Mask PAN (Permanent Account Number) in MongoDB

In MongoDB, you can mask PAN (Permanent Account Number) using the aggregation framework along with string manipulation operators. Below is an example of how to implement this:

db.collection.aggregate([

  {

    $addFields: {

      masked_pan_number: {

        $switch: {

          branches: [

            { case: { $eq: [{$strLenCP: "$pan_number"}, 16] }, then: {$concat: ["XXXX-XXXX-XXXX-", {$substr: ["$pan_number", 12, -1]}]} },

            { case: { $eq: [{$strLenCP: "$pan_number"}, 15] }, then: {$concat: ["XXXX-XXXXXX-", {$substr: ["$pan_number", 11, -1]}]} },

          ],

          default: "Invalid PAN Number"

        }

      }

    }

  }

])

This pipeline adds a new field masked_pan_number to each document in the collection, which contains the masked PAN number based on its length.

Example:

Let's say you have a document in the collection with the PAN number '1234567890123456':

db.collection.insertOne({pan_number: '1234567890123456'})

Applying the aggregation pipeline:

db.collection.aggregate([

  {

    $addFields: {

      masked_pan_number: {

        $switch: {

          branches: [

            { case: { $eq: [{$strLenCP: "$pan_number"}, 16] }, then: {$concat: ["XXXX-XXXX-XXXX-", {$substr: ["$pan_number", 12, -1]}]} },

            { case: { $eq: [{$strLenCP: "$pan_number"}, 15] }, then: {$concat: ["XXXX-XXXXXX-", {$substr: ["$pan_number", 11, -1]}]} },

          ],

          default: "Invalid PAN Number"

        }

      }

    }

  }

])

The result would be:

{

  "pan_number": "1234567890123456",

  "masked_pan_number": "XXXX-XXXX-XXXX-3456"

}

Here are few FAQs:-

1. Why should PAN numbers be masked in a database?

   - PAN numbers are sensitive information and should be protected to prevent unauthorized access and identity theft.

2. Can the original PAN number be retrieved from the masked version?

   - Ideally, the masking process should be irreversible to maintain data security. Therefore, the original PAN number should not be easily retrievable from the masked version.

3. How can I ensure that masked PAN numbers remain usable for certain operations?

   - By retaining some part of the original PAN number, such as the last few digits, you can maintain the usability of the data for operations like identification or verification while still protecting sensitive information.

4. Are there any legal requirements for masking PAN numbers?

   - Yes, various regulations such as PCI DSS (Payment Card Industry Data Security Standard) mandate the protection of sensitive cardholder data, including PAN numbers. Masking PAN numbers helps organizations comply with these regulations.

5. Can I customize the masking format for PAN numbers?

   - Yes, you can customize the mask.