So I decided to purchase a service in website which only accepts payments where I need to enter my debit card information. Now connection is secured with TLS 1.0, so no 3rd party can observe my payment data, but what about website itself?

Edit: I need to enter Card Type, Card Number, CCV number, Expiration date, etc., all the regular stuff when purchasing using credit/debit card without using 3rd parties like Paypal.

Can it see my debit card number and if yes, then it can collect it and store that information?

  • 1
    We need additional information. Does the website forward you to an external payment processor (PayPal, ...)? Or does it seem like you have to enter your credit card information on the same domain? – executifs Apr 30 '14 at 8:57
  • You need to enter Card Type, Card Number, CCV number, Expiration date, etc., all the regular stuff when purchasing using credit/debit card without using 3rd parties like Paypal. – user1880405 Apr 30 '14 at 9:01
  • Then the website has access to the data you send. What it does with it, and how it chooses to handle it (and whether that choice is PCI-compliant) is anyone's guess. – executifs Apr 30 '14 at 9:06
  • But then it looks extremely insecure, what if website stores that data and then sells all that information for the fraudsters later? – user1880405 Apr 30 '14 at 9:11
  • 2
    This leads us to a valuable life lesson: don't give your credit card information to people you don't trust. – executifs Apr 30 '14 at 9:12

Your card information goes wherever the form you filled out submits it to. You could connect to a perfectly encrypted HTTPS page with valid SSL, but if the form submits by sending an e-mail to mybankhacker.com, then that is where it will go. Most of the time, it is submitted back to the server itself that you are connecting to and they then relay it to their merchant service provider to charge your card, only legal agreements prevent them from keeping a copy.

In other situations, they may not want the legal burdens that accepting credit cards requires, so they may submit it to a merchant service provider, such as Authorize.Net, which handles the processing. In this case, the form they display would actually be provided by Authorize.Net's server and would submit to Authorize.net directly and they would only get a confirmation code after you complete the transaction. (Though Authorize.Net could still keep a copy if they wanted.)

Another situation is that where they actually fully redirect you to the merchant service provider or payment gateway. Sites that use Paypal, Google Pay or Amazon Payments are examples of this. Authorize.net also provides an option like this. In these cases, you get redirected to the merchant service provider's website, fill out your details on that provider's site and it then redirects you back. Again, only the merchant service provider then gets your details and the vendor/site you were originally visiting only gets confirmation of payment.

PCI-DSS is the security document that governs what rules people are supposed to follow for dealing with your credit card information (formally known as payment card information or PCI) however outside of an audit by the merchant service provider or merchant bank that handles their credit card transactions, there is no guarantee that they are following the requirements.

| improve this answer | |
  • Well explained answer. My bank also asks for special password when trying to make card payment like these, but still I somehow just don't trust random website. – user1880405 Apr 30 '14 at 20:37

If you enter your credit card data on a website then yes, the website can see your credit card data.

If the website redirects you to PayPal, and then you enter your credit card data on PayPal, only PayPal sees your credit card data and not the original website.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.