A payment gateway is an e-commerce application service provider service that authorizes credit card payments.

learn more… | top users | synonyms

0
votes
1answer
37 views

How to export application metrics out of PCI environment

I am building a credit card tokenization/payment-processing service. As these services need sit in pci-compliant environment, I find it hard to export the application metrics & logs. Anyone knows ...
0
votes
1answer
23 views

Integration with CCAvenue payment gateway

I am integrating payment gateway provide by CCAvenue india. I heard about PCI compliance and other certifications. My question is there any certification or any thing that we as a developer need to ...
1
vote
2answers
36 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
3
votes
2answers
135 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
1
vote
2answers
76 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
1
vote
2answers
105 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
2
votes
2answers
119 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
4
votes
3answers
453 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To ...
0
votes
1answer
34 views

How can a customer authenticate EPOS device and make sure it's not fake?

In the scenario where customers use magnetic stripe payment cards and are paying via EPOS, a merchant can put a fake EPOS on the table that looks identical to real ones, the customer uses his card on ...
3
votes
1answer
98 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
68
votes
5answers
4k views

Strange Payment Gateway

I have a freelance client that wants me to integrate a payment gateway into their Woocommerce site but I am being increasingly concerned about their choice of provider and the project as a whole. The ...
1
vote
1answer
400 views

Multiple Bank Accounts on one payment gateway or merchant account

I'm looking to use PCI compliant payment gateways such as Authorize.net or Spreedly.com in my website. However in my particular case (hotel, tour, events reservations), we will serve as an ...
1
vote
0answers
34 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
3
votes
2answers
159 views

Is there any reason for using private key 2 times when creating security hash?

One of the payment solutions for the websites provides the following way of creating security hash for payment link: hash = sha1(private_key + payment_params_json + private_key); Is there any ...
14
votes
3answers
1k views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
1
vote
2answers
18k views

SSL handshake exception: unable to find valid certification path to requested target

We are using a third party payment service for our web users to be able to pay for courses. Once payment is completed however, payu attempts to connect to our site and run an IPN. However, they get ...
1
vote
0answers
94 views

Collecting Pre-Authorized Debit (PAD) & Credit Card (PACC) Agreements Electronically

I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement ...
1
vote
0answers
131 views

Has 100+USD, accidentally [closed]

Yesterday, I just visit a shopping site which use serial payment method and I type in some serials randomly then my account have 100USD; I just want to 'test' that website (for the bug bounty), is my ...
1
vote
0answers
56 views

Best way to authenticate for Funding balance with API call [closed]

I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API. What would be a good ...
1
vote
3answers
313 views

PCI Compliance Check-list

I'm currently attempting to wrap my head around PCI compliance - and what I need to do for my business to be compliant. I would like some confirmation on what I've found so far. I accept payments in ...
3
votes
1answer
637 views

Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?

Suppose I work for a bank and am asked to write an NFC payment app for the iPhone 6 or Android but not use Apple Pay. To simply send the credit card details to the reader via NFC. Now assume I'm not ...
2
votes
3answers
744 views

How are HSMs used in payment processing on the server?

I came to know recently that HSMs are used in credit card processing on the server side but since I don't work in that space and stumped as to why its needed. I can see it used in an ATM machine - ...
0
votes
1answer
129 views

Designing and implementing a secure epayments system with RESTful API

I want to design and implement an epayments system (I will not be handling credit card payments). The system will have a RESTful API. I am already familiar with RESTful servies, and have built a few ...
2
votes
2answers
2k views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
1
vote
1answer
293 views

Paypal Vault - Is it really secure?

If the information used to retrieve a card from the Paypal Vault, i.e. "credit_card_id" is stored in a database entry on our server, if a hacker is able to gain access to the server, does it really ...
3
votes
1answer
363 views

EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV

Ok I understand from my research that the Chip Card creates an AC Key(MasterKey+AccNumber) to communicate with the authorizing server securely (3DES key to have encrypted communication) but I don't ...
3
votes
3answers
455 views

Should I install an SSL certificate for a website that uses a third party payment gateway?

I understand what an SSL certificate does but I need help evaluating if I need one for my client's website. His website sells holiday packages online but does so without asking for any credit card ...
2
votes
1answer
2k views

What level of PCI Compliance do I need to adhere to if I do not store, but transmit data?

I'm doing a bit of research on my level of PCI compliance, and I'm having a difficult time grasping where I'm supposed to be. I have a web service that has recurring billing. The site is created ...
1
vote
3answers
1k views

Can Paypal be used to verify a user's identity?

As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments. I also noticed that Paypal offers a ...
-2
votes
1answer
138 views

What are the security measures to be taken before launching a site with credit card payments? [closed]

We just completed functionality testing of our new e-commerce site and going to launch.We are accepting credit card payments. I'm really concerned about it's security.What are the precautions to be ...
4
votes
2answers
2k views

What are the security implications of the POLi Internet Payments technique?

POLi Payments is an Australian based online payment provider which has begun trading in New Zealand. They are supported as a payment option on some large eCommerce websites in New Zealand, including ...
-2
votes
1answer
105 views

Is committing credit card data to this website considered safe? [closed]

Recently i came across one donation site which gets credit card info and makes donations, like the above donation site most of the site broughts donation on their own donation page instead of ...