How To Lose 500,000 POS Terminals

In a situation that's a testament to the philosophy of "when you're in a hole, just keep digging," one of the biggest payment-card processors has now lost legal control of the phone lines that connect it to 500,000 point-of-sale terminals.

Last Tuesday (Nov. 9), as part of an ongoing legal fight, a federal judge ordered payments processing giant TSYS Acquiring Solutions to turn over control of seven phone lines used by TSYS POS terminals to merchant service provider EPS—even though many of the merchants' POS terminals connected to those lines don't have anything to do with EPS.

In theory, that puts merchants using tens of thousands of TSYS POS terminals at risk—their payment-card data could be hijacked! Or leaked! Or lost! In practice, that's not going to happen. For now TSYS still controls those phone lines while it mulls an appeal of the judge's order. But the case is a reminder that all third-party services depend on how well someone else is running another company. When a card processor gets sloppy and just a bit too arrogant with one customer, that can have effects that ripple out to many other retailers.

The root of the problem dates back to 2005, when EPS was a customer of CardSystems Solutions, which had just been hit by a breach involving 40 million payment card numbers. EPS moved its business to TSYS, which promised that EPS merchants would all be connected to TSYS by a single toll-free number, so if EPS wanted to change processors again that would be easier.

Then things turned sour. EPS complained about TSYS billing and penalty practices. The disagreement went to arbitration in 2007. In 2009, the arbitrator—a retired Arizona Supreme Court justice—ruled that TSYS owed EPS $2.6 million, and would have to give up another $1 million in penalties against EPS. The arbitrator also ruled that TSYS had to turn over to EPS control of that single toll-free line connecting the POS terminals to TSYS.

TSYS filed suit in federal court to overturn the arbitrator's ruling. The judge agreed with the arbitrator. Then TSYS filed another suit to overturn the judge's ruling as it specifically related to the toll-free number. It turns out that TSYS never did provide a single toll-free number for all EPS's merchant customers. Instead, EPS customers are distributed among seven different toll-free numbers that are also shared with many other merchants. Oopsie!

In the words of U.S. District Court Judge David G. Campbell, who handled the most recent legal round: "TSYS asserts that the 1-800 number awarded to EPS by the arbitrator does not exist, and that EPS’s merchants in fact are connected to TSYS through seven 1-800 numbers that are shared with hundreds of thousands of non-EPS merchants. TSYS argues that giving EPS control over these numbers will put these third parties at risk and will cause TSYS to be in breach of its other client contracts."

Too late, Judge Campbell ruled last week—you should have brought up that issue during arbitration, when you knew about it and EPS and the arbitrator didn't. Now you're obliged to turn over control of all seven of those toll-free numbers to EPS.

To recap: TSYS started out believing it was owed $1 million in 2007. Three years later, it owes $2.6 million and seven phone lines, and has a lot of explaining to do to the merchants using half a million of its POS terminals. And EPS is still using TSYS's services, at least until TSYS gets all the EPS merchants on the same toll-free line and gets those other TSYS customers off that line. Got all that?

Yes, it's a ridiculous situation. It arose from a promise that TSYS never intended to keep, and has just gotten messier as TSYS kept trying to wiggle out of the situation.

It's that sort of behavior that makes retailers and acquirers a little queasy. After all, they depend that payment processor. If the processor's business judgment is poor and corners are cut in one area, who knows what else may be happening along the way?

That's the real risk for the retailers caught in the middle of what, remember, started out as a billing dispute. They simply don't know what's going on. They have to trust their processor.

In this case, money—and time—will eventually solve the problem. TSYS may not be happy renting a new toll-free line and sending out new POS terminals programmed to use that line to EPS's 56,000 customers. But if TSYS is smart, it'll start doing that now, because even if it ultimately wins in court, it will still have to somehow disentangle EPS's merchants from its system.

On the other hand, if TSYS was smart, it would have started doing that years ago—and probably would be done by now.