Credit card receipts and law

Hi,

I've been reading about the rules in regards to credit card receipts but it seems to vary. Does anyone know where would be the best place to look for this information? I went to pcisecuritystandards.org but it so hard to find the answers I'm looking for.

1. For receipts are we allow to display only the last 4 or last 5 digits?

2. For record keeping purposes, when I print a summary of batch reports for the day from a stand alone terminal, can I display the full credit number without the expiration date? I read that you can store credit info, but not if its received electronically. But getting it from the terminal even though encrypted, is received electronically.

Anyone know where I can go to find details about this stuff?

Thanks

These are questions to ask your Merchant Account provider. Do not rely on hearsay via the forum.

Kim,

Credit card receipts cannot contain the expiration number. It can have the last 4 digits but not the expiration number. But orders being viewed through zen cart admin panel has the last 4 digits and also the expiration date. Since the transmission of this data is not https, shouldn't we be concerned?

Which payment module are you using? Is it the one comes with Zen? Or is it an add-on?

If it's an addon, then obviously you need to check that addon support thread. If it comes with zencart by default, Im sure the same issue has been addressed somewhere by DrByte.

Hi yellow,

I'm using the default authorize.net module that comes with zen. I don't have any payment module add-on. Maybe I should post this where dr. byte can see this thread?

Thanks

There is no need to repost.

Visit the Visa.com website. You will have to do some digging but you will be able to find the actual receipt requirements. Or just keep a couple of receipts from your next couple of purchases and see what information is shown there. You should be able to put something decent together.

Interesting. I made a purchase yesterday at walmart, and the receipt they gave me includes the last 4 digits of my card number along with the full expiry date.

Other stores show just last 4 digits or first 4 and last 4 digits, but no date.

Still other stores show last 4 digits and / as the date. Gas stations seem to do this a lot.

There are several layers of compliance that I've seen. One is the PCI Compliance and the other is FACTA. If you are looking at VISA.com website, I think its basically talking about PCI Compliance. But FACTA is another layer.

Take a look at this:

http://www.treasury.gov/offices/domestic-finance/financial-institution/cip/pdf/fact-act.pdf

on page 9, section 605. It specifically states receipts provided to the cardholder at the time of transaction cannot contain expiration date. I'm surprised that walmart prints with the expiration date. But since we (zen cart merchants) don't provide any receipt to the customer with any card info, we are safe.

What do you think?

I also noticed ZC displays the first 4 & last 4 digits which the US Federal law requires all digits except the last four be truncated. I dont have a payment gateway yet so I wont know how it will handle this, however I would like to find out how to truncate the first four digits. I also noticed the order emails show the middle digits excluding the first & last four, I want to change this as well.