Using credit cards online: is it safe?

Question

Since I started using payment cards online, I have completely no understanding about how these payments are secured.

Whenever I pay online no matter for what, I'm usually asked to provide all information, that can be found on the plastic card itself. This information usually includes

• the number of a card (those 16 digits)
• card holder full name
• expiration date
• CVV/CVV2 or similar

That means that if someone has a chance to observe my payment card when I am using it in the ATM or paying anywhere in the store, that bad guy will be able to make payments using data from my card online.

Moreover, not all banks notify me about transactions via SMS or something, so I would hardly have a chance to ever realize that someone has somehow memorised my payment card personal data and uses it for everyday "free" pizza.

From this point of view, it feels that my facebook account is much more secured, than my personal finance. I've got a password that I only know and it is not written anywhere for someone to notice, especially in public places.

So, my questions: Are payment cards provide sufficient security now?

If so, how is that achieved?

Why do online services ask for all those CVV codes and expiration date information, if, whenever you poke the card out of your wallet, all of its information becomes visible to everyone in the close area? What can I do to secure myself?

BTW, some of my friends tend to rub off the CVV code from the cards they get immediately after receiving; nevertheless, it could have already been written down by some unfair bank employee.

UPD: Looks like I'm asking something obvious for everyone else. Then, there's something more I wanted to clear out:

Usually, when you receive a plastic card, there's a pin code with it. What is worth to be noted is that it always comes in a quite secure package, which seems impossible to be looked through using a ray of light and probably some other technique.

Moreover, there's a prescription inside, that states: "Do not ever tell your personal code to anyone on the Earth, even to you relatives and bank employees, destroy it after opening".

So, why don't you put the pin code along with other stuff directly on the plastic card? Why do I have to hold my pin code securely, while preserving all other information, that also allowes to use money, at least online, simply left on the plastic card as is?

Answer 1

You're right that someone who, say, photographed the front of your card at the store could use it to make some online purchases. Schemes like Visa's 3-D Secure provide additional online security by having you enter your password on the issuer's website, but they aren't common yet in the US.

But as littleadv says, you as the cardholder generally aren't liable for fraud (except $50 in some cases). Just be sure to check your statement monthly and notify the issuer of any fraud within 60 days. To issuers, fraud losses are fairly predictable, and the cost is acceptable.

Answer 2

So, my questions: Are payment cards provide sufficient security now?

Yes.

If so, how is that achieved?

Depending on your country's laws, of course. In most places (The US and EU, notably), there's a statutory limit on liability for fraudulent charges. For transactions when the card is not present, proving that the charge is not fraudulent is merchants' task.

Why do online services ask for all those CVV codes and expiration date information, if, whenever you poke the card out of your wallet, all of its information becomes visible to everyone in the close area? What can I do to secure myself?

Is it? Try to copy someones credit card info next time you're in the line at the local grocery store.

BTW, some of my friends tend to rub off the CVV code from the cards they get immediately after receiving; nevertheless, it could have already been written down by some unfair bank employee.

Rubbish.

Answer 3

Why do online services ask for all those CVV codes and expiration date information, if, whenever you poke the card out of your wallet, all of its information becomes visible to everyone in the close area? What can I do to secure myself?

I'd guess that's to protect the card company, not you. The number of the card is guessable, but each other bit of information makes it much harder to guess (the CVV code makes it ~1000 times harder, the expiration date makes it about 50-100 times harder). Since you wouldn't be responsible for the payment anyway, adding security for online transactions provides the company with less liability.

As for the security of your information online, that's trickier. It depends entirely on the site you're using whether they've implemented the appropriate security measures or not (and, given the SSL attacks we've seen, even that might not help). (source: I'm a web developer, and have worked on payments systems before that implemented the security mandated by the cards). At the very least never, ever type in your information on a non-https site (there's normally a little "lock" icon that will display if you're on HTTPS instead of HTTP).

Answer 4

The answer: don't use your actual card number.

Some banks offer virtual credit card numbers (services like Apple Pay are functionally the same).

Bank of America's virtual cards work like this:

1. The virtual card number is different from your actual card number, so the merchant never sees your real card number. In fact, the merchant cannot even tell that you are using a virtual card.

2. You can set the maximum amount to be charged.

3. You can set the expiration date from 2 to 12 months.

4. Once the merchant has made a charge on that virtual card, only THAT MERCHANT can make any further charges on that same virtual card.

5. It is not possible to discover the real card number from the virtual card number.

So the result is that your risk is reduced to the merchant not delivering the order, or charging too much (but not over the limit you set). There is nothing to be stolen since your real info never goes over the internet, and once a merchant has used the virtual card once, no other merchant can use it.

Other banks may have virtual cards which have fewer features.

The only DISadvantage of this is that you have to go to the bank's website whenever you want to make a purchase from a new merchant. But you don't have to worry about them stealing your real credit card information.