Are debit card numbers on receipts?

Under the Fair and Accurate Credit Transactions Act (FACTA), electronic receipts may only show certain digits of debit card numbers or credit card numbers. Any merchant who has printed more than the last five digits of your debit card on a receipt is in violation of the law and can be held accountable.

What is FACTA?

The Fair and Accurate Credit Transactions Act is an amendment to the earlier Fair Credit Reporting Act. This amendment was added and signed into law in 2003 to ensure sensitive debit card and credit card information does not appear on electronically printed receipts.

FACTA requires personal account number (PAN) truncation on electronically printed receipts, which means only the last four or five digits of the card number may be visible. Most of the time, a card number on a receipt will look something like this: XXXX-XXXX-XXX1-2345. In addition, no part of the expiration date can appear on the receipt, in order to protect the card holder from experiencing his debit card number stolen.

No other digits should appear anywhere, even if there are five or fewer digits displayed. So, something like 1XXX-X23X-XXXX-XXX4 could be in violation of FACTA.

Are there exceptions to the receipt information rules?

These rules apply to all receipts that are machine printed. Emailed or handwritten receipts are not bound by the same FACTA requirements, and neither are receipts generated by making a physical imprint of the card.

When and how might violations occur?

Generally, FACTA violations of this nature are due to human error or sheer carelessness. Sometimes, an electronic update or change in third party payment processing companies may cause a slip-up of regulatory obedience. Regardless of how the violation occurs, the merchant is liable.

Are debit card numbers really that valuable to cyber thieves?

Absolutely. When too much of your personal identification information (PII) is revealed on a receipt, identity thieves can use the information to either access the full card number and the account or sell your data on the “dark web” where criminals may use your information to create fake accounts in your name. Either one of these illegal uses of your personal information could become a big headache for you to try to recapture your good credit rating.

A recent report found that debit card information stolen to be sold on the dark web is worth more than $250, compared with credit card numbers that garner less than $34. The reason for the big difference is that your debit card numbers pull money right from your bank account, but a credit card purchase can take an entire billing cycle, which allows time for the charge to be contested. A debit card number stolen can lead to an empty bank account in no time.

What can I do if I get a receipt that violates FACTA?

Whether the violation occurred at the point of sale or at the processing center used by the merchant, if you find your debit card numbers on receipts, you may be able to file a civil lawsuit against the merchant. You may also file a complaint with the Federal Trade Commission, which has the authority to investigate the incident and issue a fine. Both these options are available even if the FACTA violation did not result in debit card information stolen or used for illegal purposes.

What are the penalties for violating FACTA?

If a consumer’s debit card numbers on receipts are visible in full, the person who received the receipt may be entitled to up to $1,000 in statutory damages for each violation. If the federal government brings an enforcement action, the offender may face a fine of up to $2,500 per violation. State governments can recover up to $1,000 per violation in addition to attorney fees and court costs.

Additionally, if you become a victim of identity theft and have filed a report, you may be entitled to additional remedies such as extended fraud alerts and credit freezes.

FACTA settlements have resulted in significant payments for consumers. Fort Lauderdale Airport agreed to pay $1.1 million to resolve FACTA claims. In July 2021, Six Flags customers received settlement checks of over $100 for alleged FACTA violations.

What are extended fraud alerts and credit freezes?

If a consumer is notified of a data breach affecting their PII and feels vulnerable to potential identity theft, FACTA allows them to set up a fraud alert on their credit file for 90 days.

The second level of security is an extended fraud alert for a period of seven years, but certain requirements must be met. If a credit bureau has a request for a credit score presented, this fraud alert on the account must be disclosed. Additionally, the bureau cannot distribute the consumer’s name on any list for agencies capable and willing to make offers of credit or insurance.

According to the Federal Trade Commission (FTC), a credit freeze is also an available remedy for someone whose PII has been breached. A credit freeze restricts access to your credit report, making it very difficult for anyone to open credit in your name. Most creditors will want to see your report prior to extending credit, so restricted access protects you.

A credit freeze won’t affect your own ability to apply for credit if the freeze is removed by you and put back into place prior to and after application. Nor will a credit freeze have any effect on employment seeking, rental agreements, or buying insurance.

Join a free debit card receipt class action lawsuit investigation

If you have a receipt, invoice or contract from a retailer or vendor that includes more than the last five digits of your debit card number or any portion of the expiration date, you may qualify to file a debit card receipt class action lawsuit.

Learn More

This article is not legal advice. It is presented 
for informational purposes only.