PAN display masking rule states that PAN must be masked when displayed; which is true about who can view full PAN?

• A. All staff can view full PAN
• B. PAN masked when displayed such that only roles with legitimate business need can see the full PAN
• C. PAN masked always
• D. Never display PAN

Answer: (B)

The key idea is protecting the PAN by displaying it only to those who truly need to see the full number. The PAN is highly sensitive credit-card data, so showing it to everyone would greatly increase the risk of exposure—from shoulder surfing, screenshots, or unsecured logs. The proper approach is to mask the PAN when it’s displayed, and allow the full number to be viewed only by roles with a legitimate business need. Access to the full PAN should be governed by least-privilege and need-to-know principles, with controls like role-based access, secure systems, and audit trails in place. If a task truly requires the full PAN, it should be provided through a secure process rather than opened up to all staff. That’s why the statement that the PAN is masked when displayed and only those with a legitimate business need can see the full PAN is the best fit.