Expert: Pierre Coupet - 3/5/2001

Question
Dear Mr. Coupet:

I work for a small company that has a website.  Customers can come to our site and compare the electricity rates of different companies that are offering service in their area. If a customer sees a company they would like to switch to, they can order the switch on our website.  Sometimes, we are required to get a credit card number from the customer.

What is industry standard for storage of our customer's credit card numbers?

Any information or insights you might have will be greatly appreciated.

Sincerely,

Yvonne Thomas  

Answer
There are federal rules which regulate the means used to obtain the actual authorization info and the length of time that the original info itself (medium included)must be kept on file and available for inspection.  It is designed to prevent or combat fraud by scam artists and unscrupulous operators charging customers' [or non-customers] credit cards without their consent.

The time period is 24 months.

Refer to the FTC site below for more information.

http://www.ftc.gov/bcp/telemark/rule.htm

Otherwise, I am not really aware of an industry standard for storage of the number.

There is however a privacy issue involved.  In this case, it would be "Discard the info when there is no longer a requirement to have it and/or when the customer so elects."