Security regarding user's saved card information

Question

so I'm creating an app that allows users to pay for a product with a bank card. If the user decides to save his card information I would like the user to access that information in a way that he could visualize it, edit it and even remove it.
So our design team has decided to add this information to the private profile page where he could access it. My worry is security, the app has a login feature but can also have a "keep me logged in" feature so I would like the card information to be blurred or only accessed if a certain security step is completed. So my question is, which is the best way to do this without disrupting the UX too much.

Few quick ideas:
User reinserts password of his account.
User uses fingerprint/Touch ID.

If it's any use I'm programming in Appcelerator's Titanium with Javascript, TSS (Titanium Style Sheets) and XML.

Answer 1

You might find some more information about the security aspect of your question here: https://security.stackexchange.com/ because I can't really speak to that part of your issue, but yeah, on the surface it does seem like a valid concern.

Biometrics has become a standard go-to when it comes to security/UX compromise. I would recommend using a fingerprint when you can. That provides a much better experience in general that trying to remember your password and taking the time to type it in. I personally would appreciate the extra security step in that situation.

If your intention is to show the full credit/debit card number, I think you have to do some additional validation (despite what form it comes in).

On a separate note, what you can do is in the UI say, "You have a: Visa ending in 4820, Mastercard ending in 9047, Visa ending in 4729" etc. That way the full account information is hidden. If they want to change that payment method, THEN they hit a wall of password/fingerprint OR they can just re-enter the payment information from scratch.

Last note. You may want to look at other commerce sites/apps. This seems like an issue that would have come up amongst other services before, try looking to see how Amazon and Walmart handle it, as they do it well at scale.

Good luck!

Answer 2

You shouldn't store the users card numbers. I don't know how you are processing the users card data, but whatever service you are using look into if they allow you to tokenize the card. This means that you send them the card data and they send you a token. You can then use that token to get back some data about the card (such as a masked card number that looks like 4xxxxxxxxxxx1111) and could even use it to make payments in the future.

They may also have a hosted payment page which would allow you to stay out of PCI scope entirely, which is generally a very good thing.

PCI is an organization that created a security standard for handling credit card information. You generally want to have as little access as possible.

As @Casey Robinson mentioned. You can probably find a lot better and more detailed information on the security SE site.