Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF document to verify my identity and prevent credit card fraud from foreign credit cards.

This document asks you to fill out your credit card information again, as well as photocopy your government ID as well as the front and back of the credit card. Upon filling that our you are expected to scan the PDF, and send it back.

Surely this cannot be a safe practice. There is no mention of a privacy policy or who has access to the e-mail account it is supposed to be sent to nor does it make mention of archival policies.

Is this a violation of PCI (or similar compliance standards)?

share|improve this question
    
pcicomplianceguide.org/pcifaqs.php There is a little guide. I know when I was working for a company that was PCI compliant they were very strict. This doesn't sound like it complies best thing I can recommend is don't fill it out if you feel its sketchy. We had to have any secured communications encrypted. Which.. what you describe is no where near so :) –  Tony Nov 6 '12 at 22:51
2  
this sounds like an attempt to endrun around PCI-DSS, and yeah, I would say an attached PDF to an email is not secure. –  ewanm89 Nov 6 '12 at 23:44

2 Answers 2

up vote 2 down vote accepted

Yes, this would be in contravention of PCI requirement 4.1 ("Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open public networks").

Handling of the mail at the receiving end is very likely to be in contravention of many more requirements, including requirement 3.2.2 ("Do not store the card verification code or value").

If this company is a merchant and thus subject to PCI, I can't see any way they could be in compliance - I don't think there can be plausible compensating controls for this kind of thing.

share|improve this answer

Why don't you ask about their privacy policy? It would be the only way to resolve that aspect of the question.

I would expect your issuing bank or card company are the best people to ask if the request is compliant - they have the knowledge, authority and responsibility, and you can verify their identity. Commentators here at best will be able to refer you to a standards document, which you'll have to read, and then worry if your interpretation is accurate.

As to the practice itself - yes I think it's risky. Weigh it up against how badly you need to buy the product from that supplier. Credit cards can always be cancelled, but there can be lots of information on a government ID that shouldn't be floating around in someone elses data store.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.