0

I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be displayed/stored. I am trying to find what is required in regards to Card transmission. e.g Can the customer of a website send (if he wishes) the PAN number and CC number (not hidden) but the developer store it as it is required by PCI? So, is PCI only about storage from the merchant perspective, but how the customer send it to he merchant is irrelevant?

Thank you

  • You're wrong about PCI. Merchants are allowed to store the full card number, as long as they meet the PCI security standards. There are lower security standards for storing or displaying only the first six and last four digits, which is probably what you're thinking of. – Mike Scott Aug 1 '18 at 13:17
  • Besides the storage, my question is if I can accept cardholder's info unmasked but store it masked on my database and delete completely the unmasked evidence. – fargo01 Aug 1 '18 at 13:51
  • How would you charge them if you don’t have heir full PAN? – wireghoul Aug 2 '18 at 11:12
1

The issue of "sending" the card to the merchant is a little complicated. The cardholder may be allowed to "send" the card in ways that the merchant is not allowed to accept.

Compliance with PCI requirements is part of the contractual relationship a merchant enters into with a bank, called an acquirer, in order to be able to accept credit card payments.

PCI requirements include language both about PANs "at rest" (storage) and "in transit" (transmission). The ways that a merchant allows customers to provide their credit card number are subject to both at rest and in transit PCI requirements.

IOW, PCI dictates how a merchant may legitimately accept cards for payment.

For the cardholder- they have an agreement with their bank, called an "issuer"- the bank that offers them a credit line and sends them a card in the mail. Deep in the contractual terms of service that the cardholder agrees to with the issuer is language about keeping the card number secret.

The merchant-side rules are much more strict than the cardholder side rules, for reasons that have to do with risk and scale and business model.

In practical terms, for instance, a merchant is not able to advertise that they accept card numbers over email, as email is a protocol that does not comply with PCI. If a merchant receives a card number in an email, they have to purge that email from their email systems. PCI auditors ask about workflows like this in their reviews.

When I last looked, cardholder agreements did not expressly forbid sending a card number over email, though that may have changed, but in general the rules are much less explicit, and it's pretty rare for the card issuer to revoke a card from a cardholder for reasons that do not involve fraudulent spending or lack of payment. Cardholder casual misuse of a card number, leading to a replacement card is a standard workflow for issuers.

  • First of all, thank you for the thorough reply @jonah. So, me (as a merchant), I should warn customers on how to send (or upload to my website) image of their card (with the appropriate number and CC number masked). But, if someone uploads or send it without the masking can I store it to my database as required by the PCI (meaning that I should enforce the masking) or should I discard completely this image and require from the customer to send the image with his card masked? – fargo01 Aug 1 '18 at 13:49
  • Happy to help...though there are a couple of different issues here- why take images; masking issues are not quite as described....with all respect if you are a merchant, by taking card payments you are assuming a risk, and my sense is that you really ought to build your own understanding of PCI by engaging with a consultant or reading the source material- StackOverflow q&a really is insufficient... – Jonah Benton Aug 1 '18 at 13:57
  • My question is if I can accept cardholder's info unmasked but store it masked on my database and delete completely the unmasked evidence. But I think you are absolutely correct about the consultant. Thanks again for your time. – fargo01 Aug 1 '18 at 14:03
  • You need an unmasked PAN to be able to capture a payment, and also to create recurring payments, so you can accept and store unmasked PANs. You have to use encryption both in transit and at rest in this case. Storing last 4 unencrypted does not incur PCI risk. First 6 a little more sensitive, generally just store last 4 to remind cardholder what card they used. – Jonah Benton Aug 1 '18 at 14:14
  • 1
    @fargo01 - I strongly recommend reviewing the PCI Security Standards Council's small merchants resources - pcisecuritystandards.org/pci_security/small_merchant. These documents will help you start accepting payments in a secure and compliant manner. – waltonob Aug 1 '18 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.