Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [credit-card]

Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

Filter by
Sorted by
Tagged with
4 votes
2 answers
1k views

Are client-side-only apps regulated by PCI?

Consider a client-side-only application. It may allow a user to make a payment by redirecting them to a payment gateway website, where they enter the credit card details. If I understand correctly, in ...
50 votes
8 answers
35k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Ideally, I'm looking ...
1 vote
4 answers
567 views

Collecting banking, credit-card statements from users

I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
0 votes
1 answer
89 views

Safe to write down -- on paper -- name on Credit Card, number, expiry date? Then mail this paper? [closed]

I screen shot page 3 of 6. Fool hardy to require these three details on a paper application? Reasonable to complain to Canadian gov't for jeopardizing credit card details? Mail can be "scanned ...
1 vote
1 answer
514 views

CVV2 calculation with TR-31 Key

I need to use the CVK Key (in key block format) to calculate the CVV2. In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
3 votes
0 answers
337 views

Are there any risks sharing my phone's SEID number with the bank of my credit card?

I was not able to add a credit card to Apple Pay on an iPhone. The bank told me that they need the SEID number of the phone to resolve the issue. By a quick search on the Internet, I learned that the ...
0 votes
2 answers
128 views

how should a web application verify a redirect comes from a trustworthy source?

This document has a sequence diagram (annotated and shown below) explaining how Stripe handle's a Checkout Session. My question : When a customer is returned to the successUrl = www.example.com/some/...
0 votes
3 answers
238 views

If you don't need a PIN for your card in Apple Wallet and don't need a PIN to use Apple Wallet, how is that safe?

I've just added a card to my Apple Wallet and noticed that I didn't need a PIN. Now since Apple Wallet is apparently already "secure", I don't need a PIN to use it either. Is this a loophole ...
4 votes
2 answers
1k views

credit card honeypot service? [closed]

I recently got both my cards used in fraudulent transactions. I'm trying to trace the leak. Is there someplace I can buy a fake credit card number that will decline all transactions, but will show me ...
1 vote
0 answers
81 views

What informations can a website store about my credit card? [closed]

I read on this topic that, after performing a payment, websites can store and read: Your PAN Your zip code / cardholder name / any information you input on a website that has fillable informations ...
7 votes
4 answers
4k views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
0 votes
0 answers
147 views

Showing a license/id to a shopping website, worth it? [duplicate]

I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
73 votes
9 answers
45k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN? [closed]

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
0 votes
0 answers
136 views

PCI-DSS Compliance: SSL Tunneling Credit Card Information Through A HTTPS Mobile/Residential Proxy Service to A Destination Service

If a PCI compliant service decides to SSL-Tunnel credit card information via an independent residential/mobile proxy service to a destination payment service, would this protocol still be PCI ...
5 votes
3 answers
7k views

How could a scammer get my card details if I've never used it

Today I had about $600US spread across 20 transactions taken from my debit card over the past three days (I notified my bank said they will give me a new card and will refund me) This particular ...
-2 votes
1 answer
729 views

Should I allow CVC of 000 in our system? [duplicate]

I've reviewed multiple threads on reasons why 000 should be allowed and why it shouldn't: All 0s (zeros) in a bank card's CVC code https://news.ycombinator.com/item?id=18768801 In summary, reasons ...
1 vote
1 answer
4k views

Can a magnetic credit card writer encode a blank card based off just a credit card number?

I was wondering what info is stored in the CC mag strip. For example: if someone got a hold of by CC number, just the numbers-no CCV, no exp date, etc... it is pretty hard to use my credit card for ...
4 votes
5 answers
27k views

Online Retailer asks for a copy of Credit Card and Drivers License

This weekend I placed an order for a part from an online retailer ($300-400). Shortly thereafter I received an email from their sales team saying something similar to the following: Hi, we have ...
1 vote
1 answer
660 views

Can Twitter use the payment information they have to know if multiple users have used the same credit card to buy multiple Twitter blue subscriptions?

This question asked if websites on which one is transacting have their payment information and from the replies it seems that they do (or at least their payment gateway service providers do). But my ...
0 votes
0 answers
1k views

Writing credit card information to a new card [duplicate]

I'm learning about how credit cards work, and I want to clone my credit card's magnetic stripe to a new regular card (not a credit card, but for example a "club card") I know that magnetic ...
87 votes
3 answers
54k views

What information about me do stores get via my credit card?

Lets say I buy something at some (physical) store and pay using a credit card on one of these electronic terminals. What information do the owners of this store get about me (or my credit card) from ...
0 votes
1 answer
533 views

Inconsistency in masking CVV/CVC credit card details during input

I have observed that in some payment portals while making payments via credit/debit card the CVV/CVC number is masked out (hidden), but in different portals this is not the case. For example: USA &...
0 votes
0 answers
26 views

How to prevent contactless cards RFID signal cloning [duplicate]

I have always been sceptical about contactless. It offers little security. I've even heard of cases where the RFID signal has been captured onto mobile devices. My questions are. Is there anything ...
0 votes
1 answer
197 views

What is best practise to send credit card details update emails when the details have expired?

Recently an organization I forgot to update credit card details had my renewal payment fail because I forgot to update details. They sent an email as below which had a direct link to a web form ...
3 votes
3 answers
346 views

How can I stop fraudulent credit card submissions on a donation site?

We are a small nonprofit that accepts donations online. Our site is being hammered by hundreds of fraudulent credit card submissions per day, coming from multiple IP's all over the world (a ...
6 votes
2 answers
3k views

Do It Yourself Credit Card Storage (PCI - DSS Compliant)

I'm a software developer, considering writing a custom system for credit card number storage. Our intent is to be fully Payment Card Industry (PCI) compliant. I'm working with a small business owner ...
13 votes
2 answers
4k views

Validating and storing credit card data for retrieval later

I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
0 votes
0 answers
673 views

Is there a security issue with fit4less requiring bank information and not simply card number?

When I set up timed payments I tend to prefer setting them up through my credit card. As this tends to be more reliable in case of over charges, etc. For example spotify goes through my credit card. ...
5 votes
4 answers
6k views

Signature instead of PIN, Visa card

Most of the credit cards require PIN to authorize transaction. Recently upon a transaction the merchant required my signature and not my PIN. I understand this is another sort of authorizing the ...
2 votes
3 answers
762 views

How do companies like Uber and Paypal store card details? Is it possible to offer PCI compliance whilst saving credit card details locally?

I know there's a question that's been already asked but it's a decade old so wanted to get an up to date answer... It's mentioned quite often that the CVV number should never be stored, but this must ...
5 votes
2 answers
437 views

Best practice for Users to avoid fraud for Direct Debit enabled bank accounts?

Direct Debit or automatic debit transfer system or Bankeinzug (German), seems a common/convenient way to pay in (online shops in) many countries available for many banks. https://en.wikipedia.org/...
0 votes
0 answers
4k views

Clone a credit card [duplicate]

I wanted to ask if it's possible to clone your own credit card (clone the emv chip) and copy it onto another emv chip with an emv reader/writer. Shouldn't this be easily possible without extracting ...
1 vote
4 answers
1k views

I have recovered my credit card PAN (6 chars masked) and expiration date on a merchant site, acceptable or not?

I have a credit card saved in X merchant. I only see the last 4 digits in the UI. I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed ...
1 vote
2 answers
124 views

"encrypting" a physical copy of a number by remembering a series of mathemtical operations rather than a key. Is this safe?

For example I want to have a hard copy of my backup 2FA codes so that if I lose/destroy/don't have my phone or laptop on me. I, of course, do not want them in plain text. I don't want to encrypt them ...
1 vote
3 answers
355 views

Is it safe to write an "encrypted" PIN on a card?

I have a number of bank cards and I keep forgetting the PIN-codes, in particular because most of them I use rarely. I came up with an idea - for each card: add a secret PIN that I remember to the PIN ...
24 votes
2 answers
43k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
0 votes
2 answers
179 views

PCI : scope debate : API consumers

The Problem I have two systems. System A - E-commerce application that handles (does not store cc) customer credit data during purchase. System B - Invoicing system for these transactions (does store ...
2 votes
1 answer
2k views

Which information is disclosed to a merchant when paying online with a credit card?

Several sites require me to input far too many personal details in order to register. This now includes phone numbers, which they have zero legitimate uses for - they are never used after the initial ...
0 votes
1 answer
2k views

Credit card reader writer

If someone has all the information from my credit card name, exp date, card number, cvv and pin but no card, would they still be able to use a reader-writer or would they have to have the card to copy?...
0 votes
1 answer
307 views

If the terminal is malicious, is paying with NFC still safe?

Paying with credit card's NFC. I know about tokenization and all that, but does that actually protect my card against theft when the terminal is malicious?
2 votes
1 answer
200 views

Is it normal for a company to request this information after stolen card details were used?

My friend's credit card details were randomly used to make a two small purchases on a food delivery app, by someone other than my friend. They have already contacted the bank and cancelled the card. ...
12 votes
2 answers
32k views

Safety of publishing last 4 credit card digits in age of fast computing?

How safe is it to make public the last four digits of a credit card? Credit card numbers have a specific format. Digits tell you what type of institution issued the card, what bank issued the card, ...
13 votes
4 answers
11k views

How can I convince my customers not to send Credit Card data over email?

My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process ...
1 vote
1 answer
3k views

Are virtual credit cards in scope for PCI Compliance?

My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of ...
3 votes
3 answers
10k views

Driver's license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my driver's license to verify that it matches the details on the card because ...
0 votes
2 answers
1k views

PCI Compliance on scanned images of expired cards

What is the requirement on images of expired card numbers? The images are over ten years old. If the data is old do I still need to encrypt the data?
0 votes
2 answers
635 views

Is credit card cloning possible BEFORE activation?

I recently acquired this novel credit card which brags about being super secure for not having printed the security numbers on the physical card. Then, when my physical card package arrive I notice it ...
40 votes
6 answers
14k views

Which parts of a credit card can I obfuscate and still have it be valid

I was recently the victim of credit card fraud and I suspect it is from a merchant somewhere keeping track of my credit card details. I cancelled the card and received a new one, but I would like to ...
4 votes
1 answer
643 views

How does Firefox protect Logins and Credit Card Data?

I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
145 votes
1 answer
18k views

How does Shutterstock keep getting my latest debit card number?

I've made a single photo purchase from Shutterstock back in 2012. I created an account and gave them my debit card #. I haven't made a single purchase from them since. Silently in 2018, they activated ...

1
2 3 4 5
10