Should we trust online banks with our credit card information?

Question

I'm thinking of buying a product for someone using the steam platform. Being in Germany, the best (least expensive) option would be to use a local bank. Logging in, choosing a product and checking out lands you on the following page:

"Continue" redirects to the banking site and it contains two tokens. On the site itself the BIC and PIN number are required to finalize the transaction. The certificates of both the store and the bank are valid.

What keeps the bank from performing further, malicious transactions with the supplied information? What happens in case of compromise? as performing a transaction in this case does not require a PIN generated by a physical token (anyone can buy as long as they know the BIC, the PIN and there are sufficient funds on that account).

Answer 1

I work in the IT system of a banking company, and as such I know a bit about what happens.

Here is the sequence of events, as I understand it, when a payment goes through:

1. You send the payment information (BIC, PIN, etc.) to the seller's bank;
2. The seller's bank transmits the payment request to your bank;
3. Your bank receives the payment request, and decides to authorize the payment;
4. That authorization goes back up the chain to the seller's bank, and you get the page telling you that your payment was successful;

Now, what happens if someone in the chain initiates a payment without your consent? Fundamentally, it relies on the fact that a payment that was authorized in that way is known as depending on an insecure payment request - and intra-bank agreements stipulate that in that case, any fraud costs must be borne by the beneficiary of the payment.

So:

1. You will see that you have been charged fraudulently;
2. Your bank will reimburse you;
3. The seller's bank will reimburse your bank - in the end, the seller's bank will have gained nothing, except being noted for having allowed a fraudulent payment;

At each step of the way, you see that there is a strong trust relationship - between you and your bank, between your bank and the seller's bank. If these trust relationships are broken, then it could very easily end before a court, with very dire consequences (you leaving your bank and outing it as untrustworthy, the seller's bank being outed as untrustworthy and sued by your bank).

In short: the seller's bank would not do that voluntarily, because that could easily mean the end of its business. And if your bank is trustworthy, you should not end up footing the bill anyway. That is true, whether the seller's bank is untrustworthy or compromised.

Now, I understand it very well if you do not wish to leave such information in the hands of a bank you do not personally trust - in that case, I would suggest asking your bank about it - for example, banks can generate a disposable Credit Card number, valid only for a limited time and amount of money.

Also, there are generally rules that stipulate that such information should not be kept any longer than necessary.