Requirement 3.4 is not about storage — it is about display. Req. 3.4.1 sets the ceiling: at most the issuer's BIN (six to eight digits) and the last four digits may stay visible, with anything past that needing a documented business reason. Req. 3.4.2 adds a further duty to guard against copying a full number during remote access. UK GDPR Art. 25(2) lands on the same result by a different route: data protection by default means only what is necessary is exposed. anonym.plus reduces every number on your device to that permitted form.
When this applies
A support agent at an FCA-authorised card issuer exports a customer overview that prints the full number on every row, for a colleague who only needs the last four digits to confirm which card a query concerns. Each row has to be shortened first.
How anonym.plus handles it
- Open the statement in anonym.plus on your device.
- Local OCR reads scanned slips that print the digits.
- The tool flags every full account value.
- Apply Mask to keep the first six and last four digits.
- Confirm no full number remains anywhere.
- Save the cleaned copy locally.
What you need to provide
- The statement or screen export (PDF, CSV, scan).
- The Mask operator set to the 6/4 display form.
- Optional batch for many statement pages at once.
PII & financial identifiers detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Account | CREDIT_CARD | 4111 1111 1111 1111 → 411111******1111 |
| Account | CREDIT_CARD | 5500 0000 0000 0004 → 550000******0004 |
| Names | PERSON | holder name → [HOLDER] |
| Bank | IBAN_CODE | GB29 NWBK ... → [IBAN] |
| Dates | DATE_TIME | exp 04/27 → [DATE] |
| Amount | MONEY | £89.00 → [AMOUNT] |
Compliance achieved
- Meets PCI DSS v4.0 Req. 3.4.1: only the issuer BIN plus the last four digits show.
- Supports the remote-access copy restriction in Req. 3.4.2 — a masked copy has no full number to copy in the first place.
- Applies data protection by default under UK GDPR Art. 25(2): whoever opens the file sees no more than the task needs.
- Catches several brands of long number in the same pass.
- Local-only handling keeps the digits off any server.
Anonymise card statements offline — see plans & start free →
Limitations & cautions
A spaced or hyphenated number on a faint scan can confuse OCR. Verify the flags on image pages so no middle digit slips through. The tool masks what it detects; check the result.
Frequently asked questions
How much of the number may show under Req. 3.4.1?
At most the issuer's BIN, which runs six to eight digits, plus the last four digits. anonym.plus uses the Mask operator to keep those and hide the middle in one pass; showing more needs a documented business reason under the same requirement.
Is masking the same as truncation?
No. Masking hides digits on display; truncation removes them from storage. The Mask operator fits the display rule Req. 3.4.1 describes, while a separate truncation pass would be needed if the goal were to stop storing the full number at all.
Does this help against Req. 3.4.2's copy restriction too?
Yes, indirectly. Req. 3.4.2 asks for controls against copying a full number during remote access. A file that already carries no full number removes that risk before any access-control question even arises.