0

I need to pass credit card information for a travel reservation, and I am thinking of splitting it over email and text. The credit card number itself would be send over text, while expiration date and verification number would be send over email. How would you evaluate this technique in terms of security?

  • 1
    Who are you passing it to? Do you trust them? – Bobson Dec 14 '18 at 3:30
  • If I had to split the data, I guess I would split the credit card number in half, instead of sending it all – reed Jan 13 at 16:27
  • @bart - Can you not organize payment via a payment gateway? Is credit card the only form of payment? Can you not pay in person? Is there the option to use a throwaway card? – Motivated Jan 14 at 6:52
  • 1. How sure are you that they are legitimate? 2. Do they not have an HTTPS web CC acceptance site? – zaph Jan 14 at 17:24
2

Technically not secure, although as a result of a push by Google in the last couple of years, most (90 % ish) server-to-server email relays now use an encrypted connection, but it's still clear text on each server.

If you're going to provide the info, doing so by a voice call is probably as practical as possible.

Since you're already considering email for a piece, I suggest simply encrypting the email.

Ideally all parties would be familiar with using PGP/GPG for encryption, but unfortunately this is unlikely. Instead, put it in a file and ZIP it with a password. Most people know how to handle ZIP files. You still need to deliver the password out-of-band but you can do that with a voice call or depending upon the relationship with a cryptic reference common to you both.

1

Both SMS and email don't use encryption and aren't authenticated, so technically they are not secure. However, in practice it is unlikely that your credit card number will be compromised.

Assuming you know this other person well, a slightly better way would be to pass information by phone. This way, you at least know that the recipient is who you think it is.

Normally, credit card companies have protection against abuse and are quite lenient in giving you your money back if your card is abused. However, if you willingly give your number and verification number to another party this may change things.

  • If information is passed over the phone, doesn't that assume that the recording of the sensitive information is secure? On the comment of willingness, isn't this the case each time a purchased is made e.g online shopping? – Motivated Jan 14 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.