Timeline for Storing CVC / CVV / CVV2 until payment is processed
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 17, 2019 at 16:58 | comment | added | Gareth Oakley | Additionally, the Attestation of Compliance your QSA completes asks to certify that "No evidence of full track data1, CAV2, CVC2, CID, or CVV2 data2, or PIN data3 storage after transaction authorization was found on ANY system reviewed during this assessment". (This is how hotel booking sites can have a hotel charge your card for no shows, even if its months after the original booking) | |
| Sep 18, 2017 at 16:23 | comment | added | mikato | Yeah that is good insight with the footnote. It appears that their guidelines are leaving out some situations. They say never store the CVV, but the footnote says it must not be stored after authorization. Those 2 things don't completely agree. What about before authorization? They need to address that. Some businesses put billing information on file before performing a service as a precaution for example. | |
| Jul 7, 2014 at 18:36 | comment | added | leo0 | This is great news, thanks a lot for the answer. We will only keep the CVV stored until authorization. And sorry for the long delay, I thought no one would answer this question anymore. | |
| Jul 7, 2014 at 18:36 | vote | accept | leo0 | ||
| Jul 3, 2014 at 16:34 | history | edited | Timee | CC BY-SA 3.0 |
corrected spelling and a few grammar errors
|
| Jul 3, 2014 at 16:11 | history | answered | Timee | CC BY-SA 3.0 |