Hacker News new | ask | show | jobs
by devicenull 3733 days ago
You check the card number via the Luhn algorithm, and tell them about it? That's not giving any data to fraudsters.
2 comments

Luhn doesn't catch everything. (It will not detect transposition of the two-digit sequence 09 to 90 (or vice versa) - Wikipedia).

But, ok, what about an innocent CCV typo.

You need to give real users errors when they make mistakes.

If you at any point have access to the customers credit card number, then your doing something horribly wrong. Unless you're the payment processor.
Luhn algorithm can be done client-side - all it needs is the number.
Letting a customer enter a credit card and then parsing it on to the credit card processor means that you would need to be some level PCI complainant. You really really don't want to be close enough to the credit card numbers to do something with them, especially client side.

Having the credit card field, where you can access it, means that you become a target for people wanting to inject javascript into your site. Perhaps you're safe, but what about all the third party javascript libraries or tracking/remarketing/tracking script most sites have?

Sorry, it's a really bad idea. Let you credit card processor deal with the that hassle.

You can do that client-side, easy.