Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Since credit card transactions like cash advance can be performed at most ATMs, are banks required to be PCI DSS compliant?

share|improve this question

1 Answer

up vote 2 down vote

The Payment Card Industry DSS rules also apply to banks. I was at a large UK bank that had to change it's customer database to make the card information more secure from staff as part of a PCIDSS initiative. This included obscuring part of the PAN (the long number) from operators in the call centres etc.

It should be noted however, that in certain jurisdictions (i.e. the UK) there are a lot of other regulators that have much more effective security controls that are placed on banks and so whilst PCI DSS is applied to the cardholder data usage, it is not the be all and end all.

share|improve this answer
1  
Are the controls you mention standardized or at the whim of individual bank? – Drew Lex Jan 30 at 14:06
It's a mixture. There are legal, contractual, regulatory and ethical standards to apply. Clearly the bank owns it's own appetite to risk and therefore can have it's own take on these standards. There is a balance between cost, security and functionality that each bank has to make a decision on before investing in an effective control framework. In my experience, it's rare for a bank not to take security standards seriously. – Callum Wilson Jan 30 at 14:10
Yep-having worked with almost all the major banks represented in the UK, I can state they take it more seriously than almost all other industries. – Rory Alsop♦ Jan 30 at 14:37
1  
@RoryAlsop - I can't say the same about US banks. There idea about required 2-factor authentication is a complete and total joke. A secret question ( asked when you log into a unknown electronic device ) while a second authentication is not what should be implemented. – Ramhound Jan 30 at 16:07
That is... scary, to be honest. – Rory Alsop♦ Jan 30 at 16:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.