Retailers Rout Bankers In Fraud Liability Fight

If you shop at T.J. Maxx or Marshalls department stores frequently, you might remember where you were when you heard the news on Jan. 17.

That’s the day TJX Cos., the Framingham, Mass.-based owner of 2,500 retail stores including the two above, announced that its computer system had breached large amounts of customer data.

More than three months later, the company revealed that the number of credit and debit cards that had been stolen was, um, you know, an itty-bitty 45.7 million.

The resulting rush of anger didn’t come just from shoppers but from banks and credit unions, many of which have each reissued thousands of debit and credit cards at their own expense.

The hit was particularly bad for some smaller institutions, which generally lack sophisticated theft detection software. So many community banks and smaller credit unions simply reissued cards for all of the customers whose data was at risk, rather than just monitoring the affected accounts.

Dennis Cardello, president of the Collinsville Savings Society, has joined the bankers associations of both Connecticut and Massachusetts, as well as the Credit Union League of Connecticut, in suing TJX.

“I think it’s hurt the entire financial industry and it’s time to take a stand,” he said in an interview.

And it’s not just a monetary issue. As Rheo Brouillard, president of the Savings Institute Bank and Trust in Willimantic, told the Banks Committee in February: “It is our reputation that is tarnished, because we have to notify our customer, and they often associate that notification with an admission that we are somehow responsible.”

So banks came to the state legislature out for revenge. They wanted the retailers to pay. Literally.

Payment Plan
The bill proposed by the banks, and pushed by Connecticut Bankers Association lobbyist Thomas S. Mongellow and Fritz Conway of Gaffney, Bennett and Assoc., would have made retailers that lose customer data liable to banks for the cost of canceling and reissuing cards; closing and opening accounts; refunds to customers for stolen funds; and the cost of providing assistance to customers to mitigate their inconvenience. They wanted retailers to be left holding the entire bag.

The chairs of the Banks Committee seemed primed for action. Both considered –- and still find — TJX at fault for losing customer data.

“I still blame TJX. They should be blamed, they should be sued, they should be fined,” said state Sen. Bob Duff (D-Norwalk), in an interview.

But on the other side was Timothy G. Phelan, president of the Connecticut Retail Merchants Association, along with the team at Murtha Cullina, the association’s contract lobbyists.
Phelan began suggesting that the real bad guys in the TJX case were the hackers.

“TJX was a victim of a crime,” Phelan says. Not only that, he argues, but retailers that accept credit and debit card payments are at the whim of a system put in place by Visa and Mastercard, which are owned and implemented by banks. They were doubly victims.“We haven’t come to the legislature and said, ‘Give us relief from the Visa-Mastercard issue,’” even though the financial institutions are the ones that created it, Phelan said.

After Phelan brought the ‘We’re a Victim’ pitch around to senators for a few weeks, the careless, irresponsible discount retailer didn’t look so bad.

It’s a case study in the work that many corporate and industry groups do each session: madly scour proposed legislation and –- upon finding something injurious –- fight like heck to kill it.

On May 16, Sen. Duff did just that, concerned that he could end up putting mom-and-pop shops at risk because many of them use third-party companies to process credit purchases. If those processors got hacked, he didn’t want the sandwich shop around the corner being forced under amid payments to banks.

“I really wanted to do something on this, but in the end we couldn’t put something together,” Duff said.

The other chair, Rep. Ryan Barry (D-Manchester), still supports the idea, but would have to find a way to revive it in the House.

“They worked the bill very hard,” Rep. Barry said of the retailers. After he’d heard of Sen. Duff’s decision, he gave Phelan his due.

“I went by to Tim and I said, ‘Congratulations.’”

Jonathan O’Connell is a Hartford Business Journal Staff Writer.