Mask card numbers and secrets that arrive in tickets

How to do it

Customers paste full card numbers into chat to "help". Once a card number sits in email or chat, the PCI SSC counts those systems in scope for PCI DSS. Scan every incoming message and attachment text for 13 to 19 digits that pass the Luhn check. Keep only the last four digits. Mask API keys and passwords with the patterns from Keep secrets out of code. Reply with a link to the billing page, as Keep card numbers off your servers requires.

Examples

JavaScript example

const CARD_LIKE = /\b(?:\d[ -]?){13,19}\b/g;

function passesLuhn(digits) {
  let sum = 0;
  for (let i = 0; i < digits.length; i++) {
    let d = Number(digits[digits.length - 1 - i]);
    if (i % 2 === 1) d = d * 2 > 9 ? d * 2 - 9 : d * 2;
    sum += d;
  }
  return sum % 10 === 0;
}

export const maskCardNumbers = (text) => text.replace(CARD_LIKE, (found) => {
  const digits = found.replace(/\D/g, '');
  return passesLuhn(digits) ? `•••• ${digits.slice(-4)}` : found;
});

Python example

import re

CARD_LIKE = re.compile(r"\b(?:\d[ -]?){13,19}\b")

def passes_luhn(digits: str) -> bool:
    total = 0
    for i, ch in enumerate(reversed(digits)):
        d = int(ch)
        if i % 2 == 1:
            d = d * 2 - 9 if d * 2 > 9 else d * 2
        total += d
    return total % 10 == 0

def mask_card_numbers(text: str) -> str:
    def mask(match: re.Match) -> str:
        digits = re.sub(r"\D", "", match.group())
        return f"•••• {digits[-4:]}" if passes_luhn(digits) else match.group()
    return CARD_LIKE.sub(mask, text)

How to check

Send a test ticket with the test card number 4242 4242 4242 4242 and a fake API key. The stored ticket, the agent view and the helpdesk export show •••• 4242 and no key.

Sources

• PCI SSC FAQ on cardholder data over end-user messaging

Related rules

• SEC-33 Keep secrets out of code in Adversarial testing
• SEC-43 Keep card numbers off your servers in Adversarial testing