Tag Info

New answers tagged

-1

Isn't the target breach based upon compromised terminals? In which case, no amount of encryption on the card itself will help. What would be interesting to find out is where the original infection occured, since the POS machines must have been connected to a machine that must've been exposed to the malware. It's either going to be infected media like usb, or ...


4

Yes, PCI DSS requirement 4.2: Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.). Unless the email is somehow encrypted, you are not allowed to use it to send cardholder data.


1

In practice, it violates the DSS. In theory, it could possibly not, but that's pedantry rather than reality. DSS Requirements 3.4 ([Encrypt] PAN data in storage) and 4.1 (Encrypt PAN data across public networks) are generally violated by SMTP mail. Each mail hop is a store-and-forward gateway that writes mail to disk even if only temporarily; unless it's ...


2

“Chip and PIN” banking cards have a chip, as the name indicates. The chip performs cryptographic operations and stores secret keys. The chip isn't just storage, it's a processor and the storage is not directly accessible from the outside. The chip is physically protected against duplication — it's embedded in a protective layer and designed to self-destruct ...


1

Traditional cards are simply a magnetic strip with a very small number of bits on it, and anyone can read (or effectively re-write) those bits. The security of basic bank cards therefore does not depend on any innate secrecy or integrity. Everything you want to know is on Wikipedia: Info is usually ISO/IEC 7813 It's not a smart card, and has no private ...


3

Yes, it's in scope. There's actually a pretty thorough and explicit guide from the PCI Security Standards Council (the DSS people) to your exact question here: Information Supplement: Protecting Telephone-based Payment Card Data Which makes reasonably clear statements like this about card numbers: Call centers will need to ensure that PAN data is ...


0

Well if your wholesaler does not offer an automated way to process data, you're going to have a hard time not storing the credit card info. This means that you probably will also have to get SAQ-D. Storing a token of a card is not the same as storing the card details. In your case you will have to store the PAN and Verification code for as long as the ...


2

It's difficult to comment given that it's unclear what your purchase model is supposed to be. In particular it is not clear what the “blank e-mail” feature is for. Are you trying to do e-mail address verification? The more usual method is to allow the user to enter an e-mail address on a web form, and then receive a mail containing a token or URL that ...


1

It's a question of cost and benefit for the seller and the card holder. A stolen/lost credit card: cannot be used in caldholder-present transactions (unless the PIN was revealed) can be used in caldholder-not-present transactions, but the owner of the card will be reimbursed thanks to the credit card insurance. In this setting: The seller always gets ...


0

For Chip & Pin to work online, the customer would need a pinpad plugged into their computer. In some European areas, the bank will provide a pinpad so the card can be used online with the added protection. It's a case of somebody absorbing the cost to use the technology for the added security. For card present transactions, it's pretty easy to get the ...


5

With cardholder-not-present transactions, if the transaction turns out to be fraudulent, the retailer has to refund the money. With Chip and PIN, the retailer gets to keep the money, and either the bank or the cardholder bears the loss of the fraudulent transaction, depending on whether the cardholder has told anyone else their PIN or not. So retailers want ...



Top 50 recent answers are included