Tokenization
See how tokenization helps reduce merchant PCI scope and support PCI DSS compliance.
Learn more
An original initiative by the large credit card companies, PCI DSS was born to help fight credit card fraud and protect consumers in the growing sphere of online payments.
The Payment Card Industry Data Security Standard, also known as PCI DSS, is a global standard for securely accepting and processing credit card payments. Launched in 2006 by an alliance of major credit card companies, PCI DSS encompasses 12 key requirements as well as more than 400 sub-requirements and test procedures.
Being PCI-compliant requires not just meeting these requirements but continually identifying, documenting, and (if necessary) remediating business-level systems and processes that involve the handing of user credit card data.
PCI DSS requirements must be fulfilled by any party responsible for storing, processing, or transmitting an individual’s credit card data. It applies to all organizations that handle credit card data, including online merchants.
Although most business subject to PCI compliance are only required to self-report, the costs of PCI failures can be crippling. When merchants sign a contract with a payment processor, they agree to pay fines if they do not comply with PCI DSS. Depending on the payment processor, fines can range from $5,000 to over $100,000 USD per month based on the size of the merchant and the extent of non-compliance. Actual customer data breaches can, of course, be even more devastating.
A key concept when it comes to PCI DSS is a merchant’s “PCI scope” – the extent to which a merchant actually interacts with the customer’s payment data, and the responsibility the merchant therefore assumes for safeguarding it according to the PCI requirements.
As a PCI Level 1-certified payment processor, PayU offers merchants a variety of ways to reduce PCI scope, limit responsibility and risk, and remain complaint.
PCI covers all of the cardholder’s data environment, including how you process payments and manage customer data and how you link these systems into one. PCI compliance can be especially challenging if your payment system employs a patchwork of different services from different vendors.
Tokenization plays a significant role in reducing your PCI scope by encrypting cardholder data and preventing its storage. This means that any unencrypted credit card numbers, CVV or CVV2 or PINs, receive a unique identifier, remote from their original representation.
PayU offers several ways to help you to ensure your PCI compliance. While the collection and tokenization of a user’s card details each require a different PCI scope, universal tokens and our PCI-compliant token vault reduce PCI scope significantly by enabling merchants to avoid storing or transmitting credit card data via their own systems.
Instead, transactions are ‘tokenized’ so that credit card data is replaced in the merchant’s system with a unique set of numbers. PayU, in turn, is responsible for storing and safeguarding the original data.
With reduced exposure to PCI data security compliance requirements, you save on compliance costs, while at the same time offering your customers a more secure payments experience.
See how tokenization helps reduce merchant PCI scope and support PCI DSS compliance.
Learn more
What is 3DS 2 and why should you implement it? Learn how PayU can help you manage 3DS essentials.
Learn more
Learn more about how PayU’s anti-fraud module keeps merchants and their customers safe.
Learn moreThe Payment Card Industry Data Security Standard (or PCI DSS) represents a set of policies and procedures designed to protect any transaction processed with credit, debit, or cash cards.
PCI DSS stands for Payment Card Industry Data Security Standard, created by Visa, Mastercard, American Express, and JCB in September 2006. The standard and its enforcement mechanisms are updated regularly.
PCI DSS applies to all businesses and enterprises that process, store and transmit card data between other systems. Depending on the amount of data and the number of transactions processed, entities that store such data are mandatorily required to apply for PCI DSS certification (level 1 to level 4).
PCI DSS was created to ensure the safety and security of cardholder data. It is one of the most important policies in the payments industry because it ensures that all cardholder data is protected from potential cyber-attacks or other forms of fraud at every step of the buying journey.
PCI DSS prevents fraud and improves security with the help of the special requirements to which businesses need to adhere before storing card data. Depending on the level of compliance required, a card data storing entity must build and maintain a secure network and system with zero tolerance for vulnerabilities, while enabling strong access control measures for data, and making sure that they have a vulnerability management program that tracks their network. Many e-commerce merchants chose to reduce their “PCI scope” by working with a payment provider that is PCI-certified and can take responsibility for storing customer card data. By doing this, merchants have less exposure to sensitive user information.