{"id":44924,"date":"2025-03-20T08:54:21","date_gmt":"2025-03-20T08:54:21","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=44924"},"modified":"2026-03-13T13:12:44","modified_gmt":"2026-03-13T13:12:44","slug":"the-state-of-pci-dss","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/the-state-of-pci-dss\/","title":{"rendered":"EasyDMARC Research Examines State of PCI DSS Compliance in 2025"},"content":{"rendered":"\n

As cyberattacks rise and phishing remains a major threat, regulations are growing more rigorous to strengthen security. Companies involved in financial transactions face numerous compliance requirements, one of which is PCI DSS. With the upcoming 31 March 2025 deadline for PCI DSS v4.0.1 compliance, EasyDMARC conducted research to gauge how prepared businesses are. This report sheds light on the worrying gaps in email security, specifically DMARC adoption, despite growing regulatory pressure.<\/p>\n\n\n\n

The Payment Card Industry Data Security Standard (PCI DSS) was introduced in 2004 to protect payment transactions and prevent fraud. Since then, this framework has undergone multiple revisions to address evolving cyber threats. The latest version, PCI DSS v4.0.1, enforces stricter security controls, including email authentication measures, to combat phishing and spoofing attacks. However, EasyDMARC\u2019s research indicates that while many companies claim to be prepared, their actual readiness, particularly regarding DMARC implementation, is lacking.<\/p>\n\n\n\n

\n
Download our PCI DSS Report<\/a><\/div>\n<\/div>\n\n\n\n

The State of PCI DSS in 2025<\/h2>\n\n\n\n

EasyDMARC\u2019s study surveyed 502 IT decision-makers across various industries impacted by PCI DSS v4.0.1, including financial services, retail, and e-commerce. Our findings suggest gaps between organizations’ stated compliance and their actual security measures. While 72% of companies that process their own payments state they are ready for PCI DSS v4.0.1, only 38% have implemented DMARC, exposing them to phishing threats and compliance risks. Many organizations remain unaware of the mandatory email security measures outlined in the new standard, underscoring the need for increased education and enforcement.<\/p>\n\n\n\n

Download the Full Report<\/a><\/p>\n\n\n\n

Phishing Attacks Continue to Rise<\/h3>\n\n\n\n

Phishing remains one of the most significant cyber threats, particularly for organizations handling payments. EasyDMARC\u2019s research found that 64% of businesses experienced an increase in phishing attacks over the past year, with 25% reporting a significant surge. Cybercriminals frequently target merchants and financial institutions to steal sensitive payment data, making email security a crucial line of defense.<\/p>\n\n\n\n

\"Increase<\/figure>\n\n\n\n

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a powerful tool against phishing attacks. By authenticating emails, DMARC prevents unauthorized parties from impersonating legitimate domains. However, despite its effectiveness, adoption remains low, leaving many companies vulnerable.<\/p>\n\n\n\n

Organizations Remain Unfamiliar with DMARC<\/h3>\n\n\n\n

Despite DMARC\u2019s inclusion in PCI DSS v4.0.1, most organizations remain unaware of how it works. The report found that only 40% of companies processing their own payments are very familiar with DMARC requirements, while 19% admitted to lacking knowledge on the subject.<\/p>\n\n\n\n

Many businesses mistakenly believe that compliance responsibilities fall solely on third-party payment providers, leading to a false sense of security. In reality, PCI DSS mandates that all merchants secure their payment-related communications to mitigate phishing risks. The widespread lack of awareness highlights the urgent need for DMARC education and industry-wide enforcement.<\/p>\n\n\n\n

DMARC Adoption Remains Low<\/h3>\n\n\n\n

Despite its critical role in securing email communications, DMARC adoption remains sluggish. Currently, only 38% of companies have implemented DMARC, while 48% plan to do so in the near future. However, 14% have no plans to implement DMARC at all, exposing themselves to heightened phishing risks and potential compliance penalties.<\/p>\n\n\n\n

\"Organizations<\/figure>\n\n\n\n

The slow adoption rate can be attributed to several factors:<\/p>\n\n\n\n