PCI_DSS_INPUT_001

rules/regulations/global/pci_dss_input_detection.yaml

Citation

Requirement 3 (Protect Stored Account Data)

Condition

Covers payment card account data (primary account numbers and card security codes) entered in user inputs, which PCI DSS Requirement 3 (Protect Stored Account Data) requires an entity not to store unprotected. PCI DSS is an industry standard enforced through card-brand and acquirer contracts, not a law.

Layer 1 detects

a card-number format written as one run of digits (13 or 16 digits starting with 4; 16 digits starting with 51 to 55; 15 digits starting with 34 or 37; 16 digits starting with 6011 or 65), or written in groups with the same separator, a space or a hyphen, throughout (four groups of four digits starting with 4, 51 to 55, 6011 or 65; or groups of 4, 6 and 5 digits starting with 34 or 37). No checksum is computed: any digit run of that shape fires, a valid card number or not, and other card ranges (Mastercard numbers starting with 2, JCB, Diners, 19-digit cards) are not matched. It also fires on the words credit card, debit card, card number, CVV or CVC; on my card, my credit or my debit; and on the word card followed later on the same line by four digits that end a word. The fragment "expir" in the pattern is bounded as a whole word and does not match expiry or expiration. It matches formats and words, not purpose: it fires on a question about payment methods ("Do you accept credit card payments?") and on a masked reference ("My card ending in 1234 was declined."), although the rule lists masked references as an exception. Whether a text holds cardholder data is judged in Layer 2.

Condition type

regex

Status in the file

review