Fear FACTA

Hughes adds that while the big brands are well aware of the FACTA lawsuit factory, he believes second-tier merchants may be the next target. “A lot of the big targets have already been hit or have fixed their systems,” he says. Plaintiffs are going to look for the next tier of potential, “and that's going to be the regional providers — the regional restaurants, catalogers and retailers.”

He adds: “The cases are very easy to bring; they're relatively inexpensive and, generally speaking the statute does not require any actual harm. That's a tremendous incentive for plaintiffs to bring these lawsuits.”

Bob Botelle, vice president of merchant services for payment processing firm Litle & Co., says there is no excuse for merchants who continue to issue credit-card receipts with expiration dates on them, but some still do.

He adds that it is the payment processor's responsibility to make sure its merchant customers are compliant with laws such as FACTA. His firm downloaded software to all its customers about five years ago to that end.

To be payment card industry (PCI) compliant, all card-not-present transactions must be encrypted so the customer's card number can't be seen within the organization, Botelle says.

Also, Visa and MasterCard are levying fines of thousands of dollars a month on companies that are non-PCI-compliant, he adds.

“I am surprised that any merchant with the knowledge of what Visa and MasterCard are doing with PCI and identity theft and credit card fraud, would put anything referencing a credit card on a statement,” he says.

Botelle says mail order packing slips should contain no reference whatsoever to customers' credit cards. “There are phishing scams out there where people can make up cards using the last four digits and the expiration date,” he says. “Companies shouldn't be putting the expiration date anywhere.”

So how, more than four years after it was passed, is it possible that merchants could be issuing credit card receipts in violation of FACTA?

In a large company, the credit card processing, which deals with all the PCI requirements, “is far removed from the fulfillment area,” says Botelle. “And a lot of these are old mainframe pick-and-pack systems. And if the people who are packing the product don't know what to look for, they may not even know they're in violation.”

He adds: “I can safely say that there are companies that should be PCI-compliant that are not, and there are still systems out there that are not compliant printing these sheets. They're a target for lawsuits and they're a target for Visa and MasterCard.” (For more on PCI, see “In praise of PCI,” on page 46.)

	The good news

Last year, merchants scored some key victories over FACTA plaintiffs. In the case of Soualian V. International Coffee & Teas, for example, a district judge agreed with the defendant that the case did not meet the “superiority” test — meaning that a class action suit in this case was not the best way to remedy the situation — and refused to certify the case as a class action.

The court also ruled that certifying the suit as a class action might result in disastrous consequences to the company and put thousands of employees out of work, all over a mistake that didn't hurt anybody.

The judge in the International Coffee & Teas case cited some of the reasoning in the Cost Plus case to reach the ruling. The plaintiff in that suit tried to certify and class 3.4 million people against a company whose net sales revenue is $20 million a year, according to the AEI's Frank. Moreover, International Coffee & Teas helped its case by correcting the situation as soon as the company learned of it, the court said.

“By immediately remedying their misconduct upon receiving the plaintiff's complaint, defendants demonstrated good faith and nullified any deterrence benefit that might have been derived from a class action,” the court said.

Though these decisions offer hope, Hughes warns not to get too excited. “You can't take away from [the developments in California] that all the courts will follow those decisions.”

Meanwhile, if you haven't, check those receipts and remove the expiration dates, says Hughes. “It's just not worth the fight to argue that,” he says.