Are You Violating the Fair and Accurate Credit Transaction Act?

April 28, 2009 – Wilsonville Oregon

ORA has received reports that some establishments may still be acting (knowingly or unknowingly) in violation of the Fair and Accurate Credit Transaction Act passed in 2003, and later updated in 2008. The original act mandates the truncation of credit card numbers so that no more than the last 5 digits are to be printed on any receipt provided to the cardholder at the point of sale or transaction. This has been in effect since 2006.

We would strongly advise you to check your POS systems or credit card processing equipment, and determine if you are in compliance; if not, it is highly recommended you check with your POS system or credit card processing provider regarding coming into compliance with Federal law.

Noncompliance could open a company up to an FTC law enforcement action, including civil penalties and injunctive relief. In addition, the law allows consumers to sue businesses that don’t comply and to collect damages and attorney’s fees.

Excerpt from Fair and Accurate Credit Transaction Act, 2003

SEC. 113. TRUNCATION OF CREDIT CARD AND DEBIT CARD ACCOUNT NUMBERS.

Section 605 of the Fair Credit Reporting Act (15 U.S.C. 1681c) is amended by adding at the end the following:
"(g) TRUNCATION OF CREDIT CARD AND DEBIT CARD NUMBERS.—
"(1) IN GENERAL.—Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.
"(2) LIMITATION.—This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card.
"(3) EFFECTIVE DATE.—This subsection shall become effective—
"(A) 3 years after the date of enactment of this subsection, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is in use before January 1, 2005; and
"(B) 1 year after the date of enactment of this subsection, with respect to any cash register or other machine or device that electronically prints receipts for credit card or debit card transactions that is first put into use on or after January 1, 2005.".