Truncating Card Accounts

The Credit Card Associations of Visa and MasterCard require acquiring banks to truncate, or make indeterminable on printed sales receipts generated by automated telling machines (ATM), a minimum of four digits of the personal account number (PAN). The Associations also require PAN truncation for all receipts generated at Cardholder-Activated Terminals (CATs). PAN truncation is permitted for receipts generated at all other points of interaction.

Since 2005 it is also required that all sales receipts generated by newly installed, replaced or relocated point-of-sale terminals, whether attended or unattended, display only the last four digits of the account number. All preceding digits must be replaced with fill characters that are neither blank spaces nor numeric characters. Acceptable characters include "X," "*," and "#."

Following best practices for truncating card account numbers helps merchants fight fraud but it also promotes customer confidence in the merchant's ability to securely handle personal information. The last four digits provide the customer with enough information to identify the card that he or she used in the transaction.