2

The other day I was in a bakery in France and by accident, I obtained the receipt that was intended for the merchant – I did not get the customer copy. I saw that my FULL credit card number was displayed! Since I save all of my receipts I checked with previous purchases where I correctly obtained the customer copy and on those customer copies only the last 4 digits displayed.

I think this is really bizarre – like why does my own receipt have to conceal my own credit card number all the while any employee at a bakery can easily use my number and go online and do a purchase (provided the site won't need the CVV code).

Is this normal? Does the merchant really need my full number black on white in case of potential accounting issues?

Improve this question

1 Answer 1

Reset to default
1

You're referring to the merchant copy of the receipt which should only be retained as long as the business is required to do so (vs the cardholder copy).

On a cardholder receipt the PAN (Primary Account Number) must be truncated (first 6 digits OR last 4 digits) for PCI compliance, if this is a cardholder activated terminal transaction and not an imprint, or some other kind.

PCI compliance does NOT forbid the PAN on the merchant copy, but does require they are stored securely.

There may be more restrictions for GDPR, but I'm in the USA and not familiar with those.

Improve this answer
2
  • This. If the merchant copy has the full PAN, there's probably some kind of lockbox that they can drop receipts into after they print, to keep them secure.
    – Bobson
    Commented Mar 24, 2019 at 0:07
  • The cardholder receipt can show the first six digits and the last four digits. “PCI DSS requirement 3.3 states “Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed).” (from pcicomplianceguide.org/faq/.)
    – Mike Scott
    Commented Jul 5, 2019 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .