PCI DSS Compliance

Posted by hockey_guy on Sunday December 15, 2024 @10:39PM
from the self-post dept.

I'm building an iOS app. I want to store a users' name and the last 4 digits of their CC number. I'll use those to match transactions I read from another API which also provides name and the last 4 cc digits.

If I'm just storing name + last 4 cc digits, do I have to comply by PCI DSS?

This thread sounds promising: https://stackoverflow.com/questions/44630367/is-last-4-digits-of-credit-card-and-expiry-date-storage-allowed-in-pci-dss but not sure how accurate or dated the info is.

( 4 comments | on HN )

Re:PCI DSS Compliance by randompeach on Monday December 16, 2024 @01:11AM (#42428391)

As of my knowledge: no.

[ Parent | on HN ]

Re:PCI DSS Compliance by fragmede on Monday December 16, 2024 @02:10AM (#42428706)

The "other API" likely provides a better unique identifier for users or charges. Name + last 4 is mostly unique, but what are you going to do if a user changes credit card number because it was stolen so the old one doesn't work? Can't renew or refund them.

[ Parent | on HN ]

Re:PCI DSS Compliance by hockey_guy on Monday December 16, 2024 @11:13PM (#42438263)

Various POS API. ex: Square, Toast, and Clover. They briefly mention tokenizing CC numbers but nothing publicly available afaik.

[ Parent | on HN ]

Re:PCI DSS Compliance by fragmede on Monday December 16, 2024 @11:29PM (#42438345)

I'd hate to have to support all three of that at launch so I'll just like to Clover's. Clover's tokenization docs are https://docs.clover.com/dev/docs/create-a-card-token but you don't want to touch the cc number/PAN so as to avoid PCI, so the flow I imagine is you charge the customers card on the POS device, then use their API to retrieve the charge https://docs.clover.com/dev/reference/getorders which includes the charge and customer id, and store that.

[ Parent | on HN ]