What it means
When an invoice says it was paid by card (BG-18), the card number (BT-87) may only show part of the number: at most the first six and the last four digits under the PCI DSS card security standard.
Why it matters
A full card number on an invoice is a security risk, because invoices are stored, forwarded and archived by many people. This is a warning in most rule sets, so the invoice is accepted, but it is worth fixing straight away.
How to fix it
Change your invoicing software or payment integration so that it writes only the last four digits of the card, for example 1234, in the card number field. Never type a full card number into an invoice.
The rule as published
In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown. Business terms: BT-87
Where this rule applies
| Rule set | Version |
|---|---|
| EN 16931 (UBL) | 1.3.17 |
| EN 16931 (UBL credit note) | 1.3.17 |
| EN 16931 (CII) | 1.3.17 |
| XRechnung 3.0 (UBL) | 3.0.2 |
| XRechnung 3.0 (UBL credit note) | 3.0.2 |
| XRechnung 3.0 (CII) | 3.0.2 |
| Peppol BIS Billing 3.0 (invoice) | 2026.5 |
| Peppol BIS Billing 3.0 (credit note) | 2026.5 |
| Factur-X 1.09 EN 16931 | 1.0.9-2 |
| Factur-X 1.09 EXTENDED | 1.0.9-2 |
| ZUGFeRD 2.5 EN 16931 | 2.5.2 |
| ZUGFeRD 2.5 EXTENDED | 2.5.2 |
| SI-UBL 2.0 / NLCIUS (invoice) | 2.0.3.13 |
| SI-UBL 2.0 / NLCIUS (credit note) | 2.0.3.13 |
| NLCIUS (CII) | 1.0.3.13 |
| France CTC (UBL invoice) | 1.4.0-04 |
| France CTC (UBL credit note) | 1.4.0-04 |
| France CTC (CII) | 1.4.0-04 |
| CIUS-RO UBL Invoice 1.0.9 | 1.0.9 |
| CIUS-RO UBL Credit Note 1.0.9 | 1.0.9 |
Check your file
Drop your e-invoice to see whether BR-51 still fails, and which other rules do.