Kohl’s Alleged Failure To Provide Complete Records To ID Theft Victims

Jun 10, 2020 | Consumer Protection, Employment & Technology Archive

FTC Alleges Kohl’s Violated Fair Credit Reporting Act By Refusing To Provide Victims of Identity Theft With Complete Records of Questionable Transactions 

Kehoe Law Firm, P.C. is making consumers aware that an FTC complaint against Kohl’s Department Stores alleges Kohl’s violated the Fair Credit Reporting Act (“FCRA”) by refusing to provide victims of identity theft with complete records of questionable transactions – a right the FCRA guarantees to victimized consumers. 

According to the FTC, if, for example, a consumer notices unauthorized charges or lines of credit suggesting they are victims of identity theft, the consumer will need copies of documents from the businesses where those transactions occurred. Once a consumer asks for those documents, Section 609(e) of the Fair Credit Reporting Act gives businesses 30 days to provide the records. The law allows businesses to require proof of identity (like a driver’s license) and proof of the identity theft (like a police report and affidavit), but the whole idea behind the provision is to avoid re-victimizing consumers by tying them up in red tape.

Kohl’s original practice, according to the FTC, was to provide records to victims within 30 days, subject to proper verification. In February 2017, Kohl’s changed its policy and would share information identifying the identify thief only with law enforcement or with a victim’s attorney – not with the victimized consumer.

In August 2018, Kohl’s changed its policy again and gave customers with a Kohl’s charge account a more expansive list of business and transaction records – for example, statements, receipts, and applications. Kohl’s, however, still refused to give them information identifying the alleged thief (including the address and phone number listed on a fraudulent application or the shipping address used for fraudulent orders). Kohl’s also stopped providing that information to victims’ attorneys, which left victims with only one recourse: a direct request from a law enforcement agency.

According to the FTC’s complaint, the company’s revised policies left consumers with no practical way to get the documentation they needed to establish the charges were not theirs. Additionally, individuals whose lives had already been turned upside down by identity thieves now found themselves at odds with Kohl’s. Even when consumers complained to Kohl’s and sent the company copies of Section 609(e) of the FCRA and accompanying FTC guidance documents, the FTC’s complaint alleges that Kohl’s stonewalled them.

According to the FTC, it wasn’t until April 2019 that Kohl’s finally revised its policy to provide victims with the credit application and transaction records for which they asked. The FTC’s complaint charges that Kohl’s violated the FCRA by failing to provide consumers with the records they had a right to under the law. The FTC also says the company violated Section 609(e)’s 30-day requirement. In addition to a $220,000 civil penalty, the settlement requires Kohl’s to provide identity theft victims with business transaction records related to the theft within 30 days. Kohl’s also must post a notice on its website advising victims how to get those records and must certify that it reached out to victims who were unlawfully denied access to those records in the past.

Source: Federal Trade Commission – FTC.gov

Kehoe Law Firm, P.C.

Moneygram Payment Systems’ Alleged Unsolicited Text Messages

Jun 10, 2020 | Consumer Protection, Employment & Technology Archive

Lawsuit Alleges Moneygram Payment Systems, Inc. Caused Thousands of Unsolicited Text Messages To Be Sent To Cell Phones

Kehoe Law Firm, P.C. is making consumers aware that on June 9, 2020, a class action lawsuit was filed against Moneygram Payment Systems, Inc. (“Moneygram”) in United States District Court, Western District of Washington, for alleged violations of the Telephone Consumer Protection Act. 

According to the class action complaint, Moneygram, sent unsolicited text messages, which promoted Moneygram’s goods and services, to the Plaintiff’s cell phone from 620-57.  The unsolicited text messages the Plaintiff received were, according to the complaint, as follows:

The complaint alleges that “[u]pon information and belief, Defendant caused thousands of unsolicited text messages to be sent to the cellular telephones of Plaintiff and Class Members, causing them injuries, including invasion of their privacy, aggravation, annoyance, intrusion on seclusion, trespass, and conversion.”

Do You Believe You Are a Victim of Illegal Robocalls, Text Messages, “Junk” Faxes or Telemarketing Sales Calls?

If you have received illegal robocalls, text messages, “junk” faxes or telemarketing sales calls, you may be able to recover at least $500 for each illegal call, text or fax you received and, possibly, as much as $1,500 for each illegal call, text message or facsimile that was made either willfully or knowingly in violation of the Telephone Consumer Protection Act.

To help evaluate your potential legal claims under the Telephone Consumer Protection Act, please complete KLF’s confidential Robocall Questionnaire or, if you prefer to speak with an attorney, please complete the form above on the right, e-mail [email protected] or contact Michael Yarnoff, Esq., [email protected], (215) 792-6676, Ext. 804, for a free, no-obligation evaluation of your potential legal rights.

Kehoe Law Firm, P.C.

Bombas Data Breach Possibly Involving Customer Personal Information

Jun 8, 2020 | Consumer Protection, Employment & Technology Archive

Malicious Code Designed To Scrape Credit Card Numbers And Other Personal Information May Have Been Present on Company’s E-Commerce Platform As Early As November 11, 2016

Kehoe Law Firm, P.C. is making consumers aware that Bombas LLC filed a “Notice of Data Breach” sample customer letter with the State of California Department of Justice, Office of the Attorney General, which stated, among other things, that Bombas, “. . . as part of a review of data security, . . . discovered that malicious code designed to scrape credit card numbers and other personal information may have been present as early as November 11, 2016 on [Bombas’] e-commerce platform.” 

Further, the data breach notification stated that “[o]n May 20, 2020, [Bombas] received an investigative report, which could not rule out the possibility that the malicious code could have successfully scraped customer information. The report also confirmed that a new security feature, which was added to [Bombas’] e-commerce platform on February 16, 2017, prevented the malicious code from functioning after that date. Accordingly, there is a window from November 11, 2016 to February 16, 2017 during which customer information potentially could have been exposed.”

Bombas, according to the notification, “. . . believe[s] that the malicious code could have enabled the attacker to acquire certain personal information belonging to customers who entered their payment card information in [Bombas’] online checkout process during the relevant period. The affected information may have included [customer] name, address, and payment card data.” [Emphasis added.]

Have You Been Impacted by A Data Breach?

If so, please either contact Kehoe Law Firm, P.C., Michael Yarnoff, Esq., (215) 792-6676, Ext. 804, [email protected], complete the form on the right or e-mail [email protected] for a free, no-obligation case evaluation of your facts to determine whether your privacy rights have been violated and whether there is a basis for a data privacy class action.

Examples of the type of relief sought by data privacy class actions, include, but are not limited to, reimbursement of identity theft losses and of out-of-pocket costs paid by data breach victims for protective measures such as credit monitoring services, credit reports, and credit freezes; compensation for time spent responding to the breach; imposition of credit monitoring services and identity theft insurance, paid for by the defendant company; and improvements to the defendant company’s data security systems.

Data privacy class actions are brought on a contingent-fee basis; thus, plaintiffs and the class members do not pay out-of-pocket attorney’s fees or litigation costs.  Subject to court approval, attorney’s fees and litigation costs are derived from the recovery obtained for the class.

Kehoe Law Firm, P.C.