Credit card masking
Replace detected card numbers in conversation text and subjects with stars, with optional last-four-digit display.
What it is
Card masking replaces digits in detected payment-card numbers with stars. It applies to conversation message text and subjects, including email subjects. An optional mode leaves up to the last four digits visible.
Who uses it and why
Operators and visitors see masked text where the detector finds a card number. Administrators ask Powerfront to configure the website's masking policy and any exclusions.
Where to find it
Powerfront manages these controls in Settings › General Settings › Admin, under Security. The screen includes Test Credit Card Masking for checking sample text.
How it works
When masking is configured and active, INSIDE checks text for supported card-number patterns. It can recognise numbers separated by spaces or other short separators. Detected digits are replaced with stars before the processed text continues through the conversation.
With Use PCI DSS for CC masking off, all detected digits are masked. With it on, up to the last four digits remain visible. Message and subject processing use the same card detector.
Exclusions allow matching content to remain visible. In non-email messages, an exclusion can bypass masking for the whole message. Email processing applies exclusions to smaller portions of the text.
Configure it
Ask Powerfront to review Disable Credit Card Number Masking and confirm masking is active for your website. The switch is off by default in the Settings screen, but the existing website configuration still needs to be checked.
Ask Powerfront whether you need last-four-digit display or any exclusions. Use CC Masking Exclusions and Use PCI DSS for CC masking are off by default. The exclusion list has no initial entries.
Powerfront can use Test Credit Card Masking with non-sensitive sample text to check the result. Enabling payment forms turns off Disable Credit Card Number Masking during website start-up.
Settings
| Setting | Where | Applies to | Default | Who can change it | What it does |
|---|---|---|---|---|---|
| Disable Credit Card Number Masking | Settings › General Settings › Admin | website | Off | Powerfront | Turns off configured card-number masking when enabled. |
| Use CC Masking Exclusions | Settings › General Settings › Admin | website | Off | Powerfront | Applies the configured exclusions to card-number detection. |
| CC Masking Exclusions | Settings › General Settings › Admin | website | Not set | Powerfront | Defines matching rules for text or numbers that should bypass masking; no exclusions apply until rules are added and Use CC Masking Exclusions is enabled. |
| Use PCI DSS for CC masking | Settings › General Settings › Admin | website | Off | Powerfront | Leaves up to the last four digits of a detected card number visible instead of masking all its digits. |
Limits and good to know
- This detects card-like numbers, not every form of sensitive information or every long number.
- The shared detector searches the first 4,000 characters of its input. Text after that point is retained without that detector's scan.
- Web addresses are skipped by the shared detector.
- Exclusions can leave sensitive digits visible, including elsewhere in the same non-email message.
- A processing failure can leave the original text unchanged. Masking is not a guarantee that no card number can be stored or delivered.
- The option's PCI DSS label describes the last-four-digit mode. It is not a statement that your entire payment process meets that standard.
Depends on and works with
View all connections as a list
This feature uses
- Admin settings and feature switches · managed by PowerfrontConfigured by
Powerfront manages the website's masking switches and exclusions in Admin.
- PCI Payment Form in web chatConfigured by
Enabling payment forms turns on card masking when the website starts.
Used by
- Messages and rich contentConfigured by
Number and payment-card masking can alter displayed content.
- Typing indicators and typing previewConfigured by
Visitor draft previews apply configured number masking before transmission.
- Redacting and permanently deleting conversation dataConfigured by
Automatic credit-card and number masking has separate settings and exclusions.
- PCI Payment Form provider setupRelated
Payment-form enablement also activates chat card-number masking, which protects message text separately.
FAQ and troubleshooting
Why are the last four digits still visible?
Powerfront may have enabled Use PCI DSS for CC masking. That mode permits up to the last four digits to remain visible.
Why was a long order number left unchanged?
The detector checks supported card-number patterns. A long number is not automatically treated as a payment-card number.
Why did masking miss a number?
Ask Powerfront to check the active configuration, exclusions and the text's length and format. The shared detector skips web addresses and text after its first 4,000 characters.
Can I change the exclusions myself?
Powerfront manages this screen. Ask Powerfront to review and test the exclusion you need.