Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the details for the instantly granted (approved) Credit card so that customer can start using it for eCommerce?


IANAQSA, and you seem to be getting into the Issuer business. You really need a QSA.

You are asking about the requirements upon issuers (most PCI-DSS questions are from the POV of merchants, acquirers, and processors; the other side of the equation).

Issuers are also held to the PCI-DSS, but obviously they have different constraints. For example:

3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only personnel with a legitimate business need can see more than the first six/last four digits of the PAN.

For an issuer, it is a legitimate business need to communicate a cardholder's card number to them. Most commonly, this is done by shipping a plastic card to the cardholder's mailing address. So Issuers clearly get a pass on the requirement to Mask per 3.3 when business need requires them to disclose the full card number.

You're asking about virtual / electronic only cards, and there is precedent that Privacy.com displays full card data - PAN, expiration, and CVV - as soon as a user allocates themselves a new card. So my best answer is - yes, you can display those details per business need.

To address followup from the comments:

QSA is Qualified Security Assessor; the auditors recognized by PCI as authoritative. Since I Am Not A QSA (IANAQSA) what you get from me are opinions, but not worth anything when audit time comes.

All the MFA/2-factor requirements in PCI revolve around administration, not end users or customers, so that should not be an issue.

Privacy issues legitimate card numbers; I believe they do fall into pre-paid bins, but they aren't really pre-paid cards, as they're backed by ACH and can have sophisticated limits. But, yes, to a merchant they look like pre-paid cards.

  • Thanks a lot for your answers, Gowenfawr! What is the IANAQSA? And QSA in your answer please? Do you think there are some further requirements such as MFA / 2 Factor Authentication before the full details of Credit Card can be displayed? And lastly - Privacy.com is pre-paid card, right? (Not Credit card) so it’s like Revolut.com – user214314 Aug 11 '19 at 15:06
  • @user214314 updated answer to address your comment. – gowenfawr Aug 12 '19 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.