11

Question for any PCI experts out there:

Airport ticket kiosks can use your credit card to find your reservation at checkin time. So clearly PCI must allow use of credit card numbers to identify customers. I assume the airline is storing an irreversible hash of my credit card number with my reservation, and when I visit the checkin kiosk they hash my card again and use the hashed value to look up my reservation.

But when I go to a supermarket or drugstore and want to get discounts from their loyalty program, I need to swipe a special card that the store gave me (or enter in my phone number).

Using my credit card to identify me would be easier for me and for the merchant, so I'm surprised that retail merchants don't seem to offer this capability. This led me to wonder whether there's a PCI or legal restriction at work here.

Is there a PCI or legal restriction which prevents stores from using my credit card number to identify me for loyalty-program purposes, but which does not prevent airlines from doing the same thing at checkin kiosks?

Improve this question
2
  • Are you certain they are reading the account number? It might be easier to just read track 1 where your full name is stored and perhaps use the expiration date along with the airport and date to eliminate all the other John Smiths in the system to locate your travel record. See ANSI X4.16 on google for descriptions of all the data on that stripe.
    – bmike
    Jun 24, 2011 at 15:06
  • 4
    PCI permits the storage and use of the first 5 digits (which identify the type of card) and last 4 digits of a credit card number. This is almost always enough to uniquely identify a transaction and, through that, the customer who made said transaction; it is not enough information, however, to use the card number. I know of at least one software product that does exactly this, however NDA prohibits me from saying what product or even what market said product is in.
    – Kromey
    Jun 24, 2011 at 17:16

4 Answers 4

Reset to default
11

Merchants can use your card data to review or act on transactions. This includes processing returns, calling up your boarding pass, etc. They can't use it to identify you, only your previous transactions. I'm not sure if that's a law somewhere or because of merchant agreements.

Once your purchase is fully settled, the card data does need to be expunged from the record. This can get to be a little different when you save your card data to an account for convenience. Even in that instance, if you should change cards the older card data would need to be removed.

I highly doubt anybody does one-way hashing of cards, and it'd be relatively useless. Given that there are 16 numbers, the card must match a check code, and the first numbers can be determined from a limited list, one can quickly build a database of all possible hashes. I imagine data is stored and transmitted in an encrypted manner. If I were doing a review, I would consider one-way hashes of cards to be the same as storing a card number in plaintext.

Improve this answer
4
  • It would need to be a keyed hash, then - still better than reversible encryption
    – AviD ♦
    Jun 24, 2011 at 8:27
  • Reversible encryption is usually needed, though. Say you get a delivery back as undeliverable. You need the card number to refund the transaction.
    – Jeff Ferland ♦
    Jun 24, 2011 at 18:26
  • You guys really need to use the customer information manager most third party CC processors provide. You just store a tolken. When you pass that tolken they give you the stored credit card on demand.
    – k to the z
    Jul 27, 2011 at 14:36
  • 1
    That's a really good way to go, but that's also only a way to go if you have a 3rd party processor. If you've got the merchant account yourself, that isn't an option.
    – Jeff Ferland ♦
    Aug 13, 2011 at 13:46
10

I think the reason merchants use a separate identifier (either your phone number, or a loyalty card) has less to do with any regulatory issues, than it does practicality.

If the merchant only tied your identity to your credit card, you would then have to have that credit card present during all transactions for which you want loyalty credit, regardless of whether you're actually using that card for those purchases. So, if you wanted to use a different credit card, or use cash, or use a gift card, you would still have to present and/or swipe your original card as well.

Then, consider the case where the payment method is an alternate credit or gift card. How likely do you think it is that Joe User might mix up the order in which he swipes the cards, and possibly end up charging the wrong card?

It's probably just a lot simpler (and safer) for them to associate your rewards account with an identifier that's not dependent upon your method of payment.

Improve this answer
4

They are not using PAN off the mag stripe, only name. You don't have to use the same card as you bought the ticket with, it's just a name search for people flying out of the airport you're in today. So yes, in the unlikely event that someone with your name is flying out of the same airport on the same day, it will offer you their ticket.. this is why some systems ask your destination city, to reduce false matches.

Improve this answer
1
  • Exactly this. While they could, in theory, use a portion of the PAN (masked save the first and last four numbers), this would still possibly run afoul of PCI compliance. Outside of their core (accounting) system, even financial institutions are supposed to mask the PAN of a card even if they issue it, say... while processing ATM transactions. I don't know that merchants could get away with doing the same.
    – Jesse Williams
    Jun 15, 2016 at 14:23
2

I wouldn't assume anything in regards to how they are storing your data. Lots of places do it wrong, and the bigger the system the harder it is to change it to doing it correctly. The only thing they cannot store is full track data. So they aren't supposed to be storing your encrypted PIN or CVC2.

As far as your credit card is concerned, so long as it is not readable in plain text at rest or transit they can store it with other Personally Identifiable Information ("PII"). You've asked a pretty big question, there really is no simple answer. There lots of ways to store credit card data, like encrypting it or substituting it with a token, usually one that can pass the Luhn verification, in all that you are really just offloading the confidentiality of the data to the key.

The problem with using your credit card to identify you brings into a question of the controls they need for that customer loyalty program. So now by using your credit card as your factor of authentication. The store has effectively brought in all of those systems into PCI scope. Lets not forget what PCI is, it is a way for the card brands to indemnify and off load the cost of a breach to the acquirers who then in turn offload it to the merchants.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .