0

I have a credit card saved in X merchant. I only see the last 4 digits in the UI.

I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed transactions browser posts back my stored credit card information (PAN's 6 chars masked + expiry date) to the X merchant's website.

IMHO this is a security risk. I would not do this as a developer. But what about PCI DSS? Is this complies with PCI DSS?

The first six and last four digits are the maximum number of digits that may be displayed.

Reference

It looks like PCI DSS allows displaying PAN like this. But I could not find any information about masking expiry date. That's the point I have no answers.

enter image description here

0

Printing the expiration date on a receipt is a possible violation of the FACTA laws in the USA. But I don’t know if it’s a violation of the PCI DSS. Check with your QSA to find out if printing expiration date is allowed.

On the other hand, if there aren’t any valid reasons for printing it, don’t! I mean really important valid reasons, not just because marketing or fraud prevention thinks it would be a good idea.

0

But what about PCI DSS? Is this complies with PCI DSS?

It appears to. What you're seeing is referred to as Truncation as defined in the Guidance for §3.4:

The intent of truncation is to permanently remove a segment of PAN data so that only a portion (generally not to exceed the first six and last four digits) of the PAN is stored.

(It's also referred to as Masking, such as in §3.3.)

Transmitting that data appears to be governed by §4.2; I believe Truncation is an acceptable way to render unreadable (emphasis below is mine):

4.2.a If end-user messaging technologies are used to send cardholder data, observe processes for sending PAN and examine a sample of outbound transmissions as they occur to verify that PAN is rendered unreadable or secured with strong cryptography whenever it is sent via end-user messaging technologies.

However, it is possible the DSS is not the final word. For example, per §3.3, other requirements may apply to receipts. It is possible that one could argue that other requirements apply to this traffic. However, you'd need to know the legal and contractual obligations upon the merchant, which may vary widely.

Note: [Requirement 3.3 to mask PAN] does not supersede stricter requirements in place for displays of cardholder data—for example, legal or payment card brand requirements for pointof-sale (POS) receipts.

-1

No this is absolutely a violation of PCI. See the following:

https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf

I'm a former PCI penetration testing specialist. Best practices for storing credit card data is to not store it at all. But that's usually impossible, so next best answer is to store it securely using a high strength symmetric key encryption algorithm and have the encryption key stored in a FIPS-40 compliant manner or to use some trusted computing environment.

Most importantly the credit card data should never, ever be sent like that to the customer. At most the last 4 digits of the card can be sent for identification purposes, requiring the CVC on the back to use the saved card from their systems if you don't want to type the full card info in again. I'm sure with enough time the 6 digits could be extrapolated. They typically follow a pattern and there are no more than 9^6 combinations which in computing is not much. (531,441) to be exact.

Edit: With regards to the transmission of the card info, it is occuring even upon failed requests. You answered that part of the question yourself, that's not a correct behavior and should not be happening.

  • To clearify, the credit card data is sending to the customer by the BANK, after a 3D secure transaction failure. This virtual pos software (built by payten) is used by 9 major banks in Turkey. In this situation, I can not use stored cards to accomplish a 3d secure transaction because at the end of the transaction; bank's software leaking the card information to the customer. This situation makes no sense to me. – Oğuzhan Topçu May 3 at 21:12
  • Interesting, it constitutes a problem because it's also occuring in failed transaction responses and could potentially in some occasions be intercepted. – leaustinwile May 3 at 21:19
  • 2
    Actually truncating six digits is the accepted minimum in PCI DSS. See FAQ 1091: pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/… A correctly truncated PAN is generally not considered cardholder data - see FAQ 1117: pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/… – withoutfire May 4 at 21:05
  • So do we have any reference about whether we are allowed to show expiry dates to the customer? – Oğuzhan Topçu May 5 at 10:10
  • 1
    -1 because Storage != Transmission and it makes a difference here. – gowenfawr May 6 at 3:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.