By: Hefner H.B. No. 4007
A BILL TO BE ENTITLED
AN ACT
relating to payment card skimmers and the creation of a payment card
fraud center; imposing a civil penalty; creating criminal offenses.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Title 12, Business & Commerce Code, is amended by
adding Chapter 607 to read as follows:
CHAPTER 607. PAYMENT CARD SKIMMERS
SUBCHAPTER A. GENERAL PROVISIONS
Sec. 607.001. DEFINITIONS. In this chapter:
(1) "Center" means the payment card fraud center
established under Chapter 424, Government Code.
(2) "Financial institution" has the meaning assigned
by Section 277.001, Finance Code.
(3) "Merchant" means a person whose business includes
the sale of motor fuel or other goods and services to retail
customers.
(4) "Motor fuel dispenser" means a machine that is
used to pump gasoline, diesel, biofuels, or other types of fuels
into motor vehicles.
(5) "Payment card" has the meaning assigned by Section
522.001.
(6) "Service Company" and "service technician" have
the meanings assigned by Section 13.451, Agriculture Code.
(7) "Skimmer" means a wire or electronic device that
is capable of unlawfully intercepting electronic communications
and used
to perpetuate fraud. The term includes a re-encoder and
scanning device, as those terms are defined by Section 522.001.
(8) "Unattended payment terminal" means a
point-of-sale terminal or kiosk that is operated by a customer to
activate a transaction through use of a payment card.
SUBCHAPTER B. DUTIES RELATED TO USE OF CERTAIN UNATTENDED PAYMENT
TERMINALS
Sec. 607.051. MERCHANT DUTIES REGARDING UNATTENDED PAYMENT
TERMINALS. A merchant that has an unattended payment terminal at
the merchant's place of business shall implement procedures in
accordance with the rules adopted by the attorney general under
Section 607.052 to:
(1) prevent the installation of a skimmer on the
payment terminal;
(2) find and remove a skimmer placed on the payment
terminal; and
(3) report the discovery of a skimmer to the Center.
Sec. 607.052. RULES. (a) The attorney general by rule
shall establish reasonable policies and procedures that identify
best practices for merchants to use to comply with Section 607.051.
(b) In adopting rules under Subsection (a), the attorney
general must consider:
(1) emerging technology;
(2) compliance costs to merchants; and
(3) any impact the policies and procedures may have on
consumers.
Sec. 607.053. DISCOVERY OF SKIMMERS. (a) If a service
technician discovers a skimmer on the unattended payment terminal,
the service technician or service company that employs the
technician shall immediately notify the merchant of the skimmer.
If a merchant discovers the skimmer or is notified of the skimmer by
a service technician or other person, the merchant shall:
(1) immediately disable, or cause to be disabled,
unattended payment terminal on which the skimmer was discovered and
notify a local law enforcement agency that a skimmer has been
detected;
(2) take appropriate measures to protect from
tampering with the unattended payment terminal until a local law
enforcement agency arrives; and
(3) not later than 24 hours after the discovery of the
skimmer, or after a report of the discovery of a skimmer is made to
the merchant, report the discovery to the Center.
(b) If a service technician discovers a skimmer on the
unattended payment terminal of a motor fuel dispenser, the service
technician or service company that employs the technician shall
immediately notify the merchant of the skimmer. If a merchant
discovers the skimmer or is notified of the skimmer by a service
technician or other person, the merchant shall:
(1) immediately disable, or cause to be disabled, the
motor fuel dispenser on which the skimmer was discovered and notify
a local law enforcement agency that a skimmer has been detected;
(2) take appropriate measures to protect from
tampering with the motor fuel dispenser until a local law
enforcement agency arrives; and
(3) not later than 24 hours after the discovery of the
skimmer, or after a report of the discovery of a skimmer is made to
the merchant, report the discovery to the Center.
Sec. 607.054. REPORT TO Center. (a) In this section,
"interested person" includes:
(1) a local law enforcement agency;
(2) a merchant;
(3) a financial institution;
(4) a credit card issuer as defined by Section
505.001;
(5) a service technician or service company;
(6) a member of the public; or
(7) any other interested person.
(b) An interested person may submit a report of the
discovery of a skimmer on an unattended payment terminal at a
merchant's place of business to the Center.
Sec. 607.055. INVESTIGATION OF SKIMMER REPORTS. (a) On
receipt of a report under Section 607.053 or 607.054, the Center
shall direct the merchant to conduct an investigation and share the
report with the center.
(b) The Center may:
(1) coordinate with local law enforcement agencies in
conducting an investigation under this section; and
(c) A merchant shall cooperate with the Center during an
investigation conducted under this.
Sec. 607.056. CONFIDENTIALITY. (a) Except as otherwise
provided by this section, information is confidential and not
subject to disclosure under Chapter 552, Government Code, if the
information is:
(1) received by the Center under Section 607.053 or
607.054; or
(2) prepared or compiled by the Center in connection
with a report to or investigation conducted by the Center under this
subchapter.
(b) Information described by Subsection (a) may be
disclosed to:
(1) the attorney general;
(2) a criminal justice agency, as defined by Section
411.082, Government Code;
(3) the center;
(4) a financial institution that may be impacted by
the installation of a skimmer on the unattended payment terminal;
or
(5) another person if the disclosure of the
information is permitted or required by other law or court order.
(c) The disclosure of information under Subsection (b) is
not a voluntary disclosure for purposes of Section 552.007,
Government Code.
(d) On the dismissal or final resolution of a report or
investigation by the Center, information described by Subsection
(a) is subject to disclosure under Chapter 552, Government Code.
(e) Notwithstanding Subsection (a), the attorney general
may disclose to the public information made confidential by that
subsection if the attorney general determines that the disclosure
of the information furthers a law enforcement purpose.
SUBCHAPTER C. ENFORCEMENT
Sec. 607.101. CORRECTIVE ACTION. If the attorney general
has reason to believe that a merchant who, after an investigation
conducted by a law enforcement agency, has at the merchant's place
of business an unattended payment terminal on which a skimmer was
installed and who is in violation of a rule adopted by the attorney
general under Section 607.052, the attorney general shall notify
the merchant of the violation. The attorney general may order the
merchant to take corrective action as necessary, including the
implementation of best practices and the training of employees to
detect skimmers.
Sec. 607.102. CIVIL PENALTIES. (a) A merchant who wilfully
violates a rule adopted by the attorney general under Section
607.052 is liable to this state for a civil penalty in an amount not
to exceed $2,500.
(b) A merchant who negligently fails to make a report within
the period prescribed by Section 607.053, or who has had at least
three reports made under that section within a 24-month period as a
result of the merchant failing to comply with Subchapter B, is
liable to this state for a civil penalty not to exceed $2,500 for
each violation.
Sec. 607.103. OFFENSES; PENALTIES. (a) A person commits an
offense if the person refuses to allow the Center to direct the
inspection of an unattended payment terminal at the merchant's
place of business in violation of Section 607.055. An offense under
this subsection is a Class C misdemeanor.
(b) A person commits an offense if, after making a report
under Section 607.053, the person negligently or recklessly
disposes of a skimmer that was installed on the unattended payment
terminal by another person. An offense under this subsection is a
state jail felony.
(c) A person commits an offense if, knowing that an
investigation is ongoing or that a criminal proceeding has been
commenced and is pending, the person disposes of a skimmer that was
installed on the unattended payment terminal by another person. An
offense under this subsection is a felony of the third degree.
SECTION 2. Subtitle B, Title 4, Government Code, is amended
by adding Chapter 424 to read as follows:
CHAPTER 424. PAYMENT CARD FRAUD CENTER
Sec. 424.001. DEFINITIONS. In this chapter:
(1) "Center" means the payment card fraud center
established under this chapter.
(2) "Payment card" has the meaning assigned by Section
522.001, Business & Commerce Code.
(3) "Skimmer" means a wire or electronic device that
is capable of unlawfully intercepting electronic communications
and used to perpetuate fraud. The term includes a re-encoder and
scanning device, as those terms are defined by Section 522.001,
Business & Commerce Code.
Sec. 424.002. PAYMENT CARD FRAUD CENTER. (a) The
Department of Public Safety and other state or local agencies, as
designated by the attorney general, may collaborate with the
attorney general to establish a payment card fraud center as
provided by this chapter. The attorney general shall establish the
center in the City of Tyler.
(b) The attorney general shall appoint a director to
supervise and manage the center. The director is under the
supervision and direction of the attorney general.
Sec. 424.003. PURPOSE OF CENTER. (a) The center serves as
the state's primary entity for the planning, coordination, and
integration of the capabilities of law enforcement agencies and
other agencies to respond to criminal activity that is related to
payment card fraud, including through the use of skimmers.
(b) The purpose of the center is to maximize the ability of
state agencies and local law enforcement agencies to detect,
prevent, and respond to criminal activities related to payment card
fraud.
(c) The center shall assist state agencies and local law
enforcement agencies and merchants in their efforts to develop and
implement strategies to:
(1) detect skimmers;
(2) ensure an effective response if a skimmer is
found; and
(3) prevent payment card fraud.
Sec. 424.004. RULES. The attorney general by rule shall
adopt reasonable policies and procedures necessary to implement
this chapter.
Sec. 424.005. FACILITIES AND ADMINISTRATIVE SUPPORT. A
municipality's police department may provide facilities and
administrative support if the payment card fraud center is
established in the municipality.
Sec. 424.006. GIFTS AND GRANTS. The payment card fraud
center may accept gifts, grants, and donations to carry out the
purpose of the center.
SECTION 3. This Act takes effect September 1, 2019.