Two more credit card processes the travel industry shouldn’t be doing [PCI]

PCI is a set of standards that define how you are permitted to hold and transmit credit card data. If anyone tells you their system is secure just because they have an SSL certificate they demonstrate that they don’t really understand how security works.

PCI is much more than just an SSL certificate. Compliance is mandatory for any company handling credit card details (unless you decide not to handle credit card data - e.g. by using a 3rd party payment gateway)

Here are two more processes that travel companies do that will require the agent to be PCI audited:

• Agent takes credit card details from customer over the phone and, while customer is on the phone, places the card details into a supplier website
• Agent takes credit card details from customer and instead of charging the card they give the credit card details to a supplier (for charging directly at a later time)

The first process has become “common” (or acknowledged to take place, at the least) by agents who have been banned from selling Ryanair flights. Instead of using the agency credit card the customer’s details are placed on the Ryanair website - making it difficult for Ryanair to see that the booking is an indirect booking. However, this process would require the agent to be PCI compliant (which they are unlikely to be, for this situation)….. 

The second process is common in the hotel industry. The card details are often transmitted to the hotel for charging. This would require the agent and the hotel to be PCI compliant. e.g. you can’t just “email” the card details to the hotel. Faxing is also problematic.

The onus on the 3rd party
If you are a travel company that uses agents to send credit card data to you (on your behalf) then it is down to you to ensure your agents are PCI compliant. 

Again, something for our “non technical” industry representation bodies to get to grips with. However I am not sure they really understand that much of the industry is now structured around trading outside of the PCI standards….. and therefore what to do about it - hence nothing really happens. It will just have to take a “big breach event” to bring this to everyone’s attention.

If you want to be notified next time something is published sign up for email alerts or subscribe to the RSS feed. Thank you for reading!