Member Avatar for dado.d

Hi

I'm using European payment provider which is providing me API to communicate with them. There is a step where I need to ask from a buyer credit card info (number, expiration and CVV) so I can pass that info to that payment gateway via API.

Is that even allowed? How secure is that?

  • 3 Contributors
  • 2 Replies
  • 138 Views
  • 5 Months Discussion Span
  • Latest Post Latest Post by KirovEli

Dani AI

Generated

Brief summary in response to : accepting card numbers and CVV from buyers is legally possible, but it triggers significant security, compliance, and privacy obligations. is right that payments are lawful; is right to flag safety concerns — handling raw card data on a merchant server is the higher-risk option.

Recommended approach and safe workflow:

  • Prefer a hosted checkout or provider-controlled UI so the gateway — not the merchant server — handles PAN/CVV. This keeps PCI scope small.
  • If embedding fields in the site, use the gateway's client-side tokenization/hosted fields (token returned to the site, server uses token to create charges). This avoids storing/seeing raw PAN.
  • If the merchant environment must process card data directly, expect full PCI DSS scope (SAQ D) and heavier controls.

Key rules and cautions:

  • Never store CVV after authorization (PCI prohibits it).
  • Avoid logging PANs or exposing them in browser DOM or server logs.
  • Use TLS 1.2+ (prefer 1.3), HSTS, secure cookies, CSP, and strict access controls.
  • Limit personnel access, encrypt card data at rest with strong, audited key management, and maintain an incident response plan.
  • For EU merchants, PSD2 / SCA (3‑D Secure 2.0) commonly applies to card payments; many gateways provide built-in support.

Operational checklist for providers and audits:

  • Confirm whether the payment provider offers hosted pages or tokenization and whether integration guidance includes expected PCI SAQ scope.
  • Validate support for 3DS/SCA and sandbox testing.
  • If in-scope, plan for ASV vulnerability scans, regular penetration testing, logging/monitoring, and evidence collection for PCI assessments.

If a gateway forces raw-card submission through the merchant server, that indicates significant compliance work: engage a PCI QSA or follow the gateway's documented controls before going live.

Recommended Answers

All 2 Replies

Member Avatar for rproffitt

I worry here. That is, how else would you get the information needed to process the payment?

Answer: It's legal to be paid for a product or service.

commented: It is not safe +0
Member Avatar for KirovEli

Agree with man above, it is not safe for sure!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.