30

Until today I managed to avoid paying online with my credit card (I'm weird, I know...) but somehow I managed to do it.

Today though I had to book a hotel room (on booking.com) that required a deposit. I entered the card issuer, card number and card expiration date.

The card issuer is basically redundant since from the number you can get the issuer. So basically, with two basic pieces of information (credit card number and expiry date) anyone can pull money from my account.

If someone has some spy glasses and looks at my credit card over my shoulder while I pay for some groceries they can then pay for stuff with my credit card.

How is this thing safe?

  • 12
    It's not. That's why chip credit cards are coming in – Neil Smithline Jun 12 '16 at 18:35
  • 26
    It doesn't have to be secure. It only has to be more profitable. If fraud reimbursements < interest and fees then go – Neil McGuigan Jun 12 '16 at 20:23
  • 9
    @NeilSmithline Chip credit cards are NOT more secure - this is misinformation. EMV is more secure than magnetic strips for in-person purchases but creates no new security benefits for purchasing online/booking online. – Luke Jun 13 '16 at 1:05
  • 6
    @Luke, they do have the benifit that the details you enter on-line can not be used to make a clone card. – Ian Ringrose Jun 13 '16 at 8:35
  • 6
    a store i worked at uploaded swiped credit card transactions (with # and expry) to corporate every night, so even if you've never used your card online, you've used your card over the internet... – dandavis Jun 13 '16 at 8:49
37

Booking.com doesn't take a deposit or any payment from you; what you're filling in is a reservation form. The card details are used as a form of payment identity in case (a) you don't turn up and they need proof you intended to stay, or (b) you stay and run off without paying when checking out. They hotel still requires a present card for payment, or the CVV to do a card-not-present transaction, or cash if you choose to pay that way instead.

The bigger question of "is this secure" is more complicated. The simplest way to think about it is that there are a number of security controls in place to help prevent fraud, at various stages in the process (website, payment processor, bank), but even if these all fail the bank is insured against fraud, so you will get your money back if you use an appropriate card type. In general, credit cards offer superior and faster fraud protection in comparison to debit/bank cards.

  • 1
    So credit card number + expiry date + CVV can allow a payment? I.e. making a payment without knowing the PIN? – ILikePaperMoney Jun 12 '16 at 19:02
  • 5
    Yes, the PIN is only for card-present transactions. Online / CNP transactions, particularly ones outside your spending patterns, are subject to different types of scrutiny and verification. – Polynomial Jun 12 '16 at 19:19
  • 1
    So what if I don't show up? What can the hotel do with my credit card number and expiry date? Why do they need the credit card for reservation and not some ID document like passport or driving license? – ILikePaperMoney Jun 12 '16 at 19:40
  • 15
    @ILikePaperMoney They can't charge you, but they can bill you. If you don't pay and decide to take you to court (e.g. small claims) then they can show that you intended to stay based on your entry of your card details. Providing your card information shows intent to pay which a driving license or other ID form would not. – Polynomial Jun 12 '16 at 19:43
  • 2
    Also hotels often ask for ID when you check in, and you can’t resell the hotel room for cash. Therefore a hotel booking is not a good way to get money from a stolen credit card! – Ian Ringrose Jun 13 '16 at 8:38
17

Merchants can request a payment with only the credit card number and the expiry date, which are very visibly written on the front of the card. Most but not all merchants also require a number written on the back of the card, generically called CVV (the formal name depends on the credit card vendor). In principle, merchants have to apply certain rules known as PCI DSS to all credit card data, and aren't allowed to store the CVV (only to pass it to the bank), but PCI DSS compliance only requires that the merchant declares themselves as compliant, so violations of the requirements are common.

Yes, this does mean that once somebody has your card details, they can make an online payment in your stead. The burden is on you to verify your credit card statements and cancel any fraudulent payment. Depending on your bank, on the credit card type and your country, the details of how to cancel a fraudulent payment and what happens if this caused overspending or an overdraft vary.

To be clear, this is a risk whether you have every used your card for online payments or not. The risk is inherent in having a card. There are fraudsters who make up card numbers and try to charge them; this isn't very easy to set up because most of their payments will end up being rejected because the made-up data is invalid and the bank will eventually block the source of evidently-fraudulent requests, but it's doable. Having a valid number and expiry date greatly increases the profitability/risk ratio.

To give an idea of the profitability of this kind of fraud, from what I remember of credit card spam, a credit card number with expiry date sells for around $1 and a valid CVV raises the price to something like $5. Note that I've never checked whether the advertised data was genuine.

  • 1
    Unrelated to the question, but note that higher PCI levels will require an external auditor to check your (self-)assessed standards. – Spacy Jun 13 '16 at 4:37
  • You don't even need the expiration date, although the chances of the transaction being approved are better if you provide it. – gowenfawr Jun 13 '16 at 12:15
  • 1
    Regarding the "going rates" in the black market, A valid CC w/ expiration + CVV sells for generally 15-20 from past experience, all the way up to $50 if the address is included, and $100-200 if there's a PIN. That doesn't stop a random Joe from buying 100-200 Name + Number cards though, as there's bound to be a handful of them that can get a fraudster a return of $5-500 depending on which shady merchant doesn't verify the other security information they can find. There exists a very real black market for this stuff, and there are always going to be buyers. – Thebluefish Jun 13 '16 at 14:24
13

The trick with credit cards is to remember the credit part of the system. You're not actually paying at the point of sale, you're creating two credit relationships where you owe the issuer money and they owe it to the merchant. Effectively two 'IOU' pieces of paper, and about as secure.

The next thing is that you don't necessarily have to pay if they can't establish that it was actually you that did the transaction. If you successfully repudiate it, the merchant doesn't get paid for the transaction. If a merchant gets defrauded too often, they can be banned from the system.

So, various forms of payment system come with different proofs to the merchant about the card. In cardholder-present transactions you have the opportunity to look at the card and the customer when making the decision. It's harder to automate the fraud or carry it out from a safe distance. So these can be done with just card+expiry. Everything on the front of the card can be copied with one of those card imprint machines that use carbon paper and submitted by the merchant by post. The pre-internet system.

Cardholder-NOT-present transactions are the opposite. Fraud is easy to automate. So most online transactions ask for at least the CVV (three digits on the back of the card, not copied by imprint and not on the magnetic track). Most online retailers insist on an address which must match the cardholder address before posting out goods. People selling "cashlike" things (gift cards, game time cards) sometimes do phone verification too because they're very high fraud targets.

The hotel reservation case is funny because there's almost no fraud case possible. There's no point in making a reservation with a stolen card and then not showing up, it gets you nothing. If you do show up, it turns into cardholder-present, and many hotels take a copy of your ID.

5

One word:

Insurance

Credit card "security" is not what we understand as "security" on this site, that is features that make unauthorized use computationally infeasible. Remember that original credit card was simply imprinted. There was hardly any security at all. Business security is another thing entirely. If the risk is high (as in credit card fraud) you can either put your money into bringing the risk down - or you can pay money to insure your risk. From your point (the customer) it's quite safe and very convenient - you just call your bank, tell them "I didn't authorize that" and they give you your money back.

There is also thief's point of view: the card number is useless if you have no way of getting value out of it. Booking a hotel with stolen card basically announces the world where and when you are. Ordering goods requires a delivery address - again the next person who knocks to thief's door may wear blue instead UPS's brown uniform.

Of course, everyone is doing their best to prevent frauds. Hence the SSL, certified payment processors, best practices recommendations and requirements, etc etc. But those only minimize risks of exposing your card number - once it's exposed, all bets are off. Just looking at your cards is enough to "steal" most of it. The rest is a balance between costs and risks.

Disclaimer: I don't mean that insurance is a "worse" kind of security. Even with cryptographic algorithms we are sure there is a way of cracking them, it's just not feasible (read: profitable) to do so. Business insurance is not much different concept, just the "cracking" barrier is lower.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.