Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

I've bought something from an online store, and when entering the card details, it sent the details to their server through a HTTPS connection, which I then assume they forwarded to their provider - who that is I don't have a clue.

I've since read on their site and they do say that they'll store card details, but:

  1. I cannot see these details or anything that would indicate stored card details on my account section.
  2. I had no option to save the card details for later use when entering them.
  3. I have no idea if they're storing the details as a token with their provider or in a plain text file on somebodys desktop. For what it's worth, I made the purchase and recieved the goods 3 weeks ago, yet the money has only just come out my account now which seems a little unusual.

So, is storing card details without the card holders permission a breach of PCI DSS? I've looked at the PCI-DSS documents and while they're fairly detailed, I can't find any mention of this.

share|improve this question
1  
Very off topic, but you submitted your card details to the merchant. That would seem to me you're implicitly giving permission for them to use those details. Whether the merchant is PCI compliant is unfortunately an entirely different matter – PaulG Mar 22 '12 at 11:21
@PaulG Yeah, the more I re-read the question the more I'm questioning why I even put it here! Still, thanks for commenting anyways. I don't think StackExchange has anywhere where this sort of question would fit nicely, although strangely there is no shortage of PCI compliance questions on SO... I'm not sure of the policy of closing ones own question or just deleting it? – R4D4 Mar 22 '12 at 11:26
1  
There are lots of other reasons the charge is just now showing up. – Ramhound Mar 22 '12 at 17:10
R4D4, this sort of question fits quite nicely right here... Welcome to IT Security! – AviD♦ Mar 25 '12 at 16:57

migrated from stackoverflow.com Mar 22 '12 at 14:30

3 Answers

up vote 6 down vote accepted

As far as I'm aware PCI-DSS doesn't cover permission of the user for storing data (depending on where you live something like the Uks Data Protection Act might). That said if a company is storing full track data (inc CVV2) they wouldn't be compliant with DSS. They may only store card details for the purposes of tracking things like chargebacks, although from what I've seen many merchants are moving away from storing card details if at all possible due to the resultant compliance headaches.

share|improve this answer
up vote 0 down vote

PCI-DSS covers HOW data can be stored. The merchant agreement, and more importantly cardholder acceptance rules determine WHEN card data can be stored. For example, see Card Acceptance Guidelines for Visa Merchants. http://usa.visa.com/merchants/new-acceptance/merchant-guidelines.html

share|improve this answer
up vote 3 down vote

PCI Requirement 3.1 requires card holders to keep card storage data to a minimum...

If it isn't a service that requires reoccurring charges or the like I think it would fall under more data than they should retain (for charge back tracking they can keep other data, hashes, partials, etc).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.