3 ms·
Indeed, we need a ticket system for custom tokens per merchant. So instead of actually putting in the credit card number, you put in a token (very similar to a
by drawkbox 13y ago
Indeed, we need a ticket system for custom tokens per merchant. So instead of actually putting in the credit card number, you put in a token (very similar to an oauth type token).
If say for instance the token you gave to Adobe gets stolen, you or they just disable all tokens or ask for new tokens.
So not only will fraud be more difficult but merchants also will be known who has been compromised. Right now banks won't always tell you what merchant was compromised and causing you to get a new number/card.
New payment systems have this, for instance stripe is built similar to this.
Why do people have to update all their cards with all their merchants after one fails? Getting multiple cards and internet cards sometimes helps compartmentalize but really we need this at least per merchant.
Some banks have this like Bank of America ShopSafe but it should be the new normal.
- mmanfrin 13y agoThis is actually how a lot of merchants work -- they send CC info to a bank or processor, and get back a token they can use to charge that CC (without having to store CC information). Why Adobe didn't utilize this is beyond me.
- iriche 13y agoAnd what do you do when the payment provider you use sucks, and you want to move to a new one? Oh right! Every existing customer have to sign up again, and input the same info again. That's the reason to aim for PCI compliance your self.
- jarito 13y agoThis isn't really true anymore. Most major tokenization providers also provide a way to transfer data from one provider to the next. I'm sure they aren't happy about the idea, but most of them recognize that lock-in is a reason people don't use their services.
- iriche 13y agoThen I need to investigate if our payment provider provides this service :)