What track data is
Track data is machine-readable payment-card information used to process a transaction. A reader captures it when a customer swipes a card, and the payment request carries relevant data through processing for authorization.
It is different from a magnetic stripe. The stripe is the physical band on a card; track data is the information encoded on it. The term can also cover equivalent track data held on a chip.
Track data is needed for payment processing, but full track data must not remain stored after authorization.
What Track 1 and Track 2 contain
Track 1 contains the card number, expiration date, service code and cardholder name. Track 2 contains a shorter set of information, including the card number, expiration date and service code, but not the name.
A payment reader and processing system use these fields to create an authorization request. Track data is not a separate card-processing fee, so it does not have a standard rate or fee line on your statement.
Why PCI DSS restricts storage
Track data includes sensitive authentication data. PCI DSS prohibits storing full track data after authorization, whether it is kept in a database, log, memory, or backup. Encrypting the data does not make post-authorization storage permissible.
The current PCI DSS version is v4.0.1. Its requirements include controls for protecting payment data, and a failure to validate compliance can lead to a monthly PCI non-compliance fee charged by your processor.
How exposed track data puts your business at risk
Someone who obtains usable track data can copy it onto counterfeit magnetic-stripe cards and attempt in-person purchases or ATM withdrawals. Skimmers at payment terminals and breaches of systems that handle card data are possible exposure paths.
A chip transaction uses dynamic data, which cannot simply be replayed as a copied stripe record. However, stored track data and magnetic-stripe fallback still create exposure. If your systems retain full track data after authorization, you face a compliance failure and added fraud response work.
What you can actually change
You do not control the data encoded on a customer's card, but you control how your payment systems handle it. Keep full track data out of post-authorization storage and limit the systems and people that can access payment data.
- Configure payment applications to discard full track data when authorization is complete.
- Check application logs, databases, memory handling and backups for retained track data.
- Limit access to payment systems and investigate unexpected magnetic-stripe transactions on chip-capable cards.
- Validate your PCI DSS controls and resolve any finding involving stored track data.
- Review data retention. Have your technical team confirm that full track data is removed after authorization and does not persist in backups.
- Check system logs. Inspect payment application logs and databases for full Track 1 or Track 2 records.
- Validate PCI controls. Confirm your PCI DSS validation covers every system that handles payment-card data.
Frequently asked questions
Is track data the same as a magnetic stripe?
No. A magnetic stripe is the physical band on a payment card, while track data is the machine-readable information encoded on it. The term can also include equivalent track data held on a chip.
Can a merchant store track data after authorization?
No. PCI DSS prohibits storing full track data after authorization, including in logs, databases, memory, or backups. Encryption does not make that storage permissible.
Does track data create a fee on my processing statement?
Track data is payment information, not a processing fee, and it has no standard fee line or rate. A separate PCI non-compliance fee can apply when your business has not validated compliance.