I think it partly depends on how many customers the store has. If it&#x27;s a mom-and-pop place with a salt on their hash, attackers would get much less &quot;profit&quot; out of their search.<p>Anywho, just going to engage in some half-assed napkin-math to explore the idea:<p>Card numbers: 6 digits for institution and 9 for the customer and 1 for checksum. Let&#x27;s assume merely 20 big issuers &quot;worth attacking&quot;. The possibility-space to search is then (20 * 9^10), or ~70 million.<p>Suppose that--by design--it takes 2 seconds to compute the hash. Covering the whole range would take ~4420 years. That&#x27;s... not a very comforting margin.<p>Perhaps you could hash the credit-card along with the year-month in which the purchase occurred, but attackers probably aren&#x27;t interested in &gt;12 month old cards, so that&#x27;s only a small 12x slowdown there.