3

When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date), as well as my banking card information (like card number, CCV, expiration, owner name).

Payment form example

  • What do they do with my personal information which are not my banking card information?
  • Why is it required?
  • Is it their own policy or an international banking policy?
  • What happens if I just put James Bond born in 1980 living in 9000 South Pole Street, South Pole instead of my personal information (as long as my banking card information is correct)?
2

Verified by Visa (VBV)

Verified by Visa helps prevent people using your details without your permission. And it’s good for retailers who want to make sure their customers are protected.

When you complete your payment with Verified by Visa, your bank is able to make additional security checks to ensure your card details have not been compromised. Your bank wants to make sure that it’s really you making the purchase before they authorise the payment. After all, nobody would expect to take cash out of an ATM without using their PIN. Your bank wants to give you the same high standards of protection on the internet as well. VISA

As I understand the legacy payment system using CVV, exclusive, only requires three things: Card Number, Expiry Date and CVV. Anything else should not matter. However, this is why Verified by MasterCard and Verified by Visa came about, to mitigate this attack vector.

What do they do with my personal information which are not my banking card information?

This can relate to the individual countries money laundering laws. Equally, this could be for their records, to detour fraudsters from committing fraud. As I understand, credit card (MagStripe and CVV) is not particularly difficult. Although, this is not a huge issue for the customers as authorisation hold is performed. Could the legacy system have been better, yes!

Is it their own policy or an international banking policy?

If approached by the police, then they have records:

  • Card details
  • 'Owner name'
  • Transaction time and date

What happens if I just put James Bond born in 1980 living in 9000 South Pole Street, South Pole instead of my personal information (as long as my banking card information is correct)?

If a legacy payment system is used, then this should work. This is difficult to make a statement about because individual companies do not publish the source code for their antifraud systems. Hence, some conjecture with reverse engineering needs to be done here. But, this is why VBV and VBMC exist. To make this type of fraud more difficult.

So, the company's anti-fraud system should check:

  • Does our personal information match the card details?
  • Should additional verification be performed?
  • Is the email address domain from a 'blacklisted' domain?

In England, Anti Money Laundering Acts, require companies to validate each user with: government issue ID, utility bill, and sometimes a webcam chat. Before their account is marked as 'verified'. This is behaviour is seen with exchanges, LocalBitcoins encourages this model.

  • 1
    The PAN (Card Number) is the only thing required for a card transaction, per the Card Brands. Whatever other things are required in practice comes down to the agreed upon configuration between the merchant and the payment processor. There are examples of CVV being required by the Merchant, but not validated by the Processor; it isn't required by unless they turn on that feature. – gowenfawr Nov 27 '18 at 13:52
1

The minimum payment information needed to process a payment transaction is usually card number, expiration, and CVV code, and in some systems cardholder name.

The rest of the information are essentially to feed into a fraud detection system (e.g. AVS or more sophisticated machine learning-based fraud detection systems) and/or to process refund or invoice, but often they are just collected by the merchant because the software they used asked for them as the software may have been designed for a different market where legislations may require merchants to collect such information from customers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.