4

Today I was purchasing a gift from Singapore Groupon website. And then I realized that what I have to do is simply login and hit the "submit order" button, because they store my credit card information from my previous purchase.

By credit card information here I mean: credit card number, credit card validity date, and security number behind the card (CVV2). Which are more than enough for a thief to empty your bank account (more easily if it's a Debit VISA card).

I'm sure that they've stored my credit card information because I started with a "clean browser" by using Firefox's private browsing. As you can see below at the screenshot right after I clicked "Buy" on any of the deal, I don't have to enter anything, they have it all. Even they're showing the validity date on the screen:

enter image description here

I somehow kind of know that it's illegal to store customers' credit card information especially for being ready to use for the next purchase (so that they don't have to re-enter the information). But I couldn't find it on Master Card or VISA agreement.

Is there any official law about this, and where can we report something like this?

If it's really illegal, I would want them to at least being fined for what they've done.

[EDIT]

Here's what they've put on the FAQ page: http://www.groupon.sg/faq

Is Groupon safe?

Extremely. Your credit card number is transmitted by SSL directly to a secure electronic vault. At no time is your credit card information stored on our servers. Nonetheless, this security only applies if you log out of your Groupon account after use! It is your responsibility to keep your Groupon account secure.

The fact is, they store the credit card information, and you're even provided to register with Facebook account. One simple click "connect to FB", and you won't even need to enter any password to charge the credit card.

Even if it's legal, they have shown some careless quality in handling the payment process. They don't provide an appropriate interface to protect our security.

[UPDATE from latest answers] According to some answers on this post below, it turns out that it's legal to store credit card information, only that the website is supposed to follow the security standard from PCI-DSS. But it seems like there's no one who is responsible to ensure if every website is following the standard?

Not sure if this only happens on Groupon Singapore or all Groupons around the world.

https://stackoverflow.com/questions/8425707/groupon-sg-is-storing-customers-credit-card-information

Improve this question
7
  • You said "I somehow kind of know that it's illegal to store customers' credit card information", but then go on to ask what law exists to make this illegal? Can you clarify? Can you also clarify which country this applies? Singapore I'm guessing?
    – Steve
    Dec 8, 2011 at 5:05
  • Hi Steve, I searched on some forums, people said that it's illegal. I'm asking for Singapore.
    – dresden
    Dec 8, 2011 at 5:51
  • 1
    Hi Greg, but I started with a clean browser and clicked the "submit order" button without entering anything at all, and my credit card was charged.
    – dresden
    Dec 8, 2011 at 6:32
  • 1
    The CVV2 is not required for all transactions. It is required to ensure that you have the card present in front of you (to prevent fraud). However, there are several ways that you can avoid needing to type in the CVV2 each time. Recurring payments are one such way to avoid this. Presumably, Groupon attached some "trust" with your credit card against your groupon account which is why they asked for it in the first place. After this, it is not mandatory.
    – logicalscope
    Dec 8, 2011 at 6:50
  • 2
    I am not sure what you mean by 'careless quality' - I am pretty certain it works as it is designed, which is to make it as easy as possible for customers to make the purchase.
    – Rory Alsop ♦
    Dec 8, 2011 at 9:19

3 Answers 3

Reset to default
5

I don't believe there are any actual LAWS in place to prevent storing credit card details aside from those meant to protect against fraud. However, the PCI-DSS certainly takes a much harder stance against the storage, transmission, and processing of credit card details. The penalties are against the merchant, and can be quite severe, so there are industry-based sanctions to deter against failing to adhere.

If you read the PCI-DSS compliance text, you'll see that a merchant -- with the proper infrastructure and security systems in place -- is allowed to store the full CC#, expiry date, and name on the card. They CANNOT store the CAV2/CVC2/CVV2/CID under any circumstances (not even in an encrypted manner). See section 3.2.2 of the PCI SAQ-D (which is the most general form of the PCI-DSS assessment questionaire).

Are you sure they are storing the digits on the back of the card? This is a very blatant violation. Both VISA and MC have methods to report merchants which do not adhere to PCI-DSS and as global brands, they are enforced in Singapore.

Improve this answer
4
  • Hi Greg, thanks for your answer. Do you know how to report to VISA/MC? Yes, I'm sure they store CVV2. I've updated my post.
    – dresden
    Dec 8, 2011 at 6:12
  • 4
    @MiMee - they may not need your CVV2 to pass the transaction. It isn't always needed, depending on how the merchant has things set up. This could count as a 'recurring payment'. I would check your assumption before you try to contact Visa/MC
    – Rory Alsop ♦
    Dec 8, 2011 at 9:17
  • I don't understand though why they would display CVV2: *** when they aren't really having it.
    – dresden
    Dec 14, 2011 at 1:57
  • @Mi Mee, because a large number of the population is ignorant, at it may be easier to let them believe that everything need is already stored.
    – Zoredache
    Dec 14, 2011 at 6:25
4

I have emailed VISA AIS team, and here is their reply:

Thank you for reaching out to Visa AIS Team. With the information provided, we are unable to confirm if Groupon stores sensitive card information. The asterisk may not represent the actual CVV2 and your card account number is also masked . If you have any concerns regarding your credit card account, kindly contact your issuing bank to file an official compliant. Thank you.

Best Regards,

AIS Team

============================

I guess there's really nothing we can do then. However, I will manage to close my account on Groupon.

Thank you Greg for sharing your experience.

Improve this answer
2
  • If you are worried then remove your information after each purchase. This is what I do in the case of Amazon and other online retail stores like Walmart, Sears, ect.
    – Ramhound
    Dec 8, 2011 at 17:43
  • But there is no selection to "remove information" on Groupon.
    – dresden
    Dec 9, 2011 at 2:46
1

I do not know Groupon PCI-DSS posture but they may not be handling the transactions themselves. There are many companies which handle the actual transaction and just provide an IFRAME to be integrated to the store application (or redirect to their site - but this is probably not your case). This is usually used with stores who do not have a large volume of transactions.

Otherwise as noted by Greg the company may have gone for a PCI-DSS assessment (SAQ D) which is quite comprehensive.

Alternatively you may want to check if your bank issues virtual CC numbers (you get a unique, one-time use number which allows for a transaction of a predefined amount)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .