Also called: Card number masking, Masking, PAN truncation, Truncation
What truncation and masking are
Masking conceals part of a primary account number (PAN) when you display or print it. A receipt might show only the last four digits, while a payment screen replaces other digits with symbols. The full PAN can still be stored behind that display, so masking alone does not protect a stored card number.
Truncation permanently removes a segment of a PAN from electronic data, such as a file or database. The removed digits cannot be recovered from that truncated record. PCI DSS treats truncation as one way to make stored PAN unreadable, alongside methods such as strong cryptography and tokenization.
A masked number can still be stored in full; truncation removes digits from the stored record.
How the controls differ
Masking controls what people see on screens, receipts, reports, and printouts. PCI DSS Requirement 3.4.1 sets the display rule: show no more than the first six and last four PAN digits unless a documented, management-approved business need justifies showing more. Give additional visibility only to roles that need it, and show them the minimum digits required.
Truncation controls what remains in stored data. PCI DSS Requirement 3.5.1 covers protecting stored PANs. Visa's 2021 guidance says a 16-digit Visa PAN with an 8-digit BIN can retain the first eight and any other four digits in a truncated record, removing at least four digits. Use the format that fits your business need and the applicable card-brand rules.
What it means for your business
Masking a receipt does not secure a full PAN saved in a database, log, backup, or portable drive. If your business retains the full number electronically, you still need controls that meet the stored-data requirement. A masked number on a screen is not proof that stored card data is protected.
Truncation can reduce the card data held in a system, but it does not automatically remove the system from PCI DSS scope. The system that performs truncation and connected systems or networks remain in scope. Systems holding only properly truncated PANs may be considered out of scope if they are adequately segmented and do not otherwise store, process, or transmit cardholder data. An assessor must evaluate the full setup.
Where you will see it
Look for masking on customer receipts, checkout screens, staff reports, and printed records. Look for truncation in the design of databases, exported files, and logs that retain card numbers. These are data-handling controls, not processing-fee line items, so your merchant statement will not tell you whether either control is working.
What you can actually change
- Check every display. Review receipts, checkout screens, reports, and printouts. Limit PAN visibility to the first six and last four digits unless you have a documented, management-approved business need for more.
- Find stored PANs. Inventory databases, exports, logs, backups, and portable media. Masking a screen does not protect a full PAN saved in any of these locations.
- Review truncation formats. Confirm stored PANs are rendered unreadable and that separate truncation formats cannot be combined to reconstruct a number. Have an assessor evaluate system scope and segmentation.
- Reduce card data held. Use tokenization where your payment setup supports it, so your system retains a token instead of the full PAN. Keep access to cardholder data limited to staff who need it.
Frequently asked questions
What is the difference between masking and truncation?
Masking conceals digits when a PAN is displayed or printed, but the full number might still be stored. Truncation permanently removes a segment from stored PAN data, and those digits cannot be recovered from that record.
Does masking a receipt make stored card data safe?
No. Masking limits what someone can see on a receipt or screen. If your system stores the full PAN, that stored data still needs protection under PCI DSS Requirement 3.5.1.
Can truncated PAN data take a system out of PCI DSS scope?
Not by itself. A system holding only properly truncated PANs may be considered out of scope if adequately segmented and not otherwise handling cardholder data. The system performing truncation and connected systems remain in scope, and an assessor must review the full setup.
How many card digits can a receipt show?
PCI DSS limits a displayed PAN to the first six and last four digits unless a documented, management-approved business need supports showing more. Stricter laws or payment-brand rules can also apply.