Should I auto-save a user's credit card information?

Question

Is it wrong of me to automatically save a user's card info without asking them?

Update:

I am using Stripe, so the card data never touches our servers. Using Stripe alone doesn't make a site fully PCI compliant, but the site I'm working on is PCI Compliant.

Also, I should have mentioned this but the site I'm working on sells subscriptions -- and nothing else. I would imagine that, given that this is the case, a user would have to assume that we will retain their cc info when giving it to us (otherwise we couldn't charge them each month).

That being said, the use case I was wondering about was the situation where, after already having purchased a single subscription from the site, we automatically fill in that user's cc info when they go to purchase another.

Answer 1

You should never save credit card information, client or server, unless you are PCI compliant. PCI stands for Payment Card Industry. You can view their website here. The standard of which we are all held to when handling credit cards is the Payment Card Industry Data Security Standard (PCI DSS).

You can get around having to be PCI compliant if you use a 3rd party, who is PCI compliant, to handle all your credit card processing and storing. I have used CyberSource and it ended up being a rather neat solution:

I just created an iframe whose source was set to a page on my network that was just a credit card form. When submitted, instead of posting to my network, it posted to CyberSource. When CyberSource processed the submission, it returned back to a specific page within my network that handled the result to update the user. In doing it this way, the credit card data never entered my network and thus I was PCI compliant.

Just as a side note for client-side, use the autocomplete="off" attribute on all sensitive fields.

---

Edit per your update

Since you have now stated the site you are working on is PCI compliant, the question then changes to a multi-part question of should you:

1. Inform your users via a message prior to them signing up for the subscription?
2. Give your users the option of having their info saved or auto-filled?
3. Not tell the users anything based on the implication of what a subscription is by definition?

My experience has been such that #2 is what a lot of users prefer. I've come across many cases where parents or friends have used their credit cards to help someone out and don't exactly want their information retained where it could be used again by that someone.

Now, in a subscription, reoccurring payments are implied and from that, saving card information is implied, either by the website or the processor. That might be where you would probably be best off at least doing #1 to inform the user what you are going to do with their information.

Answer 2

You might not ask, but it's important to inform

Otherwise, you might run into some legal issues if that saved data was ever compromised. First, there's the problem that the data was compromised. Second, there's the issue that the user wasn't given proper notice that the data was being saved. You could add this to your terms and conditions page, but putting it in a more prominent place (i.e. the payment page) makes it obvious.

It's happening every day. If it were me, I wouldn't save anything. Overall you have to weigh the convenience factor (for the user) vs how much effort it will take to secure the data. PCI compliance is a big deal.

Answer 3

Yes it is wrong to save a users CC info without asking. Just ask yourself the simple question, how would you feel if a site retained your CC info without telling you.

If you don't ask you are taking advantage of the user and if the user finds out that you are doing something behind his back you may well loose him.

There there is the question of what you will use the CC info for?

Answer 4

Because it is a subscription site, I think it would be ok to save the information, but you need to handle it gracefully as well when you give the users the option to use the stored cc info. Something like "Your already have a recurring payment with us your subscription to XYZ - would you like us to charge this subscription to the same card?"

Answer 5

We're using a payment provider. We never see the credit card info, we pass information on amount and ordernumber to the payment provider, and get a transaction number back if the customer enters valid information.

This transaction number we then, at shipment time, pass to the payment provider, and the money is transferred to our account. (In our country it is not allowed to transfer the money before the goods is about to ship.)

For normal transactions, the transaction number can only release up to the amount the customer authorized. We can request less, if an item is out of stock.

For a subscription, we would get a token, which can be used when we want a payment. This token is unique to us, can not be used by others, so it need not be stored super-safely as a credit card number. It also means that if a site made a subscription, and refused to cancel it, the customer could get the payment provider to cancel the token, without having to cancel the card.

If your payment provider works the same way, you never should need to store the credit card number, you never even have the possibility.