How secure is secure?

[skiprat]

Quick question...

Can a vendor with a secure payment system see all your credit card details?

I want to buy stuff but one of the items is in stock but not listed on their site.
They said no probs, just order that part over the phone. I can't bring myself to do that, but it got me thinking...could the same person that I'm not willing to trust over the phone, see my full details anyway if I used their secure shopping cart?

Thanks guys:biggrin:

 

[budnder]

Quick question...

Can a vendor with a secure payment system see all your credit card details?

I want to buy stuff but one of the items is in stock but not listed on their site.
They said no probs, just order that part over the phone. I can't bring myself to do that, but it got me thinking...could the same person that I'm not willing to trust over the phone, see my full details anyway if I used their secure shopping cart?.
Thanks guys:biggrin:

Yes, correct. The motivation for a phone order was usually to avoid using the vendors internet shopping system, not to avoid the vendor. However, often times the vendor simply uses that same internet system to record the phone order, so, as far as security goes, the benefit may be nil. And actually, if the vendor has to write your information down manually before entering into their system, you might be more exposed, as how that little slip of paper gets dealt with is another exposure. But yeah, if they really wanted your CC number they can get it from online orders you process with them.

If you want to avoid the vendor having access to your CC, use PayPal to pay them.

 

[cjester]

Quick question...

Can a vendor with a secure payment system see all your credit card details?

I want to buy stuff but one of the items is in stock but not listed on their site.
They said no probs, just order that part over the phone. I can't bring myself to do that, but it got me thinking...could the same person that I'm not willing to trust over the phone, see my full details anyway if I used their secure shopping cart?

Thanks guys:biggrin:

Many places use a dedicated third party processor, such as Stripe or PayPal. When a vendor uses a system like that, they never see or touch your credit card information. The web form sends the CC data straight to the processor. If they do, it usually says so - "Pay with PayPal", "Powered by Stripe", etc. One of the big advantages from a vendor point of view here is if your website is ever hacked, you're safe from a card breach because you never had that data to start with.

If you see none of that, and the CC fields are mixed in with everything else on the check-out form, then there's a good chance they are handing your card data, and it might be stored in their database.

 

[MRDucks2]

Or call him and ask what is up over the phone. His online system may not support the ability to order something that is not in stock and his intention is to order directly from his supplier for you, in which case he may enter your card number directly into his suppliers online order form.


Sent from my iPhone using Penturners.org mobile app

 

[Dehn0045]

The fraud alerts are getting pretty good on credit cards. We recently had our card number stolen. They tried to use it on a cash-advance type internet site, after the first transaction there was an immediate hold placed on the card. I called the CC company and they reviewed the transactions with me, I was not charged for the fraudulent charges and they immediately sent me a new card. Other than needing to change all of my automatic payments, it was totally painless. Obviously, its smart to take care of your CC, but after this experience I am much less worried about it... I know this doesn't directly answer your question, but my thinking is that there is much less value in stolen CC numbers than there used to be, so people aren't going to take the time to steal your CC number over the phone.

 

[skiprat]

Many thanks for the answers, guys.

My main concern was that 'bit of paper' with all my details just floating around.
It would unlikely be the actual person that took your details that would crook you, they have too much to lose. It would be the shady guy in the 'background' that fishes the scrap of paper out of the bin later.

The main online order went through via Stripe. When I explained to the vendor that I was reluctant to give my CC info over the phone for the remaining bits, they again said no probs and simply sent me a Paypal Payment Request.

As a rule, I won't use any card to pay online unless the little 'Padlock' symbol is shown in the address line.

Thanks again:wink:

 

[duncsuss]

Steven --

One of my credit cards comes with the option of creating "virtual card numbers" which I always use when buying goods online.

I create a card that has both dollar limit (I normally make it a few dollars higher than what's in my shopping cart plus shipping) and time limit (which I normally set at 2 months).

Once the merchant has taken an authorization off the card (whether it's been actually charged/settled or not), that number cannot be used by anyone else.

Once I've got the goods, I close the card, so the same merchant can't sneak more charges onto it.

It only works for mail-order stuff (online, phone or mailed-in orders) but that's enough to make it worthwhile for me. I don't know if any UK credit card issuers offer the service.

One other option, if you really want to keep your stuff private, is to buy a "prepaid card" for just enough to cover what you want to buy. They can be bought almost anywhere here in the US (supermarkets, Target, etc) and they load up the value at the cash register -- typically $25, $50 or $100. Use it up and throw it away.

 

[keithncsu]

We have both a website and internal system here at our company that "saves" credit card info so that we can charge cards without having the info every time. On the website, no one internally (or so I'm told) can see the full 16 digit card information after the customer puts it in directly to the site. The same goes for our internal system once it gets put in. If we ever need to change an order or something we typically have to call and get the info again.

That said, depending on who is taking the information, they will either enter it directly to the system, or they will write it down. Personally, I usually write it down. Once I see that the card has been approved, I physically tear up the paper as small as I can and then put it in the shred box.

While that may sound crazy, please also know that we do not use the 3 digit code on the back so there's not much I could do with that card info elsewhere. It is also against the law for us to keep that 3 digit number. Sometimes customers will send it in email...yes that is crazy...and when we get it, we are instructed to permanently delete those emails.