Credit Receipts From Rite Aid, Wendy's, Fedex Draw Fire for Containing Certain Consumer Data
By ROBIN SIDEL April 28, 2007; Page B1
Consumers are pulling out their plastic for everyday purchases more than ever, and now the nation's retailers are coming under legal assault for printing too much payment-card information on customer receipts.
So far this year, plaintiffs' lawyers have filed more than 100 federal lawsuits seeking class-action status against big merchants such as Rite Aid Corp., Wendy's International Inc., FedEx Corp., TJX Cos. and Inter Ikea Systems BV. Also in the line of fire are lesser-known regional restaurant chains such as In-N-Out Burger and Melting Pot fondue restaurants.
A slew of suits brought on behalf of consumers have been filed in recent weeks in U.S. district courts in California, Pennsylvania, and Kansas.
Merchants are under pressure to help ensure the security of electronic transactions. Still, most of the nation's retailers don't comply with the card industry's myriad rules that prohibit the storage of certain customer data and require the installation of sophisticated firewalls to protect their computer systems.
Earlier this year, TJX, parent of discount clothing chains T.J. Maxx and Marshalls, disclosed that its computers had been hacked in a security breach that left at least 47.5 million of its customers vulnerable to fraud.
The requirement that retailers cut off card data is part of the Fair and Accurate Credit Transactions Act of 2003, which sought to protect consumers from fraud and identity theft amid the growing use of electronic payments. Although it was enacted more than three years ago, the law gave retailers some breathing room to make the change. In addition to the receipt requirements, the law also gives consumers the right to obtain a credit report, without charge, every 12 months.
As of Dec. 4, retailers are prohibited from printing more than the last five digits of a credit-card or debit-card account number on receipts that are handed to customers. The receipts also can't include the account's expiration date. The law applies only to electronically printed receipts, rather than those that are written by hand or imprinted on old-fashioned manual machines.