By: Hefner H.B. No. 4007

A BILL TO BE ENTITLED

AN ACT

relating to payment card skimmers and the creation of a payment card fraud center; imposing a civil penalty; creating criminal offenses.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Title 12, Business & Commerce Code, is amended by adding Chapter 607 to read as follows:

CHAPTER 607. PAYMENT CARD SKIMMERS

SUBCHAPTER A. GENERAL PROVISIONS

Sec. 607.001. DEFINITIONS. In this chapter:

(1) "Center" means the payment card fraud center established under Chapter 424, Government Code.

(2) "Financial institution" has the meaning assigned by Section 277.001, Finance Code.

(3) "Merchant" means a person whose business includes the sale of motor fuel or other goods and services to retail customers.

(4) "Motor fuel dispenser" means a machine that is used to pump gasoline, diesel, biofuels, or other types of fuels into motor vehicles.

(5) "Payment card" has the meaning assigned by Section 522.001.

(6) "Service Company" and "service technician" have the meanings assigned by Section 13.451, Agriculture Code.

(7) "Skimmer" means a wire or electronic device that is capable of unlawfully intercepting electronic communications and used to perpetuate fraud. The term includes a re-encoder and scanning device, as those terms are defined by Section 522.001.

(8) "Unattended payment terminal" means a point-of-sale terminal or kiosk that is operated by a customer to activate a transaction through use of a payment card.

SUBCHAPTER B. DUTIES RELATED TO USE OF CERTAIN UNATTENDED PAYMENT

TERMINALS

Sec. 607.051. MERCHANT DUTIES REGARDING UNATTENDED PAYMENT TERMINALS. A merchant that has an unattended payment terminal at the merchant's place of business shall implement procedures in accordance with the rules adopted by the attorney general under Section 607.052 to:

(1) prevent the installation of a skimmer on the payment terminal;

(2) find and remove a skimmer placed on the payment terminal; and

(3) report the discovery of a skimmer to the Center.

Sec. 607.052. RULES. (a) The attorney general by rule shall establish reasonable policies and procedures that identify best practices for merchants to use to comply with Section 607.051.

(b) In adopting rules under Subsection (a), the attorney general must consider:

(1) emerging technology;

(2) compliance costs to merchants; and

(3) any impact the policies and procedures may have on consumers.

Sec. 607.053. DISCOVERY OF SKIMMERS. (a) If a service technician discovers a skimmer on the unattended payment terminal, the service technician or service company that employs the technician shall immediately notify the merchant of the skimmer. If a merchant discovers the skimmer or is notified of the skimmer by a service technician or other person, the merchant shall:

(1) immediately disable, or cause to be disabled, unattended payment terminal on which the skimmer was discovered and notify a local law enforcement agency that a skimmer has been detected;

(2) take appropriate measures to protect from tampering with the unattended payment terminal until a local law enforcement agency arrives; and

(3) not later than 24 hours after the discovery of the skimmer, or after a report of the discovery of a skimmer is made to the merchant, report the discovery to the Center.

(b) If a service technician discovers a skimmer on the unattended payment terminal of a motor fuel dispenser, the service technician or service company that employs the technician shall immediately notify the merchant of the skimmer. If a merchant discovers the skimmer or is notified of the skimmer by a service technician or other person, the merchant shall:

(1) immediately disable, or cause to be disabled, the motor fuel dispenser on which the skimmer was discovered and notify a local law enforcement agency that a skimmer has been detected;

(2) take appropriate measures to protect from tampering with the motor fuel dispenser until a local law enforcement agency arrives; and

(3) not later than 24 hours after the discovery of the skimmer, or after a report of the discovery of a skimmer is made to the merchant, report the discovery to the Center.

Sec. 607.054. REPORT TO Center. (a) In this section, "interested person" includes:

(1) a local law enforcement agency;

(2) a merchant;

(3) a financial institution;

(4) a credit card issuer as defined by Section 505.001;

(5) a service technician or service company;

(6) a member of the public; or

(7) any other interested person.

(b) An interested person may submit a report of the discovery of a skimmer on an unattended payment terminal at a merchant's place of business to the Center.

Sec. 607.055. INVESTIGATION OF SKIMMER REPORTS. (a) On receipt of a report under Section 607.053 or 607.054, the Center shall direct the merchant to conduct an investigation and share the report with the center.

(b) The Center may:

(1) coordinate with local law enforcement agencies in conducting an investigation under this section; and

(c) A merchant shall cooperate with the Center during an investigation conducted under this.

Sec. 607.056. CONFIDENTIALITY. (a) Except as otherwise provided by this section, information is confidential and not subject to disclosure under Chapter 552, Government Code, if the information is:

(1) received by the Center under Section 607.053 or 607.054; or

(2) prepared or compiled by the Center in connection with a report to or investigation conducted by the Center under this subchapter.

(b) Information described by Subsection (a) may be disclosed to:

(1) the attorney general;

(2) a criminal justice agency, as defined by Section 411.082, Government Code;

(3) the center;

(4) a financial institution that may be impacted by the installation of a skimmer on the unattended payment terminal; or

(5) another person if the disclosure of the information is permitted or required by other law or court order.

(c) The disclosure of information under Subsection (b) is not a voluntary disclosure for purposes of Section 552.007, Government Code.

(d) On the dismissal or final resolution of a report or investigation by the Center, information described by Subsection (a) is subject to disclosure under Chapter 552, Government Code.

(e) Notwithstanding Subsection (a), the attorney general may disclose to the public information made confidential by that subsection if the attorney general determines that the disclosure of the information furthers a law enforcement purpose.

SUBCHAPTER C. ENFORCEMENT

Sec. 607.101. CORRECTIVE ACTION. If the attorney general has reason to believe that a merchant who, after an investigation conducted by a law enforcement agency, has at the merchant's place of business an unattended payment terminal on which a skimmer was installed and who is in violation of a rule adopted by the attorney general under Section 607.052, the attorney general shall notify the merchant of the violation. The attorney general may order the merchant to take corrective action as necessary, including the implementation of best practices and the training of employees to detect skimmers.

Sec. 607.102. CIVIL PENALTIES. (a) A merchant who wilfully violates a rule adopted by the attorney general under Section 607.052 is liable to this state for a civil penalty in an amount not to exceed $2,500.

(b) A merchant who negligently fails to make a report within the period prescribed by Section 607.053, or who has had at least three reports made under that section within a 24-month period as a result of the merchant failing to comply with Subchapter B, is liable to this state for a civil penalty not to exceed $2,500 for each violation.

Sec. 607.103. OFFENSES; PENALTIES. (a) A person commits an offense if the person refuses to allow the Center to direct the inspection of an unattended payment terminal at the merchant's place of business in violation of Section 607.055. An offense under this subsection is a Class C misdemeanor.

(b) A person commits an offense if, after making a report under Section 607.053, the person negligently or recklessly disposes of a skimmer that was installed on the unattended payment terminal by another person. An offense under this subsection is a state jail felony.

(c) A person commits an offense if, knowing that an investigation is ongoing or that a criminal proceeding has been commenced and is pending, the person disposes of a skimmer that was installed on the unattended payment terminal by another person. An offense under this subsection is a felony of the third degree.

SECTION 2. Subtitle B, Title 4, Government Code, is amended by adding Chapter 424 to read as follows:

CHAPTER 424. PAYMENT CARD FRAUD CENTER

Sec. 424.001. DEFINITIONS. In this chapter:

(1) "Center" means the payment card fraud center established under this chapter.

(2) "Payment card" has the meaning assigned by Section 522.001, Business & Commerce Code.

(3) "Skimmer" means a wire or electronic device that is capable of unlawfully intercepting electronic communications and used to perpetuate fraud. The term includes a re-encoder and scanning device, as those terms are defined by Section 522.001, Business & Commerce Code.

Sec. 424.002. PAYMENT CARD FRAUD CENTER. (a) The Department of Public Safety and other state or local agencies, as designated by the attorney general, may collaborate with the attorney general to establish a payment card fraud center as provided by this chapter. The attorney general shall establish the center in the City of Tyler.

(b) The attorney general shall appoint a director to supervise and manage the center. The director is under the supervision and direction of the attorney general.

Sec. 424.003. PURPOSE OF CENTER. (a) The center serves as the state's primary entity for the planning, coordination, and integration of the capabilities of law enforcement agencies and other agencies to respond to criminal activity that is related to payment card fraud, including through the use of skimmers.

(b) The purpose of the center is to maximize the ability of state agencies and local law enforcement agencies to detect, prevent, and respond to criminal activities related to payment card fraud.

(c) The center shall assist state agencies and local law enforcement agencies and merchants in their efforts to develop and implement strategies to:

(1) detect skimmers;

(2) ensure an effective response if a skimmer is found; and

(3) prevent payment card fraud.

Sec. 424.004. RULES. The attorney general by rule shall adopt reasonable policies and procedures necessary to implement this chapter.

Sec. 424.005. FACILITIES AND ADMINISTRATIVE SUPPORT. A municipality's police department may provide facilities and administrative support if the payment card fraud center is established in the municipality.

Sec. 424.006. GIFTS AND GRANTS. The payment card fraud center may accept gifts, grants, and donations to carry out the purpose of the center.

SECTION 3. This Act takes effect September 1, 2019.