3 ms·
Restaurant POCs have an offline mode. They had to ask my zip code so I suppose it just counts as a "card not present" transaction that goes through later. Does
by jazzyjackson 1y ago
Restaurant POCs have an offline mode. They had to ask my zip code so I suppose it just counts as a "card not present" transaction that goes through later. Does present the question of whether that data is temporarily stored unencrypted or if it's immediately encrypted to be sent to the bank when it comes online
- eszed 1y agoI, for my sins, have had to read PCI certification standards, and they're required to be encrypted, or not stored at all. Not that every implementation follows that, of course, but that's the expectation.
- joshstrange 1y agoI work for a POS company and we support offline payments. The SDK(s) we use for our card readers give us an encrypted block of data that we can store and retry when back online. We don’t support “Card Not Present” when offline, we always tokenize cards if we enter them manually (HPP) which we can’t do when offline.
- lxgr 1y agoThat sounds like security theater. What would asking for the ZIP code help if it can't be validated on the spot? If the terminal submits the transaction in batch later, it's too late for that to catch a stolen card. Providing an incorrect ZIP code also makes the transaction more likely to be declined than not providing one at all for card-not-present transactions (and is also allowed), so it really makes no sense for a merchant to do that.