Is there a PCI-DSS rule that a merchant cannot capture the funds for an order until we have actually shipped it?
I can't seem to find an official reference that describes this as a PCI DSS requirement. Is it one? If so, where can I find it?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
PCI DSS doesn't cover such topics as these. What you're looking for are the various card brand operating regulations. From a security/risk management perspective for ecommerce, Visa also has this guide: http://usa.visa.com/download/merchants/e-comm-merch-guide-to-risk-and-security-vol032413.pdf
The matters of payment capture and shipping aren't covered or related to PCI DSS.
PCI-DSS is a security document concerned with how to properly secure Personal Credit Information. Regulations about capture of payments are unrelated to data security and thus are not covered by PCI-DSS.
You may be thinking of merchant service requirements which are contractual obligations with either your payment processor or your merchant bank, but they are not security related.