Storing credit card details

UsernameAlreadyExists

Well as others have pointed out, the CVV/CV2/CSC/4DBC (the numbers on the signature strip) cannot be stored, and as more and more merchants are conforming to the requirements to capture and check this detail, the value of the card number on it's own is rapidly diminishing.

It'll get to the point where it can only be abused abroad in low tech scenarios, and you can easily dismiss these as fraudulent.

There are some large companies that shamefully violate the rules with "one click shopping" etc. but they're clearly too big and powerful to be policed and/or just pay off the fines which are probably less than the cost of change for them.

gglaze

Out of either laziness, ambivalence, or just bigger things to worry about, I also allow some of the larger, more frequently used merchants I deal with to store my details - including Ocado, Amazon, and Paypal.

Correct me if I'm wrong, but - I make regular purchases through each of the above, and I'm pretty sure I never have to re-enter the CV2 code or whatever - it seems to have my *full* card details stored - or is this because they also automatically have a Continuous Payment Authority set up, that they can re-use, and so they no longer require the CV2? Or some other way? Presumably they don't actually store the CV2 numbers, right? Is that better or worse for my security?

meer53

The CVV number isn't always needed to authorise a payment, it's just an extra layer of security. The only way to fully prevent card fraud is to never use it, anywhere.

Personally, i'd rather have the convenience of not having to input my card details every time i buy something online. I know that if there is any fraud on my account, i'll be refunded in full as soon as the fraud occurs, i check my account daily, i receive a text every morning. It's not something that worries me.

Fertilizer

@meer53
as per my post of 10th Oct
"I never key such details. There is plenty of software which encrypts your card etc details on your own PC and fills it in for you.

You could try Roboform, or it you use Norton Internet Security or some other internet security, such functionality could well be included "

Also, I think you are right about the CVV - it is not always required.

I have had 3 or 4 episodes over the years of people spending on my credit cards, although nothing in the past couple of years. Two of them were spotted by the credit card company as they were going through - very impressive - they gave me a call to check - then blocked those transactions.

However, with another one, the circumstances were such that it could only have happened with data from an organisation was "securely" storing my data - the credit card company.

You would think this was pretty secure ....... So I take the view that none of it is really secure. And if it is profitable enough, then people will find ways to circumvent the system.

dalesrider

Fertilizer wrote: »

No wonder credit card fraud is so rife.

@Dalesrider - I think everyone should worry about this - if you simply assume "they" will not lose your details you might be in for a rude awakening

As far as I am concerned, the fewer people who have my card details stored the better.

People should not be complacent about this it is not just about getting a replacement card ...

You card details are far more likely to be compromised at your local retailer.....
You are aware that EVERYTIME you use your card, not just online. The retailer has the FULL card number on their till roll.
There is no way round this. As they need it for auditing purposes.

Card fraud is not that rife....
If you have been hit several times. Then you need to look closer to home. There will be one retailer you use that has a disshonest member of staff that is taking the details. may even be a chain, where a staff member moves around a bit to cover.
But this is the type of fraud YOU can do nothing to stop.... Well unless you never have a card....

Fertilizer

As I said, I have had no issues for a couple of years.

This might be of interest - from the Telegraph recently "UK worst in Europe for identity fraud" - you can google for it ...

meer53

Fertilizer wrote: »

As I said, I have had no issues for a couple of years.

This might be of interest - from the Telegraph recently "UK worst in Europe for identity fraud" - you can google for it ...

Identity fraud is completely different to card fraud.

UsernameAlreadyExists

I work in the payments industry for a PCI compliant company.

Technically, the CVV is not required for authorisation, but it's in the implementation guidelines and type approval certification scripts that it 'should' be used when appropriate. eg. MOTO (Mail order/telephone order) and often ECommerce - however the mandate and uptake of the 3DSecure system (VerifiedByVisa/MastercardSecureCode) means it's becoming less necessary as different and better authentication processes are being used.

The entire point of the CVV is to prove that you physically have the card in your possesion and can read the numbers off the back of it. It's strictly forbidden to retain the CVV for any longer than is absolutely necessary (i.e. during the authorisation process) otherwise it would defeat the whole object.

Regarding the card numbers on the merchant journal, this is for "fall back". Some of the store and forward EPOS systems (eg terminals) may fail before they've uploaded their transaction data, and the merchant will need to re-key the transactions (perhaps into another device) as the cardholder will have long gone with the goods without having actually paid.

I've heard stories of some fraudulent card use whereby several transactions for tiny amounts are scattered amongst legitimate uses of the card and go unnoticed for months & months as the overall balance is approximately what they were expecting and unless they check each and every one they don't even realise they're being fleeced of a few pounds every so often.

dalesrider

Fertilizer wrote: »

As I said, I have had no issues for a couple of years.

This might be of interest - from the Telegraph recently "UK worst in Europe for identity fraud" - you can google for it ...

So at a guess the person taking the details has either been caught or given up.

Personally I prefer the Guardian reports :rotfl: Card fraud over europe UK = Anti fraud winner.
So you are better off in the UK

ID fraud is totally diffrent to card fraud.

Fertilizer

I suspect that the impersonators involved in identity theft are not doing it for fun ... I suspect they have a motive which often involves credit cards ...