Search Patron Data for Credit Card Information

Mask PAN when displayed; the first six and last four digits are the maximum number of digits you may display. Not applicable for authorized people with a legitimate business need to see the full PAN. Does not supersede stricter requirements in place for displays of cardholder data such as on a point-of-sale receipt. PCI DSS standard 3.3.

Use this feature to identify where there may be data attached to patrons that could be construed as a possible clear text credit card in violation of PCI DSS standard 3.3.

When using this search option, patrons will be listed that have a series of 3 or 4 numbers repeated 4 times. This means that anything with at least 12 contiguous digits in the various search fields might result in a match (note: it may not be a credit card).

Searching for 12 contiguous digits might find things like 4500 000 000 000 or 5200 0000 0000 0000. It doesn't matter if there are one or more spaces between the numbers or not. Data that will not be found are phone numbers like 518-444-5555 or conditions where numbers are separated by something other than spaces.

	Searching may take a short while. Tests on a very large database (400,000 patrons) with a lot of other data on a fast server yielded a total of 131 possible patrons within 8 seconds. Your mileage may vary.
	A full PCI scan on a machine with a TM database on it WILL provide FALSE POSITIVES, if you are using SVG maps and pick your own seats. The vector information for points in a map contain a lot of numbers which consistently fool disk level PCI scan's into thinking they are credit cards.

Fields searched for possible card data are:

Patron
- general notes, volunteer notes, donor notes, household notes, and the three customizable note fields on the notes tab
- marketing field #5
- donor publication name
- Client asset notes entered on the client asset setup in the 'donor' tab on the patron window.
- These could be entered on the various tabs in the patron window.
Donation
- Donation notes, custom fields, donation publication name, tax receipt name and other donation text fields.
- These would be seen on the donation window.
Order
- Internal and external order notes and ticket comments
- These would be seen on an order payment window and can also be seen in a list of orders
Credit card
- comments or name on card
- These would be seen on the credit card tab on the patron window.
Task notes
- on the task comments window.
Staff/Volunteer History
- Notes on the Activity setup window
- Notes on the history evaluation and duties fields

Fields not searched for any card data

Transaction card number field (T_CARD_NO) is not validated as it contains reference numbers for other payments (e.g. check #'s). If somebody used any payment method that is not of type credit card -- but they typed a valid card number in the field -- there is not much Theatre Manager can do. Since there is no way to manually place an edit check on check number field to verify that it is an actual check number (that look like credit cards) after the fact in Theatre Manager because that leads to audit issues; such as changing past information which Theatre Manager doesn't allow. If there are credit card numbers in the check # field, then it's a manual task for Arts Management Support to find them and clear them. Please contact Arts Management Support directly if this applies to your specific situation.
Theatre Pricing map SVG data - which can be false positive

To search Patron data for credit card information, you perform the following steps:

Click the Patron button in the main toolbar / ribbon bar.
The Contact List window opens.

For more information on the Contact List window click here.
Select PCI Data Check and click the Search button.

Any patrons who have a 12 digit string stored in any of the fields indicated will be displayed.
You can now go through and manually remove the data.
This will entail checking the fields described above, deleting the numbers and saving the record.