187
votes
Accepted
All 0s (zeros) in a bank card's CVC code
Alexander O'Mara provided a correct answer, but having worked in a hotel that was using booking.com I believe I can provide additional information about the reason that CVV was denied.
Every day the ...
- 1,698
161
votes
Accepted
How does Shutterstock keep getting my latest debit card number?
Simply put, Account Updater:
When participating issuers re-issue cards, they submit the new account
number and expiration date to VAU. Participating merchants send
inquiries on their credentials-on-...
- 73.3k
149
votes
All 0s (zeros) in a bank card's CVC code
The only weak argument I can think of to reject such a CVV would be that if someone were trying to brute-force your 3-digit code, they might start with 000 first (but would they also reject 001?).
...
- 8,854
129
votes
Accepted
Why are my plastic credit card and activation code sent separately?
Many low level crimes are ones of opportunity, not planned out attacks. By separating the two needed pieces of mail in time, it forces the attacker to intercept the same person's mail more than once. ...
- 21.6k
112
votes
Is this Paypal Github SDK reference really a dangerous site?
No, it's not dangerous at all. Your browser is warning you because a non-Paypal website has Paypal in its name. This is a common technique used by phishing sites that attempt to fool you into thinking ...
- 67.3k
107
votes
Accepted
Why is credit card information not stolen more often?
PCI DSS
The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform ...
- 8,439
106
votes
Accepted
How many digits of a Visa card number can vendors disclose on receipts?
As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked:
From an official 2008 PDF: PCI Data Storage Do’s and Don’ts:
Never store the personal identification number (PIN)...
- 926
94
votes
All 0s (zeros) in a bank card's CVC code
This is a frame challenge of the company's claims. A random number in the range 000-999 is more secure than 001-998, rejecting values weakens it.
It's a software bug. They can't admit it.
Just one ...
80
votes
Accepted
How can Paypal know my card is being used in another account?
There are a couple reasons why Paypal (or more generally, any payment service) can know if you've used your card in more than one place.
Your credit card is absolutely tracked everywhere possible
...
- 31.7k
66
votes
Accepted
Which parts of a credit card can I obfuscate and still have it be valid
If you deface a credit card, you are likely to find it will be rejected for all transactions. The merchant really needs all the info on the card to be valid - it's part of how they protect themselves ...
- 61.7k
63
votes
What information about me do stores get via my credit card?
From the card itself, the Merchant gets the track data, which includes card number, expiration date, and cardholder name.
If the Merchant requires zip code verification, they'll get your zip code, ...
- 73.3k
63
votes
Validating and storing credit card data for retrieval later
What service in 2022 can I use that has like an API in which I can
securely store credit card info and retrieve it at a later date for
manual processing?
Pick a credit card processor, any credit card ...
- 73.3k
57
votes
Why is this not a good way to store credit card data?
It's obviously base64 encoded. If someone steals your database, he can just decode the data and have all credit card from every customer. You could just store as string and have basically the same ...
- 55.5k
56
votes
Merchant sent email to me with all my Credit Card info
(Note: Not a PCI QSA, just know some PCI and PII stuff)
Violating the Payment Card Industry Data Security Standard is not a violation of the law. The PCI DSS is an agreement between the payment card ...
- 6,391
56
votes
Accepted
Is this Paypal Github SDK reference really a dangerous site?
This is a typical false positive. Since Firefox is using Google safe browsing API, it will show similar warning as in Chrome browser. Since some antivirus also use the API, it will be warned by those ...
- 2,417
53
votes
Which parts of a credit card can I obfuscate and still have it be valid
I put a small sticker over the CVV to avoid it being casually seen. The CVV is the three-digit code on the back of the card beside the signature, needed when you buy things on the Internet but not ...
- 731
50
votes
Accepted
How was the website able to tell my credit card was wrong before it processed it?
Credit card numbers can verified by calculating a checksum.
Every credit card number created is assigned a number following an algorithm.
Ross Millikan:
The checksum specifies the last digit, ...
- 646
48
votes
Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address?
Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back.
There is a lot of articles about this ...
- 663
47
votes
Recourse if debit card was used on a suspicious website
Don't report this as fraud; that will kick off an investigation that will ultimately conclude you did authorize the transaction. Waste of time all around.
Call the card company, tell them you made a ...
- 6,338
45
votes
Amazon let me place an order without me ever being asked for 3-D secure password
I just read my bank's page on 3D security. It says:
If the site supports payments to be made in additional security, you will see the logos of the respective card organization Verified by Visa or ...
- 979
45
votes
Amazon let me place an order without me ever being asked for 3-D secure password
Security measures like "3D password", CVV, etc. do not exist to protect you the cardholder. Do not assume that someone who lacks them can't use your card number fraudulently. All they do is allow a ...
43
votes
Accepted
Store Credit Card Information in Password Manager?
The question might come down to: which piece of data has a higher level of risk, your passwords or your credit card info?
Your passwords can be used without you ever knowing about it. Passwords let ...
- 132k
41
votes
Are credit-card security codes theoretically insecure (if not entirely broken) already?
Deriving the issuer's encryption key using a collection of credit-card numbers with their respective security codes would be an example of a known-plaintext attack (KPA).
To be considered secure, a ...
- 2,770
36
votes
In a "card not present" transaction, is the credit card number, expiry date & CVV considered as a "What you have" or a "What you know"?
A requirement for "what you have" based authentication is that ownership can be clearly assigned to a single specific entity. This specifically means that this information/device can not be (easily) ...
- 208k
32
votes
Accepted
Recourse if debit card was used on a suspicious website
The best course of action would be to contact your card provider and ask to block the transaction. Also, I recommend you block your credit card number and get a new replacement credit card. Here's why:...
- 1,366
32
votes
Accepted
Is accepting an invalid credit card number a security issue?
Should I report this as a security issue or will it come under fraud management?
There may be a business risk issue, which you can document under security, but how significant it is depends on the ...
- 73.3k
32
votes
Why are my plastic credit card and activation code sent separately?
A lot of people get a credit card and leave it in the envelope for a considerable amount of time.
Further, separating the data complicates life very greatly for a mail thief. To snatch one piece ...
28
votes
Apart from losing €40, is there any further risk if someone has my prepaid credit card number and home address?
What additional risks are there?
The hacker could attempt to use the credit card number for other purchases
The hacker could attempt to use your address and credit card information to impersonate you....
- 9,361
22
votes
Amazon let me place an order without me ever being asked for 3-D secure password
Credit card transactions have varying levels of authentication, ranging from simply submitting the card number, to card+cvc, various password systems, chip-and-pin, and so on.
The important thing ...
- 34.8k
22
votes
How can Paypal know my card is being used in another account?
PayPal is a payment processor, not a merchant, they need to pass the card number to your bank (or card issuer) when they're processing payments, so they need to store your credit card in a way that ...
- 31.6k
Only top scored, non community-wiki answers of a minimum length are eligible