3

I have a limited amount plastic card issued by a certain company. When I log into my online account of the same company, I can see complete details - 16 digits card number, name, expiry date and CVV number visible there.

The login is protected via OTP as well.

My question is: can the card issuer store complete information about my card in their portal?

  • 3
    how could they even function without having such info? – dandavis Dec 30 '16 at 21:54
  • I assume you mean CVV2/CVC2/etc which is the one displayed on the back of your card (front for Amex); the 1 values are only in the magstripe and used only for machine-read txns. The issuer must store CV2, because they are the ones who check it when it used for a txn; if they couldn't check it, it would be totally useless. Displaying it is a very different matter, and maybe a bad idea, though as answered not covered by PCI DSS. – dave_thompson_085 Dec 31 '16 at 7:52
  • Not good practice to display the CVV number. – Julian Knight Jan 1 '17 at 15:21
6

Yes.

A payment handler (e.g. Amazon, Netflix, Thames Water, Comcast) must not store CVV and must mask the PAN (card number), assuming that they are contractually bound to the Payment Card Industry Data Security Standard (PCI-DSS) by their bank.

The card issuer, however, has no such restrictions. They issued the card and they are ultimately responsible for storing its information safely. In all likelihood the card's funds will be protected by a mandatory insurance policy (either private or governmental), such as the Financial Services Compensation Scheme (FSCS) in the UK, and the bank will be liable for damages in the event of card fraud caused by their negligence.

Local law, however, may override this, though I am entirely unaware of any law governing the data security practices of financial institutes at this level of detail.

  • Not exactly, in case his card is a part of a local brand than tour answer is wrong – BokerTov Jan 1 '17 at 6:35
  • @BokerTov True; he said it was a prepay issued by a company, not a bank card, so I made an assumption that it wouldn't be governed as such. – Polynomial Jan 1 '17 at 12:00
1

Depends.

if the card is a part of the following brands VISA\MASTERCARD\AMEX\JCB\DISCOVER than no , your card issuer is not allowed to show that information. your card issuer need to comply with PCI DSS requirements as well as all other merchants and service providers.

If your issued card is not a part of the mentioned brands than PCI DSS is not relevant and he can do what ever he wants.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.