Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

2
votes
2answers
139 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
3
votes
3answers
297 views

Credit card processing in mobile app over Stripe - PCI DSS compiant?

after reading a lot of PCI DSS stuff I'm still not sure whether it would be ok for us to use the following process in our app: Get full credit card data from attached card reader Tokenize it using ...
-1
votes
1answer
69 views

Magnetic stripe credit card [duplicate]

Do ATM in London accept magnetic stripe? If yes can a thief still duplicate a credit card and use it in an ATM which accepts magnetic stripes?
3
votes
1answer
72 views

concern about including credit card form in iframe using dynamically generated url

I'm looking at including a credit card form in a page via iFrame but the form app needs parameters passed from the AngularJS app in the parent page in order to complete the transaction. My concern is ...
0
votes
5answers
165 views

What steps should I take before using my credit card to buy something online?

I am a private computer user with an internet connection. Assuming that my connection is a standard land line (that I legally own, I'm not free loading) and that my computer is up to date on operating ...
1
vote
3answers
2k views

EMV credit card cloning: PIN code known by a malicious person

Could a credit card cloned (chip or magnetic band) if someone has it for a few seconds and knows the PIN code? If the PIN code is changed, can the cloned card still be used?
5
votes
3answers
317 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
5
votes
3answers
7k views

Is it safe to auto-fill credit card numbers using Chrome?

Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the ...
6
votes
5answers
193 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
1answer
338 views

Is zinc.io PCI compliant (/does it need to be)?

zinc.io provides shopping API to programmatically purchase items on Amazon, Best Buy, and Walmart to name a few. A brief observation of its API tells us credit card information is definitely being ...
3
votes
2answers
932 views

Can expired credit card information be used for fraud?

I have encountered a situation where payment card (debit/credit) information, including name, number, expiration date, and cvc, is being saved by an organization unencrypted in excel spreadsheets on ...
2
votes
2answers
1k views

Is it secure to SMS your Credit card info (or other info) to someone else?

I am buying some products and have mostly communicated with the store via email. I am planning on paying by credit card, but the store doesn't have online billing. Normally, I would just phone the ...
0
votes
1answer
258 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
2
votes
3answers
579 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
3
votes
1answer
262 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
1
vote
0answers
34 views

Non-trad bus model: I pay suppliers directly with client CC info. Need to be able to securely collect and read info [closed]

I'm a home-based travel agent. It is against my contract with my host agency (and I think the law actually) to directly accept payment from clients. Instead, we use customer CC information to pay ...
1
vote
0answers
113 views

ASP.NET WCF security, javascript and handling sensitive information

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. "...
3
votes
1answer
153 views

What's the advantage of passing credit cards via javascript vs. over the server (without saving it)?

I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data). To my ...
30
votes
3answers
5k views

Why don't popular web services mask the CVV?

Most popular web services like PayPal, Google Wallet, and others do not mask CVV numbers, eg: (<input type="password">). As I read, the CVV is a security feature and it seems logical to mask it ...
4
votes
1answer
491 views

card.io & PCI DSS v3.0

I've researched for quite some time now, but I cannot find an answer to this question: If I touch card holder data in any way, I need PCI DSS v3.0 SAQ A-EP certification, which is quite complex to ...
0
votes
2answers
86 views

Library or service for rate limiting credit card transactions by IP [closed]

I have a simple product ordering form. A hacker is attempting to validate stolen credit card numbers by making two orders per minute with a bot. 99% of the orders are declined but some are completed....
6
votes
6answers
552 views

Looking for credit card data and other PII in files

I'm looking for ways to check for the presence of credit-card data and other personally identifiable information in files on a network I'm testing. Currently i'm doing this manually with the usual ...
3
votes
2answers
176 views

Shop saves credit card data from guest orders

A web shop allows customers to order as guest or to create an account. I ordered as guest, entered my email address and the shipping address, and payed per credit card (I had to enter the security ...
3
votes
2answers
204 views

Credit Card Fraud Prevention - Why Aren't Simple Things Used?

I use my American Express card every day, sometimes multiple times. I do a mixture of card-present and card-not-present transactions. AMEX has decent fraud detection and I get notified quickly if ...
14
votes
3answers
1k views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
2
votes
3answers
224 views

Businesses Handling Credit Cards via Email

I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices. Customers often email their CC number and expiry date in ...
36
votes
5answers
12k views

How does a website know if a certain creditcard number is wrong instantly

I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, ...
0
votes
1answer
529 views

How does SAQ A-EP apply in the situation where no I frames are used

I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know. I use primarily Stripe and Braintree in ...
3
votes
2answers
773 views

How to mask SEPA (IBAN and BIC) information correctly?

I'm currently developing a payment system where users can use SEPA-debit to pay for the service. The user has the ability to enter the data once and can then select the same payment method when making ...
2
votes
0answers
238 views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
0
votes
2answers
255 views

To which entity merchants must report credit card breach?

In the incident that a Marchand like Target or Home Depot, detects credit cards are breached, who they need to notify? Visa recommends informing the merchant bank, and/or Visa Incident Response ...
3
votes
2answers
448 views

Verifying credit card ownership

When a fraudulent credit card CNP (Card Not Present) transaction is made, merchant is liable for the chargeback. For that reason, our company implemented a policy where we ask a photo of customer's ...
0
votes
1answer
49 views

Viewing PCI data via 3rd party sites securely

I'm working on a project that requires PCI protected data (card PIN numbers) to be made visible to customers, via a Third Party (a non PCI compliant) company site. The hierarchy is as follows: Us >...
5
votes
2answers
10k views

Are VISA gift cards untraceable?

I was in a retail store today, and these people were discussing how easy it is for people to use stolen credit cards, and buy those visa gift cards without being traced after they purchase the gift ...
2
votes
2answers
2k views

No HTTPS on credit card entry form - can it be safe?

I was going to make a purchase on a website, but the page containing the credit card entry form is served via HTTP and not HTTPS. Is it definitely unsafe? The website advertises the use of "RapidSSL"...
0
votes
1answer
370 views

Lost CVV number automatically virus related?

If my credit card was used on Amazon, doesn't that mean someone has my cvv number? And would that mean I have a virus? Or is there another way they can get a CVV code off a credit card? I know it's ...
43
votes
8answers
6k views

What prevents web shop owners from misusing credit card data?

I don't own a credit card but read much about fraud with stolen credit cards. Since I don't own one, I don't know how you exactly buy online using your credit card, so please correct me, if I am wrong ...
2
votes
2answers
3k views

Does sending credit card info over email violates PCI DSS?

Being in the US, I have noticed that more and more companies ask to send sensitive credit card information (all information that is required to make a transaction) over a plain email. I believe that ...
5
votes
2answers
1k views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
1
vote
1answer
507 views

PCI DSS - Recorded Phone Conversations

I am using the using the following image from FishNet Security as a sort of guide for the data flow diagram required by PCI DSS as defined by: 1.1.3 Current diagram that shows all cardholder ...
1
vote
0answers
88 views

Telling the difference between a prepaid card and credit/debit card

In order to stop people abusing free trials, we can make sure new users are not reusing data from existing users and therefore not just signing up with a new account every month. It is reasonably ...
1
vote
0answers
95 views

Collecting Pre-Authorized Debit (PAD) & Credit Card (PACC) Agreements Electronically

I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement ...
0
votes
1answer
133 views

How secure credit card order system with blank mail

I want to know how to secure credit card order with blank mail. My boss instructing to create new site like as below: 1) User send "Blank e-mail" to new site. 2) The site returns mail including URL,...
1
vote
3answers
224 views

Why do credit cards have chips, if I can purchase online without the chip being read?

Credit cards (and debit cards) are used in three different ways: In person + pin. The seller requires me to insert my card with the chip and input the PIN number to complete the transaction. In ...
6
votes
2answers
6k views

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
0
votes
1answer
75 views

credit card security suggested scenario

I need to know the best scenario for a merchant inserting client's credit cards and expiry dates to process recurring payment for these cards. What I have in mind (and want your expert suggestions ...
3
votes
2answers
583 views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
2
votes
0answers
230 views

Which keys does a bank typically exchange with a card scheme?

I'm trying to understand the different EMV-related keys that are shared between a bank who issues EMV cards and a card scheme, such as Visa or MasterCard. I understand the bank would typically ...
4
votes
3answers
185 views

Dealing with credit card data that is not charged directly

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to ...
5
votes
2answers
151 views

Modifying credit cards to increase security

If I use a credit card only for chip&pin/EMV transactions and possibly for contactless transactions, I don't need the following parts of the card. magnetic stripe embossed numbers etc signature ...