When Undercover Credit Card Buys Go Bad

Re:When Undercover Credit Card Buys Go Bad by dibujante on Tuesday December 08, 2015 @11:56AM (#10697604)

This would be a PCI violation, so if it's common, then someone has some calls to make.

I'm a stickler about enforcing data retention (and non-retention) standards where I work. We never store any credit card information. That would be an outrageous liability.

[ Parent | on HN ]

Re:When Undercover Credit Card Buys Go Bad by phonon on Tuesday December 08, 2015 @04:03PM (#10699498)

Storing the PAN is not a "PCI violation". It's not best practice, for sure, and you then have an obligation to secure your systems much more thoroughly, but you can do it. "Payment brand rules allow for the storage of primary account number (PAN), expiration date, cardholder name, and service code." https://www.pcisecuritystandards.org/documents/SAQ_InstrGuid...

(There are other types of data you can NEVER store (also described in the above document) like the CVV or PIN code, which is perhaps what you meant.)

[ Parent | on HN ]

Re:When Undercover Credit Card Buys Go Bad by dibujante on Tuesday December 08, 2015 @04:25PM (#10699648)

The person I was responding to just said "credit card information". CVV, PIN, and CC # are all verboten.

[ Parent | on HN ]

Re:When Undercover Credit Card Buys Go Bad by phonon on Wednesday December 09, 2015 @01:29PM (#10705680)

Sorry, you are wrong about the CC# (PAN) Read what I linked to again.

[ Parent | on HN ]

Re:When Undercover Credit Card Buys Go Bad by dibujante on Monday December 14, 2015 @12:09AM (#10729511)

Oops, you're right.

[ Parent | on HN ]