Card Account Information Truncation Requirements: Suppression of Account Information on Transaction Receipts

Federal, State and Association Deadlines

Truncation - Protecting Customers’ Credit Card Numbers

With identity theft growing significantly, it is increasingly important for you to help your customers protect their personal information – particularly their credit card number. While discussions on preventing identity theft often focus on steps consumers can take, there is little consumers can do to actually prevent identity theft. The key is for business to establish responsible information-handling practices.

So, what can you do to help fight identity theft? One of the best ways is to truncate credit card account numbers. “Card Truncation” is the ability of a terminal to mask or hide all but the last few digits of a card number on a receipt. Besides the obvious safety benefits to the cardholder, many states are now requiring merchants to provide truncation services in order to reduce the growing problem of electronic fraud.

MasterCard® and Visa® Establish Truncation Requirements

Additionally, both MasterCard® and Visa® have established truncation requirements of their own. The deadlines for customer receipt truncation for both Visa and MasterCard are listed below.

Visa Account Number Truncation Requirements

Effective July 1, 2003, for all new terminals, Visa USA mandated that all but the last four digits of the cardholder account number, and the entire expiration date, be suppressed on the cardholder copy of all transaction receipts generated from electronic (including cardholder-activated) terminals.

Effective July 1, 2006, for all existing terminals, Visa USA mandated that all but the last four digits of the cardholder account number, and the entire expiration date, be suppressed on the cardholder copy of all transaction receipts generated from electronic (including cardholder-activated) terminals.

MasterCard Account Number Truncation Requirements

Effective April 1, 2005 MasterCard required all cardholder receipts generated by newly installed, replaced, or relocated ATM and point-of-interaction (POI) terminals, whether attended or unattended, must reflect only the last four digits of the primary account number (PAN). Fill characters that are neither blank spaces nor numeric characters, such as X, *, or #, must replace all preceding digits.

If your current terminal(s) cannot truncate a card number, you might need to upgrade to meet the privacy protection requirements. Global Payments has numerous applications that offer this feature. Check with your account representative or call 1 800 929-1245 for information.

Federal Account Number Truncation Requirements

On December 4, 2003, President Bush approved a federal law which preempts existing state laws requiring truncation of account numbers on customer receipts, thereby creating a uniform national standard. This legislation, called the Fair and Accurate Credit Transactions Act of 2003, provides (among many other things) that "no person accepting credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction. The law governs electronically printed receipts and does not apply to transactions in which the sole means of recording the credit or debit card account number is by handwriting or by an imprint. The effective date for merchant equipment in use before January 1, 2005 to be compliant was December 4, 2006.  The effective date for  merchant equipment that went into use on or after January 1, 2005 to be compliant was January 1, 2005.

New State Requirements and Deadlines

Effective January 1, 2007, a new provision of the Tennessee Consumer Protection Act went into effect.  The new consumer law (Tennessee Code Annotated § 47-18-126) makes it illegal to electronically print more than the last 5 digits of a credit card number and the card expiration date on receipts.  This applies to both the receipt retained by merchants and the receipt provided to customers.  The Attorney General for the State of Tennessee has the authority to enforce any violations of this law.

Effective January 1, 2009, revised California Civil Code § 1747.09 takes effect, requiring that no more than the last 5 digits of a credit or debit card number be printed on both the electronically-printed card receipt retained by merchants as well as the receipt provided to customers, thus modifying the current law which applies only to customer copies.

Global Payments is addressing both government and card association requirements concerning truncation while also meeting association requirements for proof of card presence at the point of sale (POS) to limit a merchant's exposure to chargebacks. Please use the link below to upgrade your equipment or contact us for product information.

The following state(s) require(s) terminals to truncate the card number from both the merchant and cardholder copy of electronically printed receipts:

The following states required terminals to truncate the card number from the cardholder copy of electronically printed receipts prior to the effective date of federal and card association regulations: