What may print on a card receipt
Federal law limits what an electronically printed card receipt given to a customer may show: no more than the last five digits of the card number, and no expiration date at all. The requirement comes from the Fair and Accurate Credit Transactions Act, and it applies to the receipt the customer takes with them.
Most terminals have done this correctly for years. The reason to know the rule is that not every device in a store is a modern terminal, and the ones that are not tend to be the ones nobody looks at.
Which receipts does the rule cover?
Electronically printed receipts provided to the cardholder at the point of sale. That is the specific target: a printed slip handed across the counter by a machine.
Handwritten receipts and manual card imprints sit outside that particular provision, which occasionally surprises people. That is not permission to write full card numbers on paper — other obligations cover card data generally — but it does mean the truncation rule is about machine-printed customer copies.
What about the merchant copy?
The customer copy is what the truncation rule addresses. Merchant copies are governed by the card data rules you already work under, and the practical guidance there is simple: your copy should not carry a full card number either, and any copies you keep need to be stored somewhere a casual passer-by cannot read them.
A shoebox of signed slips under the counter is a common arrangement and a poor one. If you keep them, keep them locked, and know how long you actually need to.
How do you check your own receipts?
Take one from every device that prints. The counter terminal, the second register, the mobile reader you use for deliveries, the old machine in the back that still works. Look for more than five digits of the card number and for any expiration date.
The old machine in the back is the point of the exercise. Compliance drifts through equipment that stayed in service past the moment anyone was paying attention to it.
Do the same walk for anything that prints a record without being a card terminal at all: the lottery machine, the money-order printer, an old receipt printer wired to a point-of-sale computer. Those devices sometimes render a receipt from data the software hands them, which means their output depends on software settings rather than on the terminal's certified behaviour.
What if a device prints too much?
Stop using it for customer receipts and contact your provider, because the fix is nearly always a software setting or a terminal that is out of support. This is not usually a purchase; it is usually a configuration.
Do not treat it as trivial because no customer has complained. The people who read receipts closely are not, as a rule, your regulars — and a receipt with a full card number on it is a piece of card data you handed to a stranger and then to a bin.
Does any of this apply to emailed or texted receipts?
The statutory provision is about electronically printed receipts, but the sensible practice does not change with the delivery channel. A receipt sitting in an inbox is more durable and more copyable than one in a coat pocket, so truncation matters at least as much there. The Federal Trade Commission publishes business guidance on handling this kind of data.
Frequently asked questions
Is five digits or four the requirement?
The law sets a ceiling of the last five digits, and most terminals print four. Printing four is comfortably inside the rule. The number to worry about is anything above five, or a full card number.
Does the expiration date rule have exceptions?
The provision prohibits printing the expiration date on the electronically printed receipt given to the cardholder. Terminals handle this automatically; the risk sits with unusual devices and with software that prints its own receipt format rather than the terminal's.
What about receipts from my online store?
The same instinct applies even where the specific provision is aimed at printed receipts. There is no business reason for an order confirmation to carry more than the last four digits, and plenty of reasons for it not to.
Can I write a card number on a paper order form?
Avoid it entirely. Even where a specific statute does not reach handwritten records, card data obligations and ordinary risk both do. If your workflow needs a number between the order and the terminal, change the workflow.
How long should I keep signed receipt copies?
Long enough to answer a dispute, which is a matter of months rather than years for most transactions. Keeping them longer creates storage obligations without adding protection. Pick a period, write it down, and destroy them on schedule.
Does the rule apply to debit as well as credit?
Yes. The provision covers card numbers on electronically printed receipts without distinguishing between credit and debit, and in practice terminals truncate both the same way.
Does a customer have a right to ask for a full number on their copy?
No, and you should decline. The truncation exists for the cardholder's protection, and a customer who wants their own card number can read it off their own card. A request like that at a counter is unusual enough to be worth noticing.