Is there a way for a consumer to report PCI non compliance?
-
2Not that this will help, but PCI does require you to handle security reports... But of course, if they're not compliant, they probably dont have that either...– AviD ♦Commented Apr 20, 2011 at 19:26
-
@Avid: and what about the companies which show off that they are following PCI-DSS standard? How can a consumer report in that case for non-complaince?– p_upadhyayCommented Apr 21, 2011 at 8:33
-
1It might be useful for you to describe (with an appropriate level of anonymity) what they're doing that you find non-compliant. It impacts how realistic it is you'll be able to get anyone to act. HTTP instead of HTTPS, sure. Not having assurances from their service providers on file, less so.– gowenfawrCommented Aug 22, 2014 at 4:20
-
For VISA cards, you can apparently report issues (in general, not just PCI violations) here: usa.visa.com/Forms/visa-rules.html– Dennis HackethalCommented Oct 18, 2023 at 20:34
Add a comment
|
2 Answers
The PCI organization sets the standards. The card brands enforce those standards with fines. If you contact a brand (Visa, American Express, etc)., they may act on it. I am not aware of any PCI compliance hotline, and it may involve a lot of transfers and "call this person" redirects to find somebody... who may do nothing anyway. If you have the time, though, I encourage you to work on finding your way through that process.
answered Apr 20, 2011 at 14:41
If you are dealing with a normal merchant, one of the few ways would be to notify their processor, at which point they COULD be charged penalty non compliance fees, but it would depend on a large amount of variables. If you have a CCN stolen and traced back to that location, you can report that to your bank, and to the credit card company that issued your card, which will typically trigger a PCI forensic audit.
If they are a medical entity (any entity that handles protected health information) you can typically submit a complaint under HHS website for a HIPAA violation under section 164.308. If they are not handling correctly credit card information correctly, there's a solid chance that they haven’t taken care of the following sections of their compliance:
164.308(a)(1)(ii)(A) Risk analysis (R) 164.308(a)(1)(ii)(B) Risk management process (R)
164.308 is regarding administrative safeguards. If there's credible evidence that PHI, (which includes Credit Card Numbers) has been compromised, or incorrectly handled, there would typically be a HIPAA audit which would also cover credit card requirements.
Be aware that there are typically tens thousands of dollars in fines if they are caught without the requirements necessary which can sometimes put a business under. Something to keep in mind before filing any complaints.
