Need to purchase but site appears insecure

Forums › Off topic › Need to purchase but site appears insecure

wombus

95 posts

Master Geek

# 183832 31-Oct-2015 14:30

My wife has had 2 issued credit cards used fraudulently recently, and looking into her purchasing history I suspect her purchases made here at svgcuts.com are the most likely point of compromise. As a good citizen I have just emailed them and asked them to check and implement higher levels of security, no padlock and warnings regards security on their site.

However in the short term this does not fix my immediate issue, as my wife needs to promptly purchase some more Christmas designs from Svgcuts or the world will apparently end. Basically she has told me she has to have them very soon and for me to just make it happen. As far as I know this is original material not available elsewhere and suspect they are based in USA, arts and crafts people are I suspect very trusting and would know very little regards payment gateways so not expecting a fix anytime soon.

If I could manually organise payment with them what would be the best way to get the payment transfer over to them? We are only talking very small dollar amounts, is Paypal an option as Ive never used it before?

freitasm

BDFL - Memuneh
64976 posts

Uber Geek

Administrator

Trusted

Geekzone

Lifetime subscriber

# 1417707 31-Oct-2015 14:37

The site certainly uses SSL - the padlock is not showing because it uses an old version of encryption protocol. In any case a padlock only guarantees encryption between your browser and their servers.

Even if you visit another site with a nice green padlock, this still does not guarantee they don't have someone inside stealing credit card information. It also doesn't guarantee they are using good practices when storing credit card and customer information.

In other words, I am not sure this site you point out is the culprit - it could be any other site really.

A good site to check if an email account or username has been involved in a breach is https://haveibeenpwned.com/.

freitasm

BDFL - Memuneh
64976 posts

Uber Geek

Administrator

Trusted

Geekzone

Lifetime subscriber

# 1417708 31-Oct-2015 14:40

wombus: If I could manually organise payment with them what would be the best way to get the payment transfer over to them? We are only talking very small dollar amounts, is Paypal an option as Ive never used it before?

PayPal is always an option, if the seller is willing to accept it. It's safe for both sides really.

sbiddle

28431 posts

Uber Geek

Moderator

Trusted

Biddle Corp

Lifetime subscriber

# 1417709 31-Oct-2015 14:42

One person supports this post

The site uses SSL

At the end of the day a site having SSL or not having SSL means very little in terms of credit card security. SSL is protecting your traffic from interception between your PC and their webserver. It doesn't mean they're adopting correct PCI standards behind the scenes for credit card charges and storage.

sir1963

1059 posts

Uber Geek

Subscriber

# 1417731 31-Oct-2015 15:26

You could always used a prezzy card, simply gets one with the right $ amount and once its gone it can not be used again.

sbiddle

28431 posts

Uber Geek

Moderator

Trusted

Biddle Corp

Lifetime subscriber

# 1417734 31-Oct-2015 15:31

I really wish banks in NZ would offer virtual card numbers. The only card I'm aware of that does is the Air NZ OneSmart.

wombus

95 posts

Master Geek

# 1417737 31-Oct-2015 15:46

sir1963: You could always used a prezzy card, simply gets one with the right $ amount and once its gone it can not be used again.

Brilliant thank you Sir you have solved my problem that's the best and easy solution.

wombus

95 posts

Master Geek

# 1417739 31-Oct-2015 15:55

freitasm: The site certainly uses SSL - the padlock is not showing because it uses an old version of encryption protocol. In any case a padlock only guarantees encryption between your browser and their servers.

Even if you visit another site with a nice green padlock, this still does not guarantee they don't have someone inside stealing credit card information. It also doesn't guarantee they are using good practices when storing credit card and customer information.

In other words, I am not sure this site you point out is the culprit - it could be any other site really.

A good site to check if an email account or username has been involved in a breach is https://haveibeenpwned.com/.

True it may not be the culprit it's based only on my best guess. My wife makes very few purchases and only 3 on her new issued card. This site was used on both cards that were compromised so can't risk using the site again with the new card when it arrives.

freitasm

BDFL - Memuneh
64976 posts

Uber Geek

Administrator

Trusted

Geekzone

Lifetime subscriber

# 1417752 31-Oct-2015 16:49

sbiddle: I really wish banks in NZ would offer virtual card numbers. The only card I'm aware of that does is the Air NZ OneSmart.

And you can only have one virtual card so not much use either.

sbiddle

28431 posts

Uber Geek

Moderator

Trusted

Biddle Corp

Lifetime subscriber

# 1417755 31-Oct-2015 17:04

freitasm:
sbiddle: I really wish banks in NZ would offer virtual card numbers. The only card I'm aware of that does is the Air NZ OneSmart.

And you can only have one virtual card so not much use either.

I thought it was something like 5 virtual cards - but looking at the OneSmart site they're actually unavailable completely until 1st Nov due to "high demand".

freitasm

BDFL - Memuneh
64976 posts

Uber Geek

Administrator

Trusted

Geekzone

Lifetime subscriber

# 1417767 31-Oct-2015 17:36

Still too little. It should be one virtual card for one use - for example a number for Netflix, a number for Hulu, a number for a one time use only and so on. Five is not enough for this kind of thing.

Rikkitic

Lock him up!
10949 posts

Uber Geek

Lifetime subscriber

# 1417773 31-Oct-2015 18:19

I just use a debit card and make sure there is never more money on it than I actually need. It's not a perfect solution but it works pretty well for me. Worst case scenario I can't lose more than a few hundred dollars but that has never happened.

I don't think there is ever a bad time to talk about how absurd war is, how old men make decisions and young people die. - George Clooney

wombus

95 posts

Master Geek

# 1418519 2-Nov-2015 08:45

I will a least get my money back, they took $370 which was used on gambling sites. Bank says it will take up to 9 weeks to process my claim

tripp

3387 posts

Uber Geek

Trusted

Lifetime subscriber

# 1418531 2-Nov-2015 09:07

I use a bank credit card with a low limit for my internet things, I would rather use the banks money (i.e. credit card) and not my own (debit card).

If something happens then it's the bank that does the work to get their own money back.