Since credit card transactions like cash advance can be performed at most ATMs, are banks required to be PCI DSS compliant?


The Payment Card Industry DSS rules also apply to banks. I was at a large UK bank that had to change it's customer database to make the card information more secure from staff as part of a PCIDSS initiative. This included obscuring part of the PAN (the long number) from operators in the call centres etc.

It should be noted however, that in certain jurisdictions (i.e. the UK) there are a lot of other regulators that have much more effective security controls that are placed on banks and so whilst PCI DSS is applied to the cardholder data usage, it is not the be all and end all.

  • 1
    Are the controls you mention standardized or at the whim of individual bank? – Drew Lex Jan 30 '13 at 14:06
  • It's a mixture. There are legal, contractual, regulatory and ethical standards to apply. Clearly the bank owns it's own appetite to risk and therefore can have it's own take on these standards. There is a balance between cost, security and functionality that each bank has to make a decision on before investing in an effective control framework. In my experience, it's rare for a bank not to take security standards seriously. – Callum Wilson Jan 30 '13 at 14:10
  • Yep-having worked with almost all the major banks represented in the UK, I can state they take it more seriously than almost all other industries. – Rory Alsop Jan 30 '13 at 14:37
  • 1
    @RoryAlsop - I can't say the same about US banks. There idea about required 2-factor authentication is a complete and total joke. A secret question ( asked when you log into a unknown electronic device ) while a second authentication is not what should be implemented. – Ramhound Jan 30 '13 at 16:07
  • That is... scary, to be honest. – Rory Alsop Jan 30 '13 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.