Keylogger
PCIComplianceHubLast updated
A type of malicious software or hardware that captures and records users' keystrokes, typically with the intent of stealing sensitive information such as passwords, credit card numbers, or other personal data. Protecting against keyloggers is essential for maintaining the security of cardholder data and achieving PCI DSS compliance.
Applies to. PCI DSS v4.0.1 does not name keyloggers. A software keylogger is malware and falls under the Requirement 5 anti-malware controls; a hardware keylogger fitted to a keyboard or terminal is a physical tampering problem, which is the territory of Requirement 9 rather than of anti-malware. Either matters most where account data is keyed in by hand, such as a virtual payment terminal or a call centre taking card numbers over the phone.
Related. Malware, Anti-Malware, Skimming, Virtual Payment Terminal, MOTO (Mail Order/Telephone Order)
Sources. PCI DSS v4.0.1 (June 2024)