What is the requirement on images of expired card numbers? The images are over ten years old. If the data is old do I still need to encrypt the data?

  • If the data isn't of use anymore (expired) why bother holding on to it? – Daisetsu Jan 24 at 0:20

PCI DSS doesn't discriminate between expired and active card numbers; it simply says that PAN (the Primary Account Number) being present is what triggers the need for protection:

The primary account number is the defining factor for cardholder data. If cardholder name, service code, and/or expiration date are stored, processed or transmitted with the PAN, or are otherwise present in the cardholder data environment (CDE), they must be protected in accordance with applicable PCI DSS requirements.

You can ask your QSA for an official opinion, but lacking explicit guidance, I suspect most will agree.

An analogous situation would be synthetically generated card numbers (e.g. http://www.getcreditcardnumbers.com/, https://ccardgenerator.com/). No QSA I've ever dealt with recognized the legitimacy of such card numbers as test data; the card brands do not recognize them as test data. They are mod-10 legitimate PAN numbers, therefore, they could intersect with a live (issued, non-expired) PAN and are, as such, "real credit card numbers". The card number itself is the minimum required to make a charge, so PAN is PAN.

The flip side of the coin is - for whatever purpose are you keeping images of decade-old card numbers? If the data is so useless as to not require protection, what use are you putting it to? You may wish to re-architect your flow to remove the need for this data.

  • 1
    Given that many providers keep the same PAN when the card is renewed as long as the card wasn't breached, and renewals happen at fairly regular intervals so it wouldn't be hard to extrapolate the new expiry date, I'd imagine that expired cards are still sensitive information. – nbering Jan 24 at 1:36

These are expired cards, and not valid. I can find no where in the DSS where it regulates the storage of non-valid Credit Card information. I would check with your PCI auditor, but I believe you are fine. I think it's worth saying that it's probably good practice to destroy these if not needed or required by some other standard like HIPPA. There is no requirement for data retention time specific to PCI, just an expectation of having policies in place to deal with this. See page 36, Requirement 3.1-3.1.b

If any of them are not expired (so better be sure), per the pci dss 3.2.1, you can not retain CC information with full PAN, it has to be encrypted or truncated. So again, I would destroy them if possible. If not, verify all are actually expired, and if you can't be sure they are expired then they need to be stored and transmitted encrypted.

  • PCI does not recognize the concept of non-valid Credit Card information, to them all card-compatible numbers are PAN. For example, they do not recognize the use of synthetically generated cards as test data because any mod-10 card formatted number is equivalent to PAN; any mod-10 card you generate could intersect with a "real" issued card number, and card number alone is the minimum required to make a charge. So just because they don't explicitly mention it, I don't imagine they consider expired cards "un-regulated". – gowenfawr Jan 24 at 14:22
  • @gowenfawr they should probably put it in the DSS then, huh? :) – bashCypher Jan 24 at 17:29
  • that would not be in keeping with their general M.O. The DSS provides limited guidance, the QSAs determine compliance. If you spelled everything out it would be harder to enforce :) – gowenfawr Jan 24 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.