What Changed in PCI DSS 4.0
PCI DSS 4.0 replaced version 3.2.1 in March 2022, introducing a risk-based model and continuous compliance requirements. The March 31, 2025 deadline has now passed, making full compliance mandatory for all merchants and service providers. For travel businesses, 2026 represents the first full year of enforcement — and regulators are watching closely.
The most significant changes for travel merchants include:
- Continuous monitoring and quarterly testing. Businesses must now conduct regular penetration tests, not annual reviews.
- Mandatory multi-factor authentication (MFA). Every administrator with access to the cardholder data environment must use MFA.
- Daily tamper checks. Websites that handle bookings or online payments must detect and report any unauthorized scripts or data injections.
- Enhanced tokenization. Full primary account numbers (PANs) can no longer be stored in spreadsheets, PMS exports, or unencrypted documents.
- Expanded scope. OTA integrations, GDS links, and cloud-based PMS systems are now explicitly covered.
In practice, PCI 4.0 turns payment compliance from a paperwork exercise into a continuous operational discipline. According to McDermott Will & Emery, organizations must also implement automated technical solutions for public-facing web applications to continually detect and prevent web-based attacks.
Why Travel Merchants Are High-Risk Targets
The travel industry faces unique compliance pressures. According to Antravia Advisory, roughly 80% of hotel bookings involve remote card payments, and 40% of B2B payments now rely on Virtual Credit Cards (VCCs). At the same time, data breaches in hospitality have surged, costing an average of $4.5 million per incident according to IBM’s 2025 report.
Yet compliance gaps remain widespread:
- Nearly one in three hotels still depend on manual PCI procedures
- Fewer than 20% have full tokenization of virtual cards
- Many travel agencies lack proper segmentation of cardholder data environments
The result is unnecessary risk — not just of fines (which can exceed $100,000 per month) but also merchant account freezes and reputational damage from chargebacks and cardholder disputes.
Virtual Credit Cards: The Hidden Compliance Challenge
Virtual Credit Cards are now a critical part of B2B travel. They should make reconciliation easier and fraud harder — but only when properly managed. The same tokenization that makes them convenient also introduces compliance risk if data handling is not airtight.
Under PCI DSS 4.0, VCCs must be treated exactly like physical cards: encrypted, tokenized, and restricted to MFA-secured environments.
Common VCC Risk Points
- Fake VCC issuance — fraudulent cards submitted through compromised OTA accounts
- Ghost reservations — bookings with invalid or expired virtual card numbers
- Duplicate charges — cards used across multiple transactions without proper authorization tracking
Practical Defenses
- Require issuer verification through authenticated APIs (e.g., Amex vPayment, Mastercard Easy PSP)
- Match each VCC to the booking reference automatically in your PMS
- Use real-time authorization holds at check-in to prevent duplicate or expired charges
- Capture digital folios and e-signatures at checkout to resolve future disputes
Antravia’s 2025 benchmarks found that tokenized, PCI 4.0-compliant travel businesses paid 1.8% average interchange fees, compared with 2.9% for non-compliant merchants.
Compliance is Not Just IT’s Problem
A critical misconception persists that PCI DSS is solely a technology standard. McDermott Will & Emery emphasizes that achieving compliance requires a collaborative approach involving multiple departments: legal, compliance, procurement, vendor management, and IT security.
Key obligations now include:
- Annual scope documentation — defining all system components, people, and processes that interact with cardholder data
- Payment page script controls — preventing unauthorized modifications to consumer-facing payment scripts
- Third-party service provider monitoring — enhanced oversight of processors, gateways, and OTA integrations
- Targeted risk analyses — granular assessments to identify specific vulnerabilities
Building Compliance Into Daily Operations
1. Map and Segment Your Data Environment
Start with a cardholder data flow map showing exactly where card data enters, moves, and is stored — from your PMS to OTA interfaces and payment gateways. Segregate card-processing systems from general networks like Wi-Fi or email servers.
If your system handles live card data, complete Self-Assessment Questionnaire (SAQ D). If it is fully tokenized (e.g., Stripe or Adyen integrations), you may qualify for SAQ A or A-EP, significantly reducing scope.
2. Secure and Automate Core Processes
Enable MFA across all systems, including PMS, booking engines, and email platforms used for invoicing. Deploy tokenization for all virtual card transactions. Block unencrypted card storage at every level.
3. Monitor and Test Continuously
PCI 4.0 requires ongoing testing, not annual certification. Travel merchants must:
- Run internal and external penetration tests every quarter
- Perform daily tamper checks on payment pages
- Conduct annual Reports on Compliance (ROCs) for Level 1 merchants
- Reconcile VCC transactions monthly and investigate mismatches immediately
Key Takeaways
- PCI DSS 4.0 is now fully enforced — the March 31, 2025 deadline has passed, making all 64 new requirements mandatory
- Travel merchants are high-value targets — with 80% of bookings card-not-present and VCC usage at 40%, the attack surface is significant
- Compliance is a competitive advantage — compliant merchants see interchange fees drop from 2.9% to 1.8% and chargeback rates fall from 1.8% to 0.6%
- It’s not just IT — legal, compliance, procurement, and vendor management all have roles in maintaining PCI 4.0 standards
- Third-party risk is your risk — outsourcing card functions does not relieve merchants of PCI DSS obligations
In a sector where reputation and trust directly drive bookings, compliance has become a competitive differentiator. The winners will be the businesses that treat security as strategy, not paperwork.
