Input mask on credit card number & SSN

Question

Our company is discussing the use of an input mask (asterisk) on credit card numbers and social security numbers.

I'm completely against masking the CCN, from a UX perspective, especially since our site demographics include the elderly and vision impaired.

I'm also mostly against masking the SSN for the same reasons, but since this is more commonly memorized than a CCN, I can see some arguments for masking it.

I already have several reasons why not to mask these, so I'm mainly looking for arguments to mask them. But feel free to list any other reasons not to mask, as well, in case there are some I'm not thinking of.

Answer 1

The alleged use case for masking is people might be looking over your shoulder. In reality that's of course very rare; the few times someone is looking over your shoulder you'll almost certainly know (presenting/sharing something on your PC with someone) and you'll probably either not input any passwords, or you'll ask them to look away (or turn off your projector). Outside of certain contexts where over the shoulder reading really IS a risk (like demo/presentation PCs which really shouldn't be accessing private data anyway), the real factor is trust. People expect password fields to be masked so there's an implicit breach of trust when users see it unmasked.

Related is Why should we ask the password twice during registration? and my answer on the topic of password masking/unmasking. In an old usability test a group of friends and I discovered 20% of our users explicitly mentioned the password being unmasked; and this was just a college project to try out a usability test, not a real product.

However, while masking passwords is a convention (and built-in functionality to browsers and operating systems the world over), masking credit card numbers and SSNs is not generally expected. So you don't get that shock of "OMG my password isn't masked?!" If anything it is a convention to not mask these fields on other sites, so your users might have the doubly unpleasant shock of input being both different and much more difficult.

Finally, checking the wrong credit card number can get you/people/the card in trouble. If your masked design results in a bunch of failed credit card # checks against the wrong address (because people mistyped it and couldn't see it) people could potentially get fraud alerts. And with Social Security Numbers you probably can't validate them at all, so if the user can't validate them and you save the wrong one you've screwed up pretty massively.

The only proper use-case I can imagine for masking CC/SSN would be in a system with complete validation, so if the proper SSN for that user isn't entered, you get an error, and where the system is in a very public place where the over-the-shoulder problem is real. An example of this is the standard ATM workflow, however ATMs just want your PIN, which is much much easier to put in with masking and, unlike SSN, can always be validated.

Answer 2

When the user is on a public computer or in a public place.

This is not always the case since a lot of people have their own computers at home but anytime time there is a chance for someone to walk by or look over your shoulder there is potential for someone to see your private info.

Think of how often you may have used a computer at a university, or hopped onto the free wifi at a coffee shop or elsewhere. There are people around you that may not have the best of intentions.

Answer 3

The only argument to mask (that I can think of) would be a concern that this information is being input in an environment where it could be seen by passersby (for example, filling out this form on a computer in a library or other public place).

That's a pretty valid concern, and I think your company's right to at least discuss its relative merits.

I recommend taking a look at alternative masking approaches. Specifically, I think something like "mask field onfocusout" would make sense in this scenario.