Which data element from the magnetic stripe should not be stored after authorization?

Which data element from the magnetic stripe should not be stored after authorization?

• A. Cardholder's name
• B. Full track data from magnetic stripe
• C. PAN
• D. Expiration code

Answer: (B)

Storing the full magnetic stripe data after authorization is prohibited because it contains sensitive authentication data that PCI DSS forbids retaining once authorization is complete. The track data on the stripe includes the complete set of credentials needed to reproduce the card’s data, creating a high risk if it’s stolen. That’s why the full track data should never be stored after authorization. You may retain other cardholder data, such as the PAN, cardholder name, and expiration date, as long as the PAN is protected (encrypted or tokenized) and you follow PCI DSS data protection and retention rules. The expiration date is not in itself sensitive authentication data and can be stored, unlike the full track data.

Storing the full magnetic stripe data after authorization is prohibited because it contains sensitive authentication data that PCI DSS forbids retaining once authorization is complete. The track data on the stripe includes the complete set of credentials needed to reproduce the card’s data, creating a high risk if it’s stolen. That’s why the full track data should never be stored after authorization. You may retain other cardholder data, such as the PAN, cardholder name, and expiration date, as long as the PAN is protected (encrypted or tokenized) and you follow PCI DSS data protection and retention rules. The expiration date is not in itself sensitive authentication data and can be stored, unlike the full track data.