Magnetic Stripe Data
PCIComplianceHubLast updated
The full contents of a payment card magnetic stripe, also called full track data or Track 1 and Track 2 data. Alongside the primary account number, cardholder name and expiration date, the tracks carry the CVV1 (CAV1) value and discretionary data. Full track data is Sensitive Authentication Data and must never be stored after authorization under any circumstances, including in application logs, transaction histories, crash dumps or debugging output. Retained track data is one of the most frequent findings in post-breach forensic investigations.
Applies to. The term reaches any system component that reads a physical stripe or receives what was read: point-of-sale terminals, unattended kiosks, PIN entry devices, the payment applications behind them, and any queue, log or memory dump those systems write to. Requirement 3 treats the full stripe contents as Sensitive Authentication Data that may not be kept after authorisation, and PCI DSS applies the same rule to the equivalent stripe image read from a chip.
Example. A hospitality group finds that its older point-of-sale software wrote the raw swipe string to a debug log whenever a transaction failed. Months of failed swipes, each carrying full Track 2 data, sit on the store controllers and in nightly backups. The group has to purge the logs and the backups, fix the software so the swipe string is never written, and follow its procedures for account data found where it is not expected.
Limits. PCI DSS uses magnetic stripe data and full track data as the same thing, so the term is not limited to the physical stripe: a chip can return a stripe image that counts. It is also not a synonym for account data in general. The PAN, cardholder name, expiration date and service code parsed from the stripe may be stored as Cardholder Data with the protections that class carries; what may not be stored is the stripe as read, including the discretionary data and CVV1 inside it. A truncated PAN on a receipt or a token returned by a processor is not magnetic stripe data.