After a two-hour emergency hearing Monday, U.S. District Court Judge Paul Magnuson took under advisement arguments regarding whether to stop a $19 million proposed settlement between Target and MasterCard that could have far-reaching implications for card issuers.

The proposed settlement is in response to a data breach in late 2013 that compromised approximately 110 million credit and debit cards, as well as personal information of Target customers.

The hearing came after attorneys Charles Zimmerman of Zimmerman Reed and Karl Cambronne of Chestnut Cambronne asked for an injunction (read the plaintiffs' entire legal motion here) on behalf of Umpqua Bank, Mutual Bank, Village Bank, CSE FCU and First Federal Savings of Lorain. Douglas Meal of Ropes & Gray represented Target at the hearing.

In or Out

According to a transcript of the hearing, much of the conversation revolved around whether issuers should have been involved in the talks between MasterCard and Target, whether issuers must forfeit their rights to sue if they accept the settlement and how to calculate the damages.

“The financial institutions were excluded from the process, they were not in the room, they were not being heard,” Zimmerman told the judge, according to the transcript. “We're supposed to have people whose interests are at stake in the room discussing their interest, but people that know most about the financial institutions' claims and damages were not there.”

Target and MasterCard were well within their rights to negotiate a settlement by themselves because the suit doesn’t have class-action status, Meal explained. A hearing on class certification is set for September, according to the transcript.

“We negotiated with MasterCard, who is acting on behalf of the issuers, but ultimately MasterCard said, and we agreed, we're not going to try and cram anything down on our customers. We'll present the offer, and if they like it, great. Prior history shows that issuers presented with these offers have found them to be excellent,” he said, according to the transcript.

By accepting the settlement as it is currently worded, Zimmerman told the judge, issuers would have to forfeit their right to sue under Minnesota’s Plastic Card Security Act, which entitles them to reimbursement for the cost of cancelling cards, closing and reopening accounts, blocking transactions, issuing refunds or credits to cardholders and notifying cardholders. Under the law, the reimbursable costs exclude amounts recovered from credit card companies, meaning that the issuers could still come to Target for the difference.

“They're being asked to sign a complete release of all of their damages, which is, in our view, completely inappropriate,” Zimmerman said.

“We think under the law we had every right and very good reason to structure the settlement as we did and look for a complete release from any issuer that chose to settle with us. Any issuer that doesn't choose to settle with us, there's no release and they're right where they were today, and that's perfectly appropriate and fair to everyone,” Meal said.

Million Dollar Questions

According to Cambronne, MasterCard told issuers they would be compensated for 71.4% of operational and fraud-related losses on MasterCard-branded cards believed to be affected by the Target data breach. MasterCard also provided data showing fraud losses on the Target breach of $79,319,427.74, according to the transcript.

“So you add one $80 million figure, another $80 million figure for the reissuance, and all of a sudden we have $160 million of costs, of harm, of damages attributable to the losses here, and the chief integrity officer of MasterCard has the audacity to suggest you're going to get with $19 million total 71.4% of your losses for fraud and your losses for reissuance of cards,” Cambronne said.

“Our experts tell us that card replacement is between $7 and $10, maybe $12 a card. They're looking at under this formula about a buck and a half a card. That's not right. No one was there advocating for that,” Zimmerman added.

The real reimbursement rate is 11.8%, Cambronne and Zimmerman argued.

One hang-up is with language in the communication to issuers saying losses will be calculated according to MasterCard Account Data Compromise standards, but Meal called that “manufactured ambiguity.”

The $79 million number is actually the sum of all fraud of any variety on cards at risk in the data breach, he told the judge, according to the transcript. It therefore includes, he said, fraud attributable to exposed cards that were later lost, stolen or counterfeited. Backing out this “ordinary course fraud that would have occurred anyway,” as Meal put it, significantly reduces MasterCard’s damages attributable to the Target intrusion, he said.

“Ultimately MasterCard is making estimates based in part on information they got from the issuers and based in part on just their judgment, making estimates as to what the losses are, and it's formulaic, it's absolutely formulaic. We on Target's side happen to think that they wildly overestimate what the issue or losses are, not underestimate, overestimate,” Meal emphasized.

“There are some issuers, Your Honor, who incurred no costs here, who didn't reissue cards, who didn't incur any fraud. For those issuers this is a windfall,” he added.

What’s Next?

Magnuson did not rule on the motion during the hearing, but he did express reservations that could indicate what will happen next.

“Can MasterCard and Target get into a deal? Absolutely. But can Target force through MasterCard as a quasi agent, force these banks to accept it? That's my concern,” he said, according to the transcript.

“I know, as well as you do, now that as soon as we get done here and if I put my blessing on this, then you're going to come in and see me about Visa and you're going to come in and see me with American Express and Discover, and if there's anybody else left to talk about,” he told Meal.

Instant Insights /

Target Settlement Inadequate: Financial Institutions

Related Stories

Recommended For You