All Questions
Tagged with credit-card pci-dss
113 questions
1
vote
1
answer
82
views
Does PCI/DSS allow storing the cardholder's name a person entered (and not the real one)
I have an app where a person enters their card number, the cardholder's name, the expiration date and the cvv. I am now making it pci/dss-compliant. I will store the card number in an encrypted way. ...
- 113
13
votes
2
answers
4k
views
Validating and storing credit card data for retrieval later
I need to validate and store credit card information (name, card number, expiration date, CVC) for retrieval at a later date. Once retrieved, the data will be used for manual processing on a separate ...
- 231
2
votes
3
answers
867
views
How do companies like Uber and Paypal store card details? Is it possible to offer PCI compliance whilst saving credit card details locally?
I know there's a question that's been already asked but it's a decade old so wanted to get an up to date answer...
It's mentioned quite often that the CVV number should never be stored, but this must ...
- 123
0
votes
2
answers
208
views
PCI : scope debate : API consumers
The Problem
I have two systems.
System A - E-commerce application that handles (does not store cc) customer credit data during purchase.
System B - Invoicing system for these transactions (does store ...
- 103
1
vote
1
answer
3k
views
Are virtual credit cards in scope for PCI Compliance?
My company is using virtual credit cards and since we are PCI compliant (and want to be in the future) I was wondering about the requirements of storing/processing and transmitting PAN numbers of ...
- 339
2
votes
2
answers
490
views
Storing credit card information - encrypted at rest
A client is asking for a way so his app can receive credit card information and store them. He needs this to process scheduled payments from his clients.
I told him that I can build a asymmetrical (...
- 73
1
vote
2
answers
358
views
Call center recording my credit card info
I just made a new contract over the phone with my mobile phone provider and I needed to pay the activation fee. The lady told me that they could accept only credit cards and asked me for the full ...
- 13
0
votes
1
answer
149
views
PCI DSS: Is there a way to pass encrypted billing data through a server without compliance?
Hope all is well.
I am developing a primarily cloud-based tool that allows the end-user to enter in billing data and task data via a desktop application, and the billing data is stored locally (their ...
0
votes
1
answer
129
views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
- 105
1
vote
1
answer
169
views
Cardholder info transmission between issuing and acquiring banks
Which data is actually transmitted between issuing and acquiring banks during various phases of a card payment transaction?
Specifically, does the Issuer tell the Acquirer any info (and which if any?)...
1
vote
1
answer
167
views
Business located in USA does it need to be PCI and SCA compliant?
The business is located in the US. But:
Has European customers who put a transaction via a custom-built
shopping cart Sells via tradeshow in Europe or Asia in person Could
Customers send credit cards ...
- 113
0
votes
2
answers
166
views
Telling donors we will no longer accept card information in writing [closed]
What is positive wording for telling donors we no longer accept card information in writing, for their security?
0
votes
1
answer
367
views
How to communicate Credit Card details to customers when instantly approved in PCI-DSS compliant way?
Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the ...
1
vote
4
answers
645
views
Collecting banking, credit-card statements from users
I want to build a service that collects user spending history with their permission. Users would send over (banking, credit card) account statements and I would extract, store the following ...
- 2,169
2
votes
1
answer
228
views
Using browser XMLHttpRequest to initiate credit card transaction with processor?
I have a website where people can make purchases.
The entire website is served with https.
On the first page, I accept user profile data and generate a random ID for my client and store that in my ...
- 123
-1
votes
2
answers
659
views
Does PCI Apply to PAN only?
I am trying to find out if a credit card application would be in-scope for PCI DSS. As part of the application process, customers can submit their credit card number (PAN) from another institution. No ...
- 1
1
vote
4
answers
1k
views
I have recovered my credit card PAN (6 chars masked) and expiration date on a merchant site, acceptable or not?
I have a credit card saved in X merchant. I only see the last 4 digits in the UI.
I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed ...
- 113
0
votes
1
answer
240
views
Displaying complete credit card information to end user
I am using an ecommerce website that accepts and stores CC information. In the webpage, they show only the last 4 digits (which is perfectly fine). But when I intercept the request/response, I could ...
- 401
0
votes
1
answer
276
views
PCI-DSS scope: Using P2PE Compliant devices
We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, ...
- 71
1
vote
1
answer
248
views
PCI compliance dilemma
I am looking for advice on PCI compliance. I am being told that I am not currently PCI compliant although I am not sure if this is accurate.
We outsource the payment management and card storage to a ...
- 113
0
votes
1
answer
418
views
Is PCI - DSS required to store only card number
We need to save the credit card number in our database , but not the cvv.
Should we be PCI - DSS compliant for this or some security measures is enough.
After the save we will use that to call stripe ...
- 103
2
votes
2
answers
572
views
Is taking CC info in plain HTML elements, but using a library like Stripe to tokenize PCI compliant?
I am building a site which will accept payments. I will be processing payments with either Stripe or Square. Stripe now has Stripe Elements, and Square has Square Payment Form. I have tried Square ...
- 21
3
votes
1
answer
1k
views
When credit card tokens are leaked / stolen, what can the attacker do with them? [closed]
I'm implementing an online payment system relying on an external payment processor handling all credit card entry. My payment processor supports recurring payments via "credit card tokens". We only ...
- 133
1
vote
2
answers
1k
views
Audio Recording of my Credit Card Info?
If I call into a call center to order a product or service, and they take my credit card - do I have any assurance they are not recording the phone call "for quality purposes" which includes my credit ...
0
votes
1
answer
134
views
Question about saving credit card info on PW reset [PCI]
I work for a retail organization with a large ecommerce presence. We allow our customers to store CC information for easy check-out, like many retailers.
Currently we remove all stored CC ...
- 3
0
votes
1
answer
635
views
PCI Compliance and Card Data Transmit
I have read that PCI enforces the merchants to store first six and last four digits are the maximum number of digits that may be
displayed/stored.
I am trying to find what is required in regards to ...
- 45
1
vote
1
answer
1k
views
PCI compliance for bank card system
There is a bank who has internal system working with card data preparation, generating PANs, and finally preparing personalization files that are sent to third party card manufacturer.
The bank can ...
- 1,129
0
votes
1
answer
1k
views
Is it safe to use an auto pay feature on my smart watch that stores card info?
(So guess what I got for Christmas...)
While I do appreciate the tech and some of the features in the smart watch, I am skeptical of it's biggest feature -- the Pay feature which essentially ...
- 1,366
2
votes
3
answers
715
views
PCI - store card details offline
I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts.
We have been asked a few times by various customers if we ...
- 141
2
votes
1
answer
382
views
PCI DSS compliant method to receive card data for a merchant with no electronic storage
The merchant in question has no electronic cardholder data storage.
Currently they receive CHD (no CVV) in non-secure ways and store it on paper in order to execute payments via card-not-present POS ...
- 21
0
votes
2
answers
217
views
Would one e breaking PCI compliance in this scenario?
First and foremost - I am not planning on going down the road of trying to adhere to PCI compliance myself, It's simply not worth the headache. I am however interested in how some companies manage to ...
4
votes
2
answers
2k
views
PIN delivery: do PCI DSS requirements prevent sending the PIN to an end-user's mobile phone?
Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN?
I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm ...
- 173
4
votes
1
answer
1k
views
Storing customer credit card information for manual processing later
For a solution that we are developing for the hospitality industry, we need to save customer credit card information, and show this to the hotel for them to manually process the payment later.
I have ...
- 143
1
vote
1
answer
536
views
Required security for storing bank transactions, but not credentials
If I'm using an external bank data aggregation service to get user credit and banking transactions, but the external service itself is handling the process of collecting and managing banking ...
0
votes
2
answers
222
views
Is it normal for a merchant to claim an online transaction is card-present?
I recently made a purchase from a merchant (the city of Los Angeles). During the checkout process on their web site I had to enter my credit card information. One of the fields in the credit card form ...
- 103
2
votes
1
answer
536
views
Credit card store first four and last four which PCI SAQ?
In our application, we only transfer cardholder data to a PCI DSS compliant service provider, and don't store it ourselves. We only store first four and last four digits of credit card number for ...
- 135
0
votes
1
answer
4k
views
Does credit card tokenization have an expire date?
I am reading the tokenization product security guidelines of PCI-DSS but I do not see the time of expiration of the token. Does it have it?
- 19
2
votes
2
answers
1k
views
Bank issued new credit card as a 'safety measure' but 16 digit acount number is the same
I received a new card in the mail recently. My existing card wasn't due to expire until almost two years from now. The letter that accompanied the card makes it quite clear that the card was replaced ...
- 375
1
vote
2
answers
629
views
Credit Card details shown in full after payment on online store
A large and reputable online store shows the credit card details of the customer in full on the order confirmation and receipt page (after payment has been processed).
This is the first time I have ...
user141100
1
vote
0
answers
224
views
What solutions would you recommend for credit card processing for Virtual Assistants?
I'm developing the entire backend using for an Over-the-phone Virtual Assistant service. Their clients are busy professionals who delegate their online purchasing and booking to this service, which ...
- 11
2
votes
2
answers
789
views
Sending credit-card numbers through SFTP?
I need to send credit-card numbers and other information through SFTP. What considerations should I have? Recommendations? Is valid encrypt this numbers? What does PCI say about this?
- 19
1
vote
1
answer
561
views
Transferring credit card details to hotels without PCI
I'm developing a web application for hotels that send offers to the guest's hotels. I want to store the guest's credit card data in a secure way, through a third party service as I don't want to ...
6
votes
2
answers
3k
views
Do It Yourself Credit Card Storage (PCI - DSS Compliant)
I'm a software developer, considering writing a custom system for credit card number storage. Our intent is to be fully Payment Card Industry (PCI) compliant. I'm working with a small business owner ...
- 235
1
vote
4
answers
219
views
Taking credit card info online recommendations
I have an online store in which customers can purchase a code which enables them to have use of a bot service I run.
Part of the bot needs customers sensitive information to be entered, address, and ...
1
vote
2
answers
1k
views
Is storing CVV in two parts separately a violation of PCI?
I was going through the integration documents of a payment processor, and as per my understanding of the code, docs and disassembly, they are doing the following:
Encrypting the CVV on the server-...
- 13
0
votes
1
answer
120
views
Displaying info of saved Credit Card in an Application Secured?
I've been trying to look for an answer to this question but this isn't clearing me.
Is it safe for an application to display the credit card number and expiry of a saved credit card.
For eg, I ...
- 101
3
votes
1
answer
196
views
Can I store government ID numbers according to the PCI DSS?
I am developing a service, a part of which stores the credit card data of it's users. According to the Israeli credit card companies' requirements my users need to present their government ID number ...
- 307
3
votes
3
answers
2k
views
Can a card issuing company store CVV number, expiry date and 16 digits card number?
I have a limited amount plastic card issued by a certain company. When I log into my online account of the same company, I can see complete details - 16 digits card number, name, expiry date and CVV ...
- 61
2
votes
2
answers
377
views
Receiving encrypted Credit Card number - PCI
We are in situation where our application receives a payment confirmation from a third party service, which includes an encrypted credit card number too. Our application needs to store the response. ...
- 131
2
votes
0
answers
125
views
How can I export my full customers credit card information between 2 different merchant accounts [closed]
I am trying to find out how we can get our existing customers credit card details released from our current merchant account and transferred to our new merchant account. The new bank we are working ...
- 21