Why are my VIN and email partly hidden on the order page?
On purpose. The order page shows only the last six VIN characters and a masked email so a shared screen cannot leak them. Check the last six against your VIN.
Check the review date and linked sources for context. Live availability, prices and record coverage can vary by VIN, source, jurisdiction and time.
By design, not by mistake. The order page prints your VIN as six bullets plus its last six characters, and your email with only the first two characters of the local part visible. It is a privacy measure for a page that may be open on a shared or forwarded screen. The last six characters are the production serial number, so they are enough to confirm the right vehicle was ordered.
- The masking happens server-side: the order API never returns a complete VIN to the page.
- Compare the visible last six characters with the VIN on your car or paperwork.
- The mismatch notice deliberately does not print the checkout email, for the same privacy reason.
How the masking works
Your VIN is stored encrypted. When the order API builds the response, it decrypts the VIN, checks that it is valid, and returns only six bullet characters followed by the last six characters — the full value never leaves the server for that page. The display helper adds a second guard: if a future payload ever contained a complete 17-character VIN, it would still mask it before rendering.
Emails get the same treatment. The masked form keeps the first two characters of the local part and the full domain, replacing the middle with bullets, so you can recognise your own address without exposing it. The dashboard uses the same idea for the “Signed in as” line.
Checking it is the right vehicle
Characters 12 to 17 of a VIN are the production serial number — the part that differs between two otherwise identical cars — so the six characters on screen are a real check, not decoration. Read them against the VIN on the dashboard plate, the door jamb sticker or the title. If they match, the order is on the vehicle you intended.
The refund policy is built around the same handle: when you write to support you are asked for the checkout email, the order ID and the VIN ending in the last six characters, and told never to email full payment-card details. If the last six do not match what you entered, contact support rather than paying again.
Steps
- Read the six visible characters against the VIN on the car or title.
- Check that the masked email domain is the address you use.
- Keep the eight-character order reference for support.
- If the last six do not match, contact support before re-purchasing.
What this does not cover
- Masking hides the first eleven VIN characters, so it cannot help you spot a typo in the manufacturer or attribute section.
- If the stored VIN cannot be decrypted or fails validation, the field is simply omitted rather than shown partly.
- A mismatch notice about a different account intentionally shows no email at all, so it cannot tell you which address paid.
Sources reviewed
Open the underlying public source and verify that its scope matches the question you are asking.
Frequently asked questions
Does the report itself show the full VIN?
The masking described here applies to the order and account screens, which deliberately never receive the complete value. Check the delivered provider PDF for the vehicle identification as the provider issued it.
Why does the mismatch message not show the checkout email?
Because printing it would leak the payer's address to whoever is signed in. The notice says so directly: for privacy, the checkout email is not displayed there. Sign out and use the checkout email instead.
Can I get the masked VIN unmasked by support?
Support does not need to unmask it for you. Quote the last six characters, the checkout email and the order ID — that is exactly the combination the refund policy asks for — and never send card details by email.