Displaying last-4 digits of the credit card number

[nahabed]

We're using ActiveMerchant with an e-commerce Rails app integrated
with PayPal Webstie pro.

We'd like to implement the feature whereby the credit card number -
once validated and saved - is always displayed masked (xxxx) with only
the last 4 digits displaying.

This has caused some consternation among our developers :) on how to
deal with varying number of credit card digits (15 vs. 16, etc). I'm
wondering if someone out there has done this already?

Thanks. Roupen N.

[Greg Furmanek]

Hi Nahabed

I am amazed however that such trivial problem causes consternation.
I hope I am understanding your question correctly so I will try to restate
with an example:

4123456700009191 => xxxxxxxxxxxx9191
372345600009191 => xxxxxxxxxxx9191

Here is a solution that should work for all problem stated above.
It substitutes everything except the  last 4 digits with x.
It probably could be refactored into nicer code but this works quite well
by itself.

def last_for(cc)
  cc.gsub(/(\d+)(\d{4})/, "\\1").gsub(/\d/, "x") + cc.gsub(/\d+(\d{4})/, "\\1")
end

I hope you understand the responsibility you take upon yourself when
you store credit card numbers and you are designing the system to
safeguard those numbers.

- Greg

[nahabed]

Thanks Greg... we do take CC security very seriously.

So here is how we currently display the card info on the user profile
page:

In summary mode, we show "AMEX xxx-1234" or "VISA xxx-1234".

The questions is how to group the x's for display (in the cc number
input box) when the user goes to edit their payment info?

AMEX: xxxx-xxxxxx-1234
Visa: xxxx-xxxx-xxxx-1234 (same for mastercard and visa?) I understand
VISA numbers can be 13 digits, so in the case xxx-xxx-xxx-1234?

Minutia I know but trying to keep things looking familiar and logical
for end users...

Best, Roupen N.

On Jun 16, 10:20 am, "Greg Furmanek" <greg.furma...@gmail.com> wrote:
> Hi Nahabed
>
> I am amazed however that such trivial problem causes consternation.
> I hope I am understanding your question correctly so I will try to restate
> with an example:
>
> 4123456700009191 => xxxxxxxxxxxx9191
> 372345600009191 => xxxxxxxxxxx9191
>
> Here is a solution that should work for all problem stated above.
> It substitutes everything except the  last 4 digits with x.
> It probably could be refactored into nicer code but this works quite well
> by itself.
>
> def last_for(cc)
>   cc.gsub(/(\d+)(\d{4})/, "\\1").gsub(/\d/, "x") + cc.gsub(/\d+(\d{4})/,
> "\\1")
> end
>
> I hope you understand the responsibility you take upon yourself when
> you store credit card numbers and you are designing the system to
> safeguard those numbers.
>
> - Greg
>

[Greg Furmanek]

In that case I would probably just strip all the numbers before the last 4 digits
and apply the x patterns based on cc type and the length of the whole number

Visa (13):

if cc.visa? and cc.number.size = 13
  "xxx-xxx-xxx-" + cc.last4
end

You could write some clever code to do it using regular a regular expression
or using String#scan but do you really want to maintain that? 
Sometimes simple solutions are the best.

- Sincerely

Greg

[Cody Fauser]

The ActiveMerchant CreditCard object has a display_number method that
you can use. It doesn't worry about the number of digits in the card,
so it will always display 16.

card = ActiveMerchant::Billing::CreditCard.new(:number => '4242424242424242')
=> #<ActiveMerchant::Billing::CreditCard:0x3451304 @number="4242424242424242">
>> card.last_digits => "4242"
>> card.display_number => "XXXX-XXXX-XXXX-4242"

--
Cody Fauser
http://shopify.com - e-commerce done right
http://www.codyfauser.com - blog
http://peepcode.com/products/activemerchant-pdf - ActiveMerchant PeepCode
http://www.oreilly.com/catalog/rjsrails - RJS Templates for Rails