Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the details for the instantly granted (approved) Credit card so that customer can start using it for eCommerce?
1 Answer
IANAQSA, and you seem to be getting into the Issuer business. You really need a QSA.
You are asking about the requirements upon issuers (most PCI-DSS questions are from the POV of merchants, acquirers, and processors; the other side of the equation).
Issuers are also held to the PCI-DSS, but obviously they have different constraints. For example:
3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only personnel with a legitimate business need can see more than the first six/last four digits of the PAN.
For an issuer, it is a legitimate business need to communicate a cardholder's card number to them. Most commonly, this is done by shipping a plastic card to the cardholder's mailing address. So Issuers clearly get a pass on the requirement to Mask per 3.3 when business need requires them to disclose the full card number.
You're asking about virtual / electronic only cards, and there is precedent that Privacy.com displays full card data - PAN, expiration, and CVV - as soon as a user allocates themselves a new card. So my best answer is - yes, you can display those details per business need.
To address followup from the comments:
QSA is Qualified Security Assessor; the auditors recognized by PCI as authoritative. Since I Am Not A QSA (IANAQSA) what you get from me are opinions, but not worth anything when audit time comes.
All the MFA/2-factor requirements in PCI revolve around administration, not end users or customers, so that should not be an issue.
Privacy issues legitimate card numbers; I believe they do fall into pre-paid bins, but they aren't really pre-paid cards, as they're backed by ACH and can have sophisticated limits. But, yes, to a merchant they look like pre-paid cards.
-
Thanks a lot for your answers, Gowenfawr! What is the IANAQSA? And QSA in your answer please? Do you think there are some further requirements such as MFA / 2 Factor Authentication before the full details of Credit Card can be displayed? And lastly - Privacy.com is pre-paid card, right? (Not Credit card) so it’s like Revolut.com Aug 11, 2019 at 15:06
-