Storing credit card details

Fertilizer

I don't like any online company storing my credit card details and in my long experience of shopping online it is very rare for any company to store card details. Whilst there are one or two exceptions, if online shops think it is a good idea, they ask if the customer would like the card details saved. I always say NO.

However, I see that Ocado has just changed it site from asking if you would like your credit card details stored by them, to storing them regardless, without asking.

There is NOT an option to say "no, I do not want you to store my card details". To me this is clearly a backward step, partly because organizations are in the habit of "losing" customers' "securely" held details - and that leads to lots of fraud. In today's Telegraph there is an article saying the UK is the worst in Europe for identity theft ....

Why would Ocado take away the option to save or not ?
Why would they think this is a good idea ?
Why do they think this will make all their customers happier ?

Previously, we had the option of letting Ocado possibly lose our card details: now we have no choice.


I don't know what the legal position is on this, but I am interested to hear what forum users think about companies storing your card details.

You can store them yourself on your own computer in encrypted form, of course, so that you do not need to key them every time you do a shop ...

InsideInsurance

There is no legal issue with them storing your card details as long as they are telling you that they are doing it.

As to why are they doing it? That you'd need to ask them.... at a guess they view doing it with a Continuous Payment Authority which means they will have a lower failed payment rate and a lower drop off rate at the payment stage (people going off to get their card and forgetting to come back etc).

Do they think they will make everyone happier?
Certainly not, they will however had a guestimate on what percentage will refuse to shop because of the card retention -v- the benefit for those that don't object enough to stop shopping and the benefits as above

Development and changing websites costs money, a lot when you get to that size of organisation, and you wouldnt change something that isnt broken without a business case against it showing how it creates more profit.... of cause sometimes estimates used in the cost benefit analysis can be wrong

Eydon

Have to say I'm on the opposite end of the argument to OP.

If there is one thing that bugs me it's when I go and buy something from a website which I've used regularly and have to go and find my wallet because I can't remember the 16 digit number and they haven't saved it from last time.

To be far to a lot of these places though, they only store the 16 digit number and you still have to enter the 3 digit CV2 in order to complete the sale.

dalesrider

And you don't think that EVERY retailer you use stores your card details for 6 years as required by the tax man.......

So you dont need to worry.

bert&ernie

Eydon wrote: »

Have to say I'm on the opposite end of the argument to OP.

If there is one thing that bugs me it's when I go and buy something from a website which I've used regularly and have to go and find my wallet because I can't remember the 16 digit number and they haven't saved it from last time.

To be far to a lot of these places though, they only store the 16 digit number and you still have to enter the 3 digit CV2 in order to complete the sale.

Its against card industry rules to retain certain 'Sensitive Authorisation Data', like the CVV2, after the transaction is authorised. Other cardholder data such as the PAN and expiry data can be retained, but should be protected e.g. by encryption.

Thats all very well of course, but its not uncommon for merchants to be non-compliant with these rules.

dresdendave

Fertilizer wrote: »

Previously, we had the option of letting Ocado possibly lose our card details: now we have no choice.

Ulimately you do have a choice, if you are not happy with their procedures don't use them.

meer53

In the grand fraud scheme, it's not something that would worry me. You're more likely to have your card details compromised at your local petrol station.

Fertilizer

@ EYDON
I never key such details. There is plenty of software which encrypts your card etc details on your own PC and fills it in for you.

You could try Roboform, or it you use Norton Internet Security or some other internet security, such functionality could well be included

Fertilizer

An update
a) Ocado - as above, they changed in 2012, from asking if you would like them to store your card details to assuming you want them to keep / lose them for you. I then have to go to the trouble of working through the menus to delete my card details after paying. I complained months ago, but they haven't bothered to change it back (that's not the only thing they have done to make it more difficult for customers to use their site - a strange approach to customer service).
b) Superdrug - another bad approach ... although they have a tickbox, the default is that they will store your card details unless you happen to notice the tickbox / remember to untick it each time. I have complained to Superdrug
c) Marks & Spencer - not used for online shopping for a long time but when I did recently, like Ocado, they had switched to automatically storing my card details. I complained. They offered to delete them for me - but I had already deleted them myself. Trouble is, I have to do this every time I place an order.

I really do not like this idea that firms think it is ok for them to store MY credit card details without my permission.

No wonder credit card fraud is so rife.

@Dalesrider - I think everyone should worry about this - if you simply assume "they" will not lose your details you might be in for a rude awakening

@meer53 - I think that a large electronic file containing thousands of credit card details which can be emailed / transmitted to any part of the world to anyone who is willing to pay enough, is more of a target that a few swiped at the local garage.

As far as I am concerned, the fewer people who have my card details stored the better. Worse still, if lots of other people's are stored with it, then my details are more likely to disappear as the file becomes a bigger target.

People should not be complacent about this - identity theft can cause everyone huge problems - it is not just about getting a replacement card ...

UsernameAlreadyExists

Ask to see their PCI DSS compliance certificate. If they have one, chances are your card number is pretty safe, and the regulations are getting tighter every year.

Alot of retailers may outsource the payments & card number storage to compliant companies as meeting the requirements themselves is a massive undertaking.

Fertilizer

I am not sure it matters how compliant they are ... if the target and the price is attractive enough - it becomes even more attractive in some of the far flung corners of the world where the data might be stored ...