By: Hefner H.B. No. 4007
 
 
 
A BILL TO BE ENTITLED
 
AN ACT
  relating to payment card skimmers and the creation of a payment card
  fraud center; imposing a civil penalty; creating criminal offenses.
         BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
         SECTION 1.  Title 12, Business & Commerce Code, is amended by
  adding Chapter 607 to read as follows:
  CHAPTER 607. PAYMENT CARD SKIMMERS
  SUBCHAPTER A. GENERAL PROVISIONS
         Sec. 607.001.  DEFINITIONS. In this chapter:
               (1)  "Center" means the payment card fraud center
  established under Chapter 424, Government Code.
               (2)  "Financial institution" has the meaning assigned
  by Section 277.001, Finance Code.
               (3)  "Merchant" means a person whose business includes
  the sale of motor fuel or other goods and services to retail
  customers.
               (4)  "Motor fuel dispenser" means a machine that is
  used to pump gasoline, diesel, biofuels, or other types of fuels
  into motor vehicles.
               (5)  "Payment card" has the meaning assigned by Section
  522.001.
               (6)  "Service Company" and "service technician" have
  the meanings assigned by Section 13.451, Agriculture Code.
               (7)  "Skimmer" means a wire or electronic device that
  is capable of unlawfully intercepting electronic communications
  and used
  to perpetuate fraud. The term includes a re-encoder and
  scanning device, as those terms are defined by Section 522.001.
               (8)  "Unattended payment terminal" means a
  point-of-sale terminal or kiosk that is operated by a customer to
  activate a transaction through use of a payment card.
  SUBCHAPTER B. DUTIES RELATED TO USE OF CERTAIN UNATTENDED PAYMENT
  TERMINALS
         Sec. 607.051.  MERCHANT DUTIES REGARDING UNATTENDED PAYMENT
  TERMINALS. A merchant that has an unattended payment terminal at
  the merchant's place of business shall implement procedures in
  accordance with the rules adopted by the attorney general under
  Section 607.052 to:
               (1)  prevent the installation of a skimmer on the
  payment terminal;
               (2)  find and remove a skimmer placed on the payment
  terminal; and
               (3)  report the discovery of a skimmer to the Center.
         Sec. 607.052.  RULES. (a) The attorney general by rule
  shall establish reasonable policies and procedures that identify
  best practices for merchants to use to comply with Section 607.051.
         (b)  In adopting rules under Subsection (a), the attorney
  general must consider:
               (1)  emerging technology;
               (2)  compliance costs to merchants; and
               (3)  any impact the policies and procedures may have on
  consumers.
         Sec. 607.053.  DISCOVERY OF SKIMMERS. (a) If a service
  technician discovers a skimmer on the unattended payment terminal,
  the service technician or service company that employs the
  technician shall immediately notify the merchant of the skimmer.
  If a merchant discovers the skimmer or is notified of the skimmer by
  a service technician or other person, the merchant shall:
               (1)  immediately disable, or cause to be disabled,
  unattended payment terminal on which the skimmer was discovered and
  notify a local law enforcement agency that a skimmer has been
  detected;
               (2)  take appropriate measures to protect from
  tampering with the unattended payment terminal until a local law
  enforcement agency arrives; and
               (3)  not later than 24 hours after the discovery of the
  skimmer, or after a report of the discovery of a skimmer is made to
  the merchant, report the discovery to the Center.
         (b)  If a service technician discovers a skimmer on the
  unattended payment terminal of a motor fuel dispenser, the service
  technician or service company that employs the technician shall
  immediately notify the merchant of the skimmer. If a merchant
  discovers the skimmer or is notified of the skimmer by a service
  technician or other person, the merchant shall:
               (1)  immediately disable, or cause to be disabled, the
  motor fuel dispenser on which the skimmer was discovered and notify
  a local law enforcement agency that a skimmer has been detected;
               (2)  take appropriate measures to protect from
  tampering with the motor fuel dispenser until a local law
  enforcement agency arrives; and
               (3)  not later than 24 hours after the discovery of the
  skimmer, or after a report of the discovery of a skimmer is made to
  the merchant, report the discovery to the Center.
         Sec. 607.054.  REPORT TO Center. (a) In this section,
  "interested person" includes:
               (1)  a local law enforcement agency;
               (2)  a merchant;
               (3)  a financial institution;
               (4)  a credit card issuer as defined by Section
  505.001;
               (5)  a service technician or service company;
               (6)  a member of the public; or
               (7)  any other interested person.
         (b)  An interested person may submit a report of the
  discovery of a skimmer on an unattended payment terminal at a
  merchant's place of business to the Center.
         Sec. 607.055.  INVESTIGATION OF SKIMMER REPORTS. (a) On
  receipt of a report under Section 607.053 or 607.054, the Center
  shall direct the merchant to conduct an investigation and share the
  report with the center.
         (b)  The Center may:
               (1)  coordinate with local law enforcement agencies in
  conducting an investigation under this section; and
         (c)  A merchant shall cooperate with the Center during an
  investigation conducted under this.
         Sec. 607.056.  CONFIDENTIALITY. (a) Except as otherwise
  provided by this section, information is confidential and not
  subject to disclosure under Chapter 552, Government Code, if the
  information is:
               (1)  received by the Center under Section 607.053 or
  607.054; or
               (2)  prepared or compiled by the Center in connection
  with a report to or investigation conducted by the Center under this
  subchapter.
         (b)  Information described by Subsection (a) may be
  disclosed to:
               (1)  the attorney general;
               (2)  a criminal justice agency, as defined by Section
  411.082, Government Code;
               (3)  the center;
               (4)  a financial institution that may be impacted by
  the installation of a skimmer on the unattended payment terminal;
  or
               (5)  another person if the disclosure of the
  information is permitted or required by other law or court order.
         (c)  The disclosure of information under Subsection (b) is
  not a voluntary disclosure for purposes of Section 552.007,
  Government Code.
         (d)  On the dismissal or final resolution of a report or
  investigation by the Center, information described by Subsection
  (a) is subject to disclosure under Chapter 552, Government Code.
         (e)  Notwithstanding Subsection (a), the attorney general
  may disclose to the public information made confidential by that
  subsection if the attorney general determines that the disclosure
  of the information furthers a law enforcement purpose.
  SUBCHAPTER C. ENFORCEMENT
         Sec. 607.101.  CORRECTIVE ACTION. If the attorney general
  has reason to believe that a merchant who, after an investigation
  conducted by a law enforcement agency, has at the merchant's place
  of business an unattended payment terminal on which a skimmer was
  installed and who is in violation of a rule adopted by the attorney
  general under Section 607.052, the attorney general shall notify
  the merchant of the violation. The attorney general may order the
  merchant to take corrective action as necessary, including the
  implementation of best practices and the training of employees to
  detect skimmers.
         Sec. 607.102.  CIVIL PENALTIES. (a) A merchant who wilfully
  violates a rule adopted by the attorney general under Section
  607.052 is liable to this state for a civil penalty in an amount not
  to exceed $2,500.
         (b)  A merchant who negligently fails to make a report within
  the period prescribed by Section 607.053, or who has had at least
  three reports made under that section within a 24-month period as a
  result of the merchant failing to comply with Subchapter B, is
  liable to this state for a civil penalty not to exceed $2,500 for
  each violation.
         Sec. 607.103.  OFFENSES; PENALTIES. (a) A person commits an
  offense if the person refuses to allow the Center to direct the
  inspection of an unattended payment terminal at the merchant's
  place of business in violation of Section 607.055. An offense under
  this subsection is a Class C misdemeanor.
         (b)  A person commits an offense if, after making a report
  under Section 607.053, the person negligently or recklessly
  disposes of a skimmer that was installed on the unattended payment
  terminal by another person. An offense under this subsection is a
  state jail felony.
         (c)  A person commits an offense if, knowing that an
  investigation is ongoing or that a criminal proceeding has been
  commenced and is pending, the person disposes of a skimmer that was
  installed on the unattended payment terminal by another person. An
  offense under this subsection is a felony of the third degree.
         SECTION 2.  Subtitle B, Title 4, Government Code, is amended
  by adding Chapter 424 to read as follows:
  CHAPTER 424. PAYMENT CARD FRAUD CENTER
         Sec. 424.001.  DEFINITIONS. In this chapter:
               (1)  "Center" means the payment card fraud center
  established under this chapter.
               (2)  "Payment card" has the meaning assigned by Section
  522.001, Business & Commerce Code.
               (3)  "Skimmer" means a wire or electronic device that
  is capable of unlawfully intercepting electronic communications
  and used to perpetuate fraud. The term includes a re-encoder and
  scanning device, as those terms are defined by Section 522.001,
  Business & Commerce Code.
         Sec. 424.002.  PAYMENT CARD FRAUD CENTER. (a) The
  Department of Public Safety and other state or local agencies, as
  designated by the attorney general, may collaborate with the
  attorney general to establish a payment card fraud center as
  provided by this chapter. The attorney general shall establish the
  center in the City of Tyler.
         (b)  The attorney general shall appoint a director to
  supervise and manage the center. The director is under the
  supervision and direction of the attorney general.
         Sec. 424.003.  PURPOSE OF CENTER. (a) The center serves as
  the state's primary entity for the planning, coordination, and
  integration of the capabilities of law enforcement agencies and
  other agencies to respond to criminal activity that is related to
  payment card fraud, including through the use of skimmers.
         (b)  The purpose of the center is to maximize the ability of
  state agencies and local law enforcement agencies to detect,
  prevent, and respond to criminal activities related to payment card
  fraud.
         (c)  The center shall assist state agencies and local law
  enforcement agencies and merchants in their efforts to develop and
  implement strategies to:
               (1)  detect skimmers;
               (2)  ensure an effective response if a skimmer is
  found; and
               (3)  prevent payment card fraud.
         Sec. 424.004.  RULES. The attorney general by rule shall
  adopt reasonable policies and procedures necessary to implement
  this chapter.
         Sec. 424.005.  FACILITIES AND ADMINISTRATIVE SUPPORT. A
  municipality's police department may provide facilities and
  administrative support if the payment card fraud center is
  established in the municipality.
         Sec. 424.006.  GIFTS AND GRANTS. The payment card fraud
  center may accept gifts, grants, and donations to carry out the
  purpose of the center.
         SECTION 3.  This Act takes effect September 1, 2019.