What truncation is
Truncation removes part of a card's primary account number (PAN) from a display. A printed receipt might show only the last four or five digits, with the rest replaced by asterisks. That makes it harder for someone who sees the receipt to copy the full number.
Truncation applies to what is displayed. It does not mean the full card number has been removed from your payment system or stored records. Treat any retained full card data as sensitive and protect it separately.
Truncation protects the number shown on a receipt, not every copy of the number your business retains.
What the receipt rule requires
The Fair and Accurate Credit Transactions Act (FACTA) limits the card digits shown on electronically printed receipts handed to customers at the point of sale. You may print no more than the last five digits of a credit or debit card number. The requirement took effect on December 1, 2006.
The rule covers customer receipts, not digital transaction records you retain. It also does not apply to handwritten receipts or receipts produced by manual card imprinters. Those exceptions do not remove your responsibility to handle those records securely.
Truncation is not the same as masking
Truncation hides part of the card number in a displayed record, such as a receipt. Masking hides digits while someone enters or views the number on a screen. Both limit exposure, but they address different points in the payment process.
Neither measure replaces broader payment-card security. PCI DSS covers the handling of card data during storage, processing and transmission. Its current version is PCI DSS v4.0.1 as of 2026, and truncating a receipt alone does not establish that your business meets the standard.
What truncation means for your costs and risk
Truncation does not lower interchange, network fees or your processor's markup, and it is not a separate processing charge. Its value is reducing the card details visible on a receipt, which can limit exposure if a customer copy is lost or seen by someone else.
A processor may bill a monthly PCI non-compliance fee when your business has not validated compliance. Receipt truncation by itself does not validate compliance or prevent that fee. Check your printed customer receipts and your compliance status as separate controls.
What you can actually change
You control what your receipt printer displays and how staff handle card records. Set receipt output to show no more than the last five card digits, and protect records that contain more.
- Review printed and emailed receipt formats for exposed card digits.
- Configure electronically printed point-of-sale receipts to show no more than the last five digits.
- Store or dispose of handwritten and manual-imprinter records securely.
- Validate PCI DSS compliance separately from receipt truncation.
- Inspect customer receipts. Print a sample credit and debit receipt from each point-of-sale setup and confirm no more than the last five card digits appear.
- Secure retained records. Identify any paper or digital records containing full card details and set a secure storage or disposal process.
- Separate compliance checks. Confirm your PCI DSS validation status independently because hiding digits on receipts does not establish compliance.
Frequently asked questions
How many card digits can appear on a receipt?
For electronically printed receipts handed to customers at the point of sale, FACTA permits no more than the last five digits of a credit or debit card number. The requirement took effect on December 1, 2006.
Does truncation remove the full card number from my payment system?
No. Truncation limits the number displayed on a receipt or screen. It does not delete the full PAN from payment systems or retained digital records, which need separate security controls.