When on any retailer website at the very end we are asked to make a payment. However it is not uncommon to not be taken to an external portal, usually, for example, aliexpress and Amazon will ask to use your credit card details while still on the website. e.g. the url that Aliexpress will ask you to enter your credit card details on is shoppingcart.aliexpress.com/orders?=.... However this also holds true for Amazon and every online retailer.

My question is, it doesn't matter if the website is over HTTPS, all that means is that the data is being sent over encrypted. My concern is that the website you're on, could still store and keep the information you wrote because you're still on there website.

Is this concerning? For this reason I will only ever make payments using Paypal and verify the digital certificate is from paypal.com

  • 2
    I'm not sure what you are asking. You seem to assume that only Paypal is able to handle credit card information in a secure way - which is wrong. Neither does Paypal offer 100% security for your credit card nor do others cannot get the same level of security for your data Paypal has. "... and every online retailer." - this isn't true. Smaller online retailers often outsource the payment process to Paypal, Amazon, Stripe, ... Jul 22 '20 at 6:05

My concern is that the website you're on, could still store and keep the information you wrote because you're still on there website.

  1. Has it ever occurred to you that when you're paying in real life, complete strangers may take photos of your card and use them to make purchases on your behalf?

  2. Most banks and financial institutions provide notification services (e.g. texts or their apps) when there payments made with your card - use them. Some employ various two-factor authorization features - enable them if you can.

  3. Some banks issue one-time cards for making purchases - that's a good solution for protecting yourself from bad actors.

Unfortunately, the way plastic cards work there's very little security.


Claiming PayPal is a very secure method of payment is wrong. PayPal is located on the internet, and any server/service on the internet can be hacked if the correct exploit used to leverage a vulnerability. Thus, your PayPal account can get hacked, like anything else on the internet. The result would be as bad as some internal adversary (internal attacker) on the external portal website using the credit card information you provided. In fact, it does not even have to be an internal employee as the external portal is also located on the internet, thus it too can get hacked.

When it comes to credit card information storage, and there is no website account with that external portal, the legitimate websites usually have an information retention policy. Information retention policies usually dictate what type and how long can different types of user information can be held within the organizations database. Once the retention time frame for that type data is reached, that information must be removed. Some large companies usually state on their website what the retention policy is.

The best way to protect yourself is to see if the website that you are supplying the credit card information to, is legitimate, well known, and has a good reputation. Do research about the company online, if you do not know about the company your sending your credit card information to. It also is wise to check with the Better Business Bureau website, to see if the company is a scam company. However, there are times where BBB website usually displays a lot of complaints for legit well-known companies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.