Forum Moderators: buckworks
1) is there a current trend to no longer store cc numbers now?
2) are existing sites changing to not store them?
3) what are most people doing?
I am faced with this decision (store them or not?) and my starting point is really only that I have read or heard at some point this 'general' rule that you should not store cc information unless you really need to, and if you do, encrypt it.
well I may have a need to (related to my previous post just a few minutes ago). I need to address fraud, specifically billing/shipping address mismatches. I don't currently store credit card numbers but if I want to call an issueing bank to verify a ship-to address that differs from the billing address I will need the whole credit card number. So the decision I'm currently faced with is whether to start storing the credit card numbers or to change my site to only allow shipping to the bill-to address?
any input on this would be greatly appreciated. thanks.
I use an online system Linkpoint they store them there.
You can't just process a cc and then discard the number. I myself didnt want this responsibility keeping track etc so I opted for the above.
You should be able to access the number before processing it as we do so this all the time on new orders.
I check them all the time through getting the card number and dates and checking this with master card/visa call in and address verification center. There is no need to get the issueing bank as you can use a central location to check.
You will see sometimes the address does not check out this can be a bad card or the owner has not updated the move. When I get a bad address I call the number on the order and check, it is about 50-50 on being a bad charge and person has moved.
Discover and AE both have their address verification number to call, There isn't any reason for you to store anything that is what you pay authorize.net to do
Call authorize.net back they will tell you how to access the card number before you process it for a batch.
All the first step is a preapproval for you to approve it.
You can only check US credit cards as international are a different horse altogether.
[edited by: bwnbwn at 6:33 pm (utc) on Dec. 12, 2006]
This provides only a scant opportunity between order placement and print/archive for the data to be compromised. The hard copies of course go offsite in a SAFE location. :-)
Of course this may add an additional maintenance issue and diligent monitoring.
No I hope this is not common as this just increases the odds of card theft from hackers and employees.
I can't understand why you would want to store them when they are available for you to get from your merchant services.
If authorize net does not have a way for you to get them get another merchant service as I can easiely get a card number for checking before the card is run as it cost more to refund the order than it does to process it.
I would also agree that printing hardcopies of cc numbers just widens your potential security vulnerabilities.
If you must keep the card number for the address check purpose, I recommend instituting a policy of deleting the card numbers on a regular basis (every 2 weeks) so minimize your exposure.
We ran this process by our merchant bank (one of the big ones) and they said this was sufficient protection. May have changed a bit in the last year, though. Good luck with it.
However, 90% of merchant store the CC # for various reasons. I would recommend storing it myself, because at least you will need it however you may want to reconsider if are not comfortable with your server.
We have over 50 employees, we restrict access to the CC information from them, we only display the last 4 digits.
No I hope this is not common as this just increases the odds of card theft from hackers and employees.
Do you know how a GPG key works? A public key creates the encryption, and it cannot be decrypted without the use of a private key, which is only physically present at the time of decryption. It's virtually impossible* to crack unless someone physically steals your private key. If performed on a secure server, this doubles the security measure. Employees are a different matter.
No, this method is not common, because it's difficult to set up and requires getting your hands dirty to use it. But it's highly secure.
I've seen the backside of a lot of merchant shopping carts. It's not pretty. There is a lot of storing going on, with only scant security measures.
* Nothing is impossible. But it would take months of number crunching to break a GPG key.
if you have a large business you might prefer your own payment gateway - but that costs a vast amount of money and needs lots of security checks to ensure compliance with all the regulations and the law etc
if you are not a large business then just use a large payment processing company
small businesses storing card info are often in breach of law or PCI regs etc by not storing data securely - main reason they do this is to save money - although they often just don't get the facts that they often aren't saving a penny, they are spending time manually processing card details, and they are taking risks with security
there is no need to store numbers, ever
use a large payment processor, save yourself time, hassle, money and the risks
I would look into changing as I just signed up our business and it was free with cardservice. Simple to set up do online and all u need to do is change the processing url in your cart.
This is by far the best most simple way to get this taken care of..I for one couldn't run our business if we couldn' check the cc numbers on our orders.
For example, a php programmer might hardcode the key into their code so their script can do the encryption directly - a huge, but common security problem. I have seen website put an encryption key into a client side js.
Encryption has to looked at in the context of the entire application.
Also, don't forget the most security breaches come from inside an organization. Storing cc numbers makes them easy prey to people who have access to them.
bwnbwn, as far as changing now, I know it can be done but I think there may be more involved for us since our site is a completely custom programmed site. I beleive its currently using an authorize.net specific programming API... I am not the programmer so I am not certian of the details but I don't think it would be a simple matter of changing the URL it posts to, I think some programming changes will need to be made. Of course it can be done and we just might. I will be including this as a possible option and find out how much programming, if any, would be needed.
Thanks again.
