4

So, if you stupidly sign up to a site using a credit card and then come to regret it and worry that said site is vulnerable to hacking what data can they legally hold without needing to be PCI compliant.

Things I know are:

  1. They use a PCI compliant payment gateway.
  2. There own server is in a secure facility.
  3. They claim to store only the final 4 digits of the credit card and only so that customers can quickly put more money on their account quickly without the need for entering full cc details every time.

Do you think this is all they hold? Would they also hold name and address to be able to carry out that transaction?

Sorry if I haven't been clear. This is what I received from the company when I asked if I could delete my personal data from their database:

Firstly, we are not allowed to store functional credit card data, so we don't. We do store the last four digits as on their own they are meaningless and help us authenticate you when using the quick re-purchase method. Secondly, our upstream payment provider is authorised to store your card data by VISA/MasterCard. As such they are audited annually and have to jump through all the hoops and conformity required by the PCI DSS standard. Thirdly, it is a requirement of any business to keep records of who they're dealing with. Your personal data is being stored so high up the chain that it must be kept. Other companies who claim to delete your data are most likely the first link in the chain or at an entry level. They delete it and probably shouldn't even be storing it, but their upstream provider is required to keep it.

They keep referring to this email when I ask for further clarification as to whether they themselves or only the payment gateway hold my name and address against that credit card and the account I set up with them. I have never given my address for delivery only for payments as it was a gambling website.

  • 2
    title and body don't really match - you seem to asking us what some company might store in their databases - I'm not sure how we would know that – schroeder Dec 5 '16 at 16:26
  • 2
    The typical case is: The full credit card information to carry out the transaction is stored by the payment gateway/PSP. The site only stores the last 4 digits, the holder name, and whatever address data you gave them (e.g. for shipping). – CodesInChaos Dec 5 '16 at 16:30
  • 1
    They would also often store an identifier for the card, provided by the payment gateway - this should be a value used to link their account to the payment gateway's full information on the card. Otherwise, they'd be quite a lot of potential collisions (especially if you're called "John Smith"). It's not supposed to be reversible without having the database from the payment gateway. – Matthew Dec 5 '16 at 16:37
  • What @Matthew said. The gateway needs to have more than the last 4 digits to uniquely identify the account. So that is under PCI. – Bryan Field Dec 5 '16 at 16:48
  • 1
    Now I'm more confused. They are telling you what they are storing. What is your question again? It looks like your question comes down to the storing of the address, and it seems that they are saying they are. – schroeder Dec 5 '16 at 21:47
5

If an organisation receives, processes, or stores credit card data (even if this is only hosting a payment gateway iframe or form) then they are required to be PCI compliant. Note the 'or' here - any one or more of these means you are required to be compliant.

There are no exceptions to this.

They may be required to provide a lower level of compliance i.e. need fewer controls, but they will still have to assess their required level and implement the controls that the level requires.

Even if they only hold data 'in transit' for a short period of time and never store the card data to disk, they will need to be compliant.

Again, this isn't a judgement call - if you collect, store, or process any card data at all (even just 'in passing') you need to be compliant.

Of course, how many organisations are compliant is a whole other question. Enforcement has not been 100% in the past although this is changing.

  • 1
    A very common scenario is that the site does not process full CHD even 'in passing' - they redirect the user to a PCI-compliant gateway, user gives the data to the gateway, and that gateway passes on only sanitized information to the store - e.g. the abovementioned last four digits and a reference/random token to relate this transaction to the full data stored in the gateway systems. – Peteris Dec 5 '16 at 19:30
  • That's what I am hoping but unfortunately they do not seem to be very forthcoming with exactly what they hold. – hazard44 Dec 5 '16 at 19:46
  • You can tell whether the card data touches their servers by proxying the traffic between your browser and the host. If the POST from your browser is directed to the retailer's domain i.e. not the domain of the payment gateway, then they may be storing your data. If the POST from your browser goes directly to the payment gateway domain then the retailer site will not see your card data (normally, if as Peteris says, the payment is tokenized, which is usually the case). Even in this scenario - which is known as 'silent post' the retailer must be PCI compliant. – David Scholefield Dec 5 '16 at 21:28
  • @hazard44 If you really don't trust them, would you believe them if they did answer you? If I had your concerns, I think I'd be proactive: contact the bank and get a new card. That'd be the safest thing to do. – jpmc26 Dec 5 '16 at 21:31
  • No, I wouldn't............good point. How would I go about proxying the traffic between my browser and the host? – hazard44 Dec 5 '16 at 22:41
6

It is very possible, and quite likely, that they do store- Name, Address, Phone number, email, and other contact and purchase data. This is irrelevant to PCI. PCI cares about the credit card data (CHD) and account number (PAN) and the other data on the mag stripe - including the "extra" numbers on the back of the card, and the expiration date.

PCI forbids storage of the mag stripe data and the "extra" numbers, (for anyone other than those who really need it).
PCI permits storage of the last 4 numbers along with other pieces of data such as a transaction number and for repeating transactions, the merchant can also store a special single-merchant number that looks like a credit card number and works the same, but it is tied to the merchant.

Most merchants do not want the wrath of the PCI council and/or their bank and/or law enforcement, and will do everything they can to "de-scope" systems out of PCI scope. So, there is the question if they are 100% compliant, however, they may be compliant "enough" with only the data you indicated.

1

PCI-DSS allows the storage of your cardholder data, credit card number, and expiration date as long as they are encrypted at rest and in transit.

Never store full contents of any track from the card’s magnetic stripe or chip (referred to as full track, track, track 1, track 2, or magnetic stripe data). If required for business purposes, the cardholder’s name, PAN, expiration date, and service code may be stored as long as they are protected in accordance with PCI DSS requirements.

It does not allow the storage of the verification code or PIN.

Never store the card-validation code or value (three- or four-digit number printed on the front or back of a payment card used to validate card-not-present transactions).

Never store the personal identification number (PIN) or PIN Block.

It could be that they store the full card number but only allow you to see the last four digits.

Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not apply to those authorized with a specific need to see the full PAN, nor does it supersede stricter requirements in place for displays of cardholder data such as on a point-of-sale receipt.

Link

0

So, if you stupidly sign up to a site using a credit card and then come to regret it and worry that said site is vulnerable to hacking what data can they legally hold without needing to be PCI compliant.

...

I have never given my address for delivery only for payments as it was a gambling website.

The issue that you're struggling with is not their PCI compliance, or even what you can try to compel them to do to stay within PCI compliance, but rather the fact that you used your card at a gambling site and now wish you hadn't.

Sorry if I haven't been clear. This is what I received from the company when I asked if I could delete my personal data from their database:

There is nothing in the PCI to compel them to delete your data and, as they've pointed out, their upstream processor - which has the full set of data and is in PCI scope - has a requirement to retain the transactional records, which include things like your card number and (if submitted) name.

To put it bluntly, you don't have any ownership of your transactional history. When you submit your name to purchase something, it becomes part of the transaction, and that transaction is owned by the processor. The processor must meet the requirements of the PCI DSS, of course, and must protect your names commensurate with applicable PII regulations...

(Note that even a stringent state like Massachusetts with 201 CMR 17.00 makes no mention of compelling the business to respond to PII deletion requests - PII law is about punishing loss/misuse, not preventing use).

You've asked them to delete your account; they've declined and - quite reasonably - pointed out that even if they did so, it wouldn't address your concerns. They are allowed to decline. You cannot compel them with the PCI.

You might be able to compel them with a lawyer, but that will cost you money.

If you're concerned about someone misusing the account, then report your credit card stolen and get a new one issued. That's really your only protection.

  • Thanks for the response G. I agree with the first part, you have a very valid point. Just hoping that it is the second scenario and I have now cancelled the card s thanks for that. – hazard44 Dec 5 '16 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.