We are a medium sized company. Recently, one of the representatives of the finance department raised a question about the use of credit cards to shop on-line among different departments in our company.
His concern relates to cases when a person from Department X requests to make a purchase from a site directly from his/her office computer. The reason for doing so is having direct access to some sensitive data needed right at the moment of purchase.
Currently, a finance representative walks up to the employee's office and provides the CC number.
Obviously, the risk comes from the stored CC information under that session associated to the user profile in the on-line store. Several risk scenarios rises like this if the user accidentally makes more purchases with that CC information, if that information is leaked, or if the user account is compromised.
We have proposed solutions such as using pre-paid credit cards, Verified-by-Visa, or safetypay, which requires accepting purchases (Finance Dpt) by someone else after submitting a purchase order (Dpt. User who purchases). However, not all online stores accept these payment methods not even Verified-by-Visa.
Alternative solution is to make the purchaser sign a form where Dpt. X accepts all the responsibility derived from the use of this corporate credit card. Nevertheless, we think this measure lacks the prevention factor an information security strategy must embrace.