The Fair and Accurate Credit Transactions Act (“FACTA”) forbids sellers who accept credit cards from including more than the last five digits of a buyer’s credit card number on a purchase receipt. Yet including more than those five digits will not, by itself, make a seller liable under FACTA, according to a decision issued by the Eleventh Circuit Court of Appeals on October 28, 2020. The decision — Muransky v. Godiva Chocolatier, Inc., No. 16-16486, 2020 WL 6305084 (11th Cir. Oct. 28, 2020) — could leave future FACTA litigants scratching their heads.

The controversy started when Dr. David S. Muransky traveled to a Godiva storefront in Florida to purchase a box of chocolates. Using his credit card, he spent $19.26. The cashier handed him his receipt, which contained the first six and last four digits of his sixteen digit credit card number, more than FACTA permits. As the Court put it, Muransky then “got busy, filing a class action complaint less than a week later” on behalf of anyone in the United States who received a Godiva receipt displaying more than the last five digits of the buyer’s credit card number. Because of the number of potential class members, Godiva faced potential liability of $342 million — $1,000 per violation.

Seeking to avoid paying such a hefty sum, Godiva eventually sought to settle the case for $6.3 million, which the lower court approved. But meanwhile, the Supreme Court of the United States decided the case of Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016), which jeopardized the lower court’s ability to approve the settlement, or rule on the case in any other capacity at all, because of what it said about Constitutional standing. In order for a federal court to hear a case, the plaintiff must show that he was, in fact, injured by the defendant’s conduct. Spokeo, however, held that even though Congress can make certain conduct illegal through the passing of federal statutes (here, the inclusion of too many credit card digits on a receipt), a defendant’s violation of the terms of a statute, by itself, does not necessarily mean that the plaintiff has in fact been injured. No injury; no lawsuit.

Relying on Spokeo, the Eleventh Circuit reversed the lower court’s approval of the settlement and dismissed the case without prejudice. Specifically, the Court explained that a plaintiff can show a concrete harm in two ways: (1) That the defendant’s violation of a statute directly caused harm to the plaintiff; (2) That the defendant’s violation of a statute created a real risk of harm to the plaintiff. In an extensive analysis, the Court found Muransky’s arguments insufficient under either theory, and held that even though Godiva had clearly violated FACTA’s requirements, the suit could not proceed because Muransky failed to show that the violation caused him harm, or materially increased the risk that he could suffer identity theft.

The dissent in the case accused the majority of diluting FACTA’s core protections by forcing plaintiffs to prove more than what is typically feasible, as tracing identity thieves can prove nearly impossible. The dissent noted “by assuming that [FACTA’s limited-digit requirement] redresses only actual identity theft and nothing more, the majority overlooks that FACTA protects against a point-of-sale harm—the consumer suffers a heightened risk of identity theft the moment the business prints an untruncated receipt . . . The court’s mistake all but ensures that consumers in the Eleventh Circuit must now allege, support, and prove that they suffered actual identity theft (or at least soon will) because of a defendant’s FACTA violation in order to avail themselves of the law’s protections.”

The Muransky case thus summons Forest Gump’s old maxim. As in life, or a box of chocolates, plaintiffs may not know if they have Constitutional standing before the court hands down a ruling.