2 ms·
I know the first 6/last 4 rule, but Digital River requested the last five. I actually thought that was pretty explicitly in violation of PCI. Am I wrong, or ma
by gecko 16y ago
I know the first 6/last 4 rule, but Digital River requested the last five. I actually thought that was pretty explicitly in violation of PCI. Am I wrong, or maybe misunderstanding the rules?
- powertower 16y agoYou can comply with PCI DSS by storing NO MORE THAN the first 6 and last 4 digits. You can also by-pass the requirements by storing a (somewhat non-reversible) hash of the entire card (or last x digits, in this case 5)... As long as the hashing and the storing is done on two separate systems. http://superconductor.voltage.com/2009/05/hashing-and-the-pci-dss.html http://superconductor.voltage.com/2009/05/hashing-and-the-pc...