Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way for a consumer to report PCI non compliance?

share|improve this question
Not that this will help, but PCI does require you to handle security reports... But of course, if they're not compliant, they probably dont have that either... – AviD Apr 20 '11 at 19:26
@Avid: and what about the companies which show off that they are following PCI-DSS standard? How can a consumer report in that case for non-complaince? – p_upadhyay Apr 21 '11 at 8:33
It might be useful for you to describe (with an appropriate level of anonymity) what they're doing that you find non-compliant. It impacts how realistic it is you'll be able to get anyone to act. HTTP instead of HTTPS, sure. Not having assurances from their service providers on file, less so. – gowenfawr Aug 22 '14 at 4:20

The PCI organization sets the standards. The card brands enforce those standards with fines. If you contact a brand (Visa, American Express, etc)., they may act on it. I am not aware of any PCI compliance hotline, and it may involve a lot of transfers and "call this person" redirects to find somebody... who may do nothing anyway. If you have the time, though, I encourage you to work on finding your way through that process.

share|improve this answer

If you are dealing with a normal merchant, one of the few ways would be to notify their processor, at which point they COULD be charged penalty non compliance fees, but it would depend on a large amount of variables. If you have a CCN stolen and traced back to that location, you can report that to your bank, and to the credit card company that issued your card, which will typically trigger a PCI forensic audit.

If they are a medical entity (any entity that handles protected health information) you can typically submit a complaint under HHS website for a HIPAA violation under section 164.308. If they are not handling correctly credit card information correctly, there's a solid chance that they haven’t taken care of the following sections of their compliance:

164.308(a)(1)(ii)(A) Risk analysis (R) 164.308(a)(1)(ii)(B) Risk management process (R)

164.308 is regarding administrative safeguards. If there's credible evidence that PHI, (which includes Credit Card Numbers) has been compromised, or incorrectly handled, there would typically be a HIPAA audit which would also cover credit card requirements.

Be aware that there are typically tens thousands of dollars in fines if they are caught without the requirements necessary which can sometimes put a business under. Something to keep in mind before filing any complaints.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.