Securing Credit Card Data: Masking vs Tokenization

Why the Answer Is Correct

Masking is the process of hiding specific parts of sensitive data while leaving the rest visible, typically by replacing characters with asterisks or hashes. In the context of credit card processing and PCI DSS standards, displaying only the last four digits is the standard implementation of masking. This allows support agents or systems to verify the identity of the cardholder without exposing the full Primary Account Number (PAN), satisfying the requirement to "see only the last four numbers."

Why the Other Options Are Wrong

Encryption transforms data into ciphertext that cannot be read without a key; it does not allow for viewing partial plaintext digits like the last four. Hashing is a one-way function that produces a fixed-length string; it is irreversible, so you cannot derive the last four digits from a hash. Tokenization replaces the sensitive data with a non-sensitive equivalent (token) that has no intrinsic value; the token does not resemble the original card number, so you cannot view the actual last four digits of the real card through the token alone.

Community Comment Notes

The community vote heavily favored Masking (C), aligning with the official exam logic. Some users argued for Tokenization, noting its superior security posture in storage/transit, but they missed the specific constraint of retaining visibility of the original digits. As one commenter noted, "this is wrong, the correct answer is 'tokenization'", but this overlooks the functional requirement of the question. Another user simply stated "Tokenizacion is Right", ignoring the definition of masking. The consensus correctly identifies that if you need to see the last four digits, the data must still be the original PAN, just obscured.