I work for a retail organization with a large ecommerce presence. We allow our customers to store CC information for easy check-out, like many retailers.
Currently we remove all stored CC information upon Password Resets for an individual. There is a request by one of our business partners to change this and retain CC information through the PW reset. To clarify, when the PW is reset, an email gets sent to the users primary email address with a link to reset the password.
The justification for retaining it was that it's an inconvenience today, and we are seeing lost sales due to consumers not re-entering their CC information; in particular, our co-branded and store cards.
If there WAS a malicious user who had access to credentials for our web site, that user would simply log in as the target instead of reset the password. If the user has access to the email address on file to complete the password reset functionality then we assume that it's indeed that person and not someone maliciously trying to reset the password, hence the request to retain CC information.
I am wondering if this has any sort of PCI implications that could land us in hot water?
I understand the reasoning but want to make sure we are doing the right thing.