My client emailed herself her credit card details and she has given me access to her email by sharing the username and password. She wants me purchase plane tickets, items, on her behalf using her card. I will not be storing any of her details on my system. I will also not charge her card for my companies' services at all. Does my company still need to be PCI compliant with this setup?
Here are the PCI-related services your are providing to this client:
- You have access to a third-party's card number.
- You are initiating transactions on behalf of the client.
Based on the PCI SSC's definition of a service provider, you might be consider to be acting as a service provider for this client:
[A service provider is a] business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data.
Your company needs to decide if it wants to assume the risk of acting as a service provider for this client. As stated in the comments there may be other ways you can perform the requested services without having to have the client's card number.
Are you planning this mechanism for all of your Customers? Also as a Company, you should deny such requests from Customers and educate her about potential risk of sharing email account/password which someone can use to recover passwords using "Forgot Password" functionality on nearly all websites. Also PCI applies if you are storing Card Holder Data in your setup and you should never store info like CVV etc. on back side of the card. Assuming you are not storing this information anywhere in your controlled infrastructure and sensitive information is with email solution provider and supposedly in Customer's control, you might get away with PCI compliance but can land up in bigger issues in case of dispute. Also this does not seems to be either a scalable business solution to me or a ethical practice.
You may find this odd, but technically as you are acting as an agent of the cardholder, there is no requirement for you to comply with PCI DSS. You are not contractually beholden to an acquiring (merchant) bank or a card scheme that could contractually require you to comply. If your client was worried about the security of her card details, she could require you to comply with PCI DSS (but given what you've said I don't think security is at the forefront of her mind).
As @schroeder says, these type of concierge services are quite common.
You say you won't be charging the card yourself for the provision of your service. This is good because if you did then you would be a merchant, and PCI DSS would apply.