Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [payment]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3 votes
0 answers
386 views

Are there any risks sharing my phone's SEID number with the bank of my credit card?

I was not able to add a credit card to Apple Pay on an iPhone. The bank told me that they need the SEID number of the phone to resolve the issue. By a quick search on the Internet, I learned that the ...
Domon's user avatar
  • 131
0 votes
0 answers
65 views

Rotate or replace EMV keys?

I would like to better understand the mechanism of rotation of EMV keys used for payment cards. Assuming that it intends to provide a rotation of the keys used for the production cards: just recycle ...
MaXbeMan's user avatar
1 vote
1 answer
526 views

CVV2 calculation with TR-31 Key

I need to use the CVK Key (in key block format) to calculate the CVV2. In the past, I have always used single keys in variant format for this purpose (CVKa + CVKb), and the calculation procedure is ...
MaXbeMan's user avatar
0 votes
0 answers
199 views

Management of CVK key in Key Block format

I use a Thales PayShield 10K with a LMK KeyBlock 3DES. I have to send a CVK Key to a Scheme for the valorization of CVV2 value. Now, in my envorinment i generated a CVK Key with "Key Usage"= ...
MaXbeMan's user avatar
1 vote
1 answer
667 views

Can Twitter use the payment information they have to know if multiple users have used the same credit card to buy multiple Twitter blue subscriptions?

This question asked if websites on which one is transacting have their payment information and from the replies it seems that they do (or at least their payment gateway service providers do). But my ...
TheReal_Skywalker's user avatar
0 votes
1 answer
537 views

Inconsistency in masking CVV/CVC credit card details during input

I have observed that in some payment portals while making payments via credit/debit card the CVV/CVC number is masked out (hidden), but in different portals this is not the case. For example: USA &...
Ashish Patil's user avatar
1 vote
1 answer
340 views

Is braintree clientToken supposed to be public?

I'm building an app that uses Braintree for processing payments. According to the documentation, I need a server-side endpoint that returns the clientToken, which is then used to manage a user's vault ...
David Bryant's user avatar
0 votes
1 answer
117 views

Question about the cause of the differences in Google Pay features

If you are logged in with your Google account and click "Manage your Google Account," you can then edit your payment profile. But you cannot (1) see the complete card number except for the ...
Xi Liu's user avatar
  • 121
0 votes
0 answers
187 views

Pay online with a card and then block it - any threats?

Sometimes I order stuff from less-known online stores that ask me to pay directly by providing a card number. Either they don't support PayPal or similar services or they might charge a fee for using ...
Alexander's user avatar
  • 101
3 votes
1 answer
2k views

3D secure 2 and CSP

I'm building a checkout page for a website and have a checkout page with a content security policy (CSP). When the customer pays with a card, they will see a box popup with the bank page that allows ...
SpottedPaint's user avatar
5 votes
4 answers
885 views

Are payment card PINs safe to send via SMS?

I have signed up with a new current account in the UK for day-to-day transactions. The account comes with a payment (debit) card. The banking institution's security handling of PINs for payment cards ...
halfer's user avatar
  • 831
0 votes
1 answer
106 views

PIN transfer between payment schemes

I am wondering, if it should be possible to transfer PIN in case of migrating between different payment schemes like Mastercard or VISA. For example, when I have a card issued by Mastercard, and it ...
user1563721's user avatar
  • 1,119
0 votes
2 answers
181 views

In page Payment script security needs [closed]

Currently, I'm working in a Fintech StartUp. We have already implemented our payment solution with redirect in a checkout page hosted in our domain (like https://stripe.com/docs/payments/checkout). ...
Federico Gatti's user avatar
10 votes
2 answers
10k views

I can pay by my credit card under fake name: who's responsible to check?

I am customer of a large European bank, but I have found the following happening consistently with multiple past banks. Basically, I have always been able to pay using my legitimate card(s), credit ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
29 votes
4 answers
33k views

Bypass with wrong cvv of debit card and getting OTP

This is happening in Visa/MasterCard/American Express, etc. I tried checking in many payment apps and payment gateways that if I enter the correct debit card number, name, valid date, and wrong CVV ...
Akshansh Shrivastava's user avatar
0 votes
1 answer
423 views

Is my credit card information "wide open to hackers" without VPN?

I saw an ad for a vpn provider recently where they claimed that, without using a vpn, my credit card information is "wide open to hackers" while shopping on-line. I guess the implication here was that ...
Dunno's user avatar
  • 205
0 votes
1 answer
359 views

Online payment integration requires handling my bank credentials. Why?

When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website? The context of my ...
Pips's user avatar
  • 105
6 votes
1 answer
3k views

Payment Handlers In Google Chrome

Are there any privacy/security risks associated with using payment handlers in Google Chrome? Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
John Anderson's user avatar
1 vote
1 answer
231 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
Marcus Horne's user avatar
1 vote
1 answer
432 views

Security implications of exposing payment gateway secret API key

Introduction In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow: POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL. ...
riwu's user avatar
  • 113
1 vote
2 answers
382 views

payment details over https

I have a web form on which my customer enters his credit card details along with other info. I then send this data to my backend server. I save the non-sensitive information to my database. I DO NOT ...
Deer's user avatar
  • 11
1 vote
1 answer
199 views

Custom SSL protection Message to Users in Web Applications

In some websites, especially on their payment section, I see a text something like: You are on a secure page. Your personal data is encrypted and protected by SSL technology. However it looks like a ...
Pilfility's user avatar
  • 497
0 votes
1 answer
613 views

PCI Compliance and Card Data Transmit

I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be displayed/stored. I am trying to find what is required in regards to ...
fargo01's user avatar
  • 45
6 votes
1 answer
641 views

Find Security Flaws in My Payment Page

I've done some extensive research about how to secure your website from card fraud. iFrames do a pretty good job of this, however, It can still be worked around from certain exploits. Many payment ...
Matt The Ninja's user avatar
4 votes
1 answer
174 views

Can a MAC be used as an irreversible PCI Token?

I'm looking at implementing a PCI token generation process based on a MAC code obtained from the PAN. This would be an irreversible token. The method I have in mind seems OK to me, but I'm not quite ...
Claude Chouinard's user avatar
4 votes
4 answers
868 views

Is debit (credit) card payment inherently broken from security point of view?

TL;DR I've been a user of debit cards for many years, and don't know much about the security issues. However, just thinking logically, I find the practice of paying by providing card data (i.e. card ...
Attilio's user avatar
  • 179
3 votes
1 answer
4k views

HTTPS is not green and there is no padlock icon, is it safe for a debit card payment?

I was about to pay online with my debit card, but now I'm not sure, is it safe ?
Rafa's user avatar
  • 31
4 votes
2 answers
2k views

PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?

Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN? I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
devio's user avatar
  • 173
2 votes
2 answers
580 views

Payment processing in Android

Assume that my company is PCI DSS complaint. I want to provide a custom view (in SDK library for Android) for payment processing to merchants who sell products via their Android mobile application. ...
mariami's user avatar
  • 123
0 votes
1 answer
436 views

Good book on PCI DSS? [closed]

I need to upgrade my skills on PCI DSS Compliance. I'm looking for a couple of combo: one to cover everything in an extensive way (a sort on encyclopedia to keep as a reference) and a quick guide to ...
Corlenoe's user avatar
0 votes
1 answer
201 views

How does a mobile wallet vouch for credit card data?

I just recently learned that vendors almost never store credit card data but instead receive a token from the payment processor that they then can use for future payments. I thought this is also how ...
problemofficer - n.f. Monica's user avatar
2 votes
1 answer
141 views

Secure IDs and QR

Suppose that I want to give to users of my site the option to pay for a service and use it later. I am thinking to generate a unique ID for the paid service. I want to be able to trust the ID to ...
Marco Altieri's user avatar
1 vote
0 answers
135 views

Why Russian/non-USA online firms never take a credit card directly?

I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
cnst's user avatar
  • 1,964
3 votes
2 answers
357 views

Security of the Indian AadhaarPay fingerprint based payment system?

India recently launched a payment system where merchants install an app on an Android phone, and connects a fingerprint reader it. Clients provide their Aadhaar number (like a national identity ...
user avatar
1 vote
0 answers
310 views

Android pay card registration, token generation, and verification

I was trying to find information about Android Pay and how it handles card information when adding it to Android Pay and how are token information verified. I was not able to find detailed information....
user1563721's user avatar
  • 1,119
1 vote
1 answer
140 views

How well-protected should customer billling & invoice data be?

Specifically, I'm curious about Recurly.com's hosted_login_token, described here: https://docs.recurly.com/docs/hosted-account-management Basically, it's a token that they allow to be stored in ...
Eric Nguyen's user avatar
14 votes
4 answers
4k views

Collecting credit card info in HTTPS iframe within an HTTP site

slate.com's paid membership program collects credit card info inside an HTTPS iframe over plain HTTP . The HTTPS url is https://my.slate.com/subscriptions/manage/. In an article, they claim this is ...
mcranston18's user avatar
3 votes
1 answer
156 views

NFC Security for Payment

During an offline transaction, the Point-of-Sale has no internet connection, and so the payment terminal cannot verify if the client’s payment device has been revoked. A malicious person can use a ...
Alyaa's user avatar
  • 31
1 vote
1 answer
739 views

API based platform to save bank account information

We are implementing a portal that will Require user to provide the bank details (routing number, account number etc). This data will be sent through SFTP to another carrier that will use the bank ...
user9445's user avatar
  • 143
4 votes
2 answers
1k views

Does my server need to fulfill PCI compliance if it only forwards the credit card number?

I'm currently trying to implement a payment system (braintree) but I'm not entirely sure how this is supposed to work. What I hope it works like: User selects a product and clicks on "buy" User ...
Stefan Falk's user avatar
  • 1,067