More than a decade ago, Congress attempted to address a novel threat that was then only in its nascent stages: identity theft.  The Fair and Accurate Credit Transactions Act of 2003 (“FACTA”) provided consumers with several tools to protect their identity, including the ability to request free annual credit reports from the three major credit reporting agencies and to place fraud alerts on their credit files if they suspected they had been the victims of identity theft.  The Act also prohibited businesses from printing more than the last five digits of a customer’s credit card number (or the expiration date) on a receipt.  Anyone who has used a credit card over the past decade has undoubtedly seen Congress’s handiwork in the truncated account number (“***********12345”) that appears on most credit card receipts—preventing would-be fraudsters from stealing credit card numbers from discarded or misplaced receipts.

On Tuesday, the Sixth Circuit became the latest court to address what happens when a merchant fails to truncate a credit card number as directed by Congress.  In Thomas v. TOMS King (Ohio) LLC, the plaintiff alleged that defendants provided her with a receipt that included both the first six and the last four digits of her credit card number.  On behalf of herself and other similarly situated customers, she brought suit for violation of 15 U.S.C. 1681c(g)(1), which specifically prohibits any person who “accepts credit cards or debit cards for the transaction of business” from “print[ing] more than the last 5 digits of the card number or the expiration date upon any receipt provided to the cardholder at the point of the sale or transaction.”  Under FACTA, any person who willfully violates this provision is liable for actual damages or statutory damages ranging from $100 to $1000, plus punitive damages and attorney’s fees.  See 15 U.S.C. § 1681n(a)(1)(A).

Although there was no dispute that the receipts issued by defendants technically violated FACTA, the question before the court was whether plaintiff had alleged a “concrete injury” sufficient to confer standing in federal court.  Plaintiff did not allege that her credit card number had actually been stolen (or that anyone else had even seen the receipt, for that matter).  Instead, she claimed that printing both the first six and last four digits of her credit card number on the receipt increased her risk of identity theft, and required her to take additional steps (e.g., saving the receipt) to protect herself from credit card fraud.

The Sixth Circuit rejected plaintiff’s claims, holding that she had failed to allege a concrete injury sufficient to confer standing.  In the court’s view, plaintiff had not established that disclosing the first six digits of her credit card number (which revealed only the issuer of the card) increased her risk of identity theft—even if doing so did technically violate the statute.  In the absence of allegations linking this statutory violation to an actual risk of identity theft—and given the fact that the receipt itself had not been lost, stolen, or even seen by a third party—the court concluded that plaintiff had not sufficiently alleged a concrete injury to support standing.

In so holding, the Sixth Circuit joined four other circuits (the Second, Third, Ninth, and Eleventh Circuits) in concluding that technical violations of FACTA’s truncation requirement, without more, do not confer Article III standing.  See Katz v. Donna Karan Co. Store, LLC, 872 F.3d 114 (2d Cir. 2017); Kamal v. J. Crew Grp., Inc., 918 F.3d 102 (3d Cir. 2019); Noble v. Nev. Checker Cab Corp., 726 F. App’x 582 (9th Cir. 2018); Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917 (11th Cir. 2020) (en banc).  The D.C. Circuit reached the opposite conclusion in Jeffries v. Volume Servs. Am., 928 F.3d 1059 (D.C. Cir. 2019).  The receipt in that case, however, displayed all sixteen digits of the plaintiff’s credit card number plus its expiration date, and thus presented the “nightmare scenario” that FACTA was designed to prevent.  Id. at 1066.

The Sixth Circuit’s decision is a helpful reminder that not every violation of a federal statute satisfies the injury-in-fact requirement necessary for standing in federal court.  As Judge Suhrheinrich concluded (writing for the panel), “The bottom line in these cases, as in the one before us now, is that statutory-injury-for-injury’s sake does not satisfy Article III’s injury in fact requirement.”

A copy of the panel’s decision is available here.