Is there a way for a consumer to report PCI non compliance?

  • 2
    Not that this will help, but PCI does require you to handle security reports... But of course, if they're not compliant, they probably dont have that either... – AviD Apr 20 '11 at 19:26
  • @Avid: and what about the companies which show off that they are following PCI-DSS standard? How can a consumer report in that case for non-complaince? – p_upadhyay Apr 21 '11 at 8:33
  • 1
    It might be useful for you to describe (with an appropriate level of anonymity) what they're doing that you find non-compliant. It impacts how realistic it is you'll be able to get anyone to act. HTTP instead of HTTPS, sure. Not having assurances from their service providers on file, less so. – gowenfawr Aug 22 '14 at 4:20

The PCI organization sets the standards. The card brands enforce those standards with fines. If you contact a brand (Visa, American Express, etc)., they may act on it. I am not aware of any PCI compliance hotline, and it may involve a lot of transfers and "call this person" redirects to find somebody... who may do nothing anyway. If you have the time, though, I encourage you to work on finding your way through that process.


If you are dealing with a normal merchant, one of the few ways would be to notify their processor, at which point they COULD be charged penalty non compliance fees, but it would depend on a large amount of variables. If you have a CCN stolen and traced back to that location, you can report that to your bank, and to the credit card company that issued your card, which will typically trigger a PCI forensic audit.

If they are a medical entity (any entity that handles protected health information) you can typically submit a complaint under HHS website for a HIPAA violation under section 164.308. If they are not handling correctly credit card information correctly, there's a solid chance that they haven’t taken care of the following sections of their compliance:

164.308(a)(1)(ii)(A) Risk analysis (R) 164.308(a)(1)(ii)(B) Risk management process (R)

164.308 is regarding administrative safeguards. If there's credible evidence that PHI, (which includes Credit Card Numbers) has been compromised, or incorrectly handled, there would typically be a HIPAA audit which would also cover credit card requirements.

Be aware that there are typically tens thousands of dollars in fines if they are caught without the requirements necessary which can sometimes put a business under. Something to keep in mind before filing any complaints.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.