What are credit card receipt privacy laws?

Credit card receipt privacy laws under the Fair and Accurate Credit Transaction Act (FACTA) govern what merchants are allowed to print on sales receipts. It is important to understand how this law works to protect consumers from fraud and identity theft, and know about your rights as a consumer under FACTA.

If a consumer is harmed because a merchant failed to comply with FACTA, they may have grounds to file a lawsuit.

Here are some frequently asked questions about FACTA.

What is FACTA?

The Fair and Accurate Credit Transaction Act was signed into law in 2003 as an amendment to the Fair Credit Reporting Act (FCRA), and has been in full force since 2006. The overall purpose of the law is to ensure greater accuracy of consumer’s credit information and records. Specific provisions of FACTA are intended to prevent fraudulent use of a consumer’s lines of credit and to mitigate identity theft.

What is truncation?

One way this law protects consumers from fraud is a requirement that retailers print a credit or debit card receipt in a way that hides important information — specifically, most of the digits of the card number and the expiration date — by truncating the numbers.

Essentially, truncation is the process by which information is shortened or censored, often using asterisks or other symbols to indicate the presence of a digit without revealing it. FACTA requires companies to follow specific truncation rules on receipts in order to censor enough information to adequately protect consumers.

Why is truncation important for credit cards?

The truncation process is important to protect the consumer’s credit or debit card information. By truncating or replacing the number with symbols, if the receipt falls into the wrong hands, it cannot be used by a would-be identity thief or fraudster. This is why the card number on your receipt may look something like ****-****-****-1234.

What are the credit card truncation laws?

According to FACTA rules, only the last five digits (at most) of a credit or debit card number can be shown on a receipt, though a company can choose to truncate the number even more. Often, businesses choose to show only the last four digits of a card number. Any digits other than the last five digits are prohibited from being shown.

In addition to the credit card number truncation requirement, FACTA also requires that no portion of a card’s expiration be shown on a receipt. The expiration date is often showed as some variation of **/****, or not at all.

If any digits other than the last five, or any part of the expiration date are printed, the customer may be eligible to pursue compensation for this potential violation of their rights.

Is a truncated credit card receipt secure?

If you lose track of a credit card receipt, you generally do not have anything to worry about. They are not completely immune to identity thieves and fraudsters, however. Even the few visible digits of the card number can be used for phishing.

Phishing refers to fraudulent practices, such as “spoof” emails and phone calls in which they claim to be from your bank, the utility company, or some other institution in order to get personal information. Understand that a bank or credit card company will never ask you for your full credit card number over the phone.

Phishing emails are often easy to spot, because while such messages claim to be legitimate, the domain in the return address typically has nothing to do with the institution that is claimed to have sent it.

If you receive a credit card receipt that contains more than the last five digits of your credit card or any part of your card’s expiration date however, you may be at a higher risk. Thieves could potentially use this personal financial information to commit identity theft or other crimes. It may possible for them to open lines of credit in your name, or rack up extensive purchases on your card.

In order to avoid potential identity or financial theft, you may want to check your receipts to ensure that they are FACTA compliant.

What about older imprint machines?

When FACTA was first passed in 2003, most retailers did not have modern point-of-sale processing equipment that could truncate the number. These businesses were given until December 2006 to upgrade their system in compliance with the law, but not all have.

However, there are a few small businesses with limited resources that still use manual imprint machines for credit card receipts. Hand printed receipts are not held to the same requirements under FACTA as electronically printed receipts. These types of transactions can be risky; if you make a purchase at such a store, it may be best to shred the receipt or to pay with cash instead of a card.

What are the other provisions of FACTA?

Along with credit card truncation, FACTA has a number of other provisions that can assist consumers against fraud and identity theft.

FACTA requires credit reporting agencies to issue fraud alerts and active duty alerts to customers’ accounts. FACTA allows customers to get a free annual credit report from each of the three agencies: Experian, Equifax, and TransUnion.

Under the FACTA title, consumer reporting agencies must issue fraud alerts to accounts if requested by the customer, who believes they may be a potential victim of fraud or similar crimes.  The fraud alert must be placed on the consumer’s file for at least 90 days, as well as notify all other consumer reporting agencies that the alert is in place.

Consumers can also request an extended fraud alert, in which case the credit reporting agency must disclose this alert in any credit score that is issued for the consumer during a seven-year period. The extended fraud alert also requires credit agencies to exclude consumers from any distribution list for third parties.

Active duty alerts are like typical fraud alerts but pertain to active duty military servicemembers in the U.S. military.

In addition, FACTA also requires the Federal Trade Commission work with the federal banking agencies and the National Credit Union Agency to “prepare a model summary of the rights of consumers … with respect to the procedures for remedying the effects of fraud or identity theft…”. This means making sure card numbers are properly truncated on receipts, requires some banks to disclose credit report information, and helping a victim of identity theft recover vital documents.

FACTA lawsuits

Many companies have been accused of violating FACTA regulations and printing private customer information on credit and debit cards receipts. According to a class action lawsuit filed against Six Flags in 2020, the amusement park was printing customer credit card information on receipts for food and beverage purchases. The plaintiffs in that suit claimed that when they visited the park in 2017, they received five receipts containing the first six digits of their credit card number, in addition to the final four. The lawsuit ended with a $450,000 settlement agreement.

Other major companies who have been accused of FACTA violations include Godiva, the Los Angeles Dodgers Major League Baseball team, LabCorp, and Spirit Airlines, among many others.

If you have noticed a FACTA violation on your receipt, you may be able to file a FACTA lawsuit and pursue compensation. Filing a lawsuit can be a daunting prospect, so Top Class Actions has laid the groundwork for you by connecting you with an experienced attorney. Consulting an attorney can help you determine if you have a claim, navigate the complexities of litigation, and maximize your potential compensation.

Join a free credit card receipt class action lawsuit investigation

If you have a receipt, invoice or contract from a retailer or vendor that includes more than the last five digits of your credit card or debit card number or any portion of the expiration date, you may qualify to file a credit card receipt class action lawsuit.

Learn More

This article is not legal advice. It is presented 
for informational purposes only.