Question about Credit Card Security (1 Viewer)

[Vince Maskeeper]

Since this is often a hot topic here on the HTF, I figured I'd post this one:

Most companies, when accepting a check for payment, like to have your account number listed on the memo line on the check: this goes for the phone company, electric company, cable, etc. From the beginning I was also told you should do this for your Credit Card company.

I always felt a little weird about it, because my account number, of course, was my credit card number. Years ago I had an afternoon chat with the sister of a friend of mine, who was at the time a bank branch manager- and this conversation cemented my opinion about this.

She made it clear that cancelled checks were not at all secure and that the chain of employees at her branch alone, not to mention the people at the other branch where the checks were deposited and processed, was a long one.

While logic would seem to say that these people already have access to your bank accounts, I would think any smart thief that was tempted would be far more likely to pinch CC numbers from non-bank accounts where they'd be much less likely to get caught (since your CC number could be compromised anywhere).


Anyway- as a result, for years I have only put the last 4 digits of my account on my checks. I figured the CC company knows my name, address and account number-- the fact that the same info appears on the check should be more than enough.

Last year I switch to paying my bills online. Originally in Feb of 2004 I set up an account in Ohio and paid my CC bill using online bill pay. Again, I set up the account so that it only displayed the last four digits (so in online bill pay the account number was listed as XXXX-XXXX-XXXX-9999). There seemed to be no problem, and I did this until I moved to LA in June.

In June I set up my LA accounts, again with online bill pay, and again with the same account format (only showing the last 4 digits). I paid my CC bill this way for the last year.


Today I get a call from my bank saying my bill-pay had been returned and that the CC company will not accept it unless it has the full account number on the check. Of course, this has not been a problem for the past 2 years I've used online billpay- and was not a problem for the 6 years before I paid by check and MO.

Any thoughts about this? It seems the CC company, of all people, should know how many people have access to cancelled checks and would encourage customers to protect their account numbers.

And I'm still baffled why they came up with this policy all of a sudden.

\V

 

[Mort Corey]

I've never ventured into online bill paying, but I never have written any number on any check I have submitted to a credit card company....ever. Why it would be different online is strange (to me anyway).

As an aside, I have had some customers (only a couple, fortunately for them) that pay me with checks with their Social Security number printed along with their name, address and telephone number. I've pointed out how I think that unwise and gotten a deer in the headlights look in return.

Mort

 

[CameronJ]

Vince,

Just my $0.02 - but there are so many ways for your credit card number to get compromised, worrying about whether someone in the banking chain is going to steal the number is honestly a little over the top. Every single person you give your credit card to has the number. I'd be more worried about the waiter, clerk, phone rep, monkey at the company that you order something over the internet, etc., etc., etc.

Besides the fact that banks process billions of checks a year, for someone to pull yours out of the pile.....

 

[Chris Lockwood]

> Today I get a call from my bank saying my bill-pay had been returned and that the CC company will not accept it unless it has the full account number on the check.

Find another CC company. That's ridiculous. I also only put the last 4 digits on checks.


> there are so many ways for your credit card number to get compromised, worrying about whether someone in the banking chain is going to steal the number is honestly a little over the top.

OK, then, please post your CC numbers to prove your point.

 

[MarkHastings]

Totally agreed! I have had at credit cards for over 20 years and I've NEVER written my account # in the memo line. In fact, I've never done this with any bill.

If someone required me to do this, there are plenty of other card companies that would take my business.

Wait, I'm confused (after re-reading the original post). If you have online bill pay, where does the 'check' come into play??

 

[CameronJ]

Oh please Chris!

My point is this - if you are that worried about your credit card number being stolen - don't use it! There's just a little bit of difference between the risks associated with writing your credit card number on a check vs. posting it on the public internet.

BTW - putting the last four digits on the check is the same as putting nothing. The credit card company wants the number so they can post your payment to your account. In the absence of a remittance slip - which obviously isn't included if you are paying online - the company needs some way to find your account. Basically, if you don't put the whole number on there, the company is going to have to search by name - no credit card recordkeeping system I know of allows the credit card company employee to just enter the last four digits - they all require the full number.

 

[Mark Paquette]

The key here is that the bill is being paid online, so no remittance stub is included with the payment. The stub would normally include your account number along with other information about your account. In the absence of that stub the CC company needs some method of determining which account to apply the payment to so they have requested that it be placed on the check. No CC company is going to require you to write your CC number on your check when making a payment by mail which includes the remittance stub.

Vince, can you go to the CC company's website and make the payement from there? My CC company allows this and it's deducted from my checking account within a day or 2, plus it's free.

 

[Jeff Ulmer]

I'm not sure what you mean by "online bill pay". I make credit card payments through my regular bank's online banking service. You set up a payment recipient (the credit card company/your account number), and then anytime you want to pay them they are in your list of payees. Same goes for hydro, or any other bill that needs to be paid.

I can see why they need the full number, as the first digits also tell them what kind of credit card it is - my line of credit has a different starting number than the regular card.

One recent beef I had is those extra security numbers on the back of the card. Now everyone asks for those, but what is the point of a "secret" number if you need to include it with every purchase anyway? I asked the CC company about this and they said it was fine to hand that out. Makes it kind of pointless if you ask me.

 

[MarkHastings]

but they aren't 'secret' numbers. They're 'secure' numbers. I assume they are only used to validate the CC # and don't get processed with the order so that 'thieves' can't really get more than just your CC #, thus making it harder to use?

 

[Malcolm R]

But they ALL ask you to do it, usually in several different places on the statement/envelope.

Obviously they're not concerned about any security risks in doing so.

 

[Jeff Ulmer]

They are numbers only someone in possession of the card should have, but when ordering online they are part of many site's CC number gathering, meaning they are dumped into a database, and are therefore as (in)secure as your card number. If someone heists the card numbers, they have the "secure" codes as well. All this really does is add some more numbers, it certainly doesn't stop anyone from stealing the card number/extra codes if anyone you do business with has access to them.

 

[SethH]

I always find it odd that many people are bothered that they are asked for these numbers. The claim being that giving them out makes them insecure. But if nowhere asks for them, then how are they providing any security for you?

The argument about them being dumped into a database is fine, but let's say no websites required them. Then someone steals your credit card number and uses it online. Those extra digits are not providing you with any security then either. I personally like the way things currently work where some places require them and some don't.

Finally, if you're very paranoid -- which is reasonable when it comes to credit cards online -- get a Citi card because you can go to their website and obtain a 1-time-use number for every online purchase -- making your purchases almost entirely secure (someone would have to hack into Citi's number mapping system to figure it out).

 

[Mark Paquette]

Yeah, and Best Buy asks for my phone number whenever I purchase something. I simply say no thanks. A CC company can ask me all they want to put my account number on my check, I'm not going to do it.

 

[Jeff Ulmer]

My point is that those extra numbers don't do anything to enhance security if they are being doled out to everyone.

I think it would be far better to have an option to log into your CC account website to authenticate transactions, perhaps over a certain dollar threshold.

 

[Chris Lockwood]

> BTW - putting the last four digits on the check is the same as putting nothing.

Nope. It helps keep the check with the payment form, since they have the last 4 digits. What are the odds that another payment that person is processing at nearly the same time would have the same last 4 digits? Very low.

I knew you'd back off on posting your numbers after claiming people were paranoid about giving them out.

 

[MarkHastings]

But that's just for their mailing list and has nothing to do with verifying your credit.

 

[CameronJ]

Please point out where I said that people were "paranoid" (your words, not mine) about posting numbers over the internet? Just because I don't stress about writing my credit card number on a check doesn't mean I'm enough of a moron to post it on the internet. Please explain to me how those are in any way the same thing?