Questions tagged [payment-gateway]
A payment gateway is an e-commerce application service provider service that authorizes credit card payments.
82
questions
1
vote
1
answer
362
views
Can Twitter use the payment information they have to know if multiple users have used the same credit card to buy multiple Twitter blue subscriptions?
This question asked if websites on which one is transacting have their payment information and from the replies it seems that they do (or at least their payment gateway service providers do). But my ...
13
votes
2
answers
3k
views
Validating and storing credit card data for retrieval later
I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
- 231
1
vote
1
answer
146
views
How to prevent shopping cart alterations in another tab when paymentintent is already created?
Has anyone figured out a solution to this? I seem to have gotten to the same conclusion with no solution.
If I were to go the my app's checkout page, the payintent is created in the backend (explained ...
- 11
1
vote
1
answer
197
views
Is there a secure way of handling online payments without user accounts and logging in?
I'm creating a subscription-based desktop application, but there is no authentication on the platform as the "user" is the computer upon which the application is installed. This means no ...
- 11
1
vote
1
answer
228
views
Is braintree clientToken supposed to be public?
I'm building an app that uses Braintree for processing payments. According to the documentation, I need a server-side endpoint that returns the clientToken, which is then used to manage a user's vault ...
- 11
0
votes
1
answer
996
views
Why some payment methods allow being embedded in an iframe and some don't?
Let's take some examples:
Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame
Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame
...
- 163
0
votes
1
answer
91
views
Visa Secure / TAN App showing wrong amount charged [closed]
So, the other day I was charging my prepaid VoIP account from sipgate.de via credit card payment. I chose 10 Eur which is the default and entered my card details.
As usual, I was redirected to a ...
- 148
0
votes
1
answer
144
views
Is it okay that a payment app is sending my payment details via a GET request? [duplicate]
I was trying to use a state-owned mobile payment app to conduct some transaction on the internet and, thanks to an error message, I found out that my card number and the amount I'm paying were sent ...
- 245
2
votes
1
answer
262
views
Credit card form : Is it neccessary to obscure error messages?
I'm working on designing a credit card payment form whose core functionality is provided by a payment processing company ("upstream").
Upon some transaction errors the upstream returns the ...
0
votes
1
answer
94
views
Question about the cause of the differences in Google Pay features
If you are logged in with your Google account and click "Manage your Google Account," you can then edit your payment profile. But you cannot (1) see the complete card number except for the ...
- 111
1
vote
1
answer
333
views
Web developer needs customer's private key
As a non security expert, I'm looking for advice from those who are.
I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
user240753
2
votes
3
answers
687
views
How to secure a price passed to a payment gateway on client?
Using Javascript, say a customer buy a product that cost 10$.
Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), ...
- 123
0
votes
0
answers
89
views
Adding paygate buttons to HTTP-only website?
Let's say that I have a website where I want to sell homemade goods. I want customers to be able to pay for the goods without too much hassle.
A common option is to use buttons provided by a payment ...
- 101
1
vote
1
answer
90
views
Autofilling sensitive information for publicly available form
We are in the process of designing an app which, simply put, will allow people to accept payments easily.
The customer won't need an account and we'll be linking customer data (name, address, and ...
- 227
2
votes
2
answers
184
views
Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?
We have a mobile app (React and Expo) in which the user is able to provide payment via Stripe. Our implementation uses a WebView which renders HTML and JavaScript content, which in turn pulls in the ...
- 123
-2
votes
1
answer
141
views
Which payment website is better in security [closed]
I test two websites on ssllabs, which one is better for secure payment:
https://www.ssllabs.com/ssltest/analyze.html?d=senpay.vn
https://www.ssllabs.com/ssltest/analyze.html?d=alepay.vn
-2
votes
1
answer
133
views
Security without Login
I am working on a web-app where user can access his purchased item using two word/Number combination and then user add card details on same page for the payment of those item.
Point to be noted
...
0
votes
2
answers
136
views
In page Payment script security needs [closed]
Currently, I'm working in a Fintech StartUp. We have already implemented our payment solution with redirect in a checkout page hosted in our domain (like https://stripe.com/docs/payments/checkout).
...
- 101
1
vote
1
answer
135
views
Business located in USA does it need to be PCI and SCA compliant?
The business is located in the US. But:
Has European customers who put a transaction via a custom-built
shopping cart Sells via tradeshow in Europe or Asia in person Could
Customers send credit cards ...
- 113
1
vote
2
answers
219
views
EMV Transactions vs Magnetic Stripe [closed]
In Mag stripe transactions, I've worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways ...
- 113
1
vote
0
answers
139
views
What information about me do online stores get via my credit card? [duplicate]
I found the exact same question about physical stores:
What information about me do stores get via my credit card?
Though I am interested in online stores! Are there big difference between PHYSICAL ...
- 11
1
vote
1
answer
286
views
PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]
I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store.
I have trouble figuring out if it is possible to do all that and to be PCI ...
- 11
0
votes
0
answers
520
views
MPGS (Mastercard) Integration Security
According to MPGS integration guide, if merchant wants to display receipt when payment completed successfully, MPGS will redirect to merchant site callback URL with the resultIndicator. Merchant site ...
- 3
30
votes
4
answers
31k
views
Bypass with wrong cvv of debit card and getting OTP
This is happening in Visa/MasterCard/American Express, etc. I tried checking in many payment apps and payment gateways that if I enter the correct debit card number, name, valid date, and wrong CVV ...
1
vote
0
answers
200
views
Payment gateway API authentication
I've been tasked with building an API that interacts with a couple of payment gateways to create payments.
The API has accounts with multiple users and the accounts have payments associated with them....
- 11
0
votes
1
answer
251
views
Online payment integration requires handling my bank credentials. Why?
When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website?
The context of my ...
- 105
1
vote
1
answer
198
views
PCI compliance dilemma
I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate.
We outsource the payment management and card storage to a ...
- 113
1
vote
1
answer
375
views
Security implications of exposing payment gateway secret API key
Introduction
In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow:
POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL.
...
- 113
0
votes
1
answer
205
views
Is PCI - DSS required to store only card number
We need to save the credit card number in our database , but not the cvv.
Should we be PCI - DSS compliant for this or some security measures is enough.
After the save we will use that to call stripe ...
- 103
3
votes
1
answer
875
views
When credit card tokens are leaked / stolen, what can the attacker do with them? [closed]
I'm implementing an online payment system relying on an external payment processor handling all credit card entry. My payment processor supports recurring payments via "credit card tokens". We only ...
- 133
3
votes
2
answers
1k
views
When paying by card on a website, will fake payment information make the order fail?
When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date)...
- 133
0
votes
1
answer
605
views
Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?
I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
6
votes
1
answer
610
views
Find Security Flaws in My Payment Page
I've done some extensive research about how to secure your website from card fraud.
iFrames do a pretty good job of this, however, It can still be worked around from certain exploits.
Many payment ...
1
vote
2
answers
612
views
E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout
I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
- 111
1
vote
1
answer
259
views
Hosted Payment Page - Security perspective implementation
We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point.
Am worried the about the data which we might expose in the return ...
- 113
4
votes
1
answer
109
views
When to complete PCI DSS Compliance Paperwork
I am working for a startup that will soon begin processing payments with Stripe.
Looking at their documentation, it seems we will have to file an SAQ A, SAQ A-EP, or an SAQ D depending on our ...
- 143
0
votes
2
answers
476
views
How to handle credit card information on my server [closed]
My company wants to start a subscription based website and I'm implementing it with a payment gateway.
The problem is, this payment gateway doesn't give me any tools to encrypt the client's credit ...
- 103
1
vote
1
answer
428
views
How could criminals use stolen EMV credit cards in 2011?
I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory ...
- 5,386
0
votes
3
answers
601
views
What does the message mean and is it not safe to pay online at this website?
The issue occurs on Opera 45.0.2552.812 Stable Linux 64-bit with browser identification
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/58.0.3029.81 Safari/537.36 ...
- 101
0
votes
1
answer
2k
views
PCI Compliance with scanned checks? [closed]
Client want's to store scanned checks on his publicly accessible server that is NOT PCI compliant.
I told him it's a bad idea.
I need to present him with the laws / FTC guidelines / government ...
- 864
8
votes
4
answers
3k
views
Is it secure to login to your online banking through a third party?
In South Africa there's this payment method called SiD which may be used to pay for things like flights. SiD is an assisted method where you fill in a third party form with your internet banking login ...
user55890
1
vote
0
answers
114
views
Why Russian/non-USA online firms never take a credit card directly?
I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
- 1,914
0
votes
1
answer
194
views
Can hackers steal money from my PayPal if a web shop is compromised?
Say if I were to purchase something on somewebsite.com using PayPal. If somewebsite.com was compromised, what are the chances of my PayPal account being hacked compared to before the breach?
- 1,187
1
vote
2
answers
20k
views
Passing an invalid CVV creates a successful transaction
I built a shop and integrated a card payment system. On the checkout page, we have:
The card number
Expiration date
CVV
If I use an invalid expiration date, the payment fails, as expected. But if ...
- 833
4
votes
2
answers
911
views
Are client-side-only apps regulated by PCI?
Consider a client-side-only application. It may allow a user to make a payment by redirecting them to payment gateway website, where they enter the credit card details. If I understand correctly, in ...
- 141
2
votes
2
answers
198
views
PCI DSS Compliance for Client
I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card ...
- 121
1
vote
1
answer
119
views
Hosted checkout page - who holds liability if there is fraud case?
We are planning to use the hosted checkout page - does it minimize our liability and security measures? In the event of hacking of our website or poor security of the website, does it affect the ...
- 11
2
votes
1
answer
259
views
Are retail POSs still storing credit card info?
A couple of years ago my bank sent me a new debit card and deactivated my old one unexpectedly. I suspect this was because of the Home Depot hack in which the details of some 56 million credit cards ...
- 1,146
3
votes
3
answers
1k
views
Credit Card Tokenization and multiple parties
Business B accepts the credit card information under SAQ-A-EP guidelines and gets the token T back from the payment services provider P. The token now needs to be sent (by B) to partners P1 or P2 or ...
- 143
1
vote
0
answers
713
views
Are AliPay password rules making it easier to guess a password? [duplicate]
I recently went to change my password at AliPay, and found out that there are a few restrictions on the password:
It can only be digits
It must be six digits
It can not consist of consecutive digits (...
- 233