Reduce payment-card data exposure

Editorial update: 21 September 2026. Introductory learning material.

Work with your payment processor and acquiring bank to determine your responsibilities and the validation required for your payment environment. Outsourcing processing does not automatically remove every merchant obligation.

Minimize stored card data. For recurring transactions, use the processor’s approved token or card-on-file arrangement. PCI DSS prohibits merchants from retaining card verification codes after authorization, including for recurring payments and even when encrypted.

Activity: Map where payment details enter your business, which providers receive them and whether any logs, messages or forms retain them. Confirm the required process with your payment provider.

Reference: PCI SSC guidance on verification codes and recurring payments. Check the source and your system provider’s current instructions before implementation.