Card-Present Transaction
PCIComplianceHubLast updated
A transaction where the physical card or a provisioned device is at the point of sale and is read by a terminal, whether by chip, contactless or magnetic stripe. Card-present acceptance generally carries lower fraud risk and lower interchange than card-not-present, and it shapes which Self-Assessment Questionnaire applies, since the relevant questionnaires turn on how the card is read and what the merchant systems touch.
Applies to. PCI DSS v4.0.1 treats card-present as an acceptance channel rather than a requirement set: the scope confirmation in Requirement 12 asks the entity to identify the data flows for each channel, naming card-present, card-not-present and e-commerce as examples, so the assessor expects a diagram of how account data moves from terminal to processor. The channel decides the SAQ: under the SAQ Instructions, standalone dial-out terminals or imprint machines fit SAQ B, IP-connected PTS-approved terminals fit SAQ B-IP, a listed P2PE solution fits SAQ P2PE, a listed SPoC solution fits SAQ SPoC, a payment application connected to the internet fits SAQ C, and any electronic storage of account data sends the merchant to SAQ D. Requirements 3 and 9 carry most of the weight in this channel: no sensitive authentication data kept after authorisation, and POI devices listed, inspected and guarded against tampering.