5 ms·
No, it's against the PCI guidelines to store the CVV number under any circumstances [1]. I'm not a PCI expert but as I understand it, if a merchant does store
by ra 16y ago
No, it's against the PCI guidelines to store the CVV number under any circumstances [1].
I'm not a PCI expert but as I understand it, if a merchant does store CVV numbers they can be fined for doing so.
But that fine will be chicken feed compared to the costs Sony will incur if they are found to have leaked credit card details [2].
[1] http://www.braintreepaymentsolutions.com/blog/merchants-are-prohibited-from-storing-cvv2-csc-per-pci-standards http://www.braintreepaymentsolutions.com/blog/merchants-are-...
[2] http://www.braintreepaymentsolutions.com/blog/pci-compliance-and-the-cost-of-a-credit-card-breach http://www.braintreepaymentsolutions.com/blog/pci-compliance...
NB: I've got nothing to do with Braintree - but their blog is excellent
- jrockway 16y agoI don't see anything in PCI to indicate that it's a law or that Sony can't negotiate different terms with each of the card issuers / networks. When you have billions of dollars, you can probably get Visa, Mastercard, Discover, and Amex all in a room and dictate whatever terms you want.
- derobert 15y agoVisa, MasterCard, and American Express are each individually bigger than Sony (but comparable). Certainly Sony is big enough that it can negotiate with them, but its hard to imagine them being able to dictate terms. So, Sony may be allowed to store CVV numbers, but if so its likely that they negotiated that, giving up something in return (possibly, for example, agreeing to penalties in event of disclosure). [note: I checked bigger in terms of market cap. I'm confident this is also true in any reasonable way of comparing.]