A new federal “identity theft” law prohibits merchants from printing more than the last five digits of a credit or debit card number on a customer’s receipt. The law is triggering a lot of class-action lawsuits against companies that haven’t updated their receipt systems. For instance, many companies still print credit card expiration dates on receipts, which is prohibited by the law and can easily lead to a lawsuit.

These suits are dangerous – the law provides damages of between $100 and $1,000 per willful violation. Multiply $100 or $1,000 by the number of receipts that most merchants provide, and you can quickly have a very large number.

(It’s not entirely clear what makes a violation “willful,” but a company is expected to know about the law and follow it.)

While the law clearly covers receipts provided at the point of sale, some courts have ruled that it also applies to receipts that are mailed to customers who place phone orders, and even to acknowledgement e-mails sent to customers.

More than 300 lawsuits have been filed so far, against companies ranging from mom-and-pop stores to national chains such as Ikea, 1-800-Flowers and Victoria’s Secret.

A bill now in Congress, H.R. 4008, would eliminate class-action lawsuits against companies that print a card’s expiration date on a receipt. But that bill is still in committee, and it’s not at all certain that it will pass.

Some online merchants make customers waive their right to file a class-action lawsuit as part of the “terms of use” to which they must agree in order to use the website. It’s not clear if such a provision would prevent a suit over a credit card receipt, but it couldn’t hurt.