17

I want to buy something from a VERY REPUTABLE Asian seller. They've got a lot of good references all over the internet. The only thing is, they are quite old-fashioned and so is their website.

They want you to send your order via UNSECURED FORM on their website and you should add your credit card information to be charged.

I tried to negotiate with them to pay via PayPal and that I would pay the extra expenses, but they are not interested as they don't have the PayPal account and all the other customers pay just with the unsecured form.

I'm used to paying online just via 3D-secure payment, so the only other idea I had, except sending my credit card via UNSECURED FORM, is to send them my credit card information via e-mail - ideally separate the info in two e-mails.

I know it's still not secure at all, but what is the safest option out of these two? Or is there any other option?

EDIT: The seller is in business for more than 10 years and there is no evidence about any fraud over the internet. I got another payment option and that is sending the credit card info to their FAX number. I have never used a fax and I don't have any access to the fax machine, but I have found some free/trial online fax services which offer secure fax send. Would this make any difference or is it just worse because the fax at the store just "spits out" a paper with my credit card info and anyone around the fax can take the paper?

Btw my card is a debit card and I use this just for online payments (there is not much cash on the card), I'm thinking about lowering the online payment limit to zero for a few weeks after they will charge it.

Improve this question
10
  • 18
    The two options are roughly equivalent. Note that you claim this is a reputable Asian seller, but that's clearly NOT the case if they are willing to accept credit cards unencrypted.
    – ChrisInEdmonton
    Jun 16, 2013 at 16:27
  • 7
    Is the item unique? Why not find it from a secure vendor?
    – JTP - Apologise to Monica ♦
    Jun 16, 2013 at 20:17
  • 2
    If you don't have a fax machine, go to your local library and use theirs.
    – Jesse
    Jun 17, 2013 at 2:20
  • 2
    Who is the retailer? To me "very reputable" and "accepts credit cards info over http" are mutually exclusive.
    – Cody
    Dec 21, 2018 at 22:11
  • 1
    Did you try adding the s to https? Maybe it is setup, they just aren't redirecting to secure.
    – Andy
    Feb 11, 2020 at 1:44

6 Answers 6

Reset to default
33

Buy a prepaid gift card, such as a MasterCard or Visa gift card. You can find them at the grocery store, a pharmacy, or your local bank. Provide this on their online form. If anyone steals your gift card information, you will have already used the funds for your purchase and there is no further risk to you.

Improve this answer
4
  • 1
    Why the downvote? This seems like a good idea. There are additional costs, they are certainly not credit cards, but they serve this purpose.
    – MrChrister
    Jun 17, 2013 at 3:02
  • 4
    People should be disallowed from downvoting without a comment.
    – DumbCoder
    Jun 17, 2013 at 9:56
  • 7
    @DumbCoder - the StackExchange people have debated that one over and over, and they aren't gonna change - meta.stackexchange.com/a/22937/24229
    – MrChrister
    Jun 17, 2013 at 16:47
  • 1
    +1 Best idea. Can't be charged again later. Do not use a debit card as you don't have any chargeback or fraud protection.
    – JAGAnalyst
    Jun 17, 2013 at 16:56
33

Some (most) credit cards have a way to get a one-time use number. If that is an available option for one of your cards, that is probably the way to do the very risky transaction.

These numbers can be good for only one purchase, or for multiple purchases with a single vendor. This will limit your exposure because they won't have access to your entire account.

Also review your fraud protections with your credit card.

With the single use number, it won't matter if you use the electronic form or the email. Just make sure you keep the confirmation email or a screen capture of the form.

Improve this answer
3
  • 3
    +1 for the one-time use codes. I haven't tried these yet myself.
    – Chris W. Rea
    Jun 16, 2013 at 17:16
  • +1 The first word of this answer is worth remembering because different cards have different rules. See, for example, the answers to this question
    – Dilip Sarwate
    Jun 16, 2013 at 18:20
  • 1
    The one time codes sounds perfect! The only problem is I checked with my bank and they don't offer these.
    – Joudicek Jouda
    Jun 16, 2013 at 19:52
18

Here's one option: Telephone is a lower-tech yet relatively more secure means for transmitting your payment information when a secure web site isn't available.

And yet another option: You could send them an encrypted email, but this would require tools (e.g. GPG), setup (public keys), and expertise on their end which they are unlikely to already have.

However, ChrisInEdmonton raised a good point in his comment. How can you consider them to be a reputable seller when they don't take basic precautions to protect customers' payment information online?

The seller may with good faith charge your card the correct amount and deliver the goods that you expect, but how will they protect your credit card information once in their hands? Would you trust their internal systems if they can't even set up an HTTPS web site?

Improve this answer
8

Your biggest risk with a vendor like this is not that your Credit Card Number will be stolen in transit, it is that it will be stolen from the vendor. I agree with @mhoran that using a one-time number is the best plan, provided you have a bank that offers such numbers. Bank of America calls used to call it "Shop Safe" (feature ended Sept 2019) while Citibank calls it "Virtual Account Numbers". I think Discover card has something similar, but less useful, in that they aren't really one-time use, and American Express discontinued their service. Capital One has a service called Eno which operates as a browser plugin and is less flexible (you cannot simply generate a virtual number, somehow the plugin ties a number to the merchant and auto-fills it into the payment screen on the merchant's website). AFAIK no one else offers anything like it.

If you can't get a one-time number, then I was going to suggest buying a Visa gift card, until I put together the fact that you are making a purchase in Asia and the gift cards are not authorized for international payments (due to PATRIOT act restrictions).

Visa does offer the V.me service which might help, but I doubt your vendor participates (or would even be allowed to participate) if they don't offer a secure order form.

You can open a pre-paid Visa card account, which is probably what I'd do. You can buy pre-paid Visa cards the same way you buy Visa gift cards, the difference being you have to register the pre-paid cards (thanks, PATRIOT act) before you can use them. But it's not that big a deal to register one, you just fill out the online form your your SSN etc and you're good to go. Load it up with enough money to cover your purchase and the FX fees and then cut it up.

Improve this answer
4

Most people cannot use pgp/gpg and setting it up would, in order to do that correctly, require voice fingerprint verification. Don't.

Just write a word doc and either encrypt it when saving using the "save as" function or encrypt it using zip and email that to them. Then call them and tell them the password.

Done.

Improve this answer
1
1

I know it's a very old question, but there are some new services which are providing single use cards which will be very helpful in such cases.

They are single use only and you can also associate a transcation limit to them.

Some of the examples are:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .