Display Full Credit Card Number and PCI compliance

Question

I've been reading through PCI compliance rules to see if it is ever PCI compliant to display the full credit card number on a webpage to a user. I've found some info about paper receipts and rules dictating which digits are visible in the card number. But there is also this blurb from the PCI Security Standards Do's and Don'ts document:

Do not store cardholder data unless there is a legitimate business need; truncate or mask cardholder data if full PAN is not needed and do not send PAN in unencrypted emails, instant messages, chats, etc..

In my scenario, I have a PCI compliant way to accept card information and a PCI compliant way to store this information (through an external site). I'm wondering if it is PCI compliant to display this information to the merchant that will be processing this card with their own payment system. They would view this information after logging into a secure site with the data being retrieved from another site through an HTTPS GET request.

Answer 1

The PCI DSS permits the display of card holder data for valid business purposes - but that comes with taking on full liability and penalties if any of your customers' cards are misused for fraud. Such display puts you directly in harm's way, and from a risk avoidance viewpoint I would very strongly discourage your implementation of this function.

If you do choose to display card holder data, there are many additional rules around authentication, logging, auditing, etc., that you will need to follow. Plus, there is data you must not store and therefore cannot display, such as CVV. Anyone using your data will be paying the maximum interchange rate for Cardholder Not Present (CNP) transactions.

At least check with your QSA to see what they will require of you before you start down this path. The cost of implementing it, plus the tremendous risk you will take on should give your upper management a lot to think about before approving a system like this.