Card numbers in a spreadsheet: what counts as card data, what must not be kept, and what to do when you find some

Payment card numbers turn up in order exports, refund sheets and notes columns. This guide explains the terms the card industry uses, why a security code is treated differently from a card number, how Excel can damage a long number, and what to do before the file goes to anyone else.

A card number is a small thing to find in a spreadsheet. It sits in an order export, a refund list, or a note typed by a colleague during a phone call. The note reads: "customer paid by card, 4111 1111 1111 1111, security code 123." Then someone asks for the file, to look at it, to analyze it, or to fix a fault, and the number travels with it.

This guide explains what the card industry calls these details, why some of them are treated more strictly than others, and what to do when you find one before the file goes anywhere.

Key terms

PAN (primary account number): the long number on the front of a payment card, usually 16 digits, that identifies the card account.
Cardholder data: in the card industry's terms, at least the full PAN. The name, the expiry date and the service code count as cardholder data when they appear with it.
Sensitive authentication data: security details that prove the card is genuine or that its holder is present, such as the security code, a PIN, and the full data from the card's magnetic stripe.
Security code: the three or four digits printed on the front or back of a card. The card brands call it CAV2, CVC2, CVN2, CVV2 or CID.
PCI DSS: the Payment Card Industry Data Security Standard, a set of security requirements published by the PCI Security Standards Council, an industry body.

What do the terms mean?

The PCI Security Standards Council keeps a glossary. In it, the PAN is the unique payment card number that identifies the issuer and the cardholder account. Cardholder data is, at a minimum, the full PAN, and the cardholder's name, the expiry date and the service code may be part of it when they appear with the PAN. Sensitive authentication data is the security-related information used to check the card and its holder, and the glossary lists the card verification code, full track data, PINs and PIN blocks.

The distinction matters because the Council treats the two groups differently. Its published answers say that sensitive authentication data must not be stored after a payment has been authorized, even if it is encrypted. A security code in a spreadsheet is therefore a more serious find than a card number.

Does PCI DSS apply to you?

That depends on how you take payments, and your payment provider can tell you. The Council says PCI DSS applies to any business that stores, processes or transmits cardholder data. Each card brand runs its own program that sets who must show they comply, and how. The standard was written by an industry body, not by a government. Some places refer to it in their own law: Nevada, for example, requires a business there that accepts payment cards to comply with the current version. Ask your adviser whether a law of this kind applies to you. This guide does not say what it requires of your business. The practical point holds either way: a file that holds card numbers gives its recipient something that can be misused, so it needs a reason, a decision and an owner before it leaves your hands.

Where do card numbers hide in a spreadsheet?

They are rarely in a column called "Card number". They often turn up in:

A notes or comments column, typed by someone who took a payment by phone.
A refund or dispute sheet, copied from an email or a message.
A reference column that the payment system fills in, which may hold only the last four digits or may hold more.
An old export that someone kept in case it was needed again.
A second sheet, a hidden sheet, or a comment attached to a cell. Hidden data in Excel files explains the places a workbook can keep details you do not see.

Look for long runs of digits, often written in groups of four. Most card numbers have 16 digits, and some have fewer or more. If a column is a mix of text and numbers, read the longest entries.

What happens when Excel holds a long number?

Excel keeps only 15 significant digits in a number cell. Microsoft says that any number past the 15th digit is rounded down to zero, and gives credit card numbers as an example. A 16-digit card number stored as an ordinary number therefore loses its last digit, which becomes 0. The loss cannot be undone by changing the format afterward. Microsoft's advice is to format the cells as text before the number is entered, or to type an apostrophe first.

Two things follow. A card number that was damaged this way is not a working card number any more, but it is still a sign that someone pasted card numbers into a spreadsheet, and the other digits are real. And a tool that checks numbers may not recognize a damaged one, so you cannot rely on a tool alone to tell you a file has no card numbers in it. Read the file.

What do you do when you find card numbers?

Stop. Do not send the file, upload it to an AI service, or attach it to a ticket.
Do not spread it. Do not copy the file into a chat, an email or a shared folder to "have a look".
Tell the person who owns the payments in your organization. This may be a finance lead, a security contact or your payment provider's support. They will know whether the rules apply and what must be done.
Find where else the file lives. The same export may be in an email, a download folder or a backup.
Make a working copy without the card details. Delete the column or the notes that hold them, or replace the numbers, and check the result. The next section explains how.
Keep the original out of reach until the person responsible has told you what to do with it. Do not delete it on your own if you may be asked to account for it.

How do you remove card details from a copy?

Work on a copy, and decide first what the person receiving the file needs. An analysis of sales needs the date, the amount and the product. It does not need the card number or its expiry date, and nobody needs the security code at all.

Detail	Does the analysis usually need it?	What to do in the copy
Full card number	Almost never	Remove the column, or replace each number with a stand-in
Last four digits	Sometimes, to match a payment	Keep only the last four, if a match is needed
Expiry date	Almost never	Remove
Security code, PIN	Never	Remove, and tell the owner of the payments that the original holds them
Cardholder name	Rarely	Remove or replace with a stand-in

Then check the copy with the list at the end of this guide.

What does this look like with an invented example?

A shop exports a month of phone orders. A notes column has this entry. The card number is one that payment companies publish for testing, and everything else is invented:

Row in the export	Row in the copy
20 Oct, 84.00, "paid by card 4111 1111 1111 1111 exp 09/28 code 123, deliver to Mrs Marlowe, 7 Mill Lane"	20 Oct, 84.00, notes column removed

The analysis of sales by day does not need the notes, so the whole column goes. The original, which holds the number, the expiry date and the code, stays where it is until the owner of payments has said what to do with it.

What should you check before the copy goes anywhere?

How can DataAttendant help?

DataAttendant is a tool that runs in your web browser, on your own computer. You open a CSV or Excel file, and it looks for card numbers, names, email addresses, phone numbers and other personal details. It suggests what to do with each kind.

It finds a card number by its form: 12 to 19 digits with a known card brand's starting digits and a valid check digit. The digits can be written together or in groups separated by spaces or by hyphens. It finds such a number in a column of card numbers, on a hidden sheet, and inside a sentence in a notes column. When it marks a whole column as card numbers, the treatment you choose applies to every value in it, including one it did not recognize.

You choose the treatment. The starting rules keep the last four digits and hide the rest. You can instead remove the column or replace each number with fixed text or a code. Two of the ready-made rule sets replace each number with "[CARD]". You see a preview and a list of what remains before you download the copy.

It has limits that matter for card data:

It does not look for a security code, a PIN or an expiry date. In the example note above, it changes the card number but leaves "exp 09/28 code 123" as they are.
It does not recognize a number with a wrong digit, a number whose groups mix spaces and hyphens, or one with a double space.
A 16-digit number that Excel has already cut short usually fails the check digit. In a column of such numbers, DataAttendant may propose another type, such as an internal identifier, instead of card numbers.
It does not change the text of a comment in an Excel file. A card number in a comment stays in the copy, so remove the comment in Excel first.

It does not decide whether the card industry's rules apply to you or whether a file may be shared. DataAttendant does not claim that a copy, or your use of it, is compliant with those rules or with any law. Read the copy yourself as well. Your file is processed in your browser and is not sent to DataAttendant. How DataAttendant works shows the steps.

Sources

PCI Security Standards Council, PCI SSC Glossary (entries Account Data, Cardholder Data, Primary Account Number, Sensitive Authentication Data, Card Verification Code; the page shows no version or date), pcisecuritystandards.org. Read 2 November 2026.
PCI Security Standards Council, FAQ 1533, "Why is storage of sensitive authentication data after authorization not permitted even when there are no PANs in an environment?" (July 2021). Read 2 November 2026.
PCI Security Standards Council, FAQ 1216, "Does the PCI DSS apply to acquirers?" (January 2013): who the standard applies to, and that each card brand runs its own program for checking that businesses meet it. Read 2 November 2026.
Nevada Revised Statutes, section 603A.215, subsection 1 (Nevada Legislature, leg.state.nv.us). Read 2 November 2026 in two published copies of the statute, Public.Law and FindLaw (the latter current as of 1 January 2025), because the Legislature's own page could not be opened that day.
Microsoft, "Keeping leading zeros and large numbers" (Excel support article; the page shows no date other than its copyright year, 2026): the 15-digit limit and the advice to use a text format. Read 2 November 2026.
Whether the PCI rules apply to your business, and in what form, is for your payment provider and your own contract. The law that applies to personal data in the file is a separate question for your data protection contact.