2

My client emailed herself her credit card details and she has given me access to her email by sharing the username and password. She wants me purchase plane tickets, items, on her behalf using her card. I will not be storing any of her details on my system. I will also not charge her card for my companies' services at all. Does my company still need to be PCI compliant with this setup?

  • 1
    As a suggestion, there are plenty of ways around having to share email passwords, ranging from delegation settings to forwarding settings to enterprise shared account password management solutions. – Cody P Jan 11 '18 at 6:45
  • 1
    this sounds, off the top of my head, like someone setting themselves up to claim "unauthorized use of my credit card" – baldPrussian Jan 11 '18 at 16:11
  • 2
    @baldPrussian I have seen this done many times with virtual assistants and personal shoppers. It's not a great practice, but it is a long-standing practice. – schroeder Jan 11 '18 at 16:18
2

Here are the PCI-related services your are providing to this client:

  • You have access to a third-party's card number.
  • You are initiating transactions on behalf of the client.

Based on the PCI SSC's definition of a service provider, you might be consider to be acting as a service provider for this client:

[A service provider is a] business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data.

Your company needs to decide if it wants to assume the risk of acting as a service provider for this client. As stated in the comments there may be other ways you can perform the requested services without having to have the client's card number.

1

Are you planning this mechanism for all of your Customers? Also as a Company, you should deny such requests from Customers and educate her about potential risk of sharing email account/password which someone can use to recover passwords using "Forgot Password" functionality on nearly all websites. Also PCI applies if you are storing Card Holder Data in your setup and you should never store info like CVV etc. on back side of the card. Assuming you are not storing this information anywhere in your controlled infrastructure and sensitive information is with email solution provider and supposedly in Customer's control, you might get away with PCI compliance but can land up in bigger issues in case of dispute. Also this does not seems to be either a scalable business solution to me or a ethical practice.

  • 2
    Ethics are fine if the plan is the customer's idea. It might be a bad idea, but there are no ethical problems here. – schroeder Jan 11 '18 at 15:59
1

You may find this odd, but technically as you are acting as an agent of the cardholder, there is no requirement for you to comply with PCI DSS. You are not contractually beholden to an acquiring (merchant) bank or a card scheme that could contractually require you to comply. If your client was worried about the security of her card details, she could require you to comply with PCI DSS (but given what you've said I don't think security is at the forefront of her mind).

As @schroeder says, these type of concierge services are quite common.

You say you won't be charging the card yourself for the provision of your service. This is good because if you did then you would be a merchant, and PCI DSS would apply.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.