It seems like many places spend a ton of time and money securing their site for credit card transactions. However, there are still millions of credit card numbers being stolen. Fraud is big business, and easy to do online. In Europe, credit cards have been almost entirely replaced with chip and pin systems that protect against stealing of credit cards at the terminal and the loss of physical cards. This is starting to make its way to the US and Canada as well. However, the easiest place to steal credit cards seems to have been the internet for some time now.
So I've been thinking, would it be possible to create a secure protocol for placing credit card transactions online so that sensitive data doesn't need to be sent to the web server? Is it even feasible to migrate to such a system?
What I am thinking is along these lines:
- Merchant contacts their processing service provider and obtains transaction code.
- Merchant responds with transaction code, amount/summary, and processor information via HTTP headers, with content to fall back on if the client doesn't support it
- Client sends a request to their issuing bank with authentication information, passing along the same information sent by the server.
- Client's bank checks funds and contacts the merchant's processing service provider, agree on the information, and gets an approval code if the transaction is good
- Bank responds to client with pass/fail details
- If the transaction failed, the client can try another account or responds to the server with failure
- On success, the client responds to the server with the approval code
- Merchant confirms the approval code with their processing service provider and captures funds when ready
In this scheme, the client and merchant never exchange sensitive information. So you either have to attack the banks, the client's machine, or replace the credentials on the server so everything goes to your personal account (which is risky).
I guess this isn't so much of a question, as it is looking for thoughts on how to improve things.