Visa Double Dipping in Fraud Cases, Shifting Costs to Retail

Washington, DC – The Retail Litigation Center (RLC) is supporting Sally Beauty Holdings in a legal fight with Visa over an unlawful penalty provision that Visa uses to shift costs to merchants after they have suffered a data breach.

Despite technology available to Visa to mitigate data breaches and fraud (such as replacing old magnetic stripes on cards to newer chip-and-Pin technology), Visa imposed a penalty program for data breaches designed to shift the costs associated with fraud from banks to merchants. The Visa Global Compromised Account Recovery (GCAR) program benefits its card-issuing member banks while retailers along with customers incur the consequences of Visa’s insecure system.

Sally Beauty sued Visa and won in Texas court arguing that the Visa GCAR program sets up an unlawful penalty provision under California law – Visa’s choice-of-law jurisdiction. Visa is appealing the decision to the second district court of appeals in Fort Worth, Texas.

The Retail Litigation Center filed an amicus brief in support of Sally Beauty Holdings arguing that GCAR is an unlawful penalty program because it facilitates double recovery of losses, which is prohibited by California liquidated damages law: interchange fees are already intended to compensate credit card companies like Visa for costs like security expenses and losses.

“The district court’s holding that the GCAR program is an unenforceable penalty is correct as a matter of law and will not undermine the integrity of the payment system. But the harm to merchants from reversal of the decision—both from the imposition of unlawful penalties and from the prospect of continued Visa enforcement arrogance—will be real,” said Deborah White, RLC president.  

In their appeal Visa claims the GCAR fraud recovery process is crucial to the continued integrity of the Visa ecosystem. Yet, Visa itself eliminated a key element of GCAR in 2017 as chip cards replaced magstripe-only cards in the United States and the payment card network sky still has not fallen.

“There is no reason to think the invalidation of GCAR will leave card issuers without a remedy for recovering incremental operating expenses when they can show they are entitled to such a remedy following a data breach,” said White. “Rather, invalidating GCAR merely strips card issuers of their current undeserved windfall recoveries of millions of dollars following a data breach without regard to what, if any losses they actually suffered or whether the merchant actually had a factual or legal liability for the breach.”

The brief was drafted by Steve Cannon, Owen Glist and Richard Levine of Constantine Cannon, an RLC Law Firm Member. The case is Visa Inc., v. Sally Beauty Holdings, Inc. Peyton Smith and Patrice Pujols of RLC Law Firm Member Forman Watkins are local counsel in the case for the Retail Litigation Center.

###

Retail Litigation Center

Directed by the chief legal officers of the country's leading retail companies, the Retail Litigation Center (RLC) is the only organization dedicated to advocating for the industry's top priorities in the federal and state judiciary. The RLC also works with leading law firms and retail corporate counsel to develop forward-thinking strategies to combat meritless mass action litigation. Founded by the Retail Industry Leaders Association (RILA) in 2010 as an independent organization, the RLC is a 501(c)(6) membership association open to all retailers and select law firms.

Tags

• Legal Affairs & Compliance
• Retail Litigation Center
• Finance