bill at bottlenose-wine
Oct 20, 2009, 6:17 AM
Post #2 of 2
(505 views)
Permalink
|
|
Re: mv_credit_card_cvv2 is no longer capture in mv_credit_card_info
[In reply to]
|
|
On Oct 20, 2009, at 7:35 AM, DB wrote:
>> Author: Jon Jensen <jon at endpoint.com>
>> Date: Thu Jun 18 22:56:42 2009 -0600
>>
>> Remove CVV2/CSC from default credit card encrypted block template
>>
>> The card security code should not be stored at all, even in
>> encrypted
>> form. This makes the default behavior compliant with section
>> 3.2.2 of
>> PCI-DSS 1.2:
>>
>>
>> https://www.pcisecuritystandards.org/security_standards/download.html?id=pci
>>
>> It is of course still possible to manually supply a template that
>> stores the card security code in violation of PCI-DSS
>> requirements, so
>> developers should review any custom credit card encryption
>> templates
>> to make sure that the CVV2 is not included, and purge it from any
>> historical data they have stored.
>>
>> Thanks to Mark Lipscombe for calling attention to this.
>>
>>
>> CU,
>>
>> Gert
>
> I have a client that runs charges manually on a terminal using the
> credit card data (including cvv) that's decrypted from emails sent by
> the server. Without undoing the above change and breaking
> compliance, is
> there no way for my client to continue this practice?
There is no way to store the CVV2 and be PCI compliant. Try setting up
a payment gateway.
-Bill Carr
_______________________________________________
interchange-users mailing list
interchange-users [at] icdevgroup
http://www.icdevgroup.org/mailman/listinfo/interchange-users
|
