Conversation

Hey

@Expedia

, we need to talk. You're sending HTTP links requesting credit card information...

119

328

Replying to

and

I'm fairly sure that's not PCI-compliant

Replying to

and

would you mind looping your compliance teams in on this?

Jeff Man

#HannahKickedCancersButt!!!

Replying to

Technically, they aren't who you should loop in. Because Expedia is a merchant, the entity initially responsible for this will be their acquiring bank.

Replying to

If it is an iframe then there is no requirement for the original site to be encrypted to be compliant with PCI. At no stage does the cardholder's information go anywhere near the original site. It is sent directly to the payment processor.