Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it?

I can't seem to find an official reference that describes this as a PCI DSS requirement. Is it one? If so, where can I find it?

share|improve this question
Where have you heard this? As far as I know, PCI DSS doesn't really care about payment processing at this level. To be honest, this is the first time I hear of such thing. – Adi Oct 22 '13 at 13:47
This question appears to be off-topic because it has nothing to do with information security. – Adi Oct 22 '13 at 13:48
You won't find one because it isn't a requirement, just an option, albeit probably the most common option, which may be why you were under the impression it was required. – Xander Oct 22 '13 at 13:59
@Adnan I think PCI DSS is in scope of Primarly because it stands for Payment Card Industry Data Security Standard and Data Security is in scope of our website. – Lucas Kauffman Oct 22 '13 at 14:35
No, no special meaning that I'm aware of in the context of PCI. They're more accounting driven than anything, and the options could potentially be any scheme you could think up. I'm not aware of any restrictions specific to PCI. Perhaps the next most common option, however, would be capture at sale. – Xander Oct 22 '13 at 14:39
up vote 3 down vote accepted

PCI DSS doesn't cover such topics as these. What you're looking for are the various card brand operating regulations. From a security/risk management perspective for ecommerce, Visa also has this guide:

share|improve this answer

The matters of payment capture and shipping aren't covered or related to PCI DSS.

share|improve this answer

PCI-DSS is a security document concerned with how to properly secure Personal Credit Information. Regulations about capture of payments are unrelated to data security and thus are not covered by PCI-DSS.

You may be thinking of merchant service requirements which are contractual obligations with either your payment processor or your merchant bank, but they are not security related.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.