2

I am filling out a form to set up a recurring payment with a local government building. The form requests that I put my credit card number, expiration date, and CVV number, which I'm a little hesitant to do.

How I can minimize my risk of the information being stolen/misused?

My plan:

  • I was given the option of delivering it in person, faxing it, or sending an email. I will take a picture of the form and send an email
  • I will request that he not print out the form and store it somewhere.
  • If he must print it, I will request that he cross out the CVV and expiration date after having validated the card.

Barring not setting up recurring payments, is that the best I can do?

(Given that there isn't an online portal where I can safely enter this information, I assume that requesting that he encrypt the information and store it in a database won't be an option)

Improve this question
3
  • 5
    My guess is email is likely the LEAST secure of these options. Email is backed up, stored unencrypted for years, and potentially can be accessed by the entire world of billions of people. The paper options have far less exposure, and are limited to physical proximity. Maybe hundreds of people for several days instead of years, and these days are often even shredded.
    – Steve Sether
    Jul 31, 2018 at 14:54
  • @SteveSether Good point. My view was that I didn't want paper lying around the office with my credit card information, but your point makes sense.
    – pushkin
    Jul 31, 2018 at 14:57
  • This reminds me of the White House requiring sensitive information like SSN and DOB to be sent over unsecured email for the nominal purposes of advance security screening of visitors.
    – WBT
    Sep 18, 2018 at 20:41

5 Answers 5

Reset to default
5

Privacy.com allows you to generate virtual card numbers which are per-merchant and can have limitations put upon them (e.g., $15/month). They use your checking account as a backend to cover the payments.

That's a more generic equivalent to Virtual Card Numbers, which some specific cards provide as a feature (e.g., Eno from Capital One, ShopSafe from BoA, ...)

These solutions are targeted on cases where you're not comfortable handing your card over, which is exactly where you are.

Disclaimer - no endorsement implied. I heard about Privacy.com yesterday and tried setting it up today, no success yet due to the Privacy->Plaid->Bank interface. But I have a friend who is using it successfully.

Improve this answer
3
  • Services like Google Pay also provide virtual card numbers.
    – multithr3at3d
    Aug 1, 2018 at 1:57
  • @multithr3at3d Ah interesting. However those won't work outside of Google Pay. In this case, I need to write down my information and hand it over to someone, so this won't work me.
    – pushkin
    Aug 2, 2018 at 14:47
  • accepting because this is what I ended up doing
    – pushkin
    Aug 2, 2018 at 15:53
12

They shouldn’t be asking you to write down your CVV number at all. Payment Card Industry security standards prohibit merchants from storing that information, and on paper counts. If they can’t process your card electronically so that the CVV is only ever held in memory then they shouldn’t be using the CVV at all, and accepting the risk that the transaction will be repudiated. You could report them to their payment processor, if you have any way of finding out who that is.

Improve this answer
7
  • Can you back these claims up with any sources?
    – Tom K.
    Aug 1, 2018 at 14:01
  • 2
    @TomK. PCI DSS version 3.2 requirement 3.2 states "Do not store sensitive authentication data after authorization (even if encrypted)". It earlier defines the CVV number as "sensitive authentication data".
    – Mike Scott
    Aug 1, 2018 at 14:20
  • How do you know that the organization has to comply with PCI DSS?
    – Tom K.
    Aug 1, 2018 at 14:26
  • 1
    @TomK. From the preamble to the same document: "PCI DSS applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers."
    – Mike Scott
    Aug 1, 2018 at 14:28
  • @Tom K it's good to be critical, but don't forget to be supportive when someone gives a best-practice answer. Your questions feel like they lack research.
    – J.A.K.
    Aug 1, 2018 at 14:36
2

Delivering in person is likely least risky, followed by fax.

They don't need the CVV to process a payment. It is not used in recurring payment workflows at all.

But in general there is little overall risk to you if you send a credit (not debit) card. If something happens to the card number, and there is a fraudulent purchase, just contact your issuer to get it removed, and get a new card sent to you. This happens all the time and as long as you pay attention to your statements, you should not have any liability, only the logistical inconvenience of having to set up prior recurring payments with the new card.

Improve this answer
2

Well, there are different questions here.

First is: is it legitimate to ask for the card number, CVV and expiration date to setup recurring payments?

My opinion is: yes it is. The third party does not know you and requires some guarantees that your card is valid. And your bank will ask them to prove that you actually give them all those informations. So those informatiosn should not be stored in their information system but are nevertheless required.

Second is which protocol should I use to send them that?

The most secure and less convenient is of course to physically deliver that in person. No third party will ever see it.

Second IMO is the fax. It could be intercepted, but it is now a uncommon attack vector

Last is of course the email because it will be accessible to your mail server operator.

IMHO it is still acceptable. These are of course personal and sensitive informations, but not secret informations. You bank knows them. The different sites where you have bought something know them. They should not have stored that but can you make sure of it? Simply you should:

  • immediately remove the mail from the sent folder
  • control the operations on your bank account for a while and immediately warn the bank if one is suspect
  • control the contract with your bank. Commonly, you are only responsable if you are not cautious enough. Sending a mail to a well known organization and removing all traces you can access should be acceptable. In doubt contact the bank.

Third what can be done to make sure no unnecessary copies will persist?

My answer it nothing, or just pray. Once you deliver them the information it is out of your control. If you do not trust them, do not give them. You can ask them to eat or burn the paper, but I would not be confident that they obey... And even if the person you ask to not store the information say that they will not, you will never be able to control it, just like when you use a HTTPS form.

Improve this answer
0

Your plan is a bad plan. Requesting anything from somebody who simply does not care nor owe you anything won't help you protecting your data. As likely as not your filled 'form' will end up in a garbage container behind the building - accessible to anyone. So if I were in your shoes I would not do it.

Remember that the basic trade off we are dealing here with is between convenience/comfort and security. If you are worried about one, you must necessarily be ready sacrifice the other.

Improve this answer
2
  • 1
    This is more a rant than an answer to OP's question. Can you present any evidence for your conjecture or at the very least a comprehensible causal effect?
    – Tom K.
    Aug 1, 2018 at 14:19
  • I understand that they don't owe me anything and may very well not comply with my requests, but this is a situation where I'm OK with the consequences if they don't (I can just dispute charges on my card and get a new one). Even if they don't do what I say, I'd still like to do my due diligence and take the necessary measures to minimize my risk.
    – pushkin
    Aug 2, 2018 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .