I tried buying a bus ticket online from a bus company from Brazil and the payment failed.

However, in the history of payments the failed transaction shows the first 6 and the last 4 digits of my card number:

 CARD: 123123******1234
 Operator: VISA

I am now wondering if they actually store the full information about my card details (e.g. expire date and CVV code).

Is this okay from a legal point of view? Usually I know companies can store the last 4 digits, but have not seen so far storing the first 6 digits.

  • I would think that they have to store the full details in case of audit or other investigation. The common practice of showing only the last four digits is a security mechanism. It doesn't imply that they store only the last four digits. The initial digits identify the card issuer, so it's not particularly sensitive information.
    – phoog
    Oct 21 '19 at 14:09
  • Side note: Security SE had this a couple of times: security.stackexchange.com/questions/145070/… Oct 21 '19 at 20:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.