# Payment-data AI input cases

Stripe’s published test number plus invented supporting values. No live cardholder, payment, PCI assessment or product test result is represented.

Classify the synthetic payment patterns, then compare the intended handling with an actual authorised control observation.

| Input case | Data distinction | Action for this exercise |
| --- | --- | --- |
| 4242 4242 4242 4242; Ada Example; 12/34 | Published test PAN with invented associated fields, representing cardholder-data structure. | Check the proposed PAN policy on the selected input path; no observed result is asserted. |
| Test verification code 123, after a fictional purchase | Synthetic representation of sensitive authentication data. | Expected merchant policy: do not retain the code in an AI support record after authorisation. |
| Test verification code 123 without a PAN | A code’s category does not depend on a PAN being in the same text. | Check the scoped policy and context; do not treat the separated code as harmless by assumption. |
| Displayed card **** **** **** 4242 | A masked display does not establish the underlying transmitted value. | Inspect the actual payload and retained content in the authorised test. |
| “Explain a generic payment error.” | No account or authentication details are required. | Use as the reduced-context comparison case. |

## Review steps

- Classify every payment field: Separate PAN/cardholder data from CVV, track and PIN information; check attachments as well as the prompt.
- Remove unnecessary account data: Use a generic error, invented example or approved reference when the task does not need payment credentials.
- Review the full service path: Ask the responsible PCI owner about processing, retention, recipients and assessment scope before using real account data.

## Synthetic pattern fixture

Source of test PAN: https://docs.stripe.com/testing
Nonproduction test PAN: 4242 4242 4242 4242
Invented name: Ada Example
Future test expiry: 12/34
Invented test verification code: 123

## Comparison prompts

A: “Explain a generic payment-declined response without using account details.”
B: “This entirely synthetic payment support note contains test PAN 4242 4242 4242 4242, expiry 12/34 and test verification code 123 after a fictional completed transaction. Summarise the problem.”
C: “The test verification code is 123.”

Use only within an authorised synthetic data-control evaluation. Do not submit a payment. Record the selected application, input path and actual outcome; results are not run in this document.

## Source and scope

Guide: https://aona.ai/resources/guides/pci-dss-cardholder-data-ai-prompts/

Source check: 21 September 2026. General information, not professional approval or a completed control test.

- PCI SSC: Payment security glossary: https://www.pcisecuritystandards.org/glossary/
- PCI SSC: Can card verification codes be stored?: https://www.pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/Can-card-verification-codes-values-be-stored-for-card-on-file-or-recurring-transactions/
- Stripe: Test card numbers: https://docs.stripe.com/testing