FAQ #1327 Diff
Do PANs need to be masked on cardholder statements sent by issuers to customers?
Earlier Version
Later Version
Removed
Added
PCI DSS Requirements 3.3Requirement 3 is not intended to apply to individual account statements sent by issuing banks to cardholders. Full PAN displays in individual account statements are not required to be masked or rendered unreadable. The reference to "paper reports" in Requirement 3 is intended to apply to back-office reports and 3.4other internal paper reports that are not intended to applyfor distribution to individual cardholders.With that said, Issuers should strongly consider masking or truncating PAN on any account statements, whether in paper or electronic form, as the presence of full PAN in addition to other information listed on account statements sent by issuing banks to cardholders. Full(such as name, address, telephone number, etc.) could provide a malicious individual with enough information to masquerade as the cardholder.Issuers with a legitimate business need to display full PAN displays in individualon account statements are not required tocan do so, but may wish to contact the payment brands directly to discuss possible alternatives. Contact details for the payment brands can be masked or rendered unreadable.found in FAQ 1142 - How do I contact the payment card brands?Note: The reference to ?paper reports? in Requirement 3.4 is intended to apply to back-office reportsspecific sub requirement number(s) and other internal paper reports that are not intended for distribution to individual cardholders.
With that said, Issuers should strongly consider masking or truncating PANterminology may vary depending on any account statements, whether in paper or electronic form, as the presencethe version of full PAN in addition to other information listed on account statements (such as name, address, telephone number, etc.) could provide a malicious individual with enough information to masquerade as the cardholder.
Issuers with a practical business need to display full PAN on account statements can do so, but may wish to contact the payment brands directly to discuss possible alternatives. Contact details for the payment brands can be found in FAQ 1142 -How do I contact the payment card brands?the standard being used.
With that said, Issuers should strongly consider masking or truncating PAN
Issuers with a practical business need to display full PAN on account statements can do so, but may wish to contact the payment brands directly to discuss possible alternatives. Contact details for the payment brands can be found in FAQ 1142 -How do I contact the payment card brands?
Disclaimer: This FAQ has been processed for display on this website and may contain errors. Please check the original FAQ on the PCI SSC website for the authoritative version.