Sabre Masked Credit Card Number in the IUR
June 17, 2009
Customers Affected:
Sabre GDS Customers
Purpose:
Notification to all Trams, customers of enhanced standards for customer credit card protection, implemented by the Sabre GDS.
The payment card industry (PCI) compliance and validation regulations spells out what security measures must be taken to protect the private information during any transaction occurring with the use of a paycard. The PCI Data Security Standard is used by all card brands to assure the security of the data gathered when transacting on behalf of a customer.
In an effort to assist agencies with PCI Compliancy Sabre released an enhancement on June 1, 2009 to allow agencies to mask the client credit card number in the Interface Record (IUR). Although we have not seen any notifications from any other GDS's at this time, we anticipate all GDS's will eventually also offer a credit card masking option.
We want to ensure that our customers understand that once a masking option in the Interface Record has been enabled, no trace of the full credit card number will exist in the Trams database. If credit card reconciliations are performed, or any Third Party applications require the full credit number, please ensure that the masking option is disabled. There is no way for Trams to decipher a full credit card number if the card number was masked in the interface record.
Sabre has a 2 phase roll out planned. Effective 6/1/09 Sabre added a new TJR indicator called IUR Credit Card Masking which will overlay the credit card number with zeros except for the first six numerics and the last 4 numerics.
Phase 1, credit card masking is set to OFF and must be manually turned ON in the TJR. Phase 2 however, automatically turns on credit card masking (target release date August 10th, 2009) unless your TJR option is set to NEVER.
We also made a change to correctly read the new Sabre Masked credit card number in the IUR in 3.02.00.
Contact Sabre support for any assistance needed with TJR settings.
Trams Back Office recognizes the Sabre Masked credit card number as a valid format and uses the standard masking format found throughout the TBO application. Sabre masked format displays first 6 digits + Last 4 digits.
For example, payment query results screen shows the Trams Back Office masking, the Check/CC No field in the actual payment displays the Sabre Masked Credit Card number.
Contact for more information:
Linda Pannekeet, TBO Product Manager