Can debit card info be stolen from a receipt?

Printed debit and credit card receipts are relatively secure and a very difficult medium from which to steal debit card info, but there is a federal law companies are required to follow to ensure that your information is protected.

This is because of a law known as the Fair and Accurate Credit Transactions Act (FACTA). FACTA was a 2003 set of amendments to the Fair Credit Reporting Act of 1970. Among other changes, FACTA created the requirement that receipts must omit the most essential of the customer’s debit card info.

How FACTA truncation works

FACTA protects consumer information by allowing only the last five digits of the debit card info used to process the transaction to appear on the receipt itself. Sensitive digits on a receipt are replaced with a symbol through a process known as truncation.

A merchant who prints any card digits other than the last five may have violated FACTA, even if they print no more than five digits. Under federal law, only the last five digits can be printed on a receipt—regardless of the number of digits printed.

Are debit card expiration dates allowed on receipts?

According to the Federal Trade Commission (FTC), there must be no reference to the customer’s debit card expiration date on a receipt. This requirement is in addition to truncating the actual account number down to the last five digits.

These protections are especially important since having the full information of an account number and expiration number provides a “golden ticket” to fraud. Every receipt printed with that much account information is an opportunity for identity theft.

Does truncating an account number on a receipt make the account theft-proof?

CreditCardInsider notes that identity thieves often pose as account representatives and take what information they have on a receipt or other source and try to trick you into providing the rest.

This trick is known as “phishing” and can be quite sophisticated. Phishing attempts can come as emails or telephone calls and look and sound remarkably like the real thing.

A good rule to follow is to never respond to inquiries to enter to release a full debit card number to anyone that calls or asks for information in an email unless you initiated the contact and know—without a doubt—the source is the actual lender in question.

Who is required to follow FACTA guidelines?

If you were given a receipt that contains sensitive account numbers or expiration date digits, it is important to understand whether your receipt is covered under FACTA and what your legal rights are.

FACTA regulations only apply to companies that electronically print customer receipts. Stores, self-service kiosks, cash registers, and restaurants that electronically print receipts are all required to comply with FACTA receipt regulations. Contracts and invoices are also classified as receipts under the law and subject to truncation requirements.

However, while FACTA governs receipts from most chain and big-box retailers, some smaller businesses may be exempt from the law. Retailers that give consumers emailed, handwritten, or imprinted receipts are not covered by FACTA and are not required to truncate a customer’s account information.

Receipts included inside of a package mailed to a customer’s home are also not bound by the law and are not required to truncate account numbers.

How to protect paper receipts

There are a number of measures consumers can take to protect the credit and debit card info on their paper receipts. According to Graphic Tickets, consumers should know which receipts they can safely discard and which to keep and be sure to shred. Receipts to keep include:

• Credit or debit card receipts for products with a warranty
• Credit or debit card receipts to compare with statements to ensure accuracy
• Other purchase receipts for items that may need to be returned
• Service receipts for vehicle, appliance, or other records
• IRS receipts
• ATM receipts

Of particular importance are IRS and ATM receipts. Graphic Ticket points out that the information included on these receipts are valuable to identity thieves, including available balances, banking information, tax information, and other personal information. Experts recommend keeping these receipts securely until they are no longer needed and then using a crosscut shredder to dispose of them.

Consumers don’t have to keep every receipt, notes Graphic Ticket. Most receipts from grocery stores, fast food restaurants, and convenience stores can be thrown away, although consumers should take care to ensure they do not include any FACTA violations or have their signature.

Experts recommend shredding anything that contains sensitive personal or banking info, such as social security numbers, debit or credit card numbers, along with anything that has been signed. Further, store receipts that contain a membership card number should be shredded, says Graphic ticket, because if combined with a few other key pieces of information, fraudsters can use this information to commit identity theft.

Do merchants make receipt errors?

Merchants can and do make errors that can expose them to liability. FACTA law allows the FTC to pursue civil penalties and injunctive relief. It also empowers consumers who receive a non-compliant receipt to sue for statutory damages worth $100 to $1,000 per violation.

Many types of retailers may give customers non-FACTA compliant receipts. Retailers who have already agreed to financial settlements to settle lawsuits filed by consumers claiming that they were given non-FACTA compliant receipts include Jimmy Choo, Godiva, Microsoft, LabCorp, and Spirit Airlines.

Victims who have had their personal financial information printed on a non-FACTA compliant receipt may be eligible to hire a qualified attorney and file a class action lawsuit against the retailer, regardless of whether their sensitive information was accessed by identity thieves.

Join a free credit card receipt class action lawsuit investigation

If you have a receipt, invoice or contract from a retailer or vendor that includes more than the last five digits of your credit card or debit card number or any portion of the expiration date, you may qualify to file a credit card receipt class action lawsuit.

Learn More

This article is not legal advice. It is presented 
for informational purposes only.