michaelallen

i rarely say anything, but have to throw my two cents in, since my job requires me to be trained in PCI DSS.

it is funny to hear people making up facts, as well as funny to hear others spout back scanting raves on what the believe to be the law also.

there is no law, as of this writing, that governs the storage of credit card information. the PCI is an independent council of credit card companies. they have guidlines and restrictions. when you sign up to do business with them, you agree to their guidlines and restrictions. but this is not a law. this is a business agreement, between one entity and the PCI. as part of the agreement, you agree to abide by certain guidelines and restrictions, and failing to do so, you agree to accept fines imposed by this independent council. this is not the same as legal fines. they do not have that power or authority. they cannot imprison you or anything. they can make it difficult for you to ever be able to process any form of payment in the future, ever again. but legally, they cannot do anything. you willfully agree to their terms.

if i wanted to store credit card information of people who willfully and knowlinly provided it to me, and never send it for processing, then there is nothing anyone can do, as far as PCI goes. they can’t fine me, they can’t sue me, i’ve never signed an agreement with them. i’m simply storing information that has been willfully and knowingly given to me. there may be other ramifications, but we will ignore that for now. the issue is whether PCI DSS is a law. no it is not a law it is a standard.

in the future, please read all relevant information before blasting someone. or if you don’t fully understand it, just refrain from saying anything. it’s awfully silly to make up lawas that don’t exist.

you could try this also

https://wp-plugins.net/plugin/ipscreen/

i’ve never used it, but it looked like it might fit your needs.