3

I am developing a service, a part of which stores the credit card data of it's users. According to the Israeli credit card companies' requirements my users need to present their government ID number when making a transaction.

The PCI Standard prohibits the storage of CVV and credit card PIN numbers, because of information security reasons.

My question is, can I be sure that storing my users' government ID numbers is not against the PCI standard, since it serves almost the same purpose as a CVV or a PIN number - to verify the credit card holder?

2

PCIDSS publishes how you store payment card data. A government Id is not covered.

However it probably is personally identifiable information and should still be handled with care.

The full set of requirements is buried in a pdf

https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dss

But basically you have to encrypt the card number, and you cannot retain the CVV2 / PIN or any of the data you might read from a card (but that you can't see by looking at it)

Everything else is allowed to be stored unencrypted.

  • 2
    This is all true. However, there might also be Israeli law which covers storing government ID#s. It wouldn't be part of PCIDSS, but it would be applicable if operating in Israel. – Bobson Jan 21 '17 at 23:48
  • Yes, you need to check the local Israeli laws on this matter, I can't read the Hebrew law text but there is an English news article about them locking down the ID number and not using it for this very purpose after a high profile attack in 2012: timesofisrael.com/… – ewanm89 Jan 22 '17 at 12:48
  • Thank you guys, I'll check the laws and requirements of my country and the credit card companies to see if they say something about it. – Theodore Jan 24 '17 at 6:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.