SHORT ANSWER:

签发银行不要求每笔交易确认安全法。

LONG ANSWER:

不允许将卡片安全编码和磁带数据储存在安全总局。 此外,VISA(可能还有其他网络)严格禁止储存:

http://usa.visa.com/merchants/risk_management/cisp_ Remuneration_applications.html。

Merchants storing this data can be hammered with hefty fines and dropped by processors. This happened to a client of mine.

Apple s e-commerce system asks for the security code when an account is created or whenever a new device accesses an existing account. In both instances, their platform initiates a zero-dollar transaction with the processing network to verify the customers identity (username + password + security code):

https://discussions.apple.com/thread/2594628?start=0&tstart=0

Some issuing banks require security codes to be used with each transaction. In those cases, the iTunes store will prompt you for the code.

Xixonia是正确的,个人数据在 Apple果基础设施内被标出。 大部分服务器从未触及安全数据,因为所有证书和财务数据都加密给高度保护和监督系统的内联网。

此外, Apple果和亚马孙等大型零售商利用第三方欺诈检测和预防技术,寻找虐待模式。

"It is permissible for issuers and companies that support issuing services to store sensitive authentication data if there is a business justification and the data is stored securely"

Easier purchasing and subsequent transactions are NOT business justification.

A pertinent use case would be batch transactions. During purchase the card is authorized to confirm the card is active and the funds are available. The issuing bank typically encumbers, but does not withdraw, the transaction amount from the cardholder s account. During a subsequent capture transaction, the merchant settles with the processor and the funds are transferred. This might happen because:

• The issuing bank requires it (e.g., voice authorization).
• The payment network requires it (e.g., American Express used to).
• The merchant does not know the full transaction amount (e.g., restaurant tip).
• The merchant does not have persistent connection to the payment network (e.g., mobile operator).

这条路线的触发点是MUCH,在社会、文化、文化、文化、体育和体育部的监督下进行更严格的检查。 使用谷歌检查和薪给等第三方检查系统的商家获得最低限度的治疗(SAQ A)。 存储ANY卡片持有人数据的商家承担SAQ D的沉重负担。

The compensating controls for holding security codes & magnetic stripe data are even more strict:

• Data must be stored using best practices (randomized salt + strong encryption cipher + restricted keys + mandatory access controls + audited access).
• Data must be automatically removed after a set grace period (typically a day or two).
• Data must be securely overwritten and on a medium that allows it (most solid state drives wear leveling mechanisms prevent this).