Evan Schuman's StorefrontBacktalk

In a situation that’s a testament to the philosophy of “when you’re in a hole, just keep digging,” one of the biggest payment-card processors has now lost legal control of the phone lines that connect it to 500,000 point-of-sale terminals.

Last Tuesday (Nov. 9), as part of an ongoing legal fight, a federal judge ordered payments processing giant TSYS Acquiring Solutions to turn over control of seven phone lines used by TSYS POS terminals to merchant service provider EPS—even though many of the merchants’ POS terminals connected to those lines don’t have anything to do with EPS.

In theory, that puts merchants using tens of thousands of TSYS POS terminals at risk—their payment-card data could be hijacked! Or leaked! Or lost! In practice, that’s not going to happen. For now TSYS still controls those phone lines while it mulls an appeal of the judge’s order. But the case is a reminder that all third-party services depend on how well someone else is running another company. When a card processor gets sloppy and just a bit too arrogant with one customer, that can have effects that ripple out to many other retailers.

The root of the problem dates back to 2005, when EPS was a customer of CardSystems Solutions, which had just been hit by a breach involving 40 million payment card numbers. EPS moved its business to TSYS, which promised that EPS merchants would all be connected to TSYS by a single toll-free number, so if EPS wanted to change processors again that would be easier.

Then things turned sour. EPS complained about TSYS billing and penalty practices. The disagreement went to arbitration in 2007. In 2009, the arbitrator—a retired Arizona Supreme Court justice—ruled that TSYS owed EPS $2.6 million, and would have to give up another $1 million in penalties against EPS. The arbitrator also ruled that TSYS had to turn over to EPS control of that single toll-free line connecting the POS terminals to TSYS.

TSYS filed suit in federal court to overturn the arbitrator’s ruling. The judge agreed with the arbitrator. Then TSYS filed another suit to overturn the judge’s ruling as it specifically related to the toll-free number. It turns out that TSYS never did provide a single toll-free number for all EPS’s merchant customers. Instead, EPS customers are distributed among seven different toll-free numbers that are also shared with many other merchants. Oopsie!