I have done some I.T. contracting for a medium-sized Australian hotel recently. I am concerned about their credit card handling practices.
- Customers often email their CC number and expiry date in plaintext to the company.
- Customers also send CC details via a web form over unsecured HTTP from the company website. An ambiguous statement on the contact form could be construed as solicitation of the CC details.
- CC details are stored on two mail servers, managed by the company's ISP.
- All emails containing CC details are also stored on two up-to-date Windows 7 machines on premises, via Outlook 2007's Cached Exchange Mode. So even when computers are formatted or replaced, the CC numbers will end up back on the computers. Emails are never deleted.
- Deposits and all subsequent charges are made by a human operator from an EFTPOS machine on premises.
- There is an internet lounge on premises and it shares an internet connection with computers storing the CC details in Outlook. The staff computers may be on a different subnet to the lounge (haven't checked yet).
- I have not searched the email archive. However, it seems plausible to me that some customers may have supplied CVVs over email.
I found all of this disturbing, but I didn't know exactly how to make my point to management. So I've been doing some research.
- Email is not a secure channel for CC details [P].
- Mere acceptance of CC details via email places the business under PCI-DSS requirements [Q] and meeting those requirement may be a substantial task [R].
- Accepting and storing plaintext emails containing CC numbers violates the PCI-DSS [S].
- The above practice is risky, but common among hotels and probably many low tech businesses [T].
- Consequences can be severe [K] but enforcement probably won't occur unless the business is penetrated and their information is used for CC fraud [O].
I would appreciate any help to check my inferences for bugs. I'm also still unsure about two things.
- Who enforces the PCI-DSS, in particular the fines mentioned in [K]? E.g. banks, or do government agencies get involved?
- Does this vary much internationally? Might some info in the posts above not apply to Australia?
I'm also trying to think of a solution that won't collide too much with the current workflow (i.e. that won't cost a fortune). However, fixing this seems like a big task any way I look at it. Any perspectives on how to improve this situation would be much appreciated.