Using credit cards online: is it safe?
You're right that someone who, say, photographed the front of your card at the store could use it to make some online purchases. Schemes like Visa's 3-D Secure provide additional online security by having you enter your password on the issuer's website, but they aren't common yet in the US. But as littleadv says, you as the cardholder generally aren't liable for fraud (except $50 in some cases). Just be sure to check your statement monthly and notify the issuer of any fraud within 60 days. To issuers, fraud losses are fairly predictable, and the cost is acceptable. So, my questions: Are payment cards provide sufficient security now? Yes. If so, how is that achieved? Depending on your country's laws, of course. In most places (The US and EU, notably), there's a statutory limit on liability for fraudulent charges. For transactions when the card is not present, proving that the charge is not fraudulent is merchants' task. Why do online services ask for all those CVV codes and expiration date   information, if, whenever you poke the card out of your wallet, all of   its information becomes visible to everyone in the close area? What   can I do to secure myself? Is it? Try to copy someones credit card info next time you're in the line at the local grocery store. BTW, some of my friends tend to rub off the CVV code from the cards   they get immediately after receiving; nevertheless, it could have   already been written down by some unfair bank employee. Rubbish. "Why do online services ask for all those CVV codes and expiration date information, if, whenever you poke the card out of your wallet, all of its information becomes visible to everyone in the close area? What can I do to secure myself? I'd guess that's to protect the card company, not you.  The number of the card is guessable, but each other bit of information makes it much harder to guess (the CVV code makes it ~1000 times harder, the expiration date makes it about 50-100 times harder).  Since you wouldn't be responsible for the payment anyway, adding security for online transactions provides the company with less liability. As for the security of your information online, that's trickier. It depends entirely on the site you're using whether they've implemented the appropriate security measures or not (and, given the SSL attacks we've seen, even that might not help).  (source: I'm a web developer, and have worked on payments systems before that implemented the security mandated by the cards).  At the very least never, ever type in your information on a non-https site (there's normally a little ""lock"" icon that will display if you're on HTTPS instead of HTTP)." The answer: don't use your actual card number. Some banks offer virtual credit card numbers (services like Apple Pay are functionally the same). Bank of America's virtual cards work like this: The virtual card number is different from your actual card number, so the merchant never sees your real card number. In fact, the merchant cannot even tell that you are using a virtual card. You can set the maximum amount to be charged. You can set the expiration date from 2 to 12 months. Once the merchant has made a charge on that virtual card, only THAT MERCHANT can make any further charges on that same virtual card. It is not possible to discover the real card number from the virtual card number. So the result is that your risk is reduced to the merchant not delivering the order, or charging too much (but not over the limit you set). There is nothing to be stolen since your real info never goes over the internet, and once a merchant has used the virtual card once, no other merchant can use it. Other banks may have virtual cards which have fewer features. The only DISadvantage of this is that you have to go to the bank's website whenever you want to make a purchase from a new merchant. But you don't have to worry about them stealing your real credit card information.
There's no requirement to use these OTP systems to process Internet transactions. Some merchants are using them, some are not. PayPal does not since they are not the receiver of the money but rather a merchant processor - so they don't assume any risk anyway and wouldn't bother. "Most cards, through most banks, already have limits on how much you might be liable for if the card is misused, and have mechanisms for ""charging back"" unauthorized transactions.  I'm not sure using a prepaid card would significantly improve your security." There are API libraries available to various banks in various programming languages. For example, in Perl there are many libraries in the Finance::Bank:: namespace. Some of these use screen-scraping libraries and talk to the GUI underneath, so they are vulnerable to any changes the bank makes to their interface, but some of the better banks do seem to provide back-end interfaces, which can then be used directly. In either case, you should still be sure that the transactions are secure. Some bank sites have appallingly bad security. :( A good place to start is to call your bank and ask if they offer any programming APIs for accessing their back end. USAA does - that's my bank. Wells Fargo tries to determine whether the online activity is a risk; if it is, they'll require an SMS code or phoned code be entered. You can get a fairly definitive list of online companies at twofactorauth.org. "I think what you are looking for is a secured credit card. They are mostly used by people who have ruined their credit and want to rebuild it, but it might also serve your purpose.  Essentially you deposit some money in an account and the credit card can be used up to the amount left in the account. Each month when you pay the bill, it resets the balance that you can charge. Also, many credit card providers also offer ""disposable"" or ""one use"" credit card numbers for the express purpose of using it online. It still gets charged against your regular account, but you get a separate number that can only be used for up to X dollars of transactions." I've had a card cloned 15 years ago and used to buy over 5k of goods in another country. So the inconvenience of having a card closed and re-issued is quite annoying even though the charges were reversed and I was made whole. But these days most CC fraud isn't from a card scanned by a waiter and cloned then used elsewhere. Mostly it is poorly secured databases or point of sale terminal malware. The latter is getting curtailed by chipped cards and the largest source of fraud is now online transactions (so called card not present) where the merchant has your CC number. If their system is breached the bad guys have a wealth of card numbers they sell in an E-bay like site on the dark web. This is where the Citi virtual CC comes in handy. Here's how it works to protect the bank and the hassles you go through when a card as to be re-issued. Citi's virtual CCs let you generate an actual credit card, complete with security code and expiration date. What is unique is that once the virtual CC is used it can only be used subsequently by that same merchant and is declined by any other. You can also set a total limit on what the merchant can charge as well as an expiration date. I use them for all my online accounts because they are, for all practical purposes, immune to the malware that steals CC info. Even if somehow the virtual CC is used before the merchant makes the initial charge that locks in the CC to their account the charge can be reversed without closing your actual card which has a different number. You can manage multiple Citi virtual CCs and view charge status, close, or adjust limits over time so managing them is quite easy with no risk to your primary account. In Addition to @JoeTaxpayer's answer, in the UK credit cards offer additional protection than if you were to pay by debit card. This includes (but is not limited to) getting your money back if the company you've bought something from goes bust before your order is complete. There generally isn't much in the way of real identity verification, at least in the US and online.  The protection you get is that with most credit cards you can report your card stolen (within some amount of time) and the fraudulent charges dropped. The merchant is the one that usually ends up paying for it if it gets charged back so it's usually in the merchant's best interest to do verification.  However the cost of doing so (inconvenience to the customer, or if it's an impulse buy, giving them more time to change their mind, etc) is often greater than the occasional fraudulent charge so they usually don't do too much about it unless they're in a business where it's a frequent problem. "With regard to your edit (although I didn't downvote): one way to reduce the security risk is to separate the payment from the ability to drain your account.  A considerable part of the security risk is inherent in giving people a number which is directly linked to a bank account where you keep all your money.  If you don't want that risk, don't do that.  Instead of (or in addition to) trying to reduce the chance of fraud, you can reduce the impact of fraud, even if it occurs, by not paying for things using the details of an account where you have all your money.  Trying to protect against fraud while keeping all your money in the account is sort of like carrying around thousands of dollars in cash in your wallet and then worrying about how to defend against robbery.  Yes, you can carry a weapon or hire a bodyguard, but it's probably simpler to just not carry that much money in the first place. You already mentioned one solution with your option #1, which is to just keep a small amount of money in a separate account and use that for online payments.  Assuming you can easily transfer money in and out of this account via online banking, this effectively is what you say you want in your edit: you log in to your bank online, but rather than ""informing it"" you're about to make a payment, you just transfer money in.  You'll probably have to keep a small amount of money in the account to keep it open, but if this is an important issue for you, that shouldn't be that big a deal. Another solution is a credit card.  With a credit card, you simply make the payment online.  In the US, if the merchant (or someone else stealing the info) makes fraudulent charges, the credit card company assumes the liability and the consumer suffers only the inconvenience of having to get a new card issued.  I don't know what the UK laws are regarding credit vs. debit fraud, but some sites I found seem to suggest that credit cards have fraud protection in the UK as well.  This is probably worth looking into if you are concerned about fraud." The credit limit is not going to be the problem; the daily spending limit is more likely be tripped first. I'm not a lawyer but if you are not responsible for the credit card details being leaked it is very unlikely that the bank will be able to charge you for fraudulent spending on the card. The important thing is to notify the bank as soon as possible once you realize there is a problem and if practical keep evidence of that notification, it will then be the banks problem to fix. From my understanding Singapore has relatively good consumer protection and it is unlikely the bank will get very far even if they try to charge you. Yes, but note that some credit card companies let you create virtual cards--you can define how much money is on them and how long they last.  If you're worried about a site you can use such a card to make the payment, then get rid of the virtual number so nobody can do dirty deeds with it. In practice, however, companies that do this are going to get stomped on hard by the credit card companies--other than outright scams it basically does not happen.  (Hacking is another matter--just pick up the newspaper.  It's not exactly unusual to read of hackers getting access to credit card information that they weren't supposed to have access to in the first place.) So long as you deal with a company that's been around for a while the risk is trivial. If I remember correctly my own experience : no you can't. Paypal will block the money even if it's only for online payement. This is a question with a flawed premise.  Credit cards do have two-factor authentication on transactions they consider more at risk to be fraudulent.  I've had several times when I bought something relatively expensive and unusual for me, where the CC either initially declined and sent me a text asking to confirm immediately (after which they would approve the charges), or approved but sent me a text right away asking to confirm (after which they'd automatically dispute if I told them to).  The first is legitimately what you are asking for; the second is presumably for less risky but still some risk transactions). Ultimately, the reason they don't allow it for every transaction is that not enough people would make use of it to be worth their time to implement it.  Particularly given it slows down the transaction significantly (and look at the complaints at the ~10-15 seconds extra EMV authentication takes, imagine that as a minute or more), I think you'd get a single digit percentage of people using that service. One can't, this is a systemic problem and when One bank goes pop, it drags a couple down with it. While swaps should have worked to keep the system safe at one time, when money was real, they now act as anchors that drag the entire chain down because the volume of funny money debt is so great its just not ever getting paid back. Best bet is to burn the Fed down "A slower approach: keep any discussion of income out of it to begin with. Remaining within discretionary income Z, just go back to the charities your SO has proposed, and say that you would like to set up monthly donations. You would also like to donate a similar amount to charities of your choice. Say what bills your proposed contribution is less than. Once your SO has got used to the idea of charitable giving as a regular expenditure, and has got back the grateful charity newsletters and whatnot, then address the issue of how much you ""should"" give by comparison with income. Whenever you do consider income, your SO doesn't really seem to want anything to do with this. So I'd approach it as seeking agreement. Eric Lippert has a more long-term approach for seeking involvement. So, present the following information however seems best, probably with a pre-amble establishing that you both want to support charities, so the question is how much and how to get it done. ""We earn U. This means we are fortunate enough to be in the top V% of households. Our income breaks down as: This being the case, we can afford to be generous. I would like us to give to the charities that we each care about, to the extent of N. Charitable giving is important to me because ... The amount I suggest we give is less than what we spend annually on ..., and I chose that amount because ... "" Depending on the tax situation, you may then have to explain how N from gross income translates to an actual amount available to give to charity. Or charitable giving might be tax free. If the N you want is greater than Z-A then it might be wise to suggest a smaller amount, but ask that you both make a plan in increase it in a year or whatever. Similarly if N strikes your SO as a scarily large number then I would think the best thing to do is just reduce it so that at least you start somewhere. If Y is low or zero, and your SO suffers from anxiety about financial security, then increasing Y at the same time might be a good way to offset the fear of N. When stating income you might want to exclude any income from savings/investments. Although legally it's income your SO might see it psychologically as capital gains and hence touching it would endanger your savings/investment/pension returns. Even though it's all fungible."