When you pay by credit card and a merchant asks you for your ZIP code, phone number, driver's license or Social Security number, do you have to show it to complete the sale?
In most cases, the answer is no. In some instances, asking for personal information may violate store policy, credit card merchant agreements and even state law.
Consumer advocates advise just saying no when asked to give information beyond what is necessary for a transaction — an address for shipping purposes or a Social Security number if you're opening a line of credit, for instance.
"At best, you are exposing yourself to unwanted junk mail or solicitations," says Joe Ridout with Consumer Action in San Francisco. "At worst, say, you are giving your Social Security number, you could be placing yourself at higher risk for identity theft."
Being asked for a Social Security number is a red flag issue for most consumers. There are only four times when you should give it out, Ridout says: if you are asking for an extension of credit; if you are dealing with a government agency; if you are applying for a job; or if it is required for tax purposes.
Requests for other kinds of identifying information have recently come under fire as well.
A February ruling in California made it illegal for merchants to ask for your ZIP code when making a purchase with a credit card.
A customer sued Williams-Sonoma in 2008 for invasion of privacy and violation of California's Song-Beverly Credit Card Act, after she was asked for her ZIP code, gave it and then received marketing materials. She said that with her name, credit card number and ZIP code, the store was able to find out her home address and then use that to send marketing materials to her and sell her information to other businesses.
The California Supreme Court ruled that a ZIP code is "personally identifiable information." Therefore, merchants are barred from asking for it during a credit card transaction and could face a fine of $1,000 per violation if they do. A flurry of class-action lawsuits against major retailers in California followed and other states may look at this issue as well, consumer advocates say.
Rules on what merchants may ask and whether they can record the information in any way are made on a state-by-state basis and are not governed by federal law. Stores have policies and major credit card companies have policies as well. But that doesn't mean clerks always know the rules or follow them.
Visa and MasterCard state in their merchant rules that if the back of the card is signed, a merchant may not make giving personal information a condition of making the sale. If the card is not signed, they may ask for identifying information. American Express requires merchants to check only the signature on the back of the card and does not require any additional identification. Discover does not prohibit a merchant from asking for such information, a spokeswoman said. However, if your purchase is flagged for suspicion of fraud at the register, or merchants have reason to suspect you are not the authorized card holder, they may ask for ID.
Another exception is paying for gas at the pump. You will be asked to enter a ZIP code for security reasons because there is no person to check even whether a card is signed. And gas stations do not retain the ZIP code information once the transaction is finished.
If a merchant does ask for your information and you don't want to give it, you have several options. MasterCard has a specific form you can fill out to report violations. Visa asks customers to notify the financial institution that issued your card or report the matter to Global Customer Care Services.
You can also ask to speak with a store manager, since the clerk may misunderstand store rules, or you can bargain to give up another piece of information that will satisfy their requirements, consumer advocates say.
Paul Stephens, director for policy and advocacy for Privacy Rights Clearinghouse, says there's no upside to giving out information not essential to the transaction, even if you think doing so is necessary to combat fraud. It's important for consumers to realize that you're generally not liable for fraudulent charges on the card, he says. Your maximum liability under federal law for unauthorized use of your credit card is $50 and as long as you report it quickly, your liability is zero.
"We don't feel it benefits the consumer," Stephens says.
Joe LaRocca disagrees. He's the senior adviser for asset protection for the National Retail Federation, a trade group representing retailers.
Asking for information such as e-mail addresses, home addresses and phone numbers helps stores communicate bargains and rewards to their consumers and lets them know more about what consumers want. Asking for ID on returns is also essential in combating chronic abuse of a store's return policy when customers may wear a dress one night and return it the next or write a term paper on a computer and return it, he says.
"The benefit for the consumer? The stores are able to reduce fraudulent returns, which saves costs and, in turn, saves costs from being passed to the consumer," LaRocca says. "In 2010, retailers estimated that return fraud would be $14 billion for the year."
Still, giving out personal information should be a well-thought-out choice, says Ridout.
"Merchants view your information as very valuable to the store because they can either bombard you with junk mail or sell your information to other advertisers. Sometimes, merchants will actually ask for your Social Security number to set up a cable account or electricity account, and a lot of people do it. You don't have to comply with the request. There are other ways they can prove that you are yourself."
Ridout said he recently had personal experience with an inappropriate request for information. In March, he opened a new account with a cable company salesperson who insisted that he needed his Social Security number.
Because Ridout wasn't asking for extension of credit, he asked why the company needed it and was told it was "just their policy."
"I replied that it was my policy to never give out my Social Security number for illegitimate purposes." He added that it was a deal breaker.
The company said he could use his driver's license number instead.
"I didn't feel particularly good about that either, but it's better than giving up your Social Security number," he says.
In the end, any merchant may ask for information and, short of violating state law or their credit card merchant agreement, there may be no recourse for consumers if they don't want to disclose it. If you've asked to speak to a manager and a store won't budge on its request, your only option may be to walk away.