Storing the a cryptographic hash of the credit card number would allow for searching for receipts by credit card number without storing the actual credit card number.
Anywho, just going to engage in some half-assed napkin-math to explore the idea:
Card numbers: 6 digits for institution and 9 for the customer and 1 for checksum. Let's assume merely 20 big issuers "worth attacking". The possibility-space to search is then (20 * 9^10), or ~70 million.
Suppose that--by design--it takes 2 seconds to compute the hash. Covering the whole range would take ~4420 years. That's... not a very comforting margin.
Perhaps you could hash the credit-card along with the year-month in which the purchase occurred, but attackers probably aren't interested in >12 month old cards, so that's only a small 12x slowdown there.
It might be a different story if the system required users to also enter in data like the exact customer first/last name.
http://www.wired.com/2015/11/samy-kamkar-10-dollar-tool-can-...
Beyond that, most things display first four & last four, so you can probably assume they have that too.
Yes, I agree. Even two seconds of waiting for your search is a little on the high side, UI-wise.
> Beyond that, most things display first four & last four
My impression is that "only last four" is the most-common.