Best practices on securing cardholder data

November 17, 2022

As digital payment options increase, so does the likelihood of a cyber-attack. The cost of a breach is massive, not to mention the compliance violation fees and reputational damage. Reduce your risk by ensuring payment data is secure end-to-end.

As consumer preference for digital payment options increase, so does the likelihood of data breaches, ransomware, hacking and other fraud events. According to an IBM study, the average cost of a data breach in the U.S. is $9.44 million and the average cost of a ransomware attack is $5.54 million. 

In addition to direct financial costs, cybercrime events also increase the risk of additional costs related to compliance violations that are typically revealed after data is compromised. Businesses that want to protect their brand need to ensure that their payment data and digital transactions are secure with solutions that reduce both business and compliance risk.

Point-to-point encryption, also known as P2PE, is a technology that encrypts cardholder data at the point of checkout, in-person or online. Encrypted payment data bypasses the businesses' payment environment and is sent directly to the processor where it is decrypted. Using a combination of secure devices, applications, and processes, encryption turns sensitive payment information into an unreadable code, removing any value to the cybercriminals. 

P2PE technology provides a layer of security that:

Safeguards from the point of entry

P2PE encrypts cardholder data in the card reader, protecting the data from attacks that target payment data at the point of acceptance.

Secures data in transit 

Encrypted data can safely be transferred over the network to a secure payment gateway that transmits the data to a processor to complete the transaction authorization.  Encrypted data can be tokenized and returned to the merchant where it can be safely stored in the merchant's environment for future payment transactions.

Reduces PCI DSS validation scope 

By instantly encrypting data in motion rather than storing it within a business’ systems, PCI validated P2PE reduces the scope (and associated resources and costs) for PCI DSS compliance validation.     

P2PE solution providers offer a range of services that include: 

  • Managing the encryption process at the point of transaction (the first "point" in "point-to-point encryption")

  • Maintaining application security elements such as encryption software 

  • Managing effective installation and use of the provider's solution 

  • Monitoring decryption environment requirements concerning cryptographic security 

  • Managing cryptographic key operations that perform encryption and decryption 

A PCI-validated P2PE solution can help your business reduce the scope of PCI DSS compliance.

While encryption is a valuable tool in securing payment information, only PCI-validated P2PE solutions can effectively minimize your exposure to compliance violations and cybercrime. PCI DSS (Payment Card Industry Data Security Standards) apply to all companies that accept credit and debit cards.

A PCI-validated solution means the Payment Card Industry (PCI) Council has validated that the solution conforms to their security requirements. PCI-validated solution benefits include:

  • The highest level of innovative payment data security  

  • Reduces the scope, time and costs associated with PCI DSS compliance validation 

  • Brand reputation and payment card data security that meets the established PCI DSS security standard


If you’d like to learn more about how the right transaction security partner can help protect your customer payment data and your brand, we can help. Complete this form to have one of our specialists contact you.

Related content

Fight the battle against payments fraud

Fraud prevention checklist

Proactive ways to fight vendor fraud

Business risk management for owners of small companies

Avoiding the pitfalls of warehouse lending

5 Ways to protect your government agency from payment fraud

How to improve your business network security

The latest on cybersecurity: Mobile fraud and privacy concerns

Complying with changes in fund regulations

What is CSDR, and how will you be affected?

Cybersecurity – Protecting client data through industry best practices

Government agency credit card programs and PCI compliance

Post-pandemic fraud prevention lessons for local governments

Risk management strategies for foreign exchange hedging

Best practices on securing cardholder data

Turn risk into opportunity with supply chain finance

Cybercrisis management: Are you ready to respond?

Evaluating interest rate risk creating risk management strategy

Increase working capital with Commercial Card Optimization

Authenticating cardholder data reduce e-commerce fraud

Why Know Your Customer (KYC) — for organizations

Webinar: CRE technology trends

The password: Enhancing security and usability

BEC: Recognize a scam

Hospitals face cybersecurity risks in surprising new ways

Webinar: Robotic process automation

Hospitals face cybersecurity risks in surprising new ways

Evaluating interest rate risk creating risk management strategy

Authenticating cardholder data reduce e-commerce fraud


Start of disclosure content

Loan approval is subject to credit approval and program guidelines. Not all loan programs are available in all states for all loan amounts. Interest rates and program terms are subject to change without notice. Mortgage, home equity and credit products are offered by U.S. Bank National Association. Deposit products are offered by U.S. Bank National Association. Member FDIC.