Business Law Advisor

[#1]

Last night I went out to eat at a popular DC area restaurant with some friends.  Feeling especially generous, I picked up the tab, and paid with my credit card.

On the receipt marked "Merchant Copy" ... you know, the one you sign and leave on the table for any theif to pick up and steal your identity ... there was my credit card number for the world to see.

Normally, most businesses truncate the credit number on electronically printed receipts so it appears something like this:

ACCT: ***********12345
EXP: ****

So, last night, I took the pen accompanying my receipt, and scribbled out my credit number so hard that it tore the paper.  

My friends were aghast.  One proclaimed, "You can’t do that!"  Another said, "Yeah, that’s illegal!"  And yet another, said, "No, it’s illegal for them to print the credit card number on the receipt."

What’s this? Disagreement among friends?  I had to get to the bottom of it.

According to the Fair and Accurate Credit Transaction Act (FACTA), federal law requires all businesses to truncate credit card information on electronically printed receipts.  The law does not apply to imprinted or handwritten receipts.   However, merchants are reminded of their responsibilities to protect customer privacy.

The consequences for non-compliance with this law are enforcement actions from the Federal Trade Commission, which includes civil penalties (fines) or "injunctive relief" ... which doesn’t sound like a good kind of relief … it basically means that you must refrain from doing something or you will fined or imprisoned.

So there you go.  You guys fight over who's going to buy me dinner next time. 

For more information on this law and other privacy laws, visit the following web sites:

• Federal Trade Commission Business Alert
• Protecting Personal Information – A Guide for Business
• Business.gov Guide to Privacy Laws

[#2]

Online Customer Credit Card Security Liability for the Seller

Yes, this issue of truncating credit card numbers or a portion of them is essential.  However, I need you ropinion on another related matter reagrding credit card security.

I have a business coach from a local university's business school.  He has made me aware of a seller's liability for customer credit card information when conducting online credit card transactions.  The concern is that a 3rd party could gain access to a customer's credit information without the buyer or the seller's knowledge (hacking).

PayPal changed its Terms of Service agreements and  policies in early 2008 stating that all  liability for any breach as described above is on the seller, not on the credit card processor.  Since that time, all other credit card proc. companies have done the same with their policies.  Here is the link to the PayPal policy statements: https://www.paypal.com/us/cgi-bin/webscr?cmd=xpt/UserAgreement/ua/USUA-outside (Section 10 especially). 

Question:  Has anyone noticed this?  What have you done about it?  More insurance?  I have a quote,  and it is cost-prohibitive for a very young company.  What do you do about online credit card sales and the liability on the seller?

[#3]

My husband has a small business and we are trying to watch out for all the regulations re credit card processing.  The fees for a small business, "card not present" fees are prohibitive.  We are thinking about adding a transaction fee to the buyer to help cover this expense.  I seem to remember some articles in our local paper several years ago that it was illegal to charge more for credit cards.  Is that the case?  The business is located in Kentucky, but we sell all over the eastern United States through catalog and online sales.  Does anyone know for sure about this or can suggest where I can find the regulations on this?

[#4]

This is a great idea as it prevents frauds. Being involved with the industry for over 5 years now online, the govt also requires that PCI compliant frameworks and online merchant gateways parse credit card informatoin directly to banks data centers securely via SSL so that the merchants will not see the information their clients input into a form when processing a payment online. This is all to protect the cardholder

[#5]

Nancy,

Make sure you read your terms and conditions from your merchant account processor carefully.  There's a stipulation in there that you cannot charge a customer for using a credit card in your store (you cannot charge a percentage of the sale OR a fixed fee). 

You can, however, offer a "cash discount" on your items.  For instance, if you sell an item for $9.99, you can offer it for $8.99 if the customer pays cash (you will see this on many gas stations now -- a discount if the customer pays in cash vs. uses a credit/debit card).

[#6]

I need clarification on what the federal law actually prohibits in regards to the display of credit card numbers. In the article it is stated that it is illegal to show the entire credit card number on the copy that you sign for the merchant. Is this only in the case that it is left on the table unattended, or is it illegal to print the entire number on any copy?

I use a local service that prints the last 4 of my card number on my copy of the receipt, but it prints the entire number on their copy of the receipt that they retain in their office indefinately. Is this practice illegal? And if it is illegal, what statute or legislative act makes it illegal? What I have read so far only indicates that it is illegal to print to print the entire number on my copy, but it is OK to print and keep the entire number in their possession. I have read the statutes in my state, but they only refer to the customer copy, not the merchant copy. I would appreciate some clarity on this matter.

[#7]

Should be remembered that in different banks when you'll pay with card will be a different percentage for the transaction

_________________

Custom essay writing

Message Edited by NicoleD on 09-30-2009 12:16 PM

[#8]

This is a great law if I must say myself... I remember about 5 years ago finding a receipt with a full credit card included on the receipt and someone simply tossed it on the ground.  I was shocked and immediately disposed of it.

Tyler Gheller

Los Angeles Lawyer & Attorney

Message Edited by NicoleD on 09-30-2009 12:16 PM

[#9]

I don't think any credible merchant would even consider handing out receipts that show the CC number. It just wouldn't make sense.

Omer A.

MMORPG and Game Music Site Owner

VG Alliance LLC (New Jersey)

Message Edited by NicoleD on 09-30-2009 12:18 PM

[#10]

According to the U.S. Fair and Accurate Credit Transactions Act of 2003, which went into effect on December 4, 2006, the retailers are not allowed to print their customers' full credit card numbers on the sale receipts in an effort to prevent consumer fraud and identity theft.

Modern machine are only supposed to print the last four digits of a credit card number. If the store is repoted they can face a $1,000 penalty per transaction.

[#11]

Well obviously you don't read that well because if you did you would see that in the article on the Federal Trade Commisions website it says "Several details of the law are worth noting: It applies only to electronically printed receipts, not to handwritten or imprinted ones. And it applies only to receipts you give your customer at point of sale, not to any transaction record you retain. Be aware, however, that when you keep your customers’ personal information — including account data — you have an obligation to keep it safe. “In regards to truncation and the merchant copy of the receipt. Also in Visa's regulations it states” The Primary Account Number is allowed to be printed in its entirety on the merchant transaction receipt.If possible, Visa recommends that the merchant receipt also contain a truncated PAN." So next time before you go spouting off about things you know nothing about at least research the matter first and save yourself some embarrassment. 

[#12]

Actually, draycon, Facta 605(g) says:

Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.

Since merchant receips are always provided to the cardholder (because they're they ones the cardholders sign), BobK's explanation is correct for the scenario described. The"electronically printed receipt" exception is the only exception, and it isn't relevant to the given scenario.

Moreover, neither Visa nor PCI's card protection standards supersede the law (as is noted in both). Thus, at least for cards processed in the US, FACTA's more restrictive requirements apply.