Questions tagged [credit-card]

Payment cards. For questions about storing credit card numbers, see also pci-dss. For questions involving the physical object, see also smartcard (if the card has a chip).

Filter by
Sorted by
Tagged with
0
votes
1answer
147 views

Is it safe to use an auto pay feature on my smart watch that stores card info?

(So guess what I got for Christmas...) While I do appreciate the tech and some of the features in the smart watch, I am skeptical of it's biggest feature -- the Pay feature which essentially ...
0
votes
1answer
97 views

Do 2 Chip based cards effect each other's data if they are in the same wallet all the time?

So I got 2 new ATM cards from two different banks, both cards are Chip and NFC enabled. Card A arrived one week earlier than Card B. Both of them remain in my wallet in close proximity to each other, ...
2
votes
3answers
432 views

PCI - store card details offline

I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts. We have been asked a few times by various customers if we ...
2
votes
1answer
266 views

PCI DSS compliant method to receive card data for a merchant with no electronic storage

The merchant in question has no electronic cardholder data storage. Currently they receive CHD (no CVV) in non-secure ways and store it on paper in order to execute payments via card-not-present POS ...
0
votes
2answers
140 views

Would one e breaking PCI compliance in this scenario?

First and foremost - I am not planning on going down the road of trying to adhere to PCI compliance myself, It's simply not worth the headache. I am however interested in how some companies manage to ...
4
votes
2answers
1k views

PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?

Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN? I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
0
votes
1answer
382 views

Is identification with NFC bank cards feasible?

Imagine I want to identify users more securely than using username/password, e.g. a hardware token. However, I can't issue smartcards to them. Is it a good idea to try to use NFC-enabled bank cards ...
0
votes
0answers
32 views

Verify that any online service is secure [duplicate]

I personally don't trust cloud storage, I understand the convenience, but it's not enough for me. Is there any way other than the company saying so, to verify that the storage of my files is indeed ...
4
votes
1answer
617 views

Storing customer credit card information for manual processing later

For a solution that we are developing for the hospitality industry, we need to save customer credit card information, and show this to the hotel for them to manually process the payment later. I have ...
5
votes
1answer
533 views

Is transaction history stored on credit card a security risk?

I installed an NFC reader on my android and scanned each of my bank cards to see what they would reveal through their contactless feature (NFC). Unsurprisingly they reveal the card number and the ...
0
votes
1answer
69 views

Amex cc questions [closed]

If I am issued a new card due to a lost or stolen card with American Express Platinum Card will the first 10 numbers of the account number stay the same and only the last five change or do they still ...
-2
votes
1answer
142 views

How do the Chinese keep information secure? [closed]

I ask this question in light of the recent Equifax hacking. I'm sure people in China get hacked all the time, but I was recently talking to someone from there and they told me they never walk around ...
1
vote
1answer
264 views

How could criminals use stolen EMV credit cards in 2011?

I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory ...
43
votes
8answers
24k views

Amazon let me place an order without me ever being asked for 3-D secure password

I have set a "3-d secure password" for my debit card, on my bank's website. But when I purchased something in amazon.co.uk, I went through the whole process without ever being asked for that 3D ...
1
vote
1answer
351 views

Required security for storing bank transactions, but not credentials

If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
3
votes
1answer
1k views

How to protect magnetic stripe in credit cards from being read?

I know that for credit cards with RFID there are solutions to prevent unauthorized parties from reading the data for fraudulent purposes If I know that my card 99% of the time is only going to do ...
0
votes
1answer
106 views

ATM Fraud Question

My neighbor had a guest that used a bank card to fraudulently purchase an iPad online from Apple. Neighbor was able to verify guest was the culprit with evidence and witnesses. There are also ...
-4
votes
6answers
4k views

Why is this not a good way to store credit card data? [closed]

Why is the following database table not secure? Which encryption method is better for credit cards? +--------------+-------------------------------+-----------+--------------+ | customer_id | ...
26
votes
7answers
16k views

Recourse if debit card was used on a suspicious website

My husband got a pop-up ad on his phone for a fashion website and purchased two pairs of sunglasses using our debit card. The confirmation was emailed to me (marked as spam by gmail), and the site ...
0
votes
2answers
108 views

Is it normal for a merchant to claim an online transaction is card-present?

I recently made a purchase from a merchant (the city of Los Angeles). During the checkout process on their web site I had to enter my credit card information. One of the fields in the credit card form ...
0
votes
1answer
102 views

How does a mobile wallet vouch for credit card data?

I just recently learned that vendors almost never store credit card data but instead receive a token from the payment processor that they then can use for future payments. I thought this is also how ...
0
votes
1answer
439 views

Is it safe to use SHA-512 to identify credit card?

I am thinking if using one-way function like SHA-512 is considered to be safe for application on credit card numbers. The credit card number is 13-19 number with known BIN range (6-8 numbers) and the ...
1
vote
1answer
272 views

Credit card store first four and last four which PCI SAQ?

In our application, we only transfer cardholder data to a PCI DSS compliant service provider, and don't store it ourselves. We only store first four and last four digits of credit card number for ...
2
votes
0answers
69 views

How can I create a verifiable signature for a digital transaction?

I am currently working on creating a digital signature pad that customers can sign instead of a traditional paper receipt for credit card transactions. Currently I have the ability for them to sign a ...
0
votes
3answers
8k views

Is it possible to disable NFC on credit card?

I have credit card with wireless payment. For low prices it does not require to enter pin code. An attacker with 100$ device can take these money whithout my knowledge. Of course, I can configure ...
3
votes
3answers
2k views

What info this EMV chip “skimmer” was actually capturing?

Reading a security blog I found an article about an EMV skimmer designed to be inserted into the ATM's chip card slot. What info was this device actually capture? As far as I know there's definitely ...
0
votes
1answer
2k views

Does credit card tokenization have an expire date?

I am reading the tokenization product security guidelines of PCI-DSS but I do not see the time of expiration of the token. Does it have it?
1
vote
1answer
3k views

Cloning of EMV cards

I am trying to get information about cloning of EMV credit cards (chip cards). I have a good understanding of the cryptology behind it and know that it is impossible to clone it "from the outside" ...
2
votes
2answers
380 views

Bank issued new credit card as a 'safety measure' but 16 digit acount number is the same

I received a new card in the mail recently. My existing card wasn't due to expire until almost two years from now. The letter that accompanied the card makes it quite clear that the card was replaced ...
1
vote
1answer
279 views

Accepting Card payments with SNI SSL Certificate

As part of an app I'm making, I'm making a premium version that processes cards on behalf of customers using Stripe. are SNI (Cloudflare) based SSL Certificates seen as less secure for this/a bad ...
1
vote
2answers
396 views

Credit Card details shown in full after payment on online store

A large and reputable online store shows the credit card details of the customer in full on the order confirmation and receipt page (after payment has been processed). This is the first time I have ...
0
votes
1answer
103 views

Why are card associations launching RFID enabled payment cards despite of their being unsecure?

You can use applications to get data from these cards. I got tracks data of my cards as well as card number and expiry from my debit card just by single tap of phone. A criminal can use that data and ...
11
votes
1answer
2k views

How does Square Reader comply with EMV pin entry requirements?

Square recently launched their Square Reader physical device. AS well as accepting NFC based payments (e.g. Contactless or Apple/Android Pay, it also accepts Chip and PIN authentication. However the ...
2
votes
3answers
6k views

Is it possible to brute-force a CVV code?

If I'm not wrong, the CVV code almost always follows a certain pattern based on the credit card number and dates. What are the possibilities to go through to hypothetically brute-force a CVV code? Is ...
1
vote
0answers
95 views

What solutions would you recommend for credit card processing for Virtual Assistants?

I'm developing the entire backend using for an Over-the-phone Virtual Assistant service. Their clients are busy professionals who delegate their online purchasing and booking to this service, which ...
1
vote
1answer
1k views

Security reason that Card Security Codes (CVV/CVC) are usually on the back of a card? [closed]

My friend recently got an Amazon Credit Card. Interestingly, all the information could be found on the back of the card including name, expiration, number, and CVV. Here's an image I found of the ...
2
votes
1answer
128 views

Ads on Checkout a Bad Idea™?

Is it a categorically bad practice to run third-party aggregated ads on a checkout page where sensitive information is entered? This sends of all kinds of alarm bells for me, but I've had a ...
1
vote
1answer
134 views

Why are credit card companies generally limiting themselves to 16-digit data infrastructure? [closed]

I have a question. Why are credit card companies generally limiting themselves to 16-digit data infrastructure?
2
votes
2answers
626 views

Sending credit-card numbers through SFTP?

I need to send credit-card numbers and other information through SFTP. What considerations should I have? Recommendations? Is valid encrypt this numbers? What does PCI say about this?
1
vote
1answer
436 views

Transferring credit card details to hotels without PCI

I'm developing a web application for hotels that send offers to the guest's hotels. I want to store the guest's credit card data in a secure way, through a third party service as I don't want to ...
0
votes
1answer
163 views

Credit Card information Security

In providing first 4 and last 4 number of credit card to vendor safe, considering you dont provide the expiration date or CVV2 number?
1
vote
0answers
384 views

Credit card number in credit report. Acceptable or not?

I recently applied to obtain my credit report for the very first time and was taken by surprise when I saw all my credit card numbers mentioned in the report without any masking. I had seen other ...
0
votes
1answer
70 views

Question about handling credit card info in retail program

The C# program I have created uses a webdriver to send the user's card number and other info such as their address to a store page, I never save the number in code other than when it is stored in ...
1
vote
1answer
504 views

Why Aren't Credit Card PINs Required For Online Transactions

I have never heard of credit card PINs being required for online purchases. Why is this? Wouldn't it drastically reduce online fraud? Physically stolen credit cards couldn't be used in online ...
5
votes
3answers
1k views

How to securely hash/tokenize a string

A system I'm working on accepts as input a customer account number and needs to generate a token based on it. We're not allowed to store the plain text of the account number itself, so the goal of the ...
6
votes
2answers
2k views

Do It Yourself Credit Card Storage (PCI - DSS Compliant)

I'm a software developer, considering writing a custom system for credit card number storage. Our intent is to be fully Payment Card Industry (PCI) compliant. I'm working with a small business owner ...
1
vote
4answers
106 views

Taking credit card info online recommendations

I have an online store in which customers can purchase a code which enables them to have use of a bot service I run. Part of the bot needs customers sensitive information to be entered, address, and ...
1
vote
2answers
848 views

Is storing CVV in two parts separately a violation of PCI?

I was going through the integration documents of a payment processor, and as per my understanding of the code, docs and disassembly, they are doing the following: Encrypting the CVV on the server-...
2
votes
1answer
485 views

Shimmers inside chip and pin devices

Recently shimmers made a lot of noise in the news and became popular to be installed in ATMs as they are very small. Can they be installed inside chip and pin devices? Or where else can they be ...
2
votes
1answer
228 views

Can someone debit cash from my debit card just with an ATR Number?

So basically I had a debit card, a built-in smart card reader in my laptop and some money in my account. What I did was, I plugged my debit card in my laptop's smart card reader, I copied the ATR ...

1 2
3
4 5
9