01 · How it works, in 5 steps
How does PCI DSS work?
- 1
Map where card data could appear
List every place a card number could land: chat messages, photos of cards, voice notes, the inbox, CRM notes, exports, logs, analytics and prompts sent to AI models.
- 2
Route payments to a compliant gateway
Send a payment link or hosted checkout from a PCI DSS-validated Payment Gateway, or offer UPI and WhatsApp Payments, so card entry happens on the provider's page rather than in your chat.
- 3
Detect and redact pasted card numbers
Scan inbound message text for 13–19 digit runs that pass the Luhn check, replace them with a masked value before storage as part of your PII Masking pipeline, and reply asking the customer to use the secure link.
- 4
Lock down whatever stays in scope
If you must handle card data, apply the full standard: MFA into the cardholder data environment, stored PANs rendered unreadable by tokenisation, truncation or Encryption at Rest with managed keys, no CVV or PIN storage, regular vulnerability scans and annual validation.
- 5
Validate and keep evidence
Confirm your SAQ type or assessment level with your acquirer, keep your providers' attestations of compliance (AOCs) on file, and re-check scope whenever a new channel or bot goes live.
02Try it
Hands-on: use the controls to work through it yourself.
What may you store, show or ask for?
| Store after authorisation? | Show to support agents? | Ask for it in a WhatsApp chat? | |
|---|---|---|---|
| Full card number (PAN) | |||
| Cardholder name | |||
| Expiry date | |||
| CVV / CVC | |||
| PIN or PIN block | |||
| Last four digits only |
Hover, tap or arrow-key through the cells — a dot in the corner means there is a note.
Last four digits only by Store after authorisation?
AllowedAllowed
A truncated PAN is not readable account data.
Legend — press one to highlight its cells
Row 6 of 6. Last four digits only × Store after authorisation?: Allowed. A truncated PAN is not readable account data.
03What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is the security standard maintained by the PCI Security Standards Council, which the major card brands founded, for every organisation that stores, processes or transmits cardholder data: merchants, payment gateways, processors and service providers alike. It is organised as 12 principal requirements under six goals, from network security controls and protection of stored account data to access control, logging, regular testing and security policy.
The current version is PCI DSS v4.0.1, a limited revision published in June 2024; v4.0 was retired at the end of 2024, and the requirements v4.0 had marked as future-dated became mandatory on 31 March 2025. They include targeted risk analyses, multi-factor authentication for all access into the cardholder data environment, and controls on scripts running in payment pages. How you validate depends on volume and method: large merchants are assessed on site, while smaller ones complete a Self-Assessment Questionnaire (SAQ), such as SAQ A for merchants that fully outsource card handling to a compliant provider.
PCI DSS is about card data specifically, whereas ISO/IEC 27001 and SOC 2 cover information security in general. For WhatsApp businesses the practical rule is simple: card numbers must never be collected in a chat. WhatsApp's Business Messaging Policy tells businesses not to ask people to share full payment card numbers or financial account numbers, and any system that receives a pasted card number (webhook handler, team inbox, logs, backups, AI prompts) is pulled into PCI scope. In India, RBI's card-on-file tokenisation rules have also barred merchants from storing actual card numbers since October 2022.
Key takeaways
- PCI DSS is the card industry's security standard for every business that stores, processes or transmits cardholder data.
- Version 4.0.1 is the active version, and its future-dated requirements became mandatory on 31 March 2025.
- Sensitive authentication data such as the CVV, PIN and full track data must never be stored after authorisation, even encrypted.
- Never ask for card numbers in a WhatsApp chat: WhatsApp's policy forbids it and it pulls your chat systems into PCI scope.
- Send a payment link to a PCI DSS-compliant gateway instead, so card data never touches your systems.
04 · Key facts
PCI DSS: key facts and limits
- Current version
- PCI DSS v4.0.1 (published June 2024)
- Future-dated requirements
- Mandatory since 31 March 2025
- Structure
- 12 principal requirements under 6 goals
- Never stored after authorisation
- CVV/CVC, PIN or PIN block, full track data
- PAN on screen
- Masked: BIN and last four digits at most
- WhatsApp policy
- Do not ask users for full card numbers
- India
- RBI card-on-file tokenisation since 1 Oct 2022
05 · Mistakes to avoid
Common mistakes with PCI DSS
Accepting card details in chat just this once
One pasted card number puts the message store, backups and exports in scope. Train agents to refuse, redact automatically on arrival, and always reply with a payment link.
Storing the CVV because it is encrypted
Sensitive authentication data may not be kept after authorisation in any form. Encryption does not make storing a CVV, PIN or track data acceptable, so never write them anywhere.
Forgetting photos and voice notes
Customers send pictures of cards and read numbers aloud. Treat media as possible card data: restrict access, keep retention short and do not run OCR or transcription without redaction.
Assuming the gateway makes you compliant
Outsourcing card entry shrinks scope but does not remove it. You still validate, often with SAQ A, and must protect the pages and links that send customers to the gateway.
06 · In code
PCI DSS in code
// Luhn check: true for digit strings that could be real card numbers.function luhnValid(digits) {let sum = 0;for (let i = 0; i < digits.length; i++) {let d = Number(digits[digits.length - 1 - i]);if (i % 2 === 1) { d *= 2; if (d > 9) d -= 9; }sum += d;}return sum % 10 === 0;}// Mask anything that looks like a PAN before a message is stored or logged.export function redactCardNumbers(text) {return text.replace(/\b(?:\d[ -]?){12,18}\d\b/g, (match) => {const digits = match.replace(/\D/g, "");if (digits.length < 13 || digits.length > 19 || !luhnValid(digits)) return match;return `[card ending ${digits.slice(-4)}]`;});}// In the inbound webhook handler, before saving the message:// message.text.body = redactCardNumbers(message.text.body);
Run the same redactor on exports, analytics events and AI prompts, not only on inbound webhooks.
07Example: A Surat textile wholesaler's order desk
A Surat textile wholesaler takes repeat orders over WhatsApp. Agents used to accept "card number and CVV" in chat for urgent orders, and those messages sat in the inbox, its exports and nightly backups. The business switches to sending a gateway payment link with each order summary. Its webhook handler now masks any 13–19 digit number that passes the Luhn check before the message is stored, and an automatic reply explains that the team never asks for card details in chat. With card handling fully outsourced, its acquirer agrees it can validate with the short SAQ A instead of bringing the inbox into an assessment.
08 · Why it matters
Why does PCI DSS matter?
One customer pasting a card number into a chat can turn a messaging stack into part of the cardholder data environment, with all the assessment, logging and encryption obligations that follow, and a breach of card data can bring penalties and the loss of the ability to accept cards. Designing conversations so card data never arrives keeps PCI scope small: the business sends a Payment Link or uses WhatsApp Payments, the gateway handles the card, and the WhatsApp side only ever sees an order ID and a payment status.
09PCI DSS FAQs
Can I collect credit card details on WhatsApp?+
Which version of PCI DSS applies in 2026?+
Does PCI DSS apply to UPI payments?+
What is SAQ A?+
10 · Pro tips
Best practices for PCI DSS
- Add a line to payment messages: "We never ask for card details on WhatsApp."
- Keep payment links short-lived and tied to one order, so a forwarded link is worth little.
- Show agents only the last four digits when a customer needs to confirm which card they used.
- Ask every messaging and payment vendor for its current attestation of compliance.