The short answer
Not in full. PCI DSS Requirement 3.4.1 says no more than the BIN (the first six or eight digits) and the last four digits of a card number may be “displayed on computer screens, reports, etc.” unless there is a documented business justification for a specific role to see more. Even an agent who is allowed to see the full number has no justification to show it to everyone on a Zoom, Google Meet or Teams call, or in a recording. Mask card numbers in your own systems, and add a second layer for screen shares: BlurPilot detects 13 to 19-digit card numbers, confirms them with the Luhn checksum and blurs them in the browser, free.
This article is general information, not compliance advice. Your Qualified Security Assessor (QSA) or compliance lead decides what applies to your environment.
Key takeaways
- PCI DSS 3.4.1 sets a ceiling: the BIN and last four digits, unless a role has a documented, management-approved reason to see more.
- A screen share extends your screen to people who have no such reason, and a recording keeps it.
- Never show CVV codes or full card numbers on a call. If one appears, treat it as an incident and tell your compliance lead.
- Two layers work best: masking in the systems you own, and in-browser blur for the pages you show.
What PCI DSS actually says about displaying card numbers
The Payment Card Industry Data Security Standard (PCI DSS) is the security standard every organization that stores, processes or transmits card data must follow. Requirement 3.4.1 covers what people can see. In the PCI Security Standards Council's own words, it “requires that no more than the BIN and last four digits of the PAN are displayed on computer screens, reports, etc.”, the PAN being the primary account number on the card.
Seeing more is allowed only with a reason on paper. The Council's FAQ says more digits may be shown only if there is “a documented business justification for seeing more digits”, which should explain why that person or role needs them, be approved by management and be available for an assessor to review.
| What is shown | Example | Within 3.4.1? |
|---|---|---|
| BIN and last four | 411111 •••••• 1111 | Yes, the maximum by default |
| Last four only | •••• •••• •••• 1111 | Yes, and safer |
| Full card number | 4111 1111 1111 1111 | Only for a role with a documented justification |
| CVV or security code | 123 | Should never be on a support screen: PCI DSS forbids storing it after authorization |
The example numbers are test card numbers, not real accounts.
Where full card numbers show up on shared screens
| Team | Where the number appears | Typical moment |
|---|---|---|
| Customer support | Admin panels, order lookups, payment-method screens | Walking a customer through their account |
| Billing and finance | Payment processor dashboards, refund screens, exports | Reviewing a disputed charge with a colleague or vendor |
| Fraud and risk | Transaction searches, chargeback evidence | Training sessions with real cases |
| Sales and onboarding | Customer records and notes with pasted card details | Demoing the CRM on a live account |
| Developers and QA | Logs, test tools, payment form debugging | Debugging checkout on a call |
A two-layer setup that keeps card numbers masked
Layer 1: mask in the systems you own
- Configure admin panels, CRMs and helpdesks to show only the last four digits by default. Most payment processors already do this in their dashboards.
- Keep full-number access to the few roles with a documented justification, and log when it is used.
- Never paste card numbers into tickets, chat or CRM notes. Use a secure payment link or your processor's hosted forms instead.
Layer 2: blur in the browser before you share
Layer 1 does not cover the places you do not control: a legacy tool, a vendor portal, an export opened in the browser, a note an agent pasted last year. BlurPilot covers any web page you open:
- Press Alt+Shift+H before the call. Card numbers of 13 to 19 digits, in real card groupings, are found and checked with the Luhn checksum, then blurred on every tab. This is part of the Free plan.
- Because the checksum is verified, order numbers, phone numbers and dates stay readable, so the screen is still useful to the customer.
- With Pro, the paste guard asks before a card number is pasted into a web field while you are presenting, and IBANs are blurred too.
- Team leads can export one rule pack for the whole support team, and IT can push it to managed browsers through policy.
Detection runs locally and BlurPilot never stores or transmits page content, so it adds no new system that touches card data.
If a full card number was shown on a call
- Stop sharing and, if the call is being recorded, stop the recording.
- Tell your compliance or security lead straight away, with the time, the meeting, who attended and what was visible.
- Contain copies: do not download or forward the recording until your compliance lead says how to handle it.
- Follow your incident response plan, which PCI DSS requires you to have. It decides whether the cardholder, your acquirer or the card brands need to be told.
- Fix the cause: mask the field at the source, and turn on BlurPilot for that tool so the next call cannot repeat it. If personal data was involved, see also whether a screen-share slip is a GDPR breach.
Frequently asked questions
Is it a PCI DSS violation to show a card number on Zoom?
Showing more than the BIN and last four digits to people without a documented business need conflicts with PCI DSS Requirement 3.4.1. Whether it is a reportable incident depends on your environment, so involve your compliance lead or QSA.
How many digits of a card number can be displayed under PCI DSS?
At most the BIN (the first six or eight digits) and the last four. Showing more requires a documented, management-approved business justification for that specific role.
Can support agents ask customers to read out or share their card details on a call?
Avoid it. Use a secure payment link or your processor's hosted form, so card details never appear on an agent's screen, in a recording or in a ticket.
How does BlurPilot know a number is a card number?
It looks for 13 to 19 digits in real card groupings and confirms them with the Luhn checksum before blurring, so order numbers, dates and phone numbers are not blurred by mistake.
Does BlurPilot make us PCI DSS compliant?
No tool does that on its own. BlurPilot is an extra safeguard that reduces the chance of a card number appearing on a shared screen. Masking in your own systems, access control and your incident response plan remain essential.
Is card number blurring part of the free plan?
Yes. Emails, phone numbers and card numbers are blurred automatically on the Free plan. Pro adds IBANs, API keys, the paste guard and unlimited rules.