6

After my holiday to Latvia, I was doing my administration and I noticed that almost all receipts had cryptographic hashes on the bottom. One receipt defined them as SHA1. Adding hashes to receipts is something that I'm not familiar with. Some googeling around learns me that this is normal with cryptocurrencies, but these payments were all by card (whether by Apple Pay or by inserting the card into the terminal).

Two example receipts:

Example receipt

Example receipt 2 (Redacted the last piece of the hash because I don't know what value is stored in it...)


My question is: What is the meaning of these hashes, and what is stored in it?

I wonder why this is done, since I, as a customer, am probably not able to recalculate this exact hash from the layout of the receipt. Is this a checksum that the bank can use to verify the receipt?


Notes:

  • Yes, I know SHA1 isn't secure, and imo shouldn't be used anywhere anymore because of the fact that a collision can be created these days; and that there are better alternatives. This makes me wonder even more what it's purpose is.
  • I chose to post my question here because this isn't a technical question as to how a SHA1 hash as a (presumably) checksum works. I know how to calculate a hash. The question relates to why these values are added to receipts, and what their purpose and content is. I won't find an answer to this on SO.
  • This isn't normal in my country, The Netherlands. I have never seen this, and going back in my administration shows no signs of hashes on my (Dutch) receipts.
  • 4
    I'm voting to close this question as off-topic because I don't see how this is a travel question. – Chris H Aug 26 '19 at 14:01
  • @Chris H Well, where else would you expect this type of question? I would argue that this is a travel question, since I suspect this has to do with foreign regulations (hence the tag). – MagicLegend Aug 26 '19 at 14:12
  • 4
    I don't know of an SE website where I would consider this to be on topic (I'd have suggested it if I did know one). But "it's off-topic everywhere else" doesn't make it on-topic here, and in my opinion (while I agree that it's quite interesting) this question isn't on-topic here. If others disagree with me I'll be outvoted in the review and the question will remain open. – Chris H Aug 26 '19 at 14:16
  • 1
    @MagicLegend I'd suggest asking this on one of the computing StackExchange sites. While this question includes travel (ie a receipt from a foreign country), the question itself is about the hash, which would be much more easily answered elsewhere – Matthew Barclay Aug 26 '19 at 14:52
  • 1
    They're just saying that their POS/POI terminals are not PCI-compliant. SHA hashes are used to digitally sign POS transactions, but the use of SHA-1 should have stopped in 2017 I believe. May be ask on Information Security – mustaccio Aug 26 '19 at 15:48

Browse other questions tagged or ask your own question.