3

There is a local mom and pop video store that requires new customers to write their names, addresses, and credit card information on 3x5 cards. These cards are actually kept in a recipe cards box that is left sitting on the counter, often times unattended. They also have shoe boxes left in plain site that are full of older cards for infrequent or non-returning customers. Several times I've witnessed these cards scattered across the counter as they use them to attach to movies that are being reserved. In this day of credit card fraud and theft, I'm dumbfounded that this is happening. Is this legal? Doesn't this violate credit cards companies policies of safe credit card storage? Also, is there a way to report this? Customers have complained but they just say that's how they've done it for 30+ years. They have no computer system at all in place to switch over and don't plan on getting one.

Improve this question
4
  • 2
    Where is this store? Uh... for, um... for science.
    – Mark Buffalo
    Jun 18, 2016 at 1:45
  • Just curious, what country are you in?
    – Neil Smithline
    Jun 18, 2016 at 2:23
  • Just tell the owner to improve their security or give you your card because you find it too insecure. If a few people did that, the owner would have to do something about it. Of course, it must be hard to invest anything in a business that is on the verge of closing.
    – Julie Pelletier
    Jun 18, 2016 at 2:26
  • Science huh Mark. 😉 Wonder what your hypothesis would be. I live in the US, Utah to be exact. As for asking for your card back, they've refused several times to several customers to give them back. I personally refused to write my info down and walked out but I have friends who still go there. Others have asked that they improve the security but they get very hostile at the suggestion. I'm just appalled that they refuse to give back or destroy these cards when asked.
    – Jjshumway68
    Jun 18, 2016 at 6:33

1 Answer 1

Reset to default
3

IANAQSA, and this is outside my personal experience, but here goes:

In this day of credit card fraud and theft, I'm dumbfounded that this is happening. Is this legal?

Legal? Depends on where you are, but... probably, yes. Note that even in the TJX breach, where 45 Million cards were compromised, the legal charges against them were for PII, not for violation of card numbers. There's generally no laws about that, only Card Brand requirements.

Doesn't this violate credit cards companies policies of safe credit card storage?

Yes, this violates the PCI DSS 9.5:

DSS 9.5

Now, the DSS is generally only thought of for business with computers and networks. Since IANAQSA, I can't speak to whether the business you describe would be expected to hew to it. That being said, I've no doubt that whatever contractual language they sign in order to be allowed to process cards invokes similar cautions because, as you state, they're pretty basic.

Also, is there a way to report this?

You can report it to their processor, if you can determine who that is, and that may or may not have any effect. You can also complain to the card brands (form for Visa, form for Mastercard) and there's still no guarantee that'll have any effect.

You can also vote with your feet. Ask them to destroy your card, watch them do it, and don't go back there again.

Improve this answer
2
  • Thanks for the information. From what I've gleaned there really is a huge lack of regulations that have any worth when it comes to the legal ramifications of being so careless. Compliance shouldn't be a choice in this situation. Even with all if the security breaches, at least most of these companies had some measure of protection for their customers. Note cards with CC numbers spread out on a counter is just an insult to their customers.
    – Jjshumway68
    Jun 18, 2016 at 6:44
  • @Jjshumway68 - the regulation is clear here. There is definitely no lack. And if you inform the processor something should be done. But there are no laws being broken. You are the most important part here - notify the processor, and all your friends, and possibly even provide the shop with a copy of the relevant PCI DSS section
    – Rory Alsop ♦
    Jun 18, 2016 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .