Fine print, Protecting yourself, Research, regulation, industry reports

Credit card receipts: Where do they go?

Fred Williams

What happens to those slips of paper bearing your name, signature and partial credit card number after you leave the cash register?


The question from a reader is probably one that many people have asked themselves. When the meal is over or the bar tab is rung up, you pluck the receipt that says “customer copy” from the pile on the table — hoping those other copies don’t help some ID thief breach your account.

“I was wondering if there is any regulation that states credit card receipts with either partial or full credit card numbers and also the person’s signature has to be shredded,” Janet asked in an email to “I know of a company that throws these receipts in the dumpster every month. If there is a regulation whom do I report them to?”

Good questions. The answer, at least at the federal level, doesn’t seem entirely satisfying.

Rules for credit card receipts are spelled out by the Fair and Accurate Credit Transactions Act. That’s the 2003 law better known for giving you the right to obtain a free copy of your credit reports once a year.

A lesser-known provision of FACTA sets out disposal requirements for credit report information. “Reasonable” methods like shredding are required to keep the information from falling into the wrong hands.

How to dispose of credit card receipts, however, isn’t covered. What the law does say is that credit card receipts should not include the full account number — no more than five digits are allowed — or expiration date.

But there is an exception: Manually written or imprinted receipts are not subject to the number truncation rule, when that is the only way of recording the credit card number.

The Federal Trade Commission says that it encourages any business that handles sensitive consumer information to follow the same standards for disposal that are set out in FACTA for credit report information. Of course, there’s a big difference between a suggestion and a legal requirement.

Financial companies are subject to a higher standard for protecting your information under the Gramm-Leach-Bliley Act. But for bars, dry cleaners, restaurants and other merchants, the dumpster or recycling bin is fair game. And while old zip-zap machines and credit card carbon pack slips are a rarity, they may still be used in situations where electricity and data connections are unavailable — although smartphone applications are making such off-the-grid moments less and less common.

Is there a gap in protection waiting for ID thieves to find and exploit? Or is that moment of anxiety unfounded when you leave receipts lying on the table?

Join the Discussion

We encourage an active and insightful conversation among our users. Please help us keep our community civil and respectful. For your safety, we ask that you do not disclose confidential or personal information such as your bank account numbers, social security numbers, etc. Keep in mind that anything you post may be disclosed, published, transmitted or reused.

The editorial content on is not sponsored by any bank or credit card issuer. The journalists in the editorial department are separate from the company's business operations. The comments posted below are not provided, reviewed or approved by any company mentioned in our editorial content. Additionally, any companies mentioned in the content do not assume responsibility to ensure that all posts and/or questions are answered.

  • Scott

    I guess there are a lot of companies that can get into trouble. When I order online, many send an email receipt with more than 4 digits of the card number AND the full expiration date.