Monday, April 21, 2008
In December 2003, the U.S. House of Representatives passed the Fair and Accurate Credit Transactions Act (FACTA). Section 113 of the law states "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipts provided to the cardholder at the point of sale or transaction."
Receipts printed – and presented – with complete card numbers after Jan. 1, 2008, is a violation of this law.
"Victims of identity theft and credit fraud have suffered enough," said Congressman Dennis Moore, D-Kan., an original sponsor of FACTA. "This bill will increase consumer protections and bring an end to the credit nightmares experienced by so many Americans."
The irony of this statement is that the section of the law addressing card number truncation would cause no tangible harm, directly or indirectly, to the consumer; however, it does subject retailers to fines of $100 to $1,000 for each separate violation. But those violations must be deemed "willful" and this is where the law may appear ambiguous.
The consumers in this case will neither be affected adversely nor will they be a beneficiary in this class action," said Theodore F. Monroe, Internet commerce and payments attorney. "The main beneficiary will be the class action law firms that initiated the lawsuits."
According to Monroe, the law as written does not require a consumer to show damages if the merchants conduct is deemed "willful". "In essence it's a reckless standard being used, so it's pretty much impossible for any major merchant to show that it was not a willful violation," he said. "The law has been in existence for years and we had a ramp up period where every merchant should have known."
Some legal analysts and public interest groups are even calling FACTA legal extortion.
"I don't know if I'd call it legal extortion, but I believe that any company currently facing fines and penalties under FACTA has no one to blame but themselves," said David Mertz, Senior Partner, Compliance Security Partners LLC.
"The law was passed and companies were given until the first of January 2008 to make the appropriate changes and they haven't. It wasn't until lawsuits were filed and threats were made to levy huge fines and penalties that companies finally started doing what they were supposed to do under industry or legal requirements," Mertz stated.
FACTA was passed a year before Payment Card Industry (PCI) Data Security Standard compliance came into existence in December 2004. Moreover, PCI requirements do not require card truncation. Under PCI standards, if a business can justify a reason to print the full card number on the receipt, the full number would be allowable. Under FACTA, it is not, and it is under these federal provisions that massive fines could be levied against retailers.
Monroe expects the class action suits to be directed more toward the top "couple of hundred merchants in the country" and doesn't expect to see much litigation against the smaller merchants. He still thinks the courts eventually will rule on procedural grounds even for the larger retailers.
"These class actions are not the best mechanisms. On procedural grounds it's just not that strong and it's really the court looking at these cases and saying 'the fact that you printed an additional couple of digits, we're going to bankrupt a whole bunch of merchants.' It's just a crazy law," Monroe said.
Monroe also brought up the fact that, even if someone climbs into a trash bin and steals paper receipts with card numbers and expiration dates, that can only get you so far – not nearly as far as credit card thieves would like. "How useful is that number if doesn't have the CVV2 [Card Verification Value] or the remainder of the magnetic code?" he said. "There's really almost nothing you can do with that in the 21st century."
The biggest fallout may be on the acquiring side. Merchants who felt they were not taken care of when they were set up for processing may sue their credit card processors down the line. Mertz, however, sees most of these cases settling and not being dragged through the courts for years.
"E-Bay already settled, and I think the reason you're going to see other lawsuits settle is that retailers will have no choice," Mertz said. "Retailers will settle rather than pay a $1,000 fine for every untruncated receipt going back six or 12 or 24 months, which could literally put you out of business."
The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.
