1

Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it?

I can't seem to find an official reference that describes this as a PCI DSS requirement. Is it one? If so, where can I find it?

  • 1
    Where have you heard this? As far as I know, PCI DSS doesn't really care about payment processing at this level. To be honest, this is the first time I hear of such thing. – Adi Oct 22 '13 at 13:47
  • 1
    This question appears to be off-topic because it has nothing to do with information security. – Adi Oct 22 '13 at 13:48
  • 1
    You won't find one because it isn't a requirement, just an option, albeit probably the most common option, which may be why you were under the impression it was required. – Xander Oct 22 '13 at 13:59
  • 2
    @Adnan I think PCI DSS is in scope of security.se. Primarly because it stands for Payment Card Industry Data Security Standard and Data Security is in scope of our website. – Lucas Kauffman Oct 22 '13 at 14:35
  • 1
    No, no special meaning that I'm aware of in the context of PCI. They're more accounting driven than anything, and the options could potentially be any scheme you could think up. I'm not aware of any restrictions specific to PCI. Perhaps the next most common option, however, would be capture at sale. – Xander Oct 22 '13 at 14:39
3

PCI DSS doesn't cover such topics as these. What you're looking for are the various card brand operating regulations. From a security/risk management perspective for ecommerce, Visa also has this guide: http://usa.visa.com/download/merchants/e-comm-merch-guide-to-risk-and-security-vol032413.pdf

3

The matters of payment capture and shipping aren't covered or related to PCI DSS.

3

PCI-DSS is a security document concerned with how to properly secure Personal Credit Information. Regulations about capture of payments are unrelated to data security and thus are not covered by PCI-DSS.

You may be thinking of merchant service requirements which are contractual obligations with either your payment processor or your merchant bank, but they are not security related.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.