Frequently Asked Question
![](https://www.pcisecuritystandards.org/wp-content/uploads/2022/03/FAQs-alt.jpg)
Can the full payment card number be printed on the consumer's copy of the receipt?
PCI DSS Requirement 3.3 states that PAN must be masked when displayed (the first six and last four digits are the maximum number of digits to be displayed) such that only personnel with a legitimate business need can see the full PAN. This requirement covers all displays of PAN, including those on paper reports, computer screens and payment card receipts.
Requirement 3.3 also includes the following note: "This requirement does not supersede stricter requirements in place for displays of cardholder data " for example, legal or payment card brand requirements for point-of-sale (POS) receipts. It should be noted that the maximum digits allowed per PCI DSS may be different than what is specified in existing regulations. PCI DSS does not override laws, government regulations, or other legal requirements that govern what can be printed on receipts. Entities are encouraged to contact their acquirer or the applicable payment brand to determine if any such regulations apply.
Also note that any paper receipts received and/or stored by merchants that contain PAN must adhere to applicable PCI DSS requirements, including Requirement 9 regarding physical security.
Related
-
What is the completion date for PCI DSS assessments documented in a Report on Compliance and its related Attestations of Compliance?
-
What is the completion date for PCI DSS assessments documented in a Self-Assessment Questionnaire and its related Attestations of Compliance?
-
How does PCI DSS Requirement 6.4.3 apply to 3DS scripts called from a merchant check-out page as part of 3DS processing?
Featured FAQ Articles
Featured
-
Do PCI DSS requirements for keyed cryptographic hashing apply to previously hashed PANs?
-
Is the PCI DSS Attestation of Compliance intended to be shared?
-
How does an entity report the results of a PCI DSS assessment for new requirements that are noted in PCI DSS as best practices until a future date?
-
Where do I direct questions about complying with PCI standards?
-
Can SAQ eligibility criteria be used for determining applicability of PCI DSS requirements for assessments documented in a Report on Compliance?
Most Popular
-
What is the completion date for PCI DSS assessments documented in a Report on Compliance and its related Attestations of Compliance?
-
What is the completion date for PCI DSS assessments documented in a Self-Assessment Questionnaire and its related Attestations of Compliance?
-
How does PCI DSS Requirement 6.4.3 apply to 3DS scripts called from a merchant check-out page as part of 3DS processing?
-
What is the scope of a PCI DSS assessment for service providers that can impact the security of payment account data, if the service provider does not directly store, process, or transmit payment account data?
-
Does PCI DSS apply to service providers that can impact the security of payment account data, if the service provider does not directly store, process, or transmit payment account data?
Most Recently Updated
-
What is the completion date for PCI DSS assessments documented in a Report on Compliance and its related Attestations of Compliance?
-
What is the completion date for PCI DSS assessments documented in a Self-Assessment Questionnaire and its related Attestations of Compliance?
-
How does PCI DSS Requirement 6.4.3 apply to 3DS scripts called from a merchant check-out page as part of 3DS processing?
-
Is the expectation that any PFI investigation initiated must result in a PFI Final Report?
-
Can a PFI Company perform subsequent PFI investigations for the same entity?