Testing a DLP Credit Card rule

Question

Hello!

The theory (regarding the Credit Card DLP rule):

https://learn.microsoft.com/en-us/exchange/policy-and-compliance/data-loss-prevention/sensitive-information-types?view=exchserver-2019 and other documents

The practice:

In spite of the rule above the credit cards details can be sent without any issue - the rule does not work at all (with or without policy tips, with actions from Notify to Reject, and no incident report is being created), for example, the following email would be successfully sent without mail tips even with the action = Reject:

What am I doing wrong here?

Regards,
Michael

Answer 1

Hi @Mikhail Firsov

I suppose the cause may be your test card number (2594 6547...) isn't matched in the DLP algorithm.
It didn't trigger the rule in my test as well.
While using another number for test works for me.

According to this link: Credit card number
The card number must also pass the Luhn test.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi KaelYao-MSFT,

"The card number must also pass the Luhn test." - I thought about it and tried the real card's number - it didn't work out either :(

Answer 3

The result:

...and the email with real Visa number can be sent/received with no issues at all... :(((

Regards,
Michael