Contents
What elements of cardholder data must be protected?
Protection methods such as encryption, truncation, masking, and hashing are critical components of cardholder data protection. If an intruder circumvents other security controls and gains access to encrypted data, without the proper cryptographic keys, the data is unreadable and unusable to that person.
Is it illegal to retain credit card details?
While it is not illegal for businesses to retain credit card information, several watchdog groups and government agencies advise against the practice to avoid customer information being compromised.
What does cardholder data consist of?
Cardholder data includes the primary account number (PAN) along with any of the following data types: cardholder name, expiration date or service code. A service code is a three- or four-digit number on cards that use a magnetic-stripe.
What are the do’s and Don’s of PCI data storage?
AT A GLANCE. PCI DATA STORAGE. PCI Data Storage Do’s and Don’ts. Requirement 3 of the Payment Card Industry’s Data Security Standard (PCI DSS) is to “protect stored cardholder data.” The public assumes merchants and financial institutions will protect data on payment cards to thwart theft and prevent unauthorized use.
Where is the data stored on a payment card?
Some payment cards store data in chips embedded on the front side. The front side usually has the primary account number (PAN), cardholder name and expiration date. The magnetic stripe or chip holds these plus other sensitive data for authentication and authorization.
What’s the maximum number of digits that can be displayed on a card?
The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not apply to those authorized with a specific need to see the full PAN, nor does it supersede stricter requirements in place for displays of cardholder data such as on a point-of-sale receipt.
Which is the best questionnaire to accept payment cards?
There are different questionnaires available to meet different merchant environments. You can easily find the Self-Assessment Questionnaire that best describes how you accept payment cards. If you are not sure which questionnaire applies to you, contact your acquiring bank or payment card brand for assistance.