I don't get the name and zip code requirements, is that standard in some countries? I only ever encounter the "Name on card" when shopping on US and UK sites. Danish online stores don't care.
Is the name and zip actually used as part of a validation process? If not it should just be left out.
The article says it helps with validation, and in my experience (living in the UK) many sites ask for it.
Postcodes are quite specific, they only cover around 1-30 addresses. My workplace has at least 4 postcodes to itself (different buildings). My home address shares the postcode with about 15 other houses on the same side of the road (odd numbers 1-31).
Minimal British address examples: "SW1A 1AA" (Buckingham Palace), "6, M1 4EX" (could be a house).
"As an extra security measure, we have to ask customers for the ZIP code associated with their card. There is a trade-off here: adding extra inputs to the form can increase bounce rates, but by adding it, our business is more secure and less prone to fraud."
Is the zip sent to the card processing company? Do they check that the zip matches your address? What if the customer just moved?
I've implemented card payments on multiple occasions, but not once have I seen a credit card processor that offered to validate the zip code.
Unless the name and zip can actually be sent to the credit card processor, and they have access to that information based on the credit card number alone, I don't see the use. Which brings up names, how fare of can your name be? I know plenty of people who wouldn't think twice about leaving out a middle name that they hate.
Yes. They are asking so that it can be sent to the credit card processing and used as part of a anti-fraud algorithm. Have you implemented credit card processing yourself or used something like Stripe? It's honestly a pretty common option. At least around me in the North Eastern US, pretty much every gas pump will refuse to sell you gas if you can't provide the billing zip for the credit card.
We use multiple companies, all of which are "something like Stripe", to avoid dealing with PCI requirements. I've never seen any of them check zip or name, if you want added security you ask for 3D Secure/Verified by VISA. That will either require the customer to login via their online banking solution of enter the code sent to them via SMS.
On of our payment providers just told us today that by August 1st. 3D Secure will be required for all online transaction in the EU. It might be later, less than one month doesn't seem like a reasonable notice.
Honestly name and zip seems like something that's easily obtained by a scammer.
I don't know how many people actually use it, but it's definitely a common option. The idea is that it would be another layer in your anti-fraud protection, not that it would replace something else.
> I know plenty of people who wouldn't think twice about leaving out a middle name that they hate.
And I haven't met a bank that didn't ignore the middle initial when validating a credit card. Even though they all say "enter your name as it appears on the card".
Which just makes it easier for them to be stolen. If someone gets a hold of your card number they probably also have the record of what you bought. If you had it delivered to your house they have your first and last names and zip code. All they need is the CVV2 (pick a random number from one to one-thousand) and they're in the clear.
I really don't get credit card security at all. Seems to me to be a lot of smoke and mirrors that the banks just plaster over with insurance for when they have to give back stolen money. It doesn't actually prevent or deter theft, just sweeps it under the rug.
We implemented our payments with PayPal Website Payments Pro, and we actually get back the name and address verification information and can choose to ignore it (at our own peril re chargebacks)
I wonder if they have customer beyond US/Canada that they mention. Otherwise this would fail spectacularly in other countries in general (eg, UK: both letters + numbers, Taiwan: 3 digit zip code)
Canadian postal codes are both letters+numbers as well (formatted AxByCz, where A,B,C are letters, x,y,z are numbers), so UK seems like it would be safe.
Too many or few characters, like you point out as the case for Taiwan, would be the problem.
> There goes Australia and their 4 digit zip codes...
To say nothing of Iceland, the Faroes or Madagascar (3 digits) let alone Jamaica (2 digits, and only in Kingston and St Andrew elsewhere there's no zip code) or Somalia (2 letters)
There goes Australia and their 4 digit zip codes...