0

I tried buying a bus ticket online from a bus company from Brazil and the payment failed.

However, in the history of payments the failed transaction shows the first 6 and the last 4 digits of my card number:

 CARD: 123123******1234
 Operator: VISA

I am now wondering if they actually store the full information about my card details (e.g. expire date and CVV code).

Is this okay from a legal point of view? Usually I know companies can store the last 4 digits, but have not seen so far storing the first 6 digits.

Improve this question
2
  • 1
    I would think that they have to store the full details in case of audit or other investigation. The common practice of showing only the last four digits is a security mechanism. It doesn't imply that they store only the last four digits. The initial digits identify the card issuer, so it's not particularly sensitive information.
    – phoog
    Commented Oct 21, 2019 at 14:09
  • 1
    Side note: Security SE had this a couple of times: security.stackexchange.com/questions/145070/…
    – Bernhard Döbler
    Commented Oct 21, 2019 at 20:46

3 Answers 3

Reset to default
2

Yes, they are allowed to store all the digits if they want, as long as this is not made in a way that violates any privacy laws. There isn't an specific law in Brazil about how many credit card digits a company is allowed to store. Many sites will actually offer you the option of saving card data to make it easy for you in the next purchase.

And as per phoog comments, the fact you don't see all the digits somewhere else doesn't mean the company doesn't store them.

Improve this answer
1

They not only may do so, they have to:

Without the complete credit card number and some proof that the card was used with them, the payment processor will not order the payment to the transportation agency for the debt you incurred when using their service. This is in the rules of the payment processor. So the transportation agency needs to save your whole card number at least until they have processed the payment fully - as in told the payment processor to make the wire of funds.

The transportation service (and all other companies) print parts of your number onto the receipt so you can make sure from which card you paid what service in case you might have multiple cards, or in case you want to dispute the charge on the basis that you had reported the card of that number stolen/lost before the card was used.

Improve this answer
3
  • In the UK, the business needs the complete number + cvv code to get paid, but must delete the number and the cvv code afterwards. For subscriptions, the business exchanges the complete number against a token which only allows payment to the business, so hackers or rogue employees can't use that token to put money into their own account.
    – gnasher729
    Commented Feb 6, 2022 at 0:48
  • "Without the complete credit card number and some proof that the card was used with them, the payment processor will not pay the transportation agency" What are you talking about? "Payment processor" refers to a company that facilitates interactions between a merchant and their acquiring bank. They don't "pay" anyone, they just facilitate transactions between other parties. The money comes from the issuing bank. If they aren't convinced the transaction was valid, they need to decline the transaction at the time it's made. If they authorize the transaction, then they have to pay.
    – Acccumulation
    Commented Feb 6, 2022 at 6:36
  • @Acccumulation If you try to send a payment without all the numbers of the credit card, VISA will decline. However, not all credit card payments are told VISA right away: paper transcripts are still a thing and even without internet or phone lines, credit card payments can be accumulated and processed in bulk once such is back.
    – Trish
    Commented Feb 6, 2022 at 9:27
0

I don't know about a legal point of view, but storing the PAN (credit card number) is a violation of Visa policies. However, the first six digits of your credit card is known as the BIN, and is issued to the bank that issued your credit card. Visa assigned this sequence of numbers to the bank as sort of an "account number", and the bank then uses those numbers as the first six digits for all the credit cards they issue under this account, so anyone who knows under what account your credit card was issued knows those numbers. So it's not all that secret of information. For instance, you give "123123" as being these first six numbers, but I happen to know that actually the first of these digits is 4.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .