IS YOUR TERMINAL SECURE? FIND OUT MORE ABOUT YOUR STATES CREDIT CARD TRUNCATION LAW.

As identity theft continually grows, Visa and MasterCard have mandated truncation laws to curb the ease of credit card receipts being stolen and used to produce identical cards or for e-commerce transactions.  The following information explains more about these regulations.  By current Visa and MasterCard regulations it is only required for the customers copy of the receipt to be truncated. This means that if you are using a terminal or software program that only truncated the customers receipt, this is still ok.

Visa Account Number Truncation Requirements

Effective July 1, 2003, for all new terminals, and July 1, 2006, for existing terminals, Visa USA mandates that all but the last four digits of the cardholder account number, and the entire expiration date, be suppressed on the cardholder copy of all transaction receipts generated from electronic (including cardholder-activated) terminals.

MasterCard Account Number Truncation Requirements

Effective April 1, 2005, MasterCard requires all cardholder receipts generated by newly installed, replaced, or relocated ATM and point-of-interaction (POI) terminals, whether attended or unattended, must reflect only the last four digits of the primary account number (PAN).  Fill characters such as X, *, or #, must replace all preceding digits.

On December 4, 2003, President Bush approved a federal law which preempts existing state laws requiring truncation of account numbers on customer receipts, thereby creating a uniform national standard.  This legislation, called the Fair and Accurate Credit Transactions Act of 2003, provides (among many other things) that "no person accepting credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction.”  The law governs electronically printed receipts and does not apply to transactions in which the sole means of recording the credit or debit card account number is by handwriting or by an imprint.

Non-compliance Penalties

If your current terminal(s) cannot truncate a card number, you will need to upgrade to meet the privacy protection requirements.

The Visa/MasterCard penalties for failing to truncate are as follows:

• 1st Violation - $5,000
• 2nd Violation - $10,000
• 3rd Violation - $25,000
• 4th Violation - $50,000
• Willful or Egregious Violation - $500,000/month

These are just the Visa/MasterCard penalties; there are federal and state penalties that may also be collected.  State penalties vary, but can be up to $10,000 per transaction and can have felony charges associated with them.

The following states require terminals to truncate the card number from the receipt prior to the effective date of federal and card association regulations:

For additional information, please visit these helpful websites:
Consumers Unionn
Federal Trade Commission