Limiting Credit Card Number In Database

[pjbonarrigo]

Using 1.3.8a.
I have only 3 active payment modules.
Website Payments Pro
PayPal Express
Check/Money Order

Credit card payments store CC numbers in database 'orders' table as "1234xxxxxxxx5678". Expiration date is also stored.
This bothers my manager who from time to time is concerned about PCI compliance but won't pay for PCI validation. We are SSL and the cart works quite nicely. Not one customer complaint, especially regarding CC numbers in email confirms.

I looked through a lot of threads but did not get the answer I want.

Is the PayPal functionality dependant on the first four, last four, and expiration date. The orders have "Do Full Refund" and "Do Partial Refund" buttons which work well. My manager would like no CC storage. The store manager and IT person want last four only, no expiry. I can edit the appropriate php code to change this but am wondering. I have not looked deep enough to answer my question.

Shame on me for taking the easy way out.
My apologies, Dr Byte.

[DrByte]

There is absolutely nothing wrong with storing up to the first 6 digits of a credit card number, and the last 4 digits.
The first 6 are used simply to identify which bank issued the card. Nothing secret or special about that. But Zen Cart only records the first 4, since that's more than enough in most cases.
The last 4 digits are used to confirm the card number to the customer and for you to confirm the card in a transaction update such as a refund etc.
That leaves 8 more digits to have to "guess" in order to abuse the card. That's a lotta guessing and would flag up fraud alerts if someone was slamming card numbers to try to guess something anyway.
The card companies and PCI assessors are satisifed with this approach. In fact, they're the ones who have indicated these limits are acceptable.

Some folks debate the expiry date issue; however, since the full card number is never stored anywhere and the full card number is required before the expiry date would be of any value, the expiry date is moot and useless, so storing it is essentially a non-issue.


That said, you're using an old version of Zen Cart which has known security vulnerabilities. That's a far more important thing to fix than the question you're raising. Upgrading your site should be your first priority.

[pjbonarrigo]

Thanks for responding, Dr Byte.
I guess my question wasn't clear enough.
Do you need the first four, last four, and expiry for "Do Full Refund" or "Do Partial Refund" in an order?
Do you need this for anything other than a memo reason?

Regarding security, I have installed the security updates in 1.3.8a, and plan to upgrade eventually.

[DrByte]

With PayPal you don't need the card numbers to do refunds. The Transaction ID is all that's required.
However, some other gateways do require partial card digits for refunds.