Which data element must not be stored after authorization (auth)?

Which data element must not be stored after authorization (auth)?

• A. Card verification code or value
• B. PAN
• C. Service code
• D. Cardholder name

Answer: (A)

Storing certain card data after authorization is prohibited because it remains highly sensitive and could be misused if breached. The card verification code or value is used only to verify the card at the moment of authorization and should never be stored for later use. PCI DSS requires that this value not be stored after authorization, even if encrypted, to reduce the risk of fraud. Other data elements like the PAN, service code, and cardholder name can be stored under proper protection (such as masking or encryption) according to PCI DSS, but the verification code must not be kept once authorization is complete.

Storing certain card data after authorization is prohibited because it remains highly sensitive and could be misused if breached. The card verification code or value is used only to verify the card at the moment of authorization and should never be stored for later use. PCI DSS requires that this value not be stored after authorization, even if encrypted, to reduce the risk of fraud. Other data elements like the PAN, service code, and cardholder name can be stored under proper protection (such as masking or encryption) according to PCI DSS, but the verification code must not be kept once authorization is complete.