# BR-51 Card primary account number must be masked

In accordance with card payment security standards, the invoice shall never include a full card primary account number (BT-87); PCI rules allow at most the first 6 and last 4 digits.

## Problem Description

> **WARNING**: EN 16931 core business rule (CEN)

## Context and Significance

This is an EN 16931 core rule whose severity depends on the syntax: the validation artefacts report it as a warning for UBL and as a fatal error for CII. It protects card data: an invoice passes through several systems and is archived for years, so it must never expose a usable card number. The validator reports BT-87 whenever the value is longer than 10 characters, even if the middle digits are masked with asterisks. The message appears when an ERP or payment provider exports the full or masked card number.

## Solution

Fill cac:CardAccount/cbc:PrimaryAccountNumberID (CII: ram:ApplicableTradeSettlementFinancialCard/ram:ID) with at most 10 characters, preferably only the last 4 digits of the card and no masking characters. The Schematron warns on any value longer than 10 characters, including a masked 16-character number.

- [Validate XML](/en/xrechnung-validator?source=resource&rule=BR-51)
- [Convert invoice](/en/pdf-to-xrechnung?source=resource&rule=BR-51)

## Valid Examples

- BT-87 = 1881 (last 4 digits only)

## Invalid Examples

- BT-87 = 4012888888881881 (full PAN exposed)
- BT-87 = 401288******1881 (masked, but 16 characters is still longer than 10)

## Code Examples

### Valid XML
```
<cac:PaymentMeans>
  <cbc:PaymentMeansCode>48</cbc:PaymentMeansCode>
  <cac:CardAccount>
    <cbc:PrimaryAccountNumberID>1881</cbc:PrimaryAccountNumberID>
    <cbc:NetworkID>VISA</cbc:NetworkID>
  </cac:CardAccount>
</cac:PaymentMeans>
```

### Invalid XML
```
<cac:PaymentMeans>
  <cbc:PaymentMeansCode>48</cbc:PaymentMeansCode>
  <cac:CardAccount>
    <cbc:PrimaryAccountNumberID>401288******1881</cbc:PrimaryAccountNumberID>
    <cbc:NetworkID>VISA</cbc:NetworkID>
  </cac:CardAccount>
</cac:PaymentMeans>
```

## Affected Fields

- [BT-87 Payment card primary account number](/resources/xrechnung/bt-87-payment-card-primary-account-number)

## Related Rules

- [BR-49](/resources/kosit-validator-errors/br-49-payment-means-type-code-required)

## Validation Tools

- [Official KoSIT Validator](https://github.com/itplr-kosit/validator): Run the official KoSIT validator with the XRechnung configuration to check EN 16931 and XRechnung rules.
- [Convert PDF to XRechnung](/pdf-to-xrechnung): Find validation errors during conversion and review each correction.

## Related Resources

- [Official Specification](https://docs.peppol.eu/poacc/billing/3.0/rules/ubl-tc434/)
- [Test Suite](https://github.com/itplr-kosit/xrechnung-testsuite)
- [All validation errors](/resources/kosit-validator-errors): Overview of the EN 16931, XRechnung and Peppol validation rules explained here.