Is there a correct way to mask a 15 digit credit card number?

Question

15 digit bank card numbers are formatted 0000-000000-00000^[1].

If I show the last 4 digits, it becomes xxxx-xxxxxx-x0000 which looks slightly goofy.

Is there a correct way to format a masked 15 digit number?

(I expect we will not show more than the last 4 anyway, but if there is a standard, I want to know about it.)

Folketing

Most masks I've seen don't have dashes. just a series of * for the mask and, as you say, the last 4 digits. For kicks, you could mask just the first 4 digits, which serve only to identify the type of card (visa, mastercard, amex, etc...) and amaze your friends by how easily you can guess their number. – Antennule

I like to format all the 16 digit numbers (by far, most of them are 16 digits) with dashes because it is easier to read that way. I format the masked numbers also to be consistent. – Folketing

Answer 1

There is no standard really. The vast majority of sites display the last four with four X's in front them whether the credit card number is 15 or 16 digits so that would probably be the most recognizable to your users. But if you really want to format it so you show the actual structure of the card number then do it as xxxx-xxxxxx-x0000 despite the goofiness. Users may find showing an extra character (xxxx-xxxxxx-00000) is "unsafe" and I'm sure you don't want to give anyone an opportunity to complain or do a chargeback.

Nap

Answer 2

PCI DSS v3.2.1, requirement 3: mask PAN. Last for digits represent card ID. First 4-6 digits represent bank iD.

PCI DSS - Payment card industry Data security standard. PAN - Primary account number.

Magdalen