I am shocked that most people think it's OK these days to drop the "Oops, nasty baddies bad bad got in and there goes your details, so so sorry, come again."
If this happens to some small startup with the one PHP nerd that doesn't really know what he's doing (and is underpaid anyway) - that's fine. Or at least acceptable. You're living on the edge.
But a Fortune 100 company... COM'ON.
I know Citi Credit card lets you do that.
> and wouldn't work for recurring purchases (like Adobe Creative Cloud)
It could. If I remember correctly, Citi card lets generate three types of Virtual Cards. One based on the expiration (less than a month), another based on the maximum amount/balance (where expiration is about a year) and finally a combination of both.
Virtual credit-cards are real handy especially when trying those 30 day trial services.
Seems that another way to solve this for recurring payments would be to likewise issue a virtual number. But, only the merchant with a particular Merchant ID could apply a charge to that number.
In general, it's actually a strange concept that we walk around with these wide open payment methods that only require that a dishonest person acquire a few bits of information to abuse with impunity.
Very few people used it
But there is an additional problem, from American Express's point of view. Virtual credit card numbers are patented by Orbiscom, which was acquired by MasterCard in 2009.
Pretty ridiculous though.
On a related note, I just came across this:
http://storefrontbacktalk.com/securityfraud/the-big-three-cr...
>Visa, MasterCard and American Express proposed new global standards to replace traditional account numbers with a digital payment “token” for online and mobile transactions.
So, either they are licensing it from Orbiscom, ignoring the patent, or it doesn't apply here.
In any case, it's good news. Looks like some semblance of virtual numbers will return on a standardized, more global basis.
The article talks about replacing 16-digit card numbers with a new payment infrastructure. The Orbiscom technology produces virtual card numbers that are backwards-compatible with existing 16-digit credit card numbers.
Then you go through the requests in your account and allow those you wish.
Like a sort of reverse Direct Debit/ Standing Order.
If say for instance the token you gave to Adobe gets stolen, you or they just disable all tokens or ask for new tokens.
So not only will fraud be more difficult but merchants also will be known who has been compromised. Right now banks won't always tell you what merchant was compromised and causing you to get a new number/card.
New payment systems have this, for instance stripe is built similar to this.
Why do people have to update all their cards with all their merchants after one fails? Getting multiple cards and internet cards sometimes helps compartmentalize but really we need this at least per merchant.
Some banks have this like Bank of America ShopSafe but it should be the new normal.
That's the reason to aim for PCI compliance your self.
I'm sure they aren't happy about the idea, but most of them recognize that lock-in is a reason people don't use their services.
This needs a ladder of shame. If we don't shine the light on this, things just won't get better.
Seriously, I don't get it. At least in the US, card holders have zero liability in these instances.
If your card number got leaked and is used to make a fraudulent purchase, simply report it to your card issuer. They will reverse the charge and issue you a new card number.
The paranoia around card numbers for consumers is crazy. There's literally no risk. It makes sense for merchants because they bear risk, but I don't understand why cardholders get upset.