What masking is
Masking conceals a segment of a primary account number (PAN) when it is displayed or printed. For example, a payment screen or receipt can hide part of the card number instead of showing the full PAN. The PCI Security Standards Council defines masking for situations where there is no business need to view the entire number.
Masking applies to visible information, including screens, paper receipts and printouts. It changes what someone can see in that display, not necessarily what your payment system holds or processes behind it.
Masking limits what people see on a screen or printout, but it does not secure every copy of the card number.
Where masking helps
A masked number reduces the amount of card data exposed to someone looking at a screen or handling a printed receipt. This matters at a checkout counter, in a back office, or anywhere staff review payment records without needing the full PAN to do their job.
Review every place your business displays or prints card numbers, including receipts, reports and staff-facing payment screens. If a task only requires identifying a payment or card, displaying the full PAN exposes more information than that task requires.
What masking does not protect
Masking is a display measure, not a way to protect a PAN in every state. It does not, by itself, secure card data that is electronically stored, processed or transmitted. PCI guidance uses truncation for protection of PAN in those electronic contexts, so do not treat a masked screen as proof that the underlying data is protected.
Masking also does not reduce interchange, network fees or your processor's markup. It is a security practice, not a pricing method, and it does not by itself establish that your business meets PCI DSS requirements.
What you can actually change
You control how much card data your staff and customers can see in displays and printouts. Set access and display choices around the work people need to do.
- Hide PAN segments on payment screens, receipts and printed reports when the full number is not needed.
- Limit full PAN access to specific roles with a documented business need.
- Check electronic storage and transmission separately. Masking a display does not protect those copies.
- Review receipts and reports from each payment channel to confirm that they do not expose full PAN unnecessarily.
- Inspect customer receipts. Keep a sample receipt from each checkout channel and confirm it does not show the full PAN.
- Review staff access. Identify which roles need full card numbers and remove visibility from other staff screens.
- Separate your controls. Document how your business protects electronic card data, because display masking covers a different situation.
Frequently asked questions
Does masking a card number make my business PCI compliant?
No. Masking limits the PAN shown on screens and printouts when staff do not need the full number. It does not, by itself, protect card data that is stored, processed or transmitted, or establish that your business meets PCI DSS requirements.
Is masking the same as truncation?
They address different contexts. Masking conceals part of a PAN when it is displayed or printed. PCI guidance refers to truncation for protecting PAN that is electronically stored, processed or transmitted.
Does masking lower credit card processing fees?
No. Masking is a security practice for limiting visible card data, not a processing rate or pricing method. It does not change interchange, network fees or your processor's markup.