3 ms·

How can this possibly be within PCI DSS compliance rules ? - do they not apply to everyone taking Mastercard/visa ?

by ig1 17y ago

tbgvi 17y ago
It isn't. Storing CVV is not allowed under any circumstances.
leftnode 17y ago
No, PCI/DSS is similar to the Better Business Bureau: many people think its an official (i.e., government mandated agency/law) but it's not. Many merchant account companies require it, but it's entirely possible to find a merchant account that does not require you to be PCI/DSS compliant. Some people say PCI/DSS compliance is a scam, because you generally have to pay someone to say you're PCI/DSS compliant, officially, if I remember correctly.
- tbgvi 17y ago
  It all depends on your transaction volume. If you don't run that many transactions then all you have to do is fill out a form saying you're complying. If your transaction volume is high, for example let's say Walmart, then the level of scrutiny goes way up. There is the option of not complying with PCI, but Visa and MasterCard wouldn't authorize transactions for them anymore. In a case like that there's a pretty big monetary incentive to comply. PCI isn't perfect, that's for sure, but its probably better than nothing.
  - leftnode 17y ago
    Definitely. I also believe you get a discount per transaction if you're compliant. We had to become compliant for the merchant we use, and because we don't do a lot of transactions, it was only $80 a year. Small price to pay, I think, to keep my ass covered somewhat. I suppose I came off as not liking PCI/DSS. I do like it, just wanted to clarify some things about it.
wallflower 17y ago
This is why I never use ATM debit cards outside of an ATM (e.g. for groceries) I've read reports of software along the path of the transaction caching PINs. Throw this unauthorized caching concern into the murky waters of bank liability for fradulent transactions, and I would go to an ATM (ideally one that has anti-skimming provisions) and withdraw cash before trying to pay with ATM at the POS terminal.

How can this possibly be within PCI DSS compliance rules ? - do they not apply to everyone taking Mastercard/visa ?

by ig1 17y ago

How can this possibly be within PCI DSS compliance rules ? - do they not apply to everyone taking Mastercard/visa ?

tbgvi 17y ago

It isn't. Storing CVV is not allowed under any circumstances.

leftnode 17y ago

No, PCI/DSS is similar to the Better Business Bureau: many people think its an official (i.e., government mandated agency/law) but it's not. Many merchant account companies require it, but it's entirely possible to find a merchant account that does not require you to be PCI/DSS compliant. Some people say PCI/DSS compliance is a scam, because you generally have to pay someone to say you're PCI/DSS compliant, officially, if I remember correctly.

tbgvi 17y ago
It all depends on your transaction volume. If you don't run that many transactions then all you have to do is fill out a form saying you're complying. If your transaction volume is high, for example let's say Walmart, then the level of scrutiny goes way up. There is the option of not complying with PCI, but Visa and MasterCard wouldn't authorize transactions for them anymore. In a case like that there's a pretty big monetary incentive to comply. PCI isn't perfect, that's for sure, but its probably better than nothing.
- leftnode 17y ago
  Definitely. I also believe you get a discount per transaction if you're compliant. We had to become compliant for the merchant we use, and because we don't do a lot of transactions, it was only $80 a year. Small price to pay, I think, to keep my ass covered somewhat. I suppose I came off as not liking PCI/DSS. I do like it, just wanted to clarify some things about it.

wallflower 17y ago

This is why I never use ATM debit cards outside of an ATM (e.g. for groceries) I've read reports of software along the path of the transaction caching PINs. Throw this unauthorized caching concern into the murky waters of bank liability for fradulent transactions, and I would go to an ATM (ideally one that has anti-skimming provisions) and withdraw cash before trying to pay with ATM at the POS terminal.