Deleting credit card information after every transaction

Question

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every transaction be effective in securing it from this kind of theft?

Answer 1

effective in securing it from this kind of theft?

Threats against credit card information while shopping online are diverse. I would say that your proposal is effective (as oppose to having no effect whatsoever), but the overall threat reduction is small.

This technique might be effective in partially mitigating some of the following threats:

• Companies who store your credit card details at rest in either plain text or with weak encryption
• Threats from malicious employees who might have access to the database
• An attacker who compromises your account and places orders while logged in as you

However, this technique would make little difference in the following circumstances:

• Man-in-the-middle attacks where the attacker can observe your credit card details during transmission (SSL/TLS is effective at controlling this threat but that's another story)
• Compromised software or malware on systems that interact with your credit card details, such as web servers, databased servers, payment terminals
• Attackers who have access to database backups which might contain your credit card details even after they've been removed from your account
• Software which does not actually function in the way you'd expect. For example, you can't be sure the system doesn't just mark your credit card record as inactive as oppose to physically deleting it. You also can't be certain the record is securely deleted and not recoverable by someone who has access to the hardware.
• If your credit card details are included in any logs which might remain even after you've removed the credit card from your account
• Dodgy merchants and phishing

There have been many reports of hackers compromising credit card information

If we look at a few recent case studies:

Target

At the critical moment — [...] — the malware would step in, capture the shopper’s credit card number, and store it on a Target server commandeered by the hackers.

It wouldn't have been effective in that case as the attack was executed while the payment was being processed rather than while the credit card details are at rest.

Staples

Staples says as many as 1.16 million customer credit cards may have been compromised as part of a malware attack

Home Depot

the malware in this attack was embedded in the company's in-store payment systems

So it would seems that malware is a common thread in several of the most publicised attacks. Having said that all these examples are big-box retailers rather than strictly online stores.

TLDR; It would have some effect, but overall probably not enough to be worth doing and it depends on the merchant whether it would be effective at all.