Transaction Identifier (Transaction ID)

Applies to. No PCI DSS v4.0.1 requirement names transaction identifiers, and they are not account data, so a processor or gateway reference carries none of the standard's storage, masking or encryption duties; that is their value, since receipts, support tickets, refund requests and logs can refer to a payment by its identifier instead of the PAN and stay out of scope. The identifier only does that job if nobody in the merchant environment can turn it back into a PAN; a gateway screen that lets staff look up the full card number from a reference gives them access to cardholder data, and that screen and the staff who use it are in scope. A payment token and a transaction identifier are different things: the token stands in for a PAN across many transactions, the identifier names one transaction.