How safe are your credit card details online?

The payment process
The data a company such as Securehosting takes is then transferred securely to the acquiring bank, which then sends this on to the relevant card association (ie Visa or Mastercard), which in turn sends this on to your own bank.

Once authorisation has been granted or refused, this is sent back to the payment gateway which then passes it back to the retailer. This process may sound convoluted but takes seconds.

The point is that if the retailer stores the payment forms on the payment gateway’s servers, it does not see the customers’ card details. The payment gateway can store the card details if the retailer wants to set up the ability to carry out repeat transactions but the retailer still doesn’t see any card details.

And this was the only saving grace for victims caught up in the Zavvi Direct fraud – ­ the criminals involved never saw any card details themselves.

Our verdict
The Zavvi Direct fraud is a warning that criminals are becoming more sophisticated.

This fraud was not the online equivalent of a smash-and-grab raid. Instead they used a leading payment gateway and this company hosted the payment forms. This saved the fraudsters time and hassle, and at the same time they were using legitimate systems to gave them more time to carry out the fraud.

The weakest link in this fraud was the acquiring bank, which gave the merchant status to the fraudsters, not the payment gateway which has no power to carry out security checks. These companies can ensure that your data is more secure than if it is hosted by a retailer. But it’s important to point out that there is no such thing as ‘absolute security’.

The ubiquitous golden padlock displayed by web browsers – while always something that should be looked for – indicates that the retailer has directed the customer to a secure site such as that run by a payment gateway. However, people should realise that the golden padlock can be compromised, security certificates can be bought by criminals or spoofed and not all retailers that host your data are PCI-complaint.

But the fact is most people’s card details are stolen not when shopping online but through email scams and card cloning or when a company is the victim of a security breach.