The full Account number data plus Personally Identifiable Information (PII) for a credit card is captured in a document that is scanned as an image for later processing. This image is then uploaded to another application. I am concerned that these scanned images contain all credit card data (Primary Account Number, Cardholder name, Expiry date, CVV number) and other PII information such as Residential Address and Phone number, all in plain text, though saved as an image.
The data is sent over HTTPS protocol. I am looking out for further more controls to strengthen this from capturing the track data at the first point. I request for more insights on this.
(Bit more explained: The card data is collected in document written down (all data in a credit card). The document is scanned and the image is sent through an application to the service provider. The service provider agent sees the data and manually enters it on another application. This application has the truncation enabled)