Companys holding onto Credit card details?

terrybriggs1

Hi

Made a purchase with a company a few weeks ago, and went to place another order yesterday with the same company on the phone and they asked whether i wanted to use the same card as last time? When not once in the previous conversation did i ask them i wanted them to keep my details on record? Is this Legal ?

Thanks

Terry

grumbler

I don't see anything illegal in this, and it's pretty much a norm.
Amazon store even CVVs along with other card details.

terrybriggs1

But with amazon do you not have to click the "keep my details" box ?

The company have stored my details without me agreeing to it ?

grumbler

They stored the payment details that they need at least for accounting/audit purposes.

Most companies have to store some details of their customers. Protecting the data is a different question.

iAMaLONDONER

grumbler wrote: »

I don't see anything illegal in this, and it's pretty much a norm.
Amazon store even CVVs along with other card details.

Amazon don't even ask for CVV when you make a purchase!

nonnatus

NO!


Small companies HAVE to destroy your card numbers as soon as they have been used. BIG trouble otherwise.


SO, eg I have customers who call me to place an order and I scribble down their details so that I can process the payment once I put the phone down (CC machine uses the same phone line as phone unfortunately).


As soon as I process the payment, I shred the paper I wrote it all down on. It's part of my Insurance / data protection rules.
Some customers get fed up and ASK me to store their number somewhere so they don't have to faff about finding their card every week, but I'm NOT ALLOWED to keep that info.


When you order online, the info is safe because it gets coded securely away to avoid being stolen I assume...

eskbanker

Any company accepting payment cards has to comply with PCI-DSS standards but that doesn't necessarily mean no retention, it just means that appropriate security measures need to be in place. For a small company scribbling down details for keying into a terminal then yes it's better to be safe than sorry by shredding the paper copies but it's not actually mandatory if there are suitable mitigating controls (such as storage in a safe) that satisfy the demands of security assessors. However, it's undoubtedly easier to achieve PCI-DSS accreditation if there is no storage of card numbers at all!

bluffer

nonnatus wrote: »

NO!


Small companies HAVE to destroy your card numbers as soon as they have been used. BIG trouble otherwise.

ummmm no they dont.

and to answer the op, yes it is legal. as long as all the appropriate security measures are in place.

grumbler

iAMaLONDONER wrote: »

Amazon don't even ask for CVV when you make a purchase!

I think they don't ask because they already have it.

chattychappy

nonnatus wrote: »

NO!


Small companies HAVE to destroy your card numbers as soon as they have been used. BIG trouble otherwise..

bluffer wrote: »

ummmm no they dont.

Years ago when I signed a merchant agreement that was certainly a requirement. We were not allowed to retain CC numbers once the transaction had been processed. Only details of the order, customer name, delivery address etc.

I had one customer who ordered at least a couple of times a week. By the time he had repeatedly read the number over the phone, I'd written it down, I'd read it back, I'd put it into the machine.... well, after a while I remembered all his details.

iAMaLONDONER

grumbler wrote: »

I think they don't ask because they already have it.

How would they get it? If you've never dealt with them before?