Leaving card details with insurer

tribetown

I have just renewed my car insurance, payment would not go through online so I called the insurer who had my debit card details from last year. The payment went through no problem.

"We have collected this amount from the credit or debit card that is securely held on file."

I have turned auto renew off but I was wondering if there is a risk of fraud from leaving the card details on file.

DullGreyGuy

tribetown said:

I have just renewed my car insurance, payment would not go through online so I called the insurer who had my debit card details from last year. The payment went through no problem.

"We have collected this amount from the credit or debit card that is securely held on file."

I have turned auto renew off but I was wondering if there is a risk of fraud from leaving the card details on file.

The details will have to be held in line with the Payment Card Industry Data Security Standards or higher and will not include the CCV. In almost every insurance system I've seen the details are encrypted in the db, the key to decrypt them are not held in the same db and 99% of users who have access to make payments dont have the ability to actually see the stored details. The small number of employees that do, via the system, are tightly controlled, the details dont show by default and any viewing of the details are logged.

Some go further still and it will be their merchant bank that store the actual card details and the bank gives them a key to use for future repeat payments. That key is tied to the relationship between the two firms and would be of no use to anyone else. 

The PCI-DSS rules get updated every few years to reflect emerging threats and new levels of security so are getting more secure over time. 

tribetown

Wow! What an amazing reply.
Thank-you very much for taking the time to explain the details.