Handling E-Commerce Payments - Revision history

Shady: Further Reading

2013-05-12T18:06:28Z

KirstenS: /* Further Reading */

2009-03-01T23:35:44Z

‎Further Reading

KirstenS: /* Further Reading */

2009-03-01T23:35:34Z

‎Further Reading

KirstenS: /* Further Reading */

2009-03-01T23:35:22Z

‎Further Reading

KirstenS: /* Further Reading */

2009-03-01T23:34:28Z

‎Further Reading

KirstenS: /* Displaying portions of the credit card */

2009-03-01T23:31:56Z

‎Displaying portions of the credit card

KirstenS: /* Payment Card Handling Best Practices */

2009-03-01T23:29:31Z

‎Payment Card Handling Best Practices

KirstenS at 12:05, 19 August 2008

2008-08-19T12:05:47Z

KirstenS: /* Reference */

2008-08-19T12:05:12Z

‎Reference

John.wilander: /* Chargeback */

2007-11-15T09:42:17Z

‎Chargeback

@@ Line 201: / Line 201: @@
 <u>https://www.pcisecuritystandards.org</u>
-* PCI DSS 1.1
+PCI DSS Documents Library
-<u>https://www.pcisecuritystandards.org/tech/pci_dss.htm</u>
+<u>https://www.pcisecuritystandards.org/security_standards/documents.php</u>
 * Commercial database encryption products

@@ Line 205: / Line 205: @@
 <u>https://www.pcisecuritystandards.org/tech/pci_dss.htm</u>
-[[category:FIXME|link not working]]
+[[category:FIXME|link not working]]<br>
 Supporting Documents (Audit Guide, Annual Self Assessment doc, 1.0 to 1.1 changes, etc)

@@ Line 205: / Line 205: @@
 <u>https://www.pcisecuritystandards.org/tech/pci_dss.htm</u>
-[[category:FIXME|link not working]]Supporting Documents (Audit Guide, Annual Self Assessment doc, 1.0 to 1.1 changes, etc)
+[[category:FIXME|link not working]]
 <u>https://www.pcisecuritystandards.org/tech/supporting_documents.htm</u>

@@ Line 205: / Line 205: @@
 <u>https://www.pcisecuritystandards.org/tech/pci_dss.htm</u>
-Supporting Documents (Audit Guide, Annual Self Assessment doc, 1.0 to 1.1 changes, etc)
+[[category:FIXME|link not working]]Supporting Documents (Audit Guide, Annual Self Assessment doc, 1.0 to 1.1 changes, etc)
 <u>https://www.pcisecuritystandards.org/tech/supporting_documents.htm</u>

@@ Line 199: / Line 199: @@
 Payment Card Industry (PCI) Data Security Standards council
-<u>https://www.pcisecuritystandards.org/index.htm</u>
+<u>https://www.pcisecuritystandards.org</u>
 * PCI DSS 1.1

@@ Line 145: / Line 145: @@
 '''You must not store the CCV, CCV2 and PVV (or PIN Verification Value).''' These are a credit card validation field used by many payment gateways to protect against imprint fraud as the value is on the reverse of the card.  Storing this value is not allowed as per sections 3.2.3 and 3.4.
-* For online forms, you must use a "password" type field for CCVs to provide some protection against shoulder-surfing.  Some browsers can not tell the difference between this and a login form, and will offer to remember the details.  This is not good, because it interrupts the checkout process and many users click "Yes" without thinking and thus violate their card holder agreement.  Adding ''autocomplete="off"'' to the form tag will prevent many browsers from doing this.
+* For online forms, you must use a "password" type field for CCVs to provide some protection against shoulder-surfing.  Some browsers cannot tell the difference between this and a login form, and will offer to remember the details.  This is not good, because it interrupts the checkout process and many users click "Yes" without thinking and thus violate their card holder agreement.  Adding ''autocomplete="off"'' to the form tag will prevent many browsers from doing this.
 For these reasons, it is strongly recommended that you do not present the user or your staff with open or obscured credit card numbers. If possible, do not to display any digits of a credit card at all – just the expiration date.

@@ Line 77: / Line 77: @@
 === Payment Card Handling Best Practices ===
-The PCI DSS 1.1 restricts which card data elements can and can not be stored. While the ultimate guide is the PCI DSS document, card handling best practices are summarized below, along with guidelines for implementing the requirements.
+The PCI DSS 1.1 restricts which card data elements can and cannot be stored. While the ultimate guide is the PCI DSS document, card handling best practices are summarized below, along with guidelines for implementing the requirements.
 Following is a summary of Payment Card elements which can, and can't be stored:

← Older revision		Revision as of 12:05, 19 August 2008
Line 1:		Line 1:
−	[[Guide Table of Contents]]	+	[[Guide Table of Contents\|Development Guide Table of Contents]]
	__TOC__		__TOC__

@@ Line 225: / Line 225: @@
 ==Reference==
-[[Guide Table of Contents]]
+[[Guide Table of Contents|Development Guide Table of Contents]]
 [[Category:OWASP_Guide_Project]]

@@ Line 167: / Line 167: @@
 ===Chargeback ===
-A chargeback is a credit card transaction that is billed back to the merchant after the sale has been settled - chargebacks are initiated by the card issuer on behalf of the cardholder. Typically, cardholder disputes involve product delivery failure or product/service dissatisfaction.
+A chargeback is a credit card transaction that is billed back to the merchant after the sale has been settled - chargebacks are initiated by the card issuer on behalf of the card holder. Typically, card holder disputes involve product delivery failure or product/service dissatisfaction.
-Card issuers and merchant banks take a dim view of merchants with a high charge back ratio as it costs them a lot of time and money and can indicates a lack of fraud controls.
+Card issuers and merchant banks take a dim view of merchants with high charge back ratios as it costs them a lot of time and money and might indicate lack of fraud control.
-You can take some simple steps to lower your risk. These are:
+You can take some simple steps to lower your risks. These are:
 * Money is not negative.  Use strong typing to force zero or positive numbers, and prevent negative numbers.
-* Don't overload a charge function to be the reversal by allowing negative values.
+* In your source code, don't overload a charge function to be a reversal function by allowing negative values.
-* All charge backs and reversals require logging, auditing, and manual authorization.
+* Require logging, auditing, and manual authorization for all charge backs and reversals.
-* There should be no code on your web site for automating reversals or charge backs
+* There should be no code on your web site for automating reversals or charge backs.
-* Don't ship goods until you have an authorization receipt from the payment gateway
+* Don't ship goods until you have an authorization receipt from the payment gateway.
-* The overwhelming majority of credit cards have a strong relationship between BIN numbers and the issuing institution's country.  Strongly consider not shipping goods to out-of-country BIN cards
+* The overwhelming majority of credit cards have a strong relationship between BIN numbers and the issuing institution's country. Strongly consider not shipping goods to out-of-country BIN cards.
-* For high value goods, consider making the payment an over-the-phone or fax authority.
+* For high value goods, consider making the payment with an over-the-phone or fax authorized process.
-Some customers will try charge backs one time too many.  Keep tabs on customers who charge back, and decide if they present excessive risk
+Some customers will try charge backs one time too many. Keep tabs on customers who charge back, and decide if they present excessive risk.
-Always ask for the customer's e-mail and phone number that the issuing institution has for the customer.  This helps if other red flags pop up.
+Always ask for the customer's email as well as the phone number that the issuing institution has for the customer. This helps if other red flags pop up.
-Attackers look for soft targets.  Make it known on your website that you prosecute fraud to the fullest extent of the law and all transactions are fully logged.
+Attackers look for soft targets. Make it known on your website that you prosecute fraud to the fullest extent of the law and all transactions are fully logged.
 ==Further Reading ==