Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [payment-gateway]

A payment gateway is an e-commerce application service provider service that authorizes credit card payments.

1
vote
1answer
72 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
1
vote
1answer
45 views

Security implications of exposing payment gateway secret API key

Introduction In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow: POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL. ...
0
votes
1answer
38 views

Is PCI - DSS required to store only card number

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe ...
3
votes
2answers
164 views

When paying by card on a website, will fake payment information make the order fail?

When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date)...
0
votes
1answer
35 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
0
votes
0answers
29 views

Security risks to embedding payment web page in Android app

I am very new to Android app development and I started out with the idea of fixing a small defect in an app. However, I got sucked further in and found that a payment processing company that we use ...
0
votes
0answers
129 views

Encrypt HTML form fields before submitting over HTTPS

A certain payment gateway that I use allows two methods of integration: A hosted payment form, which you add to your website with an iframe. An API endpoint to send the payment details to using HTTPS ...
6
votes
1answer
448 views

Find Security Flaws in My Payment Page

I've done some extensive research about how to secure your website from card fraud. iFrames do a pretty good job of this, however, It can still be worked around from certain exploits. Many payment ...
1
vote
2answers
102 views

E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout

I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
1
vote
1answer
96 views

Hosted Payment Page - Security perspective implementation

We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point. Am worried the about the data which we might expose in the return ...
4
votes
1answer
65 views

When to complete PCI DSS Compliance Paperwork

I am working for a startup that will soon begin processing payments with Stripe. Looking at their documentation, it seems we will have to file an SAQ A, SAQ A-EP, or an SAQ D depending on our ...
0
votes
2answers
92 views

How to handle credit card information on my server [closed]

My company wants to start a subscription based website and I'm implementing it with a payment gateway. The problem is, this payment gateway doesn't give me any tools to encrypt the client's credit ...
1
vote
1answer
199 views

How could criminals use stolen EMV credit cards in 2011?

I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory ...
0
votes
3answers
146 views

What does the message mean and is it not safe to pay online at this website?

The issue occurs on Opera 45.0.2552.812 Stable Linux 64-bit with browser identification Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 ...
0
votes
1answer
305 views

PCI Compliance with scanned checks? [closed]

Client want's to store scanned checks on his publicly accessible server that is NOT PCI compliant. I told him it's a bad idea. I need to present him with the laws / FTC guidelines / government ...
8
votes
4answers
2k views

Is it secure to login to your online banking through a third party?

In South Africa there's this payment method called SiD which may be used to pay for things like flights. SiD is an assisted method where you fill in a third party form with your internet banking login ...
1
vote
0answers
70 views

Why Russian/non-USA online firms never take a credit card directly?

I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
0
votes
1answer
99 views

Can hackers steal money from my PayPal if a web shop is compromised?

Say if I were to purchase something on somewebsite.com using PayPal. If somewebsite.com was compromised, what are the chances of my PayPal account being hacked compared to before the breach?
1
vote
2answers
3k views

Passing an invalid CVV creates a successful transaction

I built a shop and integrated a card payment system. On the checkout page, we have: The card number Expiration date CVV If I use an invalid expiration date, the payment fails, as expected. But if ...
3
votes
2answers
401 views

Are client-side-only apps regulated by PCI?

Consider a client-side-only application. It may allow a user to make a payment by redirecting them to payment gateway website, where they enter the credit card details. If I understand correctly, in ...
2
votes
2answers
118 views

PCI DSS Compliance for Client

I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card ...
1
vote
1answer
61 views

Hosted checkout page - who holds liability if there is fraud case?

We are planning to use the hosted checkout page - does it minimize our liability and security measures? In the event of hacking of our website or poor security of the website, does it affect the ...
2
votes
1answer
196 views

Are retail POSs still storing credit card info?

A couple of years ago my bank sent me a new debit card and deactivated my old one unexpectedly. I suspect this was because of the Home Depot hack in which the details of some 56 million credit cards ...
3
votes
3answers
442 views

Credit Card Tokenization and multiple parties

Business B accepts the credit card information under SAQ-A-EP guidelines and gets the token T back from the payment services provider P. The token now needs to be sent (by B) to partners P1 or P2 or ...
0
votes
0answers
235 views

Are AliPay password rules making it easier to guess a password? [duplicate]

I recently went to change my password at AliPay, and found out that there are a few restrictions on the password: It can only be digits It must be six digits It can not consist of consecutive digits (...
0
votes
1answer
76 views

PCI - PA DSS - QIR

I have a PA-DSS Certified program. Do I need to be QIR Certified to remain PA-DSS Compliant? https://www.pcisecuritystandards.org/program_training_and_qualification/...
0
votes
1answer
135 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
0
votes
1answer
56 views

How to export application metrics out of PCI environment

I am building a credit card tokenization/payment-processing service. As these services need sit in pci-compliant environment, I find it hard to export the application metrics & logs. Anyone knows ...
0
votes
1answer
222 views

Integration with CCAvenue payment gateway

I am integrating payment gateway provide by CCAvenue india. I heard about PCI compliance and other certifications. My question is there any certification or any thing that we as a developer need to ...
1
vote
2answers
85 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
7
votes
4answers
814 views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
1
vote
2answers
311 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
1
vote
2answers
411 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
3
votes
2answers
579 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
6
votes
3answers
3k views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To "...
0
votes
1answer
56 views

How can a customer authenticate EPOS device and make sure it's not fake?

In the scenario where customers use magnetic stripe payment cards and are paying via EPOS, a merchant can put a fake EPOS on the table that looks identical to real ones, the customer uses his card on ...
3
votes
1answer
363 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
70
votes
5answers
5k views

Strange Payment Gateway

I have a freelance client that wants me to integrate a payment gateway into their Woocommerce site but I am being increasingly concerned about their choice of provider and the project as a whole. The ...
1
vote
1answer
2k views

Multiple Bank Accounts on one payment gateway or merchant account

I'm looking to use PCI compliant payment gateways such as Authorize.net or Spreedly.com in my website. However in my particular case (hotel, tour, events reservations), we will serve as an ...
3
votes
2answers
191 views

Is there any reason for using private key 2 times when creating security hash?

One of the payment solutions for the websites provides the following way of creating security hash for payment link: hash = sha1(private_key + payment_params_json + private_key); Is there any ...
14
votes
3answers
2k views

Should I worry if my credit card payment processor's server allows only weak SSL cipher suites?

I tested their server using https://www.ssllabs.com/ssltest/ and, apart from the disappointing "B" rating (it handles financial transactions, after all), the server only allows the following two RC4 ...
1
vote
2answers
28k views

SSL handshake exception: unable to find valid certification path to requested target

We are using a third party payment service for our web users to be able to pay for courses. Once payment is completed however, payu attempts to connect to our site and run an IPN. However, they get ...
1
vote
0answers
137 views

Collecting Pre-Authorized Debit (PAD) & Credit Card (PACC) Agreements Electronically

I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement ...
1
vote
0answers
65 views

Best way to authenticate for Funding balance with API call [closed]

I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API. What would be a good ...
1
vote
3answers
509 views

PCI Compliance Check-list

I'm currently attempting to wrap my head around PCI compliance - and what I need to do for my business to be compliant. I would like some confirmation on what I've found so far. I accept payments in ...
3
votes
1answer
1k views

Is building an NFC payment app without a secure element like Apple Pay fundamentally insecure?

Suppose I work for a bank and am asked to write an NFC payment app for the iPhone 6 or Android but not use Apple Pay. To simply send the credit card details to the reader via NFC. Now assume I'm not ...
3
votes
3answers
4k views

How are HSMs used in payment processing on the server?

I came to know recently that HSMs are used in credit card processing on the server side but since I don't work in that space and stumped as to why its needed. I can see it used in an ATM machine - ...
0
votes
1answer
147 views

Designing and implementing a secure epayments system with RESTful API

I want to design and implement an epayments system (I will not be handling credit card payments). The system will have a RESTful API. I am already familiar with RESTful servies, and have built a few ...
3
votes
2answers
3k views

If am using Stripe am I SAQ A-EP in PCI V3

We are going through the PCI process at the moment and because v2 goes out of date on December 2014, I opted to use PCI v3. Because with Stripe you put the form inside your application and post to ...
1
vote
1answer
699 views

Paypal Vault - Is it really secure?

If the information used to retrieve a card from the Paypal Vault, i.e. "credit_card_id" is stored in a database entry on our server, if a hacker is able to gain access to the server, does it really ...