ATPCO Ticket Exchange

Sales Data Exchange System Specification and Implementation Guide Sections 1–6: General Information
Section 5.5 ATPCO Processing and Credit Card Data Security
ATPCO processing is built to take account of the sensitivity of passenger credit card information that may
appear on the processed sales record. In order to protect the credit card information, ATPCO processing
performs the following steps:
(1) All inbound files containing sales data are scanned for certain triggers which indicate that credit
card information may be present in the transaction.
(2) All inbound files are Secure Zipped and securely locked down.
(3) Where credit card data is found, characters are encrypted based on the following methodology:
a. If Form of Payment Type (FPTP) = CC, CH, CL, DF, DT, EF, PB, TC or VD, then encrypt
the related FPAC bytes 7-19.
b. If any Form of Payment Type (FPTP) = CC, CH, CL, DF, DT, EF, PB, TC, VD, or EX,
then encrypt all instances of FPIN bytes 1-50.
c. If any Form of Payment Type (FPTP) = CC, CH, CL, DF, DT, EF, PB, TC, VD, or EX,
scan the Fare Calculation Area (FRCA) fields for recognizable credit card number
patterns, and encrypt bytes 7-14 of the number found. Note that this generally occurs
only for US-issued ATB1 ticket (or ATB1 E-ticket) stock.
(4) The encryption key is securely stored and is accessible only to an administrator.
(5) The original plain text file is deleted from ATPCO servers in the FTP job.
The above steps mean that no credit card information is available to ATPCO employees at any time.
For any ATPCO employee to view any sales data file (for example to analyze issues with customer data),
a data masking utility must be run so that the credit card information is completely destroyed.
The sales data is either decrypted during the outbound FTP process (and the original deleted), or (based
on customer preference) the decrypted characters are each replaced with a letter X, otherwise known as
masking, to completely destroy the credit card data references.
ATPCO also encourages secure transmission of data, and authorizes the following methods for
transmission of sales data into ATPCO:
(1) Private circuit
(2) Secure Socket Layer FTP (FTPS)
(3) Secure Zip file transmission
(4) Sender masks data before transmission
The following methods are encouraged for secure receipt of sales data:
(1) Private circuit
(2) Secure Socket Layer FTP (FTPS)
(3) Secure Zip file transmission (this data may also be pulled)
(4) Customer chooses masked data output
At time of publishing, ATPCO is working toward compliance with all twelve of the Payment Card Industry
Data Security Standards (PCI DSS) in order to minimize the risk of data loss.
22 November 2007