FACTA shatters credit, debit card myths
Lawyers have filed more than 300 class action lawsuits throughout the United
States that could potentially cost merchants and acquirers hundreds of millions
of dollars. At the heart of this litigation are untruncated credit card
receipts.
In December 2003, the U.S.
House of Representatives passed the
Fair and
Accurate Credit Transactions Act (FACTA). Section 113 of the law states "no
person that accepts credit cards or debit cards for the transaction of business
shall print more than the last five digits of the card number or the expiration
date upon any receipts provided to the cardholder at the point of sale or
transaction."
Receipts printed - and presented - with complete card numbers after Jan. 1,
2008, are in violation of this law.
"Victims of identity theft and credit fraud have suffered enough," said
Congressman Dennis Moore, D-Kan., an original sponsor of FACTA. "This bill will
increase consumer protections and bring an end to the credit nightmares
experienced by so many Americans."
The irony of this statement is that the section of the law addressing card
number truncation would cause no tangible harm, directly or indirectly, to the
consumer; however, it does subject retailers to fines of $100 to $1,000 for each
separate violation.
But those violations must be deemed "willful" and this is where the law may
appear ambiguous.
Should merchants have known?
The consumers in this case will neither be affected adversely nor will they
be a beneficiary in this class action, said Theodore F. Monroe, Internet
commerce and payments attorney. "The main beneficiary will be the class action
law firms that initiated the lawsuits," he said. "In essence it's a reckless
standard being used, so it's pretty much impossible for any major merchant to
show that it was not a willful violation."
Some legal analysts and public interest groups are even calling FACTA legal
extortion.
"I don't know if I'd call it legal extortion, but I believe that any company
currently facing fines and penalties under FACTA has no one to blame but
themselves," said David Mertz, Senior Partner, Compliance Security Partners LLC.
"The law was passed, and companies were given until the first of January 2008 to
make the appropriate changes and they haven't," he added. "It wasn't until
lawsuits were filed and threats were made to levy huge fines and penalties that
companies finally started doing what they were supposed to do under industry or
legal requirements."
Which came first?
FACTA was passed a year before the
Payment Card
Industry (PCI) Data Security Standard (DSS) came into existence in December
2004.
Under the PCI DSS, if a business can justify a reason to print the full card
number on the receipt, the full number is allowable. Under FACTA, it is not.
Monroe expects the class action suits to be directed more toward the top "couple
of hundred merchants in the country" and doesn't expect to see much litigation
against the smaller merchants. He thinks the courts eventually will rule on
procedural grounds, even for the larger retailers.
"These class actions are not the best mechanisms. On procedural grounds it's
just not that strong and it's really the court looking at these cases and saying
'the fact that you printed an additional couple of digits, we're going to
bankrupt a whole bunch of merchants.' It's just a crazy law," Monroe said.
Source: GreenSheet, 4/28/08 |
