New answers tagged credit-card
If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification No, that's not true. If you touch card holder data, you need to SAQ B, C, or D. The SAQ A (and A-EP) is only for merchants who "do not touch, process or store cardholder data" as per your Spreedly link. The popular libary card.io makes it easy for the user to put ...
A) Yes, they do keep track of purchases. Almost all prepaid gift cards require some form of registration where they collect different data about you: name, address, zip code, phone number, etc. B) It will. The gift card becomes an account, and you can review your purchase history just like a regular credit card. However, you can be a liar when you ...
I would say: Ask your acquirer. If you roll your own library or use a 3rd party service, the rate limiting might not Count towards you in "fraud fighting score" at all, and you will still be liable if the order makes it through. If you select such services by your acquirer, then the acquirer knows that you are actively fighting against fraud, and the ...
You didn't specify what your site is built with. If by chance you're using Ruby, there is an excellent rack-attack library by Kickstarter.
OpenDLP is another project widely touted -- http://opendlp.googlecode.com -- Another is MyDLP -- https://en.wikipedia.org/wiki/MyDLP
There is a paid product called Identity Finder that will do just that. It can find a variety of PII, and produces a report that you can use. I am not affiliated with this product, I just use it at work.
ccsrch is a tool for exactly this purpose. I have seen QSAs use this as part of their audits. Personally, I'm not fond of it. I've run it against a file with 100k cards and it found all 50k of them. I got better hit rates with a python script I threw together in an afternoon. And the output requires lots of manual review to weed out false positives. ...
I guess this is bad, right? edit: Based on the new information that only email address, not physical address, is the authenticator the merchant is using...... It's still only mildly bad. They're not violating any law. They're not violating the PCI DSS or any card brand regulation that I'm aware of. They're drastically increasing the likelihood that ...
This isn't just bad, this is a disaster. Just knowing the email address of someone allows you to buy stuff using his credit card if he happened to be the unlucky customer of this horrible site. They are either storing complete credit card data in reversible format, and given that this security disaster was overlooked I wouldn't be surprised if it was stored ...
Top 50 recent answers are included