0

In providing first 4 and last 4 number of credit card to vendor safe, considering you dont provide the expiration date or CVV2 number?

Improve this question
3
  • Depends. If they're storing the full number (potentially in violation of PCI), and using this to verify that you know bits of it, this specific transfer of information is safe, but the overall picture isn't. If they're using this to verify a tokenised card number provided by a merchant account provider, it's probably fine. If they don't have the other digits at all, I'm not sure why they'd ask for these bits...
    – Matthew
    Apr 4, 2017 at 12:32
  • 1
    Do you mean you, as a cardholder, providing 4+4 to a merchant? Safe, but pointless.
    – gowenfawr
    Apr 4, 2017 at 12:59
  • 2
    The first 4 digits are constant (per provider) and well-known, the last 4 are considered "public" (inasmuch as they appear on most receipts). Whether or not this is "safe", depends on more context... Such as what you mean by "safe".
    – AviD ♦
    Apr 4, 2017 at 13:59

1 Answer 1

Reset to default
4

Per PCI-DSS Req. 3.3 You are allowed to display at most the first 6 and last 4.

This is typically not needed (most software just use the last 4).

I've seen a lot of app companies take the stance that they need the PAN digits to find transactions, however, this is usually because the of the poor implementation of the software and most of the industry has moved on to providing tokens.

It's not really a security thing other than to check that the full PAN is not stored anywhere.

Note:

Some states/cities have recipient requirements requiring "4 and 4" or "6 and 4", or only 4. E.G New York

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .