在应用程序中保护信用卡交易

Question

I want to be able to sell products (via credit card) to people using my app. It's easy enough to put some EditTexts in and get them to give me their details but the issue is security of course. What is a good way to go about doing secure credit card transactions in app?

My Big Concern - Someone else makes a fake app that looks the same, with the same icon and app name and gets potential users to download their fake app and steal their credit card information. (Can people maybe even have the same developer account name?)

What I know so far - The package names of apps served off Google Play are unique so a user could identify if the package name is not what it should be. This isn't a good solution for the typical user though.

I'm not planning on storing the credit card details or anything. I just want to be able to do once-off card transactions securely. Any advice would be super welcome and receive much upvoting.

Answer 1

All you need to do is be able to work with Authorize.Net's, or any payment gateways, API to make payment.

Authorize.Net - Android SDK

Boku Mobile Billing

Answer 2

Since you stated that you would be selling products to users using your apps I'm assuming you will have the user details stored somewhere in a database yea? Moreover, you will have some sort of authentication using a username and a password so this means that even if someone else makes the exact same app as you did they will not have the user's username and password (assuming you hash your usernames and their passwords) or the real name of the user which he/she provided during sign-up into your app. Even if the hackers are smart and just use a dummy login page, ie irrespective of the username and password entered you are logged in I'm sure users will be wary if they don't see a message saying "Hi X (real name of the user)" when they sign into your app (provided you have some functionality where you display the user's real name when they are signed into the app, this is pretty easy to implement). Having said all this, I haven't heard of a case where someone duplicated an entire app (which is no mean feat if you make a sophisticated app) simply to steal user's information.

Regarding the issue of securely accepting credit card information from users and charging it, one of the most trusted, industry-accepted and secure way of accepting user details is using Stripe.com . What's more is that they have a nice RESTful API through which you can make calls and charge the requisite amount from a user's credit card in the safest manner possible. The advantage of this is that you don't have to store the credit card information anywhere and simply use it once to make a call to the Stripe API (which is available in Java btw).