I visited a local McDonald's, and I noticed part of my Visa number repeated on the receipt like this: NNNN NN__ ____ NNNN. (So out of a total of 16 digits it breaks down like this: First six digits revealed, middle six digits hidden, final four digits revealed again.)

So only 6 digits were hidden. Finding the correct number would take 1.000.000 guesses, but there is also a checksum that further decreases the number of guesses needed to 100.000 (by my, possibly wrong, calculation).

Is there a policy on how many digits can be revealed? Could cards be in danger if companies hide only the six middle digits?

As per PCI, the first 6 (BIN) and the last 4 can be shown, others should be masked:

From an official 2008 PDF: PCI Data Storage Do’s and Don’ts:


  Never store the personal identification number (PIN) or PIN Block. Be
  sure to mask PAN whenever it is displayed. The first six and last four
  digits are the maximum number of digits that may be displayed.


PAN is Primary Account Number

So as far as compliance goes, the data terminal used to print the receipt is compliant.
