Merchants: Beware five-digit trap

Seller beware. If your business accepts credit cards and does not limit the information printed on credit card receipts in compliance with the Fair and Accurate Credit Transactions Act, or FACTA, then you are at risk of becoming yet another defendant in an epidemic of class action litigation. Your sin: printing more than the last five digits of a consumer’s credit card number or the expiration date of their credit card on a receipt. Your exposure: potentially $100 to $1,000 for every credit card receipt your business has printed since Dec. 4, 2006. The numbers can get big quickly.

The Fair Credit Reporting Act, or FCRA, was enacted in 1970 to regulate the rapidly growing consumer data industry, in other words, the credit reporting agencies. For the first 30-plus years of its existence, the FCRA applied almost exclusively to credit reporting agencies and the companies that reported data to them. However, in 2003, Congress amended the FCRA to require that merchants who take credit cards as a form of payment not reveal more than the last five digits of a consumer’s credit card number or the expiration date of the consumer’s credit card. This amendment to the FCRA, known as FACTA, was intended to prevent identity theft. However, it also marked a watershed change in the nature of the FCRA, which now expressly regulates every merchant in the United States who accepts credit cards as a form of payment.