Michaels Breach: Who’s Liable?

Tracy Kitten reports:

…. What role should merchants play, when it comes to ensuring transactional security, and how should financial institutions, as card-issuers, fall into the fray?

Attorney Randy Sabett, partner and co-chair of the Internet and Data Protection practice at law firm SNR Denton LLP, says the liability lines are often blurred and hard to define after a breach. Despite that card fraud usually occurs outside banking institutions’ control, banks and credit unions, as the card issuers, usually absorb losses and expenses associated with breach recovery.

“There is a lot of entanglement in the credit card industry,” Sabett says. “It all goes back to the contract. It’s often hard to pin anything down in the contract. But the way most of these contracts are written, the retailers aren’t liable.”