Anthony LaFaziaCEO, Atlantic Training · CEO at Atlantic Training | EdTech & Safety Compliance Leader

The Human Firewall: Daily Do's and Don'ts for PCI DSS Compliance

9 Jul 2026 · 2 min

Watch on YouTube

2:18

In this instructional segment, the presenter emphasizes that most data breaches stem from simple human mistakes rather than sophisticated hacking. He outlines critical operational rules derived from PCI DSS compliance policies: never store sensitive authentication data such as full magnetic stripe information or CVV/CVC codes after a transaction is authorized; only retain cardholder name and expiration date when a clear business justification exists, and the security code must be discarded immediately after approval. He advises staff to routinely inspect point‑of‑sale devices for skimmers—checking for wiggle, foreign plastic over the keypad, or hidden wires—and to report any anomalies. Additionally, he warns against transmitting credit‑card numbers via email, instant messenger, or text, directing employees to request a secure payment method and delete any insecure messages. The segment is punctuated by a brief promotional plug for Atlantic Training’s Wave management platform, which offers centralized HR and soft‑skill training, onboarding automation, and leadership development tracking.

Chapters

Now, let's move from the network to the desk. Most breaches don't happen because a hacker cracked a complex code. They happen because a human made a simple mistake. Here are the critical operational rules derived from standard compliance policies. The prime directive: Do not store sensitive authentication data. After a transaction is authorized, you must never store the sensitive authentication data. This specifically refers to the full magnetic stripe data or the 3 or 4-digit security code, CVV or CVC, on the back of the card.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses, all hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom plan now.
You can store the cardholder's name and the expiration date if there is a business justification, but that security code is strictly for real-time authorization. Once the transaction says approved, That code must disappear from our systems. Criminals often use skimmers, devices attached to legitimate card terminals to steal data. Make it a habit to inspect your point-of-sale devices. Does the card reader wiggle? Does it look like there is a piece of plastic stuck over the keypad? Are there hidden wires? If something looks or feels different, do not use it. Report it. Never send credit card numbers via email, instant messenger, or text. These communication channels are generally not encrypted or secure. If a customer emails you their credit card number to pay a bill, do not process it. Contact them, explain that email is unsafe, and delete the email immediately from your deleted items folder.