1

I was shopping online and I could not buy the desired item, I could only make a request. After that, I received an email from the dealer:

“If you would like to proceed, please fill out the enclosed authorization form and email it back along with copy/picture of your credit card front and back and driver’s license (all required by the Finance Dpt.). Also please provide the complete street address, telephone and email."

In this “attached authorization form” (just a .doc file) I have to write all the numbers on my credit card, including billing address and card identification number.

Looks like too much information about me. Is this normal?

  • "online dealer" of what? buying what? check for yourself what it looks like opening a brokerage/investment account at a respectable major firm (vanguard or whatever). They do KYC/AML, but not like that. – Z.T. Jun 23 at 2:54
  • Also, since this is information security stack exchange, don't open doc file attachments on a pc directly. Open them on an iOS device or upload them to a google drive and open them there. – Z.T. Jun 23 at 2:57
  • It's just a fragrance. Sure, I didn't download this file – Ellen Jun 23 at 3:08
  • All of that is not normal, I suggest you find another place that sells the item. They should use a credit card processor like Stripe or PayPal (where the shop doesn't get your credit card details), and they don't need your id. – Z.T. Jun 23 at 3:11
  • 2
    If I were you I would report this seller to the authorities. – Martin Fürholz Jun 23 at 4:50
1

Run away!

The only information an online shop should need is address (delivery or invoice, one of which needs to match the card), cardholder name, card number, expiry date and CVV on the back.

Your card issuer will handle any additional authentication - and there's new regs coming in over the next few months to tighten up on this - and this does not go back through the merchant.

The only reason I could think of for additional info like drivers licence or utility bill is you're opening a line of credit with them and they're running a credit check, buying age-restricted items or something that needs a licence to purchase.

0

When you go to purchase something online, I assume you look for the HTTPS lock to verify that the credit card information you provide is protected in transit by encryption?

Same for any other PII information you may need to provide.

Why then would you go out of your way to construct an insecure email of all of that information, bypassing all basic security?

This makes no sense!

This is a strong indication that the organization you're dealing with is at least incompetent if not malicious.

On the other hand, I've seem some pretty strange ... stuff ... over the years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.