My ATM Card# Is Widely Known

joe_04_160x1201When I was in India I was shocked that the credit (and debit) card receipts at bank ATMs were displaying information that could make it easier for someone to access my account and steal money. (see SprangleBlog post)

At the time, I thought the issue did not exist in the USA. Since then, I’ve seen similar information on some receipts in the USA.

Today I discovered that major retailers here are deliberately doing the same thing and even defending the practice against lawsuits by the US Government. According to various articles published in the last few days (eWeek Magazine and CIO INsight), the offenders are defiant, claiming that the language of the law is “confusing” and badly worded. Here’s what a Federal Judge told the operators of the Addidas retail shops:

“The question here is essentially whether [the law] is sufficiently clear that its prohibitions would be understood by an ordinary person operating a profit-driven business.

The judge ruled that the FACTA section easily meets this standard because its words have only one reasonable meaning: ‘No person . . . shall print more than the last 5 digits of the card number or the expiration date upon any receipt’ clearly means that (1) no person shall print more than the last 5 digits of the card number, and (2) no person shall print the expiration date. In other words, a retailer must print no more than 5 digits of a card number, and also must omit the expiration date—doing either violates the statute.”

The judge then shot down the Adidas arguments that the law is confusingly worded. “Adidas attempts to obfuscate this plain meaning by advancing two ‘competing’ interpretations that border on the absurd.

First, Adidas contends that the statute could be read to ‘allow a business to print the credit card’s expiration date on the receipt so long as no more than the last 5 digits of the card appear.’

Second, Adidas argues it could be read so that the phrase ‘last 5 digits’ modifies both ‘card number’ and ‘expiration date,’ and thus that a business would be in compliance so long as it truncated the card number and printed only the last five digits of the expiration date. Each interpretation is bizarre,” the judge wrote.

“The first ignores the plain reference to ‘the expiration date,’ essentially by contending that Congress prohibited only printing both an untruncated card number and an expiration date on the same receipt,” the judge said.

“This would lead to the absurd result that a firm could print an entire card number so long as it omitted the expiration date. No reasonable person would think that this was Congress’ intent.”

The full text of the Judge’s ruling – including his calling the defendants’ explanation “ridiculous” and “absurd” – should appear soon on the US Court web site

Leave a Comment