Is masked pan unique?

Question

I can retrieve my customer's credit card number and pan hash from a payment solution as follows:

492500******1234

The payment solution I use can generate different pan hashes each time for the same credit card, so this causes multiple records for the same card in my database. To prevent this I am thinking to make the card number column (which stores values as seen above) unique to provide uniqueness. Does this number is unique? At least for each customer?

Answer 1

A masked PAN is obviously not globally unique. There is a decent chance it would be unique per customer, though not guaranteed. To make it more unique you could combine it with expiry date and then hash the two together (PCI-DSS determines the expiry date is only sensitive data if stored with the full PAN)

I would have thought your payment provider would be able to provide a unique token per submitted card though?