Questions tagged [payment-gateway]

A payment gateway is an e-commerce application service provider service that authorizes credit card payments.

Filter by
Sorted by
Tagged with
3
votes
1answer
105 views

Credit card form : Is it neccessary to obscure error messages?

I'm working on designing a credit card payment form whose core functionality is provided by a payment processing company ("upstream"). Upon some transaction errors the upstream returns the ...
0
votes
1answer
47 views

Question about the cause of the differences in Google Pay features

If you are logged in with your Google account and click "Manage your Google Account," you can then edit your payment profile. But you cannot (1) see the complete card number except for the ...
1
vote
1answer
107 views

Web developer needs customer's private key

As a non security expert, I'm looking for advice from those who are. I work with company X who have hired company Y to develop their website. Company Y needs to integrate server-side online payment ...
2
votes
3answers
102 views

How to secure a price passed to a payment gateway on client?

Using Javascript, say a customer buy a product that cost 10$. Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), ...
0
votes
0answers
38 views

Adding paygate buttons to HTTP-only website?

Let's say that I have a website where I want to sell homemade goods. I want customers to be able to pay for the goods without too much hassle. A common option is to use buttons provided by a payment ...
1
vote
1answer
42 views

Autofilling sensitive information for publicly available form

We are in the process of designing an app which, simply put, will allow people to accept payments easily. The customer won't need an account and we'll be linking customer data (name, address, and ...
2
votes
2answers
80 views

Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?

We have a mobile app (React and Expo) in which the user is able to provide payment via Stripe. Our implementation uses a WebView which renders HTML and JavaScript content, which in turn pulls in the ...
-2
votes
1answer
95 views

Which payment website is better in security [closed]

I test two websites on ssllabs, which one is better for secure payment: https://www.ssllabs.com/ssltest/analyze.html?d=senpay.vn https://www.ssllabs.com/ssltest/analyze.html?d=alepay.vn
-2
votes
1answer
92 views

Security without Login

I am working on a web-app where user can access his purchased item using two word/Number combination and then user add card details on same page for the payment of those item. Point to be noted ...
0
votes
2answers
88 views

In page Payment script security needs [closed]

Currently, I'm working in a Fintech StartUp. We have already implemented our payment solution with redirect in a checkout page hosted in our domain (like https://stripe.com/docs/payments/checkout). ...
1
vote
1answer
88 views

Business located in USA does it need to be PCI and SCA compliant?

The business is located in the US. But: Has European customers who put a transaction via a custom-built shopping cart Sells via tradeshow in Europe or Asia in person Could Customers send credit cards ...
1
vote
2answers
139 views

EMV Transactions vs Magnetic Stripe [closed]

In Mag stripe transactions, I've worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways ...
1
vote
0answers
80 views

What information about me do online stores get via my credit card? [duplicate]

I found the exact same question about physical stores: What information about me do stores get via my credit card? Though I am interested in online stores! Are there big difference between PHYSICAL ...
1
vote
1answer
139 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
0
votes
0answers
285 views

MPGS (Mastercard) Integration Security

According to MPGS integration guide, if merchant wants to display receipt when payment completed successfully, MPGS will redirect to merchant site callback URL with the resultIndicator. Merchant site ...
30
votes
4answers
21k views

Bypass with wrong cvv of debit card and getting OTP

This is happening in Visa/MasterCard/American Express, etc. I tried checking in many payment apps and payment gateways that if I enter the correct debit card number, name, valid date, and wrong CVV ...
1
vote
0answers
106 views

Payment gateway API authentication

I've been tasked with building an API that interacts with a couple of payment gateways to create payments. The API has accounts with multiple users and the accounts have payments associated with them....
0
votes
1answer
129 views

Online payment integration requires handling my bank credentials. Why?

When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website? The context of my ...
1
vote
1answer
108 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
1
vote
1answer
185 views

Security implications of exposing payment gateway secret API key

Introduction In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow: POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL. ...
0
votes
1answer
68 views

Is PCI - DSS required to store only card number

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe ...
3
votes
1answer
378 views

When credit card tokens are leaked / stolen, what can the attacker do with them? [closed]

I'm implementing an online payment system relying on an external payment processor handling all credit card entry. My payment processor supports recurring payments via "credit card tokens". We only ...
3
votes
2answers
716 views

When paying by card on a website, will fake payment information make the order fail?

When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date)...
0
votes
1answer
303 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
6
votes
1answer
503 views

Find Security Flaws in My Payment Page

I've done some extensive research about how to secure your website from card fraud. iFrames do a pretty good job of this, however, It can still be worked around from certain exploits. Many payment ...
1
vote
2answers
197 views

E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout

I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
1
vote
1answer
161 views

Hosted Payment Page - Security perspective implementation

We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point. Am worried the about the data which we might expose in the return ...
4
votes
1answer
69 views

When to complete PCI DSS Compliance Paperwork

I am working for a startup that will soon begin processing payments with Stripe. Looking at their documentation, it seems we will have to file an SAQ A, SAQ A-EP, or an SAQ D depending on our ...
0
votes
2answers
220 views

How to handle credit card information on my server [closed]

My company wants to start a subscription based website and I'm implementing it with a payment gateway. The problem is, this payment gateway doesn't give me any tools to encrypt the client's credit ...
1
vote
1answer
279 views

How could criminals use stolen EMV credit cards in 2011?

I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory ...
0
votes
3answers
284 views

What does the message mean and is it not safe to pay online at this website?

The issue occurs on Opera 45.0.2552.812 Stable Linux 64-bit with browser identification Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 ...
0
votes
1answer
1k views

PCI Compliance with scanned checks? [closed]

Client want's to store scanned checks on his publicly accessible server that is NOT PCI compliant. I told him it's a bad idea. I need to present him with the laws / FTC guidelines / government ...
8
votes
4answers
3k views

Is it secure to login to your online banking through a third party?

In South Africa there's this payment method called SiD which may be used to pay for things like flights. SiD is an assisted method where you fill in a third party form with your internet banking login ...
1
vote
0answers
77 views

Why Russian/non-USA online firms never take a credit card directly?

I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
1
vote
1answer
135 views

Can hackers steal money from my PayPal if a web shop is compromised?

Say if I were to purchase something on somewebsite.com using PayPal. If somewebsite.com was compromised, what are the chances of my PayPal account being hacked compared to before the breach?
1
vote
2answers
13k views

Passing an invalid CVV creates a successful transaction

I built a shop and integrated a card payment system. On the checkout page, we have: The card number Expiration date CVV If I use an invalid expiration date, the payment fails, as expected. But if ...
4
votes
2answers
665 views

Are client-side-only apps regulated by PCI?

Consider a client-side-only application. It may allow a user to make a payment by redirecting them to payment gateway website, where they enter the credit card details. If I understand correctly, in ...
2
votes
2answers
141 views

PCI DSS Compliance for Client

I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card ...
1
vote
1answer
66 views

Hosted checkout page - who holds liability if there is fraud case?

We are planning to use the hosted checkout page - does it minimize our liability and security measures? In the event of hacking of our website or poor security of the website, does it affect the ...
2
votes
1answer
207 views

Are retail POSs still storing credit card info?

A couple of years ago my bank sent me a new debit card and deactivated my old one unexpectedly. I suspect this was because of the Home Depot hack in which the details of some 56 million credit cards ...
3
votes
3answers
830 views

Credit Card Tokenization and multiple parties

Business B accepts the credit card information under SAQ-A-EP guidelines and gets the token T back from the payment services provider P. The token now needs to be sent (by B) to partners P1 or P2 or ...
1
vote
0answers
589 views

Are AliPay password rules making it easier to guess a password? [duplicate]

I recently went to change my password at AliPay, and found out that there are a few restrictions on the password: It can only be digits It must be six digits It can not consist of consecutive digits (...
0
votes
1answer
88 views

PCI - PA DSS - QIR

I have a PA-DSS Certified program. Do I need to be QIR Certified to remain PA-DSS Compliant? https://www.pcisecuritystandards.org/program_training_and_qualification/...
0
votes
1answer
141 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
0
votes
1answer
57 views

How to export application metrics out of PCI environment

I am building a credit card tokenization/payment-processing service. As these services need sit in pci-compliant environment, I find it hard to export the application metrics & logs. Anyone knows ...
0
votes
1answer
281 views

Integration with CCAvenue payment gateway

I am integrating payment gateway provide by CCAvenue india. I heard about PCI compliance and other certifications. My question is there any certification or any thing that we as a developer need to ...
1
vote
2answers
89 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
7
votes
4answers
1k views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
1
vote
2answers
388 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
2
votes
2answers
533 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...