2

The other day I was in a bakery in France and by accident, I obtained the receipt that was intended for the merchant – I did not get the customer copy. I saw that my FULL credit card number was displayed! Since I save all of my receipts I checked with previous purchases where I correctly obtained the customer copy and on those customer copies only the last 4 digits displayed.

I think this is really bizarre – like why does my own receipt have to conceal my own credit card number all the while any employee at a bakery can easily use my number and go online and do a purchase (provided the site won't need the CVV code).

Is this normal? Does the merchant really need my full number black on white in case of potential accounting issues?

1

You're referring to the merchant copy of the receipt which should only be retained as long as the business is required to do so (vs the cardholder copy).

On a cardholder receipt the PAN (Primary Account Number) must be truncated (first 6 digits OR last 4 digits) for PCI compliance, if this is a cardholder activated terminal transaction and not an imprint, or some other kind.

PCI compliance does NOT forbid the PAN on the merchant copy, but does require they are stored securely.

There may be more restrictions for GDPR, but I'm in the USA and not familiar with those.

  • This. If the merchant copy has the full PAN, there's probably some kind of lockbox that they can drop receipts into after they print, to keep them secure. – Bobson Mar 24 at 0:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.