Service Code
PCIComplianceHubLast updated
A three or four-digit value encoded on the magnetic stripe or chip of a payment card that tells the terminal how the card may be used, such as whether it is valid internationally, whether a PIN is required, and whether the chip must be used in preference to the stripe. The service code is one of the four elements PCI DSS classifies as Cardholder Data, alongside the primary account number, cardholder name and expiration date, so it must be protected wherever it is stored. Storing it as a discrete data element is permitted; retaining the full track data it was read from is not.
Applies to. The service code reaches any entity that reads or parses track data: merchants with card-present terminals, and the acquirers and processors that receive the authorisation message. Requirement 3 classes it as Cardholder Data. When it is stored with the PAN it must be protected under PCI DSS, although it does not carry the PAN's own rule about being rendered unreadable, and 12.5.2 expects the entity to know where it is stored along with the other account data elements.
Example. A transit operator's gate readers parse the track and keep the service code in the transaction record, because it tells them whether a card may be used offline. That is a legitimate use of a Cardholder Data element. Keeping the raw track string in the same record, on the grounds that the code is inside it anyway, would not be.
Limits. The service code is Cardholder Data, not Sensitive Authentication Data: PCI DSS permits storing it. It should not be confused with the card verification code, which is a security value and may not be kept after authorisation, or with the discretionary data that follows it on the track, which belongs to the prohibited full-track set. Being allowed to keep the code does not license keeping the track it came from.