Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card details (I'm 100% sure that there are companies out there doing this).

For example, let's say I hadn't asked my question on here and I forged ahead and just decided to store customer credit card details and used some basic AES encryption. Now what? If we never get hacked, is anyone going to ask? Will Visa, or our merchant, ever want to inspect our servers?

What are the consequences of not using PCI compliant infrastructure?

Disclaimer: I get the hint - this is a bad idea and we won't be doing it, but I'm curious

share|improve this question
add comment

5 Answers

up vote 3 down vote accepted

I deal more with HIPAA/HITECH compliance than PCI/DSS directly, however, HIPAA also usually necessitates compliance with PCI/DSS. Why? You never know when medical records will contain a front and back photo copy of a credit card. More often than not, they do (sadly). This usually comes from someone just using their card to settle a co-payment. Everything just gets tossed in one folder.

Embarrassingly, when these records are 'digitized' by third parties, more often than not the resulting (unencrypted) databases contain clear copies of the CC info. Its not as bad as it was a few years ago, but its still a problem. The cause there is not carelessness, its cluelessness.

A few hospitals have already suffered from this practice, after records were stolen (physically or electronically), resulting in shopping sprees.

With any standard, a responsible company will look at the intent behind the standard and realize the problems the standard is trying to solve. This results (quite often) in exceeding the requirements of the standard. That is, if, indeed you realize that the standard applies to you :)

If you have a breach, just one breach and were dishonest about compliance (going back to your question), you will:

  • Never get another merchant account. Just forget about it. You may as well just close down shop, you have no way of getting paid.

  • Be hauled into civil court and have to pay damages

  • Possibly be hauled into criminal court with more serious consequences

  • Enjoy paying for identity protection for every effected person for years to come

If you were honest, and follow the rules about notification / etc, you will probably get out of it with a bit of a black eye, fix whatever hole was exploited and go back to business as usual. No system is, after all, 100% impervious to compromise.

You are probably correct in assuming that some companies do not follow the standard. If we assume that, we can also assume that they have been breached and just failed to report it deliberately, or perhaps (due to not complying) they did not realize the breach.

Visa / MC / Amex are very good at finding patterns, eventually they will trace a fraudulent trend back to a single vendor, and that vendor will be in quite a bit of trouble. The key here is notify them immediately in the event of a breach, which means following best practices. If they have to 'figure it out' and discover (no pun intended) that you are the common denominator, it can get quite ugly.

share|improve this answer
    
Wow, credit cards in medical records - this just makes me even more appreciative of the NHS! –  Nico Burns Jun 9 '11 at 2:09
add comment

The PCI DSS 10 Common Myths (pdf) talks about fines, legal fees, and general bad things, so I think you can assume you'd be sued into oblivion if you lied on the questionnaire :)

share|improve this answer
1  
Why do companies always have to print this stuff in PDFs? What's wrong with a webpage? I once saw a PDF from a manufacturer that was a printout of a HTML page... –  Mark Henderson Jul 20 '10 at 4:06
    
@Farseeker oh, no kidding. And then when it shows up in Google they're like "See! I can have my awesome DTP layout and still eat cake!" –  JasonBirch Jul 20 '10 at 4:37
add comment

Even when you assume that nobody might want to inspect your server you might fire an employee. Then that employee hates you might go to VISA and complain about your lack of following the standards.

share|improve this answer
add comment

I worked for a company that was going through the PCI compliance process and I have to say, if you are storing credit card info and are not PCI compliant you are putting your company at risk.

You are right in that the Credit Card industry may never find out but why risk it. You have to remember, if you ever have a breach of security or a Card Vendor finds out you can lose your business and your reputation.

Many people think that because it hasn't happened yet that it won't happen in the future and that is just plain false. Having a CC Provider find out or a breach occur is a Black Swan because it only takes 1 occurrence to ruin you.

share|improve this answer
add comment

We work Very hard not to store any info and make sure were compliant ,no need in any chances of trouble ,and be sure you always use a great cart such as miva ,or at least look at the list of cart providers that are compliant and are recomended

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.