Takeaway kept my card details?

I'm pretty sure Steam stores the CCV as well? And the CCV is not specifically mentioned in the DPA. Whilst its good practice not to, I don't think its actually a criminal offence?
 
[TW]Fox;17429434 said:
I'm pretty sure Steam stores the CCV as well? And the CCV is not specifically mentioned in the DPA. Whilst its good practice not to, I don't think its actually a criminal offence?
Click to expand...

I don't think it does, it certainly makes me enter it every time.
 
JoeMama said:
I was about to post the same thing about amazon. Play.com also seem to have mine stored too.
Click to expand...

But they don't the CVV (at least a quick look at Amazons add a card interface doesn't). As Westyfield2 says this is a pretty major no no with PCI-DSS ... that can lead to massive fines, removal of ability to accept cards etc etc ... there are pretty strivt rules to do with the storage and access to the data as well, which they are probably breaching too ...
 
Aside from keeping the details which is dodgy in itself, I'd be pretty concerned about the way they recited the whole lot to you based purely on the incoming phone number. What if you'd moved out and the new occupant was calling from your house? They'd have just given all your card details to a complete stranger.
 
CVV numbers are simply a method of the merchant verifying that you have the card in your possession and are authorised to use it - you can put a transaction through without it.

PCI DSS specifically states that you must not store the CVV number anywhere, and they could get in to trouble with their acquiring bank as they are clearly not handling the sensitive data properly.
 
[TW]Fox;17429538 said:
Which law, out of interest?
Click to expand...

It's part of the requirements for PCI-DSS compliance as opposed to a "law" ... failure to follow these and you won't be able to accept cards, be fined for not meeting the compliance and can be liable for costs if there is a breach ... how much it costs a bank to reissue a couple of thousand cards if they have been comprimised ...
 
OllyM said:
CVV numbers are simply a method of the merchant verifying that you have the card in your possession and are authorised to use it - you can put a transaction through without it.

PCI DSS specifically states that you must not store the CVV number anywhere, and they could get in to trouble with their acquiring bank as they are clearly not handling the sensitive data properly.
Click to expand...

OllyM and memyselfandi

Ok i have decided to report it, you seem to know the score, who do you think i should contact. Will local trading standards be the best to start with ?

I got no problem calling the shop and saying delete it, but ill never know they have and they may well have 100s on file.

im scared now :D

just need 1 more sensible answer before you can rip this thread to shreds
 
Efour2 said:
OllyM

Ok i have decided to report it, you seem to know the score, who do you think i should contact. Will local trading standards be the best to start with ?

I got no problem calling the shop and saying delete it, but ill never know they have and they may well have 100s on file.

im scared now :D

just need 1 more sensible answer before you can rip this thread to shreds
Click to expand...

no sure way, unless you know the right people to contact so they can investigate? or somthing. if your really worried you can allways ask the police. (not 999 lol)
 
You should tell TS regardless of anyone else you go to. If you can find out what bank/merchant they use then I assume you could report it to them too re: the PCI-DSS compliance.

Might help: http://www.ico.gov.uk/complaints.aspx

For your complaint to be eligible for further consideration we will usually need you to provide us with supporting information or evidence.
Click to expand...

Any way you can record a second call/order?
 
Last edited:
You must log in or register to reply here.
Back
Top Bottom