Tag Info

New answers tagged

1

It's a question of cost and benefit for the seller and the card holder. A stolen/lost credit card: cannot be used in caldholder-present transactions (unless the PIN was revealed) can be used in caldholder-not-present transactions, but the owner of the card will be reimbursed thanks to the credit card insurance. In this setting: The seller always gets ...


0

For Chip & Pin to work online, the customer would need a pinpad plugged into their computer. In some European areas, the bank will provide a pinpad so the card can be used online with the added protection. It's a case of somebody absorbing the cost to use the technology for the added security. For card present transactions, it's pretty easy to get the ...


5

With cardholder-not-present transactions, if the transaction turns out to be fraudulent, the retailer has to refund the money. With Chip and PIN, the retailer gets to keep the money, and either the bank or the cardholder bears the loss of the fraudulent transaction, depending on whether the cardholder has told anyone else their PIN or not. So retailers want ...


1

I can speak about booking.com as I have previous experience. They used to fax full card details of a booking direct to the hotel. This would include card number, expiry and CVV2. This would then be used by the actual hotel receiving the booking, so yes it could be stored for a year, but not necessarily by booking.com, obviously in breach of PCI. It seems ...


5

Storing CVV is not allowed: There are a few things to consider: You assume booking.com is storing CVV You're assuming a CVV is needed to process a transaction. On 1) - there can be no way to confirm whether booking.com, Expedia are storing unless you work there. They would have to answer to a QSA. Now, as far as the CVV that is stored, that is CVV2 ...


1

Your payment gateway should be able to provide you with a tokenized system for recurring payments where you submit the cc to the payment gateway once and they return an authorization code which you will use instead of a cc number for the recurring payments. This is a far better solution than storing credit card numbers in any shape or form. Please contact ...


0

PCI DSS PAN Data (Personal Account Number) should following these principals when storing: Encrypt PAN number upon creation in database (typically with HSM device) Only decrypt PAN number when billing action occurs (reoccurring billing, use stored number to buy an item, etc.) Store, in separate column (or preferably separate dB) only last 4-digits of PAN, ...


0

I think you have a good approach. I find it interesting that users would complain about not being able to immediately identify card numbers when they can view the first six AND last four in your results table--it is unlikely that there would be two results with the same masked number. The way you currently have it implemented is good because it has very ...


0

Theoretically, removing those parts of the card will not prevent the card from working, and thus will more-or-less accomplish your goal. It will fail when a human wants to see the card, but that is of course rare, as you point out. According to a search I just performed on the web, it looks like some cards don't have embossed numbers, and some apparently ...


1

The signature line matters, even for chip and pin. Chip and Pin verifies the card is present, it doesn't verify the authorized user is. The point of the signature line is to verify you are actually you, even if very few people actually check this properly. I actually leave my card unsigned to see if people properly ask for ID. I've only ever been asked ...


2

With Apple Pay, no credit card data -- even in encrypted form -- is ever stored on the iPhone or on Apple's servers. Similarly, no credit card data is ever transmitted to or stored on a merchant's servers. When a user first signs up for Apple Pay, either via an existing iTunes credit card or by loading a new one onto the iPhone, the card information ...



Top 50 recent answers are included