Does requiring users to fill out a PDF w/ CC information and mail it back violate PCI compliance?

Question

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF document to verify my identity and prevent credit card fraud from foreign credit cards.

This document asks you to fill out your credit card information again, as well as photocopy your government ID as well as the front and back of the credit card. Upon filling that our you are expected to scan the PDF, and send it back.

Surely this cannot be a safe practice. There is no mention of a privacy policy or who has access to the e-mail account it is supposed to be sent to nor does it make mention of archival policies.

Is this a violation of PCI (or similar compliance standards)?

Answer 1

Yes, this would be in contravention of PCI requirement 4.1 ("Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open public networks").

Handling of the mail at the receiving end is very likely to be in contravention of many more requirements, including requirement 3.2.2 ("Do not store the card verification code or value").

If this company is a merchant and thus subject to PCI, I can't see any way they could be in compliance - I don't think there can be plausible compensating controls for this kind of thing.

Answer 2

Why don't you ask about their privacy policy? It would be the only way to resolve that aspect of the question.

I would expect your issuing bank or card company are the best people to ask if the request is compliant - they have the knowledge, authority and responsibility, and you can verify their identity. Commentators here at best will be able to refer you to a standards document, which you'll have to read, and then worry if your interpretation is accurate.

As to the practice itself - yes I think it's risky. Weigh it up against how badly you need to buy the product from that supplier. Credit cards can always be cancelled, but there can be lots of information on a government ID that shouldn't be floating around in someone elses data store.