That might depend on a payment processor service. E.g., when a charge is made, the payment processor returns a unique ID for the transaction. Then, if the merch

That might depend on a payment processor service. E.g., when a charge is made, the payment processor returns a unique ID for the transaction. Then, if the merchant decides to give a refund, they put through a transaction that references the sale by its ID, and the payment processor then credits the appropriate piece of plastic with the desired amount. Nothing for a hacker to steal, unless they compromise the payment processor. >Both features are possible without actually storing the card number; one-way hashes to do the receipt lookup, and tokens to do the refund, but how likely is that? There is a company, Shift4† ($-sign on a US keyboard, get it?), who provide credit card processing service to smaller merchants. Shift4 itself is not a payment processor. Rather, it provides an intermediate layer standing between the merchant and the payment processor(s). A prominent feature of its service offering is tokenization: the ability to refer indirectly and opaquely to specific transactions and card accounts. It removes the need for the merchant to store card details. Shift4's tokens give the merchant a way to refer to past transactions and card accounts without having to store card details. †http://shift4.com/ http://shift4.com/