Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

3
votes
0answers
48 views

Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the ...
0
votes
1answer
46 views

TPM-esque Credit Card Solutions?

Lately, there have been a couple of projects which aim to replace all the credit cards in your wallet with a single smart device which will hold all of them, sync with your smartphone, etc. (Namely ...
6
votes
3answers
320 views

How does credit card authorization work

Few days ago I heard a professional scammer explaining how he exploits the banks, I cant find the right word to describe his actions, even the word scam does not fit as he is not breaking the law but ...
1
vote
0answers
31 views

Using chip and pin credit card for authentication?

I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (it's just a side project with no real use other than securing a ...
2
votes
2answers
41 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
3
votes
1answer
67 views

Storing Credit Card Information on Mobile Phones

I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me. The app allows a user to ...
52
votes
10answers
11k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
2
votes
2answers
50 views

In this instance, is code+security code really more secure than just a longer code?

On credit cards, the security code is printed on the back of the card (usually), on the premise that having a credit-card slip or photo of the front of the card won't allow you to use it fraudulently. ...
1
vote
1answer
63 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
3
votes
3answers
142 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
-6
votes
1answer
109 views

Is www.cheap-lingerine.com safe to use my credit card on? [closed]

I want to make sure my information is safe. This website is openly china-oriented but says to secure card information with Secure Sockets Layer technology (SSL) on those pages that involve sensitive ...
1
vote
2answers
86 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
0
votes
1answer
69 views

Credit card fraud preventions [duplicate]

Ok lets say some one have clone my debit card here in Greece all debit cards have and stripe and chip and lets say in a way he knows my pin and all my information and he put the info on a blank card ...
1
vote
1answer
132 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
1
vote
2answers
93 views

Does changing credit card numbers provide better security over time?

I've always contacted my bank and credit card provider every year and simply asked to change my credit card number itself (and get a new card). They do so without a hassle and I feel more secure in ...
1
vote
1answer
105 views

I left my debit card unattended — how exposed am I?

I yesterday visited a restaurant I usually visit, but it seems that after paying with my debit card, I accidentally left it there. Today (almost 24 hours later) I had realized that I didn't have it ...
0
votes
1answer
200 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
1
vote
2answers
52 views

Isnt the 3D secure system essentially completely ineffective in avoiding fraud?

3D secure is a system where, after you enter your credit card details on a merchants site, you are redirected to a site hosted on the bank servers where you enter a OTP sent via SMS to complete the ...
1
vote
2answers
56 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
1
vote
2answers
94 views

How do credit cards with chip+pin securely allow recurring transactions?

In Europe most cards use a chip+pin system to secure the card information. You put the card in te machine and enter a PIN number to decrypt the card information which is stored on the chip. ...
1
vote
2answers
121 views

What Can I Do While I'm Waiting for “Chip and Pin” Credit Cards?

For the second time in 8 weeks, one of my American Express (AMEX) card numbers was stolen. I do use the card online, but only at reputable (and SSL/TLS enabled sites). I use it in the real world, ...
27
votes
7answers
4k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Edit Looking for ...
39
votes
4answers
7k views

Detecting skimmers and other ATM traps

This question has been bothering me ever since I first heard of ATM skimmers: Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM ...
0
votes
0answers
48 views

How can a website charge my credit card when I entered an incorrect CVV? [duplicate]

I just created a free account on Pluralsight.com and entered my credit card details, but I entered my CVV incorrectly. How can they charge a payment to my credit card even though I entered an ...
2
votes
1answer
128 views

EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV

Ok I understand from my research that the Chip Card creates an AC Key(MasterKey+AccNumber) to communicate with the authorizing server securely (3DES key to have encrypted communication) but I don't ...
3
votes
3answers
165 views

What are some cards that are vulnerable to RFID theft?

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
1
vote
4answers
225 views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
2
votes
2answers
94 views

What's the point of EMV when only the card is needed to shop online?

In many countries, EMV is used to prevent credit and debit cards being cloned. But given that it's possible to perform online transactions using the details printed on the card, how does it add ...
1
vote
2answers
197 views

Would chip-and-PIN have prevented the Target breach?

Would chip-and-PIN have prevented the Target breach? As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
6
votes
4answers
330 views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
1
vote
2answers
90 views

Why is filling up at the gas pump require a quick scan of the Credit/Debit card?

Always wondered about this. I had a friend tell me it's to make sure your information can't be stolen as easily on the credit card, but I will admit I am a bit skeptical of his claims. At most gas ...
2
votes
1answer
100 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
11
votes
4answers
6k views

Is Visa PayWave secure?

Recently (well, a few months or even a year ago), my bank, here in Australia, introduced this PayWave technology to their Visa debit cards. They claim it's secure, but all they talk about is their ...
0
votes
3answers
387 views

How can I protect my eCommerce site from stolen credit cards?

The case would be that someone with stolen credit card registers on my site, and uses the stolen credit card details to purchase services through my site. How can I protect my eCommerce site from ...
5
votes
4answers
255 views

How can I convince my customers not to send Credit Card data over email?

My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process ...
1
vote
1answer
150 views

is it illegal to share customer credit card data

I have an app where users can enter credit card data and it is stored using a 3rd party toservice like BluePay or Authorize.net, I do not and will not save it in my system. Trying to get this point ...
0
votes
2answers
102 views

How do gift card resellers prevent sellers from re-using pin and card numbers

There are multiple gift card reseller sites that buy your gift cards and resell them at discounted price. I was wondering how these sites prevent sellers from reusing the pin and card number after it ...
1
vote
2answers
52 views

Security of Shared Corporate Credit Cards

We are a medium sized company. Recently, one of the representatives of the finance department raised a question about the use of credit cards to shop on-line among different departments in our ...
3
votes
5answers
1k views

Is it ok to cut some digits from the front-face of a credit/debit card?

I'm a European expat living in Asia. I usually hide my credit card at my apartment. However, I'm a bit scared about losing it when I carry it (wallet robbed or lost). That's why I already scrubbed ...
0
votes
2answers
75 views

Can website see my payment information?

So I decided to purchase a service in website which only accepts payments where I need to enter my debit card information. Now connection is secured with TLS 1.0, so no 3rd party can observe my ...
3
votes
1answer
127 views

How easy is it to make a malicious bank/identity card?

I recently got a magnetic card reader that plugs into my computer because I was bored. I decided to scan my ID and bank card through it and I was surprised to see my ID number/bank card number show up ...
0
votes
1answer
275 views

What is the point to the IPEK in DUKPT?

I'm trying to understand the DUKPT (Derived Unique Key Per Transaction) system used for PIN devices, but I'm getting hung up on the IPEK. This blog post has an image where the sequence is: BDK ...
5
votes
4answers
3k views

Is a 3 or 4 digit CVV enough for online transactions?

Background: The CVV/CVV2 number ("Card Verification Value") on a credit card or debit card is a 3 or 4 digit number printed on the card. It is 3 digits on VISA, MasterCard and Discover branded credit ...
2
votes
0answers
78 views

Should I cancel my current credit card because of heartbleed vulnerability? [duplicate]

I recently looked at my local credit union bank and they said that their site is not vulnerable to heart bleed. However, I have used my credit card in many websites such as grubhub, amazon, some ...
43
votes
4answers
53k views

How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I ...
4
votes
2answers
107 views

Are invalid card numbers under PCI compliance

If a merchant sends an invalid card number to the bank, will the bank have to secure the information to be PCI compliant?
2
votes
1answer
57 views

How to protect myself from future fraud? [closed]

Recently, I had my credit/debit card from my bank "stolen." The thieves somehow got my card number and information and took quite a bit of money from my account. Fortunately, I was able to recover it ...
0
votes
1answer
85 views

Is it safe to recycle unshredded credit card receipts?

Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
1
vote
3answers
1k views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
0
votes
1answer
87 views

Are there software solutions take encrypted credit card data taken straight off a square credit card reader and insert them into a standard web form? [closed]

Does anyone know how you can take the encrypted output of a square card reader and insert it directly into a standard web form?