Card Number Truncation

Receipt Truncation Last Update March 2011

There are federal laws, various state laws and association rules which require merchants to truncate the cardholder copy of receipts. Seven (7) states now require merchants to truncate both the cardholder and merchant copies of receipts. 

It is the merchant's responsibility to comply with applicable laws and regulations regarding truncation.  Please check your POS and terminal receipts to insure you are in compliance.

States Requiring Full (Cardholder and Merchant) Receipt Truncation:

Seven (7) states have passed legislation that requires merchants to truncate both cardholder and merchant receipts.  The states are:

• New Mexico - as of 01/01/2004
• Wisconsin - as of 08/01/2005
• Colorado - as of 01/01/2006
• Tennessee - as of 01/01/2007
• California - as of 01/01/2009
• Alaska - as of 07/01/2009
• Nevada - as of 07/01/2009
• Washington State - as of 07/26/2009

Additional states have legislation in progress which may be enacted in the near future which may require merchants to truncate both cardholder and merchant receipts.  Under the current legislation in the states above a merchant is required to truncate both the cardholder and merchant copy of the receipt by masking the card number and the expiration date as follows:

• Card number truncation is defined as masking all but the last 4 digits of the card number by using * or X.
  • (Example:  XXXXXXXXXXXX1234   OR   ************1234)
• Expiration date truncation is defined as masking the expiration date by using * or X.
  • (Example:  XX/XX   OR    **/**)

Although it is the merchant's responsibility to comply with all applicable laws and regulations regarding truncation, if a merchant is using an application/version that is not compliant, Vantage will assist the merchant in upgrading to new software and/or hardware as necessary.  Please check your system and contact us immediately.

---

Card Account Information Truncation Requirements: Suppression of Account Information on Transaction Receipts

New Federal, State and Association Deadlines

Truncation - Protecting Customers’ Credit Card Numbers

With identity theft growing significantly, it is increasingly important for you to help your customers’ protect their personal information – particularly their credit card number. While discussions on preventing identity theft often focus on steps consumers can take, there is little consumers can do to actually prevent identity theft. The key is for business to establish responsible information-handling practices.

So, what can you do to help fight identity theft? One of the best ways is to truncate credit card account numbers. “Card Truncation” is the ability of a terminal to mask or hide all but the last few digits of a card number on a receipt. Besides the obvious safety benefits to the cardholder, many states are now requiring merchants to provide truncation services in order to reduce the growing problem of electronic fraud.

MasterCard® and Visa® Establish Truncation Requirements

Additionally, both MasterCard® and Visa® have established truncation requirements of their own. The deadlines for customer receipt truncation for both Visa and MasterCard are listed below.

Visa Account Number Truncation Requirements

Effective July 1, 2003, for all new terminals, Visa USA mandates that all but the last four digits of the cardholder account number, and the entire expiration date, be suppressed on the cardholder copy of all transaction receipts generated from electronic (including cardholder-activated) terminals.

Effective July 1, 2006, for all existing terminals, Visa USA mandates that all but the last four digits of the cardholder account number, and the entire expiration date, be suppressed on the cardholder copy of all transaction receipts generated from electronic (including cardholder-activated) terminals.

MasterCard Account Number Truncation Requirements

Effective April 1, 2005 MasterCard requires all cardholder receipts generated by newly installed, replaced, or relocated ATM and point-of-interaction (POI) terminals, whether attended or unattended, must reflect only the last four digits of the primary account number (PAN). Fill characters that are neither blank spaces nor numeric characters, such as X, *, or #, must replace all preceding digits.

If your current terminal(s) can’t truncate a card number, you might need to upgrade to meet the privacy protection requirements. Global Payments has numerous applications that offer this feature. Check with your account representative or call 1 800 929-1245 for information.

Federal Account Number Truncation Requirements

On December 4, 2003, President Bush approved a federal law which preempts existing state laws requiring truncation of account numbers on customer receipts, thereby creating a uniform national standard. This legislation, called the Fair and Accurate Credit Transactions Act of 2003, provides (among many other things) that "no person accepting credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction. The law governs electronically printed receipts and does not apply to transactions in which the sole means of recording the credit or debit card account number is by handwriting or by an imprint.

The following states require terminals to truncate the card number from the receipt prior to the effective date of federal and card association regulations: