In PCI DSS terms, masking is used for what purpose?

• A. Encrypting cardholder data at rest
• B. Blurring display to reduce screen glare
• C. Concealing a segment of data when displayed or printed
• D. Replacing card numbers with tokens in all systems

Answer: (C)

Masking is about limiting how much cardholder data is visible when it is shown or printed. In PCI DSS, masking hides part of the PAN so someone viewing a screen or a hard copy can’t see the full number, while still allowing the record to be identified. For example, a PAN might be displayed as 123456******3456, showing only the first six and last four digits. This is a display-time protection, not an underlying safeguard of data in storage or transmission.

This approach is different from encrypting cardholder data at rest, which protects data by turning it into unreadable ciphertext in storage. It’s also not a general display blur, which doesn’t provide a defined, auditable method for protecting sensitive data. And it’s not tokenization, which replaces the PAN with a non-reversible token across systems. Masking focuses specifically on what portion of data is revealed when the data is actually presented to a user.