2

I can't be too specific unfortunately, but let's assume a company has to receive, do some physical operation on credit cards, and send them back.

No card data will ever touch a computer, and payments for the service are handled separately through a PCI-compliant provider.

Does the company need PCI-compliance?

Improve this question
1
  • Certainly a fringe and possible corner case that the folks running PCI have not considered but I think this operation could count as one that "stores cardholder data electronically". That being said, the leverage that PCI has is pretty much entirely tied to merchant processing so if you don't have any sort of merchant agreement you are not required to comply. PCI DSS is not a law per se but an industry-wide component to merchant card processing. – Jeff Meden Sep 27 '16 at 20:31
2

Who requires you to be compliant?

PCI DSS is not a law, and nothing in the PCI DSS can require you to be compliant if you don't want to. The usual meaning when people say "X needs to be PCI DSS compliant" is that either X has signed a contract where they agree to comply with PCI DSS, or want to sign a contract of a type where every partner will require them to be compliant - e.g. taking credit card payments.

If you don't want to be compliant, and haven't agreed to be compliant, then you can blatantly violate all PCI DSS conditions with two major risks:

  • the payment card industry may not want to talk to you, possibly in other aspects as well - e.g. if one of your products obviously goes against PCI DSS, then you may find out that you're unable to receive credit card payments for any products and services. That third party PCI-compliant provider might easily consider it good practice to refuse service to you if they believe you're misusing credit card data. Also, issuing banks may take action against you to prevent their cards being used in such a way - for example, if I as an issuing institution noticed that "End-users (bank customers) are sending cards" to some third party in sufficient numbers to warrant their attention, then it would be a proper and reasonable reaction to contact all customers who had transactions with you, notify them that their cards were compromised by doing this and asking them not to do it ever again, blocking all involved cards, requiring them to be replaced, and blocking any future card payments to you as potentially fraudulent.
  • if your cardholder data are fraudulently used, you might be held liable, as knowingly violating "well known industry standards" can be considered negligence and put you at fault if some fraudster manages to obtain that CC data and harm your customers. Due to this, you might want to follow at least some of PCI DSS guidelines anyway, as they include a lot of best practices for secure handling of data.
Improve this answer
6
  • "Who requires you to be compliant?" Myself - I would like to offer the service in the safest way possible, so if there are any existing guidelines about this I'd like to follow them. – André Borie Sep 27 '16 at 22:37
  • @AndréBorie my CC agreement includes a sentence "The Cardholder shall take due care to prevent the Card from coming into possession of third person" and I'm quite sure that almost every other card conditions does as well. Sending active credit cards to a third party is an extreme fraud risk, from issuing bank perspective a rule of thumb is to immediately revoke any card if this has happened. – Peteris Sep 27 '16 at 22:41
  • I do understand that and we make it clear that it may be against the bank's terms and conditions. However it is not our job to enforce them, and if a customer has a piece of plastic they would like us to work on, I don't want to refuse as long as the customer is aware of the risks. – André Borie Sep 27 '16 at 22:45
  • And yes, the part about active credit cards - we do recommend that customers ask their bank for a replacement card and send us that before they activate it to further reduce the risk. But again, I can't force them, nor do I have any way to tell whether a card is activated when it arrives. – André Borie Sep 27 '16 at 22:48
  • @AndréBorie so you probably have to treat it as a business risk - as long as they don't notice and/or don't care, you're fine; but do note that you might get hit with a notice "as of tomorrow, we're terminating your merchant account and ability to accept cards". Another risk is that you will be perceived by the customer as the guilty party for any fraudulent transactions afterward - because it is plausible that those transactions were done by some employee of yours who wrote down the card information and a few months later did some "shopping"; no matter if it really was so, it's bad PR. – Peteris Sep 27 '16 at 22:52
1

PCI DSS 3.2 states: "PCI DSS applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers. PCI DSS also applies to all other entities that store, process, or transmit cardholder data and/or sensitive authentication data."

There is an FAQ on the PCI SSC site that asks if PCI applies to paper with cardholder data and the answer was: "Yes, PCI DSS requirements are applicable if a Primary Account Number (PAN) is stored, processed, or transmitted by any media, including paper records. PCI DSS Requirements 9.5 through 9.8 specifically addresses the safeguarding of physical media, including paper records, containing cardholder data."

Given those two together, it looks like it would apply in the case of handling the media of the plastic card. As Jeff pointed out in a comment, if you don't have an agreement that contractually obligates you to PCI DSS, applicability gets interesting.

Not knowing the particulars of the process you're asking about, what I'd look at is whoever is sending the cards to the company in question. Are they a merchant or service provider that is obligated to be PCI DSS compliant? That company should be looking at 12.8, "Maintain and implement policies and procedures to manage service providers with whom cardholder data is shared, or that could affect the security of cardholder data, as follows:". This is followed by subrequirements that talk about written agreements that acknowledge responsibility, diligence processes to understand who has what responsibility on different requirements, etc.

In my experience with QSA audits, what I would expect to happen is the QSA would request a list from the merchant that included all entities with whom the merchant shared card data in any capacity. Then they would dig into that. While your company might not have any direct obligations, the merchants/service providers that you're working with that do have obligations could be in a bad situation if they needed to show evidence that they knew you were PCI DSS compliant and could not.

Improve this answer
1
  • End-users (bank customers) are sending cards - which as far as I know have no need to be PCI compliant. – André Borie Sep 27 '16 at 21:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.