Questions tagged [credit-card]

Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

Filter by
Sorted by
Tagged with
3
votes
2answers
18k views

No HTTPS on credit card entry form - can it be safe?

I was going to make a purchase on a website, but the page containing the credit card entry form is served via HTTP and not HTTPS. Is it definitely unsafe? The website advertises the use of "RapidSSL"...
-2
votes
0answers
52 views

If a hacker know you credit/debit card details, how much can they steal? [closed]

If a hacker knows you credit/debit card details, what is the maximum amount they could theoretically steal?
1
vote
1answer
67 views

Cardholder info transmission between issuing and acquiring banks

Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction? Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
1
vote
3answers
310 views

I have recovered my credit card PAN (6 chars masked) and expiration date on a merchant site, acceptable or not?

I have a credit card saved in X merchant. I only see the last 4 digits in the UI. I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed ...
4
votes
2answers
2k views

RFID-Safe Wallet destroys mag stripe?

I'm getting a hang of paying with credit cards, and contactless payment especially, lately (which was quite uncommon where I live until like a few months ago). I'm now looking to buy one of these ...
14
votes
3answers
39k views

Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the ...
3
votes
3answers
979 views

Can a card issuing company store CVV number, expiry date and 16 digits card number?

I have a limited amount plastic card issued by a certain company. When I log into my online account of the same company, I can see complete details - 16 digits card number, name, expiry date and CVV ...
2
votes
3answers
4k views

Is it possible to brute-force a CVV code?

If I'm not wrong, the CVV code almost always follows a certain pattern based on the credit card number and dates. What are the possibilities to go through to hypothetically brute-force a CVV code? Is ...
1
vote
4answers
215 views

Collecting banking, credit-card statements from users

I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
0
votes
0answers
80 views

Understanding scam involving mobile transaction number

Today I have received an SMS from the number that my credit card provider uses to send MTANs that have to be entered for e-commerce. So at first the obvious scam seemed to be someone trying to use my ...
-2
votes
2answers
110 views

Does PCI Apply to PAN only?

I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No ...
1
vote
0answers
86 views

Credit card fraud - record your face movement to unlock your account

Recently I accessed my credit card account (with a well-known credit card company) and right on the web page received a message that my account is locked to "prevent some sort of fraud". I called ...
0
votes
2answers
562 views

PCI CVV requirement - encrypt prior to authorisation?

Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorisation has occurred. In other words the restriction on storing sensitive authentication ...
7
votes
2answers
89k views

Why is the American Express 4-digit security code located on the front of the card?

Credit cards issued by American Express have two security codes, a 3-digit one and a 4-digit one: These two security codes aren't embossed so that if a physical impression of the card details has to ...
1
vote
1answer
84 views

Business located in USA does it need to be PCI and SCA compliant?

The business is located in the US. But: Has European customers who put a transaction via a custom-built shopping cart Sells via tradeshow in Europe or Asia in person Could Customers send credit cards ...
5
votes
2answers
3k views

How to manually disable the no contact card?

New payment cards in my country are now delivered with the no-contact option that allows pay without putting the card in a machine. The fact is that these cards aren't secured because you can read ...
0
votes
1answer
274 views

Is it possible to bypass 2FA and access bank account in this system?

Nowadays, any credit/debit card transaction made online (at least for mine) requires one to enter the card details (Account No., Expiry Date, CVV etc). In the end, a OTP (One Time Pass) is sent to the ...
8
votes
2answers
517 views

I can pay by my credit card under fake name: who's responsible to check?

I am customer of a large European bank, but I have found the following happening consistently with multiple past banks. Basically, I have always been able to pay using my legitimate card(s), credit ...
19
votes
4answers
20k views

Is Visa PayWave secure?

Recently (well, a few months or even a year ago), my bank, here in Australia, introduced this PayWave technology to their Visa debit cards. They claim it's secure, but all they talk about is their ...
1
vote
0answers
19 views

Is credit/debit card's chip programming clone to another empty chip card [duplicate]

Card's magnetic strip and chip should programmed by banking system. Is there any chance to clone same programming to another chip and magnetic strip empty card? By doing this, our cards may be ...
42
votes
3answers
7k views

Why are my plastic credit card and activation code sent separately?

Capital One recently sent my plastic credit card by post mail and its activation code by a separate post mail. What security problem does this mitigate? If a rogue element has access to my mail box ...
0
votes
1answer
130 views

Is there a secure way to disable NFC and RFID on credit cards and personal IDs?

If you're wondering why would I want that - it's for my own security: against identity and data theft.
9
votes
2answers
2k views

CVV Credit Card Phishing

Caller 18777348472 had my name & last 4 digits of my credit card and indicated he was from fraud prevention: someone tried to charge $600 through Amazon. He asked me to verify that I had the card ...
2
votes
1answer
81 views

CVV info for over the phone or by mail transactions

I am a newspaper circulation manager and a subscriber just informed us that we aren't allowed to ask for the CVV over the phone or by mail subscriptions. What is the correct procedure?
3
votes
2answers
192 views

Why CVV on the credit card at all?

CVV is a security feature. Why isn't it handled as a PIN and kept secret? I see that's convenient to have the number on the back (or front, in some rare cases), but so would be to write your PIN on ...
1
vote
2answers
125 views

EMV Transactions vs Magnetic Stripe [closed]

In Mag stripe transactions, I've worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways ...
3
votes
3answers
3k views

Why does Amazon ask for the CVC/CVV if it bills without it?

I have a follow-up question relating to this question: How does Amazon bill me without the CVC / CVV / CVV2? If amazon.com can bill without the CVV why does it ask for it the first time information ...
1
vote
0answers
74 views

What information about me do online stores get via my credit card? [duplicate]

I found the exact same question about physical stores: What information about me do stores get via my credit card? Though I am interested in online stores! Are there big difference between PHYSICAL ...
1
vote
0answers
38 views

Does 3D Secure provide a significant security benefit that justifies a worse UX?

We have a website that uses Stripe for charging customers. We are selling a physical product that has zero resale value and a service that is completed 30 days after the customer receives the physical ...
4
votes
2answers
226 views

Can a criminal fake the use of a PIN in a chip and pin credit card transaction?

Within minutes of my credit card being stolen by pickpockets, two large transactions were made by the thieves, apparently in a bar or cafe. My bank tells me that they were chip and pin transactions. I ...
0
votes
1answer
72 views

Credit Card Creation for Member ID [closed]

I have a bit of a unique application. I'm trying to create fancy ID cards for local membership. It's a cocktail club, and they're doing some cool things with the front of house and service ...
3
votes
2answers
2k views

PCI DSS - mask PAN and log individual access to PAN

How do you re-conciliate two PCI DSS requirements in applications: 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only ...
0
votes
2answers
89 views

Telling donors we will no longer accept card information in writing [closed]

What is positive wording for telling donors we no longer accept card information in writing, for their security?
2
votes
2answers
3k views

Is it possible for a NFC-enabled device to emulate a Visa card with PayWave?

If someone has access to the physical Visa card (and with that comes the number on the front, the expiry date, and three digits on the back) would it be possible for them to program a NFC-enabled ...
43
votes
8answers
23k views

Amazon let me place an order without me ever being asked for 3-D secure password

I have set a "3-d secure password" for my debit card, on my bank's website. But when I purchased something in amazon.co.uk, I went through the whole process without ever being asked for that 3D ...
0
votes
0answers
12 views

Questions about Card Skimming Etc [duplicate]

With the MagStripe and other technology being able to Read write and erase card info with a swipe. I am wondering if one is able to encode fished cc info to a blank card. For example If someone stole ...
0
votes
1answer
217 views

How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?

Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
7
votes
5answers
836 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
1
vote
1answer
82 views

Is it safe to give multiple virtual credit card numbers to the same vendor?

There are situations when I have to give several virtual credit card numbers linked to my real credit card to the same vendor. Can a vendor guess the real credit card number by having multiple virtual ...
1
vote
0answers
90 views

Safely Display Card PIN

We are currently sending the card PIN via SMS. We do not store them in any way, neither do we have the possibility to change it. The only way to change it is for the customer to go to an ATM and ...
0
votes
1answer
257 views

Cloning Credit/debit card chip [closed]

I have a nice, expensive, metal credit card with a chip but it's from an older card. I’m wanting to rewrite the magnetic stripe and the chip to my new card. I know how to rewrite the magnetic stripe ...
33
votes
5answers
12k views

How can Paypal know my card is being used in another account?

I have a credit card saved to my primary Paypal account. To make a long story short, I needed to make another Paypal account that would not be connected to my original one. I used a different ...
7
votes
4answers
1k views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
2
votes
1answer
74 views

Using browser XMLHttpRequest to initiate credit card transaction with processor?

I have a website where people can make purchases. The entire website is served with https. On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
234
votes
7answers
42k views

All 0s (zeros) in a bank card's CVC code

My bank card recently expired. I got a new one and this one turned out to be "lucky": its CVC code was 000. For a few months I used it extensively, both online and offline, without any difficulties - ...
1
vote
2answers
9k views

Does changing credit card numbers provide better security over time?

I've always contacted my bank and credit card provider every year and simply asked to change my credit card number itself (and get a new card). They do so without a hassle and I feel more secure in ...
3
votes
1answer
268 views

When credit card tokens are leaked / stolen, what can the attacker do with them? [closed]

I'm implementing an online payment system relying on an external payment processor handling all credit card entry. My payment processor supports recurring payments via "credit card tokens". We only ...
6
votes
2answers
96k views

Are VISA gift cards untraceable?

I was in a retail store today, and these people were discussing how easy it is for people to use stolen credit cards, and buy those visa gift cards without being traced after they purchase the gift ...
5
votes
3answers
4k views

Online Retailer asks for a copy of Credit Card and Drivers License

This weekend I placed an order for a part from an online retailer ($300-400). Shortly thereafter I received an email from their sales team saying something similar to the following: Hi, we have ...
23
votes
2answers
4k views

How was the website able to tell my credit card was wrong before it processed it? [duplicate]

I was putting in my cc number and and as soon as I had finished inputting 16 digits it highlighted it in red. I looked it over and realized one digit was wrong. Corrected it, it became black. How did ...

1 2 3 4 5 9