5

I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their customer's credit card details on their behalf to book the trip.

I've personally confirmed this is their standard practice, and the wholesalers offer absolutely no assistance. The way my client handled this with their previous hosting provider was by having a simple form on their website, which their customers would use and the credit card info was sent via email.

This is bad, obviously.

To add to the mess, the wholesalers require the security code for the card.

I don't want to go through the scrutiny of PCI compliance, so I have a few questions:

  1. Does anyone know of 3rd party service that this form could reside with? Also keeping in mind the CVV is needed.
  2. What if I created an encrypted file that is emailed to my client upon form submission, and build a desktop app for them to enter in a key in order to decrypt it?
  3. Is my business potentially liable if we build a solution and some how, some way, someone's credit card info falls into malicious hands? Perhaps I shouldn't allow it on my server and force them to get a new host, regardless if we do the work or not.

I just have absolutely no idea how to best solve this situation. Thousands of resellers of vacation packages around the globe, and this is what they're expected to do? I suggested to my client they take the card details over the phone, and shred it after making their payment, but they're unable to do this due to multiple reasons.

This has ended in a ton of searching and reading other scenarios. All the credit card "storage" services that I've found do not and will not store the security code.

I'm at a total loss. Please advise.

  • 4
    IANAL, but I'm pretty sure you can't dodge PCI and handle credit card info at the same time. So, unless you find a good answer for #1, you might want to brush up on the PCI-DSS. – Iszi Oct 15 '15 at 15:59
  • 4
    @Iszi, PCI requires merchants and processors to obey the DSS or be cut off... but in this case the entity is neither a merchant nor a processor; they're a middleman that represents the customer. There's no leverage to ensure they follow the DSS, which is why such organizations often store CVV data and handle card data casually. It's a loophole in the system... I applaud the OP for looking to do the right thing, it will be hard to find a solution as so many in the same situation just do the wrong thing. – gowenfawr Oct 15 '15 at 16:02
  • @gowenfawr Well, there is the leverage that wholesaler would (if they were complying with their PCI requirements) cut off using OP's client as a middleman/agent to interface with customers because it knew OP's client wasn't compliant with PCI practices. So there is that. – mostlyinformed Oct 18 '15 at 5:55
  • @gowenfawr But, actually I agree with you 100% when you say that "such organizations often store CVV data and handle card data casually", irresponsibly so, doing "the wrong thing" as you well put it. It's just that in my experience the question of a business doing the wrong thing on payment card info most often bears no relation at all to any question of whether it has actually found a real, legitimate loophole in PCI scope. But anyway, I too applaud OP's desire to do the right thing, though I too am not quite sure what technical advice to give him. – mostlyinformed Oct 18 '15 at 6:06
  • Thank you all for your comments and suggestions thus far. I've been watching this question for updates and still contemplating the best method to utilize. – user1447679 Oct 19 '15 at 16:01
1

I believe the situation is a bit uglier than you may have realized. Were I in this situation, I would invest myself in finding the wholesaler's competition! I would want a wholesaler who provides either a service that can directly accept orders from your client's site or, better yet, a page that can be linked from your site to allow the user's to enter the information directly into the wholesaler's system.

PCI-DSS does not formally apply to your client except to the extent that the wholesaler requires them to comply. You must understand that PCI-DSS is a contractual requirement between business entities. It is not a law that everyone must respect. You are not submitting the card data to a credit card processor, just to a merchant. The wholesaler is probably in violation of its contractual responsibilities to its card processor, but that does not directly expose the wholesaler's clients (i.e. your client) to PCI specific requirements.

Having said that, the potential for legal action against your client by customers whose cc data is compromised may exist. I am not a lawyer and this is not authoritative legal advice. ALSO, independent of PCI, I believe every state in the US now has data breach notification laws that will require your client to notify customers of exposed data and provide credit protection for some period, usually at least 1 year, in the case of a breach.

So, PCI does not really apply, but you have to be careful how you handle all customer data. Now, let's discuss possible approaches.

Two encryption approaches suggest themselves: encrypt a file then emailing the file; using encrypted email using S/MIME. Personally, I like the encrypted email approach. An email can be constructed and encrypted in memory so the unencrypted data never lands on the server's drive. Writing a file then encrypting it adds a layer of risk.

With S/MIME you will naturally use an x509 certificate with a public/private key pair for asymmetric encryption. If you go with the encrypted file approach, I urge you to use asymmetric encryption rather than the much more simplistic symmetric encryption. The big difference between the two is that an asymmetric solution on the web server would only hold the public key. If the server were compromised, the attacker would not gain the ability to decrypt the messages. Only your client, using the private key, could decrypt the messages.

There are several encryption solutions available. One robust, mature and open source library is GPG. It is also very well documented and versatile. It could be used for either of the approaches I've described.

  • I would be more careful about exonerating the OP's client from having to comply with PCI rules. If I we've playing Devils Advocate, I would point out that PCI rules require that any covered entity that recieives payment info from or transmits payment info to any other entity in a payments chain must get confirmation from that entity that it both knows about and is in compliance with PCI. I might also argue, from a legal perspective, that when the OP's client does the payment info handling it is a doing so in what's called an implied agency relationship with those same wholesalers . – mostlyinformed Oct 18 '15 at 5:21
  • Put another way, considering that (1) OP's client collects payment card info and feeds to other it commercial entities that are clearly covered by PCI on their behalf and (2) the PCI Requirements most definitely do not say "Hey, you aren't covered by PCI unless you operate with this label:", but rather talk about all entities that "process" or "store" payment card info as being in scope, OP's client would probably be very wise to assume it is in scope for PCI unless & until it can get a real world, credentialed expert in PCI scope & payments law to give a written opinion otherwise. – mostlyinformed Oct 18 '15 at 5:39
  • Actually, I feel we can be pretty specific about the scope and enforcement of PCI. Again, PCI is not a law. PCI is a standard established by an industry consortium and enforced through contractual agreements between companies. – JaimeCastells Oct 18 '15 at 19:08
  • This has been well discussed in other Questions. – JaimeCastells Oct 18 '15 at 19:15
  • It is certainly true that PCI is not a law, and thus no one at large has duty to comply with PCI rules just because they exist. On the other hand, it is certainly true that it's very easy to get yourself into a relationship where you are a sub-contractor of a PCI-covered entity who processes/stores/manages payment card information on behalf of that entity. In which case you are technically within the scope of the PCI requirements. In fact, a wholesaler who deals OP's client should exact a written promise from client that it does follow PCI rules for the handling of payment card info. – mostlyinformed Oct 18 '15 at 21:00
0

In practice, I find that standards-based encryption (like the S/MIME and GPG encryption @JaimeCastells suggested) is not feasible for end users to actually use. Having customers go through the trouble of setting up software like this to send information is often unfeasible. It does require some decent technical savvy to install and use these programs, and maintain access to your private key -- and I foresee lots of issues with end users booking vacations through a reseller being unable to do this.

What you could do is:

  • Setup a web application like ownCloud, a customized Wordpress instance, etc on a server at the client's office.
    • If using owncloud, enable Owncloud Encryption
    • Force HTTPS
    • Send clients a link via e-mail to a text form that they can fill out with their information
    • Harden server, tighten firewalls, get regular updates, all that best practices stuff
  • Use a solution like box.com or other cloud storage
    • Again, setup an editable document that clients could submit their information through.
  • Use an e-mail encryption solution like Virtru or Zix
    • May have caveats in that users will have to remember to use these mechanisms rather than regular email.

The advantage of doing something like this is allowing you, or their IT, to have central control over access. It also would all be done via HTTPS, which provides the TLS encryption layer. Enabling filesystem encryption, or better, web application level encryption (like the owncloud encryption I suggested) makes it even more secure.

I definitely can tell you this wouldn't qualify for PCI, and also legal issues are raised here about liability that can only be answered by an attorney in your locality. This is simply my attempt at suggesting a "real-world" solution that will improve security greatly and still be usable.

  • Thank you so much for your suggestion. I'm looking into this option among others. Still watching this question for other possible solutions to this issue. – user1447679 Oct 19 '15 at 16:02
-3

Get set up with burlingtonbankcard.com to process payments and use qualys.com for pci compliance

  • I'm not sure how this fits in. It's not a merchant/processor issue. If that was the case I would use a token based service like Stripe. It's a "middle man" situation. Am I misunderstanding your suggestion? – user1447679 Oct 15 '15 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.