> not the real number that is printed on the physical card (which Rakuten Kobo would store). Citation needed! In 2014 I worked for a small, unimportant ecomme

> not the real number that is printed on the physical card (which Rakuten Kobo would store). Citation needed! In 2014 I worked for a small, unimportant ecommerce retailer. We migrated at around that time to storing only a token, using our payment processor (Braintree at the time) - and no longer kept any card numbers in our database whatsoever. If someone had dumped our 'credit_cards' table after that migration, they'd have nothing but useless garbage (the token could only be used by our own merchant account). I think even Braintree didn't need to store the card number itself either, but I'm not so sure of their internals. Storing a payment card number in your database is considered an incredibly bad practice, is not PCI compliant, and probably violates other important "compliance" things you have to regularly certify as well.