Retailers Get Sued For Printing Too Many Credit Card Digits On Receipts

Credit Receipts From Rite Aid, Wendy's, Fedex
Draw Fire for Containing Certain Consumer Data
By ROBIN SIDEL
April 28, 2007; Page B1

Consumers are pulling out their plastic for everyday purchases more than ever, and now the nation's retailers are coming under legal assault for printing too much payment-card information on customer receipts.

So far this year, plaintiffs' lawyers have filed more than 100 federal lawsuits seeking class-action status against big merchants such as Rite Aid Corp., Wendy's International Inc., FedEx Corp., TJX Cos. and Inter Ikea Systems BV. Also in the line of fire are lesser-known regional restaurant chains such as In-N-Out Burger and Melting Pot fondue restaurants.

A slew of suits brought on behalf of consumers have been filed in recent weeks in U.S. district courts in California, Pennsylvania, and Kansas.

Merchants are under pressure to help ensure the security of electronic transactions. Still, most of the nation's retailers don't comply with the card industry's myriad rules that prohibit the storage of certain customer data and require the installation of sophisticated firewalls to protect their computer systems.

Earlier this year, TJX, parent of discount clothing chains T.J. Maxx and Marshalls, disclosed that its computers had been hacked in a security breach that left at least 47.5 million of its customers vulnerable to fraud.

The requirement that retailers cut off card data is part of the Fair and Accurate Credit Transactions Act of 2003, which sought to protect consumers from fraud and identity theft amid the growing use of electronic payments. Although it was enacted more than three years ago, the law gave retailers some breathing room to make the change. In addition to the receipt requirements, the law also gives consumers the right to obtain a credit report, without charge, every 12 months.

As of Dec. 4, retailers are prohibited from printing more than the last five digits of a credit-card or debit-card account number on receipts that are handed to customers. The receipts also can't include the account's expiration date. The law applies only to electronically printed receipts, rather than those that are written by hand or imprinted on old-fashioned manual machines.

"Slips of paper containing people's financial information should not be floating around," says J. Mark Moore, a lawyer at Spiro Moss Barness LLP in Los Angeles. The law firm has filed more than 40 lawsuits against retailers, charging that they "knowingly and intentionally continued to use cash registers which were not programmed to, or otherwise did not, comply" with the law.

Although the Federal Trade Commission is responsible for enforcing the law, the legislation also gave consumers the right to sue for violations. For those who receive receipts with the full account information, the best thing to do is either keep it in a safe place or rip it up, experts say. A consumer can also report a violator to the FTC. A spokesman says the agency hasn't received consumer complaints about violators and hasn't brought any enforcement actions tied to the law. The agency's regional offices are working with retailers to remind them of the law.

The lawsuits contend that retailers are "willfully" violating the law -- a practice that could result in fines of as much as $1,000 per transaction.

'Uncomfortable' for Retailers

"If you assume that many of these businesses weren't able to get this fixed until recently, [the potential fines] are enough to make even the largest of these companies feel very uncomfortable," says Gregory Hurley, a lawyer at Greenberg Traurig in Costa Mesa, Calif., who represents retail trade groups on the issue.

Mr. Hurley also puts some of the blame on the card industry, saying that card issuers and the companies that process transactions for merchants didn't do a good enough job of alerting their clients to the law.

A spokesman for FedEx Kinko's, which is the subsidiary named in the lawsuit, has reviewed its receipts since 2004 and "in no year was the printing of expiration dates identified as an item that could compromise cardholder security" under the federal law. He declined further comment, citing the pending litigation. A TJX spokeswoman declined to comment.

The suits are also drawing criticism from retailers who say they are merely opportunistic litigation from the plaintiffs' bar.

"We firmly believe Congress did not intend to allow these class-action lawyers to claim hundreds of millions of dollars in damages when no one has actually suffered any monetary harm," Arnold Wensinger, general counsel for Irvine, Calif.-based In-N-Out Burger, said in a statement.

During the past few years, thousands of retailers have overhauled their payment systems to eliminate some card information. In 2003, Visa USA Inc., for example, began requiring merchants that accept its branded cards to eliminate all but the last four account digits. The rule applied to new terminals only.

Since then thousands of retailers have altered their systems so that the last few digits of a card account number are preceded by a series of X's, but the full account data still periodically show up on receipts. Some blame software that has been improperly programmed, while others say that big restaurant chains sometimes don't have the power to enforce the rule with their franchisees.

Although businesses in other countries often print the full card-account information, that is also changing. As of April 1, Visa started requiring global merchants who accept its cards to cut off at least four of the account numbers from customer receipts.

Wendy's: Hold the Digits

Denny Lynch, a spokesman for Wendy's, says the burger chain's company-owned stores carry just the last four digits of an account number on both the merchant and customer receipt. The company makes that computer program available to its franchisees, who own about 80% of the chain's 6,200 U.S. stores. But, he said, "We don't know if all of them are taking advantage of that," he said.

Representatives of Rite Aid, Ikea and Melting Pot didn't return calls for comment.

Daveed Schwartz, a lawyer who represents retailers that have been sued, says that companies in violation of the law are likely unaware of it.

"The last thing retailers want to do is to act against their own self-interest by subjecting their customers to an increased risk of identity theft," he says. Mr. Schwartz's firm, Pillsbury Winthrop Shaw Pittman LLP, is defending about a dozen retailers who have been sued.

The Meaning of 'Or'

The suits have also stirred debate about potential ambiguity in the law, which prohibits merchants from printing the full account information "or" the expiration date. The National Retail Federation, a trade group representing merchants, says the language indicates that they would still be in compliance if they printed one or the other. Others interpret the law as meaning that merchants aren't permitted to print either one.

Another concern is whether the law applies to merchant receipts that customers sign and then hand back to a cashier or waiter. Typically, these merchant copies contain the full card-account information. The law applies to "any receipt provided to the cardholder."

People involved in the litigation also are paying close attention to a pending Supreme Court case that could have implications in the tussle over receipt information.

In that case, a number of insurance companies are challenging a decision by the Ninth Circuit Court of Appeals in San Francisco that said companies can be found liable for violating the federal credit law even if they aren't determined to have done it "willfully."