New answers tagged

3

The requirement is to protect the data appropriately. Pre-auth, you are unlikely to have the CVV on disk (it should just be in RAM) but if you do, then yes you should encrypt, and then delete afterwards, so your assumption that "the restriction on storing sensitive authentication data applies to post authentication/processing storage" is incorrect.


0

Yes, your company needs to be PCI compliant. It doesn't matter if your customer's credit cards are stored in that format or the other (PDF\in DB \ paper ...) as you wrote as long as you store transmit or process you are required to be PCI compliant. regarding your question in the comment regarding "I don't even know if storing such document requires me to ...


6

Explicitly not. The whole1 concept of magstripe data on the card is to prove that the card was present at the time of the transaction. If you were able to reconstruct it without the card, that would defeat the purpose. Likewise, that's why PCI rules require you to never store the full swipe data (so you can't replay it later). 2 If you look at what's in ...


22

Typically, it's just the last 4 that are shown to the customer, sometimes the first 6. From the PCI DSS 3.4 Standards Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not ...


3

The main consequence is not in the technical parts but in the liability you may face if “something happens” I would notify the bank about the leak. And keep a record of telling them. The bank may decide it's worth to issue a new card. Or that there's no significant risk, and do nothing unless there are fraud signs. Now, the risk is probably tiny. But if ...


6

A merchant can authorize and validate monetary transactions with only the credit card number. The only reason they collect the CVV, name, address, etc. is to protect themselves from fraud. That being said, any transaction that a merchant submits can be disputed (by you) within 60 days. The bank must respond within 30 days. Meanwhile you are not liable ...


0

Cloning isn't necessary as the algorithm used for nfc with the emv cards is flawed, lacking a true rng. The predictable prns be used to negotiate transaction authentications. Another implementation flaw foils the $200/transaction cash limit by doing the transaction in a foreign currency. There are other implementation flaws that make it relatively simple to ...


3

Q1: Yes. The link for MagStripe reader and encoder 1 does exactly that. Can read credit or debit and write it to a new blank card and can also erase data on an existing card. the MSR605 comes with software to do all of this. These machines can clone ANY card with a mag stripe. Gift cards, hotel cards, rewards cards, credit cards, id cards, etc. Q2: Yes. you ...


6

If your debit card has an NFC chip on it (the "tap to pay"), it's possible. This presentation discusses two methods. One is skimming an NFC card and using the recovered data for making Card Not Present transactions online. The other is called a "pre-play" attack, where "future transactions" are skimmed from the card in your pocket, and used to make ...



Top 50 recent answers are included