I have received an email from LINKT (part of LendLease) stating I need to update my credit card details. In this email it says "...details such as expiry date or CVV might be saved incorrectly or out of date" This is identical to their website where they say "details saved on your account (expiry date or CVV) might be saved incorrectly or out of date"
When I logged on I found that they require my CVV but nothing else to be added. I searched and found a few pages one and all seemed to be clear with this PCI reference “(3.2.2.) Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card used to verify card-not-present transactions) after payment processing authorization is complete.”
So my understanding is that
- that storage of CVV past the first transaction is not compliant
- They should not have CVV stored for any existing cards
So It does not seem reasonable to only ask for some cards which have been sucesfully processed to reenter the CVV system either all cards would need CVV to be reentered or only those which have not been validated As I have already successfully processed a credit card payment on this card I contacted LINKT and asked them why the were asking for the CVV to be re-entered and can they state it would not be stored after the first payment
- they are PCI compliant
- they need this data to ensure security as we have a new system
- this data is stored securely
The last one worried me as stating the data is stored securely seemed to me to indicate they were retaining it As they could not specifically answer to why it was required again and that it would not be stored I then considered reporting them.
- I have contacted my bank - Commonwealth Bank , they said "If you feel your details are not safe you may cancel your card" So no help there I believe they are the wrong people though it is the Processor for Linkt not my card issuer. The Agent also stated PCI compliance is not a law some companies required the CVV to complete payments as a one off on ongoing debit"
- I did find a statement "PCI compliance is an industry mandate and those without it can be fined for violating agreements and negligence." The commonwealth bank agent disagreed with this
- I lodged a complaint to Linkt saying storing of CVV details is not PCI compliant and they need to delete any stored CVVs
I beleive this is a , non-legal summary of the legalities of this: PCI-DSS compliance is not a law and is probably not referenced by any legislation. It may be a requirement of the contract with the payment provider. The only answer I got to the question was from my credit card issuer , the Commenwealth bank in Australa, where they stated that PCI-DSS is not required and as long as the company stores the data securely there is no need to worry.