Frequently Asked Question
Does PCI DSS apply to virtual (electronic-only) PANs?
PCI DSS applies to all primary account numbers (PANs) that represent a PCI SSC Participating Payment Brand. This includes PANs that are only provided electronically (virtual PANs) as well as PANs that correspond to a physical payment card.
If the virtual PAN is also a one-time or single-use PAN, refer to FAQ 1285: Does PCI DSS apply to one-time or single-use PANs?
If the virtual PAN is also a one-time or single-use PAN, refer to FAQ 1285: Does PCI DSS apply to one-time or single-use PANs?
November 2021
Article Number: 1286
Related
-
Which date format should be used when completing PCI SSC documents that request dates?
-
Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs’ embedded iframes?
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
Featured FAQ Articles
Featured
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
Most Popular
-
What are acceptable formats for truncation of primary account numbers?
-
For PCI DSS, why is storage of sensitive authentication data (SAD) after authorization not permitted even when there are no primary account numbers (PANs) in an environment?
-
How does an e-commerce merchant meet the SAQ A eligibility criteria for scripts?
-
If an organization provides software or functionality that runs on a consumer's device (for example, smartphones, tablets, or laptops) and is used to accept payment account data, can the organization store card verification codes for those consumers?
-
Are truncated Primary Account Numbers (PAN) required to be protected in accordance with PCI DSS?
Most Recently Updated
-
Which date format should be used when completing PCI SSC documents that request dates?
-
Are authentication values from a 3DS transaction considered sensitive authentication data for PCI DSS purposes?
-
Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments documented in a Report on Compliance?
-
Does PCI DSS define which versions of TLS must be used?
-
Do ASV scans in SAQ A apply to merchants with webpages that redirect to TPSPs or include TPSPs’ embedded iframes?