PAN (Primary Account Number)
PCIComplianceHubLast updated
The payment card number, typically 13 to 19 digits, that identifies the issuer and the cardholder account. The PAN is the defining element of cardholder data: wherever it is stored, processed or transmitted, PCI DSS applies. It is cardholder data rather than sensitive authentication data, so it may be stored where there is a documented business need, provided it is rendered unreadable by truncation, keyed one-way hashing, index tokens or strong cryptography. When displayed it must be masked so that only personnel with a documented business need see more than the BIN and the last four digits.
Applies to. Every system component that stores, processes or transmits it, in any format, including displays, printouts, exports and logs.
Example. An order-management screen showing the first six and last four digits with the rest starred out is masked. A report export holding all 16 digits in a spreadsheet column is stored PAN, and the export, the mailbox it went to and the laptop it sits on are in scope.
Limits. Masking and truncation are different controls: masking hides digits on display while the full PAN is still held (3.4.1); truncation removes digits from what is stored (3.5.1). A hashed PAN must be a keyed cryptographic hash of the entire PAN (3.5.1.1), because an unkeyed hash of a 16-digit number can be reversed by trying every number. The first six or eight digits are the BIN, which identifies the issuer; it is the digits in the middle that a mask or a truncation removes.