4

If we transmit 16 digit card number from a service provider to my application then PCI DSS is applicable.

But if we use (transmit/store) only the first 6 and last 4 digits of the card number and expiration date, then are we required to comply with PCI DSS?

  • I am not a QSA but I have done some PCI DSS assessments in the past. As long as the full credit card number does not flow and is stored in your system you should be good. Having said that, I think it's quite easy to guess the missing 6 digits. – Jeroen Sep 1 '17 at 7:20
  • 1
    PCI DSS explains in detail when you need to comply. Have you read through their document? – schroeder Sep 1 '17 at 10:37
2

From a PCI DSS standpoint it is not considered "Cardholder Data" unless it includes the full Primary Account Number (the 16 digit card number) so if that never touches your systems then they are indeed out of scope.

If you are looking at it beyond purely PCI then I would look at whether you actually need that much - transmitting/storing the first six and last four leaves only 10,000 possible combinations to get the "full" PAN, there is still some work to go from there to get sufficient details to "steal" the card but unless you have a specific reason for needing that much of the PAN why do it?

| improve this answer | |
  • I know of at least one e-payment/credit card payment service company that will return the first-6-and-last-4-digits as an 'ID/token' once you send them a credit card number for processing. – fgysin reinstate Monica Aug 14 '18 at 7:57
2

If you accept credit cards as payment, you must comply with PCI DSS. How you accept credit cards determines at what level. For instance, if you have a swipe terminal that connects to a POTS line and none of it touches your network, you are still required to abide by PCI and do a Self Assessment Questionnaire. Each SAQ begins with a section that reads "Before you Begin" that walks you through which one fits.

PS If you fully outsource the processing of credit card data to a 3rd party, you still must complete an SAQ-A report.

| improve this answer | |
  • Wish I could upvote this more than once. I can't count the number of times I've heard "we use a CC processor, so we can gleefully ignore PCI". It's not true. – KJ Seefried Mar 29 '18 at 19:50
1

No. A truncated (ie first 6 last 4 only) PAN does not need to be protected by PCI DSS. (I once was a QSA).

There's a really clear FAQ on the PCI SSC website: https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/Are-truncated-Primary-Account-Numbers-PAN-required-to-be-protected-in-accordance-with-PCI-DSS

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.