Payment Card
Also: Payment Cards
PCIComplianceHubLast updated
For PCI DSS, any payment card form factor bearing the logo of one of the Council's Participating Payment Brands. A physical card is one form factor; a phone, watch or wearable that emulates one is another, and the standard applies to the account data whichever form the card takes.
Applies to. Every merchant that accepts them and every service provider that handles the data from them. Whether an entity is in scope at all starts here: a card bearing a participating brand's logo is what makes the data account data.
Example. A store accepts a tap from a customer's watch. No plastic was involved, but the transaction carries a PAN from a participating brand, and the point-of-interaction device that read it is subject to 9.5.1 like any card reader.
Limits. A closed-loop store card or a gift card that carries no participating brand's logo is outside PCI DSS, whatever its number looks like. The brands decide which programmes apply and the merchant's level; the Council defines the term but does not police it. Form factors that are not cards are still cards for the standard's purposes, which is why 9.5.1 speaks of devices that capture data 'via direct physical interaction with the payment card form factor'.
In PCI DSS v4.0.1. 9.5.1