What is really on your receipt

A receipt is no longer just a shopping list: TSE data, verification values, signature counters, barcodes, card data, and Germany's receipt rules point to a larger system of retail, tax control, cryptography, and privacy.

A receipt looks harmless: a narrow strip of paper, a few items, a total, maybe a note that the card payment went through. In Germany, a modern receipt is a dense document. It is proof of purchase, a tax-control anchor, a cryptographically protected record, a payment slip, and sometimes a machine-readable key into the retailer's backend.

Since Germany's receipt issuance rules took effect for electronic recording systems, a business transaction must be documented immediately. The receipt can be provided on paper or electronically. The core idea is not paper. The core idea is traceability.

Note: This article explains technical and legal basics in general terms. It is not tax or legal advice.

I did not fall into this topic out of legal curiosity. I fell into it while building Bonblick. The starting point sounded simple: take a photo, recognize products, store shopping data in a useful way. The more real receipts I looked at, the clearer it became: this is not just OCR on paper.

A receipt is the visible surface of a system made of cash registers, item masters, discounts, tax logic, printing technology, payment data, and privacy. If Bonblick is supposed to understand receipts reliably, I first have to understand how that system works.

A quick detour around the world

Germany is not alone in taking receipts seriously. Other countries have built their own rituals around them.

In Italy, the receipt is called a scontrino. That word became part of a travel anecdote: after an espresso, so the story goes, you had to keep the receipt outside the café in case someone checked it. That should not be repeated today as a simple blanket rule; the better point is that the scontrino is deeply embedded as a visible tax document. Italy's Guardia di Finanza explains when a scontrino fiscale has to be issued, and Italy now even has a lotteria degli scontrini, where receipt data turns into a lottery mechanism.

Taiwan pushes the receipt even closer to a lottery ticket. The Ministry of Finance regularly publishes winning numbers for the Uniform-Invoice lottery. In Portugal, cashiers often ask for the NIF, the tax number, so invoices can appear in the e-Fatura system and be assigned for tax purposes. And in the Brazilian state of São Paulo, the Nota Fiscal Paulista program uses CPF or CNPJ on invoices to trigger credits and prize-draw participation.

The pattern is similar everywhere, but the culture around it differs: a receipt is not just paper. It can be an audit trail, tax incentive, warranty note, lottery ticket, or digital reporting object.

1. The visible surface

The top part of a receipt is the part everyone knows. It usually contains the retailer, branch, date, time, items, quantities, prices, discounts, tax amounts, total, and payment method.

Area	Example
Retailer	Name, branch, address
Time	Date and time of purchase
Items	Quantity, product name, unit price
Discounts	Coupons, promotions, price reductions
Total	Net amount, VAT, gross amount
Payment method	Cash, card, voucher, app payment

These details are not just customer service. Germany's Cash Security Ordinance lists minimum receipt information, including the business name and address, date, start and end of the transaction, quantity and type of goods, amount, tax, tax rate, transaction number, and TSE-related data.

Why this is harder for Bonblick than it looks

For humans, a quick glance is often enough: retailer, total, maybe the most important products. For an app, the same receipt is much more ambiguous. Product lines are abbreviated, product groups are not always visible, discounts change the logic, deposits and cancellations look different from retailer to retailer, and internal barcodes are not automatically product data.

Then there is the photo itself. Thermal paper bends, reflects light, fades, and is often photographed at an angle. OCR can recognize characters, but that is not the same as understanding a purchase. ORG BAN 1.234KG, a discount block, and a tax line still have to become a meaningful transaction again.

That is where Bonblick becomes interesting: the task is not to copy text from an image. The task is to translate an everyday slip into context.

2. Receipt obligation means issue, not take

A common misunderstanding: the receipt obligation does not mean customers have to take the receipt with them. It means the receipt must be issued or made available immediately. It may also be provided electronically if the requirements are met.

The goal is tax control. A recorded transaction should leave a verifiable trace in the cash register. Tax authorities can check during a cash-register inspection or audit whether transactions were individually recorded and retained.

3. TSE: the technical security system

The most technical term on many German receipts is TSE, short for "technical security system" in German.

Under § 146a of the German Fiscal Code, electronic recording systems and their digital records must be protected by a certified technical security system. In the basic model, a TSE has three components:

TSE component	Role
Security module	protects transactions against undetected later changes
Storage medium	keeps protected records available
Uniform digital interface	enables integration, export, and inspection

The distinction matters: the technical security system is certified. The cash register or POS software as a whole is not automatically the certified product.

4. What the TSE leaves on the receipt

Many receipts contain a dedicated TSE block. Typical fields include:

Field	Meaning
TSE transaction number	unique, sequential number for the transaction
Cash-register serial number	identifier of the electronic recording system
TSE serial number	identifier of the technical security system
Verification value	cryptographic proof tied to the transaction
Signature counter	sequential counter for signature operations
Start and end time	timestamps of the TSE transaction

The BSI technical guideline TR-03153 describes how the security module sets, among other things, the transaction number, timestamps, verification value, and signature counter in a tamper-resistant way.

5. The verification value is not a hidden shopping list

The verification value is the most interesting cryptographic part of the receipt. It is not a readable secret message. You cannot simply extract items, prices, full card data, or customer data from it.

Simplified, several parts flow together:

cash-register transaction
transaction number
timestamps
process data
signature counter
TSE key material

The result is the verification value.

The verification value is closer to a manipulation-sensitive fingerprint than to a hidden data store. If a relevant part of the transaction changes, the verification no longer matches.

Wrong assumption	Actual function
The verification value contains my items in plain text.	No, it is not a readable data store.
My card data can be reconstructed from it.	No, a digital signature does not reveal the card.
It helps detect manipulation.	Yes, that is the point.
A changed amount would still be valid.	No, the check would fail.

6. The signature counter

The signature counter looks small, but it matters. It counts TSE signature operations sequentially. It is not the same as the transaction number. One transaction can trigger several TSE operations, such as start, update, and finish.

Why does that matter? Because gaps or implausible counter values can stand out. The receipt is one small section of a larger technical control chain.

7. QR code or plain text

TSE data can be printed in plain text or represented in a machine-readable form. That is why some receipts are very long while others carry a compact QR code.

Variant	Effect
TSE data printed out	longer, visible to humans
TSE data in a QR code	shorter, machine-readable

A QR code on a receipt can be tax-relevant if it contains the intended TSE data. In that case it is not merely marketing or customer service; it is part of the inspection architecture.

8. A retailer barcode is not automatically a TSE code

Many receipts also include a retailer's 1D barcode or QR code. Such a code may contain an internal receipt or return reference without containing the TSE signature or the full purchase.

Code type	Typical role
Retailer barcode	internal receipt, return, or service reference
TSE QR code	tax inspection and signature data
Payment code	payment or terminal reference
Marketing code	app, coupon, loyalty, campaign

The difference matters: not every machine-readable code on a receipt is a TSE code.

9. Card payment: what appears at the bottom

Card payments often add a payment block. It may show the payment method, amount, terminal ID, receipt number, authorization reference, a masked card number, and EMV data.

The full card number is not printed in clear text on ordinary customer receipts. Under PCI DSS principles, the Primary Account Number must be masked when displayed; at most the BIN and last four digits may be visible unless there is a legitimate business need for more. Point-of-sale receipts may also be subject to stricter rules.

Again, technical payment data is not the same as a full card. A normal customer receipt generally does not allow an outsider to initiate a payment or reconstruct the full card number.

10. Privacy: a receipt is rarely anonymous

A single receipt usually does not contain a name or full card number. Still, it is not meaningless.

Data type	Privacy relevance
Branch, date, time	can reveal place and time
Shopping list	can suggest habits, preferences, health, or daily routines
Payment references	can become linkable in context
Masked card	usually limited alone, but identifying in context
TSE and receipt numbers	unique technical identifiers

If a receipt is shown publicly, it is better to redact card data, receipt numbers, transaction numbers, TSE serial numbers, verification values, barcode or QR code, exact time, and branch details where privacy matters.

11. DSFinV-K: the receipt is only the surface

The paper receipt is the visible end of a larger data model. In the background, cash-register systems must be able to provide data for audits in a standardized form. In Germany, that structure is the DSFinV-K, the digital interface used by tax authorities for cash-register systems.

That means the receipt is not the only record. It is a visible control anchor. The actual audit can involve register data, TSE data, export files, and plausibility checks.

12. Cash-register inspection

Tax authorities can inspect the proper use of electronic recording systems. In practice, that can look like this:

An inspector buys something anonymously.
They receive or observe the receipt.
Later, the transaction is matched against register data.
TSE transaction, signature, time, amount, and export data need to fit together.

The receipt obligation makes these checks more efficient because the visible receipt must match the digital records.

13. Reporting obligations since 2025

Since 2025, electronic reporting of cash-register systems has become practically relevant. The German Federal Ministry of Finance made the reporting procedure under § 146a paragraph 4 AO available from January 1, 2025. Electronic recording systems acquired before July 1, 2025 had to be reported by July 31, 2025; systems acquired from July 1, 2025 onward must be reported within one month.

Consumers barely see this. For businesses, it belongs to the same architecture: register, TSE, receipts, digital interface, and tax authority need to line up.

14. Paper, environment, and thermal receipts

Receipts are often thermal paper. The German Environment Agency recommends, as a precaution, not putting thermal paper into waste paper because critical color developers can enter the recycling stream. Thermal paper carrying the Blue Angel label can be an exception.

BPA in thermal paper has been strongly restricted in the EU since early 2020. That does not automatically remove the issue, because replacements such as Bisphenol S are also viewed critically.

The environmental path is therefore not only no receipt, but better handling of receipts:

less paper
more digital receipts
QR instead of long TSE plain-text blocks
recyclable thermal papers
proper disposal

15. What a receipt can teach you

A modern receipt answers a surprising number of questions:

Question	Answer on the receipt
Where was the purchase made?	Retailer, branch, address
When was it made?	Date, time, TSE timestamp
What was bought?	Items, quantities, prices
How was it paid?	Cash, card, payment reference
Which tax was applied?	Tax rate, net amount, tax amount, gross amount
Which register was involved?	Register number, serial number
Which TSE signed it?	TSE serial number
Is the transaction inspectable?	Transaction number, verification value, signature counter
Can the retailer find it again?	Barcode, receipt number, terminal ID

The receipt is a miniature database excerpt. It just happens to be printed on paper.

Conclusion

The modern receipt is not just an annoying paper strip. It is a dense control and evidence document. The purchase is at the top. The tax logic is in the middle. Payment data is at the bottom. And somewhere in between sits cryptography.

The verification value is the technical core: not a readable secret message, but cryptographic proof. The signature counter makes gaps visible. The transaction number assigns the transaction. A retailer barcode, by contrast, is often only an internal reference.

While building Bonblick, that is the real lesson for me: everyday objects are often deeper than they look. A crumpled receipt seems banal, but behind it are systems that connect retail, tax inspection, payments, product data, and software. Before you can build a good product from that, you have to take those layers seriously.

Once you understand a receipt, you no longer see just a purchase. You see a system made of retail, tax law, cryptography, payments, and privacy.