I have a fraud detection system.
From the client side (browser) I want to receive the store BIN section of the card number (first 6 digits) and if possible also the last 4 digits
Besides the above, I do not process or store credit card number (or any other payment method). I also don't process or store any personal information (don't get user name / email / ID number etc.)
So, my question is: In my case as described above, if only storing the first 6 digits (and if possible also the last 4) - do I need to comply with any PCI (or other regulation) requirements?
It seems that storing only a fragment of the whole PAN is not under the scope of PCI (https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/Are-truncated-Primary-Account-Numbers-PAN-required-to-be-protected-in-accordance-with-PCI-DSS), unless my systems is considered as a "connected system". So, if the client side where the user fills the credit card number, sends to my system only the BIN - should my system be considered as a "connected system" ?