Hiding characters in a Microsoft Access Report

Factual Questions
1

I’ve inherited a good number of Access reports at work. Several of them display credit card numbers (e.g., “4111222233339999”), and I’ve been tasked with converting some of them to display only the last four digits (e.g., “************9999”). What is the quickest way to do this? Is there a setting I can adjust on the field in the report itself, or do I need to make the change in the query?

Thanks so much.

2

You could do this with an expression that will be something like:
=“******” & Right([fieldname],4)

But there’s a potentially bigger problem - storing the card numbers intact in your DB is probably a serious security risk and (depending on the nature of your business) may put you in breach of Payment Card Industry standards (Payment Card Industry Data Security Standard - Wikipedia)

3

Unless you have a real reason for retaining the CC numbers you’re better off actually changing those records rather than just changing the display properties. In general, there’s no upside to retaining CC numbers and a HUGE downside to doing so.

If you do decide to keep them I don’t know how to change the display properties, sorry.

4

I think you can also do this with display masks in the report, but that’s the sort of thing that breaks when you move to a new version of Access, and all of a suddenly, the whole number is there for all to see.

But yes, all the time you have the whole numbers in your DB, there’s a risk they will be accidentally revealed on a report, accidentally viewed by someone looking at the table, accidentally leaked to the outside world.

5

The DB itself is encrypted. We have a team upstream of me addressing PCI concerns.

6

Still sounds risky, but OK - here’s the least worst plan I can think of:

[ul]
[li]Create a query based on the table that contains the card numbers[/li][li]Include every field in the query grid, except the card number[/li][li]When you add the card number to the grid, add it by means of an expression like the one in post #2*[/li][li]Never use the raw table in any other query or report anywhere again - only ever use the query you just made instead[/li][li]Find every existing place the raw table is used, and substitute it with your query (Queries can be treated exactly like tables in Access)[/li][/ul]
*so if your field is called ‘CardNum’, use:


MaskedCardNum: "******" & Right([CardNum],4)
7

I don’t see the point in reporting a bunch of asterisks over and over again. Just label the card column “CC Last Four” and use that.

8

Agreed (that’s why I used a smaller quantity of stars, but your idea is better).

9

so that expression would just be:


CCLastFour: Right([CardNum],4)
10

Thanks.