Subject
Action needed: Stop collecting payment card images with File custom fields
Body
Hi [first name]!
We’re contacting you because one or more File custom fields in your OwnerRez account ask guests for, or may receive, images of payment cards. PCI Security Standards Council’s data storage guidance states that scanned or physical images containing prohibited sensitive authentication data or unmasked card numbers are no longer allowed.
What happened?
Guests can upload files to a File custom field on Confirm & Pay, the rental agreement page, and Guest Details in the guest portal. Some fields in your account have been used to collect images of credit or debit cards, front and/or back.
Why can’t I use OwnerRez to collect these images?
As a merchant collecting credit card payments you are required to comply with certain PCI (Payment Card Industry) restrictions on how you collect and store cardholder data. By using OwnerRez you reduce your compliance burden by letting us manage that collection and protect that data for you.
OwnerRez is a PCI certified Service Provider, which means that we can safely collect and store cardholder data for the express purpose of facilitating payments between merchants and customers.
As a PCI Service Provider we have some systems that are approved to store card holder data and some that are not. Even those systems approved to store cardholder data are never allowed to display full card numbers or security codes to you or anyone else. Images uploaded to OwnerRez are not stored on cardholder data approved systems and, even though we store them encrypted and protected, we cannot legally retain them once we identify them.
What we’ve done
When you choose the File format for a booking custom field, the description under Show During Confirm & Pay now reminds you not to use it to collect images of guest credit cards.
We’ve left your custom field(s) enabled and kept your images. However, we can’t confirm that every guest followed those instructions, so please review them as described below.
Action needed: Stop asking guests for payment card images
- Delete any image that isn’t properly masked. Open the bookings with uploads to the listed fields. Delete any image that shows more than the last 4 digits, or that shows the security code.
- Make masking explicit. In Settings > Workflow & Devices > Custom Field Definitions, update each listed field’s description so guests must cover everything except the last 4 digits and the cardholder name, and must never include the security code.
- Stop asking for the back of the card. It carries the security code, which can’t be stored.
Better still, ask for a photo ID instead of a card image.
If you have any questions or need assistance, please contact our support team. We’re happy to help!
-The OwnerRez Team
This is in regard to the following accounts/fields:
[accounts and fields]