Contents
What is considered PAN?
PAN stands for Primary Account Number, and it is a key piece of cardholder data you are obligated to protect under the PCI DSS. Storing customers’ full PAN data exponentially increases your business’s security risk and, consequently, it’s scope of compliance.
Is PAN considered PII?
When Do They Intersect? PCI DSS covers PII when it is related to cardholder data, such as the PAN, cardholder name, service code, and card expiration date, according to InfoSec Institute. It also covers sensitive authentication data such as a card PIN.
Can truncated and hashed PAN be stored together?
In your cardholder data system, you cannot preserve truncated and hashed versions of the same card unless you make additional checks to ensure that the two versions cannot be correlated to restore PAN.
What devices are needed to create a PAN?
To create a PAN, you need a minimum of two computing devices, for example a PC and a smartphone. You will also need a communication channel, which can be wired or wireless to transfer information between the different devices.
Why do they call them PAN fish?
Webster’s defines panfish as: “A small food fish usually taken with hook and line and not available on the market.” The style manual of the Outdoor Writers Association of America takes a different approach: “Any of a variety of species of fish that resemble the shape of a frying pan, thus the name.”
What is the 8 digit bin?
The issuing Bank Identification Number (BIN) is the first 6 digits – and with this change, 8 digits – of the Primary Account Number (PAN), located on credit, debit, and prepaid cards. The issuing BIN is used globally to identify the bank that issued the card.
Is a truncated PAN cardholder data?
Once the middle six digits are removed, the PAN is no longer considered cardholder data and is considered unreadable. PAN truncation can replace the data with an “x” or “0” in place of the truncated middle digits. Importantly, hashing cannot be used to replace the truncated segment of the PAN.
How much of a pan number can you store?
3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits you may display), so that only authorized people with a legitimate business need can see more than the first six/last four digits of the PAN. However, from this doc: PCI DSS Self-Assessment Questionnaire Instructions and Guidelines, v3.2
Where can I find information on Pan data storage?
For more information on PAN data storage and the PCI DSS, see my June 2015 PCI Compliance Guide post. Have additional questions about how the PCI DSS applies to your business? Visit ControlScan.com or give us a call at 1-800-825-3301, ext. 2. We’d be happy to help. Subscribe to this blog for additional payment security tips.
What is requirement 3.4 for protection of Pan?
This requirement relates to protection of PAN displayed on screens, paper receipts, printouts, etc., and is not to be confused with Requirement 3.4 for protection of PAN when stored in files, databases, etc. This is the maximum that the DSS allows. More than that can be used to reconstruct the PAN.
How is Pan data stored on a rail card?
Now, to avoid storage of PAN data, the rail vendor may choose to store only hashed values. At the time of the ticket pick-up, the PAN of the inserted card can be hashed and the hash value can be compared to the one of the card used to purchase the ticket online (these should match).