Member Avatar for Stefce

I made an website which i require of the user to enter their credit card details for virtual money transfer inside the website only. I only take the first two numbers of the card in order to detect the Card Type and i take last four because of the UI design.

Is there any chance i can get in trouble with this? If so, is there any recommendations to escape those?

P.S: I know is off-topic but i would be glad to find this out.

  • 3 Contributors
  • 5 Replies
  • 292 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Stefce

Dani AI

Generated

Short answer: yes — you can get the country reliably from an IBAN (first two letters) and for many countries you can also extract a bank identifier from the country-specific BBAN portion, but there is no single universal “bank-name” field inside every IBAN. The IBAN format is country-dependent (country code + check digits + BBAN) and the BBAN layout (where a bank code might sit) is defined per-country in the IBAN registry. ()

Practical, low-effort path for a PHP site that only needs a nicer UI (instead of asking the user every time): validate the IBAN locally, read the country code (substr(IBAN,0,2)), then look up bank details only when a country’s BBAN contains a bank code. Libraries/APIs exist to help — validate with a PHP IBAN library and call an IBAN lookup service that returns bank name/BIC for supported countries. Example flow (very small sketch):

composer require cmpayments/iban

<?php
require 'vendor/autoload.php';
use CMPayments\IBAN;

$ibanRaw = 'DE89370400440532013000';
$ibanStr = preg_replace('/\s+/', '', $ibanRaw);
$iban = new IBAN($ibanStr);

if (!$iban->validate($error)) {
  // fallback: ask user to pick bank/country
} else {
  $country = substr($ibanStr, 0, 2);
  $json = file_get_contents('https://openiban.com/validate/'.urlencode($ibanStr).'?getBIC=true&validateBankCode=true');
  $data = json_decode($json, true);
  // if $data['bankData']['name'] exists, show it in the UI; otherwise ask user
}

Use a library for checksum/format rules and a service only for mapping to a bank name (coverage varies). (github.com)

Security/UX notes tied to the thread: since this is for UI only (as said) prefer transient lookups and avoid storing full IBANs unless you need them. Cache lookup results (bank name, country) and store a keyed fingerprint (HMAC) instead of the raw IBAN if you need deduplication. If detection fails, fall back to letting the user choose the bank (as suggested). Treat IBANs as personal data — they aren’t necessarily “sensitive payment credentials” in all regulatory texts, but they can facilitate fraud and require a proper risk assessment and protection measures. (eba.europa.eu)

Recommended Answers

All 5 Replies

Member Avatar for rproffitt

I take it you get this information over HTTPS then never store such in the databases. If you do store it's with one way encrypted plus salt just like everyone does with name and password.

Now moving on to get in trouble, what does your lawyer say?

Member Avatar for Dani

Yes, you can get in trouble. There are very strict guidelines that dictate which entities are permitted to store credit cards in their database, or even under which circumstances you can collect credit card information.

A set of standards called PCI DSS (Payment Card Industry Data Security Standard) specifies who, what, where, when, and why businesses may collect and store credit card information.

You may consult an attorney (and pay for it!) if you feel like you need more help understanding. However, if you are a business that accepts credit cards, it is your responsibility to be aware and keep yourself updated of all of the PCI DSS requirements and to ensure that your business is taking the necessary steps.

In my case, my credit card merchant audits me on a regular basis to ensure I'm in compliance.

This is not something you should need to hire a business / finance attorney for. Even if you are having difficulty understanding the PCI website, there are people who work at your credit card merchant who should be able to work with you to explain the exact requirements you need to be in compliance.

You can get more information at https://www.pcisecuritystandards.org/pci_security/maintaining_payment_security

If you have questions, I would begin by reaching out to the PCI Compliance division of your credit card merchant. (Stripe and Braintree are the two popular ones for online processing.)

Edited by Dani
Member Avatar for Stefce

Okay! After a lot of research and talking with an lawyer, i came with a conclusion that I should not ask for the user Credit Card details.. Instead to ask for the IBAN number, to detect the Bank name of the user and country, with this even if i want to i cannot abuse that number after all, since is only to receive money. So do you have any knowledge in this field on how can i detect the bank name? Or is there any ready to use PHP function/code about this. Like i said i would like to detect the Bank Name and the Country of the user for UI experience purposes. Is that possible?

Thank you for the reply

Edited by Stefce
Member Avatar for rproffitt

What about letting them input what you need to know upfront rather than trying to divine the information?

Member Avatar for Stefce

I want to test my skills in UI and thats why i want to be this way :)

Edited by Stefce
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.