Retailer faces uphill battle in US$13M lawsuit against Visa, analyst says

Genesco claims it was unfairly fined by Visa over a 2010 data breach

Specialty retailer Genesco faces an uphill battle in its precedent-setting US$13.3 million lawsuit against Visa USA, a Garner analyst said this week.

Genesco's lawsuit accuses Visa of illegally and unjustifiably imposing multimillion-dollar fines on the retailer over a 2010 data intrusion.

The intrusion resulted in Visa's issuing an alert to credit-card issuing banks warning them that all Visa payment cards handled by Genesco over the year between December 2009 and December 2010 had been compromised. The episode resulted in Genesco's having to pay a total of $13.3 million in fines.

In its lawsuit, Genesco claimed the fines were unjustified. It noted that Visa's own rules for payment card transactions specify fines only in situations where a breach occurred because of a company's failure to comply with the requirements of the Payment Card Industry Data Security Standards. Even then, fines are applicable only if more than 10,000 cards are compromised. There also needs to be actual and demonstrable financial damage resulting from fraud or counterfeiting before a fine can be imposed, Genesco said.

None of these situations applied with the 2010 intrusion, Genesco said in its complaint. The company claimed that it had been fully compliant with PCI requirements at the time of the breach. As required under PCI, no card data was ever stored on Genesco's systems at any time during the intrusion.

The only card data that was potentially exposed was the unencrypted card data being transmitted for approval. Visa's own rules at the time did not require companies to encrypt such data while it was being transmitted, Genesco maintained. The company also claimed that Visa had failed to show how the intrusion had resulted in any actual losses to either the company or to the banks that had issued the cards.

Genesco's reaction is understandable, said Gartner analyst Avivah Litan. Over the years, credit card companies such as Visa and MasterCard have hit merchants with hefty fines for data breaches allegedly resulting from non-compliance with PCI rules. Some companies have chafed at the fines and have maintained that they were fully compliant with PCI requirements when they were breached.

Visa did not respond to a request for comment.

Genesco's lawsuit marks the first time that a breached entity has challenged Visa's fines.

"I certainly can understand the frustration of Genesco here but I think legally it may be tricky," Litan said. The case challenges some of the fundamental payment system rules and regulations governing credit and debit card transactions that were put in place by companies such as Visa and MasterCard, she noted.

While some might consider Visa's rules to be random, the fact is that participation in Visa's system is voluntary, Litan said. "Visa is legally allowed to set its own rules - however arbitrary they are - because it is a voluntary system, and retailers don't 'have' to accept Visa cards," she noted.

Over the past few years, numerous lawsuits have been brought against Visa and MasterCard over the 'interchange' fees the companies charge for each payment card transaction. "In the end, the cases failed to prove one important point; that the card brands are effectively monopolies and should be thus subject to monopoly law," Litan said.

So long as Visa is not considered a monopoly, the company will be able to set its own rules, and companies that agree to abide by them will probably have a hard time challenging those rules later. "Visa may choose to settle with Genesco, depending on the merits of the case, but until Visa is declared part of a monopoly, they are at liberty to set their own rules in their own operating frameworks and this arbitrariness will continue on," Litan said.

Jim Huguelet, principal of the Huguelet Group LLC, a firm that advises companies on PCI compliance, said Genesco's claims appear to be worth pursuing. This is true especially if Genesco can show that it was PCI-compliant at the time of the intrusion, he noted.

"The fine imposed by Visa, especially if it can be proven that no material damages accrued to Visa or its issuers, would seem difficult to defend," he said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is

Join the CSO newsletter!

Error: Please check your email address.

Tags Financial ITvisasecurityNoneendpoint securityencryption

More about GartnerVisa

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts