Questions tagged [payment-gateway]

A payment gateway is an e-commerce application service provider service that authorizes credit card payments.

Filter by
Sorted by
Tagged with
-2
votes
1answer
86 views

Which payment website is better in security [closed]

I test two websites on ssllabs, which one is better for secure payment: https://www.ssllabs.com/ssltest/analyze.html?d=senpay.vn https://www.ssllabs.com/ssltest/analyze.html?d=alepay.vn
-2
votes
1answer
92 views

Security without Login

I am working on a web-app where user can access his purchased item using two word/Number combination and then user add card details on same page for the payment of those item. Point to be noted ...
0
votes
2answers
83 views

In page Payment script security needs [closed]

Currently, I'm working in a Fintech StartUp. We have already implemented our payment solution with redirect in a checkout page hosted in our domain (like https://stripe.com/docs/payments/checkout). ...
1
vote
1answer
83 views

Business located in USA does it need to be PCI and SCA compliant?

The business is located in the US. But: Has European customers who put a transaction via a custom-built shopping cart Sells via tradeshow in Europe or Asia in person Could Customers send credit cards ...
1
vote
2answers
125 views

EMV Transactions vs Magnetic Stripe [closed]

In Mag stripe transactions, I've worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways ...
1
vote
0answers
74 views

What information about me do online stores get via my credit card? [duplicate]

I found the exact same question about physical stores: What information about me do stores get via my credit card? Though I am interested in online stores! Are there big difference between PHYSICAL ...
1
vote
1answer
89 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
0
votes
0answers
161 views

MPGS (Mastercard) Integration Security

According to MPGS integration guide, if merchant wants to display receipt when payment completed successfully, MPGS will redirect to merchant site callback URL with the resultIndicator. Merchant site ...
30
votes
4answers
11k views

Bypass with wrong cvv of debit card and getting OTP

This is happening in Visa/MasterCard/American Express, etc. I tried checking in many payment apps and payment gateways that if I enter the correct debit card number, name, valid date, and wrong CVV ...
1
vote
0answers
76 views

Payment gateway API authentication

I've been tasked with building an API that interacts with a couple of payment gateways to create payments. The API has accounts with multiple users and the accounts have payments associated with them....
0
votes
1answer
95 views

Online payment integration requires handling my bank credentials. Why?

When doing a payment integration what would be the reasons the payment gateway would require your bank credentials instead of redirecting the client to his or her bank website? The context of my ...
1
vote
1answer
97 views

PCI compliance dilemma

I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate. We outsource the payment management and card storage to a ...
1
vote
1answer
111 views

Security implications of exposing payment gateway secret API key

Introduction In payment gateways such as Coinbase or G2A Pay, the typical payment flow goes as follow: POST to the gateway with the secret API key and metadata (price etc) to generate a payment URL. ...
0
votes
1answer
62 views

Is PCI - DSS required to store only card number

We need to save the credit card number in our database , but not the cvv. Should we be PCI - DSS compliant for this or some security measures is enough. After the save we will use that to call stripe ...
3
votes
1answer
266 views

When credit card tokens are leaked / stolen, what can the attacker do with them? [closed]

I'm implementing an online payment system relying on an external payment processor handling all credit card entry. My payment processor supports recurring payments via "credit card tokens". We only ...
3
votes
2answers
345 views

When paying by card on a website, will fake payment information make the order fail?

When ordering online websites often redirect to a payment service like 2Checkout (see image below). On their page I must specify my personal information (like name, address, city, sometimes birth date)...
0
votes
1answer
121 views

Only using TLS 1.1 or 1.2 is enough for PCI DSS compliance on transmission of cardholder data (point 4)?

I've read the description provideed on PCI DSS 3.2.1 for requierement 4, and I'm having a hard time understanding if it's required to have additional encryption on top of TLS 1.1 / 1.2 using a secure ...
6
votes
1answer
482 views

Find Security Flaws in My Payment Page

I've done some extensive research about how to secure your website from card fraud. iFrames do a pretty good job of this, however, It can still be worked around from certain exploits. Many payment ...
1
vote
2answers
131 views

E-commerce website that uses plaintext HTTP but redirects to PayPal during checkout

I need to purchase a few items (t-shirts, dvds, etc.) on an old e-commerce website that hasn't been updated in a while and doesn't use HTTPS to encrypt data in transit. The website does not have any ...
1
vote
1answer
146 views

Hosted Payment Page - Security perspective implementation

We are implementing a .NET MVC application and planning to use a Hosted Payment Page for Secure Payments and from PCI Stand point. Am worried the about the data which we might expose in the return ...
4
votes
1answer
67 views

When to complete PCI DSS Compliance Paperwork

I am working for a startup that will soon begin processing payments with Stripe. Looking at their documentation, it seems we will have to file an SAQ A, SAQ A-EP, or an SAQ D depending on our ...
0
votes
2answers
130 views

How to handle credit card information on my server [closed]

My company wants to start a subscription based website and I'm implementing it with a payment gateway. The problem is, this payment gateway doesn't give me any tools to encrypt the client's credit ...
1
vote
1answer
250 views

How could criminals use stolen EMV credit cards in 2011?

I would like to recall a fraud happened in France in 2011 for which a paper was published (also linked from Ars). I came onto this by following debate on EMV card security and its mandatory ...
0
votes
3answers
214 views

What does the message mean and is it not safe to pay online at this website?

The issue occurs on Opera 45.0.2552.812 Stable Linux 64-bit with browser identification Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 ...
0
votes
1answer
692 views

PCI Compliance with scanned checks? [closed]

Client want's to store scanned checks on his publicly accessible server that is NOT PCI compliant. I told him it's a bad idea. I need to present him with the laws / FTC guidelines / government ...
8
votes
4answers
3k views

Is it secure to login to your online banking through a third party?

In South Africa there's this payment method called SiD which may be used to pay for things like flights. SiD is an assisted method where you fill in a third party form with your internet banking login ...
1
vote
0answers
76 views

Why Russian/non-USA online firms never take a credit card directly?

I've noticed it back some ten years ago, and, apparently, it's still the case today -- most online retailers in the US directly procure the information about your credit card, whereas in Russia, ...
0
votes
1answer
132 views

Can hackers steal money from my PayPal if a web shop is compromised?

Say if I were to purchase something on somewebsite.com using PayPal. If somewebsite.com was compromised, what are the chances of my PayPal account being hacked compared to before the breach?
1
vote
2answers
8k views

Passing an invalid CVV creates a successful transaction

I built a shop and integrated a card payment system. On the checkout page, we have: The card number Expiration date CVV If I use an invalid expiration date, the payment fails, as expected. But if ...
3
votes
2answers
591 views

Are client-side-only apps regulated by PCI?

Consider a client-side-only application. It may allow a user to make a payment by redirecting them to payment gateway website, where they enter the credit card details. If I understand correctly, in ...
2
votes
2answers
135 views

PCI DSS Compliance for Client

I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card ...
1
vote
1answer
63 views

Hosted checkout page - who holds liability if there is fraud case?

We are planning to use the hosted checkout page - does it minimize our liability and security measures? In the event of hacking of our website or poor security of the website, does it affect the ...
2
votes
1answer
205 views

Are retail POSs still storing credit card info?

A couple of years ago my bank sent me a new debit card and deactivated my old one unexpectedly. I suspect this was because of the Home Depot hack in which the details of some 56 million credit cards ...
3
votes
3answers
733 views

Credit Card Tokenization and multiple parties

Business B accepts the credit card information under SAQ-A-EP guidelines and gets the token T back from the payment services provider P. The token now needs to be sent (by B) to partners P1 or P2 or ...
1
vote
0answers
445 views

Are AliPay password rules making it easier to guess a password? [duplicate]

I recently went to change my password at AliPay, and found out that there are a few restrictions on the password: It can only be digits It must be six digits It can not consist of consecutive digits (...
0
votes
1answer
84 views

PCI - PA DSS - QIR

I have a PA-DSS Certified program. Do I need to be QIR Certified to remain PA-DSS Compliant? https://www.pcisecuritystandards.org/program_training_and_qualification/...
0
votes
1answer
139 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
0
votes
1answer
57 views

How to export application metrics out of PCI environment

I am building a credit card tokenization/payment-processing service. As these services need sit in pci-compliant environment, I find it hard to export the application metrics & logs. Anyone knows ...
0
votes
1answer
274 views

Integration with CCAvenue payment gateway

I am integrating payment gateway provide by CCAvenue india. I heard about PCI compliance and other certifications. My question is there any certification or any thing that we as a developer need to ...
1
vote
2answers
88 views

PA-DSS & DTMF application

If the payment application is not storing any credit card information, does it needs to be PA-DSS? The application takes the Credit card information using DTMF and pass-through via secure XML for ...
7
votes
4answers
1k views

How to not store the card during 3D Secure authentication, to be PCI DSS compliant?

I'm implementing a payment solution where the cardholder enters his card details on our own website. We need to use 3D Secure for extra authentication of the cardholder. Our payment gateway ...
1
vote
2answers
370 views

How is generating payment Tokens secure in Mobile development?

I'm using Stripe for in app payments in my mobile app project and I don't quite understand how any app is secure if the user inputs there card info (with or without stripe) if it's not over HTTPS the ...
2
votes
2answers
494 views

How does Stripe Checkout prevent phishing attacks?

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and ...
4
votes
2answers
723 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
6
votes
3answers
3k views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To "...
0
votes
1answer
61 views

How can a customer authenticate EPOS device and make sure it's not fake?

In the scenario where customers use magnetic stripe payment cards and are paying via EPOS, a merchant can put a fake EPOS on the table that looks identical to real ones, the customer uses his card on ...
4
votes
1answer
471 views

Is it ok from the viewpoint of PCI DSS to send credit card info to my own server which then directly sends it to PayPal?

Currently I'm developing an iOS application which has an option to pay an order (clothes cleaning) via scanning credit card info using device camera. I can't use Apple In-App Purchases (IAP) for this, ...
70
votes
5answers
5k views

Strange Payment Gateway

I have a freelance client that wants me to integrate a payment gateway into their Woocommerce site but I am being increasingly concerned about their choice of provider and the project as a whole. The ...
1
vote
1answer
2k views

Multiple Bank Accounts on one payment gateway or merchant account

I'm looking to use PCI compliant payment gateways such as Authorize.net or Spreedly.com in my website. However in my particular case (hotel, tour, events reservations), we will serve as an ...
3
votes
2answers
191 views

Is there any reason for using private key 2 times when creating security hash?

One of the payment solutions for the websites provides the following way of creating security hash for payment link: hash = sha1(private_key + payment_params_json + private_key); Is there any ...