Merchant Asks Customer For Scanned Picture Of Credit Card - Standard Practice?

[Fabian Tan]

Just got asked by a web host provider to provide a scanned copy of the front and back of my credit card because they take a 'serious view of fraud'.

I'm getting a virtual private server from the host, by the way.

Question: is this standard practice?

Fabian

[WorldIR]

first time heard of this practise before ?

[Rus Sells]

I have never been asked by a merchant to provide a scanned copy of my CC. I've been purchasing online for almost 10 years now so yeah. If they take fraud seriously all they need to know is a little more information like billing address or zip code. People with stolen cards or numbers are less likely to know this information.

PS: But if they've seen your forum avatar I can see why they might ask you to scan it. :P

[n7 Studios]

It's not standard practice, and sounds (sorry - most likely IS) a con.

Why would having a scanned photocopy of a credit card prevent fraud from their perspective? You could have just as easily stolen the credit card, and photocopy it for them. You're still committing fraud, and they're no better off.

Who is the web host in question here?

(I'm not suggesting that you would steal credit cards, by the way!)

[Kenneth Fox]

Fabian,

I know quite a few hosting services that ask
for this info on VPS and dedicated server orders.

Usually on shared hosting, hosting providers won't
request this.

It could also be location request. You are from a
country outside of the US (assuming it's a US host
you are dealing with).

Those could be a couple possible reasons for this request.

[Chris Kent]

What does a scan prove that the numbers, name and CVC won't already?

And do they have a secure upload facility or php public key? Email is not secure and neither is a password on a zip file.

[Bungee]

Fabian
I have been asked for this before.

[Kenneth Fox]

Originally Posted by ProductCreator

What does a scan prove that the numbers, name and CVC won't already?

And do they have a secure upload facility or php public key? Email is not secure and neither is a password on a zip file.

Most online credit card fraud comes from cc numbers, names and cvs provided by various online hacker and scam sites. By requesting a scan of the physical credit card, you get rid of 99% of possible cc fraud because most scammers do not have the physical card.

Usually companies that request this info ask for a document to be faxed.

[Fabian Tan]

Thanks Kenneth. I remember a few times when I was still a hotel intern that sometimes customers send in faxed copies of credit cards.

What is dangerous here is that I have passed over copies of my identification card as well, with the address on it. This could pose problems if both the copies of the credit card and identification card end up in the wrong hands.

Bottom line: I don't like the idea of sending over scanned copies of my credit card at all.

Fabian

[artwebster]

I can understand a scan of the front of the card to prove possession but the back of the card, unless you cover it up, gives your security code. Since you can't have the back of the card without the front, what extra service does the back provide except a risk that the two scanned copies be stolen and the card miss-used?

[Kenneth Fox]

Originally Posted by Fabian Tan

Bottom line: I don't like the idea of sending over scanned copies of my credit card at all.

Fabian

I hear ya and I'm sure the companies that require this wish
that cc fraud was not that big of an issue where they had to put these
rules into place.

When you think about it, there's probably less chance of your info
getting in the wrong hands compared to the waiter you handed your
card to that has a drug addiction to fund and now has your cc info.

But seriously, there are a number of credit cards that totally protect
you against online fraud so maybe look into those as well.

[Chris Kent]

Originally Posted by Kenneth Fox

Most online credit card fraud comes from cc numbers, names and cvs provided by various online hacker and scam sites. By requesting a scan of the physical credit card, you get rid of 99% of possible cc fraud because most scammers do not have the physical card.

Usually companies that request this info ask for a document to be faxed.

Yes but that's the whole point. If you have this info already, then Photoshop is all you need. A scan of a card doesn't prove anything and is a considerable risk.

[Chris Kent]

Originally Posted by Fabian Tan

Thanks Kenneth. I remember a few times when I was still a hotel intern that sometimes customers send in faxed copies of credit cards.

What is dangerous here is that I have passed over copies of my identification card as well, with the address on it. This could pose problems if both the copies of the credit card and identification card end up in the wrong hands.

Bottom line: I don't like the idea of sending over scanned copies of my credit card at all.

Fabian

I'd bet that the bank wouldn't protect you if fraud were to happen either. Banks only protect you if you haven't been stupid. For example, if you keep your pin in your wallet with your ATM card then your bank will not cover any fraud if your card is stolen.

[Black Hat Cat]

Originally Posted by ProductCreator

I'd bet that the bank wouldn't protect you if fraud were to happen either. Banks only protect you if you haven't been stupid. For example, if you keep your pin in your wallet with your ATM card then your bank will not cover any fraud if your card is stolen.

Credit cards are treated differently than ATM cards. Not sure your ATM card scenario is correct either. It certainly doesn't apply to every bank.

As for the original poster's dilemma, just go somewhere else. There are plenty of companies out there that offer hosting services. I'm sure you can easily find one that doesn't have this requirement. I wouldn't fax them this information.

[Mike Hill]

If I were you I would call the credit card company and tell them what has been requested of you and see what they have to say about it. If it's against their policies or deviate from their Standard Operating Procedures then you might just save yourself some trouble later on.

Mike Hill

[Chris Lockwood]

Originally Posted by ProductCreator

Banks only protect you if you haven't been stupid. For example, if you keep your pin in your wallet with your ATM card then your bank will not cover any fraud if your card is stolen.

It would be pretty stupid to tell them you had the PIN there, wouldn't it? How else would they know?


As for the original post, I'd be looking for another host. I've spent a lot online and have never been asked for this. If I didn't need it for a $2000 purchase, why would they need it for hosting?

I'm surprised they have any customers if that is their policy.

I've also worked in an office where sensitive faxes came in (tax returns with SSNs and other things you wouldn't want disclosed), and it was appalling how casually those pieces of paper were treated.

[Thomas Belknap]

I normally ask for dna samples when selling my products. I haven't lost a charge back since. Of course, I haven't made any sales to worry about it.

[Michael Silvester]

Originally Posted by Thomas Belknap

I normally ask for dna samples when selling my products. I haven't lost a charge back since. Of course, I haven't made any sales to worry about it.

hahahaha...Yeh its so hard to send a swab overseas
without the evidence being contaminated.

Thomas, is there a way that I can prove my identity
by providing any other bodily fluids

Take Care,

Michael Silvester

[Thomas Belknap]

Originally Posted by Michael Silvester

hahahaha...Yeh its so hard to send a swab overseas
without the evidence being contaminated.

Thomas, is there a way that I can prove my identity
by providing any other bodily fluids

Take Care,

Michael Silvester

How far can you spit?

[David McGimpsey]

I remember when I first signed up with Hostgator they asked for this.

They gave me the option of providing a scanned copy of my credit card plus "other ID" or calling them to verify my account.

I called them because I didn't want to make a scan copy of my credit card.

[Jeff Henshaw]

If I were you I would call the credit card company and tell them what has been requested of you and see what they have to say about it. If it's against their policies or deviate from their Standard Operating Procedures then you might just save yourself some trouble later on.

I agree 100% with this advice.

If you are in any doubt - find another potential host, but if this has happened to you previously in regard to other purchases - find another card provider.

There seems to be ever more hosting providers and ever more card providers out there these days, despite the recession!

I hope that everything works out for you.

Regards,
Jeff.

[Chris Kent]

Originally Posted by Chris Lockwood

It would be pretty stupid to tell them you had the PIN there, wouldn't it? How else would they know?

You miss the point - what I'm saying is that if you do something dumb, security-wise, then you may have no recourse in the event of fraud.

[Chris Kent]

Originally Posted by David McGimpsey

I remember when I first signed up with Hostgator they asked for this.

They gave me the option of providing a scanned copy of my credit card plus "other ID" or calling them to verify my account.

I called them because I didn't want to make a scan copy of my credit card.

Wow, I never had that. Was there a reason for it? Because you live in Japan??

[haohaowan2]

i would be careful proceeding

[Bev Clement]

It happens all the time for people who don't live in the US or UK. I had to provide both sides plus a copy of my passport to Hostgator before I could get hosting with them.

I have had to do it for a number of companies, normally because of being in the Far East with a bank account in the UK.

In the 18 months + since I did it for Hostgator no problems at all.

Fact of doing business outside the US or UK.

[SeanSupplee]

DONT DO IT they do not need that information. If they have it they now have your CC number your signature, your name and your security code. Everything they need to use the CC online to buy something.
They want your business they can do without this information or find a different hosting company

[David McGimpsey]

Originally Posted by ProductCreator

Wow, I never had that. Was there a reason for it? Because you live in Japan??

The only thing I can think of is that it was because it was an Australian issued card and my address is Japan.