Shop Till Receipts

ThumbRemote

CynicalScotsman wrote: »

.
The information is useless online - as a transaction would be stopped/flagged if it was being delivered to a different address AND you would need your 'verified by visa' etc password.

The information is useless over the phone - very few retailers would carry out a 'customer not present' transaction as they would be liable should it be fraud, and, if they did you would get the money back within days anyway!

If this information is useless credit card fraud wouldn't occur, yet it clearly does. Not every site requires verified by visa, not every site prevents purcahses going to a different address. Thousands of retailers take credit cards over the phone and use the code for verification.

I'm not saying it's common, but it just seems strange to leave the full card number on a printout, when it's really not needed.

Money-Saving-King

ThumbRemote wrote: »

If this information is useless credit card fraud wouldn't occur, yet it clearly does. Not every site requires verified by visa, not every site prevents purcahses going to a different address. Thousands of retailers take credit cards over the phone and use the code for verification.

I'm not saying it's common, but it just seems strange to leave the full card number on a printout, when it's really not needed.

Seems unlikely to me. Don't you think they'd have changed it by now if there was really much of a problem created by this?

TeamLowe

ThumbRemote wrote: »

If this information is useless credit card fraud wouldn't occur, yet it clearly does. Not every site requires verified by visa, not every site prevents purcahses going to a different address. Thousands of retailers take credit cards over the phone and use the code for verification.

I'm not saying it's common, but it just seems strange to leave the full card number on a printout, when it's really not needed.

It would require the full billing address though, which you wouldn't get from a bog standard shop purchase

InsideInsurance

CynicalScotsman wrote: »

.
The information is useless in a store - as you need the card.

The information is useless online - as a transaction would be stopped/flagged if it was being delivered to a different address AND you would need your 'verified by visa' etc password.

The information is useless over the phone - very few retailers would carry out a 'customer not present' transaction as they would be liable should it be fraud, and, if they did you would get the money back within days anyway!

3D secure (eg verified by visa) is not used by all retailers, PayPal as a gateway for example don't. Even CVC and AVS isnt always used.

There is nothing wrong with shipping to another address, that is at the merchants discretion. All of my Amazon orders all go to my work address and not my billing address. If they use AVS (address verification system) then they would need to ask separately for the billing address but again not all retailers bother with AVS either because it can be particularly problematic with flats (AVS does have two levels though).

Many companies do do MOTO and Cardholder Not Present, I am not sure what companies you've tried to use but I've bought hifi equipment, furniture and takeaways recently by phone to physical stores and had no problems with any of them.

Of cause all this assumes the attempt to use the card is with a UK merchant. Go overseas and all the additional security methods disappear.

That said, lets be realistic, every time you buy on the telephone you are reading all the details to someone and they could be writing them down. Each time you put it into a website then that company could be storing the details (with the exception of 3D secure). Ultimately there has to be a little trust in all transactions.

ILW

You have to know the cardholders address for online purchases.

earthstorm

ThinkQuick wrote: »

Hoping someone can help me with a query about till receipts.

A few months back my bank Visa Debit card details were fraudulently used. No big deal, the bank systems spotted it quickly, automated phone call alerted me and so on. However I noticed that this had happened just after a had visited a particular store.

Today I was in that store and bought a couple of things. A standard chip and pin machine was used but it was the shop assistant that used it, taking my card off me, putting it in the machine, giving it to me to put the pin number in and then taking it back again to wait for receipts to print. I got my receipt as expected and they got theirs, however I was shocked to notice that on their receipt, my full card details were printed. The full card number, the start and expiry dates etc. My copy of course only showed the last 4 digits.

Is this normal because if so it would seem ludicrously insecure!!

I anticipate that some of you might suggest that "yes but they don't have your card pin number or the 3 digit security number on the back of the card"

However to that I would say that it would be exceptionally easy for an assistant, when ripping off the receipt and handing the card back to you, to turn the card over in the process and quickly clock that 3 digit number.

I thought all these transactions were computerised with no full details being stored anywhere except in the secure computer systems. Is this store just archaic in it's technology or are they scamming people?

It depends on what merchant service a retailer uses, like most major retailers will have the fixed chip and pin that they sales assistant does not touch as its directly linked to the till system, but some smaller retailers have chip and pin machines from companies like payatrader.com that are not linked to till systems, so you insert your card and hand the machine to sales assistant who will type in the sales amount and then hand it back to you to check and then enter pin and then you hand it back to assistant who will wait for the receipt or decline notice and then hand you back your card and receipt.
We use a mobile one on our market stall that we can print a receipt or just email a receipt to the buyer.

peachyprice

ThinkQuick wrote: »

H
A standard chip and pin machine was used but it was the shop assistant that used it, taking my card off me, putting it in the machine, giving it to me to put the pin number in and then taking it back again to wait for receipts to print.

This is not normal procedure and rarely happens, you should, at no point, give your card to an assistant to put into the machine, the machine should be handed to you for you to put your card in and handed back to you to remove the card. Once the card is in the reader and has been passed back to the sales assistant they can't read the CVV or expiry date.

If the correct procedure is followed it blows your whole theory of the entire card number being stored by the store being a security risk out of the water.

In future, if you're asked for the card you would be quite correct to refuse to hand over your card and ask for the terminal to be handed to you.

earthstorm

Only time you may have to hand your card to assistant is if the chip and pin machines are down and they have to use the backup manual swipe and sign machine ( the old system where you sign a voucher)

arcon5

ILW wrote: »

You have to know the cardholders address for online purchases.

You don't. The retailer can amend the security settings in the merchant account and can set it to not decline the payment if there is an address mis-match. It's just most merchants enable the security feature to help block fraudulent transactions.

arcon5

A standard chip and pin machine was used but it was the shop assistant that used it, taking my card off me, putting it in the machine, giving it to me to put the pin number in and then taking it back again to wait for receipts to print.

Not as uncommon as you think, many smaller retailers will do this. I know I did this as the terminal was not connected to the ePos software I had programmed for us so we had to input the transaction amount in the terminal before handing it to the customer.

I can think of a few times i've purchased goods in small local shops where this has also happened.