Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

3
votes
2answers
77 views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
1
vote
3answers
256 views

Would chip-and-PIN have prevented the Target breach?

Would chip-and-PIN have prevented the Target breach? As we all know, Target was breached and the hackers stole lots of credit card numbers. Target is now advocating for chip-and-PIN, as a way to ...
1
vote
2answers
43 views

Does sending credit card info over email violates PCI DSS?

Being in the US, I have noticed that more and more companies ask to send sensitive credit card information (all information that is required to make a transaction) over a plain email. I believe that ...
48
votes
4answers
61k views

How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I ...
1
vote
1answer
64 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
1
vote
0answers
31 views

Telling the difference between a prepaid card and credit/debit card

In order to stop people abusing free trials, we can make sure new users are not reusing data from existing users and therefore not just signing up with a new account every month. It is reasonably ...
2
votes
2answers
50 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
10
votes
4answers
5k views

Make online payments anonymously? [closed]

Is there a service/company which allows you to make anonymous payments online ? This is how i want the service to work - Just like a credit/debit card. When you make the payment online, instead of ...
1
vote
0answers
31 views

Collecting Pre-Authorized Debit (PAD) & Credit Card (PACC) Agreements Electronically

I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement ...
3
votes
1answer
58 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
1
vote
2answers
503 views

When paying online with a credit card, what is “3D authentication” and is it reliable?

I tried making a purchase from http://www.laptop-batteries.ca/ but on the very last step the page reloaded with an error. A representative contacted me asking why I didn't complete the order and I ...
0
votes
1answer
102 views

How secure credit card order system with blank mail

I want to know how to secure credit card order with blank mail. My boss instructing to create new site like as below: 1) User send "Blank e-mail" to new site. 2) The site returns mail including ...
0
votes
3answers
69 views

Why do credit cards have chips, if I can purchase online without the chip being read?

Credit cards (and debit cards) are used in three different ways: In person + pin. The seller requires me to insert my card with the chip and input the PIN number to complete the transaction. In ...
3
votes
1answer
179 views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
0
votes
1answer
35 views

credit card security suggested scenario

I need to know the best scenario for a merchant inserting client's credit cards and expiry dates to process recurring payment for these cards. What I have in mind (and want your expert suggestions ...
2
votes
0answers
79 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
4
votes
2answers
84 views

Modifying credit cards to increase security

If I use a credit card only for chip&pin/EMV transactions and possibly for contactless transactions, I don't need the following parts of the card. magnetic stripe embossed numbers etc signature ...
4
votes
1answer
123 views

When does an Apple Pay token get converted to a real credit-card

Apple Pay says they store a Token on the phone and use it for transactions. Who issues this token? Who then converts this token to a real credit-card. Where is the mapping from token to real card ...
5
votes
2answers
257 views

Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the ...
0
votes
1answer
48 views

TPM-esque Credit Card Solutions?

Lately, there have been a couple of projects which aim to replace all the credit cards in your wallet with a single smart device which will hold all of them, sync with your smartphone, etc. (Namely ...
6
votes
3answers
365 views

How does credit card authorization work

Few days ago I heard a professional scammer explaining how he exploits the banks, I cant find the right word to describe his actions, even the word scam does not fit as he is not breaking the law but ...
1
vote
0answers
43 views

Using chip and pin credit card for authentication?

I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (it's just a side project with no real use other than securing a ...
2
votes
2answers
48 views

Question regarding browser windows when integrating with 3rd party payment software

I've been told that when integrating with a 3rd party payment gateway, the other website's window should not be opened in an iFrame or a separate window - that the current application window itself ...
3
votes
1answer
104 views

Storing Credit Card Information on Mobile Phones

I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me. The app allows a user to ...
52
votes
10answers
12k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
2
votes
2answers
54 views

In this instance, is code+security code really more secure than just a longer code?

On credit cards, the security code is printed on the back of the card (usually), on the premise that having a credit-card slip or photo of the front of the card won't allow you to use it fraudulently. ...
1
vote
1answer
72 views

My app is asking for card details, but does not stores them. Do I need PCI compliance?

I plan to build an Android/iPhone app. The app will contain a few forms and status screens. One of the screens will ask the user for their card details. Once they'll click submit they'll be sent over ...
3
votes
3answers
170 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
-6
votes
1answer
119 views

Is www.cheap-lingerine.com safe to use my credit card on? [closed]

I want to make sure my information is safe. This website is openly china-oriented but says to secure card information with Secure Sockets Layer technology (SSL) on those pages that involve sensitive ...
1
vote
2answers
93 views

Are input fields that don’t have name=“” sent via the browser [closed]

Are input fields that don’t have name attributes susceptible to MITM attacks (w/o SSL) or any other attack? For example: <form action="" method="post"> <label ...
0
votes
1answer
84 views

Credit card fraud preventions [duplicate]

Ok lets say some one have clone my debit card here in Greece all debit cards have and stripe and chip and lets say in a way he knows my pin and all my information and he put the info on a blank card ...
2
votes
1answer
143 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
0
votes
2answers
105 views

Does changing credit card numbers provide better security over time?

I've always contacted my bank and credit card provider every year and simply asked to change my credit card number itself (and get a new card). They do so without a hassle and I feel more secure in ...
1
vote
1answer
114 views

I left my debit card unattended — how exposed am I?

I yesterday visited a restaurant I usually visit, but it seems that after paying with my debit card, I accidentally left it there. Today (almost 24 hours later) I had realized that I didn't have it ...
0
votes
1answer
330 views

What can a hacker do with a card number without CVV? [duplicate]

From my experience a card can not be used for online payment without a valid CVV, then why is it still always emphasized that card number must be protected? What can a hacker do, assume that he has ...
1
vote
2answers
60 views

Isnt the 3D secure system essentially completely ineffective in avoiding fraud?

3D secure is a system where, after you enter your credit card details on a merchants site, you are redirected to a site hosted on the bank servers where you enter a OTP sent via SMS to complete the ...
1
vote
2answers
61 views

pci compliance and temporary files

Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
2
votes
2answers
112 views

How do credit cards with chip+pin securely allow recurring transactions?

In Europe most cards use a chip+pin system to secure the card information. You put the card in te machine and enter a PIN number to decrypt the card information which is stored on the chip. ...
1
vote
2answers
149 views

What Can I Do While I'm Waiting for “Chip and Pin” Credit Cards?

For the second time in 8 weeks, one of my American Express (AMEX) card numbers was stolen. I do use the card online, but only at reputable (and SSL/TLS enabled sites). I use it in the real world, ...
27
votes
7answers
4k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Edit Looking for ...
39
votes
4answers
8k views

Detecting skimmers and other ATM traps

This question has been bothering me ever since I first heard of ATM skimmers: Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM ...
0
votes
0answers
49 views

How can a website charge my credit card when I entered an incorrect CVV? [duplicate]

I just created a free account on Pluralsight.com and entered my credit card details, but I entered my CVV incorrectly. How can they charge a payment to my credit card even though I entered an ...
2
votes
1answer
142 views

EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV

Ok I understand from my research that the Chip Card creates an AC Key(MasterKey+AccNumber) to communicate with the authorizing server securely (3DES key to have encrypted communication) but I don't ...
3
votes
3answers
327 views

What are some cards that are vulnerable to RFID theft?

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
1
vote
4answers
415 views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
2
votes
2answers
100 views

What's the point of EMV when only the card is needed to shop online?

In many countries, EMV is used to prevent credit and debit cards being cloned. But given that it's possible to perform online transactions using the details printed on the card, how does it add ...
6
votes
4answers
482 views

How can my bank debit card reader know that my pin is valid?

Why do ATMs accept any PIN? states that the ATM does not know my pin and the pin is not on the card as well. My bank has this system: It works in 5 stages: I enter my debit card number on the ...
1
vote
2answers
100 views

Why is filling up at the gas pump require a quick scan of the Credit/Debit card?

Always wondered about this. I had a friend tell me it's to make sure your information can't be stolen as easily on the credit card, but I will admit I am a bit skeptical of his claims. At most gas ...
2
votes
1answer
100 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
11
votes
4answers
7k views

Is Visa PayWave secure?

Recently (well, a few months or even a year ago), my bank, here in Australia, introduced this PayWave technology to their Visa debit cards. They claim it's secure, but all they talk about is their ...