So there we are.
We've met all the PCI standards which aim to stop criminals from stealing cards,
PINS, and card data.
All these standards are freely available as PDFs from the PCI SSC website.
The address of the website is pcisecuritystandards.org.
When you get to this site, you will find the standards in the Document Library.
The drop‑down filter lists all of the standards,
so pick the standard or the family of standards that you're interested in,
and then you'll see the standard and all other supporting
documentation for that standard listed.
To download any document, you just need to click on it.
You'll often have a legal agreement to accept.
And then once you've done that,
you can download the standard or the document you want.
Let's remind ourselves of the data that criminals want and
the data that the standards are protecting.
Criminals most want to steal physical cards and ideally with the PIN so they
can take cash from ATMs or go to stores and buy goods.
If they can't steal cards, they like to steal the magnetic stripe track data.
And with this data, they can make clone magnetic stripe cards.
And if they got the PIN, they can go to an ATM.
If they haven't got the PIN,
they can go to stores to buy goods and then sell those goods for cash.
If criminals can't get magnetic stripe data or cards,
they like ecommerce data, the primary account number,
the expiration date, and ideally the CVV2.
And then they'll go to other ecommerce shops and they'll
buy goods that they can turn into cash.
And then finally, if they can't get any of that,
they'll take the magnetic stripe image data from a chip
transaction because at least that's going to have the primary
account number and the expiration date on it,
and then they'll go shopping again at an ecom merchant that doesn't ask for
the CVV code or use 3D Secure to authenticate the customer.
Remember, the only reason that criminals target
cards and card data is financial.
They can turn that stolen data into money by making fraudulent
transactions in store, online, or at ATMs.
The PCI security standards aim to protect all types of payment data that's used
in the authorization of transactions through PCI DSS, and the standard in the
Software Security Framework aim to make secure software so that people can't
steal data from badly written software.
The PCI standards also protect data relating to the
authentication of the cardholder,
such as a PIN, along with entire payment systems used by merchants that
strongly encrypt cardholder data and authentication data as soon as it's
received, standards such as P2PE, SPoC, and CPoC. Finally,
there are PCI security standards for back‑end systems used by payment
processers for banks and for systems and environments used in 3D Secure
in tokenization and in card production.
Separate to the PCI security standards are the EMV standards,
which define how payments work, and these have been designed to
ensure that a payment card transaction cannot be completed with
just stolen card data.
There is the standard for EMV face‑to‑face chip transactions,
the EMV 3D Secure standard for ecommerce transactions, and the EMV
standard for tokenization that replaces a cardholder's primary
account number with a different value,
a token, that can just be used in specific environments or on specific devices.
People laugh when I say we defeat criminals by having standards, but
together, the PCI security standards and the EMV standards
increasingly make it hard for criminals to steal payment card data and
then to make money from any stolen data.