I get from my payment processor a token in place of the cardholder's CC number. To make the payment I have to ask the cardholder for his CVV. Doing this by calling the payment processor's webpage is cumbersome. Is it allowed to ask for the CVV in an app and forward that with the card-token to the payment processor? I think it could be allowed as I am not in possession of the actual card number and I am of course not going to store the CVV.

  • This is a question best answered by your payment processor and/or your QSA. – Bobson Aug 8 '16 at 16:20

No. The CVV is "Sensitive Authentication Data", and according to the PCI DSS page 7:

PCI DSS also applies to all other entities that store, process, or transmit cardholder data and/or sensitive authentication data.

So, yes, transmitting (receiving and re-sending) just the CVV is enough to put you in scope; if you're already using Tokenization, you're probably doing that to stay out of scope, and this would be a bad idea for you.

  • Clearly someone wasn't happy with the correct answer. – Xander Aug 8 '16 at 18:30
  • If I enter a CVV in a browser, it is recieving and transmitting. But browsers are somehow out of scope :-) – Gunstick Aug 9 '16 at 8:37
  • @Gunstick browsers are owned by the customer, not the merchant, so the DSS does not apply. If that browser was on a merchant-owned kiosk, then DSS would apply. – gowenfawr Aug 9 '16 at 10:30
  • I got similar answers from other sources. Basically smartphones are not at all subject to pci rules except if they are used as payment terminal (e.g. a tablet used as a POS terminal). So it comes down to the user deciding what he does with the CVV and if he trusts that app. – Gunstick Aug 9 '16 at 11:46
  • @Gunstick, there could be a miscommunication here. The use of the word "forward" instead of "send" in the question implied, to me, that the CVV would be routed through your infrastructure, not go direct from smartphone-app-to-processor. If, instead, you're asking why your smartphone app can't send CVV direct to processor... you're veering into whether your app needs to be PA-DSS (not PCI-DSS) compliant or not, which is a stickier question. The bottom line probably remains the same, which is, don't touch it if you don't have to. – gowenfawr Aug 9 '16 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.