Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Is it good idea to put a captcha on credit card payment form?

I am thinking to put one on my asp.net mvc application's payment section to make it more secure but I have never seen anybody doing that.

share|improve this question

migrated from stackoverflow.com Jun 26 '11 at 21:19

This question came from our site for professional and enthusiast programmers.

    
how on the earth is this question off topic? –  tugberk Jun 26 '11 at 12:49
1  
It's not a programming question, it's about the business rules and security. –  skolima Jun 26 '11 at 14:16
    
@skolima isn't it related to security of the code? or I just don't know anything. –  tugberk Jun 26 '11 at 14:37
    
I'd say it is more in the realm of the security of the business process, and the most important thing is what the transaction processor (Visa/Mastercard/etc.) requires. –  skolima Jun 26 '11 at 14:41

4 Answers 4

up vote 4 down vote accepted

I'm not the biggest fan of captcha's but when they are useful they should be used.

If you validate card number (as I think you should) you could use a captcha only after a certain number of wrong successive tries by a user (identified by its IP address and timestamp).

share|improve this answer
    
that's a decent idea. –  tugberk Jun 26 '11 at 12:50
    
+1 I was about to write something similar! –  Dommer Jun 26 '11 at 13:50
    
Here is a good article that explains this princible codinghorror.com/blog/2009/02/… –  Daveo Jun 27 '11 at 5:53

If you're worried about automatic transactions with stolen credit card numbers then it is certainly a decent idea. In most cases, however, you're just going to annoy the user. That's the last thing you want to do when they're looking to order a product from you.

share|improve this answer

Your goal is to make the payment process as simple and straightforward as possible. Adding a CAPTCHA to your payment form will do the opposite of that.

CAPTCHAs are notoriously difficult to complete. They have to be complex to defeat bots that are continually getting more and more sophisticated. But that complexity makes it more difficult for humans to complete as well. If you make the CAPTCHA easy to complete then not only is it easier for the bots to defeat, all you've done is add yet another field for users to fill out.

Using session tokens and honeypots are easy ways to find bots without humans ever knowing they were there. So start of with them and then if a user seems to be submitting a lot of forms in a short period of time and/or their payments are repeatedly declined, then use a CAPTCHA to make sure they are a human being.

share|improve this answer

i might be wrong but Captcha is used to disable spamming/automating input so that the user would have to do it his/herself.

You could probably just create a delay so that the user can't submit details repeatedly in a short amount of time instead of adding another field to fill out.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.