I'm attempting to place an order with an American company and I reside outside of America. Upon placing the order (and already submitting payment) I received an email asking me to fill out a PDF document to verify my identity and prevent credit card fraud from foreign credit cards.

This document asks you to fill out your credit card information again, as well as photocopy your government ID as well as the front and back of the credit card. Upon filling that our you are expected to scan the PDF, and send it back.

Surely this cannot be a safe practice. There is no mention of a privacy policy or who has access to the e-mail account it is supposed to be sent to nor does it make mention of archival policies.

Is this a violation of PCI (or similar compliance standards)?

  • pcicomplianceguide.org/pcifaqs.php There is a little guide. I know when I was working for a company that was PCI compliant they were very strict. This doesn't sound like it complies best thing I can recommend is don't fill it out if you feel its sketchy. We had to have any secured communications encrypted. Which.. what you describe is no where near so :) – Tony Nov 6 '12 at 22:51
  • 2
    this sounds like an attempt to endrun around PCI-DSS, and yeah, I would say an attached PDF to an email is not secure. – ewanm89 Nov 6 '12 at 23:44

Yes, this would be in contravention of PCI requirement 4.1 ("Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open public networks").

Handling of the mail at the receiving end is very likely to be in contravention of many more requirements, including requirement 3.2.2 ("Do not store the card verification code or value").

If this company is a merchant and thus subject to PCI, I can't see any way they could be in compliance - I don't think there can be plausible compensating controls for this kind of thing.


Why don't you ask about their privacy policy? It would be the only way to resolve that aspect of the question.

I would expect your issuing bank or card company are the best people to ask if the request is compliant - they have the knowledge, authority and responsibility, and you can verify their identity. Commentators here at best will be able to refer you to a standards document, which you'll have to read, and then worry if your interpretation is accurate.

As to the practice itself - yes I think it's risky. Weigh it up against how badly you need to buy the product from that supplier. Credit cards can always be cancelled, but there can be lots of information on a government ID that shouldn't be floating around in someone elses data store.


Emailing cardholder data over the internet is a violation of PCI DSS because email is not a secure form of communication. The practice of filling out the PDF form with your sensitive information and upload it via sFTP or fax, however, is NOT a violation of PCI. But here are the questions, what do they do and how do they handle that document once they get it? Are they PCI compliant? Do they have a standard operating procedure to redact the sensitive data after the transaction is completed. Here's a link to the Payment Card Industry Security Standards Council website and here's a whole section on PCI DSS.

Based on the information you provided, I don't think this company is PCI-compliant, and I wouldn't send my information to them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.