I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No other data is captured from the credit card other than the customer's name of course.
Does this make it in-scope? I found this the below statement but it says AND. Thoughts?
CHD, at a minimum, is the cardholder’s name, the primary account number (PAN) and the expiration date. Any additional information from a credit card such as CVV/CVC/CID and track data is also considered CHD, but it may not be stored except during the authorization of a transaction.