4 ms·

This is really big; if they were misusing credit card records like that, they risk losing accreditation from their PCI systems. There is probably some criminal

This is really big; if they were misusing credit card records like that, they risk losing accreditation from their PCI systems. There is probably some criminal aspect to violating PCI as well. Does anyone here know more about how PCI works?

tylerflick 9y ago
It's been quite a while since I've been involved with PCI, but it was mostly a compliance system for dealing with fraud risk. I don't remember any legal aspects of it though. There are different levels of PCI, each with requirements for risk mitigation. Edit: Fixed an apostrophe.
dpark 9y ago
I'm not sure this is relevant to PCI. PCI is about the security of credit card information. Do you store it safely, is access restricted, etc. I don't think PCI is concerned with whether you're doing ethically shady stuff with the data so long as it's stored and transferred in compliant ways.
- braveo 9y ago
  If they were using the CC information for nefarious identification I would think that would fall under "is access restricted".
  - dpark 9y ago
    Not really. If someone hands you their credit card and you refuse to sell to them because their card has a Star of David on it, you are doing something nefarious with CC information but not violating PCI. PCI is concerned with reducing fraud cost. Visa does not care if the business charging your card is shady, only that it doesn't result in extra costs to Visa.
    - braveo 9y ago
      I'm sorry, but THAT is about the most ridiculous use of a strawman I've ever seen. Uber was using the CC information to LOOK UP MORE INFORMATION ON THE USER. Comparing that to someone simply refusing service is completely outlandish, uncalled for, and indicates a level of bias that is wholly unhealthy for both sides in this discussion.
      - dpark 9y ago
        It's not a straw man at all. Uber literally denied services based on who issued customers' credit cards (allegedly). That they recognized the bank as a police credit union instead of recognizing the Star of David as a Jewish symbol doesn't meaningfully change the scenario. PCI is not concerned about protecting the user. It's about protecting credit card companies. Visa does not care that Uber uses credit card information for nefarious business purposes. They care that Uber doesn't leak the credit card information they possess.
vuln 9y ago
Just went through a PCI audit at a fortune 150. It's not just you it's your processors too. It was hectic to say the least. Then come insurance renewals.
dublinben 9y ago
The portion of the credit card number they were using is not considered sensitive information under PCI-DSS.
SilasX 9y ago
I thought so too and was corrected on the last thread: https://news.ycombinator.com/item?id=13786035 https://news.ycombinator.com/item?id=13786035 But I still suspect it would run afoul of some privacy laws, to collect someone's credit card number to process payment, while also using it to see if they might be a cop: https://news.ycombinator.com/item?id=14270250 https://news.ycombinator.com/item?id=14270250
kbart 9y ago
PCI (PCI-DSS at least) doesn't say anything about use purposes of credit card data, it's the standard on how to acquire, transfer and store such data safely.

tylerflick 9y ago

It's been quite a while since I've been involved with PCI, but it was mostly a compliance system for dealing with fraud risk. I don't remember any legal aspects of it though. There are different levels of PCI, each with requirements for risk mitigation. Edit: Fixed an apostrophe.

dpark 9y ago

I'm not sure this is relevant to PCI. PCI is about the security of credit card information. Do you store it safely, is access restricted, etc. I don't think PCI is concerned with whether you're doing ethically shady stuff with the data so long as it's stored and transferred in compliant ways.

braveo 9y ago
If they were using the CC information for nefarious identification I would think that would fall under "is access restricted".
- dpark 9y ago
  Not really. If someone hands you their credit card and you refuse to sell to them because their card has a Star of David on it, you are doing something nefarious with CC information but not violating PCI. PCI is concerned with reducing fraud cost. Visa does not care if the business charging your card is shady, only that it doesn't result in extra costs to Visa.
  - braveo 9y ago
    I'm sorry, but THAT is about the most ridiculous use of a strawman I've ever seen. Uber was using the CC information to LOOK UP MORE INFORMATION ON THE USER. Comparing that to someone simply refusing service is completely outlandish, uncalled for, and indicates a level of bias that is wholly unhealthy for both sides in this discussion.
    - dpark 9y ago
      It's not a straw man at all. Uber literally denied services based on who issued customers' credit cards (allegedly). That they recognized the bank as a police credit union instead of recognizing the Star of David as a Jewish symbol doesn't meaningfully change the scenario. PCI is not concerned about protecting the user. It's about protecting credit card companies. Visa does not care that Uber uses credit card information for nefarious business purposes. They care that Uber doesn't leak the credit card information they possess.

vuln 9y ago

Just went through a PCI audit at a fortune 150. It's not just you it's your processors too. It was hectic to say the least. Then come insurance renewals.

dublinben 9y ago

The portion of the credit card number they were using is not considered sensitive information under PCI-DSS.

SilasX 9y ago

I thought so too and was corrected on the last thread: https://news.ycombinator.com/item?id=13786035 https://news.ycombinator.com/item?id=13786035 But I still suspect it would run afoul of some privacy laws, to collect someone's credit card number to process payment, while also using it to see if they might be a cop: https://news.ycombinator.com/item?id=14270250 https://news.ycombinator.com/item?id=14270250

kbart 9y ago

PCI (PCI-DSS at least) doesn't say anything about use purposes of credit card data, it's the standard on how to acquire, transfer and store such data safely.