Printing card data not smart
David Canton - for the London Free Press - May 20, 2006 Read this on Canoe
Next time you make a purchase, look at all copies of the credit or debit card receipt. They shouldn't, but often do, show your entire credit or debit card number.
Printing those numbers on the customer or merchant copy is dangerous if receipts fall into the wrong hands.
That happened at a beauty supply store in Edmonton, Alta. Receipts bearing debit and credit card numbers were discarded in a dumpster behind the store and retrieved by criminals searching for private information. As a result, a customer was the victim of credit card fraud.
Alberta's privacy commissioner got involved when Edmonton police were tipped off that confidential client information was being improperly disposed of by the store. The tipster gave the police receipts from the dumpster as proof.
Police recovered more than 2,600 customer credit and debit card sales transaction receipts. Thousands of clients had been put at risk of fraud, identity theft and other privacy violations.
The commission found that the store had not adequately protected its customers, and made recommendations on how it could do better.
First, it recommended the store implement a system to abbreviate the credit and debit card information that gets printed on receipts.
It also recommended the store secure the receipts while they were on the premises, destroy them by shredding or other means before disposal, dispose of them only in locked garbage bins and trash cans and keep a log of who had access to them.
The commission stressed the importance of teaching all employees about the need to protect clients' privacy.
Unlike the Alberta Privacy Commission, the federal privacy commissioner has yet to address the issue of printing credit and debit card data on receipt. While the Alberta privacy legislation is different than the PIPEDA legislation that applies in Ontario and other provinces, there is no reason to believe the outcome would be different.
Businesses protecting their customers in this way also safeguard their own interests. No business wants to face a privacy investigation, or to expose its customers to credit or debit card fraud.
There is no need to print full debit or credit card numbers on either merchant or client copies of receipts. By the time the receipt is printed, the bank or credit card company has already OK'd the transaction.
The next time you see your debit or credit card number on either your own or the merchant's copy, complain to the merchant. If their practice does not change, complain to the privacy commissioner.