@foone PCI actually permits this. There's approx no entropy in the first 6 digits; they just identify your bank. There's a US federal law against this IIRC, but for those of us who work in card payments in Europe first6 + last4 is what we see all the time