Payment Card Form Factor
PCIComplianceHubLast updated
The physical thing a payment card takes the shape of: the plastic card itself, or a device that emulates one to start a transaction, such as a smartphone, a smartwatch, a fitness band, a key tag or a piece of wearable jewellery.
Applies to. Card-present environments, where the form factor is what the point-of-interaction device reads.
Example. A customer pays with a phone held to the terminal. The phone is the form factor; the terminal that read it is a POI device under 9.5.1, and the data it read is account data under Requirement 3 whether it came from plastic or from a phone.
Limits. The term exists so that the standard does not have to say 'card or device that acts like a card' throughout. It does not change what the data is or how it is protected. A merchant's own COTS phone used to accept payments is a different thing again: that is the reader, not the card, and belongs under the Council's SPoC, CPoC and MPoC programmes.
In PCI DSS v4.0.1. 9.5.1