Dear Valued Merchant:
Staying abreast of key developments in the payments industry is critical to the success of your business. Yet, the payments world is a confusing one to watch.
To keep you informed, Heartland Payment Systems is periodically publishing Payments Insider — a news-based business publication that brings key payments news, legislation and trends right to your inbox. In an easy-to-read format, we’ll offer information to help you manage your payments efficiently and cost-effectively.
In this first issue, we focus on class-action suits targeting retailers and what you need to do to protect your customers — and your business. We’re here to help you, so feel free to contact us at 1.888.963.3600 with any questions.
Best regards,
Heartland Payment Systems
Since final compliance with truncation laws essentially went into effect in December 2006, several dozen class-action lawsuits have already been filed against hundreds of merchants in California and Pennsylvania.
The lawsuits allege these merchants have printed full credit/debit and prepaid card account numbers and/or expiration dates on customer receipts, thereby violating the Fair and Accurate Credit Transaction Act (FACTA).
The lawsuits are seeking punitive damages, statutory damages, costs for any incidence of fraud, and attorneys’ fees. Due to the substantial damages that can be awarded in these class-action suits, many plaintiffs’ attorneys are looking to capitalize on the opportunity. As such, this trend may quickly spread across the nation.
Are you truncating customers’ credit/debit and prepaid card account numbers — AND eliminating card expiration dates from electronically generated receipts? If not, you could be liable for substantial monetary damages.
The cost of identity theft continues to take its toll on both consumers and businesses alike. Latest figures show consumers lose about $5 billion annually — and businesses lose about $48 billion.
And, it’s getting even worse as laws clamp down on business owners in an effort to safeguard consumers. Amendments to the federal Fair Credit Reporting Act mandate merchants who accept credit/debit and prepaid cards:
- Truncate card numbers — printing no more than the last five digits of a consumer’s account number on the customer receipt.
- Refrain from printing the card expiration date on the customer receipt.
Depending on the terminal or system you use for accepting card payments, you were required to comply with these requirements by December 2005 or December 2006 — although certain manual machines and written receipts were grandfathered. Have you truncated card account numbers and eliminated expiration dates? Do you know if this information is automatically printed on the receipt as part of your terminal or standard software package? Are you unknowingly at risk? Are you a potential target for the many class-action suits that are aggressively being filed?
According to Anita Boomstein, an attorney with Hughes Hubbard who specializes in card payments, privacy and Payment Card Industry (PCI) compliance issues and is representing three national merchants being sued, “Since the law generally became effective in December 2006, several dozen lawsuits have already been filed against merchants in California and Pennsylvania."
“What makes this very troubling is that substantial money damages can be imposed on a merchant who fails to follow the requirements,” Boomstein continues. “For ‘willful’ violations where the merchant intentionally or knowingly disregards the law, the penalty can be in the range of $100 to $1,000 for each card receipt issued. This penalty can be assessed even if the consumer has suffered no actual damages. For ‘negligent’ violations, a merchant is liable for the consumer’s actual damages. In both cases, the merchant may also be accountable for the attorney’s fees and court costs.”
In fact, part of the reason class-action suits are abounding is because the statute permits attorneys who initiate suits to be paid all of their attorney’s fees and costs. That — combined with the substantial damages that can be awarded in a class-action suit — make card-accepting merchants attractive targets for litigation.
So, protect yourself. Contact your Heartland Payment Systems Service Relationship Manager or Heartland’s Service Center at 1.888.963.3600 to ensure you are compliant. It could save your business.
- Check your receipts! Does the customer copy feature the entire card account number and/or the expiration date?
- If so, contact your Heartland Payment Systems Service Relationship Manager or Heartland’s Service Center at 1.888.963.3600. Heartland will help you download a new application that prints truncated receipts and eliminates the printing of expiration dates — or we will recommend a terminal that does. The download takes only 30 to 45 minutes.
- If you are using a point-of-sale software product, be sure your vendor has properly configured it for compliance.
- If you’re not sure about your compliance, contact your Heartland Payment Systems Service Relationship Manager or Heartland’s Service Center at 1.888.963.3600. We’ll check your terminal/point-of-sale device and software relative to truncation as mandated by your state.
- If you operate in California or Colorado, check with Heartland about the additional truncation requirements that are — or soon will be — applicable to you.
In 2003, Congress added new provisions to the federal Fair Credit Reporting Act to help prevent identity theft and fraud. The law — called the Fair and Accurate Credit Transaction Act (FACTA) — offered merchants three years to become compliant, with official enforcement effective December 2006. The law mandates merchants:
- Truncate card numbers — printing no more than the last five digits of a consumer’s account number on the customer receipt.
- Refrain from printing the card expiration date on the customer receipt.
Additionally, some states are creating additional truncation legislation like the “double truncation” laws in California and Colorado. Double truncation calls for the elimination of card account numbers and expiration dates on both customer and merchant receipts. This is intended to prevent problems that arise when the customer takes — or the merchant gives — the wrong receipt. Be aware you could be responsible for double truncation if you have any operations in California or Colorado.
Even without direct harm to the consumer, penalties for violating FACTA can be enforced. A merchant can be responsible for fines as steep as $100 to $1,000 for each receipt printed with improper information. And, a merchant can be held liable for a consumer’s damages — including attorney and court fees — if a printed receipt results in identity theft.
If so, the laws are tougher there — mandating “double truncation” where both customer and merchant receipts are forbidden to print more than five digits of the consumer’s card account number or the expiration date.
Heartland is working diligently to ensure our merchants in California and Colorado are compliant. The remedy is a simple 30 to 45-minute download of a new software application.
Be sure to protect yourself. Contact your Heartland Payment Systems Service Relationship Manager or Heartland’s Service Center at 1.888.963.3600.
