Visa Travel Notification Service - PAN alternative

[CGimenez]

All other Visa API calls use a card ID (token) instead of the PAN, however, I cannot find any such usage in Visa Travel Notification Services (Get, Add, Change, Delete).  They all require the PAN.  We are not running in a PCI compliant environment and cannot pass the PAN.  Are there any alternative integrations that do not use the PAN?  At one time (a couple of weeks ago), I found some reference to a "Masked PAN", but couldn't find any documentation on what that was, or how to get/generate it...and now I can't find that reference again...

It seems strange that Visa TNS requires PAN when all other Visa API's (with the exception of getCardID) do not use the PAN.

Thank you for your help!

[jenn_kh]

Hi @CGimenez, Thank you for reaching out. An agent will look into this and get back to you soon. Until then, if any community member knows a solution, please feel free to reply in this thread. 

[API_Products]

Hey @CGimenez,

To address your concerns regarding the use of PAN (Primary Account Number) in Visa Travel Notification Services (TNS) and alternative integrations that do not use PAN, here's a detailed review based on the Visa Developer Platform documentation:

1. PAN Requirement in TNS: Visa Travel Notification Services (TNS) indeed requires the PAN for its operations (Get, Add, Change, Delete). This is due to the nature of the service which needs to identify the specific card involved in the travel notification.

2. PCI Compliance: Since your environment is not PCI compliant, it is understandable that you cannot handle PANs directly.

3. Alternative Integrations:
- Tokenization: Most Visa APIs support tokenization where a Card ID (token) is used instead of the PAN. However, it appears that TNS currently does not support tokenization directly.
- Masked PAN: You mentioned a reference to a "Masked PAN". While the documentation may be sparse, a Masked PAN typically refers to a partially obscured version of the PAN, which still requires PCI compliance to handle securely.

4. Possible Solutions:
- Contact Visa Support: Given the specific requirement and the lack of direct support for tokenization in TNS, it is advisable to contact Visa Developer support directly. They can provide more precise information about any upcoming features or alternative methods for handling PANs securely.
- Use a PCI Compliant Service Provider: If handling PANs is unavoidable, consider using a PCI compliant service provider to manage the integration with Visa TNS on your behalf. This way, you can still leverage the TNS functionality without directly handling PAN data.

5. Documentation Review:
- Visa Travel Notification Service API Reference: Check the official Visa TNS API documentation for any updates or additional information.
- Visa Token Service: Explore the Visa Token Service for understanding how tokenization works and if it can be applied in conjunction with TNS through some intermediary service.

6. Summary Table:

Issue	Description	Recommendation
PAN Requirement	TNS requires PAN for its operations.	Contact Visa support for alternatives or upcoming features.
Non-PCI Compliant Environment	Your environment cannot handle PAN directly.	Use a PCI compliant service provider to manage PAN data.
Masked PAN Reference	Masked PAN is mentioned but not clearly documented.	Use the Test Data located in your project app. There will be sample PAN located in your Test Data.