11

I'm wondering if the following masking of credit card would be considered PCI compliant. 

######??????#### 

# Is plaintext 
? is redacted

Expiration date is available in plaintext

Is it reasonably feasible to infer the original unmasked # using the combination of the 10 available digits along with the expiration date?

Improve this question

1 Answer 1

Reset to default
24

Typically, it's just the last 4 that are shown to the customer, sometimes the first 6.

From the PCI DSS 3.4 Standards

Never store the personal identification number (PIN) or PIN Block. Be sure to mask PAN whenever it is displayed. The first six and last four digits are the maximum number of digits that may be displayed. This requirement does not apply to those authorized with a specific need to see the full PAN, nor does it supersede stricter requirements in place for displays of cardholder data such as on a point-of-sale receipt.

Improve this answer
2
  • 8
    Perfect, but I will add that, with very few exceptions, there is no reason to store the PAN or any other direct account information. Every gateway will return a transaction ID, and that's all you will ever need. Storing the PAN will require a totally different level of security that most sites (including major ones like amazon) can not pass (nor would they want to). Even if you want to "store for later" many gateways will do this just fine, without the need to store the PAN.
    – coteyr
    Jul 19, 2016 at 18:22
  • We use an external payment provider, which returns the masked cardnumber as XXXXXXXXXXXX1234. We never se the actual card number or dates, only the transaction number.
    – Lenne
    Jul 19, 2016 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .