Reference

BR-51 Card primary account number must be masked

In accordance with card payment security standards, the invoice shall never include a full card primary account number (BT-87); PCI rules allow at most the first 6 and last 4 digits.

Problem Description

In accordance with card payment security standards, the invoice shall never include a full card primary account number (BT-87); PCI rules allow at most the first 6 and last 4 digits.

ERROR

XRechnung 3.0

Context and Significance

This rule comes from the EN16931 core semantic model enforced by the KoSIT XRechnung 3.0.2 Schematron, ensuring invoices carry the mandatory data needed for automated processing.

Solution

Mask cac:CardAccount/cbc:PrimaryAccountNumberID so only the first 6 and last 4 digits remain, replacing the middle digits with a masking character.

Quick actions

Validate XML Convert invoice

Valid Examples

Use these points as the practical checks for this section.

BT-87 = 401288******1881 (masked)

Invalid Examples

Use these points as the practical checks for this section.

BT-87 = 4012888888881881 (full PAN exposed)

Code Examples

Valid XML

<cac:PaymentMeans>
  <cbc:PaymentMeansCode>48</cbc:PaymentMeansCode>
  <cac:CardAccount>
    <cbc:PrimaryAccountNumberID>401288******1881</cbc:PrimaryAccountNumberID>
    <cbc:NetworkID>VISA</cbc:NetworkID>
  </cac:CardAccount>
</cac:PaymentMeans>

Invalid XML

<cac:PaymentMeans>
  <cbc:PaymentMeansCode>48</cbc:PaymentMeansCode>
  <cac:CardAccount>
    <cbc:PrimaryAccountNumberID>4012888888881881</cbc:PrimaryAccountNumberID>
    <cbc:NetworkID>VISA</cbc:NetworkID>
  </cac:CardAccount>
</cac:PaymentMeans>

Affected Fields

BT-87 Payment card primary account number

Validation Tools

Official KoSIT Validator

Validate your XRechnung files against all BR-DE rules.

Convert PDF to XRechnung

Automatic validation error fixes when converting.