188 votes
Accepted

All 0s (zeros) in a bank card's CVC code

Alexander O'Mara provided a correct answer, but having worked in a hotel that was using booking.com I believe I can provide additional information about the reason that CVV was denied. Every day the ...
Zoey's user avatar
  • 1,688
162 votes
Accepted

How does Shutterstock keep getting my latest debit card number?

Simply put, Account Updater: When participating issuers re-issue cards, they submit the new account number and expiration date to VAU. Participating merchants send inquiries on their credentials-on-...
gowenfawr's user avatar
  • 72.7k
150 votes

All 0s (zeros) in a bank card's CVC code

The only weak argument I can think of to reject such a CVV would be that if someone were trying to brute-force your 3-digit code, they might start with 000 first (but would they also reject 001?). ...
Alexander O'Mara's user avatar
130 votes
Accepted

Why are my plastic credit card and activation code sent separately?

Many low level crimes are ones of opportunity, not planned out attacks. By separating the two needed pieces of mail in time, it forces the attacker to intercept the same person's mail more than once. ...
Steve Sether's user avatar
  • 21.6k
112 votes

Is this Paypal Github SDK reference really a dangerous site?

No, it's not dangerous at all. Your browser is warning you because a non-Paypal website has Paypal in its name. This is a common technique used by phishing sites that attempt to fool you into thinking ...
forest's user avatar
  • 66.5k
107 votes
Accepted

How many digits of a Visa card number can vendors disclose on receipts?

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked: From an official 2008 PDF: PCI Data Storage Do’s and Don’ts: Never store the personal identification number (PIN)...
Burhan Khalid's user avatar
107 votes
Accepted

Why is credit card information not stolen more often?

PCI DSS The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform ...
Peteris's user avatar
  • 8,429
95 votes

All 0s (zeros) in a bank card's CVC code

This is a frame challenge of the company's claims. A random number in the range 000-999 is more secure than 001-998, rejecting values weakens it. It's a software bug. They can't admit it. Just one ...
Harper - Reinstate Monica's user avatar
81 votes
Accepted

How can Paypal know my card is being used in another account?

There are a couple reasons why Paypal (or more generally, any payment service) can know if you've used your card in more than one place. Your credit card is absolutely tracked everywhere possible ...
Conor Mancone's user avatar
69 votes
Accepted

Has a benefit been demonstrated for credit card machines asking for ZIP code?

Is there any evidence that this actually leads to a significant reduction in successful credit card fraud? Yes there is evidence, and Yes, it absolutely has resulted in reducing many types of card ...
Rodrigo Murillo's user avatar
66 votes
Accepted

Which parts of a credit card can I obfuscate and still have it be valid

If you deface a credit card, you are likely to find it will be rejected for all transactions. The merchant really needs all the info on the card to be valid - it's part of how they protect themselves ...
Rory Alsop's user avatar
  • 61.5k
64 votes

Validating and storing credit card data for retrieval later

What service in 2022 can I use that has like an API in which I can securely store credit card info and retrieve it at a later date for manual processing? Pick a credit card processor, any credit card ...
gowenfawr's user avatar
  • 72.7k
63 votes

What information about me do stores get via my credit card?

From the card itself, the Merchant gets the track data, which includes card number, expiration date, and cardholder name. If the Merchant requires zip code verification, they'll get your zip code, ...
gowenfawr's user avatar
  • 72.7k
57 votes

Why is this not a good way to store credit card data?

It's obviously base64 encoded. If someone steals your database, he can just decode the data and have all credit card from every customer. You could just store as string and have basically the same ...
ThoriumBR's user avatar
  • 53.6k
57 votes
Accepted

Is this Paypal Github SDK reference really a dangerous site?

This is a typical false positive. Since Firefox is using Google safe browsing API, it will show similar warning as in Chrome browser. Since some antivirus also use the API, it will be warned by those ...
mootmoot's user avatar
  • 2,407
56 votes

Merchant sent email to me with all my Credit Card info

(Note: Not a PCI QSA, just know some PCI and PII stuff) Violating the Payment Card Industry Data Security Standard is not a violation of the law. The PCI DSS is an agreement between the payment card ...
crovers's user avatar
  • 6,371
53 votes

Which parts of a credit card can I obfuscate and still have it be valid

I put a small sticker over the CVV to avoid it being casually seen. The CVV is the three-digit code on the back of the card beside the signature, needed when you buy things on the Internet but not ...
Law29's user avatar
  • 731
50 votes
Accepted

How was the website able to tell my credit card was wrong before it processed it?

Credit card numbers can verified by calculating a checksum. Every credit card number created is assigned a number following an algorithm. Ross Millikan: The checksum specifies the last digit, ...
Jens Krüger's user avatar
48 votes

Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address?

Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back. There is a lot of articles about this ...
Jester's user avatar
  • 663
47 votes

Recourse if debit card was used on a suspicious website

Don't report this as fraud; that will kick off an investigation that will ultimately conclude you did authorize the transaction. Waste of time all around. Call the card company, tell them you made a ...
Ivan's user avatar
  • 6,338
45 votes

Amazon let me place an order without me ever being asked for 3-D secure password

I just read my bank's page on 3D security. It says: If the site supports payments to be made in additional security, you will see the logos of the respective card organization Verified by Visa or ...
Stefan Monov's user avatar
45 votes

Amazon let me place an order without me ever being asked for 3-D secure password

Security measures like "3D password", CVV, etc. do not exist to protect you the cardholder. Do not assume that someone who lacks them can't use your card number fraudulently. All they do is allow a ...
R.. GitHub STOP HELPING ICE's user avatar
43 votes
Accepted

Store Credit Card Information in Password Manager?

The question might come down to: which piece of data has a higher level of risk, your passwords or your credit card info? Your passwords can be used without you ever knowing about it. Passwords let ...
schroeder's user avatar
  • 128k
42 votes

Are credit-card security codes theoretically insecure (if not entirely broken) already?

Deriving the issuer's encryption key using a collection of credit-card numbers with their respective security codes would be an example of a known-plaintext attack (KPA). To be considered secure, a ...
Therac - Peace for Palestine's user avatar
39 votes

Collecting credit card info in HTTPS iframe within an HTTP site

What they are doing is certainly better than not doing https at all. However, their external http page is more susceptible to attacks like Man-In-The-Middle that could cause the 'secure' iFrame to be ...
crovers's user avatar
  • 6,371
36 votes
Accepted

Hotel reservation. How is this secure with only credit card number and expiry date?

Booking.com doesn't take a deposit or any payment from you; what you're filling in is a reservation form. The card details are used as a form of payment identity in case (a) you don't turn up and they ...
Polynomial's user avatar
  • 135k
36 votes

In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"?

A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) ...
Steffen Ullrich's user avatar
33 votes
Accepted

Is accepting an invalid credit card number a security issue?

Should I report this as a security issue or will it come under fraud management? There may be a business risk issue, which you can document under security, but how significant it is depends on the ...
gowenfawr's user avatar
  • 72.7k
32 votes
Accepted

Recourse if debit card was used on a suspicious website

The best course of action would be to contact your card provider and ask to block the transaction. Also, I recommend you block your credit card number and get a new replacement credit card. Here's why:...
whoami's user avatar
  • 1,366
32 votes

Why are my plastic credit card and activation code sent separately?

A lot of people get a credit card and leave it in the envelope for a considerable amount of time. Further, separating the data complicates life very greatly for a mail thief. To snatch one piece ...
Harper - Reinstate Monica's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible