8

I recently visited a store in Northern Ireland and paid using my Visa debit card. The receipt shows my entire card number and expiry date. It also contains other info. I thought this should all be crossed out as now they have a copy of my card number and details which was not encrypted or hidden.

Improve this question
3
  • 1
    Contact your bank. Let them know the merchant, when, and where.
    – h4ckNinja
    Commented Jun 20, 2016 at 17:20
  • 1
    A former employer of mine did far worse than this with customer data. Ratting them out went nowhere; merchants that process less than 10,000 transactions per month don't seem to be worth auditors' time.
    – Ivan
    Commented Jun 20, 2016 at 19:55
  • @Ivan Small merchants usually get away using PCI DSS self-assesment questionaries and third party security assessments of such entities are usually performed only in case of confirmed account security program violation. But I'd like to indicate that in this particular case, they clearly violate payment brand rules and not necessary PCI DSS. PCI does not prohibit printing PAN on receipt. Requirement 3.3 does not work here, because customer simply walks away with the receipt and we don't know if the merchant stores the copy AND violates reqs 9.5, 9.6, 9.7 and 9.8.1 at the same time.
    – Artem Bychkov
    Commented Jun 21, 2016 at 9:45

3 Answers 3

Reset to default
9

Printing full PAN and expiry date on the customer receipt is a violation of Visa's requirements listed in "Card Acceptance Guidelines for Visa Merchants". Therefore I suggest you to submit merchant violation complaint form directly to Visa. It is located here: https://usa.visa.com/Forms/merchant-violation-complaint-form.html

Improve this answer
2
  • Is it still a violation if it's an Irish company operating overseas? Or does that guideline only apply to Visa USA?
    – HashHazard
    Commented Jun 21, 2016 at 21:29
  • @Hollowproc Yes. Requirements for account information suppression come from Visa International Operating Regulations. There are no current exceptions for specific regions.
    – Artem Bychkov
    Commented Jun 22, 2016 at 8:13
4

Start by contacting your bank / debit card company and have your account number changed and your card reissued. I don't know there's much to do beyond that. If you let the bank know what merchant this happened at in IR, they may follow-up, but I don't know what IR requires from a CC standpoint, or if they even care about being PCI compliant; outside of the US, it can be a bit less of the "standard". YMMV.

Improve this answer
-3

First, report the private data stealing/improper handling to police and make sure to obtain a paper from them where the case/complain number and date is stated. It's a very important moment! And - keep the receipt to yourself! Attach a copy to your police invoice. After that contact your bank, supplying the incident details, a scan of a receipt and the number from police. Obtain a call audio recording - and your bank support ticket ID. Next step is to contact their payment processor/bank - you can read the name in your receipt, obtain a ticket number too, audio record the support conversation too. After that give the receipt numbers to the police and ask them to attach it to your case, and tell your bank the processor's ticket ID.

I had similar problem in Russia, so I know what I'm talking about just basing on my own experience. This action sequence will not allow to leave your case unresolved, and - especially if your card data will be used to steal your money - it will save you from losses.

Improve this answer
8
  • 3
    You make it sound as though a criminal offence is committed by printing full card details on the receipt. The law in the UK is not necessarily the same as Russia (and the law in NI is not necessarily the same as in Great Britain). If the card receipt is one of the manual card-impression type, it will always have all this information. There isn't any proof in the question here that the store has actually kept any data which it shouldn't or in any form it shouldn't.
    – Andrew Leach
    Commented Jun 20, 2016 at 21:43
  • 1
    @AndrewLeach it did - all the POS machines must have a "black box recorder" for all thr receipts it has issued. It's a regulatory and fail-safe requirement to such kind of equipment. It can be printed on a second paper roll inside it or stored electronically - but there's always two identical copies of all the receipts printed : one pops out, another one is kept inside a box
    – Alexey Vesnin
    Commented Jun 20, 2016 at 21:53
  • 1
    In which case it's exactly the same as a manual impression, except that it hasn't recorded the signature or PIN. Manual impression machines are still used. There's still no evidence that the store has anything it shouldn't. Nor is it a police matter in the UK until any data is actually misused.
    – Andrew Leach
    Commented Jun 20, 2016 at 21:58
  • 1
    @AndrewLeach as far as I know, your card data is your personal data
    – Alexey Vesnin
    Commented Jun 20, 2016 at 22:31
  • As far as I know, credit card handling violation is normally handled as a civil issue, not a criminal issue. Police generally don't have authority over civil issues, so they usually won't get involved unless there's clear indication of a criminal element.
    – Lie Ryan
    Commented Jun 21, 2016 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .