Obfuscation
PCIComplianceHubLast updated
Making data or code hard to read without making it unrecoverable: encoding, scrambling, renaming or hiding it so that a casual reader cannot make sense of it, while anyone who knows the method can reverse it. It is not encryption, hashing, truncation or index tokens, and PCI DSS does not accept it as a way to render stored PAN unreadable.
Applies to. PCI DSS v4.0.1 does not use the word, and it matters because obfuscation is what the standard does not accept: Requirement 3 names four methods for rendering stored PAN unreadable, keyed one-way hashes of the entire PAN, truncation, index tokens, and strong cryptography with key management, and anything else, such as encoding, reversible scrambling or storing the number in an unusual format, leaves the PAN readable in the standard's terms. Masking, which limits how much of a PAN is displayed rather than how it is stored, is a different control with its own entry.
Limits. Requirement 3 names four accepted methods and obfuscation is not one of them; assessors examine data repositories and logs for the method actually used, so a scrambled PAN is treated as a stored PAN.
Sources. PCI DSS v4.0.1 (June 2024)