4 ms·
One thing to note is that payment systems are never supposed to store the CVC number, so a data breach shouldn't include that number if the vendor does things c
by martin-adams 4y ago
One thing to note is that payment systems are never supposed to store the CVC number, so a data breach shouldn't include that number if the vendor does things correctly. This does make it slightly different to being a 'longer card number'.
In the UK, they also have additional verification steps, which can cause some issue when they go async to a payment system that expects to get a verification immediately.
I've had Apple take payment twice because the 2FA verification text took too long to come through from a phone order for collection and I ended up buying the item in the store.
- rr888 4y agoI've had a bunch of restaurants secure reservations with cc numbers and CVC in a big book. I guess their tech auditors didn't pick up that risk.
- PeterisP 4y agoI'd assume that for such restaurants there are no auditors, they would do 'self-certification' where they fill out a questionnaire where they assert that they are not doing anything like this. The consequence is that if the data is leaked (finding 'common point of purchase' is sometimes done for sets of fraud) they can become fully liable for the cost of fraud because of this lie in self-certification, otherwise it would generally fall on the receiving merchant.
- DennisP 4y agoA few years ago I read a book about a prolific CC hacker, which said restaurants were the worst for CC security. It wasn't unusual for them to store CC numbers with CVC on easily-hacked computers. The hacker would target common restaurant software and just snarf up the numbers remotely.