Page 1
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 1 of 18 IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION TONI IVANOV, individually and on behalf of a class, Plaintiff, v.
ALA CARTE ENTERTAINMENT, INC.
and EXCALIBUR CHICAGO, INC., and DOES 1-10, Defendants.
FILED: APRIL 15, 2008
08CV2134
TG JUDGE ZAGEL MAGISTRATE JUDGE MASON COMPLAINT – CLASS ACTION INTRODUCTION 1.
Plaintiff Toni Ivanov brings this action to secure redress for the violation by Ala Carte Entertainment, Inc. and Excalibur Chicago, Inc., of the Fair and Accurate Credit Transactions Act (“FACTA”) amendment to the Fair Credit Reporting Act (“FCRA”). 2.
One provision of FACTA, codified as 15 U.S.C. §1681c(g), provides that: No person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction.
3.
Section 1681c(g) is “not ambiguous.” It “expressly prohibits printing more than the last five digits of the credit/debit card numbers and also prohibits printing the card's expiration date.” Pirian v. In-N-Out Burgers, 06-1251, 2007 U.S. Dist. LEXIS 25384, *8 (C.D.Cal. Apr. 5, 2007); accord, Iosello v. Leiblys, Inc., 502 F.Supp.2d 782 (N.D.Ill. 2007); Follman v. Hospitality Plus of Carpentersville, Inc., 07 C 2934, 2007 U.S. Dist. LEXIS 77440 (N.D.Ill., Oct.
Page 2
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 2 of 18 17, 2007); Follman v. Village Squire, Inc., 07 C 3767, 2007 U.S. Dist. LEXIS 92585 (N.D.Ill., Dec. 18, 2007); Korman v. Walking Co., 503 F. Supp. 2d 755 (E.D.Pa. 2007); Ramirez v. MGM Mirage, Inc., 2:07-CV-00326-PMP-PAL, 2007 U.S. Dist. LEXIS 95254 (D.Nev. December 3, 2007). 4.
The purpose of this “truncation requirement” is to prevent identity theft. The Federal Trade Commission estimates that over 9 million persons each year have their identity assumed by criminals for financial gain, causing losses in excess of $50 billion. 5.
One common modus operandi of identity thieves is to obtain credit card receipts that are lost or discarded, or through theft, and use the information on them to engage in transactions. Identity thieves who do this are known as “carders” and “dumpster divers.” This modus operandi is more common than the use of sophisticated electronic means to obtain the information. Robin Sidel, “Identity Theft – Unplugged – Despite the High-Tech Threat, When You Get Ripped Off It’s Usually Still the Old Way,” Wall Street Journal, Oct. 5, 2006, p. B1. 6.
The expiration date is generally necessary for misuse of the card number.
7.
Merchants generally will not honor a credit card in a card-not-present transaction (telephone or Internet or fax) without both the correct expiration date and the card number. Thieves prefer to engage in such transactions to commit credit card fraud, so as to reduce the chances of apprehension.
8.
To curb this means of identity theft, Congress prohibited merchants who accept credit cards and debit cards from issuing electronically-generated receipts that display either the expiration date or more than the last five digits of the card number.
9.
The law gave merchants who accept credit cards and/or debit cards up to three years to comply with its requirements, requiring full compliance with its provisions no later
Page 3
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 3 of 18 than December 4, 2006.
10.
Defendants have willfully violated this law and failed to protect plaintiff and others similarly situated against identity theft and credit card and debit card fraud by failing to comply with the truncation requirement.
11.
Plaintiff brings this action against defendants based on defendants’ violation of 15 U.S.C. §§1681 et seq. Plaintiff seeks statutory damages, attorneys fees, costs, and such other relief as the Court deems proper, including punitive damages.
JURISDICTION AND VENUE
12.
This Court has subject matter jurisdiction under 28 U.S.C. §1331 and 15 U.S.C. §1681p (FCRA).
13.
Venue in this district is proper because defendants do business here.
PARTIES
14.
Plaintiff, Toni Ivanov, is a resident of this district.
15.
Defendants Ala Carte Entertainment, Inc. and Excalibur Chicago, Inc are Illinois corporations that operate the Excalibur nightclub at 632 N. Dearborn, Chicago, IL 60610. The registered agent and office of each are Fred R. Hoffmann, 2330 N. Hammond Dr., Suite G, Schaumburg, IL 60173.
16.
Defendants are each a “person that accepts credit cards or debit cards for the transaction of business” within the meaning of FACTA.
17.
Defendants Does 1-10 are individual officers, directors, employees and agents of the corporate defendants who authorized, directed or participated in the violations of law complained of.
Page 4
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 4 of 18 FACTS 18.
On May 27, 2007, plaintiff received from defendants at the Excalibur nightclub located at 632 N. Dearborn, Chicago, IL 60610, a computer-generated cash register receipt which displayed plaintiff’s full card number and the expiration date.
CLASS ALLEGATIONS
19.
Plaintiff brings this action on behalf of a class pursuant to Fed.R.Civ.P. 23(a) 20.
The class is defined as all persons to whom defendants provided an and (b)(3).
electronically printed receipt at the point of sale or transaction, in a transaction occurring in Illinois after December 4, 2006, which receipt displays (a) more than the last five digits of the person’s credit card or debit card number, or (b) the expiration date of the person’s credit or debit card or (c) both. 21.
The class is so numerous that joinder of all individual members in one action would be impracticable.
22.
There are over 100 persons to whom defendants provided an electronically printed receipt at the point of sale or transaction, in a transaction occurring in Illinois after December 4, 2006, which receipt displays (a) more than the last five digits of the person’s credit card or debit card number, or (b) the expiration date of the person’s credit or debit card or (c) both. 23.
Plaintiff’s claims are typical of the claims of the class members. All are based on the same legal theories and arise from the same unlawful and willful conduct. 24.
There are common questions of fact and law affecting members of the class, which common questions predominate over questions which may affect individual members. These include the following:
Page 5
Case 1:08-cv-02134 a.
Document 1 Filed 04/15/2008 Page 5 of 18 Whether defendants had a practice of providing customers with a sales or transaction receipt which failed to comply with the truncation requirement; 25.
b.
Whether defendants thereby violated FACTA; c.
Whether defendants’ conduct was willful; and d.
Identification and involvement of the Doe defendants.
Plaintiff will fairly and adequately represent the class members. Plaintiff has no interests that conflict with the interests of the class members. Plaintiff has retained experienced counsel.
26.
A class action is superior to other available means for the fair and efficient adjudication of the claims of the class members. Individual actions are not economically feasible.
VIOLATION ALLEGED
27.
Defendants violated 15 U.S.C. §1681c(g)(1), which provides that: . . . no person that accepts credit cards or debit cards for the transaction of business shall print more than the last five digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction.
28.
With respect to machines that were first put into use after January 1, 2005, 15 U.S.C. §1681c(g)(3)(B) required immediate compliance with the provisions of 15 U.S.C. §1681c(g)(1).
29.
With respect to machines that were in use before January 1, 2005, 15 U.S.C. §1681c(g)(3)(B) required compliance with the provisions of 15 U.S.C. §1681c(g)(1) on or after December 4, 2006.
30.
Defendants accept credit cards and/or debit cards in the course of
Page 6
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 6 of 18 transacting business with persons such as plaintiff and the class members. In transacting such business, defendants use cash registers and/or other machines or devices that electronically print receipts for credit card and/or debit card transactions.
31.
After the effective date of the statute, defendants, at the point of sale or transaction, provided plaintiff and each class member with one or more electronically printed receipts on each of which defendants failed to comply with the truncation requirement. 32.
FACTA was enacted in 2003 and gave merchants who accept credit card and/or debit cards up to three years to comply with its requirements, requiring compliance for all machines no later than December 4, 2006.
33.
Defendants knew or should have known of the truncation requirement.
34.
VISA, MasterCard, the PCI Security Standards Council – a consortium founded by VISA, MasterCard, Discover, American Express and JCB – companies that sell cash registers and other devices for the processing of credit or debit card payments, and other entities informed merchants about FACTA, including its specific requirements concerning the truncation of credit card and debit card numbers and prohibition on the printing of expiration dates, and the need to comply with the same.
35.
The requirement was widely publicized among retailers.
36.
For example, in response to earlier state legislation enacting similar truncation requirements, on March 6, 2003, the CEO of Visa USA, Carl Pascarella, explained that “Today, I am proud to announce an additional measure to combat identity theft and protect consumers. Our new receipt truncation policy will soon limit cardholder information on receipts to the last four digits of their accounts. The card’s expiration date will be eliminated from receipts
Page 7
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 7 of 18 altogether. . . . The first phase of this new policy goes into effect July 1, 2003 for all new terminals. . . . .” “Visa USA Announces Account Truncation Initiative to Protect Consumers from ID Theft; Visa CEO Announces New Initiative at Press Conference With Sen. Dianne Feinstein,” PR Newswire, March 6, 2003.
37.
Within 24 hours, MasterCard and American Express announced they were imposing similar requirements.
38.
The card issuing organizations proceeded to require compliance with FACTA by contract, in advance of FACTA’s mandatory compliance date.
39.
For example, the August 12, 2006 edition of “Rules for Visa Merchants” (p. 62), which is distributed to and binding upon all merchants that accept Visa cards, expressly requires that “only the last four digits of an account number should be printed on the customer’s copy of the receipt” and “the expiration date should not appear at all.” These statements were accompanied by a picture of a receipt showing precisely what had to be removed. VISA required complete compliance by July 1, 2006, five months ahead of the statutory deadline. 40.
Defendants accept Visa cards and is a party to a contract requiring compliance with the above-quoted requirement.
41.
American Express has a manual that contains a similar depiction of what information must be suppressed.
42.
These requirements were widely publicized. The following are illustrative. 43.
On July 9, 2003, L. Richard Fischer of VISA USA presented a written statement to the House Committee on Financial Services supporting the truncation requirements of what ultimately became FACTA. Mr. Fischer stated:
Page 8
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 8 of 18 Although Visa generally believes that the details of preventing identity theft should be left to financial institutions that are best suited to address ever evolving fraud techniques, Title II could provide important benefits to consumers and financial institutions alike by establishing workable identity theft provisions and ensuring that these provisions benefit from national uniformity. For example, Section 203 of Title II would prohibit any merchant or other entity that accepts credit and debit cards from printing more than the last four digits of the card account number or the expiration date upon receipts provided to cardholders at the point of sale 44.
The Office of Thrift Supervision of the Treasury Department (“OTS”), is responsible, inter alia, for compliance with FACTA by federal savings banks. Toward this end, the OTS publishes an Examination Handbook for OTS field personnel to use when they perform an examination, or compliance audit, of a given financial institution. The February 2006 edition of the Handbook states:
Truncation of Credit and Debit Card Account Numbers Ensure that electronically generated receipts from ATM and POS terminals or other machines do not contain more than the last five digits of the card number and do not contain the expiration dates.
45.
Heartland Payment Systems, Inc. provides credit and debit card, payroll and related processing services to restaurant, hotel and retail merchants throughout the United States, and indicates on its website that it provides services to over 137,000 merchants. In 2003, Heartland broadly disseminated a pamphlet which included the following statement: Your credit card terminal is now–or will soon be required by law or the bankcard associations to truncate–or limit–the information that can appear on electronically printed sales receipts.
What that means is that on all cardholder numbers:
o The expiration date must be eliminated o All but the last four numbers of the card number must be obscured. . . . .
Page 9
Case 1:08-cv-02134 46.
Document 1 Filed 04/15/2008 Page 9 of 18 In 2006, Heartland broadly disseminated a second pamphlet, which included the following statement:
Make every transaction a safe one. * * * * o The cardholder’s receipt should not include the card’s expiration date and should only include the last 4 or 5 digits of the card number. * * * * 47.
Another credit card processor, Commerce Bank, sent “Merchant Compliance Awareness” notices to its customers during 2004. These stated that all but the last four digits of the cardholder account number and the entire expiration date had to be suppressed from the receipt. 48.
A bulletin dated June 14, 2006 issued by AllianceData, another processor, informed its customers that under FACTA “no person that accepts credit cards or debt cards for the transaction of business shall print more that the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale transaction.” It further stated that Visa required compliance by July 1, 2006 and MasterCard by April 1, 2005. 49.
Many restaurant and retail trade associations apprised their merchant members that FACTA imposed truncation requirements mirroring Visa’s truncation requirements. For example, the Virginia Retail Merchants Association reported in its February/March 2005 Newsletter that “FACTA says receipts for credit and debit card transactions may not include more than the last five digits of the card number or expiration date.” 50.
In the April 23, 2003 edition of the monthly magazine for the National Association of Convenience Stores, an article titled “Visa USA Targets Identity Theft,” appeared which included the following statement:
[A]t a press conference held last month with Sen. Dianne Feinstein (D-CA), Visa announced its account truncation security policy. This protects consumers from
Page 10
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 10 of 18 identity theft by limiting cardholders’ information on receipts to the last four digits of their accounts. The policy will also eliminate the card’s expiration date from receipts altogether. Feinstein has introduced legislation to combat identity theft. 51.
The April 2005 edition of the Food Industry Advisor, the newsletter for the Pennsylvania Food Merchants Association and Pennsylvania Convenience Store Council, included an article regarding the requirements of credit card truncation under FACTA which included the following language:
[A]ccording to the FACTA Act,`no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of sale or transaction.....
The same article appeared in the April 2005 Edition of the NACS Magazine, published by the National Association of Convenience Stores.
52.
In its Spring 2004 Newsletter, the Connecticut Restaurant Association Newsletter included an article regarding Requirements for Credit Card Truncation, which stated: [T] here is currently no Connecticut state law, so the two ruling requirements come from VISA and a new Federal Fair Credit Reporting Act signed in December 2003. Truncation requires that all but the last four digits of the cardholder account number, along with the entire expiration date, be suppressed on the cardholder copy of the transaction receipt generated from all electronic terminals....
53.
After the enactment of FACTA, the Wisconsin Restaurant Association issued a “Credit Card Transaction” Alert to its members, which stated:
You may have been hearing about credit card truncation lately. This is what you need to know.
Credit card truncation removes all but the last four (or five) digits of a credit card account number ad the expiration date from the sales receipt. For example: A nontruncated receipt would list:
Page 11
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 11 of 18 Acct. # 1234 5678 7654 3210 Exp. 10/05 while a truncated receipt would show:
Acct. # **** **** **** 3210 Exp ****. .. . .
The federal Fair and Accurate Credit Transaction Act of 2003, prohibits any person that accepts credit cards or debit cards from printing the expiration date and more than the last five digits of the card number upon any terminal-generated receipt provided to the cardholder at the point of sale....
54.
In the January 2005 edition of the Massachusetts Restaurant Association Newsletter, an article appeared apprising Association members that both Visa and MasterCard require truncation of the entire expiration date and all but the last four digits of the cardholder account number.
55.
Similar information was disseminated by the Ohio Restaurant Association, the Oklahoma Restaurant Association, and a significant number of other restaurant trade associations, and retail merchant trade associations.
56.
In the March/April 2006 Edition of the Ohio Independent Automobile Dealers’ Association Dealer News Magazine, an article was published entitled “What You Should Know about Credit and Debit Card Processing and the FACTAs about Card Truncation.” The article states:
What is Card Truncation? This federal law sets deadlines by which the receipt electronically printed from a credit card sale must be truncated–meaning, the receipt given to the customer shows no more than the last five digits of the customer’s credit card number and does not show the expiration date.
Business owners are responsible for merchant account compliance with the truncation regulations and must make sure their printed cardholder receipts do not contain expiration dates or full account numbers.
This same article appeared in the March/April edition of the West Coast Independent Automobile
Page 12
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 12 of 18 Dealer News.
57.
The Independent Insurance Agents & Brokers of America circulated a report to its members dated June 5, 2005 titled: “Overview of the Fair Credit Reporting Act, The Fait and Accurate Credit Transactions Act, and the Drivers Privacy Protection Act.” In relevant part, this publication stated:
Under the FACT Act, businesses and others accepting credit or debit cards for payment may not print more than the last five digits of the card number nor may they print the expiration date upon any receipt provided to the cardholder at the point of sale.
58.
The November 18, 2004 edition of the Compliance Challenge, published by the Credit Union National Association News, stated: “FACTA prohibits anyone that accepts credit/debit cards to print more than the last 5 digits of the card number or expiration date on any receipt at the point of sale or transaction....” 59.
In the October 10, 2003, edition of the PT Bulletin, a Newsletter for the American Physical Therapy Association, an article appeared titled, “Truncation Requirement Now in Effect for Credit Card Processing.” In relevant part, this article stated: Physical therapists who accept credit card payments from patients and clients face new processing requirements from major credit card companies. In an effort to minimize opportunities for credit card fraud, Visa and MasterCard...have mandated that credit card account numbers and expiration dates be masked on all receipts. Compliance with this requirement is not optional....
60.
On January 10, 2007, the National Retail Federation sent a memo to the general counsels of its members warning that failure to suppress both “credit card expiration dates or anything beyond the last five digits of a customer’s credit card number on the copy of the receipt provided to the customer” was likely to result in a lawsuit.
Page 13
Case 1:08-cv-02134 61.
Document 1 Filed 04/15/2008 Page 13 of 18 The Federal Trade Commission issued a business alert in May 2007 entitled “Slip Showing? Federal Law Requires All Businesses to Truncate Credit Card Information on Receipts,” which stated: “According to the federal Fair and Accurate Credit Transactions Act (FACTA), the electronically printed credit and debit card receipts you give your customers must shorten – or truncate – the account information. You may include no more than the last five digits of the card number, and you must delete the card’s expiration date.” 62.
Truncation standards, including the standards reflected in the Visa Merchant Rules and in FACTA, permit the publication of the last four or five digits of customer account numbers on the receipt presented to customers at the point of sale. The publication of this minimal amount of account information is necessary to facilitate merchant account reconciliation, processing of returns, etc. In isolation, the publication of only the last four or five digits of a customer account number significantly limits the extent to which a potential identity thief can effectively use customer receipts disseminated at the point of sale to facilitate identity theft.
63.
The publication of expiration dates on customer receipts disseminated at the point of sale, in addition to the last four or five digits of the customer account number, exponentially increases the possibility of identity theft, which is the obvious reason that Visa, and then Congress, requires the truncation of expiration dates.
64.
Credit and debit card account numbers are not randomly generated. Instead, account numbers reflect an internal coding scheme set forth by the International Organization for Standardization (“ISO”) 7812, which defines the content in the cards’ magnetic strips. Consistent with this standard, every credit card number consists of the following: (a) a single digit Major Industry Identifier (“MII”); (b) an issuer identification number (“IIN”); (c) an number unique to the
Page 14
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 14 of 18 card; and (d) a check digit.
65.
The MII identifies the industry of the issuer of the card..
66.
The IIN consists of the first six digits of the card number and identifies the specific issuer of the card.
67.
The seventh through next to the last digit, up to a maximum of 12 digits, is the number unique to the card.
68.
The last digit is a “check digit” that is not randomly assigned, but instead is calculated by a defined algorithm. Therefore, the “check digit” is derivative of the other numbers in the credit card number.
69.
Astute identity thieves are familiar with this coding paradigm and can use sophisticated mathematical modeling to decipher account numbers.
70.
To the extent that an identity thief is able to decipher a credit card user’s account number, the importance of truncating expiration dates becomes manifest. That is, unlike the account number on the credit or debit card, the expiration date cannot be deciphered through sophisticated mathematical modeling. Therefore, the expiration date is an important security check that corroborates that a person attempting to use a given account number is actually the authorized user of the card.
71.
The expiration dates are also used to confirm that a person making a purchase over the phone or on the internet actually has the card in their possession. 72.
Banks and credit card associations (i.e. Visa, MasterCard, American Express, etc.) are keenly aware of the importance of truncating expiration dates. 73.
In addition, a would be identity thief who steals a receipt containing the last
Page 15
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 15 of 18 four or five digits of a credit card account number and an expiration date can use that data in an attempt to dupe the cardholder, or other potential information sources, into disclosing additional confidential financial information relating to the cardholder. The more information that is disclosed on the receipt, the easier it is to pilfer additional confidential financial information. 74.
The costs of truncating credit and/or expiration dates and account numbers 75.
Most of defendants’ business peers and competitors readily brought is minimal.
their credit card and debit card receipt printing process into compliance with FACTA by programming their card machines and devices to comply with the truncation requirement. Defendants could have readily done the same.
76.
Defendants willfully disregarded FACTA’s requirements and continued to use cash registers or other machines or devices that print receipts in violation of FACTA. 77.
The FCRA, 15 U.S.C. §1681n, provides:
§1681n. Civil liability for willful noncompliance
(a) In general. Any person who willfully fails to comply with any requirement imposed under this title [15 USC §§1681 et seq.] with respect to any consumer is liable to that consumer in an amount equal to the sum of– (1)
(A) any actual damages sustained by the consumer as a result of the failure or damages of not less than $ 100 and not more than $ 1,000; or
(B) in the case of liability of a natural person for obtaining a consumer report under false pretenses or knowingly without a permissible purpose, actual damages sustained by the consumer as a result of the failure or $ 1,000, whichever is greater;
Page 16
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Page 16 of 18
(2) such amount of punitive damages as the court may allow; and
(3) in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court. . . .
78.
The FCRA, 15 U.S.C. §1681p, provides:
§ 1681p. Jurisdiction of courts; limitation of actions An action to enforce any liability created under this title [15 USCS §§ 1681 et seq.] may be brought in any appropriate United States district court, without regard to the amount in controversy, or in any other court of competent jurisdiction, not later than the earlier of-(1) 2 years after the date of discovery by the plaintiff of the violation that is the basis for such liability; or
(2) 5 years after the date on which the violation that is the basis for such liability occurs.
WHEREFORE, plaintiff requests that the Court enter judgment in favor of plaintiff and the class members and against defendants as follows:
a.
For statutory damages of $100 to $1,000 per violation; b.
For attorney’s fees, litigation expenses and costs; c.
For such other and further relief as the Court may deem proper, including punitive damages.
s/Daniel A. Edelman Daniel A. Edelman
Page 17
Case 1:08-cv-02134 Document 1 Filed 04/15/2008 Daniel A. Edelman Cathleen M. Combs James O. Latturner EDELMAN, COMBS, LATTURNER & GOODWIN, LLC 120 S. LaSalle Street, 18th Floor Chicago, Illinois 60603
(312) 739-4200
(312) 419-0379 (FAX) URY DEMAND Plaintiff demands trial by jury. s/Daniel A. Edelman Daniel A. Edelman T:\21297\Pleading\Complaint_Pleading.wpd 17 Page 17 of 18
Page 18
Case 1:08-cv-02134
Document 1
Filed 04/15/2008
Page 18 of 18
NOTICE OF LIEN
Please be advised that we claim a lien upon any recovery herein for 1/3 or such amount as a court awards.
s/Daniel A. Edelman Daniel A. Edelman
Daniel A. Edelman EDELMAN, COMBS, LATTURNER & GOODWIN, LLC 120 S. LaSalle Street, 18th Floor Chicago, Illinois 60603
(312) 739-4200
(312) 419-0379 (FAX)
Back to 
