I've bought something from an online store, and when entering the card details, it sent the details to their server through a HTTPS connection, which I then assume they forwarded to their provider - who that is I don't have a clue.
I've since read on their site and they do say that they'll store card details, but:
- I cannot see these details or anything that would indicate stored card details on my account section.
- I had no option to save the card details for later use when entering them.
- I have no idea if they're storing the details as a token with their provider or in a plain text file on somebodys desktop. For what it's worth, I made the purchase and recieved the goods 3 weeks ago, yet the money has only just come out my account now which seems a little unusual.
So, is storing card details without the card holders permission a breach of PCI DSS? I've looked at the PCI-DSS documents and while they're fairly detailed, I can't find any mention of this.