Which items are considered Sensitive Authentication Data?

Which items are considered Sensitive Authentication Data?

• A. Security-related information (including card validation codes/values, full track data, PINs, and PIN blocks) used to authenticate cardholders.
• B. Cardholder name
• C. Card expiration date
• D. Merchant category code

Answer: (A)

Sensitive Authentication Data refers to the security-related information that proves a cardholder’s identity during a payment. This includes card verification codes/values (CVV/CVC/CID), full track data from the magnetic stripe, and the PIN and PIN blocks. These elements are used to authenticate the cardholder and the card, so they are extremely sensitive and must not be stored after authorization. The other items—cardholder name, card expiration date, and merchant category code—are not used to authenticate the cardholder and are not considered Sensitive Authentication Data.

Sensitive Authentication Data refers to the security-related information that proves a cardholder’s identity during a payment. This includes card verification codes/values (CVV/CVC/CID), full track data from the magnetic stripe, and the PIN and PIN blocks. These elements are used to authenticate the cardholder and the card, so they are extremely sensitive and must not be stored after authorization. The other items—cardholder name, card expiration date, and merchant category code—are not used to authenticate the cardholder and are not considered Sensitive Authentication Data.