Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [credit-card]

Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

-2
votes
2answers
40 views

Does PCI Apply to PAN only?

I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No ...
0
votes
3answers
163 views

I have recovered my credit card PAN (6 chars masked) and expiration date on a merchant site, acceptable or not?

I have a credit card saved in X merchant. I only see the last 4 digits in the UI. I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed ...
22
votes
3answers
6k views

Is accepting an invalid credit card number a security issue?

I am testing a website which accepts invalid credit card numbers for reservations. The interesting thing is they do CC validation if the currency is USD, but not for any other currencies. Should I ...
-3
votes
1answer
113 views

Clone debit card [duplicate]

Would you be able to clone someone debit card if you only have the picture of the card with the security code and the PIN?
84
votes
3answers
8k views

What information about me do stores get via my credit card?

Lets say I buy something at some (physical) store and pay using a credit card on one of these electronic terminals. What information do the owners of this store get about me (or my credit card) from ...
1
vote
1answer
120 views

Can a magnetic credit card writer encode a blank card based off just a credit card number?

I was wondering what info is stored in the CC mag strip. For example: if someone got a hold of by CC number, just the numbers-no CCV, no exp date, etc... it is pretty hard to use my credit card for ...
0
votes
1answer
78 views

Displaying complete credit card information to end user

I am using an ecommerce website that accepts and stores CC information. In the webpage, they show only the last 4 digits (which is perfectly fine). But when I intercept the request/response, I could ...
2
votes
1answer
105 views

How many digits of my credit card number may be revealed on the merchant copy of the receipt (Europe)?

The other day I was in a bakery in France and by accident, I obtained the receipt that was intended for the merchant – I did not get the customer copy. I saw that my FULL credit card number was ...
19
votes
2answers
2k views

Store Credit Card Information in Password Manager?

For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
51
votes
2answers
12k views

Is this Paypal Github SDK reference really a dangerous site?

I'm working on integrating a payment system with paypal in C#, and I installed the official paypal nuget package. Then I went to the paypal github site. And linked to this below site (SDK Reference). ...
0
votes
1answer
91 views

PCI-DSS scope: Using P2PE Compliant devices

We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
0
votes
0answers
115 views

CVV/CVC code algorithm [duplicate]

I'm looking for a definition of algorithm how to calculate CVV/CVC codes? I know that there are the following inputs: PAN Expiration Date Service Code CVK A/B But I'm not able to find the specific ...
3
votes
1answer
106 views

Can one use a Credit Card as a Smart Card?

Okay, first question on any Stack Exchange site, and Information Security seems the most fitting for this question. Anyways, I realized that my laptop has a smart card reader. I understand that ...
2
votes
2answers
258 views

RFID-Safe Wallet destroys credit card?

I'm getting a hang of paying with credit cards, and contactless payment especially, lately (which was quite uncommon where I live until like a few months ago). I'm now looking to buy one of these ...
0
votes
0answers
11 views

What data associated with my payment card does a merchant or a payment processor get when I purchase something with it? [duplicate]

If I use a debit or credit card to purchase something online, what data does the party that charges my card get? I understand that there are payment processors like Stripe or PayPal that act as a ...
0
votes
0answers
79 views

Store Credit Card data in memory for using with native payment SDKs (iOS, Android)

I am implementing a Credit Card processing in mobile apps for iOS (Swift) and Android (Kotlin) using native SDK (SAQ A EP compliance level) We thought about: disabling clipboard for CC field ...
0
votes
2answers
118 views

Could someone commit a social engineering “hack” on a credit card processor to get my credit card number?

Peripherally related to: Is it safe to recycle unshredded credit card receipts?. From some basic research, it seems as though the SEQ number is internal to the company running the POS software, the ...
0
votes
0answers
52 views

Is there a security issue with fit4less requiring bank information and not simply card number?

When I set up timed payments I tend to prefer setting them up through my credit card. As this tends to be more reliable in case of over charges, etc. For example spotify goes through my credit card. ...
1
vote
1answer
85 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
0
votes
2answers
127 views

PCI Compliance on scanned images of expired cards

What is the requirement on images of expired card numbers? The images are over ten years old. If the data is old do I still need to encrypt the data?
4
votes
3answers
197 views

Drivers license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my drivers license to verify that it matches the details on the card because ...
0
votes
1answer
50 views

Is PCI - DSS required to store only card number

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe ...
229
votes
7answers
36k views

All 0s (zeros) in a bank card's CVC code

My bank card recently expired. I got a new one and this one turned out to be "lucky": its CVC code was 000. For a few months I used it extensively, both online and offline, without any difficulties - ...
1
vote
2answers
147 views

Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?

I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
1
vote
0answers
79 views

Possible phishing victim. How to proceed? [closed]

I was trying to buy tickets for a show on an official web page. This will be the last show of this band so the server went down pretty quickly. The band tweeted about difficulties and then someone ...
0
votes
2answers
238 views

How secure is it to send credit card information partially over email and text?

I need to pass credit card information for a travel reservation, and I am thinking of splitting it over email and text. The credit card number itself would be send over text, while expiration date and ...
2
votes
1answer
108 views

Storing credit card token [closed]

I am working on a membership site which is based on monthly and annual subscription. My payment processor supports recurring payments via "credit card tokens". What's the best way to store these ...
5
votes
2answers
1k views

Online Retailer asks for a copy of Credit Card and Drivers License

This weekend I placed an order for a part from an online retailer ($300-400). Shortly thereafter I received an email from their sales team saying something similar to the following: Hi, we have ...
3
votes
2answers
189 views

When paying by card on a website, will fake payment information make the order fail?

When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date)...
1
vote
1answer
1k views

Can someone clone emv chip card by knowing the magnetic stripe info? [duplicate]

Lets consider that someone skimmed the magnetic stripe of a credit/debit card which also has an emv chip. Can this info be translated and stored into an emv chip? And if this is possible, it is ...
2
votes
0answers
89 views

Disable Google API key without access to google account

I was trying the new google api - I created anonymous account - added there my debit card, set up the API key for google maps. Tried API and pushed my API key to shared repository (yes I know - my ...
0
votes
1answer
118 views

Odd characters — including a backslash — in magstripe track 1 name field?

I've been in the Point of Sale industry for decades. Parsing card magnetic stripe track 1 data has never been difficult, but lately we've started to see some odd data in the name field of cards that ...
1
vote
2answers
132 views

Audio Recording of my Credit Card Info?

If I call into a call center to order a product or service, and they take my credit card - do I have any assurance they are not recording the phone call "for quality purposes" which includes my credit ...
3
votes
1answer
317 views

CVV credit card change [closed]

Is there a certain formula that the bank uses when changing the CVV (Card Verification Value), on a credit card. If I am trying to keep credit cards on file and they expire I know there is a form that ...
1
vote
2answers
109 views

credit card safety

location: india While talking to a customer support executive of British airways (number: 1860 180 3592) for payment of extra baggage, he asked for my credit card number, expiry date and cvv number. ...
-1
votes
1answer
230 views

People using my email address (and only that) for booking hotels. What kind of scam is this?

I have faced the same issue twice: 2 people, whose names are definitely not the same as mine, used my email address to book hotels through a well-known hotel company and a lesser-known hotel booking ...
0
votes
1answer
66 views

Question about saving credit card info on PW reset [PCI]

I work for a retail organization with a large ecommerce presence. We allow our customers to store CC information for easy check-out, like many retailers. Currently we remove all stored CC ...
0
votes
1answer
110 views

PCI Compliance and Card Data Transmit

I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be displayed/stored. I am trying to find what is required in regards to ...
2
votes
5answers
3k views

I have to write down credit card information on paper and send it. How can I minimize my risk?

I am filling out a form to set up a recurring payment with a local government building. The form requests that I put my credit card number, expiration date, and CVV number, which I'm a little hesitant ...
1
vote
2answers
698 views

Store credit card numbers in password manager?

I pay various things online with my credit card. In order to save the time of taking out my wallet and typing the number to the field, I have two options: Store the credit card number with the ...
0
votes
0answers
147 views

Cloning Contactless Credit Cards [duplicate]

I have the idea to inject an RFID/NFC chip in my hand and use it for payments and some other stuff. As far as I understand, Visa Paywave is just an RFID chip with a specific ID in it, I've tried ...
2
votes
2answers
217 views

Frequent flyer number security risk or not?

Many booking websites or tickets "re-sellers" expose in plain view for the current authenticated user the commonly used "Frequent flyer number". Should this be considered a security risk? Can this ...
4
votes
1answer
110 views

Debit Card was used fraduentely, Should I report an incident to the websites that stored my card?

Here is my situation. I had a debit card where I could transfer funds to it for limited use. I usually kept a low amount on this card just for little purchases. It was recently used in a fraudulent ...
5
votes
2answers
196 views

iTunes Account Joined Family Group Without Permission

A few weeks ago now I received an email that someone (not me) had made some in-game purchases on an iTunes account. I logged into my iTunes account and saw the transactions and that my account was ...
28
votes
1answer
7k views

Are credit-card security codes theoretically insecure (if not entirely broken) already?

I was reading the Wikipedia article on Card security codes (CSC, CVD, CVV, CVC, V-code, SPC, CID, CV2, CVN2, CAcronym2, etc) and a certain assertion caught my eye (emphasis mine): The CSC for each ...
0
votes
1answer
307 views

How to secure CC details and CCV for a small hotel?

I got a weird case here, where there is a small hotel using booking.com to receive reservations. All of the reservations are coming in, through booking.com, but most of them are not book now - pay ...
2
votes
0answers
119 views

What are the risks of providing all your credit card information except for security code to a stranger?

I've recently been approached by a person asking me for a donation to Save The Children. while I was inclined to donate, I didn't because they were asking my full name, 16 digits of credit card and ...
1
vote
1answer
702 views

PCI compliance for bank card system

There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer. The bank can ...
-3
votes
1answer
297 views

secure public facing wallet API accessed by mobile devices

I am implementing a public mobile wallet application where user can add his own card, like Android Pay, or Samsung Pay on Android device. The standard way how these applications are initially working ...
3
votes
4answers
390 views

Is debit (credit) card payment inherently broken from security point of view?

TL;DR I've been a user of debit cards for many years, and don't know much about the security issues. However, just thinking logically, I find the practice of paying by providing card data (i.e. card ...