PayPal and CSC

etienneg

Rightly or wrongly, I was under the impression that merchants were not allowed to store Card Security Codes. I was therefore surprised to receive the following email from PayPal:

"We've noticed that your card ending in ** is about to expire. Please update your card expiry date and card security code (CSC) as soon as possible to avoid any interruptions in using PayPal. Be sure to activate your new card with your bank first."

The email appears to be genuine, and the relevant card has indeed just been replaced (as it expires this month).

Comments are welcome.

Gerry1

Storing the CVV is a big NoNo.  Banned by PCI DSS Requirement 3.2.

<a href="https://blog.pcisecuritystandards.org/faq-can-cvc-be-stored-for-card-on-file-or-recurring-transactions">https://blog.pcisecuritystandards.org/faq-can-cvc-be-stored-for-card-on-file-or-recurring-transactions</a>

crumpet_man

Does it say that Paypal are storing the CVV?  You just need to input it once so that Paypal can verify/authorise it.

born_again

They will need it to ensure you are the card holder. But will not store it.
I would also not go via any link in that email to update anything. As it could very easy be a phishing email.

etienneg

Thanks for the replies. What you have said makes sense. It was just my reading of the email wording that led me astray. Saying "update your card expiry date and card security code (CSC)" made me think both of these pieces of information were being treated the same, and therefore they were both stored. If they had said "update your card expiry date and tell us your new card security code (CSC) so that we can verify the new card" (or something similar) I would have understood.