Under PCI DSS, what qualifies as a Payment Card?

• A. Any device that processes transactions at a checkout counter.
• B. Any payment card or device bearing the logos of the founding PCI SSC members.
• C. A token used to authorize card-not-present transactions.
• D. A virtual card number used for online shopping.

Answer: (B)

Under PCI DSS, a Payment Card is identified by the networks that issue and brand the card. If a card or device bears the logos of the founding PCI SSC members (Visa, MasterCard, American Express, Discover, and JCB), it is recognized as a payment card within the PCI scope. Tokens or virtual numbers are representations used to protect card data and authorize transactions, but they are not the card itself bearing a network logo. Likewise, a device that processes transactions isn’t a card. So the presence of the official payment-brand logos on the card or its device is the defining factor, which is why this option is the best fit.