So I decided to purchase a service in website which only accepts payments where I need to enter my debit card information. Now connection is secured with TLS 1.0, so no 3rd party can observe my payment data, but what about website itself?

Edit: I need to enter Card Type, Card Number, CCV number, Expiration date, etc., all the regular stuff when purchasing using credit/debit card without using 3rd parties like Paypal.

Can it see my debit card number and if yes, then it can collect it and store that information?

  • 1
    We need additional information. Does the website forward you to an external payment processor (PayPal, ...)? Or does it seem like you have to enter your credit card information on the same domain?
    – executifs
    Apr 30, 2014 at 8:57
  • You need to enter Card Type, Card Number, CCV number, Expiration date, etc., all the regular stuff when purchasing using credit/debit card without using 3rd parties like Paypal. Apr 30, 2014 at 9:01
  • Then the website has access to the data you send. What it does with it, and how it chooses to handle it (and whether that choice is PCI-compliant) is anyone's guess.
    – executifs
    Apr 30, 2014 at 9:06
  • But then it looks extremely insecure, what if website stores that data and then sells all that information for the fraudsters later? Apr 30, 2014 at 9:11
  • 2
    This leads us to a valuable life lesson: don't give your credit card information to people you don't trust.
    – executifs
    Apr 30, 2014 at 9:12

2 Answers 2


Your card information goes wherever the form you filled out submits it to. You could connect to a perfectly encrypted HTTPS page with valid SSL, but if the form submits by sending an e-mail to mybankhacker.com, then that is where it will go. Most of the time, it is submitted back to the server itself that you are connecting to and they then relay it to their merchant service provider to charge your card, only legal agreements prevent them from keeping a copy.

In other situations, they may not want the legal burdens that accepting credit cards requires, so they may submit it to a merchant service provider, such as Authorize.Net, which handles the processing. In this case, the form they display would actually be provided by Authorize.Net's server and would submit to Authorize.net directly and they would only get a confirmation code after you complete the transaction. (Though Authorize.Net could still keep a copy if they wanted.)

Another situation is that where they actually fully redirect you to the merchant service provider or payment gateway. Sites that use Paypal, Google Pay or Amazon Payments are examples of this. Authorize.net also provides an option like this. In these cases, you get redirected to the merchant service provider's website, fill out your details on that provider's site and it then redirects you back. Again, only the merchant service provider then gets your details and the vendor/site you were originally visiting only gets confirmation of payment.

PCI-DSS is the security document that governs what rules people are supposed to follow for dealing with your credit card information (formally known as payment card information or PCI) however outside of an audit by the merchant service provider or merchant bank that handles their credit card transactions, there is no guarantee that they are following the requirements.

  • Well explained answer. My bank also asks for special password when trying to make card payment like these, but still I somehow just don't trust random website. Apr 30, 2014 at 20:37

If you enter your credit card data on a website then yes, the website can see your credit card data.

If the website redirects you to PayPal, and then you enter your credit card data on PayPal, only PayPal sees your credit card data and not the original website.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .