This is page 2 of:
The Corporate Travel Card PCI Challenge
Pages: 1 2
December 8th, 2009
When PCI Columnist Walter Conway played high school football, the coach once said to him, “Son, there are three ways you can do things: the right way; the wrong way; and the coach’s way. Which way are you going to do things?” To which he replied, “the coach’s way, sir.” PCI can sometimes get like that when the card brands can’t agree among themselves as to whether something is in-scope or out-of-scope.
Most companies issue their employee road warriors with corporate travel cards. Companies also issue purchasing or procurement cards that their staff use to buy everything from office supplies to store fixtures. Most of these cards are American Express, MasterCard or Visa branded. Companies store the PANs in databases that are accessible to travelers and others who use the data for expense reporting and tracking. In my experience, the PANs get printed on hardcopy reports. The question for IT execs is, do you need to include these cards in your (merchant) PCI scope? The surprise answer is that it depends on where you store the cardholder data and, interestingly, on which brand of card you choose.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
2 Comments | Read The Corporate Travel Card PCI Challenge
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
December 10th, 2009 at 2:39 pm
Thank you for the thoughtful article. Only after reading it do I realize that the question ultimately lies in who has the liability for damages caused to an information security breach of a ‘corporate card’ program?
If the “cardmember” rules which apply to a corporate card lay all of the liability with the business on whose behalf the cards are issued, then the card brands have little standing to impose PCI DSS, as the card brands have little to lose.
What are the actual rules?
Does the cost of fraudulent use of a particular business’ corporate cards fall only on that business? If so then PCI DSS should not apply.
December 10th, 2009 at 11:03 pm
Thanks for the comment, Jay, and you make a good point about where the risk lies.
I think the risk in a compromise depends on the card type. For example, corporate/travel cards are issued in the cardholder’s name (via the company), and they would be governed by Regulation W which also covers all credit cards. That is, the liability would be $50 to the cardholder. I am not, however, an expert on the nuances of these particular cards or the specific operating regulations governing them. Maybe companies should check their contracts to see liability provisions?
As for purchasing cards which are issued in the company’s name, I can only speculate that the liability in a breach would depend on the contract between the company and the issuer for liability provisions.
In any event, you make a good point that PCI DSS should not apply. However, I keep coming back to my old high school football coach: we can do things the right way, the wrong way, or the coach’s (i.e., the brands’) way. From my point of view, I guess I’ll keep doing things the coach’s way.