Do you have to ban cellphones and paper to be PCI compliant?

Question

Today I heard of a call centre that you are not allowed to bring cellphones into or take paper out of. This is allegedly to be PCI complaint. Is this true? What is the reasoning? This seems like overkill. They said it's to protect credit card information but usually customer service reps (e.g. ones at Starbucks) don't have to do this.

Answer 1

Short version:

The PCI-DSS does not explicitly call out the steps you describe. However, those are common sense steps that are reasonably encompassed by several PCI-DSS requirements. They are not at all uncommon and I have seen them as requirements to non-PCI-DSS contractual agreements by third parties in a card processing environment.

Long version:

Technically, the PCI-DSS only prescribes security for "system components," not people:

The PCI DSS security requirements apply to all system components included in or connected to the cardholder data environment.

That said, an awful lot of the DSS touches on policies which impact things other than system components. The following requirements could be reasonably interpreted as being addressed by the two measures (prohibition of uncontrolled data/camera devices in the CDE, control over use of paper in the CDE) you describe:

7.3 Ensure that security policies and operational procedures for restricting access to cardholder data are documented, in use, and known to all affected parties.

While 7.3 doesn't say how restrictions should be implemented, it says you should have restrictions around access as part of your policy. Control of phone/camera and paper in the CDE is a reasonable restriction.

9.5 Physically secure all media: Verify that procedures for protecting cardholder data include controls for physically securing all media (including but not limited to computers, removable electronic media, paper receipts, paper reports, and faxes).

Keeping paper from leaving the CDE is a form of securing paper media, and keeping cell phones/cameras from entering is control of 'removable electronic media'.

12.3 Develop usage policies for critical technologies and define proper use of these technologies. (... tablets, removable electronic media, e-mail usage and Internet usage.)

You'll also note that call centers often disallow access to Internet and email, for the same reason - they're methods that employees could use to get card numbers out of the environment.

---

These requirements are not 'overkill', they're pretty standard. They can cause "real" problems (e.g., not just inconveniencing humans) - for example, how do you email password reset links to call center employees who don't have access to email? How do you verify identity by callback or set up multifactor authentication without soft tokens if there are no personal smartphones? But they do provide a real security value.

Which is why you will see these requirements as part of PCI-DSS driven policy and as part of contractual agreements.

Answer 2

You compare the callcenter to Starbucks in how they're required to handle credit cards. The big difference is that Starbucks handles credit cards in an entirely different way compared to a callcenter.

Starbucks barristas do not handle your credit card data in any way. What happens is that you insert your credit card into a machine that's provided by Starbuck's bank, the signal gets sent directly to the bank and it returns from the bank to the machine. In no way does Starbucks ever handle your credit card details themselves.

I am not aware of how the Starbucks app handles credit cards, but the logical explanation is that these details are either stored locally in your device, or on the Starbucks servers. In neither case does the Starbucks barrista come into contact with your credit card credentials. And neither does the customer service rep who deals with starbucks account support. At most, they can see the final 4 digits of your credit card, no expiration date and no CVC code.

---

gowenfawr pointed out that sometimes, waitstaff skim your credit card through a handheld device. This is obviously a massive violation of the PCI compliance rules, but this doesn't have anything to do with PCI compliance and all with just regular criminal activities. In this case, technically speaking Starbucks is still PCI compliant since it's not Starbucks that's stealing your credentials, but the waitstaff.

Also, if you ever see someone skim a creditcard, report them to the manager right away. Nearly every company cares enough about their customers that they will fire the offender right away. And obviously contact your credit card issuer and tell them you believe your card got compromised. They will revoke the old card and issue a new one.

Answer 3

What you are hearing is about a security policy of the company or call-center as a precaution to prevent loss of card-holder data. I've heard of other companies that do the same thing around slightly different data sets. There are many arrests each year of call-center workers taking credit cards so this is likely simply a security control to help reduce several security risks (compromised wireless devices is another issue that comes to mind).

Regarding the coffee-shop comment. The people in the coffee-shop probably don't have access to anywhere near as many credit cards as the database accessed by the call-center workers you are referring too.

You can download the actual PCI Standard from their website for free.

https://www.pcisecuritystandards.org/document_library

The standard makes references to a variety of controls but there are many ways to implement each of these controls. The call center in question may be doing this as part of their PCI control structure but I suspect they are simply doing this to reduce risks and attack-surface in general.