Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

5
votes
2answers
141 views

Can I repair a cut-through credit card?

On many cards there's the instruction to, if found, cut it in two pieces and mail them to some address. I'm wondering a bit about the security of this and if I could recover some data. It's not ...
0
votes
1answer
38 views

How to export application metrics out of PCI environment

I am building a credit card tokenization/payment-processing service. As these services need sit in pci-compliant environment, I find it hard to export the application metrics & logs. Anyone knows ...
0
votes
1answer
43 views

PCI-DSS compliance in scope if part of card number and expiry stored only? [duplicate]

If we were to store the following information about a credit card, would we need to be PCI-DSS compliance or are we out of scope? Please assume for the purposes of this question that we only store ...
2
votes
1answer
69 views

Router as MITM to steal data

I was reading a blog post about ATM skimming and the following quote (at the end of the article) caught my eye: Ivanov allegedly used two devices — a router to steal the bank data of customers ...
2
votes
0answers
30 views

Algorithm to generate (and verify) string of 4 quad alpha numeric code

I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
8
votes
1answer
83 views

Is CVV calculated or merely assigned?

Is the 3-digit (4-digit for those acolytes of standardization, American Express!) CVV/CSV/CVC calculated from card number and expiration date, or is it merely assigned? I know that once when I got a ...
2
votes
3answers
139 views

Emailing debit card details to a guesthouse

I'm trying to arrange a holiday out to the Aran Islands, and the guesthouse emailed me back confirming that they do have a room available. But here is the catch: they want me to email my credit card ...
4
votes
1answer
75 views

Wiping magnetic stripe on card with magnet?

I asked a question a while back on using magnets (for example powerful Neodymium ones) to wipe a HDD, and got shown a good article proving it is not possible to wipe data. Pretend I am about to ...
0
votes
1answer
84 views

Unauthorized credit card payment

I have a debit card which links to my savings account in a let's call it Bank A. I had never used it for online purchases/transactions (not even interbank transfer). After a while, I purchased virtual ...
0
votes
1answer
66 views

What's the best way to test if an RFID blocking wallet is effective? [closed]

I was recently gifted a wallet that alleges to block RFID signals. As I am sure you fine folks at Information Security are aware, this is to protect the information stored on my contactless bank card ...
9
votes
2answers
2k views

What are the security implications of my credit card number being known by someone else? [duplicate]

I am new to the credit card world. What are the security threats or possibilities, if someone knows my credit/debit card no. Will he be able to misuse it or will he require any additional information ...
9
votes
1answer
180 views

How do EMV contactless cards protect against replay attacks?

I understand that standard RFID cards are vulnerable to replay attacks however, how do smart cards which are also contactless protect against replay attacks? Is this decided by the chip or by the ...
4
votes
2answers
81 views

Does EMV protect against sniffing PAN data from untrusted network?

I have received conflicting information in regards to the security of PAN data on the wire. Can this be sniffed with properly configured EMV at an atm? To quote from the link below: ...
4
votes
0answers
38 views

Major UK company seems to be handling customer & card data recklessly [duplicate]

A company I used to work for is passing customer's personal details as well as card data (number, expiration date, name, CVV2 and the contents of the magstripe thanks to a reader) through Windows XP ...
2
votes
4answers
77 views

Is knowing someone's card expiration date a means of finding info about them?

Card as in debit or credit cards. I heard that even showing someone your debit/CC can be considered an exploit not because of the number or name, but because of the date of expiration. He said that ...
3
votes
3answers
187 views

Creditcard store first six digits PCI reference

I need to store masked PAN with first six digits and last four digits along with the card expiry month and year. Is it safe to do it according to the PCI rules? Regarding four digits has been ...
1
vote
1answer
61 views

Is it dangerous to have a credit card payment page without authentication?

The client wants a payment page that anyone can browse to, put in their information and id from a previous registration, and make a payment. The problem is that the id is from a different system and I ...
2
votes
3answers
82 views

Reporting Credit Card Thieves

Someone is using a client's commerce site to check the validity of lots of credit cards. After dropping IP addresses based on usage whoever is behind it throttled their requests down to 1 request ...
5
votes
3answers
822 views

Cardholder data segmentation for PCI compliance (3.2)

We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B Over channel A (mobile carrier) we collect the first 8 ...
0
votes
0answers
39 views

Hash function for credit card [duplicate]

Hey PCI and hash expert, What hash function is good for hashing credit card and providing collision resistance? Some context: We are building a tokenization service, so each credit card will have ...
4
votes
1answer
290 views

Credit card tokenization algorithm

Just curious, what is the common algorithm used to tokenize a user's credit card? I know lots service use PRNG (random number). Does it just re-gen a random number when there is a confliction? What ...
0
votes
5answers
329 views

Is it safe to tell credit card number to bank employee over a phone?

Recently, I got a new credit card via post. To activate it, it is required to call to the bank (phone number is attached to the card) and confirm, that card was received. For activation purposes, the ...
3
votes
2answers
107 views

How to manually disable the no contact card?

New payment cards in my country are now delivered with the no-contact option that allows pay without putting the card in a machine. The fact is that these cards aren't secured because you can read ...
8
votes
4answers
788 views

When paying for something on line, is paying with a checking account less risky than paying with a credit card?

If I purchase something on line and am given the choice to pay with a checking account (also known as a current account) or a credit card, is the risk of my checking account data being stolen and used ...
3
votes
0answers
131 views

Clone debit or credit card

I would like to make some workshop about Debit or Credit card fraud (Skimming). So I need as much as possible information about it. Is it possible to clone debit or credit card with MagStripe reader ...
3
votes
2answers
137 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
0
votes
2answers
178 views

If I browse a website over HTTPS using a VPN, can the data be sniffed somehow?

I bought yesterday a flight from an American website. In my country, tickets are too expensive. Therefore, I used a IPVanish VPN to browse the airline website. It appears as if I visited it from New ...
1
vote
2answers
77 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
1
vote
2answers
106 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
2
votes
2answers
125 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
52
votes
6answers
6k views

Has a benefit been demonstrated for credit card machines asking for ZIP code?

In the U.S., many credit card machines at places like gas stations have started asking for your ZIP (postal) code to use a credit card ostensibly to help verify that you really are the cardholder, ...
3
votes
2answers
172 views

Does Visa Checkout have preventive measures against spoofing?

A few online merchants are offering special deals for using Visa Checkout, a payment service similar to PayPal, so I've been trying to learn something about it before signing up. When you are on a ...
1
vote
2answers
49 views

Is it PCI-compliant/kosher to send a credit card number to a 3rd party sever from a mobile client?

I am building a mobile app, and part of the the functionality of the app is to place an order with a 3rd party. The 3rd party server accepts a credit card number string. Can I build a mobile client to ...
1
vote
2answers
71 views

Comprimising or affecting card readers, billing systems, or POS terminals using a malicious card

Our company got a new card printer for employee IDs. It was a bit expensive and we had to undergo a background as it allowed us to print both mag strips and EMV chips. I don't understand enough about ...
4
votes
3answers
461 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To ...
2
votes
2answers
237 views

How does a debit/credit card reader verify the PIN so quickly?

I understand that the associated PIN for a given card is not stored on the card itself in any way. So I am wondering then, when I use my cards how does it seem to be able to verify the PIN quite ...
0
votes
3answers
147 views

Why is using the chip in chip-cards required at manned points of sale?

Chip cards are more secure because they prevent cloning. Chip cards also have the magstripe for backward compatibility. In my recent experience at supermarkets in California, using the chip takes a ...
3
votes
0answers
65 views

Add a supplementary credit transaction to improve online payment security?

An online company from which I regularly buy goods apparently recently upgraded their security policy. Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
3
votes
1answer
98 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
5
votes
3answers
173 views

My client needs credit card details emailed to them, will an encrypted file work?

I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their ...
2
votes
2answers
136 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
3
votes
3answers
273 views

Credit card processing in mobile app over Stripe - PCI DSS compiant?

after reading a lot of PCI DSS stuff I'm still not sure whether it would be ok for us to use the following process in our app: Get full credit card data from attached card reader Tokenize it using ...
-1
votes
1answer
65 views

Magnetic stripe credit card [duplicate]

Do ATM in London accept magnetic stripe? If yes can a thief still duplicate a credit card and use it in an ATM which accepts magnetic stripes?
3
votes
1answer
64 views

concern about including credit card form in iframe using dynamically generated url

I'm looking at including a credit card form in a page via iFrame but the form app needs parameters passed from the AngularJS app in the parent page in order to complete the transaction. My concern is ...
0
votes
5answers
161 views

What steps should I take before using my credit card to buy something online?

I am a private computer user with an internet connection. Assuming that my connection is a standard land line (that I legally own, I'm not free loading) and that my computer is up to date on operating ...
1
vote
3answers
1k views

EMV credit card cloning: PIN code known by a malicious person

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code? If the PIN code is changed, can the cloned card still be used?
5
votes
3answers
301 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
4
votes
3answers
7k views

Is it safe to auto-fill credit card numbers using Chrome?

Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the ...
6
votes
5answers
170 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
1answer
326 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...