FACTA Explained: Receipt Truncation, Fraud Alerts, and Your Right to Sue

Congress enacted FACTA on December 4, 2003, as a set of amendments to the Fair Credit Reporting Act (FCRA). It is not a freestanding statute: its rules sit inside the FCRA at 15 U.S.C. 1681 and following, and it is enforced through the FCRA's damages provisions. Our FCRA guide covers the broader law.

FACTA had two goals: cut the raw material identity thieves use, and give victims faster ways to repair the damage. Its main pieces are:

• Receipt truncation (15 U.S.C. 1681c(g)), limiting card data on printed receipts.
• Free annual credit reports (15 U.S.C. 1681j(a)) from each nationwide credit bureau.
• Fraud alerts and active duty alerts (15 U.S.C. 1681c-1).
• Identity theft blocks (15 U.S.C. 1681c-2), which remove fraudulent information from your credit report.
• Business duties carried out through FTC rules, including the Disposal Rule for consumer report information and the Red Flags Rule for identity theft prevention programs.

Under 15 U.S.C. 1681c(g), no business that accepts credit or debit cards may print more than the last 5 digits of the card number or the expiration date on a receipt given to the cardholder at the point of sale. Printing the expiration date alone is a violation, even if the card number is fully masked.

The rule has limits:

• It applies only to electronically printed receipts, not handwritten slips or card imprints.
• It covers the receipt handed to the cardholder, not the merchant's own copy.
• It took full effect for all machines by December 4, 2006. Machines first put into use on or after January 1, 2005 had to comply one year after enactment.

Many retailers were sued in the mid-2000s for printing expiration dates. Congress responded with the Credit and Debit Card Receipt Clarification Act, signed June 3, 2008, which says that printing only the expiration date between December 4, 2004 and June 3, 2008 was not a willful violation if the receipt otherwise complied. That safe harbor is long closed; any expiration date printed today falls under the ordinary rule.

FACTA uses the FCRA's two liability tiers:

Type of violation	What you can recover	Statute
Willful	Actual damages or $100 to $1,000, plus punitive damages and fees	15 U.S.C. 1681n
Negligent	Actual damages and fees only	15 U.S.C. 1681o

For a willful FACTA violation, 15 U.S.C. 1681n(a) allows actual damages or statutory damages of not less than $100 and not more than $1,000 per consumer. Because most receipt plaintiffs cannot show a dollar loss, receipt cases turn on willfulness. In Safeco Insurance Co. of America v. Burr (2007), the Supreme Court held that "willful" under the FCRA covers reckless violations as well as knowing ones, so a merchant that ignored a well-publicized rule can be liable even without intent to harm.

Class settlements pay far less than the statutory range suggests. In the Trader Joe's FACTA settlement, a $7.4 million fund covered receipts from 2019 that showed the first 6 and last 4 card digits, and the plaintiff estimated about $102.45 per valid claim. Payments depend on how many people file and what fees the court approves; our guide on how class action money is divided explains the math.

After the Supreme Court's 2016 decision in Spokeo v. Robins, a federal plaintiff must show a concrete injury, not just a technical statutory violation. That has hit receipt cases hard.

On October 28, 2020, the full Eleventh Circuit held in Muransky v. Godiva Chocolatier that a receipt showing the first 6 and last 4 digits, without more, did not give the plaintiff standing, and it threw out approval of a $6.3 million class settlement. Other federal appeals courts have reached different results depending on the digits printed and the harm alleged.

Two practical effects follow. Many new receipt suits are filed in state courts, which can have looser standing rules; the Trader Joe's case, for example, was brought in Los Angeles County Superior Court. And complaints increasingly allege concrete harm, such as time spent monitoring accounts. Our FACTA receipt lawsuit page tracks current cases and investigations.

Most people know FACTA from receipt lawsuits, but its most useful parts protect you directly, at no cost.

Free credit reports

FACTA requires each nationwide credit bureau to give you a free report once every 12 months on request. The FTC says the three bureaus have permanently extended a program that lets you check your report from each once a week for free at AnnualCreditReport.com, the only official site.

Fraud alerts

• Initial fraud alert: if you suspect in good faith that you are or may become a victim of identity theft, a bureau must add an alert that lasts at least 1 year. Lenders are supposed to verify your identity before opening new credit.
• Extended fraud alert: if you submit an identity theft report, the alert lasts 7 years.
• Active duty alert: for service members on active duty.

Identity theft blocks

Under 15 U.S.C. 1681c-2, a credit bureau must block fraudulent information from your file no later than 4 business days after it receives proof of identity, an identity theft report, and your identification of the fraudulent items. An identity theft report from IdentityTheft.gov or a police report can serve as the report.

If you received a breach letter, our guide on what to do after a data breach notice walks through these steps in order.

Under 15 U.S.C. 1681p, a FACTA or FCRA lawsuit must be filed by the earlier of 2 years after you discover the violation or 5 years after it happened. Because a receipt is in your hand at the time of purchase, courts often treat the purchase date as the discovery date, which makes the practical window about 2 years. This statute of limitations is why receipt class definitions usually reach back 2 years from filing.

If you have a receipt that shows too much:

1. Keep the original. Thermal receipts fade, so photograph it right away and store it away from heat.
2. Record the details: store location, date, time, and which card you used.
3. Save your card statement showing the matching charge.
4. Note any fraud on that card after the purchase, and any time or money spent dealing with it.
5. Watch for settlement notices. If a settlement already covers your receipt, you file only on the official settlement website, and our guide on proof of purchase for settlements explains what to submit.

If a business printed your full card number or expiration date and you want to know whether you have a claim, a free case review can connect you with independent attorneys who handle FACTA cases.