The Payment Card Industry Standard is a security rulebook that card networks, banks, and merchants must follow to protect your card data

The Payment Card Industry Data Security Standard (PCI DSS) is a set of technical and operational rules that any business handling credit or debit cards must meet. It was created in 2004 by the major card networks—Visa, Mastercard, American Express, Discover, and JCB—to reduce fraud and theft of card information. When you swipe, tap, or enter your card number anywhere, the business processing that transaction is legally required to follow PCI rules or face fines, loss of card-processing ability, or both.

You do not interact with PCI directly. Instead, you benefit from it: the standard requires businesses to encrypt your card data, limit who can see it, test their systems for weaknesses, and report breaches. If a merchant is PCI-compliant, your card information is less likely to be stolen during a transaction. If they are not compliant and a breach happens, the card networks can fine them heavily or revoke their ability to accept cards.

Key Takeaways

  • PCI DSS is a mandatory security standard for any business that accepts, stores, or processes credit and debit card payments.
  • The standard requires encryption of card data, restricted access to that data, regular security testing, and documented breach response plans.
  • Merchants who do not comply face fines from card networks, loss of payment processing, and liability if customer data is stolen.
  • Your card data is safer when you pay at a PCI-compliant business than at one that ignores the standard.
  • Compliance level depends on transaction volume: a small business has fewer requirements than a large retailer processing millions of cards annually.

Who has to follow PCI rules and why

Any business that accepts card payments—online or in person—must comply with PCI DSS. This includes retail stores, restaurants, gas stations, subscription services, nonprofits, and government agencies. Even a small business taking card payments over the phone or through a website is subject to the standard. The card networks (Visa, Mastercard, and the others) wrote the rules and enforce them through the acquiring banks that process payments on behalf of merchants.

The standard exists because card data is valuable to criminals. A stolen card number can be used for fraudulent purchases, sold on the dark web, or combined with other stolen information to commit identity theft. When breaches happen at non-compliant businesses, the card networks lose money to fraud chargebacks, and customers face the burden of disputing charges and replacing cards. PCI DSS shifts the responsibility for security onto the business handling the data, not onto the card networks or your bank.

What PCI compliance actually requires

PCI DSS has 12 core requirements that businesses must meet. These include installing and maintaining a firewall, not using default passwords, encrypting card data both in transit (when it moves across the internet) and at rest (when stored on servers), restricting access to card data to employees who need it for their job, and running regular security scans and penetration tests. Businesses must also have a documented incident response plan, meaning they know exactly what to do if a breach occurs, and they must train employees on security practices.

The specific technical steps vary by business size and type. A small online retailer might use a payment processor that handles encryption and security on their behalf, which is simpler than a large chain managing card data across hundreds of locations. Businesses must also maintain detailed logs of who accessed card data and when, and they must undergo annual security audits to prove they are still compliant. If a business fails an audit, they have a set period to fix the problems or lose their ability to process cards.

Compliance levels based on transaction volume

Not all merchants face the same burden. PCI DSS divides businesses into four levels based on how many card transactions they process annually. Level 1 merchants process over 6 million transactions per year and face the strictest requirements, including quarterly security audits by an external firm and detailed documentation of all security controls. Level 4 merchants process fewer than 20,000 transactions annually and have lighter requirements, though they still must encrypt data and maintain basic security practices.

Most small businesses fall into Level 3 or 4. A coffee shop, plumber, or freelancer taking card payments online typically only needs to use a compliant payment processor and follow basic security hygiene—strong passwords, keeping software updated, not storing full card numbers. The payment processor handles the heavy lifting of encryption and security testing. Larger retailers and e-commerce sites in Level 1 or 2 must hire security consultants, conduct penetration testing, and maintain extensive documentation to prove compliance.

What happens when a merchant is not compliant

If a business processes card payments without meeting PCI standards and a breach occurs, the consequences are severe. The card networks can fine the merchant between $5,000 and $100,000 per month, depending on the severity and duration of non-compliance. The acquiring bank (the bank that processes payments for the merchant) may terminate the merchant's account, making it impossible for them to accept cards at all. If customer data is stolen, the merchant may also face lawsuits from affected customers and regulatory fines from state attorneys general.

Even without a breach, card networks conduct audits and can discover non-compliance during routine reviews. A business found to be non-compliant is given a grace period to fix the issues, but if they do not, they lose their ability to accept card payments. For most businesses, this is a death sentence—customers expect to pay with cards, and losing that option means losing revenue. This is why PCI compliance is not optional, even though it costs money and time to maintain.

How your card data moves through a PCI-compliant system

When you pay with a card at a PCI-compliant business, your card number never sits unencrypted on their servers. If you swipe or tap in person, the payment terminal encrypts your data immediately and sends it directly to the payment processor, bypassing the merchant's computer entirely. If you enter your card number online, the website uses encryption (indicated by the padlock icon in your browser) to send it to a secure payment gateway, which then forwards it to the processor. The merchant's system receives only a token—a random string of characters—that represents your card but cannot be used to make a purchase.

The payment processor and your bank then verify the transaction, check for fraud, and move money from your account to the merchant's account. Your actual card number is never stored on the merchant's servers, so even if a criminal hacks the merchant's system, they cannot steal your card data. This separation of data—keeping the card number away from the merchant—is one of the most important parts of PCI compliance and is why breaches at compliant businesses rarely result in stolen card numbers.

How to know if a merchant is PCI-compliant

You cannot always tell by looking. A business does not display a "PCI-compliant" badge the way they might display a health inspection grade. However, you can look for signs: a secure website uses HTTPS (the padlock icon in your browser address bar), payment pages are hosted by a third-party processor (like Stripe or Square) rather than the merchant's own server, and the business does not ask you to email your card number or enter it into an unsecured form.

If you are concerned about a specific merchant, you can ask them directly whether they are PCI-compliant. Legitimate businesses know this is a requirement and can tell you. If a merchant cannot answer the question or seems evasive, that is a red flag. For online shopping, stick to established retailers and payment methods like PayPal or Apple Pay, which add an extra layer of security between you and the merchant. If you suspect a merchant is not compliant and you have already paid with your card, contact your card issuer immediately to report the concern.

Frequently Asked Questions

Does PCI compliance mean my card data is completely safe?

No. PCI compliance significantly reduces the risk of your card data being stolen during a transaction, but no security standard is 100 percent foolproof. Compliance means the merchant is following best practices for encryption, access control, and monitoring. Breaches can still happen at compliant businesses if a criminal finds a previously unknown vulnerability or uses social engineering to trick an employee. However, compliant businesses are far less likely to suffer breaches than non-compliant ones.

If my card is stolen at a non-compliant merchant, who pays for fraud?

Your bank or card issuer is responsible for fraud protection under federal law, so you typically will not pay for unauthorized charges. However, you must report the fraud quickly—usually within 60 days of seeing the charge. The merchant and their bank may face fines from the card networks for non-compliance, but that does not directly compensate you. The real cost of non-compliance falls on the merchant and the card networks, not on you.

Can a small business use a payment processor instead of becoming PCI-compliant on their own?

Yes, and most small businesses do. When you use a third-party payment processor like Square, Stripe, or PayPal, the processor handles PCI compliance on your behalf. You are still responsible for basic security—strong passwords, keeping your computer updated—but the processor manages encryption and data storage. This is why small businesses do not need to hire security consultants; the processor does that work and passes the cost along in their transaction fees.

What should I do if I think a merchant is not PCI-compliant?

If a merchant asks you to email your card number, enter it into an unsecured form, or handles your card in a way that seems unsafe, do not complete the transaction. Contact your card issuer or the merchant's acquiring bank to report the concern. You can also report non-compliance to the card networks directly through their websites. If you have already paid and suspect a breach, contact your card issuer immediately to monitor your account for fraud.