My client needs credit card details emailed to them, will an encrypted file work?

Question

I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their customer's credit card details on their behalf to book the trip.

I've personally confirmed this is their standard practice, and the wholesalers offer absolutely no assistance. The way my client handled this with their previous hosting provider was by having a simple form on their website, which their customers would use and the credit card info was sent via email.

This is bad, obviously.

To add to the mess, the wholesalers require the security code for the card.

I don't want to go through the scrutiny of PCI compliance, so I have a few questions:

1. Does anyone know of 3rd party service that this form could reside with? Also keeping in mind the CVV is needed.
2. What if I created an encrypted file that is emailed to my client upon form submission, and build a desktop app for them to enter in a key in order to decrypt it?
3. Is my business potentially liable if we build a solution and some how, some way, someone's credit card info falls into malicious hands? Perhaps I shouldn't allow it on my server and force them to get a new host, regardless if we do the work or not.

I just have absolutely no idea how to best solve this situation. Thousands of resellers of vacation packages around the globe, and this is what they're expected to do? I suggested to my client they take the card details over the phone, and shred it after making their payment, but they're unable to do this due to multiple reasons.

This has ended in a ton of searching and reading other scenarios. All the credit card "storage" services that I've found do not and will not store the security code.

I'm at a total loss. Please advise.

Answer 1

I believe the situation is a bit uglier than you may have realized. Were I in this situation, I would invest myself in finding the wholesaler's competition! I would want a wholesaler who provides either a service that can directly accept orders from your client's site or, better yet, a page that can be linked from your site to allow the user's to enter the information directly into the wholesaler's system.

PCI-DSS does not formally apply to your client except to the extent that the wholesaler requires them to comply. You must understand that PCI-DSS is a contractual requirement between business entities. It is not a law that everyone must respect. You are not submitting the card data to a credit card processor, just to a merchant. The wholesaler is probably in violation of its contractual responsibilities to its card processor, but that does not directly expose the wholesaler's clients (i.e. your client) to PCI specific requirements.

Having said that, the potential for legal action against your client by customers whose cc data is compromised may exist. I am not a lawyer and this is not authoritative legal advice. ALSO, independent of PCI, I believe every state in the US now has data breach notification laws that will require your client to notify customers of exposed data and provide credit protection for some period, usually at least 1 year, in the case of a breach.

So, PCI does not really apply, but you have to be careful how you handle all customer data. Now, let's discuss possible approaches.

Two encryption approaches suggest themselves: encrypt a file then emailing the file; using encrypted email using S/MIME. Personally, I like the encrypted email approach. An email can be constructed and encrypted in memory so the unencrypted data never lands on the server's drive. Writing a file then encrypting it adds a layer of risk.

With S/MIME you will naturally use an x509 certificate with a public/private key pair for asymmetric encryption. If you go with the encrypted file approach, I urge you to use asymmetric encryption rather than the much more simplistic symmetric encryption. The big difference between the two is that an asymmetric solution on the web server would only hold the public key. If the server were compromised, the attacker would not gain the ability to decrypt the messages. Only your client, using the private key, could decrypt the messages.

There are several encryption solutions available. One robust, mature and open source library is GPG. It is also very well documented and versatile. It could be used for either of the approaches I've described.

Answer 2

In practice, I find that standards-based encryption (like the S/MIME and GPG encryption @JaimeCastells suggested) is not feasible for end users to actually use. Having customers go through the trouble of setting up software like this to send information is often unfeasible. It does require some decent technical savvy to install and use these programs, and maintain access to your private key -- and I foresee lots of issues with end users booking vacations through a reseller being unable to do this.

What you could do is:

• Setup a web application like ownCloud, a customized Wordpress instance, etc on a server at the client's office.
  • If using owncloud, enable Owncloud Encryption
  • Force HTTPS
  • Send clients a link via e-mail to a text form that they can fill out with their information
  • Harden server, tighten firewalls, get regular updates, all that best practices stuff
• Use a solution like box.com or other cloud storage
  • Again, setup an editable document that clients could submit their information through.
• Use an e-mail encryption solution like Virtru or Zix
  • May have caveats in that users will have to remember to use these mechanisms rather than regular email.

The advantage of doing something like this is allowing you, or their IT, to have central control over access. It also would all be done via HTTPS, which provides the TLS encryption layer. Enabling filesystem encryption, or better, web application level encryption (like the owncloud encryption I suggested) makes it even more secure.

I definitely can tell you this wouldn't qualify for PCI, and also legal issues are raised here about liability that can only be answered by an attorney in your locality. This is simply my attempt at suggesting a "real-world" solution that will improve security greatly and still be usable.

Answer 3

Get set up with burlingtonbankcard.com to process payments and use qualys.com for pci compliance