers
594 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
3
votes
1answer
267 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
1
vote
0answers
34 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
116 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. "...
3
votes
1answer
156 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
30
votes
3answers
5k views

Why don't popular web services mask the CVV?

Most popular web services like PayPal, Google Wallet, and others do not mask CVV numbers, eg: (<input type="password">). As I read, the CVV is a security feature and it seems logical to mask it ...
4
votes
1answer
504 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
0
votes
2answers
87 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are completed....
6
votes
6answers
566 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
3
votes
2answers
179 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
3
votes
2answers
208 views

Credit Card Fraud Prevention - Why Aren't Simple Things Used?

I use my American Express card every day, sometimes multiple times. I do a mixture of card-present and card-not-present transactions. AMEX has decent fraud detection and I get notified quickly if ...
14
votes
3answers
1k views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
2
votes
3answers
238 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
36
votes
5answers
12k views

How does a website know if a certain creditcard number is wrong instantly

I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, ...
0
votes
1answer
544 views

How does SAQ A-EP apply in the situation where no I frames are used

I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know. I use primarily Stripe and Braintree in ...
3
votes
2answers
814 views

How to mask SEPA (IBAN and BIC) information correctly?

I'm currently developing a payment system where users can use SEPA-debit to pay for the service. The user has the ability to enter the data once and can then select the same payment method when making ...
2
votes
0answers
247 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
0
votes
2answers
270 views

To which entity merchants must report credit card breach?

In the incident that a Marchand like Target or Home Depot, detects credit cards are breached, who they need to notify? Visa recommends informing the merchant bank, and/or Visa Incident Response ...
3
votes
2answers
455 views

Verifying credit card ownership

When a fraudulent credit card CNP (Card Not Present) transaction is made, merchant is liable for the chargeback. For that reason, our company implemented a policy where we ask a photo of customer's ...
0
votes
1answer
49 views

Viewing PCI data via 3rd party sites securely

I'm working on a project that requires PCI protected data (card PIN numbers) to be made visible to customers, via a Third Party (a non PCI compliant) company site. The hierarchy is as follows: Us >...
5
votes
2answers
11k views

Are VISA gift cards untraceable?

I was in a retail store today, and these people were discussing how easy it is for people to use stolen credit cards, and buy those visa gift cards without being traced after they purchase the gift ...
2
votes
2answers
3k views

No HTTPS on credit card entry form - can it be safe?

I was going to make a purchase on a website, but the page containing the credit card entry form is served via HTTP and not HTTPS. Is it definitely unsafe? The website advertises the use of "RapidSSL"...
0
votes
1answer
375 views

Lost CVV number automatically virus related?

If my credit card was used on Amazon, doesn't that mean someone has my cvv number? And would that mean I have a virus? Or is there another way they can get a CVV code off a credit card? I know it's ...
43
votes
8answers
6k views

What prevents web shop owners from misusing credit card data?

I don't own a credit card but read much about fraud with stolen credit cards. Since I don't own one, I don't know how you exactly buy online using your credit card, so please correct me, if I am wrong ...
2
votes
2answers
3k views

Does sending credit card info over email violates PCI DSS?

Being in the US, I have noticed that more and more companies ask to send sensitive credit card information (all information that is required to make a transaction) over a plain email. I believe that ...
5
votes
2answers
1k views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
1
vote
1answer
523 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
1
vote
0answers
88 views

Telling the difference between a prepaid card and credit/debit card

In order to stop people abusing free trials, we can make sure new users are not reusing data from existing users and therefore not just signing up with a new account every month. It is reasonably ...
1
vote
0answers
95 views

Collecting Pre-Authorized Debit (PAD) & Credit Card (PACC) Agreements Electronically

I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement ...
0
votes
1answer
134 views

How secure credit card order system with blank mail

I want to know how to secure credit card order with blank mail. My boss instructing to create new site like as below: 1) User send "Blank e-mail" to new site. 2) The site returns mail including URL,...
1
vote
3answers
227 views

Why do credit cards have chips, if I can purchase online without the chip being read?

Credit cards (and debit cards) are used in three different ways: In person + pin. The seller requires me to insert my card with the chip and input the PIN number to complete the transaction. In ...
6
votes
2answers
7k views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
0
votes
1answer
75 views

credit card security suggested scenario

I need to know the best scenario for a merchant inserting client's credit cards and expiry dates to process recurring payment for these cards. What I have in mind (and want your expert suggestions ...