Revisions to Is storing CVV compliant with PCI standards?

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/

Source Link

edited Mar 17, 2017 at 10:46

1

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. For people who reserve their rooms a year in advance, that means their CVV data is in the Booking Engine for a complete year!

I'm aware of this because my duties require me to regularly interface with several providers of this service, and this allows me to have access to a multitude of customers' CVC/CVV/CVV2 codes. I have personally observed the applications' behavior of collecting the code at reservation time and retaining it until check-out.

Certain Booking Engines do limit the number of times you can look at the credit card information (I believe one in particular limited me to 5), but the information is still being passed to the Channel Manager and PMS - and I work with all three.

Of course there are certain Payment Gateways which do not require the CVV code to process a transaction. However, many of the hoteliers I work with have Payment Gateways which do.

I'm concerned that retention of this data for such a long period is against PCI-DSS standards, or other legal requirements or industry best practices. I've read answers to one question here on the topic (link below) but the issue is still a bit unclear to me with regards to how this applies for services like Booking Engines.

Storing CVC / CVV / CVV2 until payment is processed Storing CVC / CVV / CVV2 until payment is processed

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. For people who reserve their rooms a year in advance, that means their CVV data is in the Booking Engine for a complete year!

I'm aware of this because my duties require me to regularly interface with several providers of this service, and this allows me to have access to a multitude of customers' CVC/CVV/CVV2 codes. I have personally observed the applications' behavior of collecting the code at reservation time and retaining it until check-out.

Certain Booking Engines do limit the number of times you can look at the credit card information (I believe one in particular limited me to 5), but the information is still being passed to the Channel Manager and PMS - and I work with all three.

Of course there are certain Payment Gateways which do not require the CVV code to process a transaction. However, many of the hoteliers I work with have Payment Gateways which do.

I'm concerned that retention of this data for such a long period is against PCI-DSS standards, or other legal requirements or industry best practices. I've read answers to one question here on the topic (link below) but the issue is still a bit unclear to me with regards to how this applies for services like Booking Engines.

Storing CVC / CVV / CVV2 until payment is processed

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. For people who reserve their rooms a year in advance, that means their CVV data is in the Booking Engine for a complete year!

I'm aware of this because my duties require me to regularly interface with several providers of this service, and this allows me to have access to a multitude of customers' CVC/CVV/CVV2 codes. I have personally observed the applications' behavior of collecting the code at reservation time and retaining it until check-out.

Certain Booking Engines do limit the number of times you can look at the credit card information (I believe one in particular limited me to 5), but the information is still being passed to the Channel Manager and PMS - and I work with all three.

Of course there are certain Payment Gateways which do not require the CVV code to process a transaction. However, many of the hoteliers I work with have Payment Gateways which do.

I'm concerned that retention of this data for such a long period is against PCI-DSS standards, or other legal requirements or industry best practices. I've read answers to one question here on the topic (link below) but the issue is still a bit unclear to me with regards to how this applies for services like Booking Engines.

Storing CVC / CVV / CVV2 until payment is processed

Tweeted twitter.com/#!/StackSecurity/status/535719715155746816

occurred Nov 21, 2014 at 9:01

Trying not to name names, and combine everything into a single coherent question.

Source Link

edited Nov 21, 2014 at 5:03

Iszi

27.2k
18
103
163

many booking engines like New Hotel Software, booking.comFrom personal, Expedia store the CVV.

job-related experience I already read the answer to Storing CVC / CVV / CVV2 until payment is processed, and I've noticed these peopleknow that many "Booking Engines" store the CVVCVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. This means, forFor people who reserve fortheir rooms a year in advance, that booking.com could store the CVV for a complete year.

All I wanted to knowmeans their CVV data is in the Booking Engine for a if this is compliant with the standards.

EDITcomplete year!

I work with a Channel Manager andI'm aware of this because my duties require me to regularly interface with several hotel extranetsproviders of booking.comthis service, and Expedia. I myselfthis allows me to have lotsaccess to a multitude of customers' CVC/CVV/CVV2 codes under my power. I'm certain aboutI have personally observed the removalapplications' behavior of this data only aftercollecting the guest leaves, not before. bookingcode at reservation time and retaining it until check-out.com for example only allows to see

Certain Booking Engines do limit the number of times you can look at the credit card info a few timesinformation (5 I as I recallI believe one in particular limited me to 5). But this, but the information getsis still being passed to the Channel Manager and PMS. I work with all three of them- and I work with all three.

EDIT 2

I know the code isn't required to perform the transaction using Of course there are certain payment gatewaysPayment Gateways which do not require the CVV code to process a transaction. I'm asking becauseHowever, many of the hoteliers I'm in touchI work with, have some payment gatewaysPayment Gateways which requiredo.

I'm concerned that retention of this data for such a long period is against PCI-DSS standards, or other legal requirements or industry best practices. I've read answers to one question here on the codetopic (link below) but the issue is still a bit unclear to me with regards to how this applies for services like Booking Engines.

Storing CVC / CVV / CVV2 until payment is processed

many booking engines like New Hotel Software, booking.com, Expedia store the CVV.

I already read the answer to Storing CVC / CVV / CVV2 until payment is processed, and I've noticed these people store the CVV until the guest leaves the hotel. This means, for people who reserve for a year in advance, that booking.com could store the CVV for a complete year.

All I wanted to know is if this is compliant with the standards.

EDIT

I work with a Channel Manager and with several hotel extranets of booking.com and Expedia. I myself have lots of CVC/CVV/CVV2 codes under my power. I'm certain about the removal of this data only after the guest leaves, not before. booking.com for example only allows to see the credit card info a few times (5 I as I recall). But this information gets passed to the Channel Manager and PMS. I work with all three of them.

EDIT 2

I know the code isn't required to perform the transaction using certain payment gateways. I'm asking because many of the hoteliers I'm in touch with, have some payment gateways which require the code.

From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. For people who reserve their rooms a year in advance, that means their CVV data is in the Booking Engine for a complete year!

I'm aware of this because my duties require me to regularly interface with several providers of this service, and this allows me to have access to a multitude of customers' CVC/CVV/CVV2 codes. I have personally observed the applications' behavior of collecting the code at reservation time and retaining it until check-out.

Certain Booking Engines do limit the number of times you can look at the credit card information (I believe one in particular limited me to 5), but the information is still being passed to the Channel Manager and PMS - and I work with all three.

Of course there are certain Payment Gateways which do not require the CVV code to process a transaction. However, many of the hoteliers I work with have Payment Gateways which do.

I'm concerned that retention of this data for such a long period is against PCI-DSS standards, or other legal requirements or industry best practices. I've read answers to one question here on the topic (link below) but the issue is still a bit unclear to me with regards to how this applies for services like Booking Engines.

Storing CVC / CVV / CVV2 until payment is processed

added 8 characters in body

Source Link

edited Nov 20, 2014 at 20:12

András Gyömrey

871
3
9
17

many booking engines like New Hotel Software, booking.com, Expedia store the CVV.

I already read the answer to Storing CVC / CVV / CVV2 until payment is processed, and I've noticed these people store the CVV until the guest leaves the hotel. This means, for people who reserve for a year in advance, that booking.com could store the CVV for a complete year.

All I wanted to know is if this is compliant with the standardsif this is compliant with the standards.

EDIT

I work with a Channel Manager and with several hotel extranets of booking.com and Expedia. I myself have lots of CVC/CVV/CVV2 codes under my power. I'm certain about the removal of this data only after the guest leaves, not before. booking.com for example only allows to see the credit card info a few times (5 I as I recall). But this information gets passed to the Channel Manager and PMS. I work with all three of them.

EDIT 2

I know the code isn't required to perform the transactioncode isn't required to perform the transaction using certain payment gateways. I'm asking because many of the hoteliers I'm in touch with, have some payment gateways which require the code.

many booking engines like New Hotel Software, booking.com, Expedia store the CVV.

I already read the answer to Storing CVC / CVV / CVV2 until payment is processed, and I've noticed these people store the CVV until the guest leaves the hotel. This means, for people who reserve for a year in advance, that booking.com could store the CVV for a complete year.

All I wanted to know is if this is compliant with the standards.

EDIT

I work with a Channel Manager and with several hotel extranets of booking.com and Expedia. I myself have lots of CVC/CVV/CVV2 codes under my power. I'm certain about the removal of this data only after the guest leaves, not before. booking.com for example only allows to see the credit card info a few times (5 I as I recall). But this information gets passed to the Channel Manager and PMS. I work with all three of them.

EDIT 2

I know the code isn't required to perform the transaction using certain payment gateways. I'm asking because many of the hoteliers I'm in touch with, have some payment gateways which require the code.

many booking engines like New Hotel Software, booking.com, Expedia store the CVV.

I already read the answer to Storing CVC / CVV / CVV2 until payment is processed, and I've noticed these people store the CVV until the guest leaves the hotel. This means, for people who reserve for a year in advance, that booking.com could store the CVV for a complete year.

All I wanted to know is if this is compliant with the standards.

EDIT

I work with a Channel Manager and with several hotel extranets of booking.com and Expedia. I myself have lots of CVC/CVV/CVV2 codes under my power. I'm certain about the removal of this data only after the guest leaves, not before. booking.com for example only allows to see the credit card info a few times (5 I as I recall). But this information gets passed to the Channel Manager and PMS. I work with all three of them.

EDIT 2

I know the code isn't required to perform the transaction using certain payment gateways. I'm asking because many of the hoteliers I'm in touch with, have some payment gateways which require the code.