1

I can retrieve my customer's credit card number and pan hash from a payment solution as follows:

492500******1234

The payment solution I use can generate different pan hashes each time for the same credit card, so this causes multiple records for the same card in my database. To prevent this I am thinking to make the card number column (which stores values as seen above) unique to provide uniqueness. Does this number is unique? At least for each customer?

Mehmed
  • 2,880
  • 4
  • 41
  • 62

2 Answers2

4

A masked PAN is obviously not globally unique. There is a decent chance it would be unique per customer, though not guaranteed. To make it more unique you could combine it with expiry date and then hash the two together (PCI-DSS determines the expiry date is only sensitive data if stored with the full PAN)

I would have thought your payment provider would be able to provide a unique token per submitted card though?

PaulG
  • 13,871
  • 9
  • 56
  • 78
3

Basically there is a concept of PAN range in card industry, where initial 6 Digital identifies BIN and 2 are check digits and remaining is card range, where you can issue card for example 5273 4400 0000 0000 till 5273 4499 9999 9999, the technique which are using is not fulfilling the uniqueness criteria.

For example: Customer A Card number is 4925 0000 0000 1234 and customer B has 4925 0000 0012 1234, as per your logic both will be masked as 492500******1234 which is wrong.

Waqas iqbal
  • 39
  • 1