1

My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of virtual credit cards.

E.g. As part of the business operations, my company needs to send information of the virtual credit card - over email - to a vendor/external provider in order for them to process and perform a transaction (only once since it is a virtual credit card).

  • How do PCI requirements apply here?
  • Should the digits be hidden?

Thank you

Improve this question

1 Answer 1

Reset to default
3

PCI DSS applies, but for single-use cards, there may be an exception.

PCI SSC says:

Articles 1285 and 1286:

“PCI DSS applies to all primary account numbers (PANs) that represent a PCI founding payment card brand (American Express, Discover, JCB, MasterCard, or Visa). This includes PANs that are only provided electronically (virtual PANs) as well as PANs that correspond to a physical payment card. Whether a one-time PAN is in scope for PCI DSS will depend on the particular restrictions around their usage as defined by the payment brands. Entities should contact the applicable payment brand to determine how PCI DSS applies.”

That means "Pobably yes". There are some interpretations.

For example, VISA says:

The following points define Visa’s updated position on the applicability of PCI DSS to virtual Visa accounts (https://usa.visa.com/dam/VCOM/global/support-legal/documents/expanded-pci-dss.pdf)

  • Tokens generated in accordance with the EMVCo Payment Tokenisation Specification are not considered to be Visa account data and are not in scope for PCI DSS protection requirements.
  • Visa considers single-use virtual Visa account numbers and multi-use virtual Visa account numbers with Dynamic Card Verification Value 2 (dCVV2) out of scope for PCI DSS protection requirements based on the low risk of fraud associated with the account type.
  • All other Visa primary account numbers (PANs) must be protected in accordance with PCI DSS.
  • In environments where a Visa PAN (i.e., stored credential) is maintained and not segmented from other virtual Visa account types, PCI DSS requirements are applicable across the full environment.

And

Mastercard does not consider Single Use Virtual Card Numbers (SU-VCNs) to be in scope of PCI DSS requirements. The SU-VCN becomes inactive/disabled after only one authorisation; therefore, the virtual PAN data cannot be reused for fraudulent activities within the payment ecosystem. However, it is important to note that even though a SU-VCN may be considered “out of scope” for PCI DSS, it does not mean that the systems and/or entities that are storing, transmitting or processing the SU-VCN are also out of scope. PCI DSS will apply anywhere a multi-use PAN is stored, transmitted or processed. If the systems storing, transmitting or processing the SU-VCN also store, transmit or process multi-use PANs, those systems will remain in scope of PCI DSS requirements.

(statement attributed to Mastercard on various websites, but not found on Mastercards own website)

Improve this answer
1
  • Note that the rationale for being out of scope is "the virtual PAN data cannot be reused" but OP's question covers transmission of the data before its first use meaning that the data is still valid.
    – Ben Voigt
    Commented Sep 28, 2021 at 17:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .