What happens to those slips of paper bearing your name, signature and partial credit card number after you leave the cash register?
The question from a reader is probably one that many people have asked themselves. When the meal is over or the bar tab is rung up, you pluck the receipt that says “customer copy” from the pile on the table — hoping those other copies don’t help some ID thief breach your account.
“I was wondering if there is any regulation that states credit card receipts with either partial or full credit card numbers and also the person’s signature has to be shredded,” Janet asked in an email to CreditCards.com. “I know of a company that throws these receipts in the dumpster every month. If there is a regulation whom do I report them to?”
Good questions. The answer, at least at the federal level, doesn’t seem entirely satisfying.
Rules for credit card receipts are spelled out by the Fair and Accurate Credit Transactions Act. That’s the 2003 law better known for giving you the right to obtain a free copy of your credit reports once a year.
A lesser-known provision of FACTA sets out disposal requirements for credit report information. “Reasonable” methods like shredding are required to keep the information from falling into the wrong hands.
How to dispose of credit card receipts, however, isn’t covered. What the law does say is that credit card receipts should not include the full account number — no more than five digits are allowed — or expiration date.
But there is an exception: Manually written or imprinted receipts are not subject to the number truncation rule, when that is the only way of recording the credit card number.
The Federal Trade Commission says that it encourages any business that handles sensitive consumer information to follow the same standards for disposal that are set out in FACTA for credit report information. Of course, there’s a big difference between a suggestion and a legal requirement.
Financial companies are subject to a higher standard for protecting your information under the Gramm-Leach-Bliley Act. But for bars, dry cleaners, restaurants and other merchants, the dumpster or recycling bin is fair game. And while old zip-zap machines and credit card carbon pack slips are a rarity, they may still be used in situations where electricity and data connections are unavailable — although smartphone applications are making such off-the-grid moments less and less common.
Is there a gap in protection waiting for ID thieves to find and exploit? Or is that moment of anxiety unfounded when you leave receipts lying on the table?