How Payment Card Industry Standards Protect Your Credit Card Information
What Payment Card Industry Standards Do
Payment Card Industry Data Security Standard (PCI DSS) is a set of rules that banks, credit card companies, and stores must follow to keep your card information safe. You do not have to do anything to benefit from it — the standard is a requirement for any business that handles credit cards, from the gas station to your online bank.
The standard exists because credit card fraud costs billions of dollars every year, and most of that cost falls on banks and card companies, not on you. The rules tell businesses exactly how to store your card number, how to move it through their systems, and how to destroy it when they no longer need it. If a business breaks these rules and your card gets stolen, the card company has a legal reason to hold them accountable.
You should know about PCI DSS because it explains why certain businesses ask for information in certain ways, why some websites look different than others when you check out, and what happens behind the scenes when you swipe or tap your card.
Key Takeaways
- PCI DSS is a security standard that banks and merchants must follow; you benefit from it automatically without taking any action.
- Businesses must encrypt your card data, limit who can see it, and test their systems regularly to find weaknesses.
- If a business handles your card information, they must meet the standard or face fines and loss of their ability to accept cards.
- You can tell a website is taking security seriously if it uses HTTPS (the padlock icon), asks for a CVV code, and does not store your full card number after purchase.
Who Has to Follow PCI DSS and Why
Any business that accepts, processes, stores, or transmits credit card information must follow PCI DSS. That includes your bank, the grocery store, the doctor's office, the online retailer, and the gas pump. The standard is enforced by the major card networks — Visa, Mastercard, American Express, and Discover — not by a government agency.
Businesses that do not follow the standard face steep penalties. A bank or card company can fine a merchant thousands of dollars per month for non-compliance. More damaging, they can revoke the merchant's ability to accept cards at all, which shuts down a large part of their business. That threat is what makes the standard work: businesses follow it because the cost of breaking it is too high.
Small businesses sometimes think they are too small to matter, but the standard applies to them too. A one-person online shop that takes credit cards must follow the same rules as a large retailer. The card networks do not make exceptions based on size.
How Businesses Must Protect Your Card Information
PCI DSS requires businesses to use encryption — a method that scrambles your card number so that even if someone steals the data, they cannot read it without a special key. When you enter your card number on a website, it should travel through an encrypted connection (you can see this by looking for the padlock icon in your browser's address bar and the letters HTTPS at the start of the web address).
Businesses must also limit who inside the company can see your full card number. A cashier at a store does not need to see your card number; the payment terminal handles it. A customer service representative should not have access to your card number unless you are calling to make a purchase. The standard requires businesses to give employees access only to the information they need to do their job.
Businesses must test their systems regularly to find security holes before criminals do. They run scans for malware, check for outdated software, and hire outside security experts to try to break in. If they find a problem, they have to fix it. These tests happen whether you know about them or not — they are a requirement of the standard, not something a business does only if it feels like it.
When a business no longer needs your card information, they must delete it securely. They cannot just throw a receipt in the trash or leave old files on a server. The standard specifies how data must be destroyed so that it cannot be recovered.
What Happens When a Business Gets Hacked
If a business that handles your card information gets hacked and your data is stolen, the card company is responsible for investigating and notifying you. You are protected by federal law from fraudulent charges on your card — your liability is usually zero, though some cards limit it to $50 if you report the fraud quickly.
The business that was hacked, however, faces serious consequences. The card networks will investigate whether the business was following PCI DSS. If the business was not compliant, the fines are higher and the damage to their reputation is worse. If the business was compliant and still got hacked, the card networks may not fine them, but they still have to pay for the investigation and notification costs.
This is why PCI DSS matters to you: it creates a financial incentive for businesses to protect your information. A business that cuts corners on security is betting that it will not get caught. The standard makes that bet more expensive.
Signs That a Business Is Taking PCI DSS Seriously
When you shop online, look for the padlock icon in your browser's address bar and HTTPS at the start of the web address. This means the connection between your computer and the business's server is encrypted. If you see HTTP without the S, or no padlock, do not enter your card information.
A legitimate checkout page will ask for your CVV code — the three or four digit number on the back of your card. This is a sign that the business is not storing your full card number; they are using a payment processor that handles the sensitive data instead. If a business asks you to email your card number or enter it into a form that does not look like a secure checkout, that is a red flag.
Reputable businesses also do not ask you to store your full card number in your account for future purchases. Instead, they store a token — a substitute number that only works with that business and cannot be used anywhere else. If you see a website that displays your full card number after you have made a purchase, that business may not be following the standard.
What You Should Do to Protect Yourself
You do not have to monitor whether a business is PCI DSS compliant — that is the card company's job. But you can take steps to protect yourself. Never enter your card information on a website that does not have HTTPS and a padlock icon. Do not use public WiFi to make online purchases; use your phone's data connection or wait until you are on a secure network at home.
Check your card statement regularly for charges you do not recognize. Most card companies let you set up alerts that notify you of purchases over a certain amount or in certain categories. If you see fraud, call your card company right away. The sooner you report it, the sooner they can stop the fraudster and protect your account.
If a business you shop with announces a data breach, take it seriously. Change your password if you have an account with them, and monitor your card statement for the next few months. Some card companies will send you a new card automatically if your information was compromised in a breach; others will wait for you to call.
The Difference Between PCI DSS Levels
PCI DSS has four compliance levels based on how many transactions a business processes per year. A small business that processes fewer transactions has less stringent requirements than a large retailer, but all businesses must follow the same basic rules: encrypt data, limit access, test systems, and delete information securely.
Level 1 applies to businesses that process more than 6 million card transactions per year. They must undergo an annual audit by a may have access to security expert and submit a detailed report to their card company. Level 4 applies to businesses that process fewer than 20,000 transactions per year online or fewer than 1 million transactions per year in person. They can complete a self-assessment questionnaire instead of hiring an auditor, but they still have to follow all the security rules.
The levels exist because a large retailer with millions of transactions has more risk than a small business, but the card networks decided that even small businesses need to follow the standard. There is no exemption for being small or new.
Frequently Asked Questions
Can I be held responsible if a business I shop with gets hacked?
No. Federal law protects you from fraudulent charges on your card. Your liability is usually zero, though some cards cap it at $50 if you report the fraud within 60 days. The business and the card company are responsible for investigating and paying for the breach.
Does PCI DSS protect me if I shop in person at a store?
Yes. The standard applies to in-person transactions too. When you swipe or tap your card at a store, the payment terminal must encrypt your information. The store must also protect the physical card reader from tampering and limit employee access to transaction data.
What should I do if a website does not have HTTPS?
Do not enter your card information. Look for the padlock icon and HTTPS in the address bar before you check out. If a website does not have these, find another way to shop or contact the business to ask why their checkout is not secure.
Will PCI DSS prevent all credit card fraud?
No. The standard reduces the risk of data breaches, but fraud can still happen through phishing, identity theft, or stolen cards. PCI DSS is one layer of protection, not a complete shield. Your card company's fraud detection and your own monitoring are also important.
Do I need to do anything to stay PCI DSS compliant?
No. Compliance is the business's responsibility, not yours. You benefit from it automatically. The only thing you should do is shop on secure websites, monitor your card statement, and report fraud quickly if you see it.