All Questions
Tagged with credit-card pci-dss
113 questions
1
vote
4
answers
645
views
Collecting banking, credit-card statements from users
I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
CommunityBot
- 1
1
vote
1
answer
82
views
Does PCI/DSS allow storing the cardholder's name a person entered (and not the real one)
I have an app where a person enters their card number, the cardholder's name, the expiration date and the cvv. I am now making it pci/dss-compliant. I will store the card number in an encrypted way. ...
- 2,260
4
votes
2
answers
1k
views
Are client-side-only apps regulated by PCI?
Consider a client-side-only application. It may allow a user to make a payment by redirecting them to a payment gateway website, where they enter the credit card details. If I understand correctly, in ...
- 141
6
votes
2
answers
3k
views
Do It Yourself Credit Card Storage (PCI - DSS Compliant)
I'm a software developer, considering writing a custom system for credit card number storage. Our intent is to be fully Payment Card Industry (PCI) compliant. I'm working with a small business owner ...
- 34.7k
13
votes
2
answers
4k
views
Validating and storing credit card data for retrieval later
I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
- 1,050
2
votes
3
answers
867
views
How do companies like Uber and Paypal store card details? Is it possible to offer PCI compliance whilst saving credit card details locally?
I know there's a question that's been already asked but it's a decade old so wanted to get an up to date answer...
It's mentioned quite often that the CVV number should never be stored, but this must ...
- 132k
1
vote
4
answers
1k
views
I have recovered my credit card PAN (6 chars masked) and expiration date on a merchant site, acceptable or not?
I have a credit card saved in X merchant. I only see the last 4 digits in the UI.
I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed ...
- 9,361
0
votes
2
answers
208
views
PCI : scope debate : API consumers
The Problem
I have two systems.
System A - E-commerce application that handles (does not store cc) customer credit data during purchase.
System B - Invoicing system for these transactions (does store ...
- 1,050
1
vote
1
answer
3k
views
Are virtual credit cards in scope for PCI Compliance?
My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of ...
- 2,180
4
votes
1
answer
1k
views
Storing customer credit card information for manual processing later
For a solution that we are developing for the hospitality industry, we need to save customer credit card information, and show this to the hotel for them to manually process the payment later.
I have ...
- 1
18
votes
3
answers
29k
views
Is storing CVV compliant with PCI standards?
From personal, job-related experience I know that many "Booking Engines" store the CVV info for customers' credit cards from the time a reservation is made until the time the guest leaves the hotel. ...
- 1
2
votes
2
answers
490
views
Storing credit card information - encrypted at rest
A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients.
I told him that I can build a asymmetrical (...
- 1,050
1
vote
2
answers
358
views
Call center recording my credit card info
I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full ...
- 5,418
0
votes
1
answer
149
views
PCI DSS: Is there a way to pass encrypted billing data through a server without compliance?
Hope all is well.
I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their ...
- 81
0
votes
1
answer
129
views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
- 73.3k
1
vote
1
answer
169
views
Cardholder info transmission between issuing and acquiring banks
Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction?
Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
- 1,050
3
votes
3
answers
2k
views
Can a card issuing company store CVV number, expiry date and 16 digits card number?
I have a limited amount plastic card issued by a certain company. When I log into my online account of the same company, I can see complete details - 16 digits card number, name, expiry date and CVV ...
- 101
-1
votes
2
answers
659
views
Does PCI Apply to PAN only?
I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No ...
- 132k
0
votes
2
answers
1k
views
PCI CVV requirement - encrypt prior to authorisation?
Technically, according to PCI SSC you can hold onto CVV and other sensitive authentication data until authorisation has occurred. In other words the restriction on storing sensitive authentication ...
- 101
1
vote
1
answer
167
views
Business located in USA does it need to be PCI and SCA compliant?
The business is located in the US. But:
Has European customers who put a transaction via a custom-built
shopping cart Sells via tradeshow in Europe or Asia in person Could
Customers send credit cards ...
- 31.6k
3
votes
3
answers
5k
views
Why does Amazon ask for the CVC/CVV if it bills without it?
I have a follow-up question relating to this question:
How does Amazon bill me without the CVC / CVV / CVV2?
If amazon.com can bill without the CVV why does it ask for it the first time information ...
- 946
4
votes
2
answers
2k
views
PCI DSS - mask PAN and log individual access to PAN
How do you re-conciliate two PCI DSS requirements in applications:
3.3 Mask PAN when displayed (the first six and last four digits are the maximum
number of digits to be displayed), such that only ...
- 1
0
votes
2
answers
166
views
Telling donors we will no longer accept card information in writing [closed]
What is positive wording for telling donors we no longer accept card information in writing, for their security?
- 132k
0
votes
1
answer
367
views
How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?
Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
- 73.3k
7
votes
5
answers
1k
views
Can I show Credit Card Data to final customers and be PCI Compliant?
I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
7
votes
4
answers
2k
views
How to not store the card during 3D Secure authentication, to be PCI DSS compliant?
I'm implementing a payment solution where the cardholder enters his card details on our own website.
We need to use 3D Secure for extra authentication of the cardholder.
Our payment gateway ...
2
votes
1
answer
228
views
Using browser XMLHttpRequest to initiate credit card transaction with processor?
I have a website where people can make purchases.
The entire website is served with https.
On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
- 123
3
votes
1
answer
1k
views
When credit card tokens are leaked / stolen, what can the attacker do with them? [closed]
I'm implementing an online payment system relying on an external payment processor handling all credit card entry. My payment processor supports recurring payments via "credit card tokens". We only ...
- 383
6
votes
3
answers
5k
views
Creditcard store first six digits PCI reference
I need to store masked PAN with first six digits and last four digits along with the card expiry month and year. Is it safe to do it according to the PCI rules?
Regarding four digits has been ...
- 103
0
votes
1
answer
240
views
Displaying complete credit card information to end user
I am using an ecommerce website that accepts and stores CC information. In the webpage, they show only the last 4 digits (which is perfectly fine). But when I intercept the request/response, I could ...
- 73.3k
0
votes
1
answer
276
views
PCI-DSS scope: Using P2PE Compliant devices
We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
- 3,169
1
vote
1
answer
248
views
PCI compliance dilemma
I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate.
We outsource the payment management and card storage to a ...
- 1,495
0
votes
1
answer
418
views
Is PCI - DSS required to store only card number
We need to save the credit card number in our database , but not the cvv.
Should we be PCI - DSS compliant for this or some security measures is enough.
After the save we will use that to call stripe ...
- 1,050
2
votes
2
answers
572
views
Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?
I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
- 1,224
1
vote
2
answers
1k
views
Audio Recording of my Credit Card Info?
If I call into a call center to order a product or service, and they take my credit card - do I have any assurance they are not recording the phone call "for quality purposes" which includes my credit ...
- 73.3k
0
votes
1
answer
635
views
PCI Compliance and Card Data Transmit
I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be
displayed/stored.
I am trying to find what is required in regards to ...
CommunityBot
- 1
0
votes
1
answer
134
views
Question about saving credit card info on PW reset [PCI]
I work for a retail organization with a large ecommerce presence. We allow our customers to store CC information for easy check-out, like many retailers.
Currently we remove all stored CC ...
- 73.3k
2
votes
1
answer
382
views
PCI DSS compliant method to receive card data for a merchant with no electronic storage
The merchant in question has no electronic cardholder data storage.
Currently they receive CHD (no CVV) in non-secure ways and store it on paper in order to execute payments via card-not-present POS ...
CommunityBot
- 1
1
vote
1
answer
1k
views
PCI compliance for bank card system
There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer.
The bank can ...
- 34.7k
4
votes
2
answers
2k
views
PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?
Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN?
I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
- 3,496
0
votes
1
answer
1k
views
Is it safe to use an auto pay feature on my smart watch that stores card info?
(So guess what I got for Christmas...)
While I do appreciate the tech and some of the features in the smart watch, I am skeptical of it's biggest feature -- the Pay feature which essentially ...
- 3,197
2
votes
3
answers
715
views
PCI - store card details offline
I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts.
We have been asked a few times by various customers if we ...
- 327
0
votes
2
answers
217
views
Would one e breaking PCI compliance in this scenario?
First and foremost - I am not planning on going down the road of trying to adhere to PCI compliance myself, It's simply not worth the headache. I am however interested in how some companies manage to ...
2
votes
2
answers
789
views
Sending credit-card numbers through SFTP?
I need to send credit-card numbers and other information through SFTP. What considerations should I have? Recommendations? Is valid encrypt this numbers? What does PCI say about this?
CommunityBot
- 1
1
vote
1
answer
536
views
Required security for storing bank transactions, but not credentials
If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
- 1,050
0
votes
2
answers
222
views
Is it normal for a merchant to claim an online transaction is card-present?
I recently made a purchase from a merchant (the city of Los Angeles). During the checkout process on their web site I had to enter my credit card information. One of the fields in the credit card form ...
- 73.3k
2
votes
1
answer
536
views
Credit card store first four and last four which PCI SAQ?
In our application, we only transfer cardholder data to a PCI DSS compliant service provider, and don't store it ourselves. We only store first four and last four digits of credit card number for ...
- 1,495
0
votes
1
answer
4k
views
Does credit card tokenization have an expire date?
I am reading the tokenization product security guidelines of PCI-DSS but I do not see the time of expiration of the token. Does it have it?
- 3,300
2
votes
2
answers
1k
views
Bank issued new credit card as a 'safety measure' but 16 digit acount number is the same
I received a new card in the mail recently. My existing card wasn't due to expire until almost two years from now. The letter that accompanied the card makes it quite clear that the card was replaced ...
- 2,656
1
vote
2
answers
629
views
Credit Card details shown in full after payment on online store
A large and reputable online store shows the credit card details of the customer in full on the order confirmation and receipt page (after payment has been processed).
This is the first time I have ...
- 1,050