Wallet

Security Methods

Issuer verifies the individual during enrollment before issuing a card/payment token to wallet, if applicable. Know Your Customer (KYC), Customer Identification Program (CIP) background checks, etc.; ID verification of a ‘carbon-based lifeform’

Employee training

Issuers may utilize anomaly and fraud detection tools to help identify suspicious or fraudulent activity associated with a specific account or group of accounts.

Additional risk scoring and authentication may be performed by the issuer before allowing a card to be enrolled in a wallet (e.g. step-up authentication)

Strong key management is also necessary to store and load encryption keys and/or account information on a mobile device.

Risks

Social engineering (e.g. call center or end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Account takeover

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Synthetic Identity: Use of stolen identity information combined with fraudulent information to create a new ‘synthetic’ identity which is used to open fraudulent accounts and make fraudulent purchases. Strong enrollment processes may help mitigate synthetic identity risk throughout the transaction process.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

Knowledge-based questions can be compromised.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Sensitive data used to enroll a card or open a wallet account:
Card Number
Expiration Date
Card Verification Values¹
Name
Address
Zip Code
Phone Number
Email address

Additional sensitive data exchanged during token provisioning:
Token
Token Expiration Date
Token Type
Mobile Banking Login (if required)
Mobile Phone Number (if required)
Email Address (if required)
Biometrics or Device payment PIN

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to make transactions via the wallet, create a counterfeit card, and be used for other identity theft crimes. Card may be fraudulently provisioned into unauthorized user’s wallet. Compromised device may be used to make fraudulent wallet purchases. Compromised emails and mobile phone numbers can open up fraud through phishing-type attacks.

Security Methods

Acquirer (or the agent of the acquirer) verifies the individual(s) or organizations enrolling as a merchant before establishing a merchant ID (KYC, CIP, background checks, etc.)

Employee training

Risks

Synthetic Identity: Use of stolen identity information combined with fraudulent information to create a new ‘synthetic’ identity which is used to open fraudulent accounts and make fraudulent purchases. Strong enrollment processes may help mitigate synthetic identity risk throughout the transaction process.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Sensitive data used to enroll or open a merchant account
Name
Date of Birth Address
Social Security Number
Demand Deposit Account Number (DDA)
Signature
Business Name
Tax ID Terminal information (IDs, entry capability, etc.)

Risks Associated with the Sensitive Payment Data

Onboarding Merchant: If compromised, someone that is not a merchant could create a fake merchant account. This could also occur if the merchant account is not fully vetted / authenticated prior to setting up the merchant account.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Merchant ID
Terminal ID
Terminal address
Merchant Category Code (MCC)
Terminal country code
Transaction currency code
Transaction type
Terminal entry capability
Merchant name

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

If compromised, data may be used to submit fraudulent payments into the payments system, especially for card testing purposes.

If compromised, someone that is not a merchant could spoof a legitimate merchant.

Security Methods

Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.

Validate the integrity of the payment message. Review message format for inconsistencies.

Employee training

Consumer and corporate customer education

Strong key management is also necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).

Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of sale to the acquirer; physically secure devices which meet international security standards.

Tokenization may be used for card data storage and used for future returns or loyalty.

As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.

Risks

Account takeover risk

Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.

Machine takeover (payee, financial institutions, network/operator, payer)

Transaction data may be intercepted altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).

Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.

First party/theft/lost or stolen transactions

Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)

Sole reliance on a point in time compliance statement (minimal, “check the box” compliance does not equal security)

Some POS systems transmit and/or store card data in the clear.

End-to-end encryption is not universally applied in POS systems.

Issuer must use all discretionary card fields to validate consumer. For instance, there are methods of duplicating EMV chip transactions but the encryption fails — some issuers were accepting them anyway.

Authenticated yet unauthorized and/or compromised credentials being integrated the payment channel or the device, subsequently used for cash-out at point of sale or payments channel

The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.

Inadequately-controlled enrollment often poses additional risk at the time of transaction.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Payment Token Data:
Token
Token expiration date
Token type
Dynamic Card Verification Value (dCVV)/Chip Card Security Code (e.g. iCVV, CHIP CVC, iCSC)
Card sequence number
Card type
Card PIN (encrypted/offset)
Service code
Velocity limits
Signature
Biometric parameters
Device / Form Factor credentials and IDs
PIN

The following data is considered Sensitive Payment Data:

Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature

Sensitive Authentication Data:
Sensitive authentication data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values ¹
PINs/PIN Blocks
Encryption Keys
PIN Offsets

Issuing bank ABA (routing) number
Issuing bank settlement account number
Merchant bank ABA number
Merchant settlement account number

Risks Associated with the Sensitive Payment Data

If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transactions.

If compromised, data may be used to make fraudulent debits to the settlement accounts

Security Methods

Participants in the original payment transaction may utilize anomaly and fraud detection tools to identify suspicious patterns of activity which may warrant further investigation or potential modifications to transaction anomaly and fraud detection tools.

Sensitive Payment Data (Data that needs to be protected)

Sensitive payment data must be protected wherever it is processed, stored or transmitted.

Varies by transaction type/governing body:
Acquirer reference number
Token
Token status
Transaction date/time
Merchant name
Transaction amount

Chargeback reason code

Risks Associated with the Sensitive Payment Data

If compromised, someone that is not a merchant could spoof a legitimate merchant.