3 ms·

That was obviously the problem. It was the first thing I thought of. But if one of the answers on SE is to be believed, this bug has uncovered a serious securi

by teilo 8y ago

That was obviously the problem. It was the first thing I thought of. But if one of the answers on SE is to be believed, this bug has uncovered a serious security concern. A person who also claims to work at Booking.com said that they do not charge cards, but pass them onto the booking hotel. If true, that's incredibly dangerous. Anyone who has gone through PCI-DSS compliance knows that the cardinal rule of CVC codes is that they are never to be stored. They are to be used to charge or pre-auth the card, and immediately discarded.

rosbrith 8y ago
It is usual practice to pass on payment details to a hotel rather than the booking agent charging the cards themselves. This can be compatible with PCI-DSS when details are tokenised and stored with a third party.
avar 8y ago
I think your experience is correct as far as it goes, but many people who've dealt with PCI-DSS have only done so in the context of companies where the delay between pre-authorization and post-authorization is seconds, e.g. some online merchant where you immediately charge the card. During this period you can store the CVC, and in some industries, such as accommodation, that time can be weeks/months. E.g. standard practice in some hotels is to store this information at check-in and charge on check-out. This blog two-part blog series is enlightening: https://pciguru.wordpress.com/2018/01/27/pre-authorization-and-post-authorization-part-1/ https://pciguru.wordpress.com/2018/01/27/pre-authorization-a... https://pciguru.wordpress.com/2018/02/17/pre-authorization-and-post-authorization-part-2/ https://pciguru.wordpress.com/2018/02/17/pre-authorization-a... And here's Booking.com's official documentation for partners showing that they can access the guest's CVC code (once): https://partnerhelp.booking.com/hc/en-gb/articles/360000764307 https://partnerhelp.booking.com/hc/en-gb/articles/3600007643...
- teilo 8y ago
  Thanks for that.

by teilo 8y ago

rosbrith 8y ago

It is usual practice to pass on payment details to a hotel rather than the booking agent charging the cards themselves. This can be compatible with PCI-DSS when details are tokenised and stored with a third party.

avar 8y ago

I think your experience is correct as far as it goes, but many people who've dealt with PCI-DSS have only done so in the context of companies where the delay between pre-authorization and post-authorization is seconds, e.g. some online merchant where you immediately charge the card. During this period you can store the CVC, and in some industries, such as accommodation, that time can be weeks/months. E.g. standard practice in some hotels is to store this information at check-in and charge on check-out. This blog two-part blog series is enlightening: https://pciguru.wordpress.com/2018/01/27/pre-authorization-and-post-authorization-part-1/ https://pciguru.wordpress.com/2018/01/27/pre-authorization-a... https://pciguru.wordpress.com/2018/02/17/pre-authorization-and-post-authorization-part-2/ https://pciguru.wordpress.com/2018/02/17/pre-authorization-a... And here's Booking.com's official documentation for partners showing that they can access the guest's CVC code (once): https://partnerhelp.booking.com/hc/en-gb/articles/360000764307 https://partnerhelp.booking.com/hc/en-gb/articles/3600007643...

teilo 8y ago
Thanks for that.