Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Court Says California Stores Can't Ask Customers For ZIP Codes

timothy posted more than 3 years ago | from the mine-was-just-a-bunch-of-sixes-anyhow dept.

Privacy 461

Hugh Pickens writes writes "CNN reports that the California Supreme Court has ruled that retailers in California don't have the right to ask customers for their ZIP code while completing credit card transactions, saying that doing so violates a cardholders' right to protect his or her personal information, pointing to a 1971 state law that prohibits businesses from asking credit cardholders for 'personal identification information' that could be used to track them down. 'The legislature intended to provide robust consumer protections by prohibiting retailers from soliciting and recording information about the cardholder that is unnecessary to the credit card transaction,' the decision states. 'We hold that personal identification information ... includes the cardholder's ZIP code.' In her lawsuit, Jessica Pineda claimed that a cashier at Williams-Sonoma had asked for her ZIP code during a purchase — information that was recorded and later used, along with her name, to figure out her home address by tapping a database that the company uses to market products to customers and sell its compiled consumer information to other businesses."

cancel ×

461 comments

Worse is (4, Informative)

Beowulf_Boy (239340) | more than 3 years ago | (#35170508)

Worse is O'Reilly auto parts. They want your name, address and phone number.
They told me it was for "warranty information". I was buying a quart of oil.

I walked out and went and bought it at Walmart instead.

Re:Worse is (1)

HeronBlademaster (1079477) | more than 3 years ago | (#35170568)

I tell stores "you don't need my zip code" when they ask. As far as I can tell, they just enter "00000" into their terminal instead.

Re:Worse is (4, Insightful)

0100010001010011 (652467) | more than 3 years ago | (#35170704)

I'm from 90210.
My phone number is: 123-456-7890 OR the local police department's phone number.

My name if paying cash is John Doe.

Yes I've gotten some raised eye brows, but all I do then is tell them to prove me wrong.

Postcode (3, Interesting)

Roger W Moore (538166) | more than 3 years ago | (#35170968)

It's even more fun when you don't actually live in the US and are just visiting. They typically get very confused when you start saying letters.

Re:Worse is (5, Funny)

pushing-robot (1037830) | more than 3 years ago | (#35170752)

I tell stores "you don't need my zip code" when they ask.

Please, please tell me you wave your hand as you say that.

Re:Worse is (1)

HeronBlademaster (1079477) | more than 3 years ago | (#35170902)

Hahaha. Thanks, I need a laugh :) I think I might do that from now on...

Re:Worse is (2, Interesting)

Fishead (658061) | more than 3 years ago | (#35170590)

There's a store in my neck of the woods, Princess Auto. They ask my phone number every purchase. I used to politely decline (and they'd always politely accept) until I was with a neighbour who returned something without a receipt. They asked his phone number, and promptly exchanged the item. With a store that touts "No sale is final until you are happy", I love giving them my number as they store a transaction a lot longer then I hang onto a receipt. I have abused and returned all sorts of tools without a receipt since then.

or Radio Shack (0)

MrEricSir (398214) | more than 3 years ago | (#35170598)

Radio Shack asks (or used to ask) for your zip code on any purchase -- even if you were buying batteries and paying cash.

(This may have changed at some point; I haven't bought anything at Radio Shack in the past two decades.)

Re:or Radio Shack (1)

AvitarX (172628) | more than 3 years ago | (#35170948)

They used to get your whole address.

They used it to send catologs and cue cats.

Re:Worse is (5, Insightful)

idle12 (1871570) | more than 3 years ago | (#35170710)

I went to go get a Hair Cut. Yes, a hair cut and they handed me a form on a clip board that wanted:

my name (including last).
Phone Number
Address
Email address

Which is ridiculous to start with; but to top it off they also wanted:
Emergency contact (seriously?)
Any medical conditions I might suffer from that would impair or need to warn the hair dresser about? (um?)
Any family members or friends that might be interested in getting a hair cut. (wtf)
and a "short" 2 page survey with questions like "How often do you get your hair cut?"

This wasn't some high end fancy pants place. It was Great Clips or ClipNSave or Cost Cutters, one of the big ones. Hair cuts are normally $20 and I had a 75% off coupon.

I told them "um, I'm not going to fill this out" and the snotty girl behind the counter said "well, I guess your not getting a hair cut here then"

  I agreed. Fuck everything about that.

Re:Worse is (0)

Anonymous Coward | more than 3 years ago | (#35170748)

I hope you like being a bear!

Re:Worse is (0)

Anonymous Coward | more than 3 years ago | (#35170768)

I'd assume the "medical conditions" is related to things such as bleaching, which aren't 100% safe for people with certain medical concerns.

Re:Worse is (1)

JWSmythe (446288) | more than 3 years ago | (#35170954)

    There are other conditions that they should be aware of.

    I have some decent spine problems. Some days, I can't turn my head more than 5 degrees to the left or right. That's all fine and dandy, they couldn't hope to move my head, since I can't. But some days, it's very painful to turn my head. The nice friendly motion of a barber could be the difference between me getting a haircut, and me screaming in pain.

    I just do the preferred thing, and don't let folks move my head around when it hurts. :) Then again, I'm not the type of guy to schedule a hair appointment. My standard instructions are "mow it off, leave just a little." It doesn't matter where I go, if they can't do that without leaving bald spots, they wouldn't really be in the business.

    For folks that schedule hair appointments, they're more likely to make the appointment, than consider their own health.

Legitimate reason (2)

nhtshot (198470) | more than 3 years ago | (#35170852)

Below is right about the bleach, but there are other concerns as well.

Ever been poked accidentally by a barber? Now, what happens if they draw blood (even a drop is enough) and you're HIV positive? It's a reasonable question to ask.

Or, simple things like hair lice or other vermin that could be infesting you.

Some of it is obviously marketing driven (hair cut count, family members, etc..), but the other stuff is not as sinister as it might first appear.

Pier1 does that (1)

Anonymous Coward | more than 3 years ago | (#35170514)

I have no idea why Pier1 asks me for my zipcode every time I buy something small like a mug or a pillow. And I pay cash most of the time.

How are they able to sell that information? I'm sure a better profile of me is stored in loyalty cards at Ralphs, Vons, or wherever.

Profiling neighborhood not you (1)

perpenso (1613749) | more than 3 years ago | (#35170584)

I have no idea why Pier1 asks me for my zipcode every time I buy something small like a mug or a pillow. And I pay cash most of the time. How are they able to sell that information?

They are not profiling you, they are profiling your neighborhood. They are probably trying to figure out what neighborhoods they should spend their ad money in, or trying to measure the response to advertising in neighborhoods.

Re:Profiling neighborhood not you (1)

sunderland56 (621843) | more than 3 years ago | (#35170754)

They are not profiling you, they are profiling your neighborhood.

I want to see the profile for zip code 12345 (yes, a valid zip code, somewhere in upstate NY). I'm sure that they think there are *all* kinds of weirdos living there.

Re:Pier1 does that (1)

JWSmythe (446288) | more than 3 years ago | (#35171004)

    I was wondering if someone from Cali would post. :)

    I don't know if they're still doing it, but when I was out there, you would be charged twice as much for everything in the store without their card. If I remember right, Vons, Ralphs, and Albertsons all did it. In other states, when I say I don't have a card, they just swipe a card that they have handy, and the "discount" is applied.

    I paid the extra anonymity tax for a while. Food stuffs there are more expensive than other places in the country. About double from where I'm living now. So a $1 item in the cheaper state is $2 in Cali, or $4 without the store card (approximate pricing, of course).

    I finally gave in, and got a card. False name, false (but legitimate) address, and even a throwaway email address. Data-mine that. The guy who "lives" in on an empty lot would buy $300 in groceries every week. Most people are sheep though. You can ask for their name, DOB, SSN, CC number and PIN, email address, and even their email password, and they'll hand it over for the "discount".

    I'm happy to be in a state again, where if they do apply such a bogus price increase, they are kind enough to take it off at the register.
   

Only applies to 'unnecessary' personal information (4, Informative)

crankyspice (63953) | more than 3 years ago | (#35170520)

The law provides for the collection of personally identifying information that's necessary for the transaction. Online, this includes the billing zip code. This ruling apples to card-present retail transactions. FYI. Here's the entire decision: http://www.courtinfo.ca.gov/opinions/documents/S178241.PDF [ca.gov]

Re:Only applies to 'unnecessary' personal informat (5, Informative)

Anonymous Coward | more than 3 years ago | (#35170586)

The law provides for the collection of personally identifying information that's necessary for the transaction. Online, this includes the billing zip code. This ruling apples to card-present retail transactions. FYI. Here's the entire decision: http://www.courtinfo.ca.gov/opinions/documents/S178241.PDF [ca.gov]

Except the billing zip code happens to be a very important (though not the only) piece of AVS (Address Verification System), which is used to combat fraud. In a nutshell, the merchant submits the customer's address along with their card info, and (depending on the merchant's arrangement) the credit card processor checks to make sure certain parts of that address match what's associated with that card number. Zip code happens to be one of the most reliable.

Re:Only applies to 'unnecessary' personal informat (1)

Anonymous Coward | more than 3 years ago | (#35170640)

The problem is that merchants are not requesting the zip code to verify the credit card transaction. The merchant collects the zip code for marketing, and that is impermissible because the zip code is part of the consumer's protected personal information re: credit card transactions. If merchants asked--or more likely, had you input the zip code like you do at a gas station kiosk--for the zip code for verification purposes then your analysis would be correct. But they don't.

Re:Only applies to 'unnecessary' personal informat (1)

davester666 (731373) | more than 3 years ago | (#35170684)

Unfortunately, there doesn't seem to be a way to get the retailer to only use my address for this purpose.

Re:Only applies to 'unnecessary' personal informat (0)

Anonymous Coward | more than 3 years ago | (#35170688)

While asking for a zip code may be necessary, retailers (despite their insistence) do not have the right to require that you show identification.

Every major credit card company I'm aware of has explicit terms in their merchant agreements that prohibits the requirement of "supplementary identification" to complete a transaction.

If they tell you their store policy requires it, feel free to require them to call the credit card company and be told they can't :-)

About the only time they can get away with requiring that you show identification is when state law does so (e.g. tobacco

Re:Only applies to 'unnecessary' personal informat (1)

dgatwood (11270) | more than 3 years ago | (#35170892)

Just about every time I go to Fry's, they ask for my ID. Just about every time, I file a merchant complaint with Mastercard.

I wonder if this ruling is why the gas station I bought fuel from this afternoon didn't ask for my billing ZIP code for the first time ever. It immediately struck me as surprising in a good way. Then, I read this story a few hours later. The timing is almost too blatant to be an accident.

Re:Only applies to 'unnecessary' personal informat (1)

Dunbal (464142) | more than 3 years ago | (#35170750)

which is used to combat fraud.

Bullshit. If my credit card company wants to talk to me and ask me security questions, they can ask the merchant to put me on the phone. The merchant is neither law enforcement nor my legal counsel. They have their arrangement with the credit card company. I have my own, separate arrangement with the credit card company. And never the twain shall meet. And if the risk of doing business is too great for that 3% or 5% or whatever they earn on every single transaction before even thinking about interest, then the credit card company should close its doors.

Re:Only applies to 'unnecessary' personal informat (1)

EvanED (569694) | more than 3 years ago | (#35170976)

If my credit card company wants to talk to me and ask me security questions, they can ask the merchant to put me on the phone.

It's not likely for the CC's company's protection, it's for the merchant's. It's the merchant that bears most of the risk for fraudulent transactions, and it's their decision to add an extra validation step.

Re:Only applies to 'unnecessary' personal informat (1)

snookiex (1814614) | more than 3 years ago | (#35170806)

Except for those countries where zip codes are not widely used. This could apply for local [US] purchases.

Re:Only applies to 'unnecessary' personal informat (1)

perpenso (1613749) | more than 3 years ago | (#35170610)

Hopefully gas station pumps can continue to ask for a ZIP rather than a PIN. Just a personal preference.

Re:Only applies to 'unnecessary' personal informat (0)

Anonymous Coward | more than 3 years ago | (#35170728)

And if gas station pumps stop asking for a ZIP the solution is obvious... change your PIN to your ZIP.

Re:Only applies to 'unnecessary' personal informat (3, Interesting)

sunderland56 (621843) | more than 3 years ago | (#35170736)

If someone steals your wallet, they have your credit card, and they have your zip code. Not very secure.

Re:Only applies to 'unnecessary' personal informat (0)

Anonymous Coward | more than 3 years ago | (#35170938)

Better than letting someone use a dropped Credit Card or copying the strip. It is not much extra to add a bit of security. If we wanted very secure, we could use a unique PIN, but for gas zip seems secure enough.

Re:Only applies to 'unnecessary' personal informat (0)

Anonymous Coward | more than 3 years ago | (#35170964)

According to one article I read, gas station use of zip is legal because the info is transmitted directly to the credit-card company for fraud prevention and not stored by the retailer.

What got them in trouble is doing unauthorized back-end matching and marketing. Gotta hand it to the sleaze-balls who argue:

"...the law was never intended as sweeping privacy legislation to prevent a retailer from using legal means to send catalogues to its customers."

and

"...this kind of litigation has caused retailers to reconsider doing business in California."

Yeah, right. We're exiting the 8th largest economy in the world because they value their privacy. Boo hoo.

Re:Only applies to 'unnecessary' personal informat (1)

Anonymous Coward | more than 3 years ago | (#35170974)

As a tourist, I find that this system sucks, as my (Australian) bank doesn't do this kind of authorisation, so any petrol pumps I've tried to use in the US have failed.

FINALLY... (1)

rtilghman (736281) | more than 3 years ago | (#35170526)

Why does it take so long for someone to finally challenge crap like this? Every time someone asks me for this kind of information at the register it just makes me mad... with so many other ways to validate my identity there is zero excuse for exposing this kind of data to retailers.

Here's to hoping this cascades to other states... who am I kidding, somewhere a lobbyist is talking with a CA state senator about when and how quickly they can amend the law.

-rt

Re:FINALLY... (1)

techwreck (1992598) | more than 3 years ago | (#35170616)

Why does it take so long for someone to finally challenge crap like this? Every time someone asks me for this kind of information at the register it just makes me mad... with so many other ways to validate my identity there is zero excuse for exposing this kind of data to retailers.

Here's to hoping this cascades to other states... who am I kidding, somewhere a lobbyist is talking with a CA state senator about when and how quickly they can amend the law.

-rt

So how would you suggest that a merchant validate your identity without revealing any personal information? As a business owner, I have no interest at all in seeing this type of information but I still must have a way to protect my business against fraud.

Re:FINALLY... (2)

zzatz (965857) | more than 3 years ago | (#35170744)

You don't need information about the person, you need information known only to the person and the card company. Using easily obtained information such as address or phone number is much less secure than a shared secret.

My credit card has my name on it. I'm the only person with that name in the phone book. Anyone who steals my card can give you my address and phone number. How's that validate the card?

It's sad that my Slashdot login is more secure than my credit card. And it preserves more of my privacy.

Re:FINALLY... (1)

nospam007 (722110) | more than 3 years ago | (#35170870)

"My credit card has my name on it. I'm the only person with that name in the phone book. "

You know that there are people not in the phone book?
It's your choice to be in the phone book, so you can't complain.

Re:FINALLY... (1)

Dunbal (464142) | more than 3 years ago | (#35170770)

The credit card company is assuming the risk, not you. Since when did Master Card have the power to deputize you and turn you into a mini police detective? They set up a system, it's their responsibility to ensure that their business model works. For that they earn billions of dollars, and you don't.

Re:FINALLY... (5, Interesting)

techwreck (1992598) | more than 3 years ago | (#35170828)

The credit card company is assuming the risk, not you. Since when did Master Card have the power to deputize you and turn you into a mini police detective? They set up a system, it's their responsibility to ensure that their business model works. For that they earn billions of dollars, and you don't.

While it would be nice if that was the case, it isn't. If someone walks out of my store with a $500 laptop computer paid for with a stolen credit card, I'm out the merchandise and the revenue when the actual card owner issues a chargeback. Think all I have to do is provide a signed charge slip to get my money back? Then you probably have never experienced the joys of attempting to do battle with a credit card company. Part of the reason that they earn billions of dollars and I don't is because they have entire departments dedicated to putting the burden of risk on the merchant and not the card issuer.

Re:FINALLY... (2)

RoFLKOPTr (1294290) | more than 3 years ago | (#35170664)

Every time someone asks me for this kind of information at the register it just makes me mad... with so many other ways to validate my identity there is zero excuse for exposing this kind of data to retailers.

A ZIP Code is hardly personal information. Who cares what city you live in? You're already giving them your name and fucking credit card info of all things... what makes a ZIP code so threatening?

Re:FINALLY... (3, Interesting)

c0lo (1497653) | more than 3 years ago | (#35170742)

TFA:

In her suit, Pineda claimed that a cashier had asked for her ZIP code during a purchase -- information that was recorded and later used, along with her name, to figure out her home address. Williams-Sonoma did this tapping a database that it uses to market products to customers and sell its compiled consumer information to other businesses.

Note that it is still legal for a business to ask your ZIP code and possibly other information. What is made illegal:
1. conditioning the sale on obtaining data which are not necessary for completing the sale transaction
2. recoding a data which is not absolutely required for completing a sale transaction.

At least this is how I interpret:

It is not illegal in California for a retailer to see a person's ZIP code or address, the ruling notes: For instance, one can request a customer's driver's license to verify his or her identity. What makes it wrong is when a business records that information, according to the ruling, especially when the practice is "unnecessary to the sales transaction."

Re:FINALLY... (2)

garcia (6573) | more than 3 years ago | (#35170700)

I don't get mad about it. I think that they should be free to ask just as I should be free to say, "no thank you," which I do every time. In most cases when you say this to them they punch in some default (Kohl's seems to do all 0s but other businesses just put in the city's zip code).

When pressured I provide 90210. The only time I've had a problem was at a RadioShack store in OH during college when I was trying to buy batteries. The dude asked for my zip code and I went through the spiel and then he laid into me, got his manger to yell at me, and finally told me never to come back into the store or they'd call the police for falsifying records.

I paid cash. No records about ME should have been kept. Ridiculous.

Re:FINALLY... (0)

nospam007 (722110) | more than 3 years ago | (#35170900)

'I think that they should be free to ask just as I should be free to say, "no thank you,"'
Really? OK, then, since I have your attention:

Your best friend dies, what would you do?

When and how was the last time you told someone HONESTLY how you felt? when was it? during the day. how was it?

What would be harder for you, to tell someone you love them or that you do not love them back?

What do you think would be the hardest thing for you to give up on?

Excluding romantic love, when was the last time you told someone you loved them?

If you had to go back in time and change one thing, if you HAD to, even if you had “no regrets” what would it be?

Imagine. It is a dark night, you are alone, it is raining outside, you hear someone walking around outside your window. Who do you call?

Would you give a homeless person CPR if they were dying?

Are you old fashioned?

Which would you choose, true love with a guarantee of a heart break or have never loved before?

If you could do anything OR wish for anything that would come true, what would you wish?

Why is it only drug dealers and software developers call their clients 'users'?

Does the Little Mermaid wear an algebra?

Do infants enjoy infancy as much as adults enjoy adultery?

How is it possible to have a civil war?

If one synchronized swimmer drowns, do the rest drown too?

If you ate pasta and antipasta, would you still be hungry?

If you try to fail, and succeed, which have you done?

Why are hemorrhoids called "hemorrhoids" instead of "assteroids"?

Why is it called tourist season if we can't shoot at them?

If the black box flight recorder is never damaged during a plane crash, why isn't the whole airplane made out of the stuff?

Why is there an expiration date on sour cream?

If man evolved from monkeys and apes, why do we still have monkeys and apes?

If all those psychics know the winning lottery numbers, why are they still working?

If a mute swears, does his mother wash his hands with soap?

Why do psychics have to ask you for your name?

OK, so what's the speed of dark?

If you add your username to your ignore list, would you not be able to read your own posts?

Why is there braille on a drive up ATM machine?

Why do we park on a driveway and drive on a parkway?

If a pin drops in a noisy classroom does anyone hear it hit the floor?

What is the most annoying habit that your girlfriend/boyfriend has?

How well "endowed" is your boyfriend or girlfriend?

Have you ever not made it to the bathroom in time and had an "accident?"

Have you ever been extremely "intimate" with someone in a public place?

What is the most embarrassing thing you've ever done?

Have you ever cheated on your boyfriend/girlfriend?

If you had only 24 hours to live, what would you do?

What is the strangest dream you've ever had?

If you could make anyone in the room your servant for the day, who would it be and what would you make them do?

If you could be born again would choose to be a different sex to what you are?

How far would you go with someone that you just met?

What is the stupidest thing you've done because someone dared you to?

What is the stupidest thing you've done on your own free will?

What's your favourite thing about the opposite sex?

What's the worst thing about being your gender?

Have you ever eaten a leaf or grass?

Have you ever peed in the shower?

Have you picked your nose when no one was looking in a public place?

After eating, do amphibians have to wait one hour before getting out of the water?

How can there be self-help groups?

If white wine goes with fish, do white grapes go with sushi?

If a mute swears, does his mother make him wash his hands with soap?

If someone has a mid-life crisis while playing hide and seek, does he automatically lose because he can't find himself?

If someone with multiple personalities threatens to kill himself, is it considered a hostage situation?

Instead of talking to your plants, if you yelled at them would they still grow, but only to be troubled and insecure?

Is there another word for synonym?

Isn't it a bit unnerving that doctors call what they do "practice"?

Just before someone gets nervous, do they experience cocoons in their stomach?

When sign makers go on strike, is anything written on their picket signs?

When you open a new bag of cotton balls, is the top one meant to be thrown away?

When your pet bird sees you reading the newspaper, does he wonder why you're just sitting there, staring at carpeting?

Where do forest rangers go to "get away from it all"?

Why isn't there a mouse-flavored cat food?

Why do they report power outages on TV?

Re:FINALLY... (1)

Mr. Slippery (47854) | more than 3 years ago | (#35170796)

Every time someone asks me for this kind of information at the register it just makes me mad.

So don't give it to them. "Zip code?" "I'd rather not." "Phone number?" "I'm sorry, I don't give that out." Haven't had a problem in over ten years of doing this. (Except the new thing with pay-at-the-pump at gas pumps, where there's no choice.)

Re:FINALLY... (1)

Anonymous Coward | more than 3 years ago | (#35170798)

Every time someone asks me for this kind of information at the register it just makes me mad...

You can always give out zip codes such as 12345 or 11101 (Both legit New York zip codes), or 90210 of course.

Takes a bit more work to memorize, but 48169 is awesome to give out if their system pulls up city/state. That one is Hell Michigan.

Other fun answers are "I don't have a zip, I live in a house boat"
or simply ask the cashier "What is Your zip code?" in a way that sounds like a poor and corny pickup line.

Typically when I am in a hurry or feeling especially antisocial, I just say "No thanks" and would have to say 99% of the time they don't even question me on it.
Maybe two or three times I got a "Excuse me?" type response, to which a "I'm just in a hurry" ends the line of questioning.

Only twice have any cashiers actually complained and claimed I have to give it to them. Both times I wordlessly left the stuff on their counter and walked out. No stress at all :D

Does that really solve the problem? (2)

techwreck (1992598) | more than 3 years ago | (#35170542)

While that makes sense in theory, merchants do have the right to verify the identity of a customer attempting to use a credit card. Won't they just request to see a driver's license instead? Then they would have access to much more personal information than just a zip code. I don't really see how this law ends up protecting anyone.

Re:Does that really solve the problem? (1)

starfishsystems (834319) | more than 3 years ago | (#35170604)

Does it really solve the problem to design a credit card that's insufficient for validating itself?

No, no they do not.. (4, Informative)

way2trivial (601132) | more than 3 years ago | (#35170608)

read an actual merchant agreement some time
(the one between the business and visa)

merchants are FORBIDDEN to ask for ID as a condition of using a credit card...

if the signature is good, and the card is present, you may NOT ask for ID just because its a credit card.

if you require ID of all purchasers say, for a hotel, you can ask for ID.. but not just because it is a credit card.....

doing so violates CC agreements.

(merchants aren't even supposed to accept cards that say CID or SEE ID)

if it is UNSIGNED, we are to request ID, then get the card holder to sign the card before accepting.

(I have a merchant agreement, I've read it, and I've read the merchant operations PDF's at the major sites)

Re:No, no they do not.. (3, Interesting)

way2trivial (601132) | more than 3 years ago | (#35170650)

There are always exceptions, but for regular Brick & Mortar retailers, asking for ID is not inside the regs.
I acknowledge, they are often ignored. here is the link-- the quote is from page 428

http://usa.visa.com/download/merchants/visa-international-operating-regulations-main.pdf [visa.com]
Supplemental Identification - U.S. Region
A U.S. Acquirer must not, as a regular practice, require a Merchant, and a Merchant must not require a
Cardholder, to provide any supplementary Cardholder information as a condition for honoring a Visa
Card or Visa Electron Card, unless it is required or permitted elsewhere in the U.S. Regional
Operating Regulations. Such supplementary Cardholder information includes, but is not limited to:
  Social Security Number (or any part thereof)
  Fingerprint
  Home or business address or telephone number
  Driver's license number
  Photocopy of a driver's license
  Photocopy of the Visa Card or Visa Electron Card
  Other credit cards

Re:No, no they do not.. (1)

sodul (833177) | more than 3 years ago | (#35170714)

I was at Target a 2-3 years back and the cashier requested the ID of the customer before me. He refused, the cashier called his manager that would not let the transaction go through without a valid id. The customer was furious and eventually showed his license even after arguing the signature was enough with his VISA credit card. I remember because the customer was really pushed back hard (yet eventually gave up) and Visa was running ads about how you do not need an idea with their card at the time (before I stopped watching TV).

So what are the consequences if a (major) merchant is not abiding by the rules ? Should I file a complaint with Visa/Amex next time they insist on my ID ?

Re:No, no they do not.. (1)

SwedishPenguin (1035756) | more than 3 years ago | (#35170766)

Weird.. How can they verify that it's your card if they can't ask for ID? At the very least, a PIN-code should be required.
In Sweden, merchants are REQUIRED to ask for ID as a condition for using a credit/debit card unless they have a card terminal where you can verify with your PIN-code.. Of course this is often ignored in places with a lot of people like bars without card terminals and for minor purchases, then signing the receipt is all they want you to do.

Re:No, no they do not.. (1)

HeronBlademaster (1079477) | more than 3 years ago | (#35170966)

It's in Visa's best interest that merchants not request ID; remember, credit card companies work very hard to make sure the merchants assume most of the risk. From Visa's perspective, they want customers to have an easy time making transactions, and not requiring ID makes it easier. They don't particularly care if someone rips off a merchant.

Re:No, no they do not.. (2)

techwreck (1992598) | more than 3 years ago | (#35170778)

read an actual merchant agreement some time (the one between the business and visa)

merchants are FORBIDDEN to ask for ID as a condition of using a credit card...

if the signature is good, and the card is present, you may NOT ask for ID just because its a credit card.

if you require ID of all purchasers say, for a hotel, you can ask for ID.. but not just because it is a credit card.....

doing so violates CC agreements.

(merchants aren't even supposed to accept cards that say CID or SEE ID)

if it is UNSIGNED, we are to request ID, then get the card holder to sign the card before accepting.

(I have a merchant agreement, I've read it, and I've read the merchant operations PDF's at the major sites)

Keep in mind that I said they have the right to "verify identity" not ask for I.D. My point is simply that most merchants will ask customers for I.D. regardless of what the merchant agreement says. Once the privacy balance is shifted in favor of crooks and those who make a living from fraudulent activity, it won't take long for businesses to stop accepting credit cards. It would make much more sense to me to focus on creating legislation aimed at those who improperly use or fail to secure personal data.

Re:Does that really solve the problem? (1)

SudoGhost (1779150) | more than 3 years ago | (#35170618)

Verifying that the name and/or photo on an ID card matches the credit card is quite different than the cashier taking the ID and recording information, I'm sure that most people can tell the difference.

And yes, while merchants do have the right to verify the identity of a customer using a credit card, the store asking for the zip code had nothing to do with that, and a zip code is hardly a secure verification at any rate.

Re:Does that really solve the problem? (1)

camperdave (969942) | more than 3 years ago | (#35170624)

merchants do have the right to verify the identity of a customer attempting to use a credit card.

Do they? Why should they? The transaction is between the merchant and the credit card company. The identity of the person holding the card is irrelevant to the merchant. It is the responsibility of the credit card company and the person to whom the card was issued that only a valid person has access to use the card. Granted, the merchant may act on behalf of the credit card company to validate the user, however it really is none of the merchant's business.

Re:Does that really solve the problem? (5, Informative)

RoFLKOPTr (1294290) | more than 3 years ago | (#35170696)

Do they? Why should they? The transaction is between the merchant and the credit card company.

You are exactly wrong. If a fraudulent purchase is made with a credit card and it is recognized and reversed, it is the merchant that takes the hit. Not the bank, not the customer, the merchant. They charge back the merchant the full amount of the purchase and then it is primarily up to the merchant to identify the suspect and prosecute the theft.

Re:Does that really solve the problem? (0)

Anonymous Coward | more than 3 years ago | (#35170956)

Exactly. Retailers aren't trying to gather info about law-abiding people using credit cards. They're trying to root out people using stolen credit cards to make purchases. Once they have your credit card number, they already know your zip. You're just flagging yourself as a possible criminal, inviting more scrutiny and investigation. Don't think retailers don't do serious investigations into the identities of people ripping them off. You have facebook, twitter, etc, they have the internet and Google. They can find out A LOT about you very quickly. Get enough attention, someone may start following you around monitoring your activities. This shit is all legal. Now, the average person will never attract this type of attention, but at the end of the day do you want to classify yourself as a customer or a crook?

Re:Does that really solve the problem? (3, Insightful)

Anonymous Coward | more than 3 years ago | (#35170712)

merchants do have the right to verify the identity of a customer attempting to use a credit card.

Do they? Why should they? The transaction is between the merchant and the credit card company. The identity of the person holding the card is irrelevant to the merchant. It is the responsibility of the credit card company and the person to whom the card was issued that only a valid person has access to use the card. Granted, the merchant may act on behalf of the credit card company to validate the user, however it really is none of the merchant's business.

It is in the merchant's best interest to ensure that the person who is presenting the card is authorized to do so (if the transaction is not authorized, guess who gets stuck with the bill... the merchant not only loses the money from the sale and transaction fees and the loss of the goods, but is usually also charged an additional fee for the chargeback). One way of doing that is by requiring "something you know" (i.e. The zip code for credit transactions, the PIN for debit transactions). This goes along with "something you have" (the card itself)

As everyone that is security minded knows, this is commonly known as two-factor authentication.

Re:Does that really solve the problem? (3, Insightful)

HeronBlademaster (1079477) | more than 3 years ago | (#35170978)

Your zip code is a very poor choice for authentication.

Stores ask for your zip code because they're interested in customer demographics, not authentication.

Re:Does that really solve the problem? (1)

Mitsoid (837831) | more than 3 years ago | (#35170994)

Yes it's a slippery situation:

They can not , according to the cardholder agreement, require you to present a photo ID to verify your identity.

They are responsible for any theft made (including fraud purchases)

However, a business -- as a private entity -- can decline to sell you product because you do not look like a "Melissa Doe" as a 35 year old man

So visa doesn't require ID be shown, but businesses still have their own right to decline a sale... kinda.. and not much you can do about it -- Visa won't penalize Best Buy or any other big store over your declined sale

Re:Does that really solve the problem? (5, Insightful)

techwreck (1992598) | more than 3 years ago | (#35170686)

As a business owner, I can tell you with 100% certainty that the day I am unable to validate the identity of a card holder and protect myself against fraud will be the day I stop accepting credit cards. While some of you think that fraud only falls on the shoulders of the credit card company, it is often the merchant that ends up on the losing end. Instead of restricting the ability of a merchant to request personal information, the legislation should be designed to penalize those who improperly use that information such as the company cited in the case above.

Re:Does that really solve the problem? (0)

Anonymous Coward | more than 3 years ago | (#35170804)

Good for you.

I can tell you as a customer that the day I have to show my driver's license to your cashier is the day I go to a different business.

Your cashier is a stranger to me and there is no way I'm going to show them my home address. My wife and daughter won't do it either. Fortunately, your agreements with Visa and MC prohibit you from requiring ID. You can request it but you can't require it.

I've had it happen many times and I've always filed a formal complaint when someone refuses to complete a transaction without seeing my ID. I've never re-visited such a store again and been asked for ID.

I find it fascinating that anyone shopping in a store is willing to give their personal residence information to a complete stranger just because they were asked.

Re:Does that really solve the problem? (1)

HeronBlademaster (1079477) | more than 3 years ago | (#35170986)

How does one file a formal complaint?

Re:Does that really solve the problem? (3, Funny)

c0lo (1497653) | more than 3 years ago | (#35170772)

TFA

It is not illegal in California for a retailer to see a person's ZIP code or address, the ruling notes: For instance, one can request a customer's driver's license to verify his or her identity. What makes it wrong is when a business records that information, according to the ruling, especially when the practice is "unnecessary to the sales transaction."

Meaning (on the line of "what can possibly go wrong" and other /. memes):
1. show them the CC and the driver license if they request it.
2. Make sure their CCTV camera records it
3. sue them for recoding the data (if you can prove the CCTV is working and they are maintaining the recordings)
4. profit

Have to punch it in at the gas stations now (3, Interesting)

Anonymous Coward | more than 3 years ago | (#35170548)

I have noticed many gas stations around here now require you to enter your zip code when you pay at the pump. I assume it's an extra validation against the zip code on your credit card.

Re:Have to punch it in at the gas stations now (1)

beschra (1424727) | more than 3 years ago | (#35170626)

Yeah, it's to help prevent fraud. The credit card company verifies the zip code on your account with the zip code entered at the pump. (I think the vendors get a little better deal if they provide the zip code for validation.) The assumption is that someone who steals a card won't know where you live. Of course by that logic a PIN should work too.

Re:Have to punch it in at the gas stations now (1)

SwedishPenguin (1035756) | more than 3 years ago | (#35170724)

Don't you have a PIN-code on your credit card?? Anyone can find out what your zip code is...

Re:Have to punch it in at the gas stations now (1)

HeronBlademaster (1079477) | more than 3 years ago | (#35171002)

In the US, at least, credit cards don't usually have PINs; debit cards do, and they go through Visa or MC's networks too, but they pull money from your bank account, rather than a line of credit. Of course, that's fine, if you always have enough money...

Re:Have to punch it in at the gas stations now (1)

RNLockwood (224353) | more than 3 years ago | (#35170812)

The credit card combined with the zip code and the license plate number that is extracted from the photo taken while the gas is pumped might give a hint to your identity.

Re:Have to punch it in at the gas stations now (0)

Anonymous Coward | more than 3 years ago | (#35170822)

It's strictly for marketing usage, nothing else.

Re:Have to punch it in at the gas stations now (4, Interesting)

Potor (658520) | more than 3 years ago | (#35170840)

When I am forced to give my zip at a terminal, I ALWAYS hit random numbers. My card has never been refused.

Re:Have to punch it in at the gas stations now (1)

Reziac (43301) | more than 3 years ago | (#35170844)

That's exactly what it is. I have two zip codes (street address and POBox) and can never remember which credit card is billed to where... always manage to input the wrong one first.

Re:Have to punch it in at the gas stations now (1)

Z34107 (925136) | more than 3 years ago | (#35170868)

I stopped for gas in Chicago not too long ago, and it confuzzled me when the pump asked for my ZIP code. I figured it was a weak attempt to make sure it was me using my credit card, but I almost pried the card scanner off trying to see if it was real or not.

66666 (0)

Anonymous Coward | more than 3 years ago | (#35170550)

Sorry timothy, no such zip code. 66606 puts you in Topeka, Kansas.

Gas pumps ... (1)

perpenso (1613749) | more than 3 years ago | (#35170556)

I'm not sure I like this. In california I've had the pumps at gas station ask for my zip code rather than my PIN. At some stations I think I'd prefer to only provide a zip code.

Re:Gas pumps ... (0)

Anonymous Coward | more than 3 years ago | (#35170682)

I believe that's where the 'unnecessary' part comes in. When it comes to credit card validation some banking options require you to provide the zip code.

Re:Gas pumps ... (0)

Anonymous Coward | more than 3 years ago | (#35170982)

Given the relatively high incidence of skimmers at gas stations, this makes perfect sense - you effectively have a weaker pin for small purchases this way.

they ask, I lie (1)

Anonymous Coward | more than 3 years ago | (#35170606)

Here's my postal code, F0K Y0U (canadian Postal Code FTW). It's not like you have to give real information.

Re:they ask, I lie (2)

mirix (1649853) | more than 3 years ago | (#35170886)

That doesn't fit the syntax. ANA NAN. A being an alpha and N being a numeral.

You can use H0H 0H0 on forms. "Santa"s post code.

gas pumps OK, the rest, F-off! (1)

alanshot (541117) | more than 3 years ago | (#35170620)

while at a "pay at the pump" transaction I dont mind giving my zip to verify my ability to use the card, the zip outside of that type of transaction is bogus!. you have no right to it.

Now then my favorite trick is when a cashier asks for my zip during a face to face transaction where the info is strictly customer base tracking, I enjoy using zip code 99501. Yes, thats the zip for Anchorage, AK. I'm in Indiana. try to figure THAT out mister statistics man...

Re:gas pumps OK, the rest, F-off! (1)

flimflammer (956759) | more than 3 years ago | (#35170726)

You actually think they're trying to track you with your zip code? It's for the same damn purpose of the pumps. You're probably confusing the fuck out of your credit card company giving them 99501.

Re:gas pumps OK, the rest, F-off! (1)

Mr. Slippery (47854) | more than 3 years ago | (#35170874)

You actually think they're trying to track you with your zip code? It's for the same damn purpose of the pumps.

No, it's not, because they ask me for my zip code when I pay cash.

They used to just want your zip code so they know where to send junk mail. But with data mining, the product of your zip code with one or two other non-unique identifiers may put the finger right on you.

Re:gas pumps OK, the rest, F-off! (0)

Anonymous Coward | more than 3 years ago | (#35170928)

The credit card companies aren't looking at the data, the retailer (gas station, store, etc) is. Being in this field, I can confirm they're looking for possible fraudulent charges. If you use your credit card, believe me, they already know your name and address, and plenty more. If a transaction if flagged as possibly fraudulent, they'll start paying closer attention every time you use that card. If it hits with a new Zip every time, you're just asking for exactly the attention you're saying you don't want.

gas pumps (1)

liquidpele (663430) | more than 3 years ago | (#35170638)

gas pumps currently use the zip to verify it's your card... hope they still allow that...

Re:gas pumps (1)

GuldKalle (1065310) | more than 3 years ago | (#35170808)

I don't understand this. Don't you have PINs in the states?

Re:gas pumps (0)

Anonymous Coward | more than 3 years ago | (#35170896)

For debit cards yes. Credit cards generally don't...

Well, who has to tell the truth... (1)

Super Dave Osbourne (688888) | more than 3 years ago | (#35170644)

The government doesn't when it comes to real numbers like unemployment or how many die in war or how they died. Companies lie about earnings all the time and if unlucky get caught and pay a fine. But none of these people including politicians seems to do time for it. My guess is if people just gave out bogus information for things like where they live, or how old they are, then all that info and meta info becomes a problem and the companies will stop using it against people.

PCI in California (2)

WarmNoodles (899413) | more than 3 years ago | (#35170646)

Interesting, if upheld, this could push the PCI DSS Council to add Zip to the list of non public information that must be encrypted.

And that would effectively mandates QSA's find every gas station in California in violation of the next wave of PCI DSS criteria.

The expense of coding testing, QA'ing, promoting encryption on Zip (at rest and in transmission) could be high as compared the moderate to minor risk that companies are stalking their customers using Gas Station data.

Re:PCI in California (0)

Anonymous Coward | more than 3 years ago | (#35170760)

"Damn those encryption patent holders, charging me by the byte. I'll encrypt the bloody five digit zip, but the +4 shall remain free for the taking!"

Eventually the cost of figuring out the bare minimum required to scrape by will be greater than the cost of just fucking encrypting our data already, and then we win.

Any chance we can get California to rule that every third letter of our first name is equally private?

Re:PCI in California (1)

WarmNoodles (899413) | more than 3 years ago | (#35170880)

lol nice

Re:PCI in California (0)

Anonymous Coward | more than 3 years ago | (#35170950)

RTFA: the gas station thing is still cool because it's used to verify the transaction. n00b.

Tracking (2)

nephillim (980798) | more than 3 years ago | (#35170672)

If it is necessary for your credit card to go through, then you have to give it anyway.

If it isn't needed by your credit card, then there is no reason you can't just interpret their question as "please name a zip code". There is a store by my house that I know will ask zip code prior to any purchase that probably thinks they have had a customer from every state including Alaska and Hawaii last year.

Legitimate Uses (1)

TheABomb (180342) | more than 3 years ago | (#35170764)

Asking for a ZIP code IS a legitimate way of verifying a card isn't stolen. Probably not the best method, but it's a common one in the wild.

It's also a legitimate way for the store to say "Hey, we got a lot of customers coming in from two towns over to shop here. Maybe that'd be a smart place to build our next store."

Re:Legitimate Uses (0)

Anonymous Coward | more than 3 years ago | (#35170888)

Asking for a ZIP code IS a legitimate way of verifying a card isn't stolen. Probably not the best method, but it's a common one in the wild.

\

Probably not?

How about almost completely worthless as a method?

Most likely your credit card is stolen with your wallet. If it's not, by some chance, then they can google your name these days and use that.

Re:Legitimate Uses (0)

Anonymous Coward | more than 3 years ago | (#35171006)

"Asking for a ZIP code IS a legitimate way of verifying a card isn't stolen."
Why and how?

Any time I've been asked for my zip code, I've provided the 4-digit post code that is on the billing address of my credit card, and my transaction has been denied.
Mostly because the system expects a 5 digit code not starting with 0 and partly because my bank doesn't do that kind of verification.

Treating symptoms (5, Insightful)

GuldKalle (1065310) | more than 3 years ago | (#35170820)

Sounds to me like the law is only treating symptoms. How about a law that makes it illegal to sell customer info without their express written consent?

is it already a choice? (1)

tchdab1 (164848) | more than 3 years ago | (#35170832)

If they wanna pay w/ a credit card then we need a zip; pay with cash, no zip code required.

"I'd rather not." (2)

bcrowell (177657) | more than 3 years ago | (#35170848)

When I'm paying in person with a credit card and a retailer asks me to provide my zip code, all I do is say "I'd rather not." Been doing it since the early 80's, when the practice first started. It's almost never a big deal. Very rarely (maybe once in several years) the cashier complains and I say that my zip code is 12345. They just want something they can punch in so they don't get in trouble with their manager.

Cashiers at some bricks-and-mortar retailers ask for a zip code even when I'm paying cash. I just give them a quizzical look and say, "Oh, I'm paying cash."

Re:"I'd rather not." (1)

ya really (1257084) | more than 3 years ago | (#35170988)

Very rarely (maybe once in several years) the cashier complains and I say that my zip code is 12345.

Nothing wrong with saying 12345. It is an actual zip code for Schenectady, NY. Imagine how they feel when people keep telling them their zip code is fake :)

California law "protects" consumers... (-1, Troll)

DustoneGT (969310) | more than 3 years ago | (#35170944)

Nice to know that the law is there to protect you in case a retailer commits the horrible crime of asking you for your zip code. Now, if an armed robber shows up to kill you for the paper and plastic in your wallet or to rape you at knifepoint, the law was also there prohibiting you from carrying the best tools for self defense. Officers will be by in 5-10 minutes to help load your dead meat in the wagon or check for a DNA sample that will take 3-4 months to process.

I'd much rather give a 5-digit code that the retailer can use to narrow my location down to a large geographic area than give up my sidearm. I'll stick with living in an inland state.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...