Phishing
PCIComplianceHubLast updated
A social engineering attack in which the attacker poses as a trusted party, usually by email or message, to trick a person into revealing credentials or card data or into opening something that runs malicious code. PCI DSS v4.0.1 treats it as both a technical problem and a training problem.
Applies to. PCI DSS v4.0.1 names phishing in two places. 5.4.1 requires processes and automated mechanisms to detect and protect personnel against phishing attacks, tested by observing the processes and examining the mechanisms. 12.6.3.1 requires security awareness training to cover phishing and related attacks, and social engineering, as threats to cardholder data and sensitive authentication data.
Limits. 5.4.1 is written about personnel: it protects the entity's own people from being phished and says nothing about phishing aimed at the entity's customers or cardholders. Neither control names a mechanism, so the choice of email filtering, link protection or reporting tools is the entity's.
Related. Social Engineering, User Training and Awareness, Phishing-Resistant Authentication, Anti-Malware, Security Event
Sources. PCI DSS v4.0.1 (June 2024)