Sensitive Authentication Data

Sensitive authentication data (SAD) is a category of payment card information defined by the Payment Card Industry Data Security Standard (PCI DSS). It covers the security-related data used to authenticate a cardholder or card during a transaction: the full contents of the magnetic stripe or its chip equivalent, the card verification code printed on the card, and PINs or encrypted PIN blocks. The standard's central rule is that this data must not be stored after a transaction has been authorised, even in encrypted form.

Sensitive authentication data is distinct from cardholder data, which includes the primary account number, the cardholder's name, the expiry date and the service code. Cardholder data may be stored if it is properly protected, while sensitive authentication data generally may not be kept at all once it has served its purpose. Together the two make up what PCI DSS calls account data, and the rules for each are set by the PCI Security Standards Council, founded by the major card networks.

PCI DSS identifies three main elements:

• Full track data. The complete data encoded on the magnetic stripe, or the equivalent data on the chip, which includes the account number, expiry date, service code and discretionary security values. With full track data, a criminal can create a counterfeit card.
• Card verification code. The three- or four-digit value printed on the card, known by names such as CVV2, CVC2 or CID, which is used to show that the person paying online holds the physical card. It is covered in more detail under card verification code.
• PINs and PIN blocks. The personal identification number entered by the cardholder, and the encrypted block in which it travels from the terminal to the issuer.

These elements are valuable to fraudsters precisely because they are designed to prove that a card or cardholder is genuine. If they were stored and stolen, attackers could bypass the controls they were meant to provide.

PCI DSS requires that sensitive authentication data is not retained after authorisation, even if it is encrypted, and that any data received is made unrecoverable once authorisation is complete. The rule applies to merchants, payment gateways, processors and service providers. It covers every place data might linger, including databases, log files, debugging outputs, call recordings, emails, screenshots and backup media.

Data may be held temporarily before authorisation, for example while a transaction is being processed, but it must be protected with strong cryptography during that time. The standard makes a limited exception for card issuers and companies that support issuing services, which may have a legitimate business need to store some of this data, but they must justify it and protect it rigorously.

For merchants that take payments by phone or mail order, the rule means card verification codes must not be written down, recorded or kept after the payment is processed. Many contact centres use pause-and-resume recording or keypad entry systems that stop agents from hearing the digits at all.

Organisations reduce the risk of holding sensitive authentication data by not receiving it in the first place. Common approaches include using hosted payment pages and iframes supplied by a payment gateway, so that card details go directly to the provider; adopting point-to-point encryption at terminals so that track and chip data are unreadable to the merchant; and relying on tokenization so that only substitute values are stored for repeat payments. Regular scans of systems for stored card data help find accidental retention, which often occurs in application logs.

PIN data is subject to additional controls under PCI PIN security requirements, which govern how PINs are entered, encrypted and translated between devices and hardware security modules.

Storage of sensitive authentication data is one of the most serious findings in a PCI DSS assessment and a common factor in large card data breaches. Stolen track data has historically fed counterfeit card fraud, while stolen verification codes enable card-not-present fraud. Card networks can impose fines on acquirers, which pass them to merchants, require forensic investigations and demand that affected cards be reissued, costs that often far exceed the value of the stolen data.

The prohibition on storing sensitive authentication data has been part of PCI DSS since its first version in 2004 and has been retained through later revisions, with clarifications about pre-authorisation storage and issuer exceptions. The growth of EMV chip cards has reduced the value of stolen track data in many countries, while online fraud has made protection of verification codes more important.