But they will have other options where the client does get the details and passes them through via the API. This can be used to give a highly tailored user experience and can be considered "more professional". However, it's important to destroy records once passed.
In America I almost always get an email from OT one or two days prior asking me to confirm my reservation.
Should not a degree of proactive flagging have taken place at that point?
One would have thought so. My opinion of the directors of OpenTable is now that they are selfish greedy scumbags until they can explain themselves.
Ah yes, good point. I suspect you're right!
I don't see where the client gets the details here - it'll be passed as a hashed object straight into the API, storage is unnecessary for a customised user experience - it's only required for recurring payments.
Indeed - i had the (wrong) impression that they'd got the full card number and were only calling up for the CSC.
I can confirm in the conversation the person who contacted me only had the last 4 digits of my card number, that's what prompted me to think it was bone fide. It was only the nagging doubt that I had not seen any transaction on my statements that stopped me from giving him the CCV.
Quite likely a brief lapse with their security certificate prompting an unsafe flagging from Google Elizabeth, the site loads fine for me now. Basically anyone publishing a website registers with a service that certifies they own the web address they're using and this certificate is recognised by software like Google, a lack of which will prompt a rather alarming warning page as you observed. It's usually a matter of the certificate not being renewed on time or a cock up on the IT bod's side rather than anything sinister, but always worth mentioning to the business involved.
Should have asked for vouchers
