Payment Card Industry standards are security rules that protect your credit card and bank account information whenever you pay for anything online or in person

The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements created by the major credit card companies — Visa, Mastercard, American Express, Discover, and others — to keep cardholder data safe. When you buy a home, refinance a mortgage, or pay property taxes and insurance online, your payment information passes through systems that must follow these rules. If a company handling your payment doesn't meet PCI standards, your financial information is at risk, and the company can face heavy fines.

You don't need to become a security expert, but understanding what PCI means helps you know which payment methods are safer, what to watch for when entering payment information online, and what recourse you have if something goes wrong. Most of the work happens behind the scenes — the lender, title company, or tax assessor's office is responsible for meeting the standard — but knowing it exists tells you something important: there are rules in place, and violations have consequences.

Key Takeaways

  • PCI DSS is a security standard that requires companies handling credit card payments to encrypt data, limit access, and monitor their systems for breaches.
  • When you pay your mortgage, property taxes, or homeowners insurance online, the company collecting that payment must be PCI compliant or your information is unprotected.
  • You can ask a company directly whether they are PCI compliant before entering payment information, and most legitimate lenders and service providers will confirm this.
  • If a company suffers a data breach and was not PCI compliant, you may have grounds to dispute fraudulent charges and can report the violation to your state's attorney general.

Who created PCI standards and why

The five major payment card networks — Visa, Mastercard, American Express, Discover, and JCB — created the PCI Security Standards Council in 2006 to set uniform rules for protecting cardholder data. Before that, each company had its own requirements, which made compliance confusing and left gaps in security. A single standard meant that any business accepting cards had to meet the same baseline.

The reason was simple: data breaches were costing the card companies money. When a retailer's system was hacked and millions of card numbers were stolen, the card companies had to reimburse customers for fraudulent charges, reissue cards, and investigate the breach. By requiring merchants, processors, and service providers to encrypt data, restrict access, and test their systems regularly, the card companies reduced the number of breaches and the cost of the ones that did happen.

For homeowners, this matters because mortgage lenders, title companies, property tax offices, and insurance companies all handle your payment card information. If they don't meet PCI standards, your data is sitting in an unencrypted file or a poorly secured database where a criminal can grab it.

What PCI compliance actually requires

PCI DSS has 12 main requirements that apply to any company storing, processing, or transmitting card data. The specifics depend on the company's size and how many transactions it handles, but the core rules are the same. Companies must encrypt cardholder data both when it's being sent and when it's stored. They must use strong passwords and multi-factor authentication to limit who can access payment systems. They must install and maintain firewalls, run regular security scans, and test their systems for vulnerabilities at least once a year.

Companies must also keep detailed logs of who accessed payment data and when, so they can detect suspicious activity. They have to restrict access to cardholder data on a "need to know" basis — an accountant who doesn't process payments shouldn't be able to see card numbers. And they must have a written security policy and train their staff on how to handle payment information safely.

When you pay your mortgage online, the lender's system should encrypt your card number before it leaves your computer. The lender stores that data in an encrypted format. If the lender's system is breached, the stolen data is unreadable without the encryption key. A company that is not PCI compliant might store your card number in plain text, making it immediately usable to a thief.

How to check if a company is PCI compliant before you pay

You can ask directly. Before entering your credit card or bank account information on a lender's website, a title company's payment portal, or a property tax office's online system, look for a statement about PCI compliance. Many companies display this on their payment page or in their security policy. The statement might say "PCI DSS compliant" or "PCI Level 1 certified" — the level depends on transaction volume, but any level is better than none.

If you don't see a statement, call the company and ask whether they are PCI compliant. A legitimate lender or service provider will answer yes and may provide a compliance certificate or the name of their security auditor. If they don't know what PCI is or say they're not sure, that's a red flag. Don't enter your payment information until you've confirmed compliance with someone in their accounting or IT department.

You can also check whether a company has been publicly breached. The website Have I Been Pwned lets you search for your email address to see if it appeared in any known data breaches. If a company you're about to pay has had a breach, that doesn't automatically mean they weren't PCI compliant at the time — breaches happen even at compliant companies — but it's worth asking them what happened and what they did to fix it.

What happens if a company has a data breach

If a company handling your mortgage payment or property tax payment suffers a breach, they are required by law to notify you. The notification must come within a certain timeframe — usually 30 to 60 days depending on your state — and must include details about what data was exposed, what the company is doing to investigate, and what steps you should take to protect yourself.

If the company was not PCI compliant at the time of the breach, they are in violation and can face fines from the card networks. Those fines can be substantial — tens of thousands of dollars or more — and the company may also face lawsuits from customers or regulatory action from your state's attorney general. You may have grounds to dispute any fraudulent charges that result from the breach and can request that your bank or credit card company reverse them.

The best protection is to monitor your accounts regularly. Check your credit card and bank statements every month for charges you don't recognize. If you see fraud, contact your bank or card issuer immediately. Most card companies have zero-liability policies, meaning you won't be responsible for fraudulent charges if you report them promptly. You can also place a fraud alert on your credit report with one of the three major credit bureaus — Equifax, Experian, or TransUnion — which makes it harder for someone to open new accounts in your name.

PCI compliance and different payment methods

Not all payment methods carry the same risk. Paying by credit card offers the most protection because credit card companies have fraud liability policies and dispute processes. If you see a fraudulent charge, you can dispute it and the card company investigates. Paying by debit card is riskier because the money comes directly from your bank account, and while you can dispute fraudulent charges, the process is slower and you may not get your money back as quickly.

Paying by bank transfer or ACH (Automated Clearing House) is generally safe if the company is PCI compliant, because the transfer is encrypted and the company doesn't store your full bank account number the way it would a credit card. However, ACH transfers are harder to reverse if something goes wrong, so confirm the company's identity before authorizing a transfer.

Paying by check is the safest method if you're worried about data breaches, because no digital information is stored. The downside is that checks are slower and you lose the convenience of online payment. For mortgage payments, most lenders offer automatic bank draft, which is secure and convenient — the lender withdraws the payment on a set date each month, and you don't have to enter your information repeatedly.

Your rights if a company is not PCI compliant

If you discover that a company you paid is not PCI compliant, you have several options. You can file a complaint with your state's attorney general, who can investigate whether the company is violating state consumer protection laws. You can also report the violation to the card network — Visa, Mastercard, or whichever card you used — by contacting your bank or card issuer and asking them to file a report.

If your information was compromised as a result of the company's non-compliance, you may have grounds for a lawsuit, though this is expensive and time-consuming. More practically, you can dispute any fraudulent charges with your card issuer and request that they stop processing payments to that company. You can also switch to a different lender or service provider that is compliant.

For mortgage payments specifically, if your lender is not PCI compliant, you can contact your state's banking regulator or the Consumer Financial Protection Bureau (CFPB) to file a complaint. Mortgage lenders are regulated entities and must meet security standards as part of their licensing requirements.

Frequently Asked Questions

Does PCI compliance mean my information will never be stolen?

No. PCI compliance reduces the risk significantly, but no system is 100% secure. Compliant companies encrypt data, monitor for breaches, and limit access, which makes theft much harder. But a determined hacker or an insider with access can still cause problems. Compliance is a baseline standard, not a may provide.

If I pay my mortgage online, is my bank account number stored somewhere?

If you pay by credit card, the lender stores an encrypted version of your card number, not your bank account number. If you pay by bank transfer or automatic draft, the lender may store your routing number and account number in encrypted form, but only what's necessary to process the transfer. They should not store your full account number in plain text.

What's the difference between PCI Level 1 and other levels?

PCI has four compliance levels based on how many transactions a company processes per year. Level 1 is for companies processing over 6 million transactions annually and requires the most rigorous audits. Smaller companies fall into Levels 2, 3, or 4 and have less stringent requirements. Any level means the company is compliant; the level just reflects the company's size and transaction volume.

Can I get my money back if I pay a non-compliant company and get defrauded?

Yes, if you used a credit card and can prove the charge was fraudulent, your card issuer will likely reverse it under their zero-liability policy. If you used a debit card or bank transfer, the process is slower and less certain. This is another reason credit cards are safer for large payments like mortgages.

Who enforces PCI compliance?

The card networks (Visa, Mastercard, etc.) enforce compliance through fines and penalties. Your state's banking regulator oversees mortgage lenders. Your state's attorney general can investigate consumer complaints. If you believe a company is not compliant, you can report it to any of these bodies.