Problem solve Get help with specific problems with your technologies, process and projects.

PCI DSS questions: Should full credit card numbers be on a receipt?

Are merchants that fall under PCI DSS allowed to print full credit card numbers on a receipt? Learn more in this response from security management expert David Mortman.

We are a merchant that must comply with PCI DSS. Does printing the full credit card number on the merchant's copy...

of the receipt violate PCI DSS credit card requirements?

Yes, the merchant's copy of the receipt may absolutely have the full credit card number on it. That being said: Is there a particular reason your company wants the full credit card number on paper? Doing so is not useful for recurring transactions, and it's not generally useful for returns either.

Having the full number on the receipt does mean there are significantly more precautions mandated for those receipts. They must be stored securely and destroyed securely when the time comes, both of which will cost time, money and effort. Plus, printing the full number gives customers the impression that protecting their information is not a priority. Hence, on many levels, it's not a good idea.

If this is something your company does today, consider implementing changes so that past and future receipts don't increase your risk exposure. If this is a change that business leaders have asked for, then try to dig into exactly why that change is needed and attempt to find another, less risky way to meet that need.

More on this topic

This was last published in November 2009

Dig Deeper on PCI Data Security Standard