Security and how we handle card data
nyfinepay is an independent private service, not the City of New York. You can always pay the city directly, which may cost less.
Paying a ticket means typing a card number, so here is plainly how we handle it, what we keep and what we do not.
Encrypted connection
nyfinepay.com is served over HTTPS, and we tell browsers to keep using HTTPS. Look for the lock in your address bar and check that the address is nyfinepay.com before you enter anything.
Your card details
Your card number and security code are typed into secure fields hosted by our payment security provider, Evervault. They are encrypted in your browser before anything is sent. Our servers receive only the encrypted values, plus the expiry date, the card brand and the last four digits. Our server rejects any card value that is not encrypted, so a plain card number is never accepted. We do not store your full card number or security code in our records.
What we keep, and for how long
- Your search and selected tickets: held in memory for your session (one hour) and then discarded.
- Order details: the tickets paid, the amounts, your name, email and billing address.
- Records of the payment: the outcome, the city’s confirmation number, and records and screenshots of the payment steps, kept to confirm that your payment went through and to resolve problems. These may show the contact and billing details you entered.
Order records are kept as long as needed for accounting, tax, fraud prevention and dispute handling, which can be several years. Details are in our privacy policy.
The one cookie
We set one essential cookie, nfp_sid, when you search. It keeps your search and order together, expires after an hour, and is not used for advertising or tracking.
Browser protections
Our pages send a strict content security policy, forbid being shown inside another site’s frame, and limit what is shared in the referrer. Pages other than checkout load no third-party scripts. The checkout page additionally loads Evervault’s script and card fields.
Deleting your data
Email support@nyfinepay.com and tell us what you want deleted. We will delete what we are not legally required to keep and answer within 45 days. The rights you have are described in the privacy policy.
Reporting a security problem
If you believe you found a weakness, email support@nyfinepay.com with details. Please do not include anyone’s card number or other personal information in your message.
Staying safe
- Only pay through addresses you typed yourself or trust. The city warns that unexpected text messages with payment links are scams.
- Nobody can legitimately promise to reduce your ticket in exchange for payment; the city calls such offers scams.
- We will never email you asking for your card number.
Read how a payment works in how it works, or contact us.