What happens if a merchant is not PCI compliant?
If your business doesn’t meet the PCI standards for compliance and the security of cardholder data is compromised, you are liable – and could end up paying thousands of dollars in fines. Some of the additional liabilities and fines include: All fraud losses incurred from the use of compromised account numbers.
How does a merchant become PCI compliant?
Merchants who are Level 1 must be validated by a qualified Quality Security Assessor (QSA). Compliance requires establishing and maintaining a PCI program. This should incorporate appropriate business policies, procedures and technologies to ensure ongoing compliance through continuous protection of payment card data.
How do I know if a merchant is PCI compliant?
There is only one way for a consumer to tell if a website is PCI compliant. If the website accepts credit card payments, it is compliant. If the site sells merchandise and does not accept payment, it is not compliant.
Who is required to comply with PCI DSS?
If you accept or process payment cards, PCI DSS applies to you. Who has to comply with the PCI Standards? Each of PCI SSC’s founding payment brand members (American Express, Discover, JCB International, MasterCard and Visa) currently have their own PCI compliance programs for the protection of their affiliated payment card account data.
How does cardholder data impact PCI DSS scope?
The merchant environment is still in scope for PCI DSS due to the presence of cardholder data. For example, in a card-present environment, merchants have physical access to the payment cards in order to complete a transaction and may also have paper reports or receipts with cardholder data.
What makes a payment card compliant with PCI?
If these conditions are met, then the payment card transaction environment is compliant. The requirements set forth by the PCI SSC are both operational and technical, and the core focus of these rules is to protect cardholder data at all times.
What are the PCI requirements for cardholder data?
If cardholder data is to be stored, PCI compliance requirements state the cardholder data must be rendered unreadable using industry standard techniques. Validating entities are permitted to store data classified as Cardholder Data (CHD).