4 ms·

I don't think PCI compliance is a factor here (unfortunately) - they literally only deal with the taking of cards, I would think Banks should be looking at this

by voycey 10y ago

I don't think PCI compliance is a factor here (unfortunately) - they literally only deal with the taking of cards, I would think Banks should be looking at this pretty skeptically! Although here in Australia there seems to be a lot more "access" available to your bank account than in many other countries (including my native UK), it makes things like integrations nicer but I do wonder just when it's all going to come crashing down!

voycey 10y ago
"Usernames and passwords to electronic accounts holding payment data are not sufficiently protected" I correct myself - maybe it does!
- windowsworkstoo 10y ago
  That is more referring to the user/pass you might use to login retrieve card details say from a card vault for manual processing. Indeed PCI 3.1 (and actually from v2) has a strong requirement for MFA when connecting to the cardholder data environment network. I've lived PCI for a while - I don't think this particular issue would fall under their purview. As per PCI-DSS doc, it is primarily concerned with the secure "acceptance, transmission and storage" of cardholder data. If they use a 3rd party payment processor for their credit/debit card transactions, they will only have a very limited PCI scope (probably just SAQ-A) which will basically say "oh, make sure you send it to your processor over TLS" and don't peek. This particular instance is probably one for the regulatory body, which in our case in Aus would likely be APRA.
joatmon-snoo 10y ago
According to the PCI-DSS website, "[i]t is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council." [1] No idea what the state of actual legally-enforceable penalties is. In the meantime I've tweeted @AmericanExpress about this. [1] https://www.pcicomplianceguide.org/pci-faqs-2/#1 https://www.pcicomplianceguide.org/pci-faqs-2/#1
- andrewguenther 10y ago
  Would you mind linking the tweet? I'm curious to see if they respond.
- abrookewood 10y ago
  I wouldn't think there are any legally enforceable penalties except maybe through contract law. PCI-DSS is not law, it's an agreement between companies.
- brazzledazzle 10y ago
  I think legally-enforceable penalties in a regulatory sense vary depending on where you and your customer are. But the contracts between you and your credit processing merchants are civilly enforceable and in my experience they don't mess around. They will fine you and raise your transaction costs when out of compliance and will ultimately cut you off if necessary. They also know their competitors will do the same thing because they bear the brunt of the costs incurred by fraud.

by voycey 10y ago

voycey 10y ago

"Usernames and passwords to electronic accounts holding payment data are not sufficiently protected" I correct myself - maybe it does!

windowsworkstoo 10y ago
That is more referring to the user/pass you might use to login retrieve card details say from a card vault for manual processing. Indeed PCI 3.1 (and actually from v2) has a strong requirement for MFA when connecting to the cardholder data environment network. I've lived PCI for a while - I don't think this particular issue would fall under their purview. As per PCI-DSS doc, it is primarily concerned with the secure "acceptance, transmission and storage" of cardholder data. If they use a 3rd party payment processor for their credit/debit card transactions, they will only have a very limited PCI scope (probably just SAQ-A) which will basically say "oh, make sure you send it to your processor over TLS" and don't peek. This particular instance is probably one for the regulatory body, which in our case in Aus would likely be APRA.

joatmon-snoo 10y ago

According to the PCI-DSS website, "[i]t is important to note that the payment brands and acquirers are responsible for enforcing compliance, not the PCI council." [1] No idea what the state of actual legally-enforceable penalties is. In the meantime I've tweeted @AmericanExpress about this. [1] https://www.pcicomplianceguide.org/pci-faqs-2/#1 https://www.pcicomplianceguide.org/pci-faqs-2/#1

andrewguenther 10y ago
Would you mind linking the tweet? I'm curious to see if they respond.
abrookewood 10y ago
I wouldn't think there are any legally enforceable penalties except maybe through contract law. PCI-DSS is not law, it's an agreement between companies.
brazzledazzle 10y ago
I think legally-enforceable penalties in a regulatory sense vary depending on where you and your customer are. But the contracts between you and your credit processing merchants are civilly enforceable and in my experience they don't mess around. They will fine you and raise your transaction costs when out of compliance and will ultimately cut you off if necessary. They also know their competitors will do the same thing because they bear the brunt of the costs incurred by fraud.