Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

3
votes
2answers
103 views

Emailing debit card details to a guesthouse

I'm trying to arrange a holiday out to the Aran Islands, and the guesthouse emailed me back confirming that they do have a room available. But here is the catch: they want me to email my credit card ...
3
votes
2answers
124 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
15
votes
4answers
17k views

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card. Is it standard practice to ask a customer to send a photo of their credit card to confirm their ...
4
votes
1answer
70 views

Wiping magnetic stripe on card with magnet?

I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data. Pretend I am about to ...
5
votes
3answers
274 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
0
votes
1answer
80 views

Unauthorized credit card payment

I have a debit card which links to my savings account in a let's call it Bank A. I had never used it for online purchases/transactions (not even interbank transfer). After a while, I purchased virtual ...
3
votes
1answer
710 views

Is it OK to generate a token for a credit card without the user's permission? Is that PCI compliant?

Is it PCI compliant to generate a token for every card used for processing, regardless of whether the client asked for his card to be saved or not?
4
votes
5answers
3k views

Is it ok to cut some digits from the front-face of a credit/debit card?

I'm a European expat living in Asia. I usually hide my credit card at my apartment. However, I'm a bit scared about losing it when I carry it (wallet robbed or lost). That's why I already scrubbed ...
5
votes
2answers
8k views

Are VISA gift cards untraceable?

I was in a retail store today, and these people were discussing how easy it is for people to use stolen credit cards, and buy those visa gift cards without being traced after they purchase the gift ...
9
votes
1answer
174 views

How do EMV contactless cards protect against replay attacks?

I understand that standard RFID cards are vulnerable to replay attacks however, how do smart cards which are also contactless protect against replay attacks? Is this decided by the chip or by the ...
0
votes
1answer
56 views

What's the best way to test if an RFID blocking wallet is effective? [closed]

I was recently gifted a wallet that alleges to block RFID signals. As I am sure you fine folks at Information Security are aware, this is to protect the information stored on my contactless bank card ...
9
votes
2answers
2k views

What are the security implications of my credit card number being known by someone else? [duplicate]

I am new to the credit card world. What are the security threats or possibilities, if someone knows my credit/debit card no. Will he be able to misuse it or will he require any additional information ...
4
votes
2answers
62 views

Does EMV protect against sniffing PAN data from untrusted network?

I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm? To quote from the link below: ...
4
votes
0answers
38 views

Major UK company seems to be handling customer & card data recklessly [duplicate]

A company I used to work for is passing customer's personal details as well as card data (number, expiration date, name, CVV2 and the contents of the magstripe thanks to a reader) through Windows XP ...
47
votes
5answers
24k views

What's the impact of disclosing the front-face of a credit or debit card?

There are quite a few cases where people are called out for disclosing the front-face of a credit or debit card (e.g. this tweet from Brian Krebs or this twitter account). So I was wondering what the ...
5
votes
2answers
1k views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
2
votes
4answers
65 views

Is knowing someone's card expiration date a means of finding info about them?

Card as in debit or credit cards. I heard that even showing someone your debit/CC can be considered an exploit not because of the number or name, but because of the date of expiration. He said that ...
3
votes
3answers
168 views

Creditcard store first six digits PCI reference

I need to store masked PAN with first six digits and last four digits along with the card expiry month and year. Is it safe to do it according to the PCI rules? Regarding four digits has been ...
1
vote
1answer
57 views

Is it dangerous to have a credit card payment page without authentication?

The client wants a payment page that anyone can browse to, put in their information and id from a previous registration, and make a payment. The problem is that the id is from a different system and I ...
16
votes
5answers
1k views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
2
votes
3answers
81 views

Reporting Credit Card Thieves

Someone is using a client's commerce site to check the validity of lots of credit cards. After dropping IP addresses based on usage whoever is behind it throttled their requests down to 1 request ...
0
votes
5answers
282 views

Is it safe to tell credit card number to bank employee over a phone?

Recently, I got a new credit card via post. To activate it, it is required to call to the bank (phone number is attached to the card) and confirm, that card was received. For activation purposes, the ...
5
votes
3answers
814 views

Cardholder data segmentation for PCI compliance (3.2)

We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B Over channel A (mobile carrier) we collect the first 8 ...
17
votes
3answers
860 views

What prevents people getting charged over NFC in crowded places?

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
46
votes
4answers
12k views

Detecting skimmers and other ATM traps

This question has been bothering me ever since I first heard of ATM skimmers: Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM ...
0
votes
0answers
38 views

Hash function for credit card [duplicate]

Hey PCI and hash expert, What hash function is good for hashing credit card and providing collision resistance? Some context: We are building a tokenization service, so each credit card will have ...
4
votes
1answer
229 views

Credit card tokenization algorithm

Just curious, what is the common algorithm used to tokenize a user's credit card? I know lots service use PRNG (random number). Does it just re-gen a random number when there is a confliction? What ...
1
vote
2answers
2k views

Does sending credit card info over email violates PCI DSS?

Being in the US, I have noticed that more and more companies ask to send sensitive credit card information (all information that is required to make a transaction) over a plain email. I believe that ...
3
votes
2answers
680 views

How to mask SEPA (IBAN and BIC) information correctly?

I'm currently developing a payment system where users can use SEPA-debit to pay for the service. The user has the ability to enter the data once and can then select the same payment method when making ...
3
votes
4answers
3k views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
0
votes
1answer
85 views

Credit card aggregation based on open standards?

Lately, there have been a couple of projects which aim to replace all the credit cards in your wallet with a single smart device which will hold all of them, sync with your smartphone, etc. (Namely ...
3
votes
2answers
98 views

How to manually disable the no contact card?

New payment cards in my country are now delivered with the no-contact option that allows pay without putting the card in a machine. The fact is that these cards aren't secured because you can read ...
8
votes
4answers
785 views

When paying for something on line, is paying with a checking account less risky than paying with a credit card?

If I purchase something on line and am given the choice to pay with a checking account (also known as a current account) or a credit card, is the risk of my checking account data being stolen and used ...
3
votes
0answers
119 views

Clone debit or credit card

I would like to make some workshop about Debit or Credit card fraud (Skimming). So I need as much as possible information about it. Is it possible to clone debit or credit card with MagStripe reader ...
156
votes
5answers
43k views

Why are chips safer than magnetic stripes?

After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip. In what ways are chips safer than stripes?
1
vote
1answer
308 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...
5
votes
2answers
241 views

When does an Apple Pay token get converted to a real credit-card

Apple Pay says they store a Token on the phone and use it for transactions. Who issues this token? Who then converts this token to a real credit-card. Where is the mapping from token to real card ...
2
votes
2answers
110 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
63
votes
10answers
23k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
4
votes
3answers
6k views

Is it safe to auto-fill credit card numbers using Chrome?

Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the ...
4
votes
3answers
413 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To ...
0
votes
2answers
173 views

If I browse a website over HTTPS using a VPN, can the data be sniffed somehow?

I bought yesterday a flight from an American website. In my country, tickets are too expensive. Therefore, I used a IPVanish VPN to browse the airline website. It appears as if I visited it from New ...
7
votes
4answers
3k views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
1
vote
2answers
71 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
1
vote
2answers
102 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
52
votes
6answers
6k views

Has a benefit been demonstrated for credit card machines asking for ZIP code?

In the U.S., many credit card machines at places like gas stations have started asking for your ZIP (postal) code to use a credit card ostensibly to help verify that you really are the cardholder, ...
3
votes
2answers
152 views

Does Visa Checkout have preventive measures against spoofing?

A few online merchants are offering special deals for using Visa Checkout, a payment service similar to PayPal, so I've been trying to learn something about it before signing up. When you are on a ...
1
vote
2answers
45 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
0
votes
2answers
58 views

Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card

Our company got a new card printer for employee IDs. It was a bit expensive and we had to undergo a background as it allowed us to print both mag strips and EMV chips. I don't understand enough about ...
0
votes
3answers
140 views

Why is using the chip in chip-cards required at manned points of sale?

Chip cards are more secure because they prevent cloning. Chip cards also have the magstripe for backward compatibility. In my recent experience at supermarkets in California, using the chip takes a ...