In August, I read a good journalist’s article on businesses that print full credit card numbers on receipts. At the time, I hadn’t realized how widespread this was until I started checking every receipt closely. Now it is starting to make me angry.
On Tuesday, I went to a regulatory conference where the privacy officer for TD Bank was presenting. I asked her about merchants who print full credit card numbers on receipts. She informed me that Visa has a requirement to only print last few digits of credit card on receipts and it came into effect on April 1, 2007 of this year. However, this new rule is not well known and not enforced and it seems customers have to police it on their own. In fact, she seemed to think we could expect merchants to take 3 to 7 years to “get it right”. With 500,000 terminals in use in Canada alone, I don’t doubt her point. I just take issue with the process.
So I have gotten into the habit of crossing out the middle six numbers on their store copy of the receipt (since I keep my own and am careful with it). Other than that, cardholders can call the Visa card issuer with information about the merchant’s name, location and the date. Or customers can call the federal Privacy Commissioner at 1-800-282-1376 or send an email to info@privcom.gc.ca.
Incidentally, MasterCard made a similar mandate in Canada back on April 1, 2005. At that time, cardholder receipts generated by newly installed, replaced or relocated terminals were required to block all but the last four digits of the account number.
For further info, read this letter from the Ontario Privacy Commissioner.
At first, it appeared that Shopper’s Drug Mart printed full credit card numbers. I need to double-check my receipts because I dug into this more deeply and they are supposedly substituting four digits with four zeroes rather than the more customary asterisks. Due to complaints they are supposedly changing to asterisks in October, 2007. [UPDATE Sep 23/07: zeroes in it! I’m quite relieved to know Shoppers did this. And not only do I support their explanation that it is hard to distinguish zeroes from the rest of your credit card number and their decision to move toward asterisks– I now have more respect for them for doing this. That is how privacy can build confidence in a business!]
But the one that really got me on to this was when I registered my son for swimming lessons at the YMCA. A big company like that should not be printing full credit card numbers. No way, no how.