3

I'm in charge of security for a small online store that wishes to request credit card information, but not actually charge the customer until approximately a month after the purchase - this cannot be avoided.

However, it seems to be a nightmare for compliance purposes. It seems as if we'd need to store the credit card details for some time until we charge the customer, possibly necessitating pci-dss compliance. We have no use for the numbers after that month-ish long period.

Does this setup necessarily entail pci-dss compliance? If it doesn't what alternatives are there to securely manage that information on this time scale?

Improve this question
1
  • 1
    I know you say "this cannot be avoided" but you may want to rethink. Just because the card is valid now, doesn't mean it will be valid in a month. Similarly, if you aren't even checking whether the card is valid now, what are you going to do in a month if it turns out to be invalid? If your scenario is something like "sign up now, get a free month" you should ask a question targeting how to do that correctly.
    – Bobson
    Commented Aug 26, 2016 at 8:50

2 Answers 2

Reset to default
3

PCI-DSS comes into play in your scenario. Time is irrelevant. It's the storing of the PAN that triggers PCI-DSS complexity.

If you want to avoid it, architect a different approach. For instance, payment processors can put an authorization hold on the funds for a time then process the full payment.

I would talk to the many payment processors out there to see what they can do for your organization.

Improve this answer
1
  • Just to add to your answer...PCI applies to all that process, store, or transmit. So regardless of the storing of cards you have to comply with PCI because you are processing and transmitting card payments. Depending on the implementation, the scope and requirements may vary but you will always have to be PCI compliant
    – Timee
    Commented Aug 30, 2016 at 0:29
1

There are plenty of on-the-shelf solutions out there that the credit card companies support for 'recurring' payments and you CAN have a 'recurring' payment that only triggers once. As suggested above, the KEY is to clear a small credit card transaction at agreement time - the time when the shopper first presents their credit card info online - you MUST check the card at this time as you are not allowed to store the CVV and it's a darn good idea to be able to show that you cleared the initial transaction in a recurring series WITH the CVV (which you do NOT store but DID clear on the first transaction). Find a payment gateway that supports recurring transactions (Paypal and Authorize.net both do this). I'd suggest you use a service that 'tokenises' the card info - they store the card info for you and give you a token - you can safely store that token with little PCI compliance impact - when you want to run another charge on that same card, you present the token and your gateway looks up the actual credit card info they stored against the token and produces the charge for you. (stripe and braintree both do this, and many other services are 'working on it')

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .