Is your 16-digit Visa number on your receipts?

July 24 2007 by Ellen Roseman

Big stores “truncate” credit card numbers, so only the last digits are showing. The rest are blanked out, just as they are on the receipts you get from bank machines. But some merchants are still printing the entire Visa card number on receipts. This is not only an invasion of privacy, but it contravenes a new Visa Canada policy supposed to take effect on April 1, 2007.

Gordon from Picton, Ont. has been pursuing answers from CIBC (his Visa card issuer) and the Canadian head office of Visa International. He’s found very few people even know about the new truncation policy and sound defensive when asked. He’s furious that many stores he deals with still print all 16 numbers on their Visa receipts and the expiry date.

I’m printing his letters below and Visa Canada’s response. I’d like to know what you have discovered with your own Visa card tranasactions.

I did a column recently and got many responses. Many people were surprised to see how frequently their full card number and expiry date were on their receipts. They wanted to stop it. Only with a real consumer push will we see a speeded-up adoption of new point of sale terminals.

What about the merchant’s copy? Can it contain the full credit card number? Yes, says Visa, because the merchant may need it for refunds or dispute resolution. However, the federal privacy law requires businesses to safeguard all the information they collect. This means they can’t throw the receipts into the dumpster without shredding them or leave them exposed to theft by employees.

21 comments

  1. Ellen Roseman

    Jul 24 2007

    From Gordon:

    On a recent visit to Sarnia, I dealt with a business that had a brand-new handheld printer that printed off full name, credit card number and expiry date. If more thieves were aware of this available personal information, look at the potential for damage in just a few hours.

    I find over half my Visa charges do not truncate, although big retialers such as Canadian Tire and Home Depot do truncate receipts.

    Most merchants/shops/restauntants/service depots have printers that actually only print once — onto Vendor Copy, which is transposed directly to Cardholder copy via Carbonless paper receipts. Thus, whatever is printed on merchant copy prints onto Cardmember copy! This information includes Cardholder name, full Visa number and expiry date.

    When I’m advising Merchant Managers of this non-compliance, firstly, they are not even aware of what is printed on receipt, and secondly, claim they have no knowledge of how to change it. It is understood that whatever Visa’s computers send them to print, it is printed.

    On the public side, out of 20 friends I asked, no one is aware of what is actually printed on their copy of a receipt.

    Why does the cardholder have to notify their Visa issuer for merchant non-compliance, when the practise is rampant in the marketplace for all Visa issuers and considered the “norm”? Do you know how long it takes to successfully pass through telephone menu systems to actually have someone take the info and furthermore, know how to react? Most recent attempts at CIBC Visa take 5 minutes. Why should I do that? For my normal weekly transactions, I’d have to do it 3-4 times.

  2. Ellen Roseman

    Jul 24 2007

    From Tania Freedman of Visa Canada:

    If a cardholder finds that a merchant is not truncating the account number, they should call their Visa card issuer with information about the merchant’s name, location and the date. We will then work with the merchant’s Acquirer to enforce compliance.

    Visa doesn’t have any direct relationship with the merchants. We work with Acquirers, and it is the Acquirer who signs up merchants to accept Visa and would rent them a terminal.

  3. Brian Verbonac

    Jul 24 2007

    I have been aware of the truncation “problem” for quite some time now and here in Muskoka, most merchants are aware of the provision. If I do find one that has a problem with the requirement and bring it to their attention , the reply is usually split 50/50 between…”we are in the process of correcting this” or ” I haven’t a clue what your talking about”.

    This email is to also thank you for the information relative to the effective date of the Visa policy.

    One question…do the other card issuers like Mastercard also have the same requirement?

  4. Jamie

    Jul 24 2007

    It was some time ago, so I’m not sure if it’s still the case, but when I ordered digital photos from Staples for pickup at their copy centre, I was surprised to see not only was the full credit card information included on the receipt, but the envelope was not sealed at all. Considering the nature of their young, low-paid, part-time, high-turnover staff, I found this rather shocking.

  5. brad

    Jul 24 2007

    There was a Shell station here in Montréal that was printing all digits of credit card numbers on their receipts (they have since addressed the problem); apparently thieves hung out there waiting for drivers to go off and leave their receipts behind. I myself was a victim: within an hour or two after I bought gas at that station, I got a call from my bank saying they had cancelled my card because it had been pirated: dozens of people were charging to it. The thieves had a telephone or e-mail network that they used to spread my card number around within a few minutes after they found my receipt.

  6. Tartine

    Jul 24 2007

    I knew about this and I’ve been checking my receipts. Most of the time the big stores are OK, but yesterday my Mastercard card number was printed in full at Pharmaprix. The battle is still on…

  7. David Canton

    Aug 1 2007

    Unfortunately merchants continue to print full card numbers despite it being contrary to privacy laws and card issuer rules. This is a pet peeve of mine. I don’t understand why merchants do this. It serves no purpose, violates privacy laws, is a fraud risk, and puts the merchant at risk. Another concern of mine is do they keep it electronically, which is just as bad.

    I have commented on this issue before on my own blog. Anyone interested can look at those posts by clicking on the “credit card” or “debit card” links in the tag cloud of my blog at http://www.canton.elegal.ca

  8. Margo Humphreys

    Aug 8 2007

    I have encountered this problem with Visa receipts at Mr. Gas stations in the Ottawa area. I contacted the company several months ago complaining of this practice, but heard nothing and it was still happening as of August 1/07.

    I now ask at a station before buying gas and go elsewhere if the answer is not satisfactory.

  9. Alan L Brown

    Aug 25 2007

    One big Canadian company that may or may not truncate credit card numbers depending one which one you go to is Shoppers Drug Mart. Here’s my experience with their stores:
    Truncated
    5230 Dundas Street
    1630 Danforth Avenue
    NOT truncated
    69 Yonge Street
    817 Yonge Street
    351 Queen Street East

  10. Alan L Brown

    Aug 25 2007

    Further to my comment above:
    I have just filled in a form today, August 25) at Shoppers Drug Mart’s website sending them this message:
    ———————————————-
    Hello
    Toronto Star columnist Ellen Roseman in her blog (http://blog.ellenroseman.com/?p=55) has a discussion going about some merchants not truncating credit card numbers on their receipts. As she says on her blog “Some merchants are still printing the entire Visa card number on receipts. This is not only an invasion of privacy, but it contravenes a new Visa Canada policy supposed to take effect on April 1, 2007.”
    Unfortunately Shoppers Drug mart is one of those companies that prints the entire Visa card number on receipts (at least in some of your stores). here’s my experience:
    Truncated
    5230 Dundas Street
    1630 Danforth Avenue
    NOT truncated
    69 Yonge Street
    817 Yonge Street
    351 Queen Street East

    Could you tell me when Shoppers Drug Mart will begin truncating customers VISA numbers in ALL their stores. I will then feel safer shopping with your company.

    Thank you
    Alan L Brown
    Toronto
    ———————————————-
    After clicking the Submit button, the screen said: “Thank you for your comments. A Customer Service Representative will respond to your e-mail as soon as possible.”

    I will let you know of any reply I receive.

  11. Alan L Brown

    Aug 25 2007

    Further to my comments above:
    I received a reply from Shoppers Drug Mart today, the same day (August 25) I filled in a form on their website.
    Here’s the response:
    —————————————
    Hello Mr. Brown,

    Thank you for writing us. We apologize for any inconvenience you may have experienced.

    At Shoppers Drug Mart, we maintain the highest standards with respect to privacy, security, and integrity of personal information. We have recently replaced the asterisks previously used to mask customer’s credit card numbers with zeros on our sales receipts. This ensures customer privacy, and complies with current Payment Card Industry standards. However, due to customer feedback, the registers will revert to the asterisks in October of 2007. We thank you for your feedback and appreciate your comments.

    Please do not hesitate to contact the Customer Service Call Centre at 1-800-SHOPPERs should you have any further questions or comments, or require immediate assistance.

    Regards,
    Jennifer
    Shoppers Drug Mart Customer Service
    —————————————
    I must apologize for my error. All Shoppers Drug Mart receipts conceal the VISA credit card number. Some just do it in a way that I did not recognize. Four of the digits in the number are replaced by 0’s. This is not easily recognized at first glance which is way, as explained in the response above, they will be replaced by asterisks soon.

  12. FourPillars

    Aug 27 2007

    When I read this post, I had assumed that it was only the mom & pop gas stations in the middle of nowhere Ontario that were still printing all the digits of the credit card. Needless to say I was surprised that my Visa receipt from Shopper’s Drug Mart at Queen & Carlaw (in Toronto) showed every digit.

    Unbelievable.

    Mike

  13. Shani

    Sep 5 2007

    I am in USA, New York City. The same problem here: about 80% of the smaller stores are still printing the entire Visa card number on their receipts. When I am signing their receipts, I make first few digits not readable. Some stores’ employees are mildly displeased with my action, but most get really, really angry.

  14. Bll Tackaberry

    Sep 29 2008

    At the end of each month, I review my credit card receipts for expense distribution and noticed that a receipt I had from the Marina Grille at Ontario Place showed all 16 digits and expiry date of my TD Visa GM Card.

    I called TD Visa to express my concern and to notify them of the merchant name and merchant number, but it seemed that the woman I talked to (though polite) was not interested in recording any info about it.

    When she kept referring to Ontario Place as Ontario Point, my confidence level in thinking anything would be accomplished from India about contacting the “acquirers” to compel the Marina Grille to update their processing equipment disappeared.

  15. Joe F.

    Oct 16 2008

    At the end of each and every week, I review my credit card receipts for expense distribution. I noticed that a receipt I had from the McDonalds/Value Village Superstore showed all 16 digits and expiry date of my TD Visa GM Card!!!

    I called TD Visa to tell them of my concern and to notify them of the merchant name and merchant number. But it seemed that the man I talked to was not interested in recording any info about it and was very rude.

    When he kept referring to the Superstore as a vintage fat reck, my confidence level in thinking anything would be accomplished from Switzerland about contacting the “acquirers” to force the Superstore to update their processing equipment disappeared!!!!

  16. Dave

    Feb 23 2009

    I have been the victim of 2 different companies printing not only the card number but the expiry date also.

    The most recent was really scary. When the package arrived, I saw they had put the wrong receipt in the box so I had someone else’s info, which would mean that someone else had mine. Is there no privacy law that will apply here?

  17. John

    Mar 2 2009

    I am happy to found this blog, well done.

    I have had the same experience with CIBC Visa and Hongchow Restaurant in Kanata, ON. They print EVERYTHING on the receipt.

    Perhaps the only way to affect this is to publish the names of merchants who put our households at risk, much as your blog is doing, Ellen, only in a more summarized fashion.

    If the acquirers start to get complaints from merchants who see their potential sales jeopardized, maybe they will both pay attention.

  18. JJ

    May 23 2009

    I went to a restaurant this noon, noticed the full number and the expiration date of my credit card and my name had been printed on the receipt.

    I phoned the credit card company and I was told: it is normal that the business print this info on the receipt and I was overreacting. Hohoho.

  1. Citadel of the Blogs » careful when you sign that credit card receipt