Full Disclosure mailing list archives

Re: Credit card numbers


From: Dan Stromberg <strombrg () dcs nac uci edu>
Date: 17 Jul 2003 11:57:11 -0700

On Thu, 2003-07-17 at 10:49, Myers, Marvin wrote:
Maybe it is only me, but does anyone else notice a big jump in the
number of merchants that are printing the entire credit card number
and expiration date on receipts?

Over the past 6 months I have had to educate about a dozen local
merchants about the possible abuse scenarios that exist with this type
of information leakage. If there

Is not already some sort of law governing this policy, there should
be.


I believe there's a patent on the idea of only listing four digits of a
credit card.  So yes, there's an actual financial incentive to do the
wrong thing.

A local grocery store was doing 8 digits for a while - before they went
out of business.  Another shows all of them - they seem to be doing
well.

Shredders are your friends.  But don't let that stop you from
complaining to the merchant in question.  Don't behead the person behind
the counter - but maybe ask them to relay a message to their manager.

On a related note, how do you get web vendors not to store your credit
card # on their hard disks longer than absolutely necessary?  I trust
(ssl data entry * number of orders) a lot more than a merchant's ability
to stay up to date on patches until my card expires.

-- 
Dan Stromberg DCS/NACS/UCI <strombrg () dcs nac uci edu>

Attachment: signature.asc
Description: This is a digitally signed message part


Current thread: