Skip to content

BR-51: Card primary account number (BT-87) is too long

Official message

[BR-51] In accordance with card payments security standards an invoice should never include a full card primary account number (BT-97). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.

EN 16931 (CII) · Error · Message language: English · Version: xrechnung-3.0.2-validator-configuration-2026-08-31

[BR-51] In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.

EN 16931 (UBL) · Warning · Message language: English · Version: xrechnung-3.0.2-validator-configuration-2026-08-31

[BR-51] In accordance with card payments security standards an invoice should never include a full card primary account number (BT-87). At the moment PCI Security Standards Council has defined that the first 6 digits and last 4 digits are the maximum number of digits to be shown.

Factur-X / ZUGFeRD EN 16931 · Error · Message language: English · Version: Factur-X 1.08 / ZUGFeRD 2.4
Severity
Error The invoice is invalid and may be rejected by the recipient.
Applies to
EN 16931 (CII), EN 16931 (UBL), Factur-X / ZUGFeRD EN 16931
Affected fields
BT-97, BT-87

What does this mean?

In accordance with card payment security standards an invoice should never include a full card primary account number (BT-87); the PCI Security Standards Council allows at most the first 6 and the last 4 digits. The check therefore allows at most 10 characters; the card number given is longer.
In CII the rule is an error, in UBL a warning. One version of the official text refers to BT-97; the card number (BT-87) is meant.

Typical causes

The full card number was copied.
The card number was masked in full length, e.g. 123456******1234; the mask characters count as well.
Spaces or hyphens between the digit groups lengthen the value.

How to fix the error

State only part of the card number, at most 10 characters, e.g. only the last 4 digits.
CII: ram:SpecifiedTradeSettlementPaymentMeans/ram:ApplicableTradeSettlementFinancialCard/ram:ID, UBL: cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID.
Generate and validate the invoice again.

In E-Rechnungsfreund

In the invoice form ("Experte" view), section "Zahlungsmittel (BG-16)" (payment means), enter at most 10 characters in the field "Karten-PAN (BT-87)" (card number), e.g. the last 4 digits.

Example

Wrong

<ram:SpecifiedTradeSettlementPaymentMeans>
  <ram:TypeCode>48</ram:TypeCode>
  <ram:ApplicableTradeSettlementFinancialCard>
    <ram:ID>123456******1234</ram:ID>
    <ram:CardholderName>Jane Doe</ram:CardholderName>
  </ram:ApplicableTradeSettlementFinancialCard>
</ram:SpecifiedTradeSettlementPaymentMeans>

Correct

<ram:SpecifiedTradeSettlementPaymentMeans>
  <ram:TypeCode>48</ram:TypeCode>
  <ram:ApplicableTradeSettlementFinancialCard>
    <ram:ID>1234</ram:ID>
    <ram:CardholderName>Jane Doe</ram:CardholderName>
  </ram:ApplicableTradeSettlementFinancialCard>
</ram:SpecifiedTradeSettlementPaymentMeans>
For developers: test expression per syntax

EN 16931 (CII) (CII)

Context: //ram:ApplicableTradeSettlementFinancialCard

string-length(normalize-space(ram:ID)) <= 10

EN 16931 (UBL) (UBL)

Context: cac:PaymentMeans/cac:CardAccount/cbc:PrimaryAccountNumberID

string-length(normalize-space(.))<=10

Factur-X / ZUGFeRD EN 16931 (CII)

Technical ID in the source: FX-SCH-A-000281

Context: //ram:ApplicableTradeSettlementFinancialCard

string-length(ram:ID)<=10

Related validation rules

  • BR-01: Specification identifier (BT-24) is missing
  • BR-02: Invoice number (BT-1) is missing
  • BR-03: Invoice issue date (BT-2) is missing
  • BR-04: Invoice type code (BT-3) is missing
  • BR-05: Invoice currency code (BT-5) is missing
  • BR-06: Seller name (BT-27) is missing

Frequently asked questions

Why does a masked card number like 123456******1234 fail?

The check counts all characters, including the asterisks. 16 characters are more than the 10 allowed. State it without mask characters, e.g. only 1234.

Last updated:
Explanation of the validation rule, not legal or tax advice.