Link This |
Email this |
Blog This |
Comments (1)
Are your (payment card) slips showing?
May 2, 2007
Too much information can be a bad thing, especially when it comes to payment card information printed on customer receipts. Under a federal anti-identity theft provision that became fully effective in December 2006, merchants are required to limit the amount of payment card information contained on electronically generated receipts.
Payment card receipt truncation requirements
The Fair and Accurate Credit Transactions Act of 2003 (FACTA) section that regulates the truncation of payment card receipts (15 U.S.C. § 1681c(g)) provides that merchants who accept credit or debit cards in business transactions must not print more than the last five digits of the card number or the expiration date of the card on an electronically generated receipt.
This federal law requirement came into effect on January 1, 2005, for cash registers, machines and other devices that print receipts electronically and that were first put into use after that date. The requirement became effective on December 4, 2006, for devices that went into first use prior to January 1, 2005. Thus as of December 4, 2006, all devices that print electronic receipts must comply with the truncation requirement.
The federal law truncation requirement does not apply to receipts that are written by hand, or imprinted on old-fashioned manual machines.
Enforcement
The federal law that imposes the payment card truncation requirements gives the Federal Trade Commission authority to enforce the law through administrative proceedings, including the imposition of fines up to $1,000 per transaction.
The federal law also allows private individuals to bring enforcement actions, and they have recently done so in large numbers. Over a hundred class action lawsuits have been brought against major retailers such as FedEx Corp., Wendy’s, RiteAid and IKEA, but smaller concerns have also been hit as well, including regional restaurant chains In-N-Out Burger and Melting Pot restaurants. These class action lawsuits are discussed in an article "Lawsuit claims companies put consumers' credit card info at risk," ABCChicago7.com (April 27, 2007),
These class action complaints should serve as a reminder to small- and medium-sized businesses that they should scrutinize their electronic payment processing devices and make sure that they are compliant with the new requirements. Compliance may require updating to new devices, but in some cases only a software upgrade may be necessary.
And don't forget...
Both major payment systems, Visa and MasterCard, also have receipt truncation requirements, and they enforce those (and other data security) requirements with fines. Depending upon the agreement pursuant to which a merchant accepts these cards, the merchant may be held responsible for fines assessed against a member bank for failure to adhere to truncation requirements.
The posts on this blog reflect the personal views of Jeffrey D. Neuburger, in his individual capacity, and do not necessarily represent the views of his law firm or his clients, and are not sponsored or endorsed by them. The information contained in this blog is provided only as general information for educational purposes, and no warranty or representation is made about the accuracy of the information provided. Blog topics may or may not be updated subsequent to their initial posting. This information is not provided in the course of an attorney-client relationship and is not intended to constitute legal advice. This blog should not be used as a substitute for competent legal advice from a licensed attorney in your state.
Posted by Jeff Neuburger on May 2, 2007 | Comments (1)
