Is there a correct way to mask a 15 digit credit card number?

15 digit bank card numbers are formatt开发者_如何学运维ed 0000-000000-00000^[1].

If I show the last 4 digits, it becomes xxxx-xxxxxx-x0000 which looks slightly goofy.

Is there a correct way to format a masked 15 digit number?

(I expect we will not show more than the last 4 anyway, but if there is a standard, I want to know about it.)

There is no standard really. The vast majority of sites display the last four with four X's in front them whether the credit card number is 15 or 16 digits so that would probably be the most recognizable to your users. But if you really want to format it so you show the actual structure of the card number then do it as xxxx-xxxxxx-x0000 despite the goofiness. Users may find showing an extra character (xxxx-xxxxxx-00000) is "unsafe" and I'm sure you don't want to give anyone an opportunity to complain or do a chargeback.

PCI DSS v3.2.1, requirement 3: mask PAN. Last for digits represent card ID. First 4-6 digits represent bank iD.

PCI DSS - Payment card industry Data security standard. PAN - Primary account number.