“Can I write a customer’s card number down and run it later?” It is one of the most common habits in a small office: the customer reads the card over the phone, someone jots it on a pad, and the pad sits by the computer until the end of the day. The card rules do not forbid writing a number down. But one thing on that note, the security code, may never be kept once the payment goes through, the card number should be kept only if you truly need it, and there are easier ways to get paid that keep the card off your desk altogether.
Who sets the rules
The card rules are the Payment Card Industry Data Security Standard, PCI DSS, which its Council calls “a set of baseline technical and operational requirements designed to protect payment account data.” It applies to “all entities involved in payment processing, including merchants, regardless of their size or transaction volume.” It comes from the card industry, not a government agency: the Council’s five founding card brands (American Express, Discover, JCB, Mastercard and Visa) each run their own compliance program, and the Council sends merchants to their acquirer (the merchant bank) or the card brand to learn what they must do to show they comply.
Two kinds of data are on a card. Cardholder data is the card number, the cardholder’s name, the expiration date and the service code. Sensitive authentication data is the full magnetic-stripe or chip data, PINs, and the card verification code: the three- or four-digit number printed on the card and used to verify payments when the card is not present.
The security code: never kept after the payment
The Council’s answer is flat: “It is not permitted to retain card verification codes once the specific purchase or transaction for which it was collected has been authorized.” Encryption does not change that, and neither does the customer saying it is fine; the Council says a customer’s approval “has no validity for PCI DSS.” Not for card-on-file customers, not for recurring plans; for those, it says to ask your acquirer or the card brands for a method that does not need the code.
On paper, the Council’s self-assessment spells out what that means: if you write the code down during a transaction, you either shred the paper immediately after the transaction is complete, or black out the code with a marker before the paper is stored.
The card number: keep it only if you must
The Council’s small-merchant guide puts it in capitals: “IF YOU DON’T NEED CARD DATA, DON’T STORE IT.” Shred what you do not need. If you must keep paper with card data, mark through the data with a thick black marker until it is unreadable and keep the paper in a locked drawer or safe that only a few people can open. The FTC says the same in its guide for businesses: “don’t retain the account number and expiration date unless you have an essential business need to do so,” keep paper records in a locked room or file cabinet, and dispose of them by “shredding, burning, or pulverizing.”
Email is worse than paper. If a customer emails you a card number, the Council’s guide says you can still run the payment, but delete the email immediately, tell the customer how you prefer to receive card details, and if you reply, delete the card details from your reply first so the number is not copied again. The FTC adds that regular email “is not a secure method for sending sensitive data.”
If your phone system records calls, a card read aloud ends up in the recording too. The Council’s 2011 guidance on telephone payments says digital recordings may not hold the security code after the payment is authorized if the recordings can be searched, and that technology to keep those details out of the recording should be used where it exists. The simplest fix is to take card payments by link instead. If you record calls for other reasons, Recording Customer Calls covers the consent rules.
Safer ways to take the payment
The receipt rule
One rule here is federal law, not card-brand policy. A business that accepts credit or debit cards may not print “more than the last 5 digits of the card number or the expiration date” on a receipt given to the cardholder at the point of sale (15 U.S.C. §1681c(g)). It applies only to electronically printed receipts, not to handwritten ones or card imprints. Check what your terminal or printer puts on the customer’s copy.
The self-assessment questionnaire
If your acquirer asks you to show compliance, a small merchant usually does it with a Self-Assessment Questionnaire, an SAQ. There are several, because the Council wrote one for each common way of taking cards. Whether you file one, and which, is not your choice: the Council says to ask the “compliance-accepting entity,” typically your acquirer (merchant bank) or the card brands. Three that fit small contractors, as the Council’s April 2022 (version 4.0) editions describe them; the forms have been revised since, so ask your acquirer for the current one:
| How you take cards | Questionnaire |
|---|---|
| Card-not-present only, all processing outsourced, no card data on your systems | SAQ A |
| One payment at a time, typed into a provider’s virtual terminal on a computer isolated in one location, with no card reader attached | SAQ C-VT |
| Only an imprint machine or a standalone dial-out terminal on a phone line | SAQ B |
All three assume any card data you keep is on paper, such as printed reports or receipts. The Council revised SAQ A in January 2025, in effect from March 31, 2025, adding an eligibility test that asks merchants to “confirm their site is not susceptible to attacks from scripts that could affect the merchant’s e-commerce system(s),” which matters if customers pay through your own website. If the questionnaire looks like a foreign language, start with the Council’s Data Security Essentials resources for small merchants on its merchant page, including an online evaluation tool.
A worked example
Say a pest-control company renews service plans by phone. Today the office writes each card on a renewal sheet, security code included, and runs the sheets on Fridays. The fix: renewals go out as payment links, a customer who wants to pay on the call is keyed straight into the virtual terminal, cards for monthly plans are stored as tokens by the processor, and the old sheets are shredded. The office now stores no card numbers at all, which is what the Council’s guide calls “the best way to protect against data breaches.”
If card data is stolen
Every state has a breach law: the National Conference of State Legislatures says all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands require private businesses to notify people of breaches of personally identifiable information. The FTC’s advice is to have a response plan before you need it, with a senior member of your staff named to coordinate it. The Council’s guide adds: know who your merchant bank and payment vendors are, keep their contact details where you can find them in an emergency, and contact your terminal vendor or merchant bank immediately if you suspect anything.
For what a card payment costs you and whether you may pass the fee on, see Credit Card Fees: Can You Add a Surcharge?; for when to collect it, Getting Paid Faster; and for the customer who disputes the charge after the job, When a Customer Disputes a Card Payment.
General information, not legal or tax advice. Rules change and vary by state; check with the agency named above or a professional for your situation.