Retailers Facing New Legal Landscape For Credit Card Receipt Cases

Written by Evan Schuman
June 8th, 2007

Whether or not retailers can be legally punished for giving consumers receipts with full credit-card numbers has become much more uncertain, with a few recent critical?and conflicting?legal decisions.

A series of lawsuits against retailers for violating federal law by printing full credit card numbers on receipts is now facing unclear legal terrain, with two federal judges issuing contradictory rulings and the U.S. Supreme Court weighing in this week on a related case and giving some contradictory directions of its own.

In the initial lawsuits filed early this year, some 50 of the nation’s top retailers?including Rite Aid, Harry & David, Ikea, KB Toys, Disney, Regal Cinemas and AMC Theaters?were accused of printing full credit numbers and expiration dates on printed customer receipts, violating a provision of the Fair and Accurate Credit Transactions Act (FACTA) that makes it illegal for a retailer to print more than the last five digits or a credit/debit card number and it also forbids printing the card’s expiration data on that receipt. This is known as masking or truncation. The rule took effect in phases, but by December 2006, the latest of its phases kicked in.

More recently, at least two of those defendants have filed lawsuits against their POS vendors, saying that the POS firms should have protected the retailers when writing their POS software.

The first of the key federal judge rulings was last month, when U.S. District Judge Gary Allen Feess ruled against an attempt by Adidas to dismiss the case, describing some of the retail arguments “absurd” and “bizarre.”

In another case being heard in the courtroom of a different federal judge in California, the decision went the other way. That case involved retailer Cost Plus, which operates about 300 casual home furnishing stores in 34 states.

The judge for the Cost Plus case?U.S. District Court Judge John F. Walter?ruled in favor of the retailer. But Walter’s decision did not involve an attempt to dismiss the case, but was a request to allow the case to proceed as part of a class-action. A class-action status allows for many small?but identical or at least extremely similar?cases to be merged for the convenience of the court and of the litigants.

With the FACTA masking cases, the decisions on whether they can tried as class-action cases is crucial because the nature of the plaintiffs is such that it would almost certainly not be financially possible to proceed individually. In effect, then, a ruling preventing class-action status?if not overturned–is tantamount to a practical dismissal of the claims.

Each judge is only handling a portion of these FACTA masking cases. From a retailer’s perspective, it’s going to be essential whether other federal judges involved reach the same decision as Walter and whether those decisions survive appeals.

Walter’s decision found that the weight of the potential penalties?given the large number of receipts that each chain issues every day?was too extreme. “In this case, if a class is certified and plaintiff prevails, even the minimum statutory damages would be ruinous to defendant,” Walter wrote in his decision. “If plaintiff is able to prove that defendant committed a willful violation of FACTA, each class member would be eligible to receive between $100 and $1,000 in statutory damages. For a class of 3.4 million people, statutory damages alone would range from a minimum of $340 million and a maximum of $3.4 billion. Defendant’s entire net worth is approximately $316 million. Thus, an award of even the minimum statutory damages would put defendant out of business.”

Walter also wrote that the plaintiffs in this case did not claim to have sustained actual damages, which he found a good reason to deny the class certification request.

Lawyers representing plaintiffs in some of these cases found the judge’s ruling unusual, in the sense that it’s rare for a federal judge to rule against class certification because a defendant apparently broke federal law too often. It’s also unusual to rule a case involving federal law violations that no damages could be proven as a reason for dismissing class certification. Would frequent violations of OSHA safety regulations?with a company, for example, that blocked safety exits and left acids in the open?be dismissed because no employee had yet been injured?, one attorney asked.

This week, the U.S. Supreme Court issued an important?and unanimous?decision on FACTA enforcement, but the Supreme Court’s decision dealt with a portion of FACTA that is unrelated to the credit card receipt masking/truncation issue. But retail attorneys are still focusing on the decision because it touches on an important area that might impact the masking actions.

In the case of Safeco Insurance Co. of America Vs. Burr, the justices unanimously supported a decision by the U.S. Court of Appeals for the Ninth Circuit that had been seen as supporting the consumers trying to sue the retailers. But the detailed Supreme Court decision gave both sides something to cheer and cry about.

On the pro-consumer side, the court supported the ninth circuit and ruled that recklessness?as opposed to deliberate actual knowledge?is required to prove willfulness.

“Under the Court’s view of recklessness, a defendant should be found to be reckless if its interpretation of the statute was highly unreasonable and it should have known of the unreasonableness, even if it subjectively thought that what it was doing was completely proper,” wrote Scott Nelson, one of the attorneys involved in the Supreme Court case. “Thus, plaintiffs seeking to prove recklessness will not have to find smoking guns showing that defendants were actually aware of the risk that they were violating the law.”

But the decision also detailed requirements for a finding of reckless that might make it easier for retailers to defend themselves in these cases. If a retailer is arguing that they purchased professional POS software and had legitimate reasons to expect that to handle the new federal requirements, some of the Supreme Court’s wording might come to their aid.

Additional decisions in the new few weeks will be a strong indicator of whether these cases will continue.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.