PCI Compliance PCI DSS

PCI compliance is the set of rules your business must follow as soon as it accepts card payments. The card companies wrote them together and called them PCI DSS, so no government inspector will ever knock on your door about them. The checking is done by your bank or your payment provider instead. Their punishment is the simplest one there is, because they can stop you taking cards at all.

The rules are lighter than that threat sounds, because most of them are ordinary habits rather than technical work. Nobody should be writing card numbers in a notebook by the till, and five people should never share one login between them. The software on the payment machine has to stay updated, the password printed in the box needs changing, and the server room should be locked. None of that needs an expert, and the one Linkysoft finds broken most often is the shared login behind the counter.

The most useful rule is the one that makes the others easy, because a good system never keeps the card number. The number goes straight from the customer to the payment gateway, which sends back a short stand-in code called a token. Your system stores that token, so it can charge the same customer next month without ever seeing the real number. To a thief the token is worthless, since it only works from your own account, and that is how Storek handles repeat card payments.

The part nobody expects is who pays when card details are stolen from a shop. The bill is never just the money taken, because it also carries fines from the card schemes and an investigation you pay for yourself. You then have to write to every affected customer, and your card fees stay higher for years. Small businesses have closed over a few hundred stolen cards, so read your merchant agreement. It almost certainly puts all of that on you and not on the bank.

Most small businesses only fill in a short yearly questionnaire about themselves, and it gets much shorter once the card number never reaches your server. So put one plain question to any supplier, which is whether their system ever sees the full card number. If the answer is yes, ask why, because there is rarely a good reason left. When Linkysoft builds a web application that takes money, the payment step goes to the gateway on purpose, so the shop keeps the sale record and never the card.