2

I pay various things online with my credit card. In order to save the time of taking out my wallet and typing the number to the field, I have two options:

  • Store the credit card number with the service
  • Store the credit card number in my password manager

First is bad if a service gets compromised. The second is bad if my machine should be compromised, but then I have larger problems than just the credit card.

I am curious about the following: If I decide not to let stores save my credit card information but instead store it in my password manager, how does liability change? I presume that the first option is just fine with the credit card issuer since that is common practise. But what about the second one? I think that it would be more secure, but does the company see it the same?

I will also contact the company but I am not confident that I will get a straight answer, especially since they block my password manager in their online banking and advise to not store passwords on the computer at all.

Improve this question
8
  • 1
    I'm not sure that this is a security question but a T and C's question about payment card operators. "Liability" is a legal/contractual concern that is up to the company.
    – schroeder ♦
    Jul 23, 2018 at 20:34
  • I store them on my password manager.
    – ThoriumBR
    Jul 23, 2018 at 21:03
  • @schroeder: You are right, I was again thinking about this from the technical angle but that is largely irrelvant. Can you trigger a migration to Law SE? The interesting angle really would be if a clause in the T&C about not storing passwords on a computer would actually be legal in Germany.
    – Martin Ueding
    Jul 23, 2018 at 21:11
  • This is not a security answer - Why don't you try services like 'PayPal' or 'Mobile Wallet'. You may have to store your card only once...
    – Sayan
    Jul 24, 2018 at 0:04
  • If you store it in a password manager under your control, I'm pretty sure it has exactly the same liability as if you didn't store it anywhere at all.
    – Bobson
    Jul 24, 2018 at 1:10

2 Answers 2

Reset to default
2

IANAL but generally speaking the cardholder is theoretically slightly more at risk using a password manager.

There are several distinct relationships involved.

Merchants who accept and store cards are accountable to their acquiring banks to do so in PCI-compliant ways. If they suffer a breach, they may be liable for the fraud conducted as a result of the breach.

Consumers using cards do so under the terms of cardholder agreements with their issuing banks, which have language that dictates that consumers have to keep the card numbers secret and safe.

Password managers are explicit in disavowing responsibility for the secrecy or custody of any data they store, and have no relationships with issuers or banks.

In theory, if a password manager's systems are breached, consumers using those systems could be found to have inappropriately shared what they were to have kept secret.

Improve this answer
2

One of the issuing banks have called me and talked about this. They have told me that a data breach of a shop is of no concern to me. If I store it in a password manager and the card is abused, they might frame this as negligence. He also told me that this will likely be no problem as the bank will likely pay for it the first time and only stop doing that in case it happens repeatedly.

But his suggestion was to just store it with the shops.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .