Does PCI DSS apply to "hot cards," fraudulent, expired, cancelled or invalid card numbers?
If it has been confirmed that the cards are inactive or disabled, the PANs (Primary Account Numbers) no longer pose fraud risk to the payment system, and PCI DSS would not apply in these cases. If, however, the PAN is later reactivated, PCI DSS will again apply.
When payment cards expire, the same account number is often reused on the new card with a different expiry date. The PAN should be verified as not being valid before expired cards are excluded from PCI DSS scope.
Entities should retain PAN based on business/legal needs, as defined in data retention policy (PCI DSS Requirement 3.1). Remember: If you don?t need it, don?t store it.