I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts.
We have been asked a few times by various customers if we can store there card details, for processing later, citing the fact that other suppliers offer this service.
How could this be allowed? E.g. the offline storage of full card holder data, including the security code (CSC) from the rear of the card?
Under PCI, if this data is received via a non electronic format and with written consent, would this be allowed?
We want to try and accommodate customers as much as possible (especially if competitors offer this service), but we want to be fully PCI complaint. Due the entire offline nature of this case, I am having trouble finding a concrete answer, please could someone clarify?
As under PCI compliance documentation, you cannot store any of the following:
So surely this applies to offline storage as well?
I am sure that I am correct in thinking this can't be stored (even in an 100% offline manor) but I just want clarification, thanks.