Federal Trade Commission Proposes Small Business Protections Against Telemarketing Tricks and Traps

Agency Also Seeks Public Comment on Combatting Tech-support Scams and Adding Click-to-Cancel Requirements

April 28, 2022

The Federal Trade Commission today proposed extending protections against telemarketing tricks and traps to small businesses and strengthening safeguards against other pernicious telemarking tactics plaguing consumers. The agency is seeking comments on updates to the Telemarketing Sales Rule that would protect small businesses against business-to-business telemarking schemes, address tech-support scams that target seniors, and extend click-to-cancel requirements to telemarketing. 

“Today we are taking aggressive action to protect small businesses and consumers from telemarketing tricks and traps,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “We look forward to hearing from the public about how we can further strengthen this rule to hold telemarketing scammers accountable.”

Both the notice of proposed rulemaking and advance notice of proposed rulemaking announced today stem from the Commission’s regulatory review of the Telemarketing Sales Rule and address public comments the FTC has received as part of that review.

The current regulatory review of the Telemarketing Sales Rule began with the publication of a 2014 Federal Register notice seeking comments on general issues such as whether to retain, eliminate, or modify the rule. It also sought comment on specific issues, such as whether the rule should provide additional protections to consumers from telemarketing calls involving use of previously acquired account information and negative option offers, as well as recordkeeping requirements for sellers and telemarketers.

The Telemarketing Sales Rule

The FTC’s Telemarketing Sales Rule became law in 1995 and applies to virtually all “telemarketing” activities, both in the United States and international sales calls to consumers in the U.S. With several notable exceptions, the rule generally applies only to outbound calls made by telemarketers to consumers and protects consumers in a range of ways. For example, the rule requires telemarketers to make certain disclosures and prohibits misrepresentations during sales calls.

The Telemarketing Sales Rule ensures that telemarketers obtain a consumer’s authorization before billing or collecting payment, and prohibits telemarketers from requesting advance payments for services, such as credit repair, “guaranteed” loans, and debt settlement programs. The rule also prohibits credit card laundering by or on behalf of telemarketers and generally prohibits them from calling phone numbers on the Do Not Call Registry or plaguing consumers with robocalls, among other things.

Proposal to Protect Small Businesses and Strengthen Enforceability

The notice of proposed rulemaking announced today proposes amending the recordkeeping requirements of the Telemarketing Sales Rule and prohibiting deception in business-to-business telemarketing calls. Specifically, the notice seeks public comment on:

  • Business-to-business schemes: Whether the FTC should amend the Telemarketing Sales Rule to prohibit misrepresentations in business-to-business calls, as the Commission’s experience has shown that small businesses continue to be harmed by deceptive telemarketing, and
  • Recordkeeping requirements: Whether the FTC should amend the rule’s recordkeeping provisions to require telemarketers to retain information in seven new categories, such as keeping recordings of robocalls.

Addressing Other Telemarking Tactics and Scams

The advance notice of proposed rulemaking announced today seeks information on a range of issues, some of which were identified during the previous comment period. Specifically, the agency seeks public comment on:

  • Tech-support scams: Whether the Telemarketing Sales Rule should add additional provisions to address the rise in tech-support scams. These are scams where telemarketers trick consumers into purchasing unnecessary computer technology services to fix phantom problems. Generally, telemarketers who induce consumers to call them by placing deceptive internet ads are currently exempt from Telemarketing Sales Rule requirements. The advance notice of proposed rulemaking seeks comment on whether those calls should be covered by the rule.
  • Click-to-cancel requirements: Whether the rule should require telemarketers to provide consumers with a simple notice and cancelation, such as click-to-cancel, when they sign up for subscription plans; and
  • Robocalls and other telemarketing to small businesses: Whether the Telemarketing Sales Rule broadly should stop treating telemarketing calls made to businesses differently from those made to consumers. Generally, such calls currently are exempt from certain provisions of the rule.

The Commission vote approving publication of the notice of proposed rulemaking and advance notice of proposed rulemaking in the Federal Register was 4-0.

The Federal Trade Commission works to promote competition and protect and educate consumers. Learn more about consumer topics at consumer.ftc.gov, or report fraud, scams, and bad business practices at ReportFraud.ftc.gov.

Block, formerly known as Square, Confirms Cash App Data Breach

On April 4, 2022, Block, Inc. (the “Company”) announced that it recently determined that a former employee downloaded certain reports of its subsidiary Cash App Investing LLC (“Cash App Investing”) on December 10, 2021 that contained some U.S. customer information. While this employee had regular access to these reports as part of their past job responsibilities, in this instance these reports were accessed without permission after their employment ended.

The information in the reports included full name and brokerage account number (this is the unique identification number associated with a customer’s stock activity on Cash App Investing), and for some customers also included brokerage portfolio value, brokerage portfolio holdings and/or stock trading activity for one trading day.

The reports did not include usernames or passwords, Social Security numbers, date of birth, payment card information, addresses, bank account information, or any other personally identifiable information. They also did not include any security code, access code, or password used to access Cash App accounts. Other Cash App products and features (other than stock activity) and customers outside of the United States were not impacted.

Upon discovery, the Company and its outside counsel launched an investigation with the help of a leading forensics firm. Cash App Investing is contacting approximately 8.2 million current and former customers to provide them with information about this incident and sharing resources with them to answer their questions. The Company is also notifying the applicable regulatory authorities and has notified law enforcement.

The Company takes the security of information belonging to its customers very seriously and continues to review and strengthen administrative and technical safeguards to protect the information of its customers. Future costs associated with this incident are difficult to predict. Although the Company has not yet completed its investigation of the incident, based on its preliminary assessment and on the information currently known, the Company does not currently believe the incident will have a material impact on its business, operations, or financial results.

SEC event filing of Cash App data breachhttps://www.sec.gov/ix?doc=/Archives/edgar/data/0001512673/000119312522095215/d343042d8k.htm

FTC Takes Action Against CafePress for Data Breach Cover Up

March 15, 2022- Commission orders e-commerce platform to bolster data security and provide redress to small businesses.

The Federal Trade Commission today took action against online customized merchandise platform CafePress over allegations that it failed to secure consumers’ sensitive personal data and covered up a major breach. The FTC alleges that CafePress failed to implement reasonable security measures to protect sensitive information stored on its network, including plain text Social Security numbers, inadequately encrypted passwords, and answers to password reset questions. The Commission’s proposed order requires the company to bolster its data security and requires its former owner to pay a half million dollars to compensate small businesses.

“CafePress employed careless security practices and concealed multiple breaches from consumers,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “These orders dial up accountability for lax security practices, requiring redress for small businesses that were harmed, and specific controls, like multi-factor authentication, to better safeguard personal information.”

In a complaint filed against Residual Pumpkin Entity, LLC, the former owner of CafePress, and PlanetArt, LLC, which bought CafePress in 2020, the FTC alleged that CafePress failed to implement reasonable security measures to protect the sensitive information of buyers and sellers stored on its network. In addition to storing Social Security numbers and password reset answers in clear, readable text, CafePress retained the data longer than was necessary. The company also failed to apply readily available protections against well-known threats and adequately respond to security incidents, the complaint alleged. As a result of its shoddy security practices, CafePress’ network was breached multiple times.

According to the complaint, a hacker exploited the company’s security failures in February 2019 to access millions of email addresses and passwords with weak encryption; millions of unencrypted names, physical addresses, and security questions and answers; more than 180,000 unencrypted Social Security numbers; and tens of thousands of partial payment card numbers and expiration dates. Some of the information was later found for sale on the Dark Web.

After being notified a month later that it had a security vulnerability and that hackers had obtained consumer data, CafePress patched the vulnerability but failed to properly investigate the breach for several months despite additional warnings, the complaint alleged. This included a warning in April 2019 from a foreign government, which notified the company that a hacker had illegally obtained CafePress customer account information and urged the company to notify affected customers. The company, however, withheld this essential information, and instead only told customers to reset their passwords as part of an update to its password policy.

The complaint alleges CafePress did not inform affected customers until September 2019—one month after the breach was reported widely. The company’s lax security practices, however, still left many consumers at risk. For example, the company continued to allow people to reset their passwords on the website by answering security questions associated with customer email addresses—the same information that had been previously stolen by hackers.

According to the complaint, CafePress was aware of problems with its data security prior to the 2019 data breach. Through at least January 2018, when CafePress determined that certain accounts of shopkeepers had been hacked, CafePress closed the accounts and charged the victims a $25 account closure fee. The company also experienced several malware infections to its network prior to the 2019 hack but failed to investigate the source of such attacks.

In addition to its security failures, the FTC alleged the company misled users by using consumer email addresses for marketing despite its promises that such information would only be used to fulfill orders consumers had placed.

As part of the proposed settlement, Residual Pumpkin and PlanetArt will be required to implement comprehensive information security programs that will address the problems that led to the data breaches at CafePress. This includes replacing inadequate authentication measures such as security questions with multi-factor authentication methods; minimizing the amount of data they collect and retain; and encrypting Social Security numbers.

In addition, the proposed settlement requires Residual Pumpkin to pay $500,000 in redress to victims of the data breaches. PlanetArt will be required to notify consumers whose personal information was accessed as a result of CafePress’s data breaches and provide specific information about how consumers can protect themselves. Both companies will be required to have a third party assess their information security programs and provide the Commission with a redacted copy of that assessment suitable for public disclosure.

The Commission voted 4-0 to issue the proposed administrative complaint and to accept the consent agreement with the companies.

The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $46,517.

https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-cafepress-data-breach-cover

Ethisphere honors U.S. Bank for 8th year

Elavon’s parent company, U.S. Bank has been named one of the World’s Most Ethical Companies by the Ethisphere Institute for the eighth consecutive year. Ethisphereis the global leader in defining and advancing the standards of ethical business practices that fuel corporate character, marketplace trust and business success

“Our employees have gone above and beyond to support our communities and customers.” said Andy Cecere, chairman, president and chief executive officer. “They work hard to earn and keep our customers’ trust, and this honor belongs to them.”

Ethisphere recognized 136 honorees that span 22 countries and 45 industries. U.S. Bank is one of five honorees in the banking category.

The World’s Most Ethical Companies assessment is based on Ethisphere’s Ethics Quotient® framework. It includes more than 200 questions on culture, environmental and social practices, ethics and compliance activities, governance, diversity and initiatives to support a strong value chain. The process captures and collects the leading practices of organizations across industries and around the globe. This year, the questions also gauged how applicants are adapting and responding to the global health pandemic, environmental, social, and governance factors, safety, equity, and inclusion and social justice.

“Today, business leaders face their greatest mandate yet to be ethical, accountable, and trusted to drive positive change,” said Ethisphere CEO Timothy Erblich. “We continue to be inspired by the World’s Most Ethical Companies honorees and their dedication to integrity, sustainability, governance, and community. Congratulations to U.S. Bank for earning the World’s Most Ethical Companies designation.”

About Ethisphere
Ethisphere® is the global leader in defining and advancing the standards of ethical business practices that fuel corporate character, marketplace trust and business success. Ethisphere has deep expertise in measuring and defining core ethics standards using data-driven insights that help companies enhance corporate character and measure and improve culture. Ethisphere honors superior achievement through its World’s Most Ethical Companies recognition program and provides a community of industry experts with the Business Ethics Leadership Alliance (BELA). More information about Ethisphere can be found at: https://ethisphere.com.

*By selecting this link, you will leave Elavon content and enter a third-party website. Elavon is not responsible for the content of, or products and services provided by this third party, nor does it guarantee the system availability or accuracy of information contained in the site. This website is not controlled by Elavon. Please note that the third-party website may have privacy and information security policies that differ from those of Elavon.

Notes to editors

About Elavon

Elavon is a leading global payments company with more than 4,300 employees and operations in 10 countries. A subsidiary of U.S. Bancorp (NYSE:USB), Elavon provides businesses with the technology needed to accept payments from customers, whether they are shopping in stores, at home or on the go. Its platform is distinctive in that it is common across countries, making it easier for businesses to get their payment system up and running quickly and securely.

Elavon Financial Services DAC, trading as Elavon Merchant Services, is regulated by the Central Bank of Ireland and the Prudential Regulation Authority and subject to limited regulation by the Financial Conduct Authority and Prudential Regulation Authority. Details about the extent of our authorization and regulation by the Prudential Regulation Authority, and regulation by the Financial Conduct Authority are available from us on request.

About U.S. Bank

U.S. Bancorp, with 74,000 employees and $488 billion in assets as of September 30, 2019, is the parent company of U.S. Bank National Association, the fifth-largest commercial bank in the United States. The Minneapolis-based bank blends its relationship teams, branches and ATM network with mobile and online tools that allow customers to bank how, when and where they prefer. U.S. Bank is committed to serving its millions of retail, business, wealth management, payment, commercial and corporate, and investment services customers across the country and around the world as a trusted financial partner, a commitment recognized by the Ethisphere Institute naming the bank a 2019 World’s Most Ethical Company. Visit U.S. Bank online or follow on social media to stay up to date with company news.

Visit U.S. Bank and Elavon online or follow on social media to stay up to date with company news. 

###

Note: 3D Merchant Services is an authorized reseller of Elavon merchant services and related products, including CenPOS.

Chinese PAX payment terminal manufacturer raided by FBI in Florida

PAX Technology Warehouse in Jacksonville Florida was the subject of a search and investigation October 26, 2021 by the Federal Bureau of Investigation, the Department of Homeland Security, and several other agencies. PAX is a Chinese credit card terminal provider that significantly grew it’s global reach, including the US, during the transition to EMV chip terminals.

Brian Krebs, a cybersecurity investigative journalist, reported a major US payment processor noticed that PAX terminals were being used both as a malware “dropper” — a repository for malicious files — and as “command-and-control” locations for staging attacks and collecting information. Something didn’t add up and PAX didn’t give any good answers.

FBI Statement: “The FBI Jacksonville Division, in partnership with Homeland Security Investigations, Customs and Border Protection, Department of Commerce, and Naval Criminal Investigative Services, and with the support of the Jacksonville Sheriff’s Office, is executing a court-authorized search at this location in furtherance of a federal investigation. We are not aware of any physical threat to the surrounding community related to this search. The investigation remains active and ongoing and no additional information can be confirmed at this time.”

US vendors in the payments ecosystem were quick to respond. The sale and installation of PAX terminals has already been prohibited by some.