The opinion of the court was delivered by: Blanche M. Manning United States District Judge
In 1950, Diners Club issued its first credit cards, crafted from cardboard, so diners could charge meals in 27 restaurants in New York City. One year later, nearly 20,000 Americans had a Diners Club card. In 1958, American Express and BankAmericard (now Visa) created credit cards that rapidly gained acceptance as the words "charge it!" became part of the American lexicon. See M.J. Stephey, A Brief History of: Credit Cards, TIME, Apr. 2009, available at http://www.time.com/time/magazine/article/0,9171,1893507,00.html (last visited Sept. 26, 2011).
The ease and convenience of signing for purchases made on credit, however, had negative repercussions that likely were not contemplated back in the 1950s. Specifically, after credit card identity theft based on misappropriated credit card information became an unfortunate reality for many Americans, the Fair and Accurate Credit Transactions Act ("FACTA"), 15 U.S.C. § 1681c(g), was enacted. Among other things, FACTA prohibits merchants from printing the expiration date or more than the last five digits of a credit or debit card number on electronically printed receipts provided at the point of sale.
In this case, plaintiff Natalie Van Straaten seeks to represent a class of consumers who used Shell's proprietary credit and debit cards at Shell gas stations. Ms. Van Straaten contends that Shell Oil Products Company, Equilon, and Shell Oil (collectively Shell) improperly truncated the digits on Shell's payment cards by masking the wrong digits on the receipt. Shell's motion for summary judgment is before the court. For the following reasons, Shell's motion is denied.
The following facts are undisputed unless otherwise noted.
Credit and debit card transactions are overwhelmingly processed electronically. Electronic processing uses electronically encrypted data in the magnetic stripe on the back of a payment card, as opposed to the numbers that are embossed on the front of the card. International standards promulgated by the International Organization for Standardization and the International Electrotechnical Commission govern, among other things, the data contained in the magnetic stripe. The information in the magnetic stripe allows electronic point of sale terminals to read data and process transactions after a card is swiped. Thus, when a consumer uses a card, the data in the magnetic stripe is transmitted to an intermediate institution and then to the cardholder's bank, after which an electronic signal approving or rejecting the transaction is sent back to the merchant's point of sale terminal.
International standards mandate that every payment card's magnetic stripe must contain a series of digits called the primary account number, or PAN. The PAN consists of account and other numbers that are prescribed by international standards and recognized throughout the payment card industry. It consists of a maximum of 19 digits, and includes digits identifying the industry associated with the card, the card holder, and the card issuer. The following diagram illustrates the composition of the PAN:
ISO/IEC standard 7812-1, attached as Ex. C to the plaintiff's statement of facts.
For example, the PAN for a financial institution card such as Visa or MasterCard starts with a 5, a travel and entertainment card such as American Express starts with a 3, and a petroleum industry card starts with a 7. The PAN also contains digits constituting the "individual account identification" for the card holder. Next, the PAN contains a "check digit" that acts as an anti-fraud measureand is a number derived from an algorithm known as the "Luhn formula." See Joe Celko, Joe Celko's Thinking in Sets: Auxiliary, Temporal, and Virtual Tables in SQL § 8.3.3 (2008). The PAN may also include digits indicating the specific card issued to an account that has multiple cards (ex: Jane and John Doe's cards associated with their joint account may contain digits that indicate whether the card is Jane's or John's).
B. Numbers Embossed on the Front of a Payment Card
Because digits embossed on the front of a payment card are irrelevant to electronic processing, which relies on the data in the magnetic stripe, there are no international standards governing which numbers should be embossed onto the front of a payment card. As a general rule, the numbers embossed on the front of the card correspond to data in the magnetic stripe, as none of the data in the stripe (the PAN and other information) is visible to the naked eye.
Each type of card (Visa, MasterCard, etc.) has all or a part of the PAN embossed onto the front of the card. To the extent that PAN digits are omitted from the front of a card, those omitted digits are not at the end of the PAN. To illustrate, assume that the PAN for hypothetical payment card Z contains 18 digits. The front of that card has the last 15 of those digits embossed on its face, which means that the last five digits of the PAN and the last five digits on the front of the payment card are identical:
PAN = 1 2 3 4 5 6 7 8 9 A B C D E F G H I
Face of the card = 4 5 6 7 8 9 A B C D E F G H I
With respect to Shell payment cards, the system governing the arrangement and labeling of the numbers embossed on the front was designed more than 50 years ago by a Shell employee whose name has been lost to the ages. The numbers embossed on the front are taken from the PAN. The digits are arranged in two groups labeled "account number" (on the left) and "card number" (on the right):
Dkt. No. 85, Page ID#536. Each number has a designated significance.
The method Shell used to select the digits comprising Shell's so-called "card number" causes many of its payment cards to have the same digits in the area of the card designated as the "card number." According to Shell, this duplication (as opposed to the more unique sequence of digits in the "account number" section of a Shell payment card) makes it difficult for a merchant to use digits from Shell's "card number" to cross-reference receipts and other documents when performing returns, refunds, and chargebacks.
D. Electronically Printed Receipts and Masking
The software controlling electronic processing of credit and debit card transactions dictates which PAN digits will be printed on the receipt. When electronic processing started, receipts contained the entire PAN, the card's expiration date, and the cardholder's name. This made things easy for identity thieves. To combat the growing problem of identify theft, Visa, by contract with its merchants, began to require the software to mask all but the last four digits of the PAN.
Turning back to hypothetical payment card Z, which has an 18-digit PAN with the last 15 digits of the PAN embossed on its face, the PAN, face of the card, and the electronically printed ...