Did a Receipt Include Your Credit Card Details?

If you received a debit card or credit card receipt that contained more than the card’s last five digits, your privacy may have been violated. The Fair and Accurate Credit Transactions Act (FACTA) limits the debit or credit card details that retailers can put on a receipt. There are some exceptions to the law, however, that customers should be aware of. 

Why Did a Business Print Your Full Credit Card Details?

FACTA is a law passed in 2003 that aims to protect consumers from identity theft. Businesses had until 2006 to ensure that their receipt systems complied with the law. Technology advances have made it increasingly easy for thieves to steal information and use it to commit fraud and identify theft. FACTA dictates what debit or credit card information can be visible on a receipt.

If receipts containing a credit or debit card number or expiration date fall into the wrong hands, a thief can use this information to make fraudulent purchases and damage a victim’s credit. 

To prevent this from happening, FACTA prohibits most businesses from including more than the last five digits of a card number on a customer receipt. This means that it’s illegal to print anything other than the last five digits, including the card’s expiration date or CVV code, in most cases. Additionally, if a receipt only includes four digits of a card number, but the four digits are not the last digits, the merchant may have violated the law.

A properly truncated receipt might display a credit card number like this:

**** **** ***1 2345

FACTA rules allow the last five digits of a debit or credit card number to be shown, but many businesses choose to truncate the number to just the last four digits, like this:

**** **** **** 4321

This truncation process requires that the revealed numbers be nowhere other than the last five spaces. Therefore, this approach is not allowed:

1234 5*** **** ****

FACTA rules also dictate that no portion of a card’s expiration date or CVV code be shown on a receipt.

However, creditcards.com explains that even truncation does not make a receipt totally safe — thieves can use just parts of a credit card number to phish for your whole card number through a scam.

The law has been in effect for a number of years now and many consumers may be used to seeing only the shortened, or truncated, version of their card information. If your receipt contains more extensive credit card details, it may not necessarily violate the law if it falls under one of the law’s exceptions.

Only customer copies of receipts fall under FACTA’s five-digit restriction. If you accidentally took home the merchant’s copy of your receipt and noticed that it contains the full credit card number, the merchant may not have violated FACTA. Investopedia explains that merchants may need the full credit card information if a refund or charge-back is necessary. However, they do have a duty under FACTA to keep that information secure.

Additionally, FACTA’s requirements apply only to electronically generated receipts. Handwritten receipts or receipts from manual imprinters need not truncate card information.

What Are the Risks of FACTA Non-Compliance?

For consumers, the risks posed by exposure of personal information like credit card numbers or card expiration dates include major issues like fraud and identity theft. Too much of this information can help a thief or fraudster piece together enough information to access your card or accounts.

Thieves who come into possession of a consumer’s credit card information may be able to open lines of credit in the victim’s name, rack up credit card debt, or commit other crimes using the victim’s identity. They may also be able to sell your personal information and credit card details to other criminals.

For businesses, the risks are also clear: Failing to comply with FACTA requirements can result in high fines or even litigation.

Is the Business Responsible for Potential Credit Card Fraud?

FACTA allows consumers to recover up to $1,000 per violation of the law if their privacy was violated by a merchant who printed too much credit or debit card information on a customer receipt. Class action lawsuits are one way that customers can take action against businesses that may be violating customer rights.

Investopedia explains that courts’ responses to these claims have varied. Some courts may require individuals to prove they suffered a concrete injury as a result of their information being exposed, while other courts have determined that customers can file claims even if they have not suffered a concrete injury, rather having just suffered a violation of privacy. 

This means that in the eyes of some courts, your chances of holding a business liable for a FACTA may be greater if you were in fact a victim of credit card fraud.

What Does the Term ‘Actual Harm’ Mean in a FACTA Lawsuit?

When a business prints too many digits of a credit card number or any other identifying information banned by FACTA, the consumer may have grounds to file a FACTA lawsuit against the offending merchant.

The question is whether breaking the law itself is enough to substantiate penalties or if the person whose information was disclosed needs to prove actual harm in the form of attempted identity theft, illegal use of the card by an unauthorized person, or another type of injury that occurred as a result of the FACTA violation.

Six Flags Great America in Gurnee, Ill. is reportedly facing a FACTA class action lawsuit filed by consumers who say too many credit card details appeared on food receipts from the amusement park.

Plaintiffs allege that park food vendors printed the first six digits and the last four digits, which Six Flags has admitted to doing.

Plaintiffs Hugh and Sharon S. claim that when they visited a Six Flags park in August 2017, they were given receipts that included more than the allowable number of digits.

According to the couple’s lawsuit, they made five food purchases at the park, and each receipt they were given included at least the first six digits of their card number. They claim that either the park knowingly violated FACTA requirements with these receipts or that it engaged in reckless conduct by failing to ensure the receipts were FACTA compliant. Additionally, the plaintiffs claim they threw away some of these receipts, meaning that it’s possible that their credit card information could have been stolen due to Six Flags’ actions.

In addition to Six Flags, other companies accused of printing too many digits on credit card receipts include Godiva, Subway, Jimmy Choo, Microsoft, LabCorp, and Spirit Airlines. Some lawsuits against these companies have resulted in multi-million dollar settlements in addition to compelling the businesses to comply with FACTA regulations in the future.

According to the Chicago Daily Law Bulletin, Illinois’s 2nd District Appellate Court ruled that a violation of adding too many digits to the receipt was an adequate reason for a claim because FACTA states that the “violators can be held liable for any actual damages caused by transgressions ‘or’ damages between $100 and $1,000.”

Justice Robert D. McLaren wrote, “Because each alternative stated section 1681n imposes liability to the consumer, our interpretation furthers FACTA’s preventative and deterrent purposes. Accordingly, we conclude that when a person willfully fails to comply with FACTA’s truncation requirements, the statute provides a private cause of action for statutory damages and does not require a consumer to suffer actual damages before seeking recourse.”

Six Flags had argued that the plaintiffs had to plead actual damages.

The Six Flags Class Action Lawsuit is Soto et al., et al. v. Great America LLC, et al., Case No. 125806 in the Illinois Supreme Court.

How to Join a FACTA Class Action

Since the machines that print receipts should be programmed to comply with FACTA rules, reporting FACTA violations on receipts can help all consumers affected by the same violation. If a machine has not been properly updated to comply with FACTA, the violation may have been repeated countless times.

Examining your receipts is the first step in joining a FACTA class action lawsuit if you worry that your privacy has been violated. If you have a receipt that contains more than the last five digits of your card number, you may have a legal claim. An experienced lawyer can help you best determine if you do have a legal claim and can help you file the strongest case possible. This can be one way to receive compensation for a violation of your privacy.

Join a Free Credit Card Receipt Class Action Lawsuit Investigation

If you have a receipt, invoice or contract from a retailer or vendor that includes more than the last five digits of your credit card or debit card number or any portion of the expiration date, you may qualify to file a credit card receipt class action lawsuit.

Learn More

This article is not legal advice. It is presented 
for informational purposes only.