8

Reading about PCI-DSS 3 recently: Would like confirmation what I am interpreting here - you need PCI-DSS SAQ-A to have credit card associated payment or donation URL links on a merchant's website?

For example: If a business or charity operated their webpage with a PayPal standard donate button on it for donation with a linking to PayPal accepting credit cards, does their webpage have to be PCI-DSS compliant or not?

I am confused but whether or not falls under SAQ-A, where it defines URL link redirects.

VISA doesn't seem to include this scenario in their PCI-DSS guide: https://www.visaeurope.com/media/images/processing%20e-commerce%20payments%20guide-73-17337.pdf

If having links requires PCI-DSS compliance, this is quite prohibitive for some charity organizations I know - hosting and maintaining a website which is PCI-DSS compliant may be too complex and costly for them to upkeep.

As a side-note, if a the presence of a credit card accepting PayPal button means the merchant website has to be PCI-DSS compliant, placing a link on a merchant's own site may not be any less secure than sharing it on social media (Facebook, Twitter) or other sharing platforms (Twitch, bulletin boards/forums)? Does this affect direct URL links to a PayPal credit card payment page from a merchant's social media page?

My lesson to be learned may be to be more careful with credit card payment forms.

I have checked other similar questions but they do not address the use of the PayPal buttons. A similar situation would be using Razoo.

Edit: After some more reading, the merchant needs to pay attention to PCI-DSS compliance. The practical starting point for self-assessment would still be SAQ A for all intents and purposes. PayPal's public documentation is lacking, but I've found some recommendations from Recurly: https://docs.recurly.com/pci-dss-compliance

A merchant must always be PCI compliant if they accept credit card payments online (even if the card is entered on another site). If using HPP, Recurly’s recommendation is to complete SAQ A. (HPP - hosted payment pages)

Improve this question
1
  • 1
    I think this might come down to whether the website owner directly receives payment from the credit card owner. PayPal is a bit weird like that - is it a bank, an escrow service, or a sort of voucher system where you receive PayPal money which happens to be directly equivalent to real money...
    – Matthew
    Jan 31, 2016 at 11:52

2 Answers 2

Reset to default
4

The merchant or charity who accepts only PayPal, and uses a mechanism that redirects the customer/donor to PayPal's site does not handle the credit card at all. PayPal does that, takes a fee for the service, and remits the rest to the merchant.

So, PayPal has to comply with PCI-DSS, but the merchant who uses only PayPal and does so with redirection to PayPal does not. The merchant's bank may require them to complete Self Assessment Questionnaire A. That is applicable as follows "SAQ A merchants may be either e-commerce or mail/telephone-order merchants (card-not-present), and do not store, process, or transmit any cardholder data in electronic format on their systems or premises." Completing it will mostly require checking "Not Applicable."

Improve this answer
2
  • Sadly not the case.
    – Richard
    Feb 4, 2016 at 18:04
  • A little poking tells me that merchants who accept credit card information themselves and pass it to PayPal via API do need to be PCI-DSS compliant. However, the PayPal link that redirects to PayPal, so that the merchant never sees the credit card information need not comply. I'll edit my answer.
    – Bob Brown
    Feb 4, 2016 at 23:32
3

PCI applies to ANY organization or merchant, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. Said another way, if any customer of that organization ever pays the merchant directly using a credit card or debit card, then the PCI DSS requirements apply.

https://www.pcicomplianceguide.org/pci-faqs-2/#2

But: According to the Sage Pay Benchmark Report a quarter of the online shop owners don't even know about PCI-DSS. And far more never implement it. The solution is simple: To avoid the expensive certification, shops don't store ANY credit card information themselves, thus they don't have the obligation to care for them. Of course, this solution relies on the security of transmission.

Improve this answer
3
  • 2
    Correct, but not relevant to a merchant that accepts only PayPal.
    – Bob Brown
    Jan 31, 2016 at 12:43
  • For me the complication comes when the merchant websites that redirect or repost to sites credit card cardholder data but not store it are in scope for a stricter checklist with SAQ A-EP. I was wondering if it was restricted things direct links as well, but I guess this is one of the loopholes like the off-domain payment solution hosted iFrames and repost Javascript files.
    – Chislon Chow
    Feb 4, 2016 at 22:55
  • 1
    Even if you don't store them but have them in transmit across your network you are required to be PCI compliant.
    – Lucas Kauffman
    Feb 5, 2016 at 0:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .