PCI DSS (Payment Card Industry Data Security Standard), commonly known as PCI Compliance, is an extensive set of information security standards required by the major card schemes (Visa, MasterCard, American Express, Discover, and JCB) to ensure that all organizations that accept, process, store, or transmit credit card information have a secure environment. In the travel industry, where high-value, card-not-present transactions are a standard, following these standards is not an option but an obligation to process payments.
The concept at the core of PCI DSS is Scope. The Scope encompasses any system, person, or process that comes in contact with card data.
To have de-scoping and still allow for refunds and recurring billing, the industry uses something called tokenization.
When the traveler inputs their card details, the payment gateway (like Stripe or Worldpay) intercepts the data and replaces the sensitive 16-digit PAN with a unique and random string of characters called a Token. The travel agency doesn’t store the card number, but instead stores the Token (e.g., tok_123abc) in their database. If the agency needs to charge the card again (ex., for a seat upgrade), they send the Token to the gateway which matches the Token to the actual card number and charges accordingly. If it is hackers who break into the database of a travel agency, they will steal worthless tokens, not credit card numbers.
One of the requirements of PCI DSS, and the most stringent, is around CVV/CVC (the number on the back of the card, usually 3 or 4 digits). You may need the CVV to confirm a transaction at the moment, but you must never store it once authorization is complete.
This causes a challenge for travel agents. If, for example, a hotel requires a CVV to ensure a booking made for next month, the agent cannot, by any means, write it down or save it in the GDS profile. They shall use special Credit Card Authorization Forms or secure links to collect it at the time of making payment.
It is not a law of the government but a contract law that is enforced by the PCI Security Standards Council (PCI SSC). If a merchant is non-compliant and they are hit with a breach, the card brands can fine them heavily ($5,000 to $100,000 a month) or revoke their ability to accept credit cards entirely.
Merchants are divided by volume.
It makes it easy but does not free you. Using a third-party processor (like PayPal) takes a lot of technical load off your shoulders, but you still need to make sure that your own physical environment (e.g., not writing passwords on sticky notes) is secure.
Leave your request
We will contact you shortly
Thank you for your request!
We will get back to you as quickly as possible
