Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be displayed/stored. I am trying to find what is required in regards to Card transmission. e.g Can the customer of a website send (if he wishes) the PAN number and CC number (not hidden) but the developer store it as it is required by PCI? So, is PCI only about storage from the merchant perspective, but how the customer send it to he merchant is irrelevant?
Thank you
The issue of "sending" the card to the merchant is a little complicated. The cardholder may be allowed to "send" the card in ways that the merchant is not allowed to accept.
Compliance with PCI requirements is part of the contractual relationship a merchant enters into with a bank, called an acquirer, in order to be able to accept credit card payments.
PCI requirements include language both about PANs "at rest" (storage) and "in transit" (transmission). The ways that a merchant allows customers to provide their credit card number are subject to both at rest and in transit PCI requirements.
IOW, PCI dictates how a merchant may legitimately accept cards for payment.
For the cardholder- they have an agreement with their bank, called an "issuer"- the bank that offers them a credit line and sends them a card in the mail. Deep in the contractual terms of service that the cardholder agrees to with the issuer is language about keeping the card number secret.
The merchant-side rules are much more strict than the cardholder side rules, for reasons that have to do with risk and scale and business model.
In practical terms, for instance, a merchant is not able to advertise that they accept card numbers over email, as email is a protocol that does not comply with PCI. If a merchant receives a card number in an email, they have to purge that email from their email systems. PCI auditors ask about workflows like this in their reviews.
When I last looked, cardholder agreements did not expressly forbid sending a card number over email, though that may have changed, but in general the rules are much less explicit, and it's pretty rare for the card issuer to revoke a card from a cardholder for reasons that do not involve fraudulent spending or lack of payment. Cardholder casual misuse of a card number, leading to a replacement card is a standard workflow for issuers.
