FAQ #1136 Diff
Can the full payment card number be printed on the consumer's copy of the receipt?
Earlier Version
Later Version
Removed
Added
PCI DSS Requirement 3.3 states that PAN must be masked when displayed (the first six and last four digits are the maximum number of digits to be displayed) such that only personnel with a legitimate business need can see the full PAN. This requirement covers all displays of PAN, including those on paper reports, computer screens and payment card receipts.
Requirement 3.3states “Maskalso includes the following note: “This requirement does not supersede stricter requirements in place for displays of cardholder data “ for example, legal or payment card brand requirements for point-of-sale (POS) receipts. It should be noted that the maximum digits allowed per PCI DSS may be different than what is specified in existing regulations. PCI DSS does not override laws, government regulations, or other legal requirements that govern what can be printed on receipts. Entities are encouraged to contact their acquirer or the applicable payment brand to determine if any such regulations apply.
Also note that any paper receipts received and/or stored by merchants that contain PANwhen displayed (the first six and last four digits are the maximum number of digitsmust adhere to be displayed).” See also the note underapplicable PCI DSS requirement 3.3: “This requirement does not apply to employees and other parties with a legitimate business need to see the full PAN. This requirement does not supersede stricter requirements in place for displays of cardholder data (for example, for point-of-sale (POS) receipts).”
Since this requirement covers all displays of PAN,requirements, including those on paper reports, computer screens and receipts, the maximum digits allowed per PCI DSS may be more than are specified in existing regulations (see FACTA below). Please note, however, that PCI DSS does not override any other laws that legislate what can be printed on receipts (such as the U.S. Fair and Accurate Credit Transactions Act (FACTA) or any other applicable laws). Also note that any paper receipts stored by merchants for legitimate business reasons and which contain the full PAN must adhere to the PCI DSS, especially Requirement 9 regarding physical security.
Requirement 3.3
Also note that any paper receipts received and/or stored by merchants that contain PAN
Since this requirement covers all displays of PAN,
Disclaimer: This FAQ has been processed for display on this website and may contain errors. Please check the original FAQ on the PCI SSC website for the authoritative version.