Credit Chaos
Plaintiffs' bar attacks merchants for violations of the Fair and Accurate Credit Transactions Act.
May 31, 2007 at 08:00 PM
19 minute read
When Congress passed a sweeping law in December 2003 to crack down on identity thieves, it had no intention of setting up restaurant owners and retailers for potentially devastating class action litigation. But plaintiffs' attorneys have seized on an ambiguous clause in the Fair and Accurate Credit Transactions Act (FACTA), filing more than 150 class action lawsuits alleging violations of the law.
The cookie-cutter suits allege the merchants failed to comply with a FACTA provision designed to prevent theft of credit and debit card numbers from electronically generated receipts. The problem is that Congress wasn't clear on how that should be accomplished. Almost all the defendants truncated cardholders' numbers as the law requires. But the defendants failed to also remove customers' card expiration dates, which the suits argue was required under FACTA. Defendants include national chains Costco, California Pizza Kitchen, TGI Friday's, FedEx Kinko's, IKEA, Wendy's, T.J. Maxx and Radisson Hotels.
On their face, the suits seem silly. After all, what can thieves do with a few digits of a card number? But the defendants aren't laughing. FACTA does not require plaintiffs to prove actual damages if the defendants are found to be in “willful non-compliance,” and it allows them to claim up to $1,000 of statutory damages for each receipt that violates the act.
“We are easily talking tens of billions of dollars if the plaintiffs succeed in getting these cases certified as class actions,” says Barry Parsons, counsel at Crowell & Moring, who is defending a FACTA suit. “Many companies could be wiped out.”
Ambiguous Clause
FACTA, which amended the Fair Credit Reporting Act (FCRA), is best known for allowing every American to obtain a free annual credit report. Among its 26 provisions is one prohibiting businesses that accept credit or debit cards from including “more than the last five digits of the card number or the expiration date” on electronically generated receipts. That provision became effective Dec. 4, 2006. The next day, plaintiffs' attorneys filed the first class action.
The fact that plaintiffs accuse several major retail and restaurant chains of violating an act they had three years to prepare for raises the question of how a federal law could be so widely ignored.
“There is no easy answer as to why,” says Kenneth Kan, associate at Berman, Berman & Berman, which represents a defendant. “One of the most logical explanations is that the word did not filter down to those who needed to know.”
In fact, media coverage of FACTA centered on the free credit reports, ignoring the section on receipts. The FTC, charged with protecting consumers from identity theft, did not publicize the receipt provision. Equipment and technology vendors also apparently failed to spread the word, or perhaps notified people who weren't around when the law finally took effect.
“A lot of these changes would be implemented by an IT department, and you can't expect continuity of employment or communication of a change like that over a three-year period,” says Daveed Schwartz, partner in Pillsbury Winthrop Shaw Pittman.
Word Play
Attorneys defending the FACTA cases also argue that the law's wording is ambiguous. The plaintiffs contend that merchants needed to remove all but the last five digits of card numbers and the expiration date. But defense attorneys say their clients interpreted the law to mean they could either truncate the number or remove the expiration date.
It appears that even the FTC's staff may not have realized that the law required both. The only FTC news release on the subject summarizes June 2004 Congressional testimony on FACTA by J. Howard Beales III, director of the Bureau of Consumer Protection. “FACTA seeks to reduce ?? 1/2 fraud by requiring merchants to truncate the full number on electronic receipts,” Beales testified. He never mentioned expiration dates.
Because some state laws and credit card issuers required truncation of account numbers prior to FACTA's enactment, some merchants thought they already were in compliance.
“They were not turning a blind eye to concerns about identity theft,” Parsons says. “The industry had come up with a standard for truncation of credit card numbers and virtually all of them were in compliance. But they were continuing to print expiration dates.”
Defense attorneys say their clients had no motivation to violate the law.
“It's difficult to imagine any retailer deliberately including information that would put their customers at risk for identity theft,” Schwartz says.
Two-Step Process
Early defense motions to dismiss were unsuccessful. For those cases that go to trial, litigation will be a two-step process, according to John Gibson, partner in Paul, Hastings, Janofsky & Walker.
“The first step is determining whether the defendant violated the statute,” Gibson says. “It's possible the courts will say they had a choice to truncate the numbers or eliminate expiration dates. Only if the court says it is a violation not to do both will it go to the second step–was the violation willful or not?”
That second step is crucial because FACTA authorizes damages of $100 to $1,000 for each receipt found to be a “willful” violation, even when there is no proof of actual injury. On the other hand, a “negligent” violation requires proof that the consumer suffered actual damages before the defendant becomes liable.
Definitions of “willful” differ among the federal circuits. The 9th and 3rd Circuits have held that consumers do not need to prove that the companies intentionally broke the law to qualify for willful damage awards. Instead, consumers need to prove only that the companies ignored the law's requirements.
Because the 9th and 3rd Circuits have expansive “willful non-compliance” definitions, plaintiff's attorneys have filed most of the FACTA suits in California, Nevada and Pennsylvania.
Attorneys are anxiously awaiting a Supreme Court decision on the 9th Circuit's “willful violation” standard that could significantly impact the course of the FACTA litigation. Should the High Court strike down the 9th Circuit's standard, plaintiffs would have trouble winning damages.
“They would only have left cases for actual damages where the plaintiff's identity was stolen,” Gibson says. “Those cases would be few and far between.”
Meanwhile, attorneys warn business owners still printing receipts with full card numbers or expiration dates to re-program their registers rather than waiting for the courts to clarify the law.
When Congress passed a sweeping law in December 2003 to crack down on identity thieves, it had no intention of setting up restaurant owners and retailers for potentially devastating class action litigation. But plaintiffs' attorneys have seized on an ambiguous clause in the Fair and Accurate Credit Transactions Act (FACTA), filing more than 150 class action lawsuits alleging violations of the law.
The cookie-cutter suits allege the merchants failed to comply with a FACTA provision designed to prevent theft of credit and debit card numbers from electronically generated receipts. The problem is that Congress wasn't clear on how that should be accomplished. Almost all the defendants truncated cardholders' numbers as the law requires. But the defendants failed to also remove customers' card expiration dates, which the suits argue was required under FACTA. Defendants include national chains Costco, California Pizza Kitchen, TGI Friday's, FedEx Kinko's, IKEA, Wendy's, T.J. Maxx and Radisson Hotels.
On their face, the suits seem silly. After all, what can thieves do with a few digits of a card number? But the defendants aren't laughing. FACTA does not require plaintiffs to prove actual damages if the defendants are found to be in “willful non-compliance,” and it allows them to claim up to $1,000 of statutory damages for each receipt that violates the act.
“We are easily talking tens of billions of dollars if the plaintiffs succeed in getting these cases certified as class actions,” says Barry Parsons, counsel at
Ambiguous Clause
FACTA, which amended the Fair Credit Reporting Act (FCRA), is best known for allowing every American to obtain a free annual credit report. Among its 26 provisions is one prohibiting businesses that accept credit or debit cards from including “more than the last five digits of the card number or the expiration date” on electronically generated receipts. That provision became effective Dec. 4, 2006. The next day, plaintiffs' attorneys filed the first class action.
The fact that plaintiffs accuse several major retail and restaurant chains of violating an act they had three years to prepare for raises the question of how a federal law could be so widely ignored.
“There is no easy answer as to why,” says Kenneth Kan, associate at
In fact, media coverage of FACTA centered on the free credit reports, ignoring the section on receipts. The FTC, charged with protecting consumers from identity theft, did not publicize the receipt provision. Equipment and technology vendors also apparently failed to spread the word, or perhaps notified people who weren't around when the law finally took effect.
“A lot of these changes would be implemented by an IT department, and you can't expect continuity of employment or communication of a change like that over a three-year period,” says Daveed Schwartz, partner in
Word Play
Attorneys defending the FACTA cases also argue that the law's wording is ambiguous. The plaintiffs contend that merchants needed to remove all but the last five digits of card numbers and the expiration date. But defense attorneys say their clients interpreted the law to mean they could either truncate the number or remove the expiration date.
It appears that even the FTC's staff may not have realized that the law required both. The only FTC news release on the subject summarizes June 2004 Congressional testimony on FACTA by J. Howard Beales III, director of the Bureau of Consumer Protection. “FACTA seeks to reduce ?? 1/2 fraud by requiring merchants to truncate the full number on electronic receipts,” Beales testified. He never mentioned expiration dates.
Because some state laws and credit card issuers required truncation of account numbers prior to FACTA's enactment, some merchants thought they already were in compliance.
“They were not turning a blind eye to concerns about identity theft,” Parsons says. “The industry had come up with a standard for truncation of credit card numbers and virtually all of them were in compliance. But they were continuing to print expiration dates.”
Defense attorneys say their clients had no motivation to violate the law.
“It's difficult to imagine any retailer deliberately including information that would put their customers at risk for identity theft,” Schwartz says.
Two-Step Process
Early defense motions to dismiss were unsuccessful. For those cases that go to trial, litigation will be a two-step process, according to John Gibson, partner in
“The first step is determining whether the defendant violated the statute,” Gibson says. “It's possible the courts will say they had a choice to truncate the numbers or eliminate expiration dates. Only if the court says it is a violation not to do both will it go to the second step–was the violation willful or not?”
That second step is crucial because FACTA authorizes damages of $100 to $1,000 for each receipt found to be a “willful” violation, even when there is no proof of actual injury. On the other hand, a “negligent” violation requires proof that the consumer suffered actual damages before the defendant becomes liable.
Definitions of “willful” differ among the federal circuits. The 9th and 3rd Circuits have held that consumers do not need to prove that the companies intentionally broke the law to qualify for willful damage awards. Instead, consumers need to prove only that the companies ignored the law's requirements.
Because the 9th and 3rd Circuits have expansive “willful non-compliance” definitions, plaintiff's attorneys have filed most of the FACTA suits in California, Nevada and Pennsylvania.
Attorneys are anxiously awaiting a Supreme Court decision on the 9th Circuit's “willful violation” standard that could significantly impact the course of the FACTA litigation. Should the High Court strike down the 9th Circuit's standard, plaintiffs would have trouble winning damages.
“They would only have left cases for actual damages where the plaintiff's identity was stolen,” Gibson says. “Those cases would be few and far between.”
Meanwhile, attorneys warn business owners still printing receipts with full card numbers or expiration dates to re-program their registers rather than waiting for the courts to clarify the law.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllCoinbase Hit With Antitrust Suit That Seeks to Change How Crypto Exchanges Operate
3 minute readBaker Botts' Biopharma Client Sues Former In-House Attorney, Others Alleging Extortion Scheme
Trending Stories
- 1Call for Nominations: Elite Trial Lawyers 2025
- 2Senate Judiciary Dems Release Report on Supreme Court Ethics
- 3Senate Confirms Last 2 of Biden's California Judicial Nominees
- 4Morrison & Foerster Doles Out Year-End and Special Bonuses, Raises Base Compensation for Associates
- 5Tom Girardi to Surrender to Federal Authorities on Jan. 7
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250