If a vendor clearly ignores PCI-DSS regulations and puts my personal credit card information at risk, is there any legal action I can take against them?

In the case at hand, a vendor first scanned my hand-written order form with a phone (likely a personal smartphone) and then sent that scan to me in an unencrypted email. But this is not the first case in which a vendor has mistreated my information like this.

While I have not (yet) incurred any actual damage, I would like to be able to do my part in making vendors aware of their obligations. So far I usually send a nice email reminding them of the PCI-DSS regulations. But I always feel like that these emails are ignored at best. Is there some form of cease and desist that I can apply in this case? Is there a place or organization that I should notify? Should I sue them?

1 Answer 1


You can, but probably won't succeed. You'd probably be better off reporting the noncompliance to card brands (e.g., Visa). PCI DSS is not required by federal law, and the few states that mention it in their laws generally do so in the context of breaches (actual damages). But processing credit card payments comes with certain merchant obligations, so card brands may be able to enforce something.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.