Credit Card Removal After Account Has Been Cancelled - Security Risk

Product owner - do you not think about security??? After an account is closed and after the last bill has been PAID, you should delete/remove users cc information as well. 

This is a huge security risk! For your company and your user!

Also, users should not be required to remember to call/email support to have the sensitive card information remove.

In additional, what's up with the 1 cc rule per account? Is it to reduce cc fraud? If it is, then you missed a bigger chunk as stated above. I only discovered this when I tried to switch my cc from my spouse's inactive account. You should allow a cc to move to another 'ACTIVE' account.

AND, is this is for users that want to save money? Your target audience and market segments? Why would they have multiple CCs per household??? 

Sincerely,

A product owner executive with security background 

0

Comments

3 comments
  • Hey Cheada, 

    We don't actually keep credit card information on file. We keep authorization tokens to stay PCI-compliant. Per our VP of Customer Experience, we do remove authorizations once the final bill has cleared.

    The 1 Card-per-account rule is indeed to reduce credit card and Ting account fraud. If you haven't yet, contact our support team at help@ting.com and we can help you remove a card from an inactive and completely-paid-up account.

    0
    Comment actions Permalink
  • Hi Mitch,

    Thank you for the update! Yes, I did contact your support team and would be happy to forward over the chat conversation we had regarding this. Seeing that you use Zendesk, you can easily pull up that conversation from your end as well. Seems like there is a gap in training because her response was that cc cannot be removed from an inactive account until after three months and that it’s not automatic removal there after and that I would need to call you back to have it removed.

    Obviously this is what triggered my concern. With that being said, when I contact your support team tomorrow, will someone with the right training be able to help me? Or is it better that I am given a direct contact that knows his/her stuff. Thanks.

    0
    Comment actions Permalink
  • Without getting into too many account details, you've still got an active line on your account, and that's why we're not able to remove a credit card from it. When you contact support, they can move or deactivate that line as needed.

    I have full faith in the agent who handled your case, as all Ting agents are well-trained and know their stuff. 

    0
    Comment actions Permalink

Please sign in to leave a comment.