Not long ago, a homeowner paid the plumber by check. Today, most home service companies take cards in the driveway, on a technician's phone, or through a link texted after the job. That's faster and more convenient for everyone.
It also means your company handles payment card data, and that brings the Payment Card Industry Data Security Standard, known as PCI DSS, into the picture. Here's what contractors need to know in plain language.
What Is PCI DSS?
PCI DSS is a set of security requirements created by the major card brands through the PCI Security Standards Council. Any business that accepts, processes, stores, or transmits payment card information is expected to follow it. Your obligation usually comes through your agreement with your payment processor or bank.
The current version is PCI DSS v4.0.1. Requirements that were marked as "future-dated" in version 4.0 became mandatory on March 31, 2025.
PCI DSS isn't a government law, but failing to meet it can lead to fees from your processor, higher costs after a breach, or even losing the ability to accept cards.
How It Applies to Most Contractors
Most home service companies are small merchants. That usually means:
- You complete a yearly Self-Assessment Questionnaire (SAQ) rather than a full audit.
- The specific SAQ depends on how you take payments.
- Your processor may provide a portal to complete and track it.
The way you accept cards makes a huge difference in how much work compliance takes. The less card data touches your systems, the simpler it gets.
Payment Methods, From Simplest to Riskiest
Card readers from your processor
Many modern mobile card readers encrypt card data the moment it's swiped, tapped, or inserted. Some are validated under the PCI point-to-point encryption (P2PE) program, which can significantly reduce your compliance scope.
Payment links and hosted pages
Texting or emailing a payment link that sends customers to your processor's secure page keeps card numbers off your devices entirely.
Card-on-file through your processor
Storing a customer's card for maintenance agreements is fine when the processor stores it using tokens. Your system keeps a reference number, not the actual card.
Typing card numbers into a phone or computer
Manually entering card numbers into a web browser or app on a shared office computer increases risk and scope.
Writing card numbers down
This is the riskiest practice. Card numbers on work orders, sticky notes, or spreadsheets are a common cause of compliance problems and breaches.
Practical Rules for Every Technician
- Never write down card numbers on paper work orders or notes.
- Never store the security code (CVV) for any reason.
- Never text or email card numbers to the office.
- Only use company-approved payment apps and readers.
- Keep devices locked with a PIN or fingerprint.
- Report a lost device or reader immediately.
Office Practices That Matter
- Use individual logins for payment and dispatch systems.
- Turn on multifactor authentication for payment platforms.
- Keep office computers updated and protected from malware.
- Shred any old paper records that contain card numbers.
- Review who has access to payment reports and refunds.
A Common Scenario
A customer calls the office to pay over the phone. A busy office assistant writes the card number on a notepad, then types it into the payment system later. The notepad sits on the desk for weeks.
The better approach: send the customer a secure payment link, or enter the card directly into the processor's virtual terminal while on the call, without writing it down. Then the number never lives anywhere in your office.
Where to Start
- Ask your processor which SAQ applies to your business.
- List every way your company accepts card payments.
- Eliminate any process that involves writing down or storing card numbers.
- Move toward encrypted readers, payment links, and tokenized card-on-file.
- Train technicians and office staff on the rules above.
Many businesses overlook requirements like these. We explore similar gaps in the compliance blind spot.
Make Payments Easy and Safe
The right payment setup protects customers, reduces your compliance workload, and gets you paid faster. Maise Technology helps contractors with compliance services and cybersecurity services sized for service businesses.
Want help reviewing how your company takes payments? Schedule A 15 Minute Discovery Call.
This article provides general information. Confirm your specific PCI DSS obligations with your payment processor or a qualified assessor.
