3

I have a limited amount plastic card issued by a certain company. When I log into my online account of the same company, I can see complete details - 16 digits card number, name, expiry date and CVV number visible there.

The login is protected via OTP as well.

My question is: can the card issuer store complete information about my card in their portal?

Improve this question
3
  • 4
    how could they even function without having such info?
    – dandavis
    Commented Dec 30, 2016 at 21:54
  • 1
    I assume you mean CVV2/CVC2/etc which is the one displayed on the back of your card (front for Amex); the 1 values are only in the magstripe and used only for machine-read txns. The issuer must store CV2, because they are the ones who check it when it used for a txn; if they couldn't check it, it would be totally useless. Displaying it is a very different matter, and maybe a bad idea, though as answered not covered by PCI DSS.
    – dave_thompson_085
    Commented Dec 31, 2016 at 7:52
  • Not good practice to display the CVV number.
    – Julian Knight
    Commented Jan 1, 2017 at 15:21

3 Answers 3

Reset to default
9

Yes.

A payment handler (e.g. Amazon, Netflix, Thames Water, Comcast) must not store CVV and must mask the PAN (card number), assuming that they are contractually bound to the Payment Card Industry Data Security Standard (PCI-DSS) by their bank.

The card issuer, however, has no such restrictions. They issued the card and they are ultimately responsible for storing its information safely. In all likelihood the card's funds will be protected by a mandatory insurance policy (either private or governmental), such as the Financial Services Compensation Scheme (FSCS) in the UK, and the bank will be liable for damages in the event of card fraud caused by their negligence.

Local law, however, may override this, though I am entirely unaware of any law governing the data security practices of financial institutes at this level of detail.

Improve this answer
2
  • Not exactly, in case his card is a part of a local brand than tour answer is wrong
    – BokerTov
    Commented Jan 1, 2017 at 6:35
  • @BokerTov True; he said it was a prepay issued by a company, not a bank card, so I made an assumption that it wouldn't be governed as such.
    – Polynomial
    Commented Jan 1, 2017 at 12:00
0

Depends.

if the card is a part of the following brands VISA\MASTERCARD\AMEX\JCB\DISCOVER than no , your card issuer is not allowed to show that information. your card issuer need to comply with PCI DSS requirements as well as all other merchants and service providers.

If your issued card is not a part of the mentioned brands than PCI DSS is not relevant and he can do what ever he wants.

Improve this answer
-3

Card Issuing company can store card no, expiry but not cvv. If a virtual card is issued then all storage is permitted.

Improve this answer
5
  • This is incorrect. As explained in the accepted answer, the card issuer absolutely can store the CVV.
    – Joseph Sible-Reinstate Monica
    Commented Nov 30, 2019 at 15:20
  • @JosephSible-ReinstateMonica The card issuer can not store cvv unless it is closed loop card(whatis.techtarget.com/definition/…). I am talking about a card with can be used at any atm or ecommerce website irrespective of brand. In India a bank which i work for issues Rupay Cards do not store cvv. Also it is useless to store cvv at issuers end because issuer can anytime calculate cvv using two des keys, card number, service code, expiry date.
    – krishna T
    Commented Dec 1, 2019 at 6:49
  • That's not true either.
    – Joseph Sible-Reinstate Monica
    Commented Dec 1, 2019 at 6:56
  • @JosephSible-ReinstateMonica The purpose of cvv is to check integrity of track data using HSM. If you are storing cvv then you are defying the purpose of having cvv. It is not optional to comply with PCI DSS standards. In India Reserve Bank of India mandates PCI DSS compliance whatever brand you may are.
    – krishna T
    Commented Dec 1, 2019 at 6:56
  • @JosephSible-ReinstateMonica What is not true? instead of down voting can you explain a bit.
    – krishna T
    Commented Dec 1, 2019 at 7:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .