Category: Data Protection Methods

Masking

Simply put

In payment security, masking is a way of hiding most of a card number when it is displayed, for example showing only the first six and last four digits and replacing the rest with symbols. This lets staff or customers recognize a card without exposing the full account number on screens or receipts. The evidence provided does not contain payment-security source material defining masking, so this description reflects the concept qualitatively rather than any cited definition.

Formal definition

Masking is the practice of concealing segments of cardholder data, most commonly the primary account number (PAN), when it is displayed, so that a viewer sees only a permitted portion rather than the full value. Under PCI DSS, PAN must be masked when displayed unless a specific business need justifies showing more, and the maximum digits that may be shown is defined by the standard; confirm the exact display and truncation rules against the current published version of PCI DSS, as requirement numbering and wording differ between versions. Masking should be distinguished from truncation (which permanently removes digits from stored data), from tokenization (which substitutes the PAN with a surrogate value), from hashing (which produces a one-way representation), and from encryption (which reversibly protects data using cryptographic keys). Masking affects presentation of data and does not by itself remove stored PAN from scope; its effect on PCI DSS scope depends on implementation and validation, not on the label alone. NOTE: The supplied evidence packet contains no payment-security, PCI, or data-protection sources for 'masking'; all sources describe an unrelated psychological concept and therefore cannot be cited for this definition.

Why it matters

Masking matters because payment environments constantly display card numbers to people who need to recognize a card without needing to see it in full. Call center agents, retail staff, and customers reviewing their own accounts can identify a card from a masked value such as the first six and last four digits, while the intervening digits remain hidden from casual view, shoulder-surfing, or screenshots. Reducing full-PAN exposure on screens, printed receipts, and reports lowers the chance that account numbers are captured or leaked through routine business operations.

Under PCI DSS, PAN must be masked when displayed unless there is a specific, documented business need to show more, and the standard defines the maximum number of digits that may be shown. This makes masking a compliance-relevant control, not merely a cosmetic one. Because requirement numbering and wording differ between versions of PCI DSS, organizations should confirm the exact display rules against the current published version rather than assuming a fixed requirement number.

A critical caution is that masking changes only how data is presented, not how it is stored. Masking does not by itself remove stored PAN from PCI DSS scope, and its effect on scope depends on implementation and validation rather than on the label alone. Treating masking as equivalent to truncation, tokenization, hashing, or encryption can lead teams to believe underlying data is protected when the full PAN may still exist in storage or be recoverable elsewhere in the environment.

Who it's relevant to

Compliance Officers

Compliance officers need to confirm that PAN is masked when displayed and that any exception showing more than the permitted digits is backed by a documented business need. They should verify display rules against the current published version of PCI DSS, since requirement numbering and wording differ between versions.

Security Engineers and Developers

Those building and maintaining applications implement masking at the presentation layer and must not confuse it with truncation, tokenization, hashing, or encryption. Because masking does not by itself remove stored PAN from scope, engineers should ensure underlying data protection is addressed separately and validated accordingly.

Merchant Operations and Call Center Teams

Staff who handle cards during service interactions rely on masked values to recognize a customer's card without exposing the full account number on screens or receipts, helping reduce casual exposure of PAN during routine work.

QSAs and Assessors

Assessors evaluating an environment must determine whether masking is correctly implemented and how it interacts with stored data, recognizing that its effect on PCI DSS scope depends on implementation and validation, not on the label alone.

Inside Masking

PAN masking

The practice of displaying only a portion of the Primary Account Number when shown on screens, receipts, reports, or other outputs, so that the full PAN is not exposed to individuals who do not have a business need to see it.

Maximum displayable digits

PCI DSS limits how much of the PAN may be displayed. Historically this is expressed as showing no more than the first six and last four digits, though practitioners should confirm the exact allowance and wording against the current published version of the standard rather than assuming fixed language.

Business need-to-know basis

Masking requirements apply relative to who is viewing the data. Personnel with a legitimate, documented business need may be permitted to view more digits, while everyone else sees only the masked value.

Display-layer control

Masking governs how data is presented, not how it is stored. The underlying PAN may still exist in storage, so masking on its own does not render stored data unreadable.

Relationship to truncation, hashing, encryption, and tokenization

Masking transforms what is shown; truncation permanently removes digits from stored data; hashing produces a one-way value; encryption renders data unreadable pending key access; tokenization substitutes a surrogate value. These are distinct techniques with different effects on data and on PCI DSS scope depending on implementation and validation.

Common questions

Answers to the questions practitioners most commonly ask about Masking.

Is masking the same as encryption or tokenization?

No. Masking, encryption, and tokenization transform data in different ways and serve different purposes. Masking obscures portions of a PAN when it is displayed, typically leaving only defined segments visible to a viewer. Encryption applies a cryptographic algorithm and key to render data unreadable, and the original value can be recovered with the appropriate key. Tokenization replaces the PAN with a surrogate value that generally has no algorithmic relationship to the original. Because masking commonly operates at the display layer, it usually does not by itself remove stored data from PCI DSS scope; the underlying data and how it is stored still matter. Their effect on scope depends on implementation and validation, not on the label alone.

Does masking a PAN mean the underlying data is protected at rest?

Not necessarily. Masking typically controls what a person sees when the PAN is displayed, and it does not inherently change how the full PAN is stored, processed, or transmitted behind that display. A masked presentation can coexist with a fully stored PAN in an underlying system, which would still fall under PCI DSS protection requirements. Protecting data at rest is addressed by separate controls, such as rendering stored PAN unreadable through methods like strong cryptography or truncation, and readers should confirm the specific requirements and current wording against the published standard for the applicable version.

How much of the PAN can be displayed when masking is applied?

PCI DSS describes masking in terms of limiting the digits displayed to only those needed for a legitimate business purpose, rather than displaying the full PAN by default. The maximum number of digits that may be shown, and the conditions under which additional digits may be revealed to personnel with a legitimate need, are defined in the standard. Because requirement numbering and wording differ between versions, confirm the exact permitted display against the current published standard rather than assuming a fixed value.

Can different roles be shown different amounts of the PAN?

Yes. Masking can be implemented so that most viewers see only a limited portion of the PAN, while individuals with a documented, legitimate business need may be permitted to see additional digits or the full PAN. This is typically enforced through role-based access controls tied to job function. The legitimate business need should be defined and justified, and access to fuller PAN views should be restricted accordingly. Confirm the specific conditions and any limits against the current published standard.

Does applying masking on a screen reduce PCI DSS scope for the systems behind it?

Masking at the presentation layer does not automatically reduce scope for the systems that store, process, or transmit the underlying cardholder data. Scope depends on where and how the actual PAN exists in the environment, not on how it is displayed to a user. Systems handling the full PAN generally remain in scope regardless of masking at display. Whether any scope reduction applies depends on implementation and validation for that specific environment.

How does masking differ from truncation in an implementation?

Masking generally obscures digits at the point of display while the full PAN may still exist in storage, whereas truncation permanently removes a portion of the PAN so that the removed digits are not retained. Because truncation eliminates data rather than merely hiding it, it can affect stored-data readability differently from masking. The two are distinct controls with different effects, and their impact on stored data and on PCI DSS scope depends on how each is implemented and validated. Confirm the applicable definitions and requirements against the current published standard.

Common misconceptions

Masking a PAN on screen makes the stored data unreadable and therefore satisfies the requirement to protect stored cardholder data.

Masking is a display-layer control that affects only what is shown to a viewer. It does not alter or protect the PAN in storage. Rendering stored PAN unreadable is a separate requirement typically addressed through methods such as truncation, hashing, encryption, or tokenization, evaluated per implementation.

Masking and truncation are the same thing.

Masking hides digits at the point of display while the full value may still be retained elsewhere. Truncation permanently removes digits so the excised portion is not stored at all. They differ in whether the hidden data continues to exist.

Everyone must always see only the first six and last four digits.

The maximum displayable digits define an upper bound for those without a business need. Individuals with a legitimate, documented business need may be permitted to view more of the PAN. Confirm the exact allowed digits and conditions against the current published version of PCI DSS.

Best practices

Define and document which roles have a legitimate business need to view full or extended PAN, and mask the PAN by default for all other viewers.

Confirm the maximum number of displayable digits and the exact wording against the current published version of PCI DSS rather than assuming a fixed requirement number or format.

Apply masking consistently across all display outputs, including screens, printed receipts, reports, logs, and error messages, so PAN is not inadvertently exposed in overlooked channels.

Do not rely on masking to satisfy requirements for rendering stored PAN unreadable; pair it with an appropriate storage-protection method such as truncation, hashing, encryption, or tokenization, validated per implementation.

Ensure sensitive authentication data, such as full track data, CAV2/CVC2/CVV2/CID, and PINs or PIN blocks, is not stored after authorization at all, since masking is not a substitute for prohibiting its retention.

Review access controls and masking logic together so that the amount of PAN displayed is enforced by the viewer's authorization rather than by client-side controls alone.