When is it acceptable to store magnetic stripe data?
A. It is never acceptable for acquirers, merchants, or service providers to retain magnetic stripe data subsequent to transaction authorization. The Visa & MasterCard Operating Regulations prohibit storage of the contents of the magnetic stripe as a unit. Cardholder name, account number, and expiration date may be retained subsequent to transaction authorization, however the data must be encrypted.
It is never acceptable for Acquirers, merchants, or service providers to retain magnetic stripe data subsequent to transaction authorization. The Visa & MasterCard Operating Regulations prohibit storage of the contents of the magnetic stripe as a unit. The following individual data elements may be retained subsequent to transaction authorization: Cardholder Account Number Cardholder Name Card Expiration Date.
It is never acceptable for acquirers, merchants or service providers to retain magnetic stripe data, including the Card Verification Value or Code (CVV2/CVC). The Visa and MasterCard Operating Regulations prohibit storage of the contents of the magnetic stripe data. The Card Verification Value or Code (CVV/CVC) is a three-digit code located on the back of a card, inside the signature panel area. The three-digit code helps merchants ensure that the card is in the owner’s possession.
