Unless you are a big company, PCI-DSS is "verified" by self-assessment. They can say whatever they want.