Card receipts: what the rules actually require.
The card number must be truncated and the expiry date must not appear. Beyond that the network rules are modest, and your terminal handles most of them — unless somebody has configured it badly.
What this page settles.
Three questions, in the order most people ask them.
The truncation rule
Two requirements, and they are the ones with teeth.
No more than the last five digits of the card number may appear on an electronically printed receipt given to the cardholder. In practice almost every terminal shows four, which is well inside the rule and is the convention customers expect.
The expiry date must not appear at all on the cardholder’s receipt.
These come from federal law — the truncation requirement in the Fair Credit Reporting Act, as amended — as well as from the card network rules, and the combination is what makes them worth getting right rather than approximately right. The reason is simple: a card number plus an expiry date is most of what somebody needs to use a card fraudulently. Either alone is much less useful.
What this means for you in practice is a configuration check rather than an ongoing task. Modern terminals and POS systems truncate correctly out of the box. The cases that go wrong are old equipment, custom receipt templates somebody built, and invoicing or order systems that print payment details alongside the order.
Print one of your own receipts and look at it. Four digits, no expiry, done.
What else belongs on the receipt
Beyond truncation, the network rules expect a receipt to let a cardholder identify the transaction. The standard set:
Your business name, matching what appears on their statement. If the receipt says one thing and the statement says another, you will generate disputes from your own customers for no reason. Billing descriptors.
The transaction date, and for many categories the time.
The amount, with tax and tip shown where applicable.
The authorization code or transaction reference.
The card brand and the truncated number, so they can tell which of their cards they used.
Whether it was a sale, a refund or a void.
For tipped trades, a tip line on the merchant copy and a total line that the customer completes. If you use tip adjustment, the receipt is the record that supports the adjusted amount, which matters if it is ever disputed. Restaurant processing.
None of this is onerous and all of it is standard terminal output. The point of listing it is that when you build custom receipts — through a POS, an online checkout, or an invoicing tool — these are the fields to make sure survived the design process.
Your copy, and why it matters
The merchant copy is evidence, and it is the cheapest evidence you will ever have.
In a dispute, what you want to be able to produce is the transaction record showing how the card was read. A chip or contactless read is strong evidence that the physical card was present; a keyed transaction is weak evidence of anything. Your receipt and the matching transaction record in your processor’s portal are what you submit. How to fight a chargeback.
Two practical habits:
Keep merchant copies in order for at least the dispute window, which can be months. A shoebox in date order beats a drawer.
Do not keep anything you do not need. Merchant copies with truncated numbers are fine to keep. Anything holding a full card number — an old imprint slip, a written-down number, an order form with card details — is a liability in a breach and gives you nothing. Find it and destroy it. What happens if card data is breached.
The signature question comes up often: the networks removed the signature requirement some years ago, and signature is no longer the thing that proves a card-present transaction. The chip read does that. If your terminal still prompts for a signature and your staff still collect it, no harm done — it is just not what your dispute defence rests on any more.
Digital receipts
Email and text receipts satisfy the requirement to make a receipt available, and customers increasingly prefer them. Three things to get right.
Truncation applies identically. A digital receipt is a receipt. Four digits, no expiry.
Do not capture more than you need. Collecting an email address for a receipt is reasonable. Quietly adding that address to a marketing list is a different thing, is governed by its own rules, and is the fastest way to turn a convenience into a complaint.
Make sure it looks like you. A digital receipt from a payment provider that carries the provider’s branding more prominently than yours is a mild dispute generator, because the customer does not recognise it a month later.
For phone-based acceptance, digital is the only option — there is no printer — which is worth knowing if your trade has customers who expect paper.
Surcharges and fees on the receipt
If you add a surcharge for card payment, the receipt is one of the places the networks require it to be disclosed: the surcharge must be shown as a separate line item, not folded into the price.
That sits alongside the other disclosure requirements — signage at the point of entry and at the point of sale — and alongside the limits on what may be surcharged and by how much. The rules here are specific and the consequences of getting them wrong include losing the right to surcharge at all. Surcharging rules, in full.
The same applies to the programs sold as zero-fee or cash discount processing. Whatever the program is called, what appears on the receipt has to accurately describe what the customer was charged. A “service fee” line that is really a card surcharge, undisclosed at the door, is the version that gets merchants into trouble.
What usually goes wrong
Five things, all configuration rather than conduct.
A custom receipt template that reintroduced the expiry date. Happens when someone builds a receipt in a POS and copies the fields from an order form.
An invoicing or order system printing payment details. The terminal is fine; the back-office document is not.
Old hardware showing more digits than it should. Rare now, but check.
A business name on the receipt that does not match the statement descriptor. Not a rule violation, just a reliable source of disputes.
A surcharge line that is not actually a line. Folded into the price, or described as something else.
All five are found by printing one receipt and reading it, which is a five-minute job that nobody does.
What we charge
Interchange + 0.50% + 10¢ in person, interchange + 0.75% + 25¢ keyed, with no contract, no monthly fee and no monthly minimum.
Receipt configuration is terminal setup, and it is part of boarding an account properly rather than something to charge for. Send us a photo of one of your receipts and we will tell you whether anything on it needs changing.
While we are on the subject
Can I print the full card number on my own copy?
Storing full card numbers in any form, including on paper in a drawer, puts you squarely in scope for PCI and is a liability with no benefit. Modern terminals truncate both copies and that is the right setting.
Do I have to give a receipt at all?
Network rules require that you make one available. A digital receipt satisfies that where the customer accepts it.
Does a signature still matter?
The networks dropped the signature requirement some years ago. Your evidence in a dispute now comes from the chip or contactless read, not from a signature.
What about the expiry date on an invoice?
Do not put it anywhere the customer or anybody else receives. Storing expiry dates alongside card numbers is exactly the combination that makes stolen data usable.