4 ms·
Note that in the case of Stripe, the site doesn't hold onto "financial information" per se - they hold onto tokens where Stripe is the holder of the information
by vertex-four 10y ago
Note that in the case of Stripe, the site doesn't hold onto "financial information" per se - they hold onto tokens where Stripe is the holder of the information, and they can't access the card number or CVV after it's been sent to Stripe - so all fraudulent transactions would have to be requested through that Stripe account.
- hdhzy 10y agoThey shouldn't have access to card number and CVV either way because usually they are not PCI-DSS certified. Stripe handles that in an iframe (requirement of PCI). CVV cannot be stored at all even by Stripe.