Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [credit-card]

Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

Filter by
Sorted by
Tagged with
236 votes
7 answers

All 0s (zeros) in a bank card's CVC code

My bank card recently expired. I got a new one and this one turned out to be "lucky": its CVC code was 000. For a few months I used it extensively, both online and offline, without any difficulties - ...
Vlad Nikiforov's user avatar
183 votes
5 answers

Why are chips safer than magnetic stripes?

After the recent Target hack there has been talk about moving from credit cards with magnetic stripes to cards with a chip. In what ways are chips safer than stripes?
Thomas's user avatar
  • 3,861
165 votes
5 answers

How does Amazon bill me without the CVC / CVV / CVV2?

The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I ...
TC1's user avatar
  • 1,753
145 votes
1 answer

How does Shutterstock keep getting my latest debit card number?

I've made a single photo purchase from Shutterstock back in 2012. I created an account and gave them my debit card #. I haven't made a single purchase from them since. Silently in 2018, they activated ...
M -'s user avatar
  • 1,927
87 votes
3 answers

What information about me do stores get via my credit card?

Lets say I buy something at some (physical) store and pay using a credit card on one of these electronic terminals. What information do the owners of this store get about me (or my credit card) from ...
flawr's user avatar
  • 711
82 votes
7 answers

How many digits of a Visa card number can vendors disclose on receipts?

I visited a local McDonald's, and I noticed part of my Visa number repeated on the receipt like this: NNNN NN__ ____ NNNN. (So out of a total of 16 digits it breaks down like this: First six digits ...
SimZal's user avatar
  • 903
74 votes
2 answers

Minimum requirements for storing last 4 digits of credit card number?

We have a merchant website that uses's CIM and AIM. Our users may have multiple credit cards so we'd want to give them opportunity to distinguish between credit cards that they use on ...
Andrei Botalov's user avatar
73 votes
9 answers

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN? [closed]

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
Brian's user avatar
  • 731
62 votes
2 answers

Why is credit card information not stolen more often?

Nowadays there are a lot of hacked websites with stolen login information. In many cases the website states that no credit card data and/or payment information was stolen. Why is that? What I assume ...
tim's user avatar
  • 851
61 votes
3 answers

Merchant sent email to me with all my Credit Card info

Is there some place for a consumer to file a complaint concerning improper use of credit card information? I gave my credit card to a towing company and they sent me a receipt via email with all of ...
Jim Skov's user avatar
  • 569
60 votes
5 answers

What's the impact of disclosing the front-face of a credit or debit card?

There are quite a few cases where people are called out for disclosing the front-face of a credit or debit card (e.g. this tweet from Brian Krebs or this twitter account). So I was wondering what the ...
Rory McCune's user avatar
  • 62.3k
56 votes
6 answers

Has a benefit been demonstrated for credit card machines asking for ZIP code?

In the U.S., many credit card machines at places like gas stations have started asking for your ZIP (postal) code to use a credit card ostensibly to help verify that you really are the cardholder, ...
reirab's user avatar
  • 2,703
51 votes
2 answers

Is this Paypal Github SDK reference really a dangerous site?

I'm working on integrating a payment system with paypal in C#, and I installed the official paypal nuget package. Then I went to the paypal github site. And linked to this below site (SDK Reference). ...
user230910's user avatar
  • 1,015
50 votes
10 answers

Can a steel woven wallet prevent RFID scanning of credit card information?

According to the Popular Mechanics article RFID Credit Cards and Theft: Tech Clinic, the fact that many new credit/debit cards have a RFID chip embedded on it, there is a risk (albeit, small according ...
user avatar
50 votes
8 answers

Hashing a credit card number for use as a fingerprint

What's the best way to hash a credit card number so that it can be used for fingerprinting (i.e. so that comparing two hashes will let you know if the card numbers match or not)? Ideally, I'm looking ...
FloatingRock's user avatar
50 votes
4 answers

Detecting skimmers and other ATM traps

This question has been bothering me ever since I first heard of ATM skimmers: Instances of skimming have been reported where the perpetrator has put a device over the card slot* of an ATM (...
TildalWave's user avatar
  • 10.8k
49 votes
8 answers

What prevents web shop owners from misusing credit card data?

I don't own a credit card but read much about fraud with stolen credit cards. Since I don't own one, I don't know how you exactly buy online using your credit card, so please correct me, if I am wrong ...
sweet home's user avatar
48 votes
5 answers

How does a website instantly know if a certain credit card number is wrong?

I was renewing my Internet subscription through the online portal of my ISP. What struck me was when I was entering my credit card details, I entered the type of my credit card (MasterCard, Visa, AA, ...
tony9099's user avatar
  • 779
44 votes
8 answers

Amazon let me place an order without me ever being asked for 3-D secure password

I have set a "3-d secure password" for my debit card, on my bank's website. But when I purchased something in, I went through the whole process without ever being asked for that 3D ...
Stefan Monov's user avatar
41 votes
3 answers

Why are my plastic credit card and activation code sent separately?

Capital One recently sent my plastic credit card by post mail and its activation code by a separate post mail. What security problem does this mitigate? If a rogue element has access to my mail box ...
Lord Loh.'s user avatar
  • 549
40 votes
6 answers

Which parts of a credit card can I obfuscate and still have it be valid

I was recently the victim of credit card fraud and I suspect it is from a merchant somewhere keeping track of my credit card details. I cancelled the card and received a new one, but I would like to ...
8bitme's user avatar
  • 503
39 votes
4 answers

Convince the company not to store credit card numbers in our webapp

The company I work for needs a system to perform monthly credit card charges to customer accounts. Customers will be able to update their credit card information from an online interface written in ...
M8R-53mg86's user avatar
39 votes
1 answer

Is CVV calculated or merely assigned?

Is the 3-digit (4-digit for those acolytes of standardization, American Express!) CVV/CSV/CVC calculated from card number and expiration date, or is it merely assigned? I know that once when I got a ...
Bruce Ediger's user avatar
  • 4,542
36 votes
3 answers

Why don't popular web services mask the CVV?

Most popular web services like PayPal, Google Wallet, and others do not mask CVV numbers, eg: (<input type="password">). As I read, the CVV is a security feature and it seems logical to mask it ...
Paul Annekov's user avatar
32 votes
5 answers

How can Paypal know my card is being used in another account?

I have a credit card saved to my primary Paypal account. To make a long story short, I needed to make another Paypal account that would not be connected to my original one. I used a different ...
TheAsh's user avatar
  • 485
30 votes
4 answers

Hotel reservation. How is this secure with only credit card number and expiry date?

Until today I managed to avoid paying online with my credit card (I'm weird, I know...) but somehow I managed to do it. Today though I had to book a hotel room (on that required a ...
ILikePaperMoney's user avatar
29 votes
4 answers

How can a website verify that my phone number belongs to me?

I was signing into a Capital One credit card website that I hadn't used in a long time, and once I entered my user name and password, it requested my mobile phone number for additional verification. ...
JPhi1618's user avatar
  • 480
28 votes
1 answer

Are credit-card security codes theoretically insecure (if not entirely broken) already?

I was reading the Wikipedia article on Card security codes (CSC, CVD, CVV, CVC, V-code, SPC, CID, CV2, CVN2, CAcronym2, etc) and a certain assertion caught my eye (emphasis mine): The CSC for each ...
Dai's user avatar
  • 1,728
26 votes
7 answers

Recourse if debit card was used on a suspicious website

My husband got a pop-up ad on his phone for a fashion website and purchased two pairs of sunglasses using our debit card. The confirmation was emailed to me (marked as spam by gmail), and the site ...
thumbtackthief's user avatar
24 votes
4 answers

What is the use of stolen credit card details?

What can a person with stolen credit card details do? Buy porn? Buy tons of server resources to perform an attack? What else? I'm sure that if he buys books, shoes and bicycles or transfer funds to ...
cherouvim's user avatar
  • 360
24 votes
2 answers

Specific risks of embedding an HTTPS iframe in an HTTP page

I need help listing the specific risks of embedding an HTTPS iframe that enables credit card checkout inside of an HTTP page. Are there security issues with embedding an HTTPS iframe on an HTTP page? ...
Dan Kohn's user avatar
  • 343
23 votes
2 answers

How was the website able to tell my credit card was wrong before it processed it? [duplicate]

I was putting in my cc number and and as soon as I had finished inputting 16 digits it highlighted it in red. I looked it over and realized one digit was wrong. Corrected it, it became black. How did ...
larry909's user avatar
  • 625
23 votes
5 answers

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card. Is it standard practice to ask a customer to send a photo of their credit card to confirm their ...
JMK's user avatar
  • 2,506
21 votes
5 answers

Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address? [closed]

My girl was scammed and entered my home address and my credit card number on a fake website (through a Facebook ad). What risks am I additionally incurring, apart from having lost €40 (the money that ...
CoffeDeveloper's user avatar
21 votes
2 answers

Store Credit Card Information in Password Manager?

For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint ...
Suimon's user avatar
  • 385
21 votes
4 answers

Credit card forms on HTTP pages a MITM risk?

The other day, there was a web developer mailing list thread about a fundraiser page. One person noted that the page with the credit card form was HTTP, not HTTPS. In response, one person said that ...
Andrew Grimm's user avatar
  • 2,102
21 votes
3 answers

Is accepting an invalid credit card number a security issue?

I am testing a website which accepts invalid credit card numbers for reservations. The interesting thing is they do CC validation if the currency is USD, but not for any other currencies. Should I ...
Jaya's user avatar
  • 401
20 votes
4 answers

Is Visa PayWave secure?

Recently (well, a few months or even a year ago), my bank, here in Australia, introduced this PayWave technology to their Visa debit cards. They claim it's secure, but all they talk about is their ...
AlbeyAmakiir's user avatar
19 votes
4 answers

In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"?

Is the credit card number, CVV & expiry date considered to be a secret? If so, then the physical credit card is incidental & the info about the card is something "you know". OTOH, if you don't ...
user93353's user avatar
  • 2,032
19 votes
5 answers

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
MBender's user avatar
  • 380
18 votes
3 answers

Is storing CVV compliant with PCI standards?

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
András Gyömrey's user avatar
18 votes
3 answers

What prevents people getting charged over NFC in crowded places?

I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just ...
RomanSt's user avatar
  • 1,220
16 votes
3 answers

Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the ...
Sparkler's user avatar
  • 805
16 votes
2 answers

Is adding a supplementary credit transaction something that could improve online payment security?

An online company from which I regularly buy goods apparently recently upgraded their security policy. Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
WhiteWinterWolf's user avatar
15 votes
4 answers

Is a 3 or 4 digit CVV enough for online transactions?

Background: The CVV/CVV2 number ("Card Verification Value") on a credit card or debit card is a 3 or 4 digit number printed on the card. It is 3 digits on VISA, MasterCard and Discover branded credit ...
Md Mahbubur Rahman's user avatar
15 votes
3 answers

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
Gabriel S.'s user avatar
14 votes
4 answers

Collecting credit card info in HTTPS iframe within an HTTP site's paid membership program collects credit card info inside an HTTPS iframe over plain HTTP . The HTTPS url is In an article, they claim this is ...
mcranston18's user avatar
14 votes
5 answers

I need ideas for blocking a single malevolent user

Let me throw out this problem I'm having to some of my technical peeps and see if you guys have any new suggestions: We have a website that sends text messages and voice mails for our clients. ...
Chris Chubb's user avatar
14 votes
3 answers

Is it safe to auto-fill credit card numbers using Chrome?

Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the ...
BlueBerry - Vignesh4303's user avatar
13 votes
2 answers

Validating and storing credit card data for retrieval later

I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
tony's user avatar
  • 231

2 3 4 5