GS Logo
The Green Sheet, Inc

Please Log in

A Thing
View Archives

View PDF of this issue

Care to Share?


Table of Contents

Lead Story

PCI: Is it working?

News

Industry Update

FACTA shatters credit, debit card myths

Frontier takes nose dive

Diners Club on Discover's menu

Wish for dying kids takes flight

Features

Interchange fees and ATM usage

Travis K. Kircher
ATMmarketplace.com

ISOMetrics:
PCI Timeline

Industry Leader

Anna Solomon –
Parent, president, payments advocate

Views

Going green ain't always cheap

Patti Murphy
The Takoma Group

IP yea, dial-up nay

Scott Henry
VeriFone

Smack those hackers down

Ben Goretsky
USA ePay

Education

Street SmartsSM:
Go from middlin' to marvelous

Jason Felts
Advanced Merchant Services

Factors of FACTA compliance

David Mertz
Compliance Security Partners LLC

POS hardware: Lemon or dream machine?

Dale S. Laszig
DSL Direct LLC

Marketing in compliance

Nancy Drexler
SignaPay

Strategizing for ISO growth

Lane Gordon
MerchantPortfolios.com

Company Profile

U.S. Merchant Systems

New Products

Cut out the transaction fat

Slim CD
Company: Slim CD Inc.

Customer stickiness with a single swipe

SingleSwipe
Company: Chockstone Inc.

Inspiration

MLS reloaded

Departments

Forum

Resource Guide

Datebook

A Bigger Thing

The Green Sheet Online Edition

April 28, 2008  •  Issue 08:04:02

previous next

FACTA shatters credit, debit card myths

Lawyers have filed more than 300 class action lawsuits throughout the United States that could potentially cost merchants and acquirers hundreds of millions of dollars. At the heart of this litigation are untruncated credit card receipts.

In December 2003, the U.S. House of Representatives passed the Fair and Accurate Credit Transactions Act (FACTA). Section 113 of the law states "no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipts provided to the cardholder at the point of sale or transaction."

Receipts printed - and presented - with complete card numbers after Jan. 1, 2008, are in violation of this law.

"Victims of identity theft and credit fraud have suffered enough," said Congressman Dennis Moore, D-Kan., an original sponsor of FACTA. "This bill will increase consumer protections and bring an end to the credit nightmares experienced by so many Americans."

The irony of this statement is that the section of the law addressing card number truncation would cause no tangible harm, directly or indirectly, to the consumer; however, it does subject retailers to fines of $100 to $1,000 for each separate violation.

But those violations must be deemed "willful" and this is where the law may appear ambiguous.

Should merchants have known?

The consumers in this case will neither be affected adversely nor will they be a beneficiary in this class action, said Theodore F. Monroe, Internet commerce and payments attorney. "The main beneficiary will be the class action law firms that initiated the lawsuits," he said. "In essence it's a reckless standard being used, so it's pretty much impossible for any major merchant to show that it was not a willful violation."

Some legal analysts and public interest groups are even calling FACTA legal extortion.

"I don't know if I'd call it legal extortion, but I believe that any company currently facing fines and penalties under FACTA has no one to blame but themselves," said David Mertz, Senior Partner, Compliance Security Partners LLC. "The law was passed, and companies were given until the first of January 2008 to make the appropriate changes and they haven't," he added. "It wasn't until lawsuits were filed and threats were made to levy huge fines and penalties that companies finally started doing what they were supposed to do under industry or legal requirements."

Which came first?

FACTA was passed a year before the Payment Card Industry (PCI) Data Security Standard (DSS) came into existence in December 2004.

Under the PCI DSS, if a business can justify a reason to print the full card number on the receipt, the full number is allowable. Under FACTA, it is not. Monroe expects the class action suits to be directed more toward the top "couple of hundred merchants in the country" and doesn't expect to see much litigation against the smaller merchants. He thinks the courts eventually will rule on procedural grounds, even for the larger retailers.

"These class actions are not the best mechanisms. On procedural grounds it's just not that strong and it's really the court looking at these cases and saying 'the fact that you printed an additional couple of digits, we're going to bankrupt a whole bunch of merchants.' It's just a crazy law," Monroe said.

Biggest fallout for acquirers?

Monroe also mentioned that stolen paper receipts with card numbers and expiration dates can only get you so far - not nearly as far as credit card thieves would like.

"How useful is that number if it doesn't have the CVV2 [Card Verification Value] or the remainder of the magnetic code?" he said. "There's really almost nothing you can do with that in the 21st century."

The biggest fallout may hit acquirers. Merchants who felt they were not taken care of when they were set up for processing may sue their credit card processors down the line. Mertz, however, sees most of these cases settling outside of court.

"E-Bay already settled, and I think the reason you're going to see other lawsuits settle is that retailers will have no choice," Mertz said.

Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.

previous next

Spotlight Innovators:

USAePay | Impact Paysystems | Electronic Merchant Systems | Inovio