Payment taken without authorisation.. kind of
Discussion
Not sure if this is really a finance question or an SPL one as it sits in the grey area between...
I recently used some airport parking and was given the to set one card as a payment card, and another as an entry card, so since it was for work I set my business card as the payment and my personal for entry. At the this time a small booking fee was taken from the business card - no problem there.
However, when I used the parking (using my personal card to identify me at entry and exit), the fees for the parking were billed to my personal card rather than the business one. During booking, the details given for this card were the 16 digit number, name and expiry date. No security number was provided, and no explicit authority was given to debit money from this card (I've not found anything in the t&c's to suggest this would/could happen either).
I was quite surprised, as I'd assumed these days that a physical payment would require either a pin or signature, and a cardholder not present would need a PIN. I queried this with my bank and they suggested the payment was made as a "recurring payment". If payments can be made this way it makes a complete mockery of the alleged security systems as all you'd need its a picture of the front of the card to make payments...
I will check the complete booking process for any suggestion payment could be taken this way when I use it again this weekend, but assuming there is nothing there where does PH think the fault lies? The car park company for using the wrong card, or the bank/visa/payment process for accepting a transaction with incomplete data? (For clarity, the company have never had any more info from that card, so the recurring payment was set up without any security verification at any time)
I recently used some airport parking and was given the to set one card as a payment card, and another as an entry card, so since it was for work I set my business card as the payment and my personal for entry. At the this time a small booking fee was taken from the business card - no problem there.
However, when I used the parking (using my personal card to identify me at entry and exit), the fees for the parking were billed to my personal card rather than the business one. During booking, the details given for this card were the 16 digit number, name and expiry date. No security number was provided, and no explicit authority was given to debit money from this card (I've not found anything in the t&c's to suggest this would/could happen either).
I was quite surprised, as I'd assumed these days that a physical payment would require either a pin or signature, and a cardholder not present would need a PIN. I queried this with my bank and they suggested the payment was made as a "recurring payment". If payments can be made this way it makes a complete mockery of the alleged security systems as all you'd need its a picture of the front of the card to make payments...
I will check the complete booking process for any suggestion payment could be taken this way when I use it again this weekend, but assuming there is nothing there where does PH think the fault lies? The car park company for using the wrong card, or the bank/visa/payment process for accepting a transaction with incomplete data? (For clarity, the company have never had any more info from that card, so the recurring payment was set up without any security verification at any time)
I can't help on the specifics, but are you sure they used the card number etc to take payment, rather than the actual card when you entered it into the machine?
I recently bought a parking ticket in Iceland (the country, not the shop) by just putting my UK credit card into the machine and pressing a button - no pin or signature etc needed - so it must be possible - just not done very often.
EDIT - A CVV code isn't always required for customer not present - Amazon don't ask for a CVV and yet they still manage to charge me ok.
I recently bought a parking ticket in Iceland (the country, not the shop) by just putting my UK credit card into the machine and pressing a button - no pin or signature etc needed - so it must be possible - just not done very often.
EDIT - A CVV code isn't always required for customer not present - Amazon don't ask for a CVV and yet they still manage to charge me ok.
Jakg said:
I can't help on the specifics, but are you sure they used the card number etc to take payment, rather than the actual card when you entered it into the machine?
I recently bought a parking ticket in Iceland (the country, not the shop) by just putting my UK credit card into the machine and pressing a button - no pin or signature etc needed - so it must be possible - just not done very often.
EDIT - A CVV code isn't always required for customer not present - Amazon don't ask for a CVV and yet they still manage to charge me ok.
I don't know when they took the data for the payment, but there is certainly no "press ok to confirm" stage to it.I recently bought a parking ticket in Iceland (the country, not the shop) by just putting my UK credit card into the machine and pressing a button - no pin or signature etc needed - so it must be possible - just not done very often.
EDIT - A CVV code isn't always required for customer not present - Amazon don't ask for a CVV and yet they still manage to charge me ok.
I think i've had no pin or signature payments before, but always at levels much lower than the 70 euros this was. I need to book again today so i'll see if I can spot anything in the booking process and terms that suggests it would happen this way.
Presumably in the amazon case you've put all the details in previously and given them permission to store the data for future use?
egomeister said:
Presumably in the amazon case you've put all the details in previously and given them permission to store the data for future use?
You don't ever give Amazon the CVV details.http://security.stackexchange.com/questions/21168/...
Jakg said:
Very interesting, it shows how illusory much of the security isGassing Station | Finance | Top of Page | What's New | My Stuff