Questions tagged [credit-card]
Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).
452 questions
1
vote
1
answer
82
views
Does PCI/DSS allow storing the cardholder's name a person entered (and not the real one)
I have an app where a person enters their card number, the cardholder's name, the expiration date and the cvv. I am now making it pci/dss-compliant. I will store the card number in an encrypted way. ...
- 113
1
vote
0
answers
30
views
Sending photo of debit card over email [duplicate]
I have seen/heard online stores (not necessarily within the U.S., maybe international) asking buyers to provide a picture of their debit cards via email (e.g., for verifying identity). My intuition ...
- 111
0
votes
1
answer
168
views
Safe to write down -- on paper -- name on Credit Card, number, expiry date? Then mail this paper? [closed]
I screen shot page 3 of 6. Fool hardy to require these three details on a paper application? Reasonable to complain to Canadian gov't for jeopardizing credit card details?
Mail can be "scanned ...
user307169
4
votes
0
answers
3k
views
Are there any risks sharing my phone's SEID number with the bank of my credit card?
I was not able to add a credit card to Apple Pay on an iPhone. The bank told me that they need the SEID number of the phone to resolve the issue.
By a quick search on the Internet, I learned that the ...
- 141
0
votes
3
answers
1k
views
If you don't need a PIN for your card in Apple Wallet and don't need a PIN to use Apple Wallet, how is that safe?
I've just added a card to my Apple Wallet and noticed that I didn't need a PIN. Now since Apple Wallet is apparently already "secure", I don't need a PIN to use it either.
Is this a loophole ...
- 3
0
votes
2
answers
216
views
how should a web application verify a redirect comes from a trustworthy source?
This document has a sequence diagram (annotated and shown below) explaining how Stripe handle's a Checkout Session.
My question : When a customer is returned to the successUrl = www.example.com/some/...
- 309
1
vote
0
answers
102
views
What informations can a website store about my credit card? [closed]
I read on this topic that, after performing a payment, websites can store and read:
Your PAN
Your zip code / cardholder name / any information you input on a website that has fillable informations ...
- 11
1
vote
1
answer
886
views
CVV2 calculation with TR-31 Key
I need to use the CVK Key (in key block format) to calculate the CVV2.
In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
- 21
-2
votes
1
answer
1k
views
Should I allow CVC of 000 in our system? [duplicate]
I've reviewed multiple threads on reasons why 000 should be allowed and why it shouldn't:
All 0s (zeros) in a bank card's CVC code
https://news.ycombinator.com/item?id=18768801
In summary, reasons ...
- 1
1
vote
1
answer
890
views
Can Twitter use the payment information they have to know if multiple users have used the same credit card to buy multiple Twitter blue subscriptions?
This question asked if websites on which one is transacting have their payment information and from the replies it seems that they do (or at least their payment gateway service providers do). But my ...
0
votes
0
answers
2k
views
Writing credit card information to a new card [duplicate]
I'm learning about how credit cards work, and I want to clone my credit card's magnetic stripe to a new regular card (not a credit card, but for example a "club card")
I know that magnetic ...
- 121
0
votes
1
answer
656
views
Inconsistency in masking CVV/CVC credit card details during input
I have observed that in some payment portals while making payments via credit/debit card the CVV/CVC number is masked out (hidden), but in different portals this is not the case.
For example: USA &...
- 111
0
votes
0
answers
26
views
How to prevent contactless cards RFID signal cloning [duplicate]
I have always been sceptical about contactless. It offers little security. I've even heard of cases where the RFID signal has been captured onto mobile devices. My questions are.
Is there anything ...
- 95
0
votes
1
answer
244
views
What is best practise to send credit card details update emails when the details have expired?
Recently an organization I forgot to update credit card details had my renewal payment fail because I forgot to update details. They sent an email as below which had a direct link to a web form ...
- 121
13
votes
2
answers
4k
views
Validating and storing credit card data for retrieval later
I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
- 231
2
votes
3
answers
867
views
How do companies like Uber and Paypal store card details? Is it possible to offer PCI compliance whilst saving credit card details locally?
I know there's a question that's been already asked but it's a decade old so wanted to get an up to date answer...
It's mentioned quite often that the CVV number should never be stored, but this must ...
- 123
0
votes
0
answers
5k
views
Clone a credit card [duplicate]
I wanted to ask if it's possible to clone your own credit card (clone the emv chip) and copy it onto another emv chip with an emv reader/writer.
Shouldn't this be easily possible without extracting ...
- 11
1
vote
2
answers
128
views
"encrypting" a physical copy of a number by remembering a series of mathemtical operations rather than a key. Is this safe?
For example I want to have a hard copy of my backup 2FA codes so that if I lose/destroy/don't have my phone or laptop on me. I, of course, do not want them in plain text. I don't want to encrypt them ...
- 11
0
votes
2
answers
208
views
PCI : scope debate : API consumers
The Problem
I have two systems.
System A - E-commerce application that handles (does not store cc) customer credit data during purchase.
System B - Invoicing system for these transactions (does store ...
- 103
3
votes
1
answer
4k
views
Which information is disclosed to a merchant when paying online with a credit card?
Several sites require me to input far too many personal details in order to register. This now includes phone numbers, which they have zero legitimate uses for - they are never used after the initial ...
- 31
0
votes
1
answer
2k
views
Credit card reader writer
If someone has all the information from my credit card name, exp date, card number, cvv and pin but no card, would they still be able to use a reader-writer or would they have to have the card to copy?...
0
votes
1
answer
320
views
If the terminal is malicious, is paying with NFC still safe?
Paying with credit card's NFC. I know about tokenization and all that, but does that actually protect my card against theft when the terminal is malicious?
1
vote
1
answer
3k
views
Are virtual credit cards in scope for PCI Compliance?
My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of ...
- 339
0
votes
2
answers
859
views
Is credit card cloning possible BEFORE activation?
I recently acquired this novel credit card which brags about being super secure for not having printed the security numbers on the physical card.
Then, when my physical card package arrive I notice it ...
- 101
4
votes
1
answer
756
views
How does Firefox protect Logins and Credit Card Data?
I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
- 153
1
vote
3
answers
382
views
Is it safe to write an "encrypted" PIN on a card?
I have a number of bank cards and I keep forgetting the PIN-codes, in particular because most of them I use rarely. I came up with an idea - for each card: add a secret PIN that I remember to the PIN ...
- 135
0
votes
1
answer
1k
views
Why some payment methods allow being embedded in an iframe and some don't?
Let's take some examples:
Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame
Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame
...
- 183
2
votes
1
answer
781
views
Website showing entered credit card number as valid or invalid [duplicate]
I noticed on a website that when I entered my credit card number, the entry box was highlighted blue:
I then tried a dummy credit card number, which made the box highlight red, indicating that credit ...
- 63
0
votes
0
answers
206
views
Can a stolen chip & pin card be used to withdraw cash from an ATM without knowing the actual pin?
My chip and pin Visa debit card was stolen from a gym locker and successfully used to withdraw money from an ATM in 2017 in London, England. The PIN was not recorded anywhere and yet the card was used ...
2
votes
1
answer
208
views
Is it normal for a company to request this information after stolen card details were used?
My friend's credit card details were randomly used to make a two small purchases on a food delivery app, by someone other than my friend. They have already contacted the bank and cancelled the card.
...
- 63
2
votes
3
answers
265
views
School Request: What can be done protect people's financial information?
This is a bit of an odd question, and if it doesn't belong on this forum feel free to retract. I was asked by a group of 7th graders to share my thoughts on the problem of credit card data breaches. ...
- 123
2
votes
0
answers
139
views
Should i login to my ebanking account through frames in another website?
During a credit card payment to site X , it asks me to login to my ebanking account through a frame in a site that handles that transaction in order to implement a more secure authentication (3d ...
- 21
145
votes
1
answer
18k
views
How does Shutterstock keep getting my latest debit card number?
I've made a single photo purchase from Shutterstock back in 2012. I created an account and gave them my debit card #. I haven't made a single purchase from them since.
Silently in 2018, they activated ...
- 1,947
2
votes
1
answer
240
views
Over-the-top (?) security practices for CVV inputs
On some internet banking websites, I've seen some CVV input fields that seem strange to me. Here is an example:
The field works as such:
You can not input a CVV code using a keyboard.
The numbers ...
user195617
1
vote
0
answers
145
views
How to determine if a webshop is scam? [closed]
Nowadays people prefer to do their shopping online rather than using the real shop, especially because of the COVID-19 restrictions. But in the same context, attackers (scammers) are trying to gain ...
- 10.2k
2
votes
1
answer
345
views
Credit card form : Is it neccessary to obscure error messages?
I'm working on designing a credit card payment form whose core functionality is provided by a payment processing company ("upstream").
Upon some transaction errors the upstream returns the ...
0
votes
1
answer
2k
views
How does a fraudulent credit card charge to a Department of State work?
I looked at my Credit card statement, and noticed a fraudulent charge to what turned out to be the NY Department of State. This was especially odd to me, since I don't live in NY (and so was obvious ...
- 21.6k
0
votes
0
answers
190
views
Pay online with a card and then block it - any threats?
Sometimes I order stuff from less-known online stores that ask me to pay directly by providing a card number.
Either they don't support PayPal or similar services or they might charge a fee for using ...
- 101
4
votes
1
answer
6k
views
Chance of guessing any valid credit card data
What's the chance of guessing valid credit card data that could be used to make a payment online? To me, it looks like it's not extremely hard to guess, but I'm not able to calculate the probability. ...
- 15.9k
0
votes
1
answer
197
views
How can hackers steal from a savings account that has no client card? [closed]
Someone I know was stolen a few hundreds dollars from a savings account. Looking at the history, she saw transactions like Uber rides and video games purchases she did not do. This account is used ...
- 103
-1
votes
2
answers
152
views
How can you secure credit card security when purchasing from any online retailer? [closed]
When on any retailer website at the very end we are asked to make a payment. However it is not uncommon to not be taken to an external portal, usually, for example, aliexpress and Amazon will ask to ...
- 101
0
votes
1
answer
6k
views
ATM CVV1 + Service Code, POS Security Flaw?
I'm new to this topic and I found it very interesting how all the payment system is currently working. To be honest it look like they are not doing enough to stop fraudulent activity with Credit Cards....
- 11
2
votes
2
answers
490
views
Storing credit card information - encrypted at rest
A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients.
I told him that I can build a asymmetrical (...
- 73
0
votes
1
answer
783
views
Store credit card data in google sheets - Asymetric Encryption
Yes! this sounds crazy, and it is, please let me give you some background about this...
I'm doing a self-checkin app for a hotel, this app will store this checkin data in google sheets, where the ...
- 101
1
vote
1
answer
7k
views
Is it possible to guess cvv code from payment number and expiration dates?
If I am not wrong, visa is easy to guess cvv right?
Let's say if I have 100,000 credit card numbers and expiration dates, it is possible to make daily 5 guesses.
All cards with 5 the same gateway/...
1
vote
2
answers
358
views
Call center recording my credit card info
I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full ...
- 13
3
votes
3
answers
355
views
How can I stop fraudulent credit card submissions on a donation site?
We are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP's all over the world (a ...
- 224
0
votes
1
answer
149
views
PCI DSS: Is there a way to pass encrypted billing data through a server without compliance?
Hope all is well.
I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their ...
5
votes
4
answers
995
views
Are payment card PINs safe to send via SMS?
I have signed up with a new current account in the UK for day-to-day transactions. The account comes with a payment (debit) card. The banking institution's security handling of PINs for payment cards ...
- 831
0
votes
1
answer
129
views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
- 105