1

Employee has access to image format of full credit card data on an application (primary account number, cvv, expiry code, name). He copies from this application and enters manually to another application which has truncation enabled.

What level of restrictions can be enforced on employee from mishandling or copying the data or memorizing the card data.

2

Once an employee has access to this data, you cannot actually control what they do with it. There are useful restrictions, such as:

  • disallow phones or camera devices
  • disallow taking papers home
  • strongly restrict what their computer can access

As well as wider controls such as:

  • employee vetting
  • contracts that include major disciplinary repercussions

But you need to accept the risk can not be 100% remediated.

1

You could not let one employee see the all the data, e.g. have one employee enter the cc number and name and have another employee enter the cvv and expiration date. This way no employee ever gets to see all the cc data and cannot copy or memorize it.

This would mean that you need 2 images of the application form, one where the name and number are blacked out and one where the cvv and expiration date are blacked out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.