My Merchant Account Blog

Cardholder Data and Sensitive Authentication Data Elements

Thursday, December 04, 2008

Cardholder data includes the Primary Account Number (PAN), cardholder name, expiration date, service code, the CAV2 / CVC2 / CID / CVV2, PIN, and other sensitive information that is found on the full magnetic stripe. There are certain fields that cannot be stored and other fields that can be stored as long as it is encrypted.

Never store the CAV2 / CVC2 / CID / CVV2 in your database or logs. This is a direct violation of the requirements. If you have to store the PAN for any reason, it should always be encrypted. If it needs to be displayed, it should be masked unless the personnel is authorized with a specific need to see the full account number. You can display the first six digits and the last four digits if necessary, but that is the maximum number of digits that you should display. Some websites might show the customer the last four digits just so he can confirm what card number is on file with the merchant.

The cardholder name, service code, and expiration date can be stored, but must be encrypted if this information is stored in conjunction with the PAN. PCI DSS does not apply if PANs are not stored, processed or transmitted.

The PAN should be unreadable anywhere it is stored, for example backups, logs, or any other type of media that is used to store the numbers. Developers can consider using truncation, strong cryptography, index tokens and securely stored pads, or a one-way hash based on strong cryptography.

The PAN should never be sent in unencrypted emails (which almost all emails are just plain text), instant messaging, instant chats, or over any unsecured transmission. If you are asking customers to send you’re their PAN via a form to email method, you must make sure the email is secure. Just because they are submitting the form with an https: in the URL does not mean the email is secure and encrypted.

Card Validation Value or Code

The card association developed a three or four digit code to help prevent fraud on all keyed transactions. This code is uniquely assigned to each card and ties the card account number to the card itself.

CVV2: Card Verification Value 2 (Visa)
CVC2: Card Validation Code 2 (MasterCard)
CID: Card Identification Number (American Express and Discover)
CAV2: Card Authentication Value 2 (JCB)