5

We are currently collecting card holder data in a segmented way. Our system is used by call center agants which I will refer to as channel B

Over channel A (mobile carrier) we collect the first 8 digits of the credit card followed by the cvv. Now we are not in control of logging over this channel and they might log this in clear text.

Over channel B, agent collects the rest of PAN and expiry date.

We then reconstruct it to switch.

My Question is this, point 3.2 of PCI compliancy states you are not allowed to store cvv, but does this apply with segmented PAN? My argument is that you cant do anything with CVV without the full pan.

Improve this question

3 Answers 3

Reset to default
12

Here are the basic do's and dont's for PCI-DSS: enter image description here

Regardless of segmentation you are not allowed to store the CVV data. The effectiveness of this code is limited to the ability to keep it out of the hands of criminals, which is why it is prohibited by PCI Standards from being stored. For merchants who charge customers on a recurring basis, the CVV code can be used with the initial transaction but cannot be stored for future transactions.

Now you have an argument, but consider there is a breach in your company and the CVV numbers are obtained and used together with card numbers collected in a breach from company B, then guess who will be held accountable as they did not adhere to the PCI-DSS standard.

The rules for PCI-DSS are not only there to give you guidance on how to store information but also serve as a way of off-loading risk from the card acquirers to the merchants. Maybe you might think that it's not fair, but in case of PCI-DSS: "The rules are the rules". The only way you would be able to avoid this risk is by having a QSA sign off on your implementation and explicitly have your architecture where you store the CVV as part of the audit report (to be fair I highly doubt any QSA will sign off on that).

Improve this answer
3
  • I totally agree, but since we do not store anything on our side its very unlikely of a breach at the mobile carrier and our system at the same time. FYI we have already obtained PCI compliance for our DTMF collection method which also channels through mobile carrier and at that time the QSA said mobile carriers are out of scope.
    – Devonne Burger
    Commented Feb 22, 2016 at 10:16
  • 1
    The image is unavailable to several users. Can you move some of the info on it to the answer, or provide a source?
    – Mindwin Remember Monica
    Commented Feb 22, 2016 at 12:34
  • @Mindwin I'll add the link to the post
    – Lucas Kauffman
    Commented Feb 23, 2016 at 2:39
8

My understanding of it is that it's an absolute - you are not allowed to store the CVV number, whether you have stored the rest of the card number, none of the card number, part of the card number, or an encrypted card number.

PCI doesn't tend to work on what you can do with things, merely preventing things that have high potential to cause issues.

Improve this answer
2
  • But there is no potential risk in having someones cvv without a PAN or even the first half of the PAN. PCI 3.2 also states that It is permissible for issuers and companies that support issuing services to store sensitive authentication data if there is a business justification.
    – Devonne Burger
    Commented Feb 22, 2016 at 9:52
  • 3
    As I said, PCi isn't about dealing with risk. It's about a pre-defined set of rules. If you want to do anything that isn't exactly as specified, you'll need to speak to a QSA to get valid advice.
    – Matthew
    Commented Feb 22, 2016 at 9:55
0

1.if you have the first 8 digits it is considered as PAN 2.the requirement is not to store it after authorization meaning if you store, authorize and delet its ok

Improve this answer
5
  • The first 6 digits represent an issuer which is public data. I do not see how this qualifies as pan.
    – Devonne Burger
    Commented Feb 22, 2016 at 9:45
  • 1
    that's true the first 6 are the issuer, the last four are check digit, meaning now the rest of the pan are the six digits in the middle now if you take another two (digits 7 & 8 ) as you wrote you leave only 4 digits left to guess
    – BokerTov
    Commented Feb 22, 2016 at 10:24
  • 1
    From what i can see only the last digit is a check digit. The other 7 (or n) is the account number. On Channel A they do not have account number and Channel B they do not have cvv even if they try to reconstruct the account number with checksum digit and try to guess issuer.
    – Devonne Burger
    Commented Feb 22, 2016 at 10:36
  • 1.you are right its its the last digit and not the last four 2. you wrote that the call center reconstruct the number so the call center has the full PAN and the CVV
    – BokerTov
    Commented Feb 22, 2016 at 12:23
  • The call centre does not reconstruct the PAN. Our offsite application that get used by the call centre reconstructs the PAN. The whole idea is to prevent callcenter agent to have access to the data.
    – Devonne Burger
    Commented Feb 23, 2016 at 7:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .