I have an app where users can enter credit card data and it is stored using a 3rd party toservice like BluePay or Authorize.net, I do not and will not save it in my system. Trying to get this point across to potential new customers is sometimes hard to do.

I want to tell them that it is actually illegal to collect and then share credit card information, but is this actually a true statement?

  • As far as i know storing credit card information requires to comply with the PCI standard. I'm pretty sure that after reading the requirements, your customer will reconsider implementing this feature. – martinstoeckli Jun 12 '14 at 14:35

I wouldn't take that approach, because it is an inaccurate statement: it's not a 'legal' issue per se, it's a Payment Card regulations issue. I would simply say that credit card information falls under PCI DSS regulations which prevents companies from storing the card information at all unless they use a compliant system. To comply with regulations with storing and transmitting payment card data to 3rd parties can require a major investments in infrastructure.

| improve this answer | |
  • They use a previous system that sent them credit card information in plain text in tab delimited text files, pretty damn scary how many people do this. Trying to build my case against it. Since they haven't been burned yet they do not want to complicate the business process they have in place and simply want to get the card numbers into their ERP system. – Slee Jun 12 '14 at 14:20
  • Oh THAT'S the problem. Then your approach is simpler: PCI regulations control how data is stored and communicated. Failure to comply can result in massive fines and potentially having their ability to accept payment by credit card revoked. End of story. It's NOT a 'legality' thing. It's a regulatory thing. – schroeder Jun 12 '14 at 14:36
  • Failure to comply does not generate "massive fines" it just opens up a way for the card companies to make you pay for all fraud occured with cards which are determined to have been leaked by you. IIRC the only way you will end up getting fined is when you actually violate a law. An investigation may uncover other actions which are illegal or non-compliant with the financial market regulations and these may lead to a fine. Card companies themselves are not legal entities and cannot give you a fine which you HAVE to pay. – Lucas Kauffman Jun 12 '14 at 21:22
  • According to this, there are fines that accrue monthly due to 'trickle-down' liability: pcicomplianceguide.org/pci-faqs-2/#11 . Card company fines the banks, the banks fine you. It's not a legal fine. – schroeder Jun 12 '14 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.