PCI-Compliance: Automatic saving of Credit Cards to Authorize.net CIM

Question

Our website uses authorize.net CIM to store consumer credit card's securely after a user's initial purchase. We currently do not have an "opt-in" button allowing us to do this. However, after reviewing other sites such as Groupon, Living Social, and even Amazon, it seems as though this is now common practice. Other more traditional sites such as Nordstrom's require the user to opt-in to save the Credit card. I was wondering what best practice was for saving credit cards. Any other example references would be appreciated.

Thanks for any advice you can provide.

Answer 1

The more up front you are about your handling of sensitive information through your website you are, the less likely someone is able to complain (i.e. sue you) that you put there information at risk without their knowledge. It's not bulletproof protection, but you want to make sure you cover the basics so in the event of a breach or lawsuit you have as much protection as possible.

Answer 2

You always want to reduce the scope, so by offloading the storage to a site such as Authorize.NET or some other gateway provider, you are protecting yourself from liability if the data is lost or stolen. If you can prove to your PCI Compliance auditor that you are using Authorize.NET or some other service to store the card information and not your own potentially insecure database, then this will help you in your PCI scans and compliance.

Amazon and some of the others you mentioned are much larger and have much larger IT staff. So they can secure their sites much better than someone on a shoe string budget. You can always store the personal information such as address and phone number, this is not covered by PCI. It is however covered when you store it in conjunction with the card number and/or expiration date.

Your best bet is not store anything.