Merchants do several specific things with credit card receipts: they store the transaction record for years to meet IRS, card network, and dispute-resolution rules; they protect that stored copy under federal law and the Payment Card Industry Data Security Standard; they use it to defend chargebacks when customers dispute a charge; and when the retention period ends, they destroy it in a way that makes the data unrecoverable. Certain pieces of card data — the full magnetic stripe, the security code on the back, your PIN — they are forbidden to keep at all, even for a moment after the sale is authorized.
How Long the Record Stays
Retention isn’t a single number. It’s the longest of several overlapping obligations.
The IRS wants records that support income, deductions, and credits for at least three years from the date the return was filed. That stretches to six years if a business underreports gross income by more than 25%, and to seven years for a loss claimed on worthless securities or a bad debt.1Internal Revenue Service. How Long Should I Keep Records? The individual receipt is the evidence that ties a day’s sales to the totals on the annual return.
The Uniform Commercial Code adds a separate clock. A breach-of-contract claim on a sale of goods can be brought up to four years after the problem arises.2Legal Information Institute. UCC 2-725 Statute of Limitations in Contracts for Sale A merchant who tosses records early may have nothing to show when a dispute surfaces later.
Each card network sets its own minimum through the merchant agreement. Visa and Mastercard require at least 13 months of transaction data. American Express requires two years. Discover requires three. Those are contractual, not advisory: a merchant who can’t produce a requested record within the window generally loses the dispute by default.
Most businesses set their retention floor at the longest deadline that could apply to them, which typically lands between four and seven years.
What Can Appear on Your Receipt, and What Can’t Be Kept
Federal law limits what prints on the copy you’re handed. Under the Fair and Accurate Credit Transactions Act, an electronically printed receipt given to the cardholder can show no more than the last five digits of the card number and cannot display any part of the expiration date.3Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports The rule targets the customer copy specifically. It doesn’t govern the merchant’s own retained copy, and it doesn’t apply to handwritten or imprinted slips.
A merchant who willfully violates the truncation rules faces statutory damages of $100 to $1,000 per affected consumer, plus potential punitive damages and attorney’s fees.4Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Class actions have produced multimillion-dollar settlements, which is why modern terminals truncate automatically.
Separately, PCI DSS draws a hard line on what merchants may never store after authorization, even encrypted:
- The full magnetic stripe or chip data
- The three- or four-digit security code (CVV/CVC)
- Your PIN
These are treated as sensitive authentication data and have to be destroyed the moment the transaction is authorized.5PCI Security Standards Council. PCI Data Storage Dos and Donts Cardholder data that merchants may keep with proper safeguards includes the primary account number, cardholder name, expiration date, and service code. A merchant who stores prohibited data — even by accident, through a misconfigured system — faces network fines, possible termination of processing, and heavy liability if a breach happens.
How the Stored Copy Is Protected
Most merchants use a mix of physical and digital storage. Paper slips get organized by date or batch and kept in locked cabinets with restricted access. Many businesses now scan slips into encrypted digital systems right after the sale, which speeds up audits and dispute responses.
Any system holding cardholder data has to meet PCI DSS: encryption of stored data, strict access controls over who can view full card numbers, and regular security scans by the processor or an approved scanning vendor.6PCI Security Standards Council. PCI Security Standards Overview Cloud storage is common, but the merchant stays responsible for the provider meeting these standards.
Why They Hold Onto It: Chargeback Defense
The stored receipt is the merchant’s primary evidence when you dispute a charge. A chargeback begins when you contact your card issuer and challenge a transaction — saying it was unauthorized, the goods never arrived, or the amount doesn’t match what you agreed to. Your issuer routes the dispute to the merchant’s bank, which sends a retrieval request. The merchant has to respond with a clear copy of the transaction record: signature if applicable, authorization code, proof of delivery. Without documentation, the merchant almost always loses, and the full sale is pulled from their account.
Processors also charge a fee per chargeback, typically $20 to $100, with arbitration fees of $250 to $500 possible if the case escalates. Merchants whose dispute ratios climb too high face card network monitoring programs; Visa flags acquirers whose merchants exceed a 1.5% dispute ratio, a threshold dropping to 0.9% in April 2026.7Visa. Visa Acquirer Monitoring Program Fact Sheet A merchant who breaches those thresholds can lose the ability to accept the card brand altogether. That’s why retained receipts get treated as serious business records, not clutter.
Emailed Receipts
When a merchant emails your receipt, the same truncation rules apply: no more than the last five digits of the card number, no part of the expiration date. Digital receipt systems also have to avoid quietly storing sensitive authentication data in server logs or backups, which would violate PCI DSS even if the customer-facing email is properly truncated.
A purely transactional email — one that just confirms the purchase you made — is exempt from most of the CAN-SPAM Act, including the opt-out requirement.8Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business Merchants often push that line by adding coupons, product recommendations, or marketing to the receipt email. If a reasonable person would see the message as primarily an advertisement, the full CAN-SPAM rules kick in, including an unsubscribe mechanism and honoring opt-outs within 10 business days.
How the Record Is Destroyed
When retention expires, merchants can’t just throw receipts in the trash.
For records that contain information derived from consumer reports — for example, credit check results tied to in-store financing — the FTC’s Disposal Rule requires reasonable steps to make the information unreadable. The regulation names burning, pulverizing, or shredding paper, and destroying or erasing electronic media, as compliant methods.9eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records
For ordinary transaction receipts containing cardholder data, PCI DSS imposes its own rule: the data has to be rendered unrecoverable before the media is discarded. In practice, businesses use cross-cut shredders for paper and professional data destruction services for drives and other storage media.
Most states layer on their own data disposal laws requiring shredding, erasing, or otherwise rendering personal information unreadable, and several states require a written disposal policy on file. A merchant operating across state lines usually meets this by treating every record containing cardholder or personal data as material that must be securely destroyed.
Getting a Copy of Your Own Receipt
You can request records tied to your transactions in certain situations. Under the Fair Credit Billing Act, if you dispute a billing error with your card issuer, you can request written proof of the purchase and copies of relevant documents from the creditor. That’s one reason merchants hold records well past the networks’ minimum retention windows: a billing dispute can surface months after the sale.
If you spot an unfamiliar charge, start with your card issuer, not the merchant. The issuer opens the formal dispute, which triggers the retrieval request on the merchant’s side. The merchant then has a limited window to produce the record, which only works if they’ve kept the documentation properly in the first place.