Can someone steal your debit card info from a receipt?

In the past, varying amounts of information were printed on receipts. Based on this, someone could theoretically gather receipts and piece together payment information which could then be used for identity theft and other fraud.

Moreover, with the rise of the internet and the dark web, it is becoming easier for thieves to comb through hacked payment information and piece together usable consumer information.

Laws have since been passed to help safeguard debit card information and reduce this risk, but consumers should watch their bills and records as well to protect themselves from identity theft.

How is debt card receipt info protected?

Part of FACTA established credit report rights for consumers, allowing them to request a free credit report from each of the major credit bureaus once a year. The act also helped reduce identity theft risks by allowing alerts to be placed on credit histories and regulating the information allowed on electronically printed receipts.

Under FACTA, electronically printed receipts are only allowed to show at most the last five digits of a credit or debit card number. Additionally, these receipts are not allowed to show any information about a card’s expiration date. Expiration dates receive special protection since they are often used for authentication purposes.

In order to comply with these rules, electronically printed receipts can be put through a process called truncation. When information is truncated, important information is replaced with symbols such as # or *.

Proper FACTA truncation

Instead of containing a full 16-digit debit card number, a properly truncated receipt would only show either of the following:

• #### #### ###0 1234
• #### #### #### 1234

The following are incorrect:

• 0000 #### #### 1234
• #### #### 0000 1234
• 0### #### #### 1234

Even if a receipt only shows five digits, this is not correct truncation if the digits are any other than the last five.

Additionally, no expiration date information is allowed on a debit card receipt. This means that even if part of the expiration date is truncated, the receipt violates FACTA.

Knowing your risk of identity theft

Carrying too many credit and debit cards could already increase your chances of becoming a victim of identity theft but the printing of your personal information on a debit card receipt is often outside of the control of the consumer. Many people don’t even look closely at their receipts after these are handed over at the point-of-sale transaction.

ATM receipts, gas station receipts and other receipts can have scraps of usable information that con artists can pick up to reconstruct entire account numbers.

This is one of the leading reasons why FACTA exists; requiring point-of-sale merchants to limit the amount of personally identifying information that shows up on a debit card receipt.

Unfortunately, since many people swipe their debit cards on a regular basis, it’s easy to overlook a receipt that might have printed too much information and therefore exposed you to identity theft. Many consumers don’t even realize this situation has happened until after their debit card information has been stolen and used illegally.

If your identity has already been stolen, your next steps should be to monitor your credit carefully to address the opening of new accounts quickly. If you review your old receipts and find that at some point too much of your debit card information was included on the receipt in violation of FACTA, keep this receipt as potential evidence.

Merchants can be held accountable in lawsuits if it can be shown that they included too many details about a consumer’s debit card on a receipt.

Rules for receipts

These consumer protection rules apply to all recipients that are electronically printed. This includes all electronic card processing machines, kiosks, restaurants, and other vendors. With printed receipts, if one consumer has been affected, hundreds or even thousands of other consumers have likely been affected as well. Handwritten receipts have different guidelines.

Although FACTA rules help protect consumer credit and debit card info, these laws are rendered useless if vendors do not follow them as required by law. In order for consumer information to remain protected, vendors need to strictly adhere to requirements and print only the allowed information on electronically printed receipts.

Under FACTA, consumers who have their information illegally printed on debit or credit card receipts can file legal action against the offending vendors. A growing number of lawsuits are being filed against companies — including major businesses — over FACTA violations, such as Burger King and Cheesecake Factory.

Successful plaintiffs in FACTA lawsuits or class action lawsuits may be able to collect between $100 and $1,000 in statutory damages for each violation. Proving a FACTA violation is fairly straightforward — save receipts and take note of whether or not they follow FACTA regulations for both card numbers and expiration date.

Join a free credit card receipt class action lawsuit investigation

If you have a receipt, invoice or contract from a retailer or vendor that includes more than the last five digits of your credit card or debit card number or any portion of the expiration date, you may qualify to file a credit card receipt class action lawsuit.

Learn More

This article is not legal advice. It is presented 
for informational purposes only.