With the growing rate of identity theft and fraud, Visa® and MasterCard® require merchants to comply with "account number truncation." This mandates merchants to suppress – or hide – all but the last four digits of the card number on a printed receipt, replacing all preceding digits with fill characters, such as “X” or “#” that are neither blank spaces nor numeric characters . The card expiration date must also be hidden.
Many states, as well as the Fair and Accurate Credit Transactions Act (FACTA), make account number and expiration date truncation enforceable by law. For specifics about the laws and requirements in your state, we suggest you review your state’s applicable laws and consult with legal counsel.
Complying with account number truncation may require a new payment application, a new terminal, or both. You can rely on our service support staff to answer your questions and guide you through the latest technology options, so you can choose the best solution for your business.
While we are here to assist you, please keep in mind it is the responsibility of the business owner to comply with federal and state laws, as well as payment brand regulations, relative to account number truncation.
What does "account number truncation" mean?
Generally, account number truncation is the suppression of the expiration date and all but the last four digits of the cardholder's account number on electronically printed transaction receipts. All preceding digits must be replaced by characters such as “X” or “#,” that are neither blank spaces nor numeric characters.
Do I have to provide account number truncation on every single receipt?
No. Account number truncation rules do not apply to handwritten or manually imprinted receipts, but are strongly suggested for the customer's copy of the receipt. In some point-of-sale situations (i.e. restaurant applications), the merchant's copy of the receipt may be needed to re-enter transactions that may be lost during a power outage or equipment failure. If you retain copies containing full account numbers, you are required to store them securely and dispose of them according to PCI Data Security Standards (PCI-DSS) requirements. Be aware of changing federal regulations, payment brand requirements and your state’s laws to form educated decisions regarding your storage policies. The complete list of standards is available for download from the PCI Security Standards Council.
Why is account number truncation necessary?
The key goal is to protect personal account information. If the card number and expiration date are hidden, they cannot be stolen and used fraudulently. At the same time, providing the last four digits will help merchants and customers match a receipt with a transaction record.
How do I know if my POS terminal is compliant?
You should not see more than the last four (Visa and MasterCard) or five (American Express and Discover) digits of the cardholder number on the printed receipt, nor should you see the card expiration date.
What do I do if I am not in compliance?
Since the payment brands have made this a requirement for several years, non-compliance is a violation of their rules and possibly federal and state laws. You should take action immediately. If your terminal prints a full cardholder account number and/or the card expiration date on the customer or merchant copy of the receipt, contact your payment processor immediately to ask for upgrade assistance.
What are the penalties if I am not compliant?
Payment brand penalties for non-compliance vary from brand to brand, but can be over $600,000 annually after being assessed as non-compliant. Additionally, there could be penalties associated with legal non-compliance. We encourage you to review your state's applicable laws and consult with legal counsel for penalties associated with legal non-compliance.
How much will it cost to upgrade?
Chase Paymentech offers a broad array of compliant equipment and application software choices. Some customers may only require a new application. However, you may need to purchase an upgraded terminal. Talk with your Account Executive to learn more about your business' requirements.