eavesdropping credit card info

Posts: 3 · New Forum Member Joined: May 08, 2008 Posts: 3

I have another question about using Vonage for my small business. I regularly take credit card information over the phone, and I am concerned about eavesdropping. I understand that there is no encryption on Vonage. Should I be concerned about this? Are there some folks out there using Vonage to take credit card information regularly for their business?

Thanks for any comments.

Posts: 173 · Vonage Forum Master Joined: Dec 06, 2006 Posts: 173

Actually, it is the analog POTS line that is without encryption. This is the same type of voice line over which businesses have been taking credit card orders for decades. I think it is a very rare instance that identity theft occurs with a thief actually tapping a POTS line for the information.

Inherently, the Vonage service DOES have a level of encryption which makes their network much more secure than the analog POTS line. By encrypting analog information into digital packets, and sending these packets down the line, all a thief would hear would be a hiss. Unless he was a snake, this hiss would mean nothing, unlike an analog POTS line whose audio information would be, immediately, understood and intelligible.

Posts: 4661 · Vonage Forum **MVM** Joined: Aug 30, 2005 Posts: 4661

tophtml wrote:

By encrypting analog information into digital packets, and sending these packets down the line, all a thief would hear would be a hiss. Unless he was a snake, this hiss would mean nothing, unlike an analog POTS line whose audio information would be, immediately, understood and intelligible.

But credit card thieves are snakes, aren't they?? Cry

Posts: 173 · Vonage Forum Master Joined: Dec 06, 2006 Posts: 173

A point well taken! Very Happy

Posts: 4661 · Vonage Forum **MVM** Joined: Aug 30, 2005 Posts: 4661

Couldn't resist. Seriously, though, I agree with the basic message. Security with Vonage shouldn't be any worse than with POTS, and probably is better.

Posts: 3 · New Forum Member Joined: May 08, 2008 Posts: 3

I understand that "tapping" a vonage conversation may be more difficult technically speaking, however the information is traveling across the internet, and is accessible by computers. To me, it seems like this fact opens it up to a whole other world of vulnerability that a POTS line does not have.

If I had a computer set up for packet sniffing, I could probably work out a way to scan for vonage traffic. Then I could have the computer scan the vonage traffic for 16 digit numbers being read out loud. The numbers could be translated and automatically checked for validity. The valid numbers would then be written to a little text file called "stolen_card_numbers.txt" for the hacker to pick up later.

In fact, one could probably work up a nice little virus that would spread itself around many computers and relay vonage traffic found on it's subnet to a machine somewhere that could process the data for card numbers.

The efficiency of this arrangement would be much higher than physically hiking out to a POTS junction box and wiring into a single line with hopes of finding a valuable one. Not to mention much lower risk for the perpetrator.

That said, if there are no (or very few) documented incidences of credit card theft happening over a VoIP connection, then that might be good enough evidence for me.

Posts: 173 · Vonage Forum Master Joined: Dec 06, 2006 Posts: 173

I have never heard of credit card information theft occurring over a VOIP line. However, I HAVE heard of credit card theft occurring by hacking into various, large and secured credit card data bases. It seems that any hacker with a sufficient degree of expertise in sniffing and assembling packets would go for a concentration of this information in a database that is dedicated to this information rather than waste his/her time with an occasional credit card transaction over a VOIP line.

If credit card information is to be compromised, I think it is much more likely that it will come from a major financial institution, where there are tens of thousands of accounts, rather than the, relatively, few credit card transactions that a small businessman would process over his VOIP line.

Having said this I would add that while it may be technically possible to hack a VOIP line for the purposes of which you speak, it is highly unlikely that it would happen because it is easier and more profitable to hack into a financial institution's credit card data base.

Posts: 5

delgrifith wrote:

I have another question about using Vonage for my small business. I regularly take credit card information over the phone, and I am concerned about eavesdropping. I understand that there is no encryption on Vonage. Should I be concerned about this? Are there some folks out there using Vonage to take credit card information regularly for their business?

Thanks for any comments.

=========================================
If you have a cordless Digital phone (Which I have) that would further help in privacy. Also my ISP is wireless for about a mile which they tell me is FM signal encrypted. Then with Vonage so I guess I have triple encryption. Lol