3

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every transaction be effective in securing it from this kind of theft?

  • 1
    The question would be how to stop this kind of theft ? There is enormous ways of stealing credit card information far of the database itself. – amrx Apr 26 '15 at 13:06
3

effective in securing it from this kind of theft?

Threats against credit card information while shopping online are diverse. I would say that your proposal is effective (as oppose to having no effect whatsoever), but the overall threat reduction is small.

This technique might be effective in partially mitigating some of the following threats:

  • Companies who store your credit card details at rest in either plain text or with weak encryption
  • Threats from malicious employees who might have access to the database
  • An attacker who compromises your account and places orders while logged in as you

However, this technique would make little difference in the following circumstances:

  • Man-in-the-middle attacks where the attacker can observe your credit card details during transmission (SSL/TLS is effective at controlling this threat but that's another story)
  • Compromised software or malware on systems that interact with your credit card details, such as web servers, databased servers, payment terminals
  • Attackers who have access to database backups which might contain your credit card details even after they've been removed from your account
  • Software which does not actually function in the way you'd expect. For example, you can't be sure the system doesn't just mark your credit card record as inactive as oppose to physically deleting it. You also can't be certain the record is securely deleted and not recoverable by someone who has access to the hardware.
  • If your credit card details are included in any logs which might remain even after you've removed the credit card from your account
  • Dodgy merchants and phishing

There have been many reports of hackers compromising credit card information

If we look at a few recent case studies:

Target

At the critical moment — [...] — the malware would step in, capture the shopper’s credit card number, and store it on a Target server commandeered by the hackers.

It wouldn't have been effective in that case as the attack was executed while the payment was being processed rather than while the credit card details are at rest.

Staples

Staples says as many as 1.16 million customer credit cards may have been compromised as part of a malware attack

Home Depot

the malware in this attack was embedded in the company's in-store payment systems

So it would seems that malware is a common thread in several of the most publicised attacks. Having said that all these examples are big-box retailers rather than strictly online stores.

TLDR; It would have some effect, but overall probably not enough to be worth doing and it depends on the merchant whether it would be effective at all.

  • 1
    To add one more "little difference" to @thexacre excellent list: the actual ecommerce transactions that are sent to the backend credit card processor. These are separate from the account database, and also contain a copy of the credit card information (number, exp date, sec code). On poorly designed web sites, these ecommerce batches are kept in temporary text files literally in a common TEMP directory! So a site may boast they encrypt your credit card info, but behind the scenes leave it in-the-clear in a temporary text file. Several past compromises have used this flaw. – cybermike Apr 26 '15 at 5:54
  • @cybermike that's essentially what I meant by "software which does not actually function in the way you'd expect", but yes that's a prime example of why you can't assume removing your CC details from your account will actually remove all traces of it. I've actually seen a system that does exactly what you describe yet it was apparently implemented according to the bank's reference implementation... I'm sure it's frighteningly common. – thexacre Apr 26 '15 at 6:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.