Call center agents must confirm a caller's identity using only the last four digits of the payment card, while the billing system must keep storing and charging the full card number. Which data protection method best meets both requirements?
Select an answer to reveal the explanation.
Short Explanation
Your agents only need a peek, not the whole card. Masking is like a sticky note covering most of the number: the full value's still underneath for billing, but you only show the last four. Hashing, encrypting or scrambling the display won't give them those four clean digits.
Full Explanation
Data masking replaces part of a value with substitute characters at the point of display or extraction while leaving the original intact where the business needs it. Showing agents a value such as the last four digits with the rest replaced by placeholder characters satisfies the identity check and limits what an insider or shoulder surfer can see, while the billing platform continues to store and charge the full card number. Hashing produces a fixed-length digest that cannot be read back, so agents would have no usable digits to compare with the caller's answer, and a digest of a card number is also vulnerable to brute force because the input space is small. Encrypting the field and displaying ciphertext gives agents nothing readable until a key is released, and releasing the key exposes the entire number, defeating the minimization goal. Data transpose rearranges values to obscure them, but scrambled digits on screen neither preserve the last four reliably nor provide meaningful protection against someone who knows the pattern. Exam caveat: masking protects the view, not the stored value, so storage still needs its own controls. Operational check: sign in with an agent role and confirm only the last four digits appear on every screen, report and export, then confirm billing still processes full card numbers.