Credit card security

The security of a credit card is related to the security associated with the physical card and also the card number’s privacy. That is exactly why the card issuing authorities request you to keep your credit card number confidential and refrain from disclosing it to others. For purchases that are done via a mail order, the merchants accept the card numbers and do not verify it to ensure that the order is indeed placed by the credit card owner. Nowadays, the orders are sent only to the verified addresses so that frauds can be minimized.

While some merchants need only the card number, others need the card and the signature of the customer. In the event that the card gets lost and it is suspected that it was stolen, the customer must get in touch with the bank and request blocking the card to avoid the card being used by a fraud.

The standard that is associated with data security is PCI DSS. The issuing authority is PCI SSC which is actually Payment Card Industry Security Standards Council. Most of the fraud activities are done over the internet. Card information is obtained by frauds by tampering into the security of systems and copying data from the retailers.

In the beginning, PCI DSS was 5 different programs namely ‘JCB Data Security Program’, ‘Discover Information and Compliance’, ‘American Express Data Security Operating Policy’, ‘MasterCard Site Data Protection’ and ‘Visa Card Information Security Program’. The underlying purpose was to create more protection while storing, processing and transmitting the data of the credit card holder by the merchant. ‘The Payment Card Industry Security Standards Council’ came into existence and during 2004 December, all the companies pooled in and ‘Payment Card Industry Data Security Standard’ was released.

PCI standard’s 1.1 versions came to effect during 2006 September. This had some revisions and clarifications. The other security standards are Sarbanes-Oxley Act - 2002, HIPAA (which is ‘Health Insurance Portability and Accountability Act’), GLBA (‘Gramm-Leach-Bliley Act’), Basel II, ISF Standards and BS7799. While version 1.1 became obsolete during 2008 December, the release date of Version 1.2 was 2008 October. 

Numerous supplements were released by PCI SSC for clarifying requirements. Some of these documents are ‘Requirement 11.3 Penetration Testing’, ‘PCI DSS Wireless Guidelines’, ‘Requirement 6.6 Code Reviews and Application Firewalls Clarified’ and ‘Navigating the PCI SSC - Understanding the Intent of the Requirements’.

PCI Security Standards Council published the wireless guidelines during 2009 July. This was for using WIPS (‘Wireless Intrusion Prevention System’) for automating wireless scanning in big firms. The guidelines are related to the Wireless LAN deployment at the environment of card holders called CDE which is cardholder data environment. CDE is the environment which holds or transmits data related to the credit card.

Security standards are designed to offer the maximum protection possible for card holders. In addition to using secured connections while transmitting data, the customer using the internet banking facility should not disclose the credit card number to anyone else.