2

I see that to perform on-line transaction with credit (or debit) card you usually need 3 pieces of information

  • Card number
  • Expiration date
  • Security code

Some merchants offer option to store payment method for later use. What is stored then as usual practice and what merchant can do with this data without card holder supplying the rest?


The source of this question is my observation that if I save my debit card transaction as a payment method the subsequent uses are not authorized by my bank. I expect that

  • They are not saving everything
  • They expect the information saved do be enough for bank to authorize transaction
  • They are expecting it to be enough because they are not asking me to supply the rest

My guess is that it may be difference between credit and debit card handling.


This is rewrite of question to get better answers so the comments may refer to original form of the question.

  • Without knowing which items the merchant is saving it is hard to guess what's missing. – Nathan L Jun 5 '14 at 20:46
  • 3
    You might want to consider the wisdom of having your debit card (that's what you have) information stored on a merchant's web site. At least in the US, and perhaps elsewhere in the world too, debit cards have very little protection against fraudulent transactions if the merchant's web site is hacked. Once the money is gone from your bank account, it is gone. With a credit card, the issuing bank can reverse charges, investigate, etc, and you don't lose the money unless you pay the monthly statement which you can refuse to do in case of fraudulent charges. – Dilip Sarwate Jun 5 '14 at 21:12
  • I think what you are saying my be related to answer to my question. It looks like the amount of information stored by merchant is not enough for my bank to authorize the transaction but merchant expect it would be enough which may be a case for credit card. That way I see more risk in initial transaction (where all data can be intercepted) than in storing (where the information is not enough to authorize payment). – AGrzes Jun 5 '14 at 21:53
  • In the US, debit cards usually require the PIN number to be entered at point-of-sale terminals. An on-line merchant would probably need to have the card information (number, expiry date, etc) and the PIN number stored in order to use the data in a later transaction. You may feel very comfortable having all this information saved on the merchant's website, but the merchant is protecting himself by refusing to save all this data on his web site. What if his site is hacked? Interception of your number in transit to the web site is less likely than hacking or employee fraud. – Dilip Sarwate Jun 6 '14 at 1:54
  • @Dilip who uses debit card pin with online transactions? No-one. In the US - online transactions with debit card are treated (by the merchants) exactly the same as online transactions with credit cards. – littleadv Jun 6 '14 at 6:44
1

From a security perspective, once you give that information to a merchant, they can do whatever they like with it, including leak it to malicious actors.

Typically, a reputable, security-conscious merchant will not store the actual card data. The merchant provides card data to their payment processor, who returns a token. The token is then used for subsequent transactions but doesn't contain the credit card number or other data.

Example reading: http://community.developer.authorize.net/t5/The-Authorize-Net-Developer-Blog/Tokenization-101-with-CIM-and-CRE-Secure/ba-p/22911

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.