full laser card number on receipt

mackeire

i was in centra today and used my card to pay for my goods. Usually i would just throw any receipts straight into the bin but today i decided to look at it and read it. I noticed that my full laser card number and expirerey date were printed on it. Surely this cant be legal as anyone who got hold of this receipt would have my card details and could use it any way they wanted!

Are shops meant to give receipts with full laser card numbers on them??

Rebel1977

I thought receipt had the number blocked out with **** except for last 4 numbers

The Lovely Muffin

Rebel1977 wrote: »

I thought receipt had the number blocked out with **** except for last 4 numbers

They do usually.

I always thought the merchant copy of the receipt had the full card number, but I could be wrong on this.

Have you contacted the shop in question OP to ask about this? Because if the merchant copy of the receipt has the full card number on it, then it sounds as if the shop has the customer copy, so whoever served you, made a mistake with the receipts.

wardy2

Heres the story
i work in a store and every shop prints out two receipts ,one for the customers with all the numbers block out expcet the last 4,and theres one for the shop itself with all of the numbers on it because if there some thing happen like the payment doest go tru,they can do it again the next day,dont worry every store does it....

dudara

Moved to Banking & Insurance & Pensions

dudara

stephendevlin

They gave you the wrong copy! they should have kept that one and given you the other......... . I have worked with about 5 of these machines.. all operate the same.

bobbytables

Obviously vulnerabilities exist but I'm surprised that they exist in this area. Surely it would make more sense if all the shop owner had was a transaction code that could be retried until the payment succeeds. I can't understand why the shop would need to hold on to that level of information just to retry again later.

I'd love to hear the privacy policies associated with handling such information in the likes of centra. The first thing that popped in to my head when I read the OP's post is how many people are going to start checking the streets and bins around centra's looking for discarded receipts.

Ms. Chanandler Bong

I've worked for a major Irish chain that uses these machines. As wardy2 says, the shop can enter your information if the transaction doesn't go through initially. I can see where bobbytables is coming from re: transaction codes but this particular type of machine doesn't work like that. They hang on to these receipts because they have to keep everything in case of an audit, all paperwork has to be held for something like 6 years (I think it's 6).
I've had people come into where I work now and say "I don't have my card, can't you just enter the number?" Luckily the machine my current employer uses doesn't allow for this facility. We don't have any way of taking payment from you without your card being present.
In my previous employment, we used to take orders from people over the phone who would give us their credit card details & expiry date, which we simply entered into the card machine. They were assuming we disposed of these details in a shredder afterwards but in fact these numbers would be written on a scrap piece of paper & simply thrown in a bin afterwards.:rolleyes: Was horrified the first time I saw it happen but owner said "sure no-one cares"!!!!! :O

ted1

so that's where the dodgy shop assistants get their info from.

mackeire

it was the merchant copy of the receipt that i have but have now i am thinking twice about where i use my card! I thought by entering my pin code, no body could get my details but the truth is any member of staff can have all my card detail as soon as i leave the shop. I think i might have to use the atm from now on!!

**Timbuk2**

It used to be the case (until very recently) that when lodging money into my Ulster bank Account, the 'receipt' I got contained the full card number (although it referred to it as a PAN Number) of my Visa Debit Card. This was the case for quite a while, but recently it just displays the last 4 numbers of the card.

Rebel1977

I aasume the expiry date be blanked out ?

XxMCRxBabyxX

Can they do much though without either your pin or CVV no though?

Genuine Q btw!

mackeire

Rebel1977 wrote: »

I aasume the expiry date be blanked out ?

No. I have the merchant copy here and the only thing that is not on it is the 3 digit code on the back. But that is only a 3 digit number so its between 001 and 999 so its not that hard to figure out!

Ms. Chanandler Bong

XxMCRxBabyxX wrote: »

Can they do much though without either your pin or CVV no though?

Genuine Q btw!

With the machines I used to have to use, you needed neither, you could bypass them. The machine asked if you had the CVV number, hit 'yes' or 'no', I hit 'no', it moves on to processing the transaction. No pin, no signature, no nothing. I've taken money from your account without you being in front of me with your card and I've not needed any security features to do so.

XxMCRxBabyxX

catreyn wrote: »

With the machines I used to have to use, you needed neither, you could bypass them. The machine asked if you had the CVV number, hit 'yes' or 'no', I hit 'no', it moves on to processing the transaction. No pin, no signature, no nothing. I've taken money from your account without you being in front of me with your card and I've not needed any security features to do so.

oi you keep away from my moneys! :P

In all seriousness though I didn't realise that it was that easy. I do find that a little worrying, especially considering that I use my laser for everything.

Ms. Chanandler Bong

XxMCRxBabyxX wrote: »

oi you keep away from my moneys! :P

In all seriousness though I didn't realise that it was that easy. I do find that a little worrying, especially considering that I use my laser for everything.

In fairness, not all machines allow you to do this. Didn't realise any did until I started working in that place:p Where I work now, machines don't allow it at all, in fact there's literally no need for us to touch the card even. You put the card in, we use the touchscreen facility on the till to get the pinpad set up, prompt you to enter your pin, the till tells us the transaction is authorised or not, you take out your card & leave happy!;) Our receipts print out with ************1234 & the expiry date, both on yours & our copy.
I do agree with bobbytables that a more secure method would be for the retailer to have a transactions number to re-use if necessary (that would only be valid for that transaction). But then (as I think about it whilst typing), what's to stop a dishonest retailer entering this number over & over? If someone wants to be dishonest, in general they will always find a way IMO

GerardKeating

wardy2 wrote: »

Heres the story
i work in a store and every shop prints out two receipts ,one for the customers with all the numbers block out expcet the last 4,and theres one for the shop itself with all of the numbers on it because if there some thing happen like the payment doest go tru,they can do it again the next day,dont worry every store does it....

Mastercard now recommend that the card number is also masked on the Merchant copy, it think it will become mandatory next year.

Visa are starting to suggest masking on the merchant copy..

XxMCRxBabyxX

catreyn wrote: »

In fairness, not all machines allow you to do this. Didn't realise any did until I started working in that place:p Where I work now, machines don't allow it at all, in fact there's literally no need for us to touch the card even. You put the card in, we use the touchscreen facility on the till to get the pinpad set up, prompt you to enter your pin, the till tells us the transaction is authorised or not, you take out your card & leave happy!;) Our receipts print out with ************1234 & the expiry date, both on yours & our copy.
I do agree with bobbytables that a more secure method would be for the retailer to have a transactions number to re-use if necessary (that would only be valid for that transaction). But then (as I think about it whilst typing), what's to stop a dishonest retailer entering this number over & over? If someone wants to be dishonest, in general they will always find a way IMO

I've worked in a few shops and certainly the last one I was in worked in the same way as you described (touchscreen, no interaction with actual machine) but even with the other ones I never realised that it was possible to be able to overrise the PIN and CVV options. Then again I never looked either!

goat2

ted1 wrote: »

so that's where the dodgy shop assistants get their info from.

this is not a good thing as this poster says, when shops employ people do they ask for garda checks, i see people of all nationalities working in these supermarkets and other shops, do they run a check on who they employ, this holding credit card numbers is new to me, i am disappointed

stephendevlin

Card details are easy to get a hold of.. pin numbers are not. If money has been taken from your account and the pin number was not verified. The onus is on the shop that did the transaction. If you reported a payment on your account that was not authorised by pin ... the shop would be the one thats in trouble....

bobbytables

stephendevlin wrote: »

If you reported a payment on your account that was not authorised by pin ... the shop would be the one thats in trouble....

That's what I wanted to hear, cheers

The PIN is only used in Card Present transaction, and never used online. Another poster mentioned how their boss didnt think many people "cared" and he's right, they dont. Thats because they expect and believe they are not at any risk. The difference between them and say a Social Engineer is that the SE uses information they have obtained already as a means of gaining further information. All the info doesn't need to be in one place. One place will expose X, another Y and another Z. The SE will piece that together if the potential gains create enough of an incentive.

mackeire

i went into the same centra and paid with my laser again and looked at the receipt and again my full card number and exp date were on it. I asked the guy behind the till a he said that other people had said it to him aswel and was then talking to the manager and he said that this is the way that their system is set up, (to print of full card details). He tried explaining that it doesn't matter if someone gets your number and exp date as long as they dont have your pin code. I replied that from ordering take away and paying by card that a pin code is not needed to use the card so he assured me that first thing monday morning, he would be on to head office and and find out why all the card details are printed on a receipt, instead of just the last 4, and would try to get to the system changed!!