Masking Credit Card Numbers
byVancouver businesses are failing to protect my private purchasing information, and they’re probably doing the same with yours too.
How often have you eaten at a restaurant in town, paid by credit card and noticed on the receipt you’re about to leave on the table that your entire credit card number is displayed? If you haven’t next time you should look, because now whoever picks up that receipt will have your private payment information and your signature at their disposal. Establishments should be masking your credit card number so it shows up with only four legible numbers ie. xxxx-xxxx-xxxx-1234.
The other day at Yaletown Brewing I paid with a credit card and I noticed they didn’t mask my number. When this happens, I sign the receipt and always hand it directly to my server. Unfortunately in this case, he was too busy to pick up our bill from the table and when I asked if he could please take it from me he replied rudely that I need to leave it on the table. I replied, I need you to take this.
In the US various states have laws in place regarding card masking, and the issue is a hot one.
…some 50 of the nation’s top retailers—including Rite Aid, Harry & David, Ikea, KB Toys, Disney, Regal Cinemas and AMC Theaters—were accused of printing full credit numbers and expiration dates on printed customer receipts, violating a provision of the FACTA (Fair and Accurate Credit Transactions Act) that makes it illegal for a retailer to print more than the last five digits of a credit or debit card number or the card’s expiration date on a receipt. This is known as masking or truncation. The rule took effect in phases, but the latest phase went into effect in December 2006. [PC Magazine, Dec 2006]
Apparently in Canada, 2007 was also supposed to be our year of heightened credit card security, according to our Federal Privacy Commissioner:
…representatives of the retail industry have told her that all equipment used to electronically process credit-card payments will mask the cardholders’ personal information in 2007. [CBC, Dec 2006]
According to the BC Personal Information Protection Act: “The technology capable of masking or truncating numbers on receipts does exist, but many businesses have not yet converted to it. Industry advises us that masking the information of the cardholder on all equipment used to electronically process credit card payments should be in place in 2007.” [PDF]
I’ve noticed this all over town, and I think my main concern is with restaurants more than retailers (right now at least) since patrons are expected to leave their receipts and payment slips out in the open. This happened again yesterday at White Spot for Sunday brunch and I run into this issue at least once a week when I am using my credit card. Although I’m not one who scares easily, when it comes to my hard-earned money I’m going to try and protect what I have.
The next time you’re out dining on the town, remember to check for your credit card number on the receipt. If it is not masked, make sure you hand it off directly to staff. The Office of the Privacy Commissioner also has some tips for savvy consumers, I personally like the one about shredding. Hopefully by the end of 2007, retailers and restaurants in our international city will be up to snuff when it comes to personal privacy security standards.
12 Comments — Comments Are Closed
Not only do they not blank out your credit card number, but they also print out your card’s expiry date. I have noticed that on my ‘client copy’ they did blank out the number! Heaven forbid I should know my own credit card number!
I have know people personally who have had this information stolen from their table once they have left the restaurant and before the waiter/ess has collected it.
I notice this all the time too and it worries me. I can remember when I managed a hair salon a few years ago, we actually had to request for our machine to print the receipt with the number blanked out and pay extra to have that feature added. While it was certainly worth the money to protect our clients, I don’t see why a receipt would ever be printed with the entire credit card number visible, let alone the expiry too. That just seems like a case of fraud waiting to happen.
Thanks for posting this Rebecca. It’s definitely important for people to be aware of it.
I rarely pay by credit card, but have once or twice. I never even noticed whether the # came up fully or not. Thanks for the head-up!
Thanks for the reminder. I travel lots internationally, and sometimes, it’s just more convenient to pay with the credit card, because one tends to get more comparable and favourable market currency conversion rates with the credit card than with currency exchanges on the street. At any rate, I try to check that the credit card number is indeed masked on the slip I sign and leave for the restaurant …
Good reminder. I always check that. It’s pretty annoying that some stores don’t do that though.
It’s probably a moot point but it’s not always up to the establishment, but rather their bank that handles the credit card processing (who probably owns the machines that are rented to them) as to whether or not their machine has the software upgrades (or in many cases, new hardware is needed) that actually does the ‘masking’.
In some cases the establishment may have to pay for a hardware upgrade which could be the reason behind the slow migration to ‘masking’.
I also know from first hand experience at my day job that a hardware rollout of this kind can take ages to do and there are only so many ‘banking nerds’ out there to do the upgrades in person.
I always do what you described…and I don’t care if my number is printed or not, I will hand my receipt to someone in the restaurant before I leave. I never leave it sit on the table.
I’ve had my card number stolen, twice. Both times it appears as though it was stolen in Malaysia. There was a period of time in which nothing happened (taking time to get a card made, undoubtedly) and then, wham, the charges start racking up. The last time it happened, they racked up over $10,000.00 worth of merchandise in less than a day…hitting all the best shops in Paris, France.
My bank was fantastic about the whole thing. I noticed the activity online and I called and refused the transactions. I had to fill out a cumbersome form online, but other than that, I was done. The bank canceled my card and re-issued a new one with a new number. The credits were placed into a separate account until the issue was resolved (which is pretty easy when they call up the receipts an none of them match my signature).
Something to remember, though. If you have your DEBIT card stolen along with the pin number…you won’t have it so easy. You will be on the hook for what is spent…because, there is generally no paper receipt to follow. There is a complicated chain of events you have to meet in order to get out of those transactions…and one of those is reporting your card stolen to the bank and to police. It’s very strange. Hence, I prefer the use of a credit card wherever I go. Use it, pay it.
On an unrelated story…I once dined in a restaurant, paid with my card, and handed the receipt to the hostess on my way out the door. It was a $75.00 meal with a $10 tip. When the transaction cleared the bank, it was for $135. Huh? I called the bank and got a copy of the receipt…someone at the restaurant had altered the 1 in my tip to a 6…pocketing an extra $50.
Lesson? Leave your tip in cash.
it’s articles like this that make me say GET IN MAINSTREAM MEDIA!
your sh*t is good, girl.
While I find the response from the server deplorable and not in keeping with our customer service guidelines – I can assure you that the Yaletown Brewing Company IS masking the credit card numbers on our guest checks and we employ the latest in POS security available to the restaurant/food service business.
Nonetheless, thanks for taking the time to point out this service blunder. We have posted your article in our staff room and will detail your concerns at our pre-shift meetings.
Fraser Boyer
Yaletown Brewing Company
Hi Fraser, I hope you haven’t posted my photo along with it as I’d like to be able to eat there again without finding surprises in my food hehe. Thank so much for the update, as of last week the masking wasn’t in place (on the merchant or customer copy) so it’s good to know YBC is stepping up.
It is often thought that the cost of credit card fraud is borne by the credit card companies, but that is not so. It is borne by the merchants who accept the bogus cards.
While I was in London, where they use chip and PIN for most customers who have such cards, my American Express card was duplicated – and it did not leave my hands at all. I ran it through a machine at the table, and then signed the printed receipt which the waitron took immediately. So the scammers do not even need to get their hands on the printed copy.
For consumers identity theft is an inconvenience – sometimes quite a big one. For merchants it is a source of serious losses. So you would think that in general they would have a strong incentive to tighten up procedures. The roll out of chip and PIN here is disgracefully slow. In Europe they have had it for years.
Wow. Nice attitude from the dude. I’d have NEEDED to walk out.