Truncated Credit Card Numbers

December 2009

Why stores should print only partial credit card information on customer receipts

Retailers are required under privacy laws to safeguard their customers’ personal information. A credit card number is a valuable piece of personal information; for reasons of privacy and to deter fraud, it needs to be kept secure.

One way to do that is not to print full credit card numbers on customer receipts, because if the receipt is lost, stolen or discarded, the number can be used to commit credit card fraud, identity theft or other crimes.

Credit card companies such as Visa and MasterCard now require retailers to truncate the card numbers, which means printing only portions of the number string on the customer’s receipt. While rules vary, some receipts now show as few as four digits, with the rest of the number replaced by symbols such as X or #. It’s up to retailers to decide how to implement the credit card companies’ truncation directives, in order to protect their customers from fraud.

Responsible Retailers: Under the Personal Information Protection and Electronic Documents Act (PIPEDA), organizations are required to limit the collection, use and disclosure of personal information and to safeguard all personal information in their possession.

Since credit card numbers are personal information, retailers should be careful not to print them in full on customer receipts. This reduces the risk of fraud if the receipt falls into the wrong hands.

The simplest solution is to block out some of the digits, so as to conceal the credit card number from fraudsters. Newer payment-processing systems typically include truncation as a standard feature, but older payment machines need to be modified or replaced.

Merchants should familiarize themselves with the truncation requirements of each of the credit companies they deal with. As a best practice, receipts should display only the last four digits of any credit card number.

Buyer Beware:  Individuals should check all their credit card receipts to make sure the card numbers are truncated. If they find receipts where this is not being done, they can remind retailers of their privacy obligations. All receipts should be stored in a safe place and securely disposed of when they are no longer needed.

The Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec
K1A 1H3

Toll-free: 1-800-282-1376
Phone: (819) 994-5444
Fax: (819) 994-5424
TTY: (819) 994-6591