I have a credit card saved in X merchant. I only see the last 4 digits in the UI.

I have launched a 3D secure payment transaction by using my saved card. Then I have noticed that even in the failed transactions browser posts back my stored credit card information (PAN's 6 chars masked + expiry date) to the X merchant's website.

IMHO this is a security risk. I would not do this as a developer. But what about PCI DSS? Is this complies with PCI DSS?

The first six and last four digits are the maximum number of digits that may be displayed.


It looks like PCI DSS allows displaying PAN like this. But I could not find any information about masking expiry date. That's the point I have no answers.

enter image description here


4 Answers 4


Please refer to this table. Note the footnote. As I read it, the expiration needs to be protected only when stored in conjunction with the full PAN. Since the PAN is masked, it's okay to display or transmit the expiration date.

PCI Table

See also this question on Stackoverflow.


But what about PCI DSS? Is this complies with PCI DSS?

It appears to. What you're seeing is referred to as Truncation as defined in the Guidance for §3.4:

The intent of truncation is to permanently remove a segment of PAN data so that only a portion (generally not to exceed the first six and last four digits) of the PAN is stored.

(It's also referred to as Masking, such as in §3.3.)

Transmitting that data appears to be governed by §4.2; I believe Truncation is an acceptable way to render unreadable (emphasis below is mine):

4.2.a If end-user messaging technologies are used to send cardholder data, observe processes for sending PAN and examine a sample of outbound transmissions as they occur to verify that PAN is rendered unreadable or secured with strong cryptography whenever it is sent via end-user messaging technologies.

However, it is possible the DSS is not the final word. For example, per §3.3, other requirements may apply to receipts. It is possible that one could argue that other requirements apply to this traffic. However, you'd need to know the legal and contractual obligations upon the merchant, which may vary widely.

Note: [Requirement 3.3 to mask PAN] does not supersede stricter requirements in place for displays of cardholder data—for example, legal or payment card brand requirements for pointof-sale (POS) receipts.


Printing the expiration date on a receipt is a possible violation of the FACTA laws in the USA. But I don’t know if it’s a violation of the PCI DSS. Check with your QSA to find out if printing expiration date is allowed.

On the other hand, if there aren’t any valid reasons for printing it, don’t! I mean really important valid reasons, not just because marketing or fraud prevention thinks it would be a good idea.


No this is absolutely a violation of PCI. See the following:


I'm a former PCI penetration testing specialist. Best practices for storing credit card data is to not store it at all. But that's usually impossible, so next best answer is to store it securely using a high strength symmetric key encryption algorithm and have the encryption key stored in a FIPS-40 compliant manner or to use some trusted computing environment.

Most importantly the credit card data should never, ever be sent like that to the customer. At most the last 4 digits of the card can be sent for identification purposes, requiring the CVC on the back to use the saved card from their systems if you don't want to type the full card info in again. I'm sure with enough time the 6 digits could be extrapolated. They typically follow a pattern and there are no more than 9^6 combinations which in computing is not much. (531,441) to be exact.

Edit: With regards to the transmission of the card info, it is occuring even upon failed requests. You answered that part of the question yourself, that's not a correct behavior and should not be happening.

  • To clearify, the credit card data is sending to the customer by the BANK, after a 3D secure transaction failure. This virtual pos software (built by payten) is used by 9 major banks in Turkey. In this situation, I can not use stored cards to accomplish a 3d secure transaction because at the end of the transaction; bank's software leaking the card information to the customer. This situation makes no sense to me. May 3, 2019 at 21:12
  • Interesting, it constitutes a problem because it's also occuring in failed transaction responses and could potentially in some occasions be intercepted. May 3, 2019 at 21:19
  • 2
    Actually truncating six digits is the accepted minimum in PCI DSS. See FAQ 1091: pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/… A correctly truncated PAN is generally not considered cardholder data - see FAQ 1117: pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/… May 4, 2019 at 21:05
  • So do we have any reference about whether we are allowed to show expiry dates to the customer? May 5, 2019 at 10:10
  • 2
    -1 because Storage != Transmission and it makes a difference here.
    – gowenfawr
    May 6, 2019 at 3:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .