PAN masking is the removal of the middle digits of a primary account number under PCI-DSS v4.0 Req. 3.4. The rule lets the first six and last four digits show. anonym.plus finds each long value on your device and reduces it to that allowed form.
When this applies
A display screen or report may print the whole string across several lines. You must cut each to the masked form under Requirement 3.4 before it shows.
How anonym.plus handles it
- Open the report in anonym.plus on your device.
- Local OCR reads scanned slips that print the digits.
- The tool flags every full account value.
- Apply Mask to keep the first six and last four digits.
- Confirm no full number remains anywhere.
- Save the cleaned copy locally.
What you need to provide
- The report or screen export (PDF, CSV, scan).
- The Mask operator set to the 6/4 display form.
- Optional batch for many statement pages at once.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Account | CREDIT_CARD | 4111 1111 1111 1111 → 411111******1111 |
| Account | CREDIT_CARD | 5500 0000 0000 0004 → 550000******0004 |
| Names | PERSON | holder name → [HOLDER] |
| Bank | IBAN_CODE | DE89 3704 ... → [IBAN] |
| Dates | DATE_TIME | exp 04/27 → [DATE] |
| Amount | MONEY | EUR 89.00 → [AMOUNT] |
Compliance achieved
- Meets PCI-DSS v4.0 Req. 3.4: only 6/4 digits show.
- Catches several brands of long number in the same pass.
- Offline work keeps the digits off any server.
Anonymize card reports offline — see plans & start free →
Limitations & cautions
A spaced or hyphenated number on a faint scan can confuse OCR. Verify the flags on image pages so no middle digit slips through. The tool masks what it detects; check the result.
Frequently asked questions
How much of the number may show under Req. 3.4?
At most the first six and last four digits. anonym.plus uses the Mask operator to keep those and hide the middle in one pass.
Is masking the same as truncation?
No. Masking hides digits on display; truncation removes them from storage. The Mask operator fits the display rule the requirement describes.
Can it read a number printed on a scanned slip?
Yes. Local OCR reads the image, then masks the value. Always verify faint scans.