Foundation · 2 min
What you need to know
How should ecommerce payment data be protected?
Start with the store’s architecture: keep raw card data inside approved payment components, protect the checkout page from unauthorized changes, and restrict every system that can influence the payment flow.
What is PCI DSS?
PCI DSS is the payment-card industry’s security standard. This guide focuses on identifying which of your systems can affect payment security; Payment Security, PCI DSS and Tokens explains the broader PCI and token fundamentals.
What ecommerce PCI responsibilities may merchants have?
Even with an outsourced payment form, the merchant must secure its website, accounts, scripts, and integrations and complete the validation assigned by its acquirer. Record which duties belong to the merchant, and which belong to each provider.
Why should raw card data generally not pass through unnecessary systems?
Every system that handles raw card data can expand attack exposure and PCI scope. Keep the data inside necessary, controlled payment components whenever possible.
How does tokenization reduce payment-data exposure?
Tokenization can keep reusable card numbers out of the order database, logs, and support tools. Treat the remaining token and the credentials that can charge it as controlled payment assets; see Payment Security, PCI DSS and Tokens for token types and limitations.
What is payment-data scope?
Payment-data scope is the set of people, processes and technologies that store, process, transmit, or can affect the security of payment account data. Architecture and integrations determine it.
A quick store check
Map every system that can influence payment-page security or touch account data and confirm the applicable PCI validation path.
Foundation · 2 min
Frequently asked questions
Can a merchant store card security codes for later use?
Do not store sensitive authentication data contrary to PCI requirements; use provider-supported payment credentials and confirm the rule with payment partners.
Does using tokens eliminate payment fraud?
No. Tokens reduce card-data exposure, but account abuse, compromised checkout and fraudulent transactions still require controls.