0

Would displaying the full Credit Card details (PAN, Expiry date and CVV/CVC) in Online Banking and / Mobile Banking be considered both PCI-DSS and secure? Or what would be Best practice to display the details for the instantly granted (approved) Credit card so that customer can start using it for eCommerce?

1 Answer 1

1

IANAQSA, and you seem to be getting into the Issuer business. You really need a QSA.

You are asking about the requirements upon issuers (most PCI-DSS questions are from the POV of merchants, acquirers, and processors; the other side of the equation).

Issuers are also held to the PCI-DSS, but obviously they have different constraints. For example:

3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only personnel with a legitimate business need can see more than the first six/last four digits of the PAN.

For an issuer, it is a legitimate business need to communicate a cardholder's card number to them. Most commonly, this is done by shipping a plastic card to the cardholder's mailing address. So Issuers clearly get a pass on the requirement to Mask per 3.3 when business need requires them to disclose the full card number.

You're asking about virtual / electronic only cards, and there is precedent that Privacy.com displays full card data - PAN, expiration, and CVV - as soon as a user allocates themselves a new card. So my best answer is - yes, you can display those details per business need.


To address followup from the comments:

QSA is Qualified Security Assessor; the auditors recognized by PCI as authoritative. Since I Am Not A QSA (IANAQSA) what you get from me are opinions, but not worth anything when audit time comes.

All the MFA/2-factor requirements in PCI revolve around administration, not end users or customers, so that should not be an issue.

Privacy issues legitimate card numbers; I believe they do fall into pre-paid bins, but they aren't really pre-paid cards, as they're backed by ACH and can have sophisticated limits. But, yes, to a merchant they look like pre-paid cards.

2
  • Thanks a lot for your answers, Gowenfawr! What is the IANAQSA? And QSA in your answer please? Do you think there are some further requirements such as MFA / 2 Factor Authentication before the full details of Credit Card can be displayed? And lastly - Privacy.com is pre-paid card, right? (Not Credit card) so it’s like Revolut.com
    – user214314
    Aug 11, 2019 at 15:06
  • @user214314 updated answer to address your comment.
    – gowenfawr
    Aug 12, 2019 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .