228

You can't clone the chip. A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards. A chip also holds a secret number. ...


186

Alexander O'Mara provided a correct answer, but having worked in a hotel that was using booking.com I believe I can provide additional information about the reason that CVV was denied. Every day the hotel I worked in would receive around 50 bookings, a quarter of these bookings would be using fake credit card details, and about 90% of people using fake ...


148

The only weak argument I can think of to reject such a CVV would be that if someone were trying to brute-force your 3-digit code, they might start with 000 first (but would they also reject 001?). From practical point of view, how reasonable it is to decline "000" as insecure? It's not really reasonable. Either you can charge the card with the provided ...


130

Many low level crimes are ones of opportunity, not planned out attacks. By separating the two needed pieces of mail in time, it forces the attacker to intercept the same person's mail more than once. This prevents a mail thief from simply walking up to homes and looking for credit cards and activating them all in one step. Now suddenly the thief has to ...


117

That code isn't necessary. This may cause more fraud and more chargebacks, but Amazon keeps those numbers low so that they can offer a faster shopping experience such as one-click. The only thing necessary to make a purchase is the card number and, in all but rare cases, expiration date, whether in number form or magnetic. Most systems require more ...


112

No, it's not dangerous at all. Your browser is warning you because a non-Paypal website has Paypal in its name. This is a common technique used by phishing sites that attempt to fool you into thinking the site is official. For example, a website might be called paypal.secure1234.com and made to look like the official site, enticing you to trust it and input ...


106

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked: From an official 2008 PDF: PCI Data Storage Do’s and Don’ts: Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. ...


106

PCI DSS The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform to a set of security practices and (usually) audit requirements, or (b) stop handling payment card data themselves and delegate it to someone who can handle ...


93

This is a frame challenge of the company's claims. A random number in the range 000-999 is more secure than 001-998, rejecting values weakens it. It's a software bug. They can't admit it. Just one example: say, somewhere in the stack, they use a language with untyped variables (i.e. Where the same variable can hold 123.45, "late for dinner", a 0-...


82

There are a couple reasons why Paypal (or more generally, any payment service) can know if you've used your card in more than one place. Your credit card is absolutely tracked everywhere possible Shouldn't my credit card be stored with a hash under my account only? If your card is kept hashed then it can be easily compared across accounts. Hashes are ...


71

Checksums CC numbers, as well as pretty much any other well designed important numbers (e.g. account numbers in banks) tend to include a checksum to verify integrity of the number. While not a security feature (since it's trivial to calculate), a decent checksum algorithm can guarantee to always fail if (a) a single typo was made or (b) two neighbouring ...


70

The chip carries out a cryptographic operation on data passed to it that requires knowledge of the key that is strongly protected within the chip - so an attacker cannot easily copy the card. That said, there have been some successful research papers on timing or power attacks, but these are from lab conditions, and probably not a real worry in the wild. ...


70

Is there any evidence that this actually leads to a significant reduction in successful credit card fraud? Yes there is evidence, and Yes, it absolutely has resulted in reducing many types of card fraud: The fraud prevention feature you are referring to is called Address Verification Service (AVS). AVS service checks that the street number and/or the zip ...


65

If you deface a credit card, you are likely to find it will be rejected for all transactions. The merchant really needs all the info on the card to be valid - it's part of how they protect themselves from fraud. So my answer would be: none! Instead of worrying about that, concern yourself more with how the merchants handle your card. In the UK, for example,...


63

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full primary account number, not the truncated 4 digit number. If you are storing, processing, or transmitting cardholder data then you must meet all of the other PCI ...


61

Most likely answer: They don't have to (it's not a PCI requirement) It's better from a UI/support standpoint Let's keep this in perspective. This is the number that's printed, on the back of the card, right where minimum-wage cashiers are instructed to visually inspect when performing a POS transaction. Absolute secrecy from physical bystanders is ...


58

The liability for a disputed transaction falls upon the merchant for Card-Not-Present transactions. Essentially, if you dispute a transaction, if the merchant doesn't have your signature, then if you persist they will end up footing the bill. By the same token, when a CNP merchant double bills you, they're going to end up paying when you dispute the bill. ...


58

From the card itself, the Merchant gets the track data, which includes card number, expiration date, and cardholder name. If the Merchant requires zip code verification, they'll get your zip code, obviously. (Card-Not-Present Merchants often get address data for billing/shipping purposes, but you asked about physical stores... and they get that from the ...


57

Amazon pays a slightly higher rate to accept your payment without the CVV, but the CVV is not strictly required to present a transaction - everybody uses CVV because they get a lower rate if it is present (less risk, less cost). Nobody who knows what they are doing will store your CVV - if the card networks suspect that you are storing CVV, you will have ...


57

(Note: Not a PCI QSA, just know some PCI and PII stuff) Violating the Payment Card Industry Data Security Standard is not a violation of the law. The PCI DSS is an agreement between the payment card companies (VISA, etc) and the processors about how data will be secured. The towing company is likely in breach of an agreement with their processor by doing ...


57

This is a typical false positive. Since Firefox is using Google safe browsing API, it will show similar warning as in Chrome browser. Since some antivirus also use the API, it will be warned by those antivirus as well. Here is the Google safe browsing transparency report. Somebody needs to file an incorrect phishing warning to google to remove the ...


56

It's obviously base64 encoded. If someone steals your database, he can just decode the data and have all credit card from every customer. You could just store as string and have basically the same security, as you are only using more bytes to achieve the same. To store credit card data, you must be compliant with PCI rules. And PCI explicitly forbids ...


51

I put a small sticker over the CVV to avoid it being casually seen. The CVV is the three-digit code on the back of the card beside the signature, needed when you buy things on the Internet but not otherwise. A merchant who takes your card and checks the signature can easily remember the three digits, and I think this was what happened the one time my credit ...


50

Any Faraday cage will do the trick. So a shielding of just about anything conductive, be it aluminum foil, conductive paint, wire mesh, or any of a number of similar alternatives is going to be opaque to radiation. That means no radio waves in or out, which means the RFID signal is blocked. Note that the size of the mesh has to be significantly smaller than ...


50

Credit card numbers can verified by calculating a checksum. Every credit card number created is assigned a number following an algorithm. Ross Millikan: The checksum specifies the last digit, so there are 15 digits left. That should mean there are 10^15 numbers available, but there are other restrictions. The first digit is the card type (4=Visa, ...


48

Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back. There is a lot of articles about this online. If you knowingly ignore the issue you might be liable for any future damages by fraudulent credit card charges.


47

Don't report this as fraud; that will kick off an investigation that will ultimately conclude you did authorize the transaction. Waste of time all around. Call the card company, tell them you made a purchase on a site that is not at all PCI-compliant, is "likely fraudulent" and your card information is now assumed compromised. Go through the hoops to get a ...


44

I just read my bank's page on 3D security. It says: If the site supports payments to be made in additional security, you will see the logos of the respective card organization Verified by Visa or MasterCard SecureCode So apparently it's up to the site to require or not require my 3D password.


44

Security measures like "3D password", CVV, etc. do not exist to protect you the cardholder. Do not assume that someone who lacks them can't use your card number fraudulently. All they do is allow a merchant who chooses to use them as part of their card processing merchant agreement to obtain a lower transaction fee, on the basis that the feature reduce the ...


42

Deriving the issuer's encryption key using a collection of credit-card numbers with their respective security codes would be an example of a known-plaintext attack (KPA). To be considered secure, a cipher has to be resistant to known-plaintext attacks, i.e. cracking the encryption even with a large number of plaintext-ciphertext pairs should not be ...


Only top voted, non community-wiki answers of a minimum length are eligible