Payment security

Who processes card data

The card number, expiry date and CVV never reach GemPay. They are entered directly on the payment organisation's secure page and stay there.

Who processes it

A payment organisation operating under Uzbek law

What GemPay sees

Only the payment status: approved or declined

Is the card number stored

No — it never exists in GemPay's systems

Connection

TLS-encrypted, HSTS enforced

Standard

PCI DSS — the international requirement for card processing

3-D Secure — for international cards

Payments with Visa, Mastercard cards are additionally confirmed through the 3-D Secure protocol. Visa calls it Visa Secure; Mastercard calls it Mastercard Identity Check.

3-D Secure hands the right to approve a payment to the bank that issued the card. So even someone who knows the card number cannot complete a payment without the confirmation your bank asks you for.

1. 1
   The card is entered

   On the payment organisation's secure page. GemPay does not see these details.

2. 2
   The bank asks for confirmation

   The page hands off to the issuing bank: a push in its app, an SMS code, or biometrics.

3. 3
   You confirm

   Confirmation happens on the bank's side. The code goes only to you, and you never need to share it.

4. 4
   The payment completes

   Once the bank answers, the payment goes through and the order moves to fulfilment.

Local cards — UzCard and HUMO

UzCard and HUMO cards are confirmed with a one-time SMS code (OTP) rather than 3-D Secure. The protection works the same way: only the person who received the code can complete the payment.

• The code goes to the phone number linked to the card.
• It expires quickly — usually within a few minutes.
• If the code is wrong the payment fails and no money is taken.
• If a code arrives unexpectedly, someone is trying to use your card. Do not enter it; tell your bank.

Anti-fraud measures

GemPay monitors payments under the agreement it has with the acquiring bank. The aim runs both ways: protecting cardholders from unauthorised use of their money, and protecting the service from fraud.

• Payment monitoring — unusual frequency, amounts and repeat patterns are watched.
• Limits — a daily cap applies per account and per card.
• Step-up authentication — where there is doubt, 3-D Secure or OTP becomes mandatory.
• Temporary hold — a suspicious order is held until the review finishes.
• Refusal — where fraud is confirmed the service is not provided and the money returns to its source.
• Cooperation with the bank — on disputed payments (chargebacks) documents are supplied at the bank's request.

What happens with a suspicious payment

If you believe an order was stopped in error, message support with the order number: https://t.me/StarsPaymeeSupport. You will get an explanation of the result.

What we will never ask for

• The password to your game account, or any way to log into it.
• Your card PIN or the CVV on the back.
• A one-time code from your bank or from Telegram.
• Your email or Telegram account password.
• A full photo of your card or a scan of your ID — over Telegram.

Advice for cardholders

• Check that 3-D Secure or SMS alerts are switched on for your card — the cheapest protection there is.
• Use a separate card for payments, or a virtual one with a low limit.
• After ordering, compare the amount in your bank alert with the amount on screen.
• If you see a payment you do not recognise, tell your bank first, then us.
• Be wary of anyone offering help in GemPay's name — there is one official channel: support.