Evan Schuman's StorefrontBacktalk

But ControlScan does get mucho chutzpa points for prominently listing on its Web site 42 retailers that had displayed the seals when they hadn’t paid for them, as opposed to retailers that displayed the seals when they didn’t deserve them. As long as they paid, everything was fine. (Speaking of fine, ControlScan and its founder owe the government $750,000 as part of the settlement.)

“ControlScan customers using the Verified Secure trust seal have earned the right to display these seals on their Web sites by following the necessary requirements set forth by ControlScan. These requirements have been put in place to help merchants provide a safer shopping experience to their online customers,” the site said. “Unfortunately, there are businesses in the marketplace that attempt to mislead potential customers by misusing copies of ControlScan’s Verified Secure seal. Most often, these businesses display counterfeit copies of ControlScan’s seals on their Web sites without authorization.” For good measure, the site offered people a link to rat out other sites that hadn’t paid.

Since the earliest days of the Web, the idea behind E-Commerce sites posting security seals was to provide third-party assurances to consumers that privacy and data—and especially payment—security procedures were being followed. For those seals, retailers spent anywhere from about $130 to $1,300 a year, to cover the cost of a third-party verifying that information, in some cases daily.

But the zero-liability program from major card brands has made consumers impressively cavalier about the sites they give their credit card information to; they’re confident that they will be covered for any losses. Placing trust in Bob’s House Of Stuffed Animals becomes irrelevant as long as consumers trust Visa, MasterCard or their bank. The lack of any significant customer defections from TJX and Hannaford—or, for that matter, the dozens of other retailers impacted in various major breaches in the last couple of years—makes that consumers’ apathy clear.

Then again, as the percent of transactions being handled as debit increases and takes market share away from credit, a site’s reputation may slowly start to become much more important to consumers, making these types of seal programs potentially relevant.

And the FTC’s lack of enforcement teeth makes such settlements more annoying than devastating. ControlScan will have to send a letter to customers asking them to take down the bogus seals. But it’s unclear whether the FTC will be able to verify that ControlScan actually sends the letter to all of the affected customers. Even the $750,000 fine was suspended because ControlScan said it didn’t have the money to pay. (Just try using that line on a federal judge, in either a criminal or a civil case.)

The FTC order, for example, instructs ControlScan to not misrepresent any more. I covered courts for years, and I can’t quite envision a burglar admitting to various felonies and being told by the judge, “No jail time for you because I don’t have that authority. And no fine because you’re broke, which is probably why you were breaking into houses in the first place. So I am now ordering you to not break into any more houses. But you have to write a letter to the owners of the houses you broke into. It had better be handwritten. Defendant is released. Next case.”