22

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card.

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

  • 7
    This is not standard. I suggest she declines to do this. I cannot think of a single reason a legit merchant would ask to do this. Only two possible outcomes will come out of this. The first the mercant will use her credit card for fraud, and the second is in 6 months their images of said credit card will be leaked and it will be used by a different criminal. – Ramhound Aug 7 '12 at 17:22
  • 2
    It used to be much more common, but it is still used now in various places. – Rory Alsop Aug 7 '12 at 19:01
  • Did you asked them if you could send an edited photo, with the date, billing number and total price written on the card photo with an image editor? – curiousguy Aug 25 '12 at 3:39
  • If its just a verification on who you are why cant they ask for a different kind of photo ID? It's suspicious when you are asked for either a passport or a drivers license even if you blank out the info – user103322 Mar 4 '16 at 0:11
  • No way. While some actually are legit, think about what would happen if that picture of your card was seen by an unhappy employee. – Henry F Apr 28 '16 at 17:53
12

I've seen similar requests coming from foreign sites/companies just because of how they handle credit card payments.Think of credit cards imprinters. Some countries/merchants still use them and somehow they assume that an image of the credit card could be just as valid.

In the situations where I've come across this type of request, I have opted to send payment either via Wire transfer, Paypal or similar services. They were wholesale orders where the card could not be charged until the product was manufactured, etc.

20

It's not standard, and it's quite inadvisable.

The PCI security standard, with which any legit merchant will have to comply as part of their merchant account agreement, would require that a photo of the front of a card would have to be transferred using a secure, encrypted upload facility, stored encrypted at the merchant end, and, in the case of Amex cards which have the Card Security Code on the front, securely deleted after the transaction was authorised. It's very unlikely they've managed to get all this right, and if they asked you to send the photo through mail (or MMS etc) then clearly that could not be compliant.

That's not evidence of malice, but openly asking customers to do something non-PCI-compliant is evidence of incompetence, raising questions about their security in general.

  • If a company does something that is against the PCI security standard I considering that to be both incompetence and malice to be honest. In other words they are basicaly a stupid criminal in my eyes. I only give people a single chance to get things right in the form of security. – Ramhound Aug 8 '12 at 12:53
10

No it's not standard practice - in no way, shape or form does sending a photo of your credit card confirm your identity at all. Ignoring the fact that photos can easily be photoshopped, the fact that you physically possess a credit card certainly does not prove that you are who you say you are.

  • 2
    Not only that, the photo does not even expire (until the photographed object expires), it trivially could be reused. – curiousguy Aug 25 '12 at 3:37
3

They tell you to cover most of the information on your card. They just want the last 4 digits, the expiration date, the picture, and your address. They wouldn't be able to do much with that: just a verification of who you are.

1

All that does is ID the card as being physical and not just numbers from a data dump.

To verify the card is active they can do that by the card number, name, exp date and CSV on the back, and a simple penny or dollar withdrawal.

The best industry standard I have seen is used by Circle.

Circle is Goldman-Sachs. Not just some fly-by-night web site.

They want a photocopy of your driver license or other government-issued ID with a photo, first.

Then their site turns on your webcam (I used a smartphone). That way they can match a photo taken at a known time with the photo on the ID.

They will not accept a date and time-stamped uploaded photo. It must be in real time.

Then, and only then, do they ask about your banking information. Their priority is to identify the person first.

If some site is asking for that, you might want to ponder whether you really want to entrust your data with them.

protected by Community Jan 16 '17 at 23:30

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.