Van Straaten v. Shell Oil Products Co.

• Decision Date: 08 December 2011
• Docket Number: No. 09 C 1188.,09 C 1188.
• Citation: 813 F.Supp.2d 1005
• Parties: Natalie VAN STRAATEN, Plaintiff, v. SHELL OIL PRODUCTS COMPANY LLC, Equilon Enterprises LLC, and Shell Oil Company, Defendants.
• Court: U.S. District Court — Northern District of Illinois

813 F.Supp.2d 1005

Natalie VAN STRAATEN, Plaintiff,

v.SHELL OIL PRODUCTS COMPANY LLC, Equilon Enterprises LLC, and Shell Oil Company, Defendants.

No. 09 C 1188.

United States District Court, N.D. Illinois, Eastern Division.

Sept. 26, 2011.Statement Granting Motion for Certification of Appealability Dec. 8, 2011.

John R. Wylie, Donaldson & Guin LLC, Martin Jay Oberman, Chicago, IL, for Plaintiff.

Ray G. Rezner, Rachael M. Trummel, Sarah B. Waxman, Shermin Kruse, Barack

Ferrazzano Kirschbaum & Nagelberg LLP, Chicago, IL, for Defendants.

MEMORANDUM AND ORDER

BLANCHE M. MANNING, District Judge.

In 1950, Diners Club issued its first credit cards, crafted from cardboard, so diners could charge meals in 27 restaurants in New York City. One year later, nearly 20,000 Americans had a Diners Club card. In 1958, American Express and BankAmericard (now Visa) created credit cards that rapidly gained acceptance as the words “charge it!” became part of the American lexicon. See M.J. Stephey, A Brief History of: Credit Cards, TIME, Apr. 2009, available at http:// www. time. com/ time/ magazine/ article/ 0, 9171, 1893507, 00. html (last visited Sept. 26, 2011).

The ease and convenience of signing for purchases made on credit, however, had negative repercussions that likely were not contemplated back in the 1950s. Specifically, after credit card identity theft based on misappropriated credit card information became an unfortunate reality for many Americans, the Fair and Accurate Credit Transactions Act (“FACTA”), 15 U.S.C. § 1681c(g), was enacted. Among other things, FACTA prohibits merchants from printing the expiration date or more than the last five digits of a credit or debit card number on electronically printed receipts provided at the point of sale.

In this case, plaintiff Natalie Van Straaten seeks to represent a class of consumers who used Shell's proprietary credit and debit cards at Shell gas stations. Ms. Van Straaten contends that Shell Oil Products Company, Equilon, and Shell Oil (collectively Shell) improperly truncated the digits on Shell's payment cards by masking the wrong digits on the receipt. Shell's motion for summary judgment is before the court. For the following reasons, Shell's motion is denied.

I. Background

The following facts are undisputed unless otherwise noted.

A. The Magnetic Stripe

Credit and debit card transactions are overwhelmingly processed electronically. Electronic processing uses electronically encrypted data in the magnetic stripe on the back of a payment card, as opposed to the numbers that are embossed on the front of the card. International standards promulgated by the International Organization for Standardization and the International Electrotechnical Commission govern, among other things, the data contained in the magnetic stripe. The information in the magnetic stripe allows electronic point of sale terminals to read data and process transactions after a card is swiped. Thus, when a consumer uses a card, the data in the magnetic stripe is transmitted to an intermediate institution and then to the cardholder's bank, after which an electronic signal approving or rejecting the transaction is sent back to the merchant's point of sale terminal.

International standards mandate that every payment card's magnetic stripe must contain a series of digits called the primary account number, or PAN. The PAN consists of account and other numbers that are prescribed by international standards and recognized throughout the payment card industry. It consists of a maximum of 19 digits, and includes digits identifying the industry associated with the card, the card holder, and the card issuer. The following diagram illustrates the composition of the PAN:

Image 1 (4.29" X 1.93") Available for Offline Print ISO/IEC standard 7812–1, attached as Ex. C to the plaintiff's statement of facts.

For example, the PAN for a financial institution card such as Visa or MasterCard starts with a 5, a travel and entertainment card such as American Express starts with a 3, and a petroleum industry card starts with a 7. The PAN also contains digits constituting the “individual account identification” for the card holder. Next, the PAN contains a “check digit” that acts as an anti-fraud measure and is a number derived from an algorithm known as the “Luhn formula.” See Joe Celko, Joe Celko's Thinking in Sets: Auxiliary, Temporal, and Virtual Tables in SQL § 8.3.3 (2008). The PAN may also include digits indicating the specific card issued to an account that has multiple cards (ex: Jane and John Doe's cards associated with their joint account may contain digits that indicate whether the card is Jane's or John's).

B. Numbers Embossed on the Front of a Payment Card

Because digits embossed on the front of a payment card are irrelevant to electronic processing, which relies on the data in the magnetic stripe, there are no international standards governing which numbers should be embossed onto the front of a payment card. As a general rule, the numbers embossed on the front of the card correspond to data in the magnetic stripe, as none of the data in the stripe (the PAN and other information) is visible to the naked eye.

Each type of card (Visa, MasterCard, etc.) has all or a part of the PAN embossed onto the front of the card. To the extent that PAN digits are omitted from the front of a card, those omitted digits are not at the end of the PAN. To illustrate, assume that the PAN for hypothetical payment card Z contains 18 digits. The front of that card has the last 15 of those digits embossed on its face, which means that the last five digits of the PAN and the last five digits on the front of the payment card are identical:

PAN = 1 2 3 4 5 6 7 8 9 A B C D E F G H I

Face of the card = 4 5 6 7 8 9 A B C D E F G H I

C. Shell Payment Cards

With respect to Shell payment cards, the system governing the arrangement and labeling of the numbers embossed on the front was designed more than 50 years ago by a Shell employee whose name has been lost to the ages. The numbers embossed on the front are taken from the PAN. The digits are arranged in two groups labeled “account number” (on the left) and “card number” (on the right):

Image 2 (3.52" X 2.24") Available for Offline Print Dkt. No. 85, Page ID# 536. Each number has a designated significance.

The method Shell used to select the digits comprising Shell's so-called “card number” causes many of its payment cards to have the same digits in the area of the card designated as the “card number.” According to Shell, this duplication (as opposed to the more unique sequence of digits in the “account number” section of a Shell payment card) makes it difficult for a merchant to use digits from Shell's “card number” to cross-reference receipts and other documents when performing returns, refunds, and chargebacks.

D. Electronically Printed Receipts and Masking

1. Pre–FACTA

The software controlling electronic processing of credit and debit card transactions dictates which PAN digits will be printed on the receipt. When electronic processing started, receipts contained the entire PAN, the card's expiration date, and the cardholder's name. This made things easy for identity thieves. To combat the growing problem of identify theft, Visa, by contract with its merchants, began to require the software to mask all but the last four digits of the PAN.

Turning back to hypothetical payment card Z, which has an 18–digit PAN with the last 15 digits of the PAN embossed on its face, the PAN, face of the card, and the electronically printed receipt issued following Visa's protocol are as follows:

PAN = 1 2 3 4 5 6 7 8 9 A B C D E F G H I

Face of the card = 4 5 6 7 8 9 A B C D E F G H I

Receipt = X X X X X X X X X X X F G H I

Due to Visa's size, its PAN masking protocol became the unofficial standard. In the meantime, states passed their own masking statutes to fight identity theft. These statutes often contained inconsistent terms. Eventually, Congress enacted FACTA in an effort to wipe out the patchwork of conflicting state laws and protect consumer credit information.

2. FACTA

The masking provisions in FACTA provide that:

(g) Truncation of credit card and debit card numbers

(1) In general

Except as otherwise provided in this subsection, no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number

or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.

(2) Limitation

This subsection shall apply only to receipts that are electronically printed, and shall not apply to transactions in which the sole means of recording a credit card or debit card account number is by handwriting or by an imprint or copy of the card.

15 U.S.C.A. § 1681c(g) (emphasis added).

3. Shell's Masking Protocol

Shell designed its masking protocol before FACTA's enactment. After FACTA was enacted, Shell employees who are not attorneys analyzed the statute and related materials and decided that Shell's pre-FACTA masking protocol complied with FACTA. Under Shell's masking protocol, every digit embossed on the face of a payment card (which, the reader will recall, is a subset of the numbers comprising the PAN) is masked except the last 4 digits of what Shell calls the “account number,” which is the first group of numbers embossed on the front of a Shell payment card. Thus, an electronically processed receipt from a purchase made with a Shell payment card looks like this:

+-------------------------------+
                ¦XXX XX1234       ¦XXXXX        ¦
                +-----------------+-------------¦
                ¦—ACCOUNT NUMBER— ¦—CARD NUMBER—¦
                +-------------------------------+
                

Exp Date: XXX
                

Ms. Van Straaten contends that Shell is masking the wrong numbers because the relevant numbers on a Shell card under FACTA consist of the entire sequence of digits on the front of a Shell's payment card, which corresponds with the PAN. Ms. Van Straaten...