4

When a fraudulent credit card CNP (Card Not Present) transaction is made, merchant is liable for the chargeback.

For that reason, our company implemented a policy where we ask a photo of customer's card only showing the last 4 digits before we clear the payment. We ask them to send it via email which I think is a security risk because it could be unencrypted.

Our company provides electronically delivered financial services. So we only ask for billing address, we never deliver physical goods.

What's the better approach of verifying card ownership? (complying to PCI-DSS)

Improve this question
1
  • 1
    Have you asked your Processor what value-add services they can offer? Yours isn't a unique concern, and various processors have different services which can help.
    – gowenfawr
    Jan 13, 2015 at 22:01

2 Answers 2

Reset to default
8

I would suggest implementing Verified by Visa and Mastercard 3DSecure.

Ask your acquirer about enabling these services on your merchant account. Those 2 services will shift the liability to the customer provided that the correct VbV/3DS password/OTP authentication passed.

You could also select to reject cards that do not have VbV/3Ds enabled, or you could pass those transactions and take the chargeback risk.

If the financial services you provide only are "useable" in a specific country due to laws and such, I would suggest putting a geoIP lock on your site, and also ask your acquirer (or set it up in your merchant Control panel if they provide such facility) to lock so only cards issued in country X is accepted.

If you also want to use AVS (Address Verification System), I would suggest the user has to enter their billing address at sign-up, then you send a physical snail-mail with a one-time code required to activate account. Then only this billing address can be used. Changing of billing address deactivates account and sends a new snail-mail code to the new address. This also both adds convenience to the customer (he does not need to enter his billing address all the time), auditability (you have a real address for the customer to give to the police in case of fraud), and security (since the address is both verified by snail-mail and against the credit card).

Improve this answer
8
  • 1
    Just be warned that GeoIP is not completely accurate, so using it for blocking has a not-insignificant chance of blocking legitimate users (the larger your userbase is, the higher the chance of such an occurrence). If you use it, you should give them the option to manually contact and request an unblock (and make sure your site has that capability).
    – Bob
    Jan 14, 2015 at 0:35
  • @Bob And the flip side--a GeoIP lock may block legitimate users who are traveling.
    – Loren Pechtel
    Jan 14, 2015 at 4:33
  • For the record, I have had experiences with Verified by Visa in which legitimate transactions were blocked.
    – Cat
    Jan 14, 2015 at 5:35
  • @Bob I would not suggest a manual bypass, because it boils down to the very same problem that the block was originally meant to solve. Its very uncommon that it does block a legitimate user, and incase, you can ask the end user to turn to ISP support since the fault is often on their side when multi-national ISPs does not update assignment country if they decide to move a IP range to a Another country.I would say its better to reject those customers completely. You could even -j DROP traffic from invalid countries for even additional security, since then the geoIP block is managed by firewall.
    – sebastian nielsen
    Jan 14, 2015 at 10:28
  • @sebastiannielsen The very first rule of IPs is to never make assumptions about the location, number of people sharing it, or lease time (never assume it's permanent). They get shuffled around frequently, and it's trivial to redirect (so a block isn't even all that useful, since an attacker can trivially get a tunnel to an in-country IP). It's up to the OP to decide if the advantages are worth it - it's a very minor barrier to any determined attacker, but causes significant inconvenience to legitimate users caught out by it.
    – Bob
    Jan 14, 2015 at 13:56
2

This should be a comment, but it was getting a bit long....

I reckon I could fake such a picture in about 30 minutes to a level where it would take a competent data forensics expert to spot. I don't have specialist skills/tools.

And you seem to be confused about what you are trying to protect here. This is a leak in transferring the last 4 digits of the credit card unencrypted but it is very minor. And it is orthogonal to the threat you are trying to address (i.e. verifying the card ownership).

Hence I don't think what you are doing is adding any value, but I don't think it is doing any signifcant harm.

"we only ask for billing address" - but you have lots of other information you can use for identifying fraud - source IP, HTTP headers, user agent, product requested, time of day, navigation patterns. And you could easily add additional capture such as verfied email address, browser fingerprint. While these do not prevent the first instance of a fraud, they can be used to prevent recurring fraud.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .