credit card information processing
a friend of mine is making a project on airline reservation system through mobile here is the basic idea.
1. A customer open a web site and fills a registration form in which he gives his credit card info. and mobile with other info like name and address.
2. if the credit card info provided by that user is valid he is given a 3 digit PIN and his credit card info is saved in database of that site.
3.when he wants to make a reservation he has to send a sms to a pertivular number this SMS include 3 digit pin and details of flight and so on.
A perticular user can only make a reservation from his mobile number only(for security reasons).
the question is can a perticular web site store users credit card info in its database?
I mean is there any law about it?
If not then can that site claim to be secure ?
i mean if credit card information is stored in there database then they can't be secure can they?
And if i am right what changes can be made in this project?
Re: credit card information processing
Quote:
2. if the credit card info provided by that user is valid he is given a 3 digit PIN and his credit card info is saved in database of that site.
...
the question is can a perticular web site store users credit card info in its database?
I mean is there any law about it?
some companies store your CC number for a small time (those that cant do the transaction on real time with CC company) but store it for ever isnt a good idea. And CC company will need also that 3 CVV to complete transaction. So, if someone stole that info, it will be hard to the customer to deny....
the SMS idea sounds good, but im not sure that is a safe way to do transactions. can it be intercepted? i think that someone can get the sms message, clone your cel phone and buy 1,000 tickets to China....
Re: credit card information processing
Quote:
Originally posted here by littlenick
the question is can a perticular web site store users credit card info in its database?
They can and do.
Quote:
I mean is there any law about it?
That is probably locality-specific.
Quote:
If not then can that site claim to be secure ?
i mean if credit card information is stored in there database then they can't be secure can they?
It is reasonable for customers of a site which collects credit card information to assume that the site has adequate security against any security compromise. A security compromise would allow an attacker to collect CC numbers, whether they are stored in a database or not.
Quote:
And if i am right what changes can be made in this project?
Many payment service providers allow you to use an API to make repeat purchases from a card without needing to store its details in your own database. In fact, they do this by storing the CC details on your behalf.
Ask your PSP whether they support this feature and integrate with it. Then you can do what your want without storing the details.
Slarty