Is LINKT non-PCI compliance and if so how do I report it

Question

I have received an email from LINKT (part of LendLease) stating I need to update my credit card details. In this email it says "...details such as expiry date or CVV might be saved incorrectly or out of date" This is identical to their website where they say "details saved on your account (expiry date or CVV) might be saved incorrectly or out of date"

When I logged on I found that they require my CVV but nothing else to be added. I searched and found a few pages one and all seemed to be clear with this PCI reference “(3.2.2.) Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment card used to verify card-not-present transactions) after payment processing authorization is complete.”

So my understanding is that

1. that storage of CVV past the first transaction is not compliant
2. They should not have CVV stored for any existing cards

So It does not seem reasonable to only ask for some cards which have been sucesfully processed to reenter the CVV system either all cards would need CVV to be reentered or only those which have not been validated As I have already successfully processed a credit card payment on this card I contacted LINKT and asked them why the were asking for the CVV to be re-entered and can they state it would not be stored after the first payment

They stated

1. they are PCI compliant
2. they need this data to ensure security as we have a new system
3. this data is stored securely

The last one worried me as stating the data is stored securely seemed to me to indicate they were retaining it As they could not specifically answer to why it was required again and that it would not be stored I then considered reporting them.

So I found this and this on reporting but I don't fully understand - should I be asking my bank or should I be asking their processor to check , if it is their processor how do I find this?

Updates

• I have contacted my bank - Commonwealth Bank , they said "If you feel your details are not safe you may cancel your card" So no help there I believe they are the wrong people though it is the Processor for Linkt not my card issuer. The Agent also stated PCI compliance is not a law some companies required the CVV to complete payments as a one off on ongoing debit"
• I did find a statement "PCI compliance is an industry mandate and those without it can be fined for violating agreements and negligence." The commonwealth bank agent disagreed with this
• I lodged a complaint to Linkt saying storing of CVV details is not PCI compliant and they need to delete any stored CVVs

I beleive this is a , non-legal summary of the legalities of this: PCI-DSS compliance is not a law and is probably not referenced by any legislation. It may be a requirement of the contract with the payment provider. The only answer I got to the question was from my credit card issuer , the Commenwealth bank in Australa, where they stated that PCI-DSS is not required and as long as the company stores the data securely there is no need to worry.

Answer 1

PCI-DSS is not a law. It's a requirement by the card company industry. So the Agent is correct on that point.

I googled "PCI DSS when is it ok to store CVV" and this was the top hit:

Some service providers offer a concierge-style service, where cardholder details are retained by the provider to facilitate potential future transactions. Retention of card verification codes/values for this purpose is also prohibited under PCI DSS Requirement 3.2.

So the payment processor can't retain the CVV. What they should do instead is to get an authorisation token from the card company to perform subsequent transactions made with the stored card.

I also googled "how to report a pci dss violation" and got this as the top hit. (report them to their card processing provider - ask them who they use ...)