I think it makes more sense in the context of how much extra information is being given away, rather than how easy it'd be to brute force the remaining digits.
A PAN is not entirely a random value, it's made up of:
- a six-digit Issuer Identification Number (IIN) (previously called the "Bank Identification Number" (BIN)) the first digit of which is
the Major Industry Identifier (MII),
- a variable length (up to 12 digits) individual account identifier
- a single check digit calculated using the Luhn algorithm
http://en.wikipedia.org/wiki/Bank_card_number
Therefore using this information:
My company's database supplies me with name, address, card type,
truncated PAN, and expiry date of the card/holder
You could probably narrow down the first 6 digits pretty easily to quite a small set of possibilities.
That only leaves the last 4 digits, one of which is a check-digit and therefore doesn't contain any additional entropy.
So basically you're only giving away 3 digits, even if all 10 that are allowed are exposed.
this leaves only 100,000 card numbers to brute force in order to get
the one I want
I'm guessing it would be fairly hard to execute such a brute force attack as most payment processors would lock you out very quickly.
PCI DSS also says:
Note: It is a relatively trivial effort for a malicious individual to
reconstruct original PAN data if they have access to both the
truncated and hashed version of a PAN. Where hashed and truncated
versions of the same PAN are present in an entity‘s environment,
additional controls should be in place to ensure that the hashed and
truncated versions cannot be correlated to reconstruct the original
PAN.
Which should prevent the attacker from staging an offline brute force attack.
Also, these are the minimum requirements. It states in principle 7 that:
Requirement 7: Restrict access to cardholder data by business need to
know
I imagine displaying all 10 allowable digits to customers would fall outside "need to know". Perhaps the last 4 are required to identify which card is which, but most users wouldn't need to know the first 6 except perhaps to be shown what type of card it is.