Bankruptcy

Your Free Lottery Ticket: Credit Card Truncation and Identity Theft

By Adam Levitin

You might be holding a litigation lottery ticket without knowing it. Take a look at your most recent credit card receipt. The receipt likely shows your credit card account number?but with everything except the last

Confused? The explanation lies in a strange little federal statute and tells us some very important things about the root causes of a key consumer credit problem--identity theft.

[Bear with me through some of the more mundane technical stuff--I promise there's an interesting payoff at the end...]   

In 2003, Congress enacted the federal credit card truncation statute, 15 U.S.C. § 1681c(g), as part of the Fair and Accurate Credit Transaction Act (FACTA). This law, which was intended to help prevent identity theft, forbids anyone who accepts credit or debit cards from printing more than the last 5 digits of the card number or expiration date on any electronically printed receipt given to the cardholder at point of sale. The law became effective for all new cash registers as of Jan. 1, 2005, and for those registers already in use, as of Dec. 4, 2006. There is a private right of action for violations. If the merchant was negligent, then the merchant is liable for actual damages and attorneys? fees/costs. But if the violation was willful?and this is key?meaning?meaning knowing or intentional, not malicious?then the merchant is subject to statutory damages of a minimum of $100 violates, plus punitive damages, and costs/attorneys fees. $100 doesn?t sound like a lot, but multiply that by every transaction made at that register since the truncation statute?s effective date and potential damages are huge.

Not surprisingly, a cottage industry has emerged in credit card truncation class action litigation (centered in NJ and CA). To date, every suit filed so far has survived a motion to dismiss. Merchants? attempts to defend themselves through counterclaims of bad faith filings have been unsuccessful.

Many of the merchant defendants in these suits have been fast food or quick dining restaurants?Chuck-E-Cheese?s, Subway, In and Out Burger, El Pollo Loco. Fast food stores are newcomers to credit card acceptance. They weren?t accepting cards when the truncation statute was adopted, but began to take cards between adoption and the effective date. It seems that some of them purchased register software that wasn?t updated for card truncation. One would think that they could turn around and sue the register software providers, but often the register software providers offered to ?upgrade? the software for free, on the condition of a release, the significance of which was not

So, what about that lottery ticket? Get to the point, Levitin? OK. If the numbers match, you?ve got two potential payout options.  One is to get yourself to a class action attorney. But that only gets you $100 and maybe punitives. The other option is to go talk to the merchant?s general counsel. Maybe you get a bit more than $100 for a release?you can capture part of the attorneys? fees and potential punitive damages for yourself.

And what does this possibly tell us about the roots of identity theft?   Card truncation statutes say that 5 digits can be printed, but not 6 or a full 16. But is the problem really how many digits are printed on the receipt? Isn?t the problem that I can pretend to be you simply by getting 16 numbers which are embossed on plastic and listed on your monthly statement? I don?t even have to forge a physical card to commit the fraud; I can just do it on the Internet or over the phone.

Card truncation statutes are meant to protect consumer from identity theft. While 5 digits is better than 16, truncation just misses the point?physical card technology isn?t very secure. Is it any wonder my cousin Boris in Odessa (privyet Boris!) has gotten rich selling card numbers and making fake credit cards? We?re talking about 1970s technology?a piece of embossed plastic and a magnetic stripe. It?s a lot easier and cheaper to forge a credit card than it is to forge a $100 bill, and far more lucrative. One fake credit card leads to a credit limit that could be in the thousands of dollars.

All of this raises a much more serious question?why is credit card technology so dated? Why hasn?t the market encouraged innovation? Is something amiss in the card market such that proper incentives do not exist for card issuers to insist on better card technology? The card industry's joint PCI security standard requires merchants to keep card data much more securely, but the very medium of the card itself seems to be a large part of the problem and one that card issuers could fix fairly easily, either through two-stage encryption or through biometrics or PINs.

Perhaps, let me suggest, the problem is that card issuers bear very little of the cost of fraud. This is a complex subject for another post, but ultimately a lot of what is reported as ?fraud losses? is recovered from other parties in the card system. And with low fraud costs, there is little incentive to change the system.  That is to say, card issuers might be the least cost avoider, but they do not bear the cost of the harm. It is important to emphasize that identity theft is primarily consumer credit fraud?what used to be called unauthorized account charges?and how to correct misaligned incentives should be a major part in our thinking about it.

Full post as published by Credit Slips on January 10, 2008 (boomark / email).