I want to know how to secure credit card order with blank mail.

My boss instructing to create new site like as below: 1) User send "Blank e-mail" to new site. 2) The site returns mail including URL, the URL is display credit card number to start payment. 3) After input credit card number and press OK, then display input CVV2 code page. The input page is provided by credit-card company. 4) Payment is completed, then the site returns PIN code to the e-mail address.

We use "Blank e-mail" feature to get "from address".

The boss said, we always use CVV2, so the system is secure. But I think it is not secure because there are no limitation about try other CVV2 code with same credit card number. And the system does not have membership, so there are no login system. First target OS is smartphone (android and ios), and second target will PC.

Is there any idea to more secure the system, or any succeeded site with similar style, please let me know.


1 Answer 1


It's difficult to comment given that it's unclear what your purchase model is supposed to be. In particular it is not clear what the “blank e-mail” feature is for. Are you trying to do e-mail address verification?

The more usual method is to allow the user to enter an e-mail address on a web form, and then receive a mail containing a token or URL that confirms they received it. I think most people would probably find sending an e-mail to request that token in reply less convenient than the typical web form model.

There are reasons to want to do e-mail address verification but none that really constitute extra security for a simple payment processor form. If you are concerned about brute-force attacks against the CVV2 field, then (a) that's normally the payment system's concern, not yours; (b) e-mail addresses are not a scarce resource (anyone can create millions of them instantly), so verifying addresses and limiting attempts per address is not an effective form of rate-limiting.

Your step (2) makes it sound like you are serving the page containing the form to enter the credit card number (PAN) into. Is this not something also handled by the payment processor? If you are accepting PANs yourself you are bringing some hefty PCI-DSS requirements down on your head, are you sure that's what you want?


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .