Which type of data is categorized as Sensitive Authentication Data?

Which type of data is categorized as Sensitive Authentication Data?

• A. Cardholder Name
• B. PAN
• C. Expiration Date
• D. Full track data

Answer: (D)

Sensitive Authentication Data refers to information that directly enables the verification or forging of card credentials during a payment. Full track data is the complete magnetic stripe information from a card, including both tracks that encode the PAN, service code, expiration date, and other discretionary data. Because possessing the full track data could be used to clone a card and authorize fraudulent transactions, it is categorized as Sensitive Authentication Data. The other options—cardholder name, the PAN, and the expiration date—are cardholder data, but they do not by themselves provide the authentication material that full track data contains. PCI DSS also emphasizes that storing full track data after authorization is prohibited in most cases, to reduce risk.

Sensitive Authentication Data refers to information that directly enables the verification or forging of card credentials during a payment. Full track data is the complete magnetic stripe information from a card, including both tracks that encode the PAN, service code, expiration date, and other discretionary data. Because possessing the full track data could be used to clone a card and authorize fraudulent transactions, it is categorized as Sensitive Authentication Data. The other options—cardholder name, the PAN, and the expiration date—are cardholder data, but they do not by themselves provide the authentication material that full track data contains. PCI DSS also emphasizes that storing full track data after authorization is prohibited in most cases, to reduce risk.