Credit Receipts From Rite Aid, Wendy's, Fedex Draw Fire for Containing Certain Consumer Data
So far this year, plaintiffs' lawyers have filed more than 100 federal lawsuits seeking class-action status against big merchants such as Rite Aid Corp., Wendy's International Inc., FedEx Corp., TJX Cos. and Inter Ikea Systems BV. Also in the line of fire are lesser-known regional restaurant chains such as In-N-Out Burger and Melting Pot fondue restaurants.
A slew of suits brought on behalf of consumers have been filed in recent weeks in U.S. district courts in California, Pennsylvania, and Kansas.
Merchants are under pressure to help ensure the security of electronic transactions. Still, most of the nation's retailers don't comply with the card industry's myriad rules that prohibit the storage of certain customer data and require the installation of sophisticated firewalls to protect their computer systems.
Earlier this year, TJX, parent of discount clothing chains T.J. Maxx and Marshalls, disclosed that its computers had been hacked in a security breach that left at least 47.5 million of its customers vulnerable to fraud.
The requirement that retailers cut off card data is part of the Fair and Accurate Credit Transactions Act of 2003, which sought to protect consumers from fraud and identity theft amid the growing use of electronic payments. Although it was enacted more than three years ago, the law gave retailers some breathing room to make the change. In addition to the receipt requirements, the law also gives consumers the right to obtain a credit report, without charge, every 12 months.
As of Dec. 4, retailers are prohibited from printing more than the last five digits of a credit-card or debit-card account number on receipts that are handed to customers. The receipts also can't include the account's expiration date. The law applies only to electronically printed receipts, rather than those that are written by hand or imprinted on old-fashioned manual machines.
"Slips of paper containing people's financial information should not be floating around," says J. Mark Moore, a lawyer at Spiro Moss Barness LLP in Los Angeles. The law firm has filed more than 40 lawsuits against retailers, charging that they "knowingly and intentionally continued to use cash registers which were not programmed to, or otherwise did not, comply" with the law.
Although the Federal Trade Commission is responsible for enforcing the law, the legislation also gave consumers the right to sue for violations. For those who receive receipts with the full account information, the best thing to do is either keep it in a safe place or rip it up, experts say. A consumer can also report a violator to the FTC. A spokesman says the agency hasn't received consumer complaints about violators and hasn't brought any enforcement actions tied to the law. The agency's regional offices are working with retailers to remind them of the law.
The lawsuits contend that retailers are "willfully" violating the law -- a practice that could result in fines of as much as $1,000 per transaction.
