Court Throws Out Last Part of PSECU's Case Against Retailer, Processor; Other CU Cases Still Active

SCRANTON, Pa. – A U.S. District Court has thrown out the case brought by the $2.3 billion Pennsylvania State Employees Credit Union trying to recoup damages from a card data breach. In early 2004, a card data breach at B.J.’s Wholesale Club came to light that was made worse by the retailer having held onto card data in violation of Visa’s regulations. The compromise of that data made the card accounts especially vulnerable to fraud and meant that CUs around the country, including PSECU, had to close and reissue thousands of their card accounts. PSECU sued the retailer and its merchant processor, Fifth Third Bank, for the roughly $100,000 the CU said it cost to replace the cards and the court threw out the majority of the case in October 2005, but left intact a complaint against Fifth Third. The bank made a motion for reconsideration of that complaint and the court threw out that complaint as well. Essentially, the court found that the CU is not a “third party beneficiary” to the contract between Fifth Third Bank and Visa, a contract that was violated when the retailer retained consumer card data in violation of Visa regulations. It also found that there were no provisions in the contract between Fifth Third and Visa to allow compensation for the cost of preventing fraud after a card breach, only for the cost of the breach itself. “The compliance process does not provide issuers a means to recover `operational costs,’” the Court wrote in its 32-page opinion letter rejecting PSECU’s last argument. “These include card replacement costs, the damages PSECU seeks here. An issuer’s cancellation and reissuance of compromised Visa cards prevents further fraud losses and protects the acquirer from the consequences of its breach; nonetheless, the Visa System does not provide any mechanism for issuers to recover the costs associated with that card replacement,” the court added. The CU has not decided whether or not it will appeal the decision, according to PSECU CEO Greg Smith. “The great irony here is that we were the parties in all of this who did what we were supposed to do,” Smith said. “We looked after the interests of our members, we kept our fraud controls up to date and in place, we relied on other parties in the Visa system to do what they were supposed to do too, and they didn’t. But we are the ones who had to pay the costs for the breach, the ones who were keeping up our end of the contract.” Interestingly PSECU and CUs like them were not the only ones to have to pay. The decision revealed that Fifth Third has had to pay almost $873,000 in damages to Visa issuers for direct fraud losses as a result of the breach, as well as $550,000 to Visa in the form of fines and penalties for having kept the data in the first place, as well as changing its system to stop holding onto the data. Smith agreed that the loss of the case highlighted the need for increased clarity in federal law about who owes what in these sorts of card data breach cases, and that Visa’s regulations and procedures alone will not be enough to bring about changes in behavior. “One of the reasons we brought this case was not as much the money as much as it was a desire to bring home to retailers and processors how important it is to be careful with this data,” Smith said. “We wanted there to be a real cost to these kinds of things that would focus their attention on prevention,” he added, noting that this sort of provision was not included in any of the current federal legislation on the topic. Story Not Over Yet Even though PSECU’s case has been lost at this level, it is not the only CU case seeking compensation from B.J.’s and Fifth Third. CUNA Mutual, which also suffered damage on account of the breach, has brought a case in Massachusetts’ state court on behalf of credit unions. The insurer has better hopes for its case because of the different venue and because it brought the suit on different grounds, according to Phil Tschudy, CUNA Mutual spokesman. “We do not see the ruling in the PSECU case as having any bearing on our case against B.J.’s,” Tschudy said. “PSECU only asserted claims for Breach of Contract (as a Third Party Beneficiary) and for Negligence. Those claims were also dismissed in our case. However, we also asserted claims for Fraud and Negligent Misrepresentation and a claim under Massachusetts’ Unfair Business Practices statute. Those claims survived a motion to dismiss in our case, which allowed it to proceed.” Tschudy pointed out that CUNA Mutual’s claims argue that B.J.’s represented to the credit union card issuers that it would not store full magnetic stripe data. In addition, Fifth Third Bank represented that it would require B.J.’s to follow the rules against storing full mag stripe data. The insurer’s case asserts that the parties either knew such representations were not true or were negligent in not knowing whether they were true; that the credit unions’ relied on those representations; and that the credit unions were harmed as a result of those representations being untrue, Tschudy explained. [email protected]