Is instant messaging and chat in scope of PCI DSS requirement 4.2?
PCI DSS requirement 4.2 prohibits the sending of primary account numbers (PANs) via unencrypted email, whether sent internally or over public networks. Instant messaging and chat should be considered an alternative mechanism of email and thus required to meet PCI DSS requirement 4.2 Per PCI DSS requirement 4.1, strong cryptography and security protocols should be used when cardholder data is sent over open, public networks. As a reminder, under no circumstances should sensitive authentication data such as the card validation codes and values (CAV2, CID, CVC2, CVV2) be stored after obtaining authorization.
