[PCI DSS 1.x] 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of

[READ-ONLY] Archives [RETIRED] PCI DSS v.1.x Questions and Answers Protect Cardholder Data
1

[PCI-DSS] 3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).

Notes:

[ul]
[li] This requirement does not apply to employees and other parties with a legitimate business need to see the full PAN.[/li][li] This requirement does not supersede stricter requirements in place for displays of cardholder data–for example, for point-of-sale (POS) receipts.[/li][/ul]
3.3 Obtain and examine written policies and examine displays of PAN (for example, on screen, on paper receipts) to verify that primary account numbers (PANs) are masked when displaying cardholder data, except for those with a legitimate business need to see full PAN.

2

Great post! It’s very nice. Thank you so much for your post.

3

Virtual Credit Cards

What about virtual credit cards offered online for users?

PAN, and even cvv2 must be showed on screen. are they in scope? Thank you.