Last week, 637 delegates gathered in Edinburgh for the PCI Security Standards Council’s Europe Community Meeting, representing the full payments lifecycle from merchants to processors, acquirers and card brands, to assessors and solution providers.

The meeting marked the 20th anniversary of the Payment Card Industry Data Security Standard (PCI DSS), with an agenda that looked back as much as forward.

Looking back, the first 20 years

PCI DSS was introduced to protect card data from theft and misuse, and the success of the standard can be seen in fraud trends since its introduction in 2006.

For card-present transactions, PCI DSS reduced the volume of card data stolen from merchant and processor systems, and EMV made what was stolen far harder to turn into a working counterfeit card. In combination, these have reduced fraud from counterfeit cards by c. 90% across Europe and US over the last 20 years.

The early success of PCI DSS and EMV together pushed fraud to card-not-present channels. Successive versions of PCI DSS brought in controls to mitigate CNP risks and encouraged merchants to outsource CNP processing to specialist providers. PCI DSS v4.x took further steps to limit ecommerce fraud, introducing controls over the scripts that run on payment pages.

According to Verizon’s 2024 Payment Security Report there has been no disclosed public records of any organization experiencing a confirmed payment card data breach that was found to be in full compliance with the requirements at the time of the breach since the standard was introduced.

Looking ahead, the next 20 years

The PCI DSS framework is as relevant now as it was 20 years ago, because it rests on fundamental principles that remain valid as technology evolves. Within that framework, the controls change as the threat landscape shifts, to ensure its continued effectiveness.

Planning for the next evolution of PCI DSS is in progress, with the PCI SSC unveiling its timeline for feedback and development of the standard over the next 2-3 years.

In Edinburgh, the Council shared two likely changes expected in the next release of the PCI DSS:  bringing tokens into scope alongside PAN, and bringing parts of the PCI 3DS Core and TSP requirements into the PCI DSS itself.

A token that can initiate a payment can be used for fraud in much the same way as a card number. The Council flagged this risk as far back as its 2011 tokenization guidance, which said high-value tokens may fall within PCI DSS scope even though they cannot be used to recover the PAN.

Separately, consolidating 3DS and TSP requirements into PCI DSS aims to reduce duplication for entities currently assessed against several standards.

AI and quantum computing are obvious candidates for a future version, but in both cases the technology needs to settle before prescriptive controls can be meaningfully defined. In the meantime, the PCI SSC’s Security Considerations for AI Systems information supplement provides guidance for complying under the current version of the standard.

Harvest-now-decrypt-later attacks mean encrypted account data and key material captured today are at risk once quantum decryption becomes practical. PCI DSS v4.x already requires an annual review of the cryptographic cipher suites and protocols in use, which gives organizations the inventory they will need for migration. What post-quantum controls should look like across payment-specific cryptography, including HSMs, PIN security and key management, is still being worked out.

The most open question is whether PCI DSS should extend beyond cardholder data. The strongest case for extension is that the controls are largely data-agnostic and apply just as well to other types of sensitive information such as personal data. The fraud figures support it too, since some of the largest losses now involve no card data at all.

Payment security for the present and future

Until the next version arrives, v4.0.1 will remain the standard organizations are assessed against. Whatever the next version of PCI DSS brings, organizations can’t protect, minimize or scope data they don’t know about. That’s true for PAN today, for payment tokens next and for any other sensitive data the standard takes on.

Where could unexpected cardholder data be sitting in your environment, and how would you know? Answer both before your next scope revalidation. Book a meeting and let us help you find out.