Possible credit card scam

[itadakimasu]

I ordererd from Knifeworks, paying with a credit card. They did not want any confirmation. About 10 days later the package arrived at my door! They are good guys.

 

[not2sharp]

Wow, it is actually in their "International Orders Section"

PER KNIFEWORKS INTERNATIONAL ORDER SECTION:

" Due to the problem of fraud orders, any customer who is placing the first order with us and use credit card to pay for the order, you will receive the other email from us ask you to send the copy of your credit card that you use for the order to be verified."

ETA- Link to International Orders Page

So it is a legit policy - but a terribly unsecure policy. I can't hardly believe it, but it's on their website (unless they have been compromised and the ruse is incredibly well thought out). I would cancel my order if they asked me to send a photo of my credit card, or any credit information, through e-mail. Especially public e-mail accounts like Gmail and Yahoo.

It sounds like a potential PCI Compliance issue.

n2s

 

[Franciscomv]

I received a reply from the nice folks at Knifeworks. They explained that this is a new policy for international orders and also told me why the e-mail address wasn't one of their regular xxxx@knifeworks.com but rather a Gmail account.

I hadn't checked the info on their website concerning international orders because this isn't the first time I've bought from them and I didn't think anything had changed. My bad.

 

[A Justice]

It sounds like a potential PCI Compliance issue.

n2s

It is a PCI compliance issue, and it could lead to serious problems for them. All transmissions of customer data must be encrypted across open, public networks. It's also questionable whether such a level of physical access to employees (having small image files with cardholder information stored in a gmail address) is an issue itself. That's why I strongly suggest Knifeworks revises that policy ASAP. Even if it wasn't an issue with card processing, it's public record now; a hacker that found this policy couldn't help but try infiltrating it - a Gmail address with a bunch of foreign Credit Card information stored in it?? #IdentityThiefDreams

I don't like seeing small business facing more obstacles than they have to, but security is a requisite of online retail. I wouldn't ever be subjected (domestic customer) to this specific policy, but the low standards bother me and shrugging it off as an acceptable risk leads me to question their ability to create and maintain a secure data flow for cardholder information. Also, a lot of people do not question vendor practices - they would just send the photo. If Franciscomv shrugs it off as an acceptable risk and Knifeworks doesn't feel pressured to develop safer practices or question their policies proactively, those protections fail for the customers that are unaware or uneducated about the risk. Everyone will do what they want (or what they think they can get away with), but right now would be a good time to address a potentially unsafe practice. Everything will work fine until it doesn't.

 

[choombak]

It is a PCI compliance issue, and it could lead to serious problems for them. All transmissions of customer data must be encrypted across open, public networks. It's also questionable whether such a level of physical access to employees (having small image files with cardholder information stored in a gmail address) is an issue itself. That's why I strongly suggest Knifeworks revises that policy ASAP. Even if it wasn't an issue with card processing, it's public record now; a hacker that found this policy couldn't help but try infiltrating it - a Gmail address with a bunch of foreign Credit Card information stored in it?? #IdentityThiefDreams

I don't like seeing small business facing more obstacles than they have to, but security is a requisite of online retail. I wouldn't ever be subjected (domestic customer) to this specific policy, but the low standards bother me and shrugging it off as an acceptable risk leads me to question their ability to create and maintain a secure data flow for cardholder information. Also, a lot of people do not question vendor practices - they would just send the photo. If Franciscomv shrugs it off as an acceptable risk and Knifeworks doesn't feel pressured to develop safer practices or question their policies proactively, those protections fail for the customers that are unaware or uneducated about the risk. Everyone will do what they want (or what they think they can get away with), but right now would be a good time to address a potentially unsafe practice. Everything will work fine until it doesn't.

PCI is designed as a security theater, and does little to actually protect information. Just like most compliances are. Educate the user is the biggest myth ever invented by the security industry. But that's another story for another day.

As of today I am perfectly happy sending my CC image to knife works via gmail.

 

[choombak]

A phone call is several orders of magnitude more secure way to transmit your CC# than e-mail. It isn't moot, and even though I expect an average person to not understand the security risks, a large online retailer should know better. If you send an e-mail with an un encrypted CC number it is automatically stored in 5 spots before the first backup ever takes place. In Verizon's 2013 annual Data Breech Investigations Report, over 621 confirmed data breeches occurred in reporting companies, and there were 47,000 security incidents. Now keep in mind, those 621 are encrypted databases that were accessed maliciously - the 47,000 security incidents is what you're opening yourself up to when that data is sent over an un encrypted e-mail.

They may not know of a better way, but their current policy is an activity that has been considered a poor security practice for a long time, and is probably one of the most elementary and well known DON'Ts of the e-commerce industry. They need to amend the policy for their own good and the good of their International customers. Excuses and posturing doesn't make sending your Credit Card information through e-mail any more secure. I think most people are well aware of how much fraud goes on overseas, but that isn't a good reason to institute a poor security practice, and pass on the risk of fraud to your customers.

If you don't want to take it from me, just search the Internet and come to the same conclusion yourself.

As I said earlier you should stop using credit card physically at merchants - who knows some malicious merchant may steal all that information and use it for his gains. ;-)

It isn't a bit more (or less) secure either way. And those statistics of breaches only serve the security vendors who thrive on FUD.

I am perfectly happy sending my CC data as image to knife works, given the state of art is equally (in)secure. Compliances are feel good factors and have questionable impact in improving it.

 

[357survival]

Things that are NOT PCI Compliant:
Never send or request credit card information over email.
Never request credit card information over chat.
Do not use web forms on your web site to collect credit card information.
Web sites hosted on shared web servers will never be PCI compliant
Web sites hosted on virtual private servers, and cloud servers will also NOT be PCI compliant unless the underlying host servers are also PCI compliant (and dedicated to you).
Dedicated physical servers will not be PCI compliant unless many additional factors are met.

https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf
Section 4.2 I believe

 

[flatblackcapo]

I received a reply from the nice folks at Knifeworks. They explained that this is a new policy for international orders and also told me why the e-mail address wasn't one of their regular xxxx@knifeworks.com but rather a Gmail account.

I hadn't checked the info on their website concerning international orders because this isn't the first time I've bought from them and I didn't think anything had changed. My bad.

I would just find somewhere else to buy my knives. They are out of their minds if they think I would send my CC info, picture or other wise, in a email to a Gmail account. Where is the crack smoking emoticon ?

 

[choombak]

Things that are NOT PCI Compliant:
Never send or request credit card information over email.
Never request credit card information over chat.
Do not use web forms on your web site to collect credit card information.
Web sites hosted on shared web servers will never be PCI compliant
Web sites hosted on virtual private servers, and cloud servers will also NOT be PCI compliant unless the underlying host servers are also PCI compliant (and dedicated to you).
Dedicated physical servers will not be PCI compliant unless many additional factors are met.

https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf
Section 4.2 I believe

I doubt if pci compliance is applicable for knifeworks - they do not handle CC data but use a 3rd party payment gateway for this.

But the pci standards org are nuts - they will extort fines from anyone whom they can, it's organized extortion syndicate in the name of security.

 

[A Justice]

As I said earlier you should stop using credit card physically at merchants - who knows some malicious merchant may steal all that information and use it for his gains. ;-)

It isn't a bit more (or less) secure either way. And those statistics of breaches only serve the security vendors who thrive on FUD.

I am perfectly happy sending my CC data as image to knife works, given the state of art is equally (in)secure. Compliances are feel good factors and have questionable impact in improving it.

I almost think you don't have the slightest clue what any of this means. You're doing a dis service to everyone that purchases from Knife Works by entertaining the notion (absurd as it is) that sending your CC info through e-mail is as secure as using your card physically at a merchant. Troll much?

Knifeworks doesn't handle CC Data? WTF do you call it when someone e-mails them a credit card number? They have in effect expanded their Cardholder data environment to Un Encrypted Gmail messages.

Is Knifeworks subject to PCI Compliance?

From the PCI Compliance FAQ:
: PCI applies to ALL organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. Said another way, if any customer of that organization ever pays the merchant directly using a credit card or debit card, then the PCI DSS requirements apply.

Sending an e-mail with your credit card information is paying the merchant directly, it doesn't matter how they process it. Card companies are in charge of handing out fines or revoking card processing priveleges, and it doesn't matter how many layers of processing companies is between you and Visa, they can reach out and touch you and all those companies are more than willing to give up every piece of data they have . You're defending a notion that doesn't have the slightest bit of truth to it. If you want to complain about PCI, send them an e-mail. It is a fact that Knifework's policy is un secure though, and any reputable security professional can verify that. It almost seems like you have a vested interest in degrading the security of merchants in this industry.

 

[357survival]

I feel like, if they do have to go through PCI compliance, that they are skirting the PCI compliance by using a gmail address to have the cc numbers emailed to, in case their email server gets scanned as part of the compliance audit?

 

[choombak]

I almost think you don't have the slightest clue what any of this means. You're doing a dis service to everyone that purchases from Knife Works by entertaining the notion (absurd as it is) that sending your CC info through e-mail is as secure as using your card physically at a merchant. Troll much?

By emailing it via gmail, you make 10 copies enroute, including gmail datacenters. How different it is than handing over your CC in a restaurant to the server, who makes 4 stops enroute (where he has ample opportunity to copy your card data), before handing it over to the counter to be swiped (where it can be copied again)? Absurd ideas have lead to the tiny security improvements we see today, fixated minds don't help much. Let's not get started with the troll bit.

Knifeworks doesn't handle CC Data? WTF do you call it when someone e-mails them a credit card number? They have in effect expanded their Cardholder data environment to Un Encrypted Gmail messages.

Is Knifeworks subject to PCI Compliance?

Sending an e-mail with your credit card information is paying the merchant directly, it doesn't matter how they process it. Card companies are in charge of handing out fines or revoking card processing priveleges, and it doesn't matter how many layers of processing companies is between you and Visa, they can reach out and touch you and all those companies are more than willing to give up every piece of data they have . You're defending a notion that doesn't have the slightest bit of truth to it. If you want to complain about PCI, send them an e-mail. It is a fact that Knifework's policy is un secure though, and any reputable security professional can verify that. It almost seems like you have a vested interest in degrading the security of merchants in this industry.

I have a vested interest in letting people know things aren't (in)secure as they think they are. PCI happens to be the case in point here. Being on one side of PCI-compliance, I probably have more stories than you (unless you happen to be on either side), but let's save them for another day.

 

[357survival]

Really?
There is a gmail account sitting out there with a bunch of copies of peoples credit card numbers sitting in it and everyone knows what it is?
Seems like a pretty bad idea to me.
I am pretty sure that no card issuer or bank would approve of that. That is specifically what PIC compliance is meant to protect from.

Also, yes, someone could skim your card number (a waiter or waitress), but someone can't kidnap the person and get all of the credit card numbers that they have ever handled. Thanks for contributing your crap answer to the thread.

By emailing it via gmail, you make 10 copies enroute, including gmail datacenters. How different it is than handing over your CC in a restaurant to the server, who makes 4 stops enroute (where he has ample opportunity to copy your card data), before handing it over to the counter to be swiped (where it can be copied again)? Absurd ideas have lead to the tiny security improvements we see today, fixated minds don't help much. Let's not get started with the troll bit.



I have a vested interest in letting people know things aren't (in)secure as they think they are. PCI happens to be the case in point here. Being on one side of PCI-compliance, I probably have more stories than you (unless you happen to be on either side), but let's save them for another day.

 

[choombak]

Really?
There is a gmail account sitting out there with a bunch of copies of peoples credit card numbers sitting in it and everyone knows what it is?

Maybe KW is well aware of this, and promptly deletes the CC image?

Seems like a pretty bad idea to me.
I am pretty sure that no card issuer or bank would approve of that. That is specifically what PIC compliance is meant to protect from.

I am not against PCI compliance (if that is the idea you had all along). However, I have seen how overly abstract and confusing the wording of PCI standards is, how PCI controls are implemented, how the compliance is assessed, their changing definition of "in scope" and "out of scope" systems, and how confused the auditors are. It gives me not an ounce of hope after seeing the complexity in PCI. Pray tell me, even with PCI compliance, why do we see security breaches with huge financial institutions day in and out? (today's news has JPMC, yesterday it was a bank in Europe, and the day before an Asian bank, and the list just goes on). I am sure all of them had PCI-compliant systems, but when the exceptions are the norm, things ain't right the way they seem. How many security breaches did KW have (assuming they are not PCI-compliant and request CC images?). Maybe we don't know, but it will be hazardous to guess either way, and cry wolf.

Also, yes, someone could skim your card number (a waiter or waitress), but someone can't kidnap the person and get all of the credit card numbers that they have ever handled. Thanks for contributing your crap answer to the thread.

No actually, the restaurant owner maintains this CC data in a diary which is kept in an (un)locked drawer. As I said earlier, sending CC image over gmail is perfectly (in)secure as much as having PCI-compliant systems. As a CC holder you are surely free to decide whom to trust, and make reasonably secure choices that safeguard your financial data. As for me I am perfectly fine sending CC image to KW if they demand it, and worry less about PCI-compliance. Actually in my opinion, "compliance" is for mediocre people who would rather hide behind it, than worry about the actual security of data. No, we shouldn't abandon PCI-compliance, but I feel a blind faith in it should be avoided as well.

Thanks for contributing your answer to the thread. :thumbup: