For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login.
Would this be a violation of PCI DSS 3.3 or not as the validity of the PAN is unknown?
PCI DSS 3.3 "Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed)"
Just to fill in the blanks a little more, many Canadian banks use PAN's and a password for logging into online banking. In most cases the PAN are not masked during the initial login. Thinking more on this, I suppose there is no real added risk to returning the PAN on a failed login if its entered in the clear initially. However I can see now that this is probably not best practice either. In order to protect from shoulder surfing, which is the risk in this scenario, the PAN should be treated similar to a password and masked on entry, and not returned either on failed login.