1

I have received an email from LINKT (part of LendLease) stating I need to update my credit card details. In this email it says "...details such as expiry date or CVV might be saved incorrectly or out of date" This is identical to their website where they say "details saved on your account (expiry date or CVV) might be saved incorrectly or out of date"

When I logged on I found that they require my CVV but nothing else to be added. I searched and found a few pages one and all seemed to be clear with this PCI reference “(3.2.2.) Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card used to verify card-not-present transactions) after payment processing authorization is complete.”

So my understanding is that

  1. that storage of CVV past the first transaction is not compliant
  2. They should not have CVV stored for any existing cards

So It does not seem reasonable to only ask for some cards which have been sucesfully processed to reenter the CVV system either all cards would need CVV to be reentered or only those which have not been validated As I have already successfully processed a credit card payment on this card I contacted LINKT and asked them why the were asking for the CVV to be re-entered and can they state it would not be stored after the first payment

They stated

  1. they are PCI compliant
  2. they need this data to ensure security as we have a new system
  3. this data is stored securely

The last one worried me as stating the data is stored securely seemed to me to indicate they were retaining it As they could not specifically answer to why it was required again and that it would not be stored I then considered reporting them.

So I found this and this on reporting but I don't fully understand - should I be asking my bank or should I be asking their processor to check , if it is their processor how do I find this?

Updates

  • I have contacted my bank - Commonwealth Bank , they said "If you feel your details are not safe you may cancel your card" So no help there I believe they are the wrong people though it is the Processor for Linkt not my card issuer. The Agent also stated PCI compliance is not a law some companies required the CVV to complete payments as a one off on ongoing debit"
  • I did find a statement "PCI compliance is an industry mandate and those without it can be fined for violating agreements and negligence." The commonwealth bank agent disagreed with this
  • I lodged a complaint to Linkt saying storing of CVV details is not PCI compliant and they need to delete any stored CVVs

I beleive this is a , non-legal summary of the legalities of this: PCI-DSS compliance is not a law and is probably not referenced by any legislation. It may be a requirement of the contract with the payment provider. The only answer I got to the question was from my credit card issuer , the Commenwealth bank in Australa, where they stated that PCI-DSS is not required and as long as the company stores the data securely there is no need to worry.

3
  • The difference here is that the card details are being stored to make multiple charges over time. Not a single charge. So the CVV is needed to be stored
    – schroeder
    Oct 13, 2022 at 10:02
  • The PCI -DSS specifillay says no what you have said is not the correct manner of using a CVV - According to PCI-DSS they should use he CVV the first time then discard the CVV - Which is what schroeder , oh you, said in your correct answer
    – Ross
    Oct 15, 2022 at 23:35
  • My comment was not to say what was permitted by PCI DSS, but what the requirement was of LINKT
    – schroeder
    Oct 16, 2022 at 9:35

1 Answer 1

2

PCI-DSS is not a law. It's a requirement by the card company industry. So the Agent is correct on that point.

I googled "PCI DSS when is it ok to store CVV" and this was the top hit:

Some service providers offer a concierge-style service, where cardholder details are retained by the provider to facilitate potential future transactions. Retention of card verification codes/values for this purpose is also prohibited under PCI DSS Requirement 3.2.

So the payment processor can't retain the CVV. What they should do instead is to get an authorisation token from the card company to perform subsequent transactions made with the stored card.

I also googled "how to report a pci dss violation" and got this as the top hit. (report them to their card processing provider - ask them who they use ...)

1
  • Yes I believe this is the answer - I need to ask the non-compliant company to reveal their card processing provider so I can report them to the card processing provider for being non-compliant - Its not going so well for me at the moment
    – Ross
    Oct 15, 2022 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.