0

so I'm creating an app that allows users to pay for a product with a bank card. If the user decides to save his card information I would like the user to access that information in a way that he could visualize it, edit it and even remove it.
So our design team has decided to add this information to the private profile page where he could access it. My worry is security, the app has a login feature but can also have a "keep me logged in" feature so I would like the card information to be blurred or only accessed if a certain security step is completed. So my question is, which is the best way to do this without disrupting the UX too much.

Few quick ideas:
User reinserts password of his account.
User uses fingerprint/Touch ID.

If it's any use I'm programming in Appcelerator's Titanium with Javascript, TSS (Titanium Style Sheets) and XML.

3
  • You should probably read about PCI DSS. Unless you have very very strong security measures in place (which go waaaay beyond SSL/TLS), you are not allowed to save the card number, and in all cases, you should never display it. So as suggested by yitzih, you should find a payment gateway that lets you tokenise the information. Note also that you are never allowed to store the card security code.
    – jcaron
    Aug 29, 2018 at 22:06
  • Hello, thanks for your comment. Are you sure about not being allowed to store the CVV? Is there any documentation about it I could send to the boss?
    – Philip RH
    Aug 30, 2018 at 8:09
  • blog.pcisecuritystandards.org/… and pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf would be a good starting point
    – jcaron
    Aug 30, 2018 at 9:33

2 Answers 2

0

You might find some more information about the security aspect of your question here: https://security.stackexchange.com/ because I can't really speak to that part of your issue, but yeah, on the surface it does seem like a valid concern.

Biometrics has become a standard go-to when it comes to security/UX compromise. I would recommend using a fingerprint when you can. That provides a much better experience in general that trying to remember your password and taking the time to type it in. I personally would appreciate the extra security step in that situation.

If your intention is to show the full credit/debit card number, I think you have to do some additional validation (despite what form it comes in).

On a separate note, what you can do is in the UI say, "You have a: Visa ending in 4820, Mastercard ending in 9047, Visa ending in 4729" etc. That way the full account information is hidden. If they want to change that payment method, THEN they hit a wall of password/fingerprint OR they can just re-enter the payment information from scratch.

Last note. You may want to look at other commerce sites/apps. This seems like an issue that would have come up amongst other services before, try looking to see how Amazon and Walmart handle it, as they do it well at scale.

Good luck!

1
  • I like the idea of saying that they have a Visa ending in 5132, specially if they want to edit they should start from scratch.
    – Philip RH
    Aug 30, 2018 at 8:15
0

You shouldn't store the users card numbers. I don't know how you are processing the users card data, but whatever service you are using look into if they allow you to tokenize the card. This means that you send them the card data and they send you a token. You can then use that token to get back some data about the card (such as a masked card number that looks like 4xxxxxxxxxxx1111) and could even use it to make payments in the future.

They may also have a hosted payment page which would allow you to stay out of PCI scope entirely, which is generally a very good thing.

PCI is an organization that created a security standard for handling credit card information. You generally want to have as little access as possible.

As @Casey Robinson mentioned. You can probably find a lot better and more detailed information on the security SE site.

1
  • I have seen companies like AliExpress display the full card information though but to be fair that was a while back, I just checked and they display the final 4 numbers as @Casey Robinson suggested.
    – Philip RH
    Aug 30, 2018 at 8:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.