PCI Compliance

What is PCI Compliance?

Payment card industry (PCI) compliance refers to the practical and operational principles that companies need to follow to ensure that credit card information provided by cardholders is secure. PCI compliance is prescribed by the PCI Standards Council, and all companies that automatically store, process or convey credit card data are required to follow these procedures. Created in 2004, PCI compliance aims to secure credit and debit card transactions against data theft and fraud.

PCI Compliance Infographic

Compliance is validated on an annual or quarterly basis and evaluated by a PCI auditor. The system is divided into four levels. Methods range depending on the volume of transactions handled:

  1. Highest Level (1): Applies to companies who process more than 6 million credit or debit card transactions annually. These merchants must have an internal audit once a year. Additionally, merchants must submit to a PCI scan by an Approved Scanning Vendor (ASV) each quarter.
  2. Level 2: Applies to companies processing between 1 and 6 million annual credit or debit card transactions. Requirements include a yearly Self-Assessment Questionnaire (SAQ). A quarterly PCI scan may also be required.
  3. Level 3: Applies to companies processing between 20,000 and 1 million transactions annually. They must complete a yearly SAQ. A quarterly PCI scan may also be required.
  4. Level 4: Applies to sellers processing less than 20,000 transactions annually. These merchants must complete a yearly SAQ. A quarterly PCI scan may also be required.

Basics Needed for PCI Compliance

  1. A Secure network with original passwords.
  2. Secure and encrypted cardholder data.
  3. Vulnerability management.
  4. Anti-virus software that is used and regularly updated.
  5. Secure systems and applications for users.
  6. Restricted and controlled access to cardholder information.
  7. Consistent network monitoring and testing.
  8. Information security policy and maintenance of that policy.

PCI Compliance and Digital Payments

With the rise in new payment technologies, such as contactless payments and digital wallets, payment fraud has never been more sophisticated Likewise, the financial rewards for the perpetrators have never been greater.

These new changes will affect all industries, from banking to e-commerce. Experts believe these new technologies will soon represent the majority of all transactions.

Since then, fraudsters have taken advantage of businesses ' limited ability to adapt. Even among well-funded organizations, resources may not be used properly. For example, key resources and critical forensic data, investigative expertise, and data science capabilities are broadly scattered. Actions occur across cybersecurity, accounting, fraud, compliance, legal, and IT departments. With this comes little coordination or sharing in between departments. This is where PCI compliance is vital, and also where fraudsters have opportunities.

PCI Compliance and Beyond

Combat fraud leveraging data science and analytics, gradually moving away from a narrow focus on false positives and loss prevention. Harness Fraud.net’s capabilities to reduce losses, detect and prevent emerging fraud, and enhance the customer experience. Get in touch with us today to learn more.

PCI DSS

The Payment Card Industry Data Security Standard, also known as PCI DSS, is an IT security standard for companies that handle branded credit cards from the major card providers. The PCI Standard is mandated by the card brands and administered by the Payment Card Industry Security Standards Council. The standard was created to increase controls around cardholder data to reduce credit card fraud.