Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

47
votes
4answers
58k views

How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I ...
140
votes
5answers
23k views

Why are chips safer than magnetic stripes?

After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip. In what ways are chips safer than stripes?
18
votes
4answers
1k views

Credit card forms on HTTP pages a MITM risk?

The other day, there was a web developer mailing list thread about a fundraiser page. One person noted that the page with the credit card form was HTTP, not HTTPS. In response, one person said that ...
2
votes
2answers
1k views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
4
votes
1answer
291 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
2
votes
1answer
140 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
36
votes
5answers
7k views

What's the impact of disclosing the front-face of a credit or debit card?

There are quite a few cases where people are called out for disclosing the front-face of a credit or debit card (e.g. this tweet from Brian Krebs or this twitter account). So I was wondering what the ...
22
votes
4answers
27k views

What is the use of stolen credit card details?

What can a person with stolen credit card details do? Buy porn? Buy tons of server resources to perform an attack? What else? I'm sure that if he buys books, shoes and bicycles or transfer funds ...
3
votes
4answers
1k views

How to spoof an ATM transaction?

About 20 years ago, a man disappeared, but his ATM card was "supposedly" used the day after the disappearance. However, surveillance footage of the store shows no-one in the store physically used the ...
9
votes
2answers
13k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
3
votes
1answer
212 views

Fraud Mitigation - Card Present Transactions

When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent ...
8
votes
4answers
4k views

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card. Is it standard practice to ask a customer to send a photo of their credit card to confirm their ...
2
votes
1answer
100 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
6
votes
1answer
252 views

What's the use of adding a challenge to a one time password algorithm?

In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
3
votes
3answers
591 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
1
vote
4answers
336 views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
0
votes
3answers
468 views

Bank cards - chips vs mag stripe security

In this thread: Why are chips safer than magnetic stripes? the answers all seem to be that the chip cards are far more secure and difficult to copy. Here is my problem, and my question. A couple of ...
0
votes
1answer
240 views

Is it possible that the same VISA debit card numbers could be issued to different people by different banks? [closed]

I'm wondering if is it possible that the same VISA debit card numbers could ever be issued to different people by different banks or companies?