My client physically makes online purchases (through various websites) on his customer's behalf using their credit cards. His clients have basically said "here's my credit card, buy what you need to." Currently, I'm assuming he has his customer's credit card details locally stored in a file on his computer.

He would like to centralize the credit card information so that he can delegate the purchasing task to another employee while still being able to access and keep the card information updated himself.

Can anyone recommend a secure way to to accomplish this?

  • 1
    I'm fairly sure there are local laws, and policies set out by your payment processor. You could check with them. – WalterJ89 Nov 19 '13 at 23:38
  • 1
    Keep it in the existing file? I'm not sure what you're asking for. What are you hoping to protect against? I would note that PCI-DSS has some very specific things to say about the storage of credit card details, and those details lay out some security methods to employ. – schroeder Nov 20 '13 at 20:21
  • Just to clarify, he's not using a payment processor. The purchases are made physically, online, through various websites using his clients card information, which he's storing on his computer, I assume. He wants to make the card information available to someone else so they can also make these purchases. His clients have basically said "here's my credit card, buy what you need to." – Lauren Nov 21 '13 at 14:50

From what you've said, he clearly does not understand the enormous size of the risk he's taken with this. I assume that if he is doing shopping for other people, those other people are wealthy, and have high dollar limit (possibly unlimited) credit cards. He needs to be aware that if this data is stolen, he will be personally held liable for all the fraud committed.

If he has the cards of 10 million-dollar clients, he needs to treat these card numbers as if they were $10 million worth of diamonds. He should keep them on a piece of paper, locked in a safe. If it were me asking one of my employees to use a card, I would have them come into my office and ask me to type in the card number for them, instead of giving the card numbers away.

Some other piece of bad news is that if one of his clients' cards is stolen somewhere else (at a restaurant or gas pump skimmer), and if Visa learns he has stored these card numbers, they may hold him liable anyway -- even if he had nothing to do with the actual theft or fraud.

Making it easy to get at should be the opposite of what he wants. He should instead be paranoid about who can get to this list.

Since he is lacking the security basics (demonstrated by failing to understand the value of what he's been entrusted with) I further doubt his ability to maintain a secure computing environment. He needs to understand that he can't afford to trust this information to a computer that could be hacked in exchange for a little convenience.

| improve this answer | |
  • I'm going to point anyone that mentions storing credit cards to this answer. Awesome. – Lauren Nov 21 '13 at 17:23
  • I often use the metaphor "radioactive gold" when talking about card numbers and PCI DSS. You need to treat them like they're extremely valuable, but completely toxic. – John Deters Nov 21 '13 at 17:58

This is almost more of a regulatory or procedural question than it is a technical one. As often as not, the merchant will be enjoined from storing much of this data at all (particularly stuff like the CVV2 code), or else they will be required to comply with something like PCI-DSS, so assuming your client is the acquirer (eg. if he holds a merchant account and processes payments), he should probably talk it over with his processor and hire a qualified consultant to become compliant.

In general, you shouldn't do this at all if you can avoid it. However, if you absolutely must, some strategies involve encrypting the data in some way and storing it in a location where it's hard to get at it from the internet (such as an offline computer, or a computer on a restricted network of some sort). It's even better if each card can be individually encrypted, possibly with some salt to hinder cryptanalysis, with a key that is in an HSM someplace that only exists when necessary.

I realize this is painting with broad strokes, but if you're looking for a turnkey solution for this, you're a bit out of your depth.

| improve this answer | |
  • Thanks for your input Falcon. This is actually the advice I keep coming across when searching but his situation is a bit different in the sense that he's actually physically making these purchases using his customer's credit cards through various websites. There's no payment processor or merchant account involved, at least not in the way you're assuming. – Lauren Nov 21 '13 at 15:04
  • If there isn't any merchant agreement, the breach of contract (if any) lies entirely with his customers, and he can do almost whatever he likes (though lawyers can help clarify that, as there is in fact some liability arising from this). In this case, ignore the first and last paragraphs. – Falcon Momot Nov 21 '13 at 20:38

The easiest way I can think of to protect the credit card details would be to write them on paper, and store them in a locked filing cabinet. Then he can remove them from his computer.

| improve this answer | |
  • Thanks David. Yea, I had a feeling this would be suggested. It was my first thought too :) However, I have a feeling that telling him this won't deter him and he'll just end up figuring out a solution on his own, like sharing it in a Google Doc or something, that would likely be way more insecure than anything I might be able to recommend. I'm his web developer and originally he had asked me to store the card details in the web application I developed. I told him that wouldn't be possible but that I would help him to find a solution. – Lauren Nov 21 '13 at 15:10

If you are planning to store client card details you will be covered by the Payment Card Industry (PCI) regulations which require that card data is stored securely and that your systems are audited.

There is a lot to do but you could start here. http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard

Essentially you should consider carefully whether you really need to do this or if it is safer, and cheaper, to pay a third party to handle your transactions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.