Is it good idea to put a captcha on credit card payment form?

I am thinking to put one on my asp.net mvc application's payment section to make it more secure but I have never seen anybody doing that.

  • how on the earth is this question off topic?
    – tugberk
    Commented Jun 26, 2011 at 12:49
  • 1
    It's not a programming question, it's about the business rules and security.
    – skolima
    Commented Jun 26, 2011 at 14:16
  • @skolima isn't it related to security of the code? or I just don't know anything.
    – tugberk
    Commented Jun 26, 2011 at 14:37
  • I'd say it is more in the realm of the security of the business process, and the most important thing is what the transaction processor (Visa/Mastercard/etc.) requires.
    – skolima
    Commented Jun 26, 2011 at 14:41

4 Answers 4


I'm not the biggest fan of captcha's but when they are useful they should be used.

If you validate card number (as I think you should) you could use a captcha only after a certain number of wrong successive tries by a user (identified by its IP address and timestamp).


If you're worried about automatic transactions with stolen credit card numbers then it is certainly a decent idea. In most cases, however, you're just going to annoy the user. That's the last thing you want to do when they're looking to order a product from you.


Your goal is to make the payment process as simple and straightforward as possible. Adding a CAPTCHA to your payment form will do the opposite of that.

CAPTCHAs are notoriously difficult to complete. They have to be complex to defeat bots that are continually getting more and more sophisticated. But that complexity makes it more difficult for humans to complete as well. If you make the CAPTCHA easy to complete then not only is it easier for the bots to defeat, all you've done is add yet another field for users to fill out.

Using session tokens and honeypots are easy ways to find bots without humans ever knowing they were there. So start of with them and then if a user seems to be submitting a lot of forms in a short period of time and/or their payments are repeatedly declined, then use a CAPTCHA to make sure they are a human being.


i might be wrong but Captcha is used to disable spamming/automating input so that the user would have to do it his/herself.

You could probably just create a delay so that the user can't submit details repeatedly in a short amount of time instead of adding another field to fill out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.