This is page 3 of:
PCI Playing Mobile Limbo
The PCI-DSS rules require merchants to be in compliance. This means using compliant technologies in a complaint manner. Generally, compliant comports with reasonably secure. Many technologies associated with payment systems have never been tested and may never be tested for compliance, but they nonetheless make up a part of the overall chain of a payment card network.
If you fail to use a compliant technology, you run the risk of being in breach of the contract with your acquiring bank. In many cases, the non-compliant or, more frequently, the unevaluated technology may be safer than the compliant technology. Of course, if there is a data breach involving the non-compliant technology, you run the risk of liability for not only the breach costs themselves but fines under PCI-DSS.
The best way to avoid that liability is to avoid the data breach itself. Indeed, to a great extent, you should never make PCI-DSS compliance your goal. Securing card data is the goal. Compliance with PCI-DSS (and with the terms of the contract) may (and sometimes may not) be the consequence of being secure. Remember though, nothing you read online is legal advice, and your mileage may vary.
So, should you pull the plug on technology that has not been given the Good Housekeeping seal of approval by the PCI-DSS Council? My best advice is to keep using the technology if—and only if—you can demonstrate that it is reasonably secure (hardware and software testing, penetration testing, red-teaming, the whole megillah) and if you develop a plan B. And ready both the engineers and that team of lawyers for a fight.
The overall objective of PCI-DSS is to provide reasonable protection to the security of payment card information. Indeed, even if there were no contract, tort law would likely require a merchant, as the fiduciary of customer data, to provide such reasonable protection irrespective of the stated standard to meet. If there is no standard, because the PCI Council has not yet adopted one, then you should be able to do anything that reasonably protects the security of the data. If the council rejects something you have adopted, don’t panic; a new technology will be just around the corner.
If you disagree with me, I’ll see you in court, buddy. If you agree with me, however, I would love to hear from you.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
