Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

learn more… | top users | synonyms

61
votes
5answers
89k views

How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I ...
146
votes
5answers
32k views

Why are chips safer than magnetic stripes?

After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip. In what ways are chips safer than stripes?
18
votes
4answers
2k views

Credit card forms on HTTP pages a MITM risk?

The other day, there was a web developer mailing list thread about a fundraiser page. One person noted that the page with the credit card form was HTTP, not HTTPS. In response, one person said that ...
2
votes
2answers
1k views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me wihout the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
48
votes
10answers
28k views

Can a steel woven wallet prevent RFID scanning of credit card information?

According to the Popular Mechanics article RFID Credit Cards and Theft: Tech Clinic, the fact that many new credit/debit cards have a RFID chip embedded on it, there is a risk (albeit, small according ...
9
votes
2answers
7k views

Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the ...
4
votes
1answer
364 views

Has the wedge security flaw been fixed for credit cards?

According to this site http://www.lightbluetouchpaper.org/2009/08/25/defending-against-wedge-attacks/ there is a flaw in EMV. Since then has this flaw been fixed? Is it the same law as the one ...
2
votes
1answer
229 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
11
votes
4answers
589 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
32
votes
7answers
7k views

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Ideally, I'm ...
39
votes
5answers
14k views

What's the impact of disclosing the front-face of a credit or debit card?

There are quite a few cases where people are called out for disclosing the front-face of a credit or debit card (e.g. this tweet from Brian Krebs or this twitter account). So I was wondering what the ...
22
votes
4answers
36k views

What is the use of stolen credit card details?

What can a person with stolen credit card details do? Buy porn? Buy tons of server resources to perform an attack? What else? I'm sure that if he buys books, shoes and bicycles or transfer funds ...
14
votes
2answers
20k views

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
4
votes
4answers
2k views

How to spoof an ATM transaction?

About 20 years ago, a man disappeared, but his ATM card was "supposedly" used the day after the disappearance. However, surveillance footage of the store shows no-one in the store physically used the ...
3
votes
1answer
228 views

Fraud Mitigation - Card Present Transactions

When it comes to fraud screening for card not present transactions (credit card / debit card) there are a number of techniques / services that can be utilized to mitigate risks from fraudulent ...
2
votes
4answers
2k views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
8
votes
4answers
9k views

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card. Is it standard practice to ask a customer to send a photo of their credit card to confirm their ...
4
votes
2answers
340 views

What is stored on a banking card and how is it protected?

I wonder what is the content of a basic banking card having a chip, the kind you use for payment in any store, with a PIN, possible bank authorization, such as Mastercard or Visa or national banking ...
2
votes
1answer
129 views

How much information is released when paying with a debit card

How much information is released when paying with a debit card? Is it possible for a vendor to grab your name and address from your debit card and send you things in the mail?
1
vote
3answers
3k views

How can hotels securely receive your credit card details (for a custom, one-off payment)?

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email. I have negotiated a deal for accommodation with ...
13
votes
4answers
9k views

Is Visa PayWave secure?

Recently (well, a few months or even a year ago), my bank, here in Australia, introduced this PayWave technology to their Visa debit cards. They claim it's secure, but all they talk about is their ...
6
votes
1answer
266 views

What's the use of adding a challenge to a one time password algorithm?

In these YouTube videos Challenge-Respond Mode and Sign Mode the customer enters a challenge into the CAP device before generating a one time password. Why not just generate the one time password ...
5
votes
4answers
1k views

How can I convince my customers not to send Credit Card data over email?

My wife and I run an online business. For a long time we would accept credit cards over our website, and cash or bank drafts in person. However, as time went on my wife picked up the Square to process ...
4
votes
3answers
636 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
3
votes
1answer
249 views

EMV(Chip) Cards - What's the point of having the chip card communicating directly to the authorising server? & Clarification of CDA in EMV

Ok I understand from my research that the Chip Card creates an AC Key(MasterKey+AccNumber) to communicate with the authorizing server securely (3DES key to have encrypted communication) but I don't ...
0
votes
3answers
1k views

Bank cards - chips vs mag stripe security

In this thread: Why are chips safer than magnetic stripes? the answers all seem to be that the chip cards are far more secure and difficult to copy. Here is my problem, and my question. A couple of ...
0
votes
1answer
688 views

Is it possible that the same VISA debit card numbers could be issued to different people by different banks? [closed]

I'm wondering if is it possible that the same VISA debit card numbers could ever be issued to different people by different banks or companies?