I am using an ecommerce website that accepts and stores CC information. In the webpage, they show only the last 4 digits (which is perfectly fine). But when I intercept the request/response, I could see the complete CC number as part of one API response. Anyways they don't show security code/CVV.
- Does sending complete CC number to end user violate PCI compliance?
- What are the issues this might cause? I could think of only one scenario - If the account is compromised, attacker can get the complete card number and he can brute force the CVV or use the number on sites that doesn't require CVV.