Ask the Expert

PCI DSS questions: Should full credit card numbers be on a receipt?

We are a merchant that must comply with PCI DSS. Does printing the full credit card number on the merchant's copy of the receipt violate PCI DSS credit card requirements?

    Requires Free Membership to View

Yes, the merchant's copy of the receipt may absolutely have the full credit card number on it. That being said: Is there a particular reason your company wants the full credit card number on paper? Doing so is not useful for recurring transactions, and it's not generally useful for returns either.

Having the full number on the receipt does mean there are significantly more precautions mandated for those receipts. They must be stored securely and destroyed securely when the time comes, both of which will cost time, money and effort. Plus, printing the full number gives customers the impression that protecting their information is not a priority. Hence, on many levels, it's not a good idea.

If this is something your company does today, consider implementing changes so that past and future receipts don't increase your risk exposure. If this is a change that business leaders have asked for, then try to dig into exactly why that change is needed and attempt to find another, less risky way to meet that need.

For more information:

This was first published in November 2009

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: