Are you shopping online safely?

I am satisfied that using a credit card to make a purchase by telephone is fairly safe if use of the keypad to enter the codes is enabled, but paying with a credit card on a speech-only method is risky. I am surprised more companies don not have keypad data-entry systems for taking payments by phone.

This comment was removed at the request of the user

I have had 2 disputes raised with Paypal and both times they sided with the seller. I did win both eventually, but now would only use Paypal as a last resort.

I only had one issue with a seller on PayPal, and was eventually refunded in full but I agree; I don’t like using them and always attempt to avoid them.

Thanks alfa, those all sound like sensible precautions.

Excellent, Alpha. W? could use that list and feature it on the site alongside the original article.

…………and a definitive thumbs up from me alpha!

alfa – are you saying that you card issuer has re-issued the card with a new expiry date and its existing number, and that PayPal have either been notified of this, or have discovered it off their own bat?

I have re-read your comment, Alfa, and realised I had misinterpreted it.

I see now that this is not about a credit card issued by PayPal but a credit card from a different card issuer that you have registered with PayPal for payments. As you say, how did they get hold of your new expiry date? Presumably they would not have any reason to know your new three-digit security code as that should be encrypted and only used during the payment process for reconciliation with the card issuer.

If I were you I would de-register the card with PayPal.

I am suspicious of any auto-renewals and dislike continuing payment authorities.

PayPal have ‘discovered’ the expiry date for themselves from the card issued by my bank.

There is a chance that all cards from that source have the same length of time added to them until the next expiry date I suppose.

I need to log into PayPal and look at my account. I think the last time I used PP was over 3 years ago and I will probably have to go through the rigmarole of forgotten passwords.

There is no login link from the email which you would expect to find if it was a scam.

I will also check with my bank and hear what they have to say about it.

The three-digit security code is a good point John. It has changed so how would PayPal know what it is? Unless PayPal don’t actually check security codes.

I have just done a quick research on the card security code.

http://uk.creditcards.com/credit-card-news/three-digit-security-code-explained.php
The card verification code was designed to prevent card-not-present fraud (usually via online purchases) by requesting customers to provide an extra verification code apart from the card’s number, holder and expiry date,” Liviu Arsene, senior e-threat analyst at anti-virus software firm Bitdefender, said in response to emailed questions.

Retailers are not allowed to store CSCs on their systems, which means cybercriminals who hack into company databases and steal payment information cannot access them. In theory, this makes it harder for thieves to use your card, even if they’ve stolen other personal information. CSCs are also never transmitted during physical “card present” purchases, making it difficult for card skimmers to collect them.

So I can only assume they guessed the new expiry date. I still need to follow this up though.

I think the CVC system is a good security feature so long as –
(a) the card-holder never writes the number down [and especially not in proximity to the card number],
(b) the card never falls into the hands of a third party [as in a restaurant],
(c) the CVC is encrypted in any on-line order so is not visible to any employee of the company fulfilling the order or by any other party, and
(d) the CVC is never given when making a telephone payment – in my experience it is usually requested but I don’t know why they need it for telephone ordering because they already have plenty of other personal information [like name and delivery address] for authenticating the order, and in any case – unlike with an instant or immediate service – there is always a fulfilment period during which time the payment transaction can be verified and confirmed.

The issue of a new CVC on renewal of the card is also an added protection but I would prefer shorter validity periods as well. I think some of my cards are valid for four years or longer.

I assume that the CVC’s are not incorporated into the chip on the credit card.

The absence of the log-in link in your e-mail is a good sign of authenticity and protection. It is not unknown for e-mails to be forwarded to other people either unintentionally, or on purpose but carelessly.

I suspect that a certain amount of credit card fraud is facilitated by corrupt employees in call-centres or customer service roles who can acquire full card details including the CVC by writing down the information before typing it into the computer. I have no idea whether there are any checks to prevent this.

When I first received a credit card [an unsolicited “Access” card in about 1973] there were virtually no personal computers and all goods ordered by telephone using a card had to be delivered to the billing address for that card, so half these problems did not arise.

I have called my bank and apparently some companies do automatically update your card details for you. Amazon is another one that does it.

I forgot to ask about the CVC. Paypal do not know the new code so maybe I would get asked for it the first it was used.

I suppose they would only need the code the first time the card was used to validate it. There again, wouldn’t it be needed for every transaction?

They recommend deleting the card from my PayPal account.

I believe the CVC is the only thing that has to entered manually for every purchase the remainder of the personal data being stored if the payment card has been registered [although the option not to register a card should also be available]. Many people also enable their computer to store their log-in details and password. Those who do that should definitely have a separate password for every account.