2013-01- Urging State Legislatures to Prohibit the “Cramming” of Unauthorized Charges onto Consumer Telephone Bills and Proposing a Statute to Solve the Problem.

[e] on the inattention and fear of consumers or on the disparity of power between them and the persons they bill to extract payments which, in many cases, probably are not rightfully theirs”); California Pub. Util. Comm’n, Order Instituting Rulemaking to Establish Consumer Rights and Consumer Protection Rules Applicable to All Telecommunications Utilities, Decision 10-10-034 (Nov. 2, 2010) (“CPUC Order”), p. 33 (“customers do not carefully check bills and often pay small charges, even if unauthorized, due to the time and inconvenience of disputing the charges”).

5 CPUC Order, note 4 above, p. 7 (observation of The Utility Reform Network); S. Hrg. 112-171, note 1 above, p. 5 (“[b]ecause telephone companies generate revenue by placing third-party charges on their customers’ bills, telephone companies profit from cramming”); Segal, note 2 above (April 7, 2012) (“if the SMS system were set up by a disinterested party, rather than one that is sharing the profit, it would look much more consumer-friendly”).

6 See S. Hrg. 112-171, note 1 above, p, 7.

7 Orders pass supposed validation tests even when the supposedly validating information is incorrect. See Norristown Telephone Co., LLC, 26 F.C.C.R. 8844 (FCC 2011); Main Street Telephone Co., 26 F.C.C.R. 8853 (FCC 2011); Cheap2Dial Telephone, LLC, 26 F.C.C.R. 8863 (FCC 2011); VoiceNet Telephone, LLC, 26 F.C.C.R. 8874 (FCC 2011). As stated in Norristown, “[t]o the extent it actually uses them, Norristown’s validation and verification processes are clearly inadequate to confirm that the person who ‘enrolled’ in the plan, i.e., the one whom Norristown will charge for the service, in fact authorized the service.” As stated in Cheap2Dial, “[t]he name, address, email, and birth date were all false.” In all four cases, “[t]he only information that consistently belonged to the customer whom the Company charged was, in fact, his or her telephone number.” There was nothing in the process that “prevent[ed] the individual who [was] inputting the data from using someone else’s identifying information or otherwise falsifying that data.” Two of the companies claimed that one of the ways they validated the orders was to verify that the IP address from which the order came was within 100 miles of the customer’s billing address! Cheap2Dial, ¶¶ 8, 12, 18; VoiceNet, ¶¶ 8, 16. The deficiencies reported in these cases are not the isolated deficiencies of a handful of companies. The Iowa consumer advocate has filed petitions seeking civil penalties based on similar complaints against no fewer than 21 different companies. See NASUCA initial comments in response to notice of proposed rulemaking, “Empowering Consumers to Prevent and Detect Billings for Unauthorized Charges (“Cramming”), CG Docket No. 11-116, et al. (Oct. 24, 2011), pp. 21-24. In one Iowa case, the consumer reported he “graduated from high school the year before the supposed date of birth” on the alleged order. The order was not rejected. It went through. See complaint filed Oct. 23, 2009, Iowa Util. Bd. no. FCU-2010-0004. In another case, the complainant stated: “I am 90 years old. I do not use a computer . . . . I have been told an individual can give any phone number to purchase these services. This practice is an inviting environment for dishonesty. There has to be a better way!” See complaint filed Oct. 21, 2010, Iowa Util. Bd. no. FCU-2011-0023. Contrast a PIN number system in which, if a wrong PIN number is entered, the system bounces back “invalid PIN number,” and the transaction is rejected rather than approved.

8 In the Inc21.com case, note 3 above, the defendants acknowledged tens of thousands of fraudulently “manufactured” sales. Commonly at the center of the difficulty were about twenty telemarketing call centers, all but one located in India or the Philippines. Among other illegitimate practices, the telemarketers would digitally record the consumer’s voice when no verifier was on line, then play the consumer’s recorded voice in response to the verifier’s questions when no consumer was on line, all in such a way that the so-called verification process would classify the fraud as a valid sale. The use of “doctored” audio was “extremely difficult . . . to detect, particularly in light of the fact that the sales were deemed valid by the TPV review provider.” The record in the case contained numerous declarations from “customers” who, after being allowed to listen to their TPV recordings, stated the recordings were inaccurate and had been manipulated. A re-examination of 10,434 recordings that had supposedly been screened and passed showed that 4,616, or 44 per cent, actually failed. 975 F. Supp. 2d at 991-92. Complaints about “doctored” and otherwise invalid recordings are neither new nor unusual. Sampling from a dozen such complaints in Iowa are quoted in comments submitted by NASUCA to the FCC. See NASUCA comments, note 6 above, pp. 17-20.

9 Years ago, the Federal Communications Commission eliminated the welcome letter as a verification method for carrier changes because it “does not provide evidence . . . that the [consumer] has in fact authorized a carrier change,” does not “prevent carriers from sending welcome packages to consumers . . . from whom they have not obtained valid consent,” and “fail[s] to provide adequate protection against fraud.” Implementation of Subscriber Carrier Selection Changes Provisions of the Telecommunications Act of 1996, 14 F.C.C.R. 1508 (1998) ¶¶ 59-61, 89. The Commission recently reinforced this conclusion in the Norristown, Main Street, Cheap2Dial and VoiceNet orders, note 6 above: “The process does not require any action on the part of the consumer to confirm either that the consumer received the email or that the consumer signed up for or agreed to be charged for [the] service. Indeed, many of the complainants assert they never received any emails or other communications from [the company] regarding its . . . service. This would not be surprising given that, as noted above, the email address in [the company’s] records is generally not the consumer’s. Even if a consumer did, in fact, receive this welcome material, it is possible, if not probable, that he or she might reasonably discard the material as ‘junk’ mail or spam, given that the consumer did not create a relationship with, or even know of the existence of, [the company].”

10 CG Docket No. 11-116, “Empowering Consumers to Prevent and Detect Billing for Unauthorized Charges (‘Cramming’); see NASUCA initial comments in response to further notice of proposed rule-making, filed June 22, 2012, pp. 13-14.

11 See note 2 above.

12 From 1996 through 1998, in actions affecting nearly 400,000 consumers, state public utility commissions and state attorneys general ordered carriers to pay at least $13.4 million in customer restitution and at least $4.1 million in penalties and fines for slamming and cramming violations alone. U.S. Government Accountability Office, Telecommunications: State and Federal Actions to Curb Slamming and Cramming, Report No. GAO/RCED-99-193 (July 1999), http://www.gao.gov/archive/1999/rc99193.pdf, p. 14.

13 See S. Hrg. 112-171, n. 1 above.

14 See Verizon Wireless Data Usage Charges (Consent Decree), 25 F.C.C.R. 15105 (Enf. Bur. 2010) (consent decree requiring credits or refunds of data usage charges exceeding $50 million to approximately 15 million affected customers, a $25 million voluntary payment to the U.S. Treasury and a compliance plan designed to eliminate cramming).

15 See Press Release, Federal Trade Commission, Oct. 25, 2007, “Phone Bill ‘Cramming’ Defendant Settles FTC Charges,” http://www.ftc.gov/opa/2007/10/nationwide.shtm, (describing “massive fraudulent billing scheme [involving] more than $30 million in bogus collect call charges [collected] from millions of consumers”); Order Instituting Investigation into the Operations of Telseven, LLC No. I.10-12-010 (Cal. Pub. Util. Com’n Dec. 21, 2010) (alleging unauthorized directory assistance charges totaling over $21 million on phone bills of approximately three million Californians); NASUCA initial comments in response to notice of inquiry, “Consumer Inquiry and Disclosure,” CG Docket No. 09-158, et al. (Oct. 13, 2009), pp. 49-52 (frequent complaints of unauthorized charges for long distance, collect, directory assistance and other calls, including apparent scams). In one case, a collect call from a sex hotline was supposedly received at the home of a 65-year old grandmother who lived alone; the company produced a voice recording allegedly showing the calls were accepted by a male who identified himself as “Marcus Welby.” See id.

16 As observed by the California Public Utilities Commission, telephone companies are responsible for all charges placed on their bills. CPUC Order, note 4 above, p. 2. California rules thus require telephone companies to conduct a reasonable inquiry prior to approving a third-party vendor or billing aggregator, to monitor the billings the telephone company controls for the purpose of preventing and detecting unauthorized charges, and promptly to address and resolve disputed billings without deflecting consumers to the third-party vendor or billing aggregator. Id., Attachment A, §§ 5, 6, 8.

17 See Doty v. Frontier Communications Inc., 36 P.3d 250, 258 (Kan. 2001) (“[t]o allow Frontier to participate and profit through its contractual agreements . . . – yet insulate itself from any responsibility – flies in the face of the intent of the Kansas Legislature when it enacted [the slamming statute]”; Press Release. Federal Trade Commission, “FTC Seeks Return of $52 Million Worth of Bogus Phone Bill Cramming Charges; Agency Charges Nation’s Largest Third-Party Billing Company with Contempt” (May 8, 2012) (“BSG cannot profit from the fraud of others and then deny responsibility for the harm they made possible”).see also Hudson v. United States, 522 U.S. 93, 104 (1997) (civil monetary penalty “can be imposed even in the absence of bad faith”); Northern Wind, Inc. v. Daley, 200 F.3d 13, 19 (1st Cir. 1999) (“scienter never has been required for violations of public welfare regulations”).

18 See S. Thaker and T. Ramos, PCI [Payment Card Industry] Compliance for Dummies (2011) (observing there are many points of vulnerability in a payment system, and explaining the numerous steps that need to be taken in order to protect against them, including the use of a PIN number or its equivalent).

19 While there is a cost-benefit analysis that needs to be done in conjunction with the development of a reliable authentication process, the analysis has already been done in the payment card industry.

Proposal

June 2013

An Act prohibiting unauthorized charges on telephone bills and providing a penalty.

Section 1. Findings. The legislature finds:

(1) The “cramming” of unauthorized charges onto consumer bills, due often to scams and frauds, has long been a serious problem with respect to wireline telephone bills. There is widespread concern that the problem has been migrating to wireless telephone bills.

(2) The unauthorized charges are often small in amount. They often recur from month to month. Because the charges are often small, consumers often do not notice them. As a result, the number of such unauthorized charges probably far exceeds the number of complaints.

(3) The unauthorized charges harm consumers, who often pay the charges even though of doubtful legitimacy, because the consumers either do not notice the charges or seek to avoid the difficulty of contesting the charges and the potential damage to credit scores.

(4) The telephone bill has become the functional equivalent of a debit or credit card, often carrying the charges of third parties unrelated to the billing telephone company, but without equivalent protections.

(5) Processes intended to authenticate that the charges placed on telephone bills are valid have often failed to authenticate that the charges have in fact been authorized by the person to whom they are billed.

(6) The telecommunications industry needs to develop processes that authenticate with a reasonable degree of reliability that the charges placed on telephone bills have in fact been authorized by the person to whom they are billed.

(7) The assessment of civil monetary penalties for unauthorized charges on telephone bills will encourage the industry to develop such adequate authentication processes and will help to curtail and eliminate the problem.

Section 2. Definitions. For purposes of this Act,

(1) “Authorization” means agreement to or approval of a service or charge by or on behalf of a consumer. Authorization is a factual issue. Authorization does not include words of assent given by or on behalf of a customer in reasonable reliance on material misstatements of fact made by or on behalf of a seller.

(2) “Billing aggregator” means a company that collects charges from third-party vendors and submits them to a telephone company for inclusion on a telephone bill.

(3) “Charge” means any line item on a telephone bill.

(4) “Telephone bill” means a bill, statement or invoice that includes one or more charges for a telecommunications service.

(5) “Telephone company” means a company that provides a telecommunications service.

(6) “Telecommunications service” means a voice communication service by wire or radio over the public voice network, regardless of the technology used, including wireline, wireless, voice-over-Internet-protocol or any other mode of service.

(7) “Third-party vendor” means a company, other than the billing telephone company, whose charges for a product or service appear on a telephone bill.

Section 3. Purpose. The purpose of this Act is to curtail and eliminate unauthorized charges on telephone bills.

Section 4. Prohibition. The placement of an unauthorized charge on a telephone bill is prohibited. This prohibition extends to each telephone company that places an unauthorized charge on a telephone bill, to each billing aggregator that submits an unauthorized charge to a telephone company for placement on a telephone bill, and to each third-party vendor that submits an unauthorized charge to a billing aggregator or to a telephone company for placement on a telephone bill.

Section 5. Defective authentication. A claimed “authentication” or “verification” for a service or charge is not a defense to a claim of violation of section 4 if the charge or service at issue was in fact unauthorized.

Section 6. Defense. A company shall not be determined to have violated the prohibition set forth in section 4 if the circumstances giving rise to the unauthorized charge were beyond the control of, or could not reasonably have been prevented by, the company.

Section 7. Civil penalty. A telephone company, a billing aggregator or a third-party vendor that violates the prohibition in section 4 is subject to a civil penalty. The civil penalty may be assessed, after notice and opportunity for hearing, by the [state public utilities commission or other appropriate jurisdiction]. The civil penalty shall not exceed ten thousand dollars per violation. Each violation is a separate offense.

Section 8. Amount of penalty. In determining the amount of penalty, the [state public utilities commission or other appropriate jurisdiction] may consider the size of the company, the gravity of the violation, any history of prior violations by the company, remedial action taken by the company, the nature of the conduct of the company and any other relevant factors.

Section 9. Public education. The [state public utility commission or other appropriate jurisdiction] shall take appropriate measures to educate the public regarding the placement of unauthorized charges on telephone bills, including publication of the number of consumer cramming complaints by third-party vendor name.

Section 10. Construction. This statute is remedial in character and shall be broadly construed to effect its purpose, as stated in section 3.