Point-to-point encryption (P2PE) is a method of protecting payment card data in which the card details are encrypted the moment they are read by a payment terminal and stay encrypted until they reach a secure decryption environment controlled by a solution provider. Merchants that take card payments in person use P2PE so that their own tills, networks and staff never handle readable card numbers, which makes a breach of the merchant's systems far less damaging. A validated product is a point-to-point encryption solution.
The term has a general meaning and a specific one. Generally it describes any encryption from one fixed point to another. In the card industry it usually refers to solutions validated against the P2PE standard published by the PCI Security Standards Council, which sits alongside the Payment Card Industry Data Security Standard (PCI DSS). Unvalidated products that work in a similar way are often marketed as end-to-end encryption instead.
How point-to-point encryption works
A P2PE solution links several components, each controlled by the provider rather than the merchant:
- Secure card readers. The terminal at the point of sale reads the chip, stripe or contactless interface and encrypts the data inside tamper-resistant hardware before it leaves the device.
- Key injection. Encryption keys are loaded into each device in a controlled facility, and schemes such as derived unique keys per transaction mean that every payment uses a different key.
- Decryption environment. The encrypted data travels through the merchant's systems to the provider, which decrypts it inside a hardware security module before passing it to the acquirer or processor.
- Device management. The provider tracks every terminal from manufacture to installation, repair and disposal, so that tampered or stolen devices can be detected.
Because the merchant never holds the decryption keys, any card data an attacker captures from the merchant's network is unreadable. Key management is the central control: if keys were exposed, the whole solution would fail.
P2PE and PCI DSS scope
The main commercial reason merchants adopt validated P2PE is to reduce the effort of PCI DSS compliance. Card data that is encrypted by a validated solution and cannot be decrypted by the merchant is treated as largely outside the merchant's environment. Eligible merchants can complete a shorter self-assessment questionnaire designed for P2PE users, rather than assessing their entire network, tills and back office. Merchants still have duties, such as inspecting terminals for tampering, keeping an inventory of devices and following the provider's instruction manual.
Validated solutions, components and devices are listed on the PCI Security Standards Council website. Merchants considering a product described as encrypted should check whether it appears on that list, because only listed solutions qualify for the reduced questionnaire.
Relationship with tokenization and other controls
P2PE protects card data while it is moving from the terminal to the processor. Tokenization protects it after authorisation, by replacing the card number with a substitute value that the merchant can store for refunds, reporting or repeat payments. Many acquirers sell the two together: data is encrypted at the terminal, decrypted at the processor, and a token is returned to the merchant. Neither replaces the other, and neither removes the need for EMV chip technology, which prevents counterfeit card fraud by making each EMV transaction cryptographically unique.
P2PE also differs from transport encryption such as TLS, which protects data only between two network endpoints and leaves it readable inside the merchant's systems. Separate rules cover PIN entry, set out in PCI PIN security requirements, because PINs are handled by the terminal under their own encryption scheme.
Benefits and limitations
For merchants, P2PE lowers the risk and cost of a data breach, shortens compliance work and reduces the value of their systems to attackers. For acquirers it lowers the fraud that follows large breaches of in-store systems, which were a major source of stolen card numbers before encryption at the terminal became common.
The limitations are mostly practical. Validated solutions tie the merchant to the provider's terminals and processing, which can make switching acquirer harder. P2PE does not protect online payments, where the equivalent controls are hosted payment pages, payment tokenization and 3-D Secure. It also does nothing against physical attacks such as card skimming devices placed over the reader before encryption, which is why terminal inspection remains part of the merchant's obligations. Finally, card-present fraud using stolen but genuine cards is untouched, because P2PE protects data, not identity.