information:classification
Security

Credit card security relies on the physical security of the plastic card as well as the privacy of the credit card number. Therefore, whenever a person other than the card owner has access to the card or its number, security is potentially compromised. Once, merchants would often accept credit card numbers without additional verification for mail order purchases. It is now common practice to only ship to confirmed addresses as a security measure to minimize fraudulent purchases. Some merchants will accept a credit card number for in-store purchases, whereupon access to the number allows easy fraud, but many require the card itself to be present and require a signature (for magnetic stripe cards). A lost or stolen card can be cancelled, and if this is done quickly, will greatly limit the fraud that can take place in this way. European banks can require a cardholder's security PIN be entered for in-person purchases with the card.

The Payment Card Industry Data Security Standard (PCI DSS) is the security standard issued by the Payment Card Industry Security Standards Council (PCI SSC). This data security standard is used by acquiring banks to impose cardholder data security measures upon their merchants.

The goal of the credit card companies is not to eliminate fraud, but to "reduce it to manageable levels". This implies that fraud prevention measures will be used only if their cost is lower than the potential gains from fraud reduction, whereas high-cost low-return measures will not be used – as would be expected from organizations whose goal is profit maximization.

Internet fraud may be committed by claiming a chargeback which is not justified (" friendly fraud "), or carried out by the use of credit card information which can be stolen in many ways, the simplest being copying information from retailers, either online or offline. Despite efforts to improve security for remote purchases using credit cards, security breaches are usually the result of poor practice by merchants. For example, a website that safely uses TLS to encrypt card data from a client may then email the data, unencrypted, from the webserver to the merchant; or the merchant may store unencrypted details in a way that allows them to be accessed over the Internet or by a rogue employee; unencrypted card details are always a security risk. Even encrypted data may be cracked.

Controlled payment numbers (also known as virtual credit cards or disposable credit cards) are another option for protecting against credit card fraud where the presentation of a physical card is not required, as in telephone and online purchasing. These are one-time use numbers that function as a payment card and are linked to the user's real account, but do not reveal details, and cannot be used for subsequent unauthorized transactions. They can be valid for a relatively short time, and limited to the actual amount of the purchase or a limit set by the user. Their use can be limited to one merchant. If the number given to the merchant is compromised, it will be rejected if an attempt is made to use it a second time.

A similar system of controls can be used on physical cards. Technology provides the option for banks to support many other controls too that can be turned on and off and varied by the credit card owner in real time as circumstances change (i.e., they can change temporal, numerical, geographical and many other parameters on their primary and subsidiary cards). Apart from the obvious benefits of such controls: from a security perspective this means that a customer can have a Chip and PIN card secured for the real world, and limited for use in the home country. In this eventuality, a thief stealing the details will be prevented from using these overseas in non-chip and pin EMV countries. Similarly, the real card can be restricted from use online so that stolen details will be declined if this is tried. Then when card users shop online they can use virtual account numbers. In both circumstances, an alert system can be built in notifying a user that a fraudulent attempt has been made which breaches their parameters, and can provide data on this in real-time.

Additionally, there are security features present on the physical card itself in order to prevent counterfeiting. For example, most modern credit cards have a watermark that will fluoresce under ultraviolet light. Most major credit cards have a hologram. A Visa card has a letter V superimposed over the regular Visa logo and a MasterCard has the letters MC across the front of the card. Older Visa cards have a bald eagle or dove across the front while older MasterCard cards have two circles (Venn diagram) with continents on it. In the aforementioned cases, the security features are only visible under ultraviolet light and are invisible in normal light.

In the United States, the United States Department of Justice, United States Secret Service, Federal Bureau of Investigation, U.S. Immigration and Customs Enforcement, and U.S. Postal Inspection Service are responsible for prosecuting criminals who engage in credit card fraud. However, they do not have the resources to pursue all criminals, and in general they only prosecute cases exceeding $5,000.

Three improvements to card security have been introduced to the more common credit card networks, but none has proven to help reduce credit card fraud so far. First, the cards themselves are being replaced with similar-looking tamper-resistant smart cards which are intended to make forgery more difficult. The majority of smart card (IC card) based credit cards comply with the EMV (Europay MasterCard Visa) standard. Second, an additional 3 or 4 digit card security code (CSC) or card verification value (CVV) is now present on the back of most cards, for use in card not present transactions. Stakeholders at all levels in electronic payment have recognized the need to develop consistent global standards for security that account for and integrate both current and emerging security technologies. They have begun to address these needs through organisations such as PCI DSS and the Secure POS Vendor Alliance.