15
14
cardholder data are secured (e.g. locked filing cabinet), these may include: MOTO order
forms, merchant copies of manual transactions, cardholder records for recurring or
pre-authorisation transactions.
Where storage of cardholder data is required, you must ensure both the type of cardholder
data retained, and the method used to store it is compliant with PCI DSS and ANZ
requirements.
Here are a few simple guidelines:
• Never email credit card numbers or request your customers provide their credit card
number by email
• Ensure that you process eCommerce transactions with security codes (CVV2/CVC2), but
do not store these codes after they have been authorised
• Keep cardholder data storage to a minimum, only what is necessary for business or
legal needs
• Once a transaction is processed, obscure all digits except the first 6 and last 4 digits of
the Credit Card Number (e.g. 1234 56XX XXXX 7890) on all paper and electronic records
• Store cardholder data in a secure environment with strict controls and restricted access
• Use strong passwords which are changed at least every 90 days for all administrator
roles and users with access your customer’s card details
• Avoid storing cardholder data on PC’s, Laptops or mobile phones
• Do not store your customer’s card details online or unencrypted on your computer
• Securely dispose of cardholder data as soon as its use has expired. PCI DSS
recommends shredding, pulping, incinerating or other methods which make it
impossible to reconstruct the cardholder data. ANZ requires you keep transaction
records for 30 months minimum.
Under no circumstances should sensitive information be stored; this information includes
security codes (CVV2, CVC2), PIN or magnetic stripe data
The following sources provide guidance on card data storage:
General Conditions – see Section 14 ‘Information Collection, Storage and Disclosure’
For more information, visit the PCI Security Standards Council website at
https://www.pcisecuritystandards.org/index.shtml
8. Errors and Disputes
A Return and Correction (R&C) refers to a Voucher from a debit or credit card transaction
that cannot be processed. Consequently the transaction is debited from your bank
account and then the Voucher is returned to you for correction.
8.1 Typical Causes of Return and Corrections
• Incorrect Vouchers used and incorrect additions on Merchant Summary Vouchers
• Incomplete information e.g. card imprint cannot be read on the Voucher
• Banking of Vouchers from other card schemes e.g. American Express.
