New answers tagged

6

If your debit card has an NFC chip on it (the "tap to pay"), it's possible. This presentation discusses two methods. One is skimming an NFC card and using the recovered data for making Card Not Present transactions online. The other is called a "pre-play" attack, where "future transactions" are skimmed from the card in your pocket, and used to make ...


1

I guess part of the question is whether a user could intercept the response from the first call before the second call. The answer to that is absolutely, Yes. For this setup to be secure, you would have to have an encryption scheme. The Amount and Transaction Action (sale, refund, etc) either has to be encrypted or accompanied by a checksum of said ...


1

Never trust the client browser. There are four main attack vectors I can see based on this model. 1) Leaked credentials First, as @JuliePelletier commented, in order for this to work, all the information necessary to make a "charge this card" call to Authorize.Net has to be available to the customer's webbrowser. This includes whatever secure credentials ...


2

Your identity is somehow linked to your card and automatically registered the next time you pay, no extra actions required. Your name is on the card, electronically. When they swipe your card the computer reads your name off the mag strip and they know that you're John Doe: Credit/Debit cards follow the ISO/IEC 7813 standard for the data on the mag ...


3

IANAQSA, and this is outside my personal experience, but here goes: In this day of credit card fraud and theft, I'm dumbfounded that this is happening. Is this legal? Legal? Depends on where you are, but... probably, yes. Note that even in the TJX breach, where 45 Million cards were compromised, the legal charges against them were for PII, not for ...


1

Your scheme isn't terribly likely to work because not all ATMs keep the card, many are swipe. Any thief that sees two pins will think only one is valid, and can easily bypass your scheme by just using an ATM that you swipe the card instead of the ATM taking it.


2

Anything you can do to mitigate the threat of usage after the physical-theft of the card is a great idea. Making them take longer by making them make mistakes and/or trying in multiple places is a solid idea. That is, aside from the ultimate mitigation of keeping your bank's phone numbers in your phone so you can contact them immediately to report card theft....


0

An answer to your question will be difficult based on these conditions: What if an already registered loyalty shopper replaces their credit card through its expiring system or a compromise? The system will not be able to identify them unless the operator painstakingly relink that new card to the same customer. A simple cash register machine does not have a ...


11

The trick with credit cards is to remember the credit part of the system. You're not actually paying at the point of sale, you're creating two credit relationships where you owe the issuer money and they owe it to the merchant. Effectively two 'IOU' pieces of paper, and about as secure. The next thing is that you don't necessarily have to pay if they can't ...


5

One word: Insurance Credit card "security" is not what we understand as "security" on this site, that is features that make unauthorized use computationally infeasible. Remember that original credit card was simply imprinted. There was hardly any security at all. Business security is another thing entirely. If the risk is high (as in credit card fraud) you ...


15

Merchants can request a payment with only the credit card number and the expiry date, which are very visibly written on the front of the card. Most but not all merchants also require a number written on the back of the card, generically called CVV (the formal name depends on the credit card vendor). In principle, merchants have to apply certain rules known ...


37

Booking.com doesn't take a deposit or any payment from you; what you're filling in is a reservation form. The card details are used as a form of payment identity in case (a) you don't turn up and they need proof you intended to stay, or (b) you stay and run off without paying when checking out. They hotel still requires a present card for payment, or the CVV ...


1

PCI-DSS rules generally require that any PAN stored be encrypted in such a way that it requires not one, but two authenticators to decrypt. In practice, this would normally mean that even if you intend that the end-user is the only one with an encrypted copy, this would be insufficient from a regulatory standpoint. "Who" has a copy is irrelevant, in this ...


5

Can an attacker get information off the card? Yes, at least some can, and the UK consumer group Which? mentioned in the question did it: Our researchers tested 10 cards (six debit and four credit, from volunteers) to assess security risks. Contactless cards are coded to 'mask' personal data, but using an easily obtainable reader and free software ...


1

Some card issuers let you create a virtual credit card. You can setup a virtual card, configure appropriate limits, then use it on an insecure site with much less risk than using your main card. A low-tech alternative is to get a pre-paid credit card and use that whenever you're concerned.


0

You can buy at sites that are PCI DSS complaint. The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard and the merchants who comply with it are more secure monitored and surveyed by a qualified security assessor . You will be able to identify these merchants by the PCI Turquoise logo in white letters at ...


3

Instead of seeing this from the point of view of the card, look at this from the point of view of your account's money (that after all it's what matters, right?). So, how can you protect your money in such sites? Simple solution: using a virtual credit card. Most banks offer these kind of cards that you should always have with no funds. Then when you are ...


8

There's nothing you can do. Because if it's actually you using the web site, then fraud is obviously not an issue. The 2FA only helps if someone else is using a web site pretending to be you, and so nothing that you do on web sites will make any difference. You can't stop a fraudster who has got hold of your card details from using them on a web site that ...



Top 50 recent answers are included