PCI DSS

What it means

PCI DSS, the Payment Card Industry Data Security Standard, is a security standard created by the major card schemes. It applies to anyone who accepts, transmits, processes or stores payment card data: the card number, expiry date, cardholder name and above all the security code. It is not a law but a contractual obligation towards the bank that provides card acceptance to the merchant.

The standard sets requirements in areas such as a secure network, protection of stored data, encryption in transit, vulnerability management, access control, monitoring and regular testing, including penetration tests. The scope of obligations depends on transaction volume and on how the merchant comes into contact with card data.

Compliance is demonstrated either by an audit by a qualified assessor or, for smaller merchants, by a self-assessment questionnaire known as the SAQ. There are several types of questionnaire, from a very short one for merchants who never see card data to an extensive one for those processing it on their own servers.

How it works in practice

For a small online store the simplest route is to leave the entire payment to a certified payment gateway. The customer enters card details on the gateway's page or in its secure frame, and the shop receives only the payment result. Card data never passes through the merchant's server, and its obligations shrink to a short questionnaire and basic website security.

Even with this set-up, the page that redirects to the gateway must be protected. Attackers target online stores by injecting a malicious script that sends the customer to a fake payment page. System updates, strong admin passwords, limiting plugins and monitoring changes to the site's code are therefore important.

PCI DSS is complemented by other mechanisms: 3D Secure and strong customer authentication verify that the payment is made by the legitimate cardholder and reduce the risk of disputed payments. For payment terminals in a physical shop the provider is responsible for certifying the device, but the merchant must make sure no one tampers with it.

What to watch out for

Never store card data in emails, spreadsheets or notes, not even briefly, for example with telephone orders. The CVV security code must never be stored at all. A breach can lead to fines from the bank, loss of the ability to accept cards and liability for losses from fraudulent transactions.

The standard evolves, and version 4 brought new requirements such as protecting payment pages against injected code. A merchant should update its questionnaire every year and check whether its set-up has changed. Switching payment gateway or online store template can also change the scope of obligations.