Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

1
vote
3answers
935 views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
3
votes
4answers
1k views

How to spoof an ATM transaction?

About 20 years ago, a man disappeared, but his ATM card was "supposedly" used the day after the disappearance. However, surveillance footage of the store shows no-one in the store physically used the ...
3
votes
2answers
157 views

Proxying a Credit Card Transaction?

Lets say there is a service that processes a credit card, service X. I want to create a new service (Y) that has a form on it mirroring the fields from service X. I use the credentials entered into ...
2
votes
3answers
224 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
0
votes
1answer
181 views

Why most of the Websites supports only Paypal for online transaction? [closed]

Background : There are several electronic and email based online transaction system worldwide. For example, Paypal, MoneyBooker, Alert Pay and others. My Question : Why most of the Websites supports ...
9
votes
4answers
4k views

Is Visa PayWave secure?

Recently (well, a few months or even a year ago), my bank, here in Australia, introduced this PayWave technology to their Visa debit cards. They claim it's secure, but all they talk about is their ...
-2
votes
1answer
716 views

Credit Card Error. What doe “Bad Track 2” mean? [closed]

I am receiving this error when a customer is trying a transaction. What causes it?
5
votes
4answers
2k views

Is a 3 or 4 digit CVV enough for online transactions?

Background: The CVV/CVV2 number ("Card Verification Value") on a credit card or debit card is a 3 or 4 digit number printed on the card. It is 3 digits on VISA, MasterCard and Discover branded credit ...
4
votes
1answer
286 views

Conceptual design of vulnerability scanning program in global retail network (PCI DSS)

I am trying to design yearly program to scan for vulnerabilities on a very large network of payment terminals. The company has thousands of retail points all around the world which need to be ...
7
votes
3answers
503 views

Credit card fraud prevention

The project that I am working on requires processing of credit cards. Is there any way to detect cloned/counterfeit cards? Are there any proven workarounds to prevent credit card fraud or misuse? We ...
36
votes
5answers
5k views

What's the impact of disclosing the front-face of a credit or debit card?

There are quite a few cases where people are called out for disclosing the front-face of a credit or debit card (e.g. this tweet from Brian Krebs or this twitter account). So I was wondering what the ...
2
votes
2answers
842 views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
37
votes
4answers
36k views

How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I ...
4
votes
1answer
109 views

Giving merchant account information to web programmer

Our web programmer needs our merchant account information to set up our ecommerce site. He is asking for the "processor name", "processor ID" and "merchant ID". If I provide him with the information ...
1
vote
1answer
313 views

Which PCI DSS SAQ applies when you don't store store but transmit CHD?

We have a merchant website that uses Authorize.net's AIM. Cardholder data (credit card number, expiration date, etc.) is entered at our website. Then it's transmitted to payment gateway and isn't ...
21
votes
2answers
9k views

Minimum requrements for storing last 4 digits of credit card number?

We have a merchant website that uses Autorize.net's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
0
votes
2answers
427 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
23
votes
4answers
2k views

Convince the company not to store credit card numbers in our webapp

The company I work for needs a system to perform monthly credit card charges to customer accounts. Customers will be able to update their credit card information from an online interface written in ...
3
votes
2answers
1k views

Send credit card info by email from HTTPS and SMTP on SSL

A client asked me to receive credit card info of his costumers by email. I know that is a very very not secure way ... But if the page with the input form is on HTTPS, and then i use a smtp (like ...
6
votes
4answers
2k views

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card. Is it standard practice to ask a customer to send a photo of their credit card to confirm their ...
3
votes
2answers
725 views

Is a new protocol needed for credit card transactions?

It seems like many places spend a ton of time and money securing their site for credit card transactions. However, there are still millions of credit card numbers being stolen. Fraud is big business, ...
13
votes
3answers
537 views

What prevents people getting charged over NFC in crowded places?

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
0
votes
2answers
245 views

Signing up on a paid site with a credit card

I'm building a subscription-based website that needs to accept recurring payments. The concept is much like that of Netflix, but there is also a variation between the two. When a user attempts to ...
6
votes
1answer
224 views

What's the use of adding a challenge to a one time password algorithm?

In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
4
votes
1answer
224 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
2
votes
3answers
307 views

Why do credit cards not use digital certificates?

Asymmetric encryption and digital certificates are used all over in the IT world to verify authenticity and prevent forgeries. And it works great. Why do credit cards not use some form of ...
8
votes
3answers
6k views

What is the DUKPT Key Derivation Function?

I'm tasked with decrypting ciphertext acquired from an encrypted card reader. The card reader utilizes DUKPT(derived unique key per transaction) scheme and 3DES encryption. I don't have a problem with ...
12
votes
5answers
280 views

I need ideas for blocking a single malevolent user

Let me throw out this problem I'm having to some of my technical peeps and see if you guys have any new suggestions: We have a website that sends text messages and voice mails for our clients. ...
4
votes
3answers
713 views

Secure one-time-use credit cards

I've been reading a lot about one-time-use online credit card numbers (e.g. https://www.discover.com/credit-cards/member-benefits/security/create-online-account-number.html#) but I have to admit that ...
21
votes
4answers
21k views

What is the use of stolen credit card details?

What can a person with stolen credit card details do? Buy porn? Buy tons of server resources to perform an attack? What else? I'm sure that if he buys books, shoes and bicycles or transfer funds ...
3
votes
1answer
200 views

Fraud Mitigation - Card Present Transactions

When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent ...