0

In providing first 4 and last 4 number of credit card to vendor safe, considering you dont provide the expiration date or CVV2 number?

  • Depends. If they're storing the full number (potentially in violation of PCI), and using this to verify that you know bits of it, this specific transfer of information is safe, but the overall picture isn't. If they're using this to verify a tokenised card number provided by a merchant account provider, it's probably fine. If they don't have the other digits at all, I'm not sure why they'd ask for these bits... – Matthew Apr 4 '17 at 12:32
  • 1
    Do you mean you, as a cardholder, providing 4+4 to a merchant? Safe, but pointless. – gowenfawr Apr 4 '17 at 12:59
  • 2
    The first 4 digits are constant (per provider) and well-known, the last 4 are considered "public" (inasmuch as they appear on most receipts). Whether or not this is "safe", depends on more context... Such as what you mean by "safe". – AviD Apr 4 '17 at 13:59
4

Per PCI-DSS Req. 3.3 You are allowed to display at most the first 6 and last 4.

This is typically not needed (most software just use the last 4).

I've seen a lot of app companies take the stance that they need the PAN digits to find transactions, however, this is usually because the of the poor implementation of the software and most of the industry has moved on to providing tokens.

It's not really a security thing other than to check that the full PAN is not stored anywhere.

Note:

Some states/cities have recipient requirements requiring "4 and 4" or "6 and 4", or only 4. E.G New York

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.