The Green Sheet Online Edition
September 14, 2009 • Issue 09:09:01
The word on truncation
Do merchants need to truncate credit card numbers on the merchant-retained copy of a receipt?
Southern Oregon Processing
We referred your question to Ross Federgreen, founder of CSRSI, The Payment Advisors. Federgreen, who is also a member of The Green Sheet's advisory board, provided the following response.
This is a very active component of credit card law currently despite federal regulation through Public Law 108 to 159 under Title I, Section 113.
This complex question requires both an understanding of federal law and specific state law. Since 1999, 42 states have either introduced or enacted legislation to deal with this topic. Six states have passed legislation that requires merchants to truncate both cardholder and merchant receipts.
States requiring full (cardholder and merchant) receipt truncation include Colorado, Tennessee, California, Alaska, Nevada and Washington. In addition, Kentucky enacted legislation in 2004 that has been interpreted to include both the receipt for the cardholder and the merchant.
Through the Fair and Accurate Credit Transactions Act of 2003, Public Law 108 to 159, the U.S. Congress preempted the states on credit and debit card truncation to set a national standard. Under Title I, Section 113 of the act, only the last five digits of the card account number can be printed on electronically printed receipts provided to the customer. The truncation requirement does not apply to handwritten receipts or receipts imprinted with a copy of the credit card.
Various states have enacted rules that are more stringent than the federal statute. These include Nevada and Washington. The Nevada legislation, AB 389, Chapter 161, signed by the governor on May 22, 2009, prohibits a business from printing more than the last five digits of the account number of the card on any copies of the receipt retained by the business that accepted the card.
The state of Washington enacted into law on May 7, 2009, HB 1127, Chapter 382, which provides that a person who accepts credit cards or debit cards for the transaction of business may not print more than the last five numbers of an account number or print the expiration date on an electronic receipt that is retained by the person or is provided to the cardholder. This restriction does not apply if the means of recording the number is by imprint or handwriting.
California enacted into law on Sept. 26, 2006, SB 682. It prohibits printing more than the last five digits of the credit card account number or the expiration date upon any receipt retained by the person, firm, partnership, association, corporation or limited liability company that is printed at the time of the purchase, exchange, refund or return and signed by the cardholder. This also applies to any receipt retained by the entities listed above that is printed at the time of the purchase, exchange, refund or return but is not signed by the cardholder because the cardholder used a PIN to complete the transaction.
Kentucky enacted legislation relating to credit and debit cards on April 27, 2004, which created Kentucky Revised Statutes sections 434.550 to 434.730. The law requires that electronic cash registers and similar machines print not more than the last five digits of the credit or debit card number and not print the card expiration date on credit and debit card receipts. The act does not apply to handwritten receipts or to nonelectronic imprints of credit and debit cards.
Bottom line: Depending on your state of operation and in certain instances the residence of the consumer, different rules may apply. It is strongly recommended that merchants truncate both consumer and retained receipts.
When asked whether the phrase "electronically printed receipts provided to the customer" in the federal legislation pertains only to receipts cardholders keep or whether it pertains to both merchant and cardholder copies of receipts because both are typically presented to cardholders for signature, Federgreen said that is a matter for the courts to decide because they are the ones charged with interpreting legislative intent.
I hope this clarifies the issues for you. Please do not hesitate to get back in touch if you have further questions.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.