Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [payment]

The tag has no usage guidance.

2
votes
1answer
73 views

RFID-Safe Wallet destroys credit card?

I'm getting a hang of paying with credit cards, and contactless payment especially, lately (which was quite uncommon where I live until like a few months ago). I'm now looking to buy one of these ...
0
votes
0answers
10 views

What data associated with my payment card does a merchant or a payment processor get when I purchase something with it? [duplicate]

If I use a debit or credit card to purchase something online, what data does the party that charges my card get? I understand that there are payment processors like Stripe or PayPal that act as a ...
1
vote
1answer
72 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
1
vote
1answer
45 views

Security implications of exposing payment gateway secret API key

Introduction In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow: POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL. ...
1
vote
2answers
84 views

payment details over https

I have a web form on which my customer enters his credit card details along with other info. I then send this data to my backend server. I save the non-sensitive information to my database. I DO NOT ...
2
votes
1answer
81 views

Custom SSL protection Message to Users in Web Applications

In some websites, especially on their payment section, I see a text something like: You are on a secure page. Your personal data is encrypted and protected by SSL technology. However it looks like a ...
0
votes
1answer
79 views

PCI Compliance and Card Data Transmit

I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be displayed/stored. I am trying to find what is required in regards to ...
6
votes
1answer
448 views

Find Security Flaws in My Payment Page

I've done some extensive research about how to secure your website from card fraud. iFrames do a pretty good job of this, however, It can still be worked around from certain exploits. Many payment ...
4
votes
1answer
87 views

Can a MAC be used as an irreversible PCI Token?

I'm looking at implementing a PCI token generation process based on a MAC code obtained from the PAN. This would be an irreversible token. The method I have in mind seems OK to me, but I'm not quite ...
3
votes
4answers
325 views

Is debit (credit) card payment inherently broken from security point of view?

TL;DR I've been a user of debit cards for many years, and don't know much about the security issues. However, just thinking logically, I find the practice of paying by providing card data (i.e. card ...
3
votes
1answer
2k views

HTTPS is not green and there is no padlock icon, is it safe for a debit card payment?

I was about to pay online with my debit card, but now I'm not sure, is it safe ?
4
votes
2answers
382 views

PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?

Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN? I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
2
votes
2answers
294 views

Payment processing in Android

Assume that my company is PCI DSS complaint. I want to provide a custom view (in SDK library for Android) for payment processing to merchants who sell products via their Android mobile application. ...
0
votes
1answer
163 views

Good book on PCI DSS? [closed]

I need to upgrade my skills on PCI DSS Compliance. I'm looking for a couple of combo: one to cover everything in an extensive way (a sort on encyclopedia to keep as a reference) and a quick guide to ...
0
votes
1answer
87 views

How does a mobile wallet vouch for credit card data?

I just recently learned that vendors almost never store credit card data but instead receive a token from the payment processor that they then can use for future payments. I thought this is also how ...
2
votes
1answer
70 views

Secure IDs and QR

Suppose that I want to give to users of my site the option to pay for a service and use it later. I am thinking to generate a unique ID for the paid service. I want to be able to trust the ID to ...
1
vote
0answers
70 views

Why Russian/non-USA online firms never take a credit card directly?

I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
4
votes
2answers
268 views

Security of the Indian AadhaarPay fingerprint based payment system?

India recently launched a payment system where merchants install an app on an Android phone, and connects a fingerprint reader it. Clients provide their Aadhaar number (like a national identity ...
1
vote
0answers
227 views

Android pay card registration, token generation, and verification

I was trying to find information about Android Pay and how it handles card information when adding it to Android Pay and how are token information verified. I was not able to find detailed information....
1
vote
1answer
63 views

How well-protected should customer billling & invoice data be?

Specifically, I'm curious about Recurly.com's hosted_login_token, described here: https://docs.recurly.com/docs/hosted-account-management Basically, it's a token that they allow to be stored in ...
14
votes
4answers
3k views

Collecting credit card info in HTTPS iframe within an HTTP site

slate.com's paid membership program collects credit card info inside an HTTPS iframe over plain HTTP . The HTTPS url is https://my.slate.com/subscriptions/manage/. In an article, they claim this is ...
3
votes
1answer
85 views

NFC Security for Payment

During an offline transaction, the Point-of-Sale has no internet connection, and so the payment terminal cannot verify if the client’s payment device has been revoked. A malicious person can use a ...
1
vote
1answer
192 views

API based platform to save bank account information

We are implementing a portal that will Require user to provide the bank details (routing number, account number etc). This data will be sent through SFTP to another carrier that will use the bank ...
2
votes
2answers
483 views

Does my server need to fulfill PCI compliance if it only forwards the credit card number?

I'm currently trying to implement a payment system (braintree) but I'm not entirely sure how this is supposed to work. What I hope it works like: User selects a product and clicks on "buy" User ...