Primary Account Number (PAN) truncation is a security measure used at point-of-sale (POS) terminals to guard against fraud. When a customer pays for goods or services with a credit or debit card, the card’s numbers are truncated on the sales receipt with the missing digits replaced by wild cards such as asterisks. In some cases only the last four numbers are revealed, but a minimum of four digits must be replaced to comply with the regulation. PAN truncation allows the customer to identify which card he or she used while protecting the account.
Paper receipts that are carelessly thrown away, lost or stolen, previously provided thieves with everything they needed to commit identity theft or fraud. Stealing a credit or debit card number not only allows bilking of the account, but can also lead to opening new lines of credit, unbeknownst to the victim. By the time the victim learns of the new credit lines, the thief has vanished, leaving financial ruin in his or her wake.
The MasterCard™ Worldwide Merchant Rules Manual mandated PAN truncation for new, replaced or relocated POS terminals effective 1 April 2005. These terminals suppress all but the last four digits of a debit or credit card. Existing POS terminals were upgraded, giving merchants leeway to use programs that suppressed fewer digits, though MasterCard strongly recommends suppressing all but the last four. VISA™ International Operating Regulations also mandates PAN truncation, echoing MasterCard’s recommendations.
According to Global Payments Inc., MasterCard issued additional guidelines that require elimination of a card’s expiration date from both customer and merchant receipts, to be implemented with software upgrades between 1 October 2008 and 31 December 2010. MasterCard also purportedly made the previous recommendation of suppressing all but the last four digits on the customer’s receipt a requirement, urging adoption of PAN truncation for merchant receipts as well.
Although PAN truncation can help stem the tide of growing credit card fraud by eliminating additional opportunities for theft, it is wise to use a confetti-style paper shredder for materials that contain personal information of any kind. This includes name, address, phone, phone records, bills, and financial records. Bar codes might also contain personal information. By shredding sensitive documents you are placing one more layer of security between yourself and potential fraud.
