0

I need to pass credit card information for a travel reservation, and I am thinking of splitting it over email and text. The credit card number itself would be send over text, while expiration date and verification number would be send over email. How would you evaluate this technique in terms of security?

4
  • 1
    Who are you passing it to? Do you trust them?
    – Bobson
    Dec 14, 2018 at 3:30
  • If I had to split the data, I guess I would split the credit card number in half, instead of sending it all
    – reed
    Jan 13, 2019 at 16:27
  • @bart - Can you not organize payment via a payment gateway? Is credit card the only form of payment? Can you not pay in person? Is there the option to use a throwaway card?
    – Motivated
    Jan 14, 2019 at 6:52
  • 1. How sure are you that they are legitimate? 2. Do they not have an HTTPS web CC acceptance site?
    – zaph
    Jan 14, 2019 at 17:24

2 Answers 2

2

Technically not secure, although as a result of a push by Google in the last couple of years, most (90 % ish) server-to-server email relays now use an encrypted connection, but it's still clear text on each server.

If you're going to provide the info, doing so by a voice call is probably as practical as possible.

Since you're already considering email for a piece, I suggest simply encrypting the email.

Ideally all parties would be familiar with using PGP/GPG for encryption, but unfortunately this is unlikely. Instead, put it in a file and ZIP it with a password. Most people know how to handle ZIP files. You still need to deliver the password out-of-band but you can do that with a voice call or depending upon the relationship with a cryptic reference common to you both.

3
  • If you encrypt your zip with ZipCrypto, the protection is poor. If you encrypt it with AES-256, not all archiving programs will know how to open it.
    – Brian
    Nov 12, 2019 at 19:29
  • Winzip introduced AES support in 2004. Nov 13, 2019 at 21:38
  • Sure, but plenty of people rely on Windows explorer to open zip files, rather than a dedicated utility. Windows Explorer does not support AES.
    – Brian
    Nov 13, 2019 at 21:52
1

Both SMS and email don't use encryption and aren't authenticated, so technically they are not secure. However, in practice it is unlikely that your credit card number will be compromised.

Assuming you know this other person well, a slightly better way would be to pass information by phone. This way, you at least know that the recipient is who you think it is.

Normally, credit card companies have protection against abuse and are quite lenient in giving you your money back if your card is abused. However, if you willingly give your number and verification number to another party this may change things.

1
  • If information is passed over the phone, doesn't that assume that the recording of the sensitive information is secure? On the comment of willingness, isn't this the case each time a purchased is made e.g online shopping?
    – Motivated
    Jan 14, 2019 at 6:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .