New Jersey-2024-A1211-Introduced

An Act concerning scanning devices, amending P.L.2005, c.225 and supplementing P.L.1960, c.39 (C.56:8-1 et seq.).

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. Section 1 of P.L.2005, c.225 (C.2C:21-6.1) is amended to read as follows:

1. a. Definitions. As used in this section:

(1) "Merchant" means any owner or operator of any store or other retail mercantile establishment, or any agent, servant, employee, lessee, consignee, officer, director, franchisee or independent contractor of such owner or proprietor.

(2) "Payment card" means a credit card, charge card, debit card or any other card that is issued to an authorized card user and that allows the user to obtain, purchase, or receive goods, services, money or anything of value from a merchant.

(3) "Reencoder" means an electronic device that places encoded information from the magnetic strip or stripe of a payment card onto the magnetic strip or stripe of a different payment card or any electronic medium that allows a transaction to occur.

(4) "Scanning device" means a scanner, skimmer, reader or any other electronic device that is used to access, read, scan, obtain, memorize or store, temporarily or permanently, information encoded on the magnetic strip or stripe of a payment card.

b. It shall be [a crime of the third degree] unlawful for a person, with the intent to defraud an authorized user of a payment card, the issuer of the authorized user's payment card or a merchant, to use:

(1) a scanning device to access, read, obtain, memorize or store, temporarily or permanently, information encoded on the magnetic strip or stripe of a payment card, without the permission of the authorized user of the payment card; or

(2) a reencoder to place information encoded on the magnetic strip or stripe of a payment card onto the magnetic strip or stripe of a different card or any electronic medium that allows a transaction to occur without the permission of the authorized user of the card from which the information is being reencoded.

An offense under this subsection shall be a crime of the third degree; provided, however, it shall be a crime of the second degree if a subsequent offense results in a theft of at least $50,000 or if the first offense and the subsequent offense result in a combined total theft of at least $50,000.

c. It shall be a crime of the fourth degree for a first offense and a crime of the third degree for a second or subsequent offense for a person to knowingly possess with intent to commit a violation of paragraph (1) or (2) of subsection b. of this section any device, apparatus, equipment, software, article, material, good, property or supply that is specifically designed or adapted for use as or in a scanning device or reencoder.

(cf: P.L.2005, c.225, s.1)

2. (New section) a. As used in this section:

"Director" means the Director of the Division of Consumer Affairs.

"Merchant" means any owner or operator of any store or other retail mercantile establishment, or any agent, servant, employee, lessee, consignee, officer, director, franchisee, or independent contractor of such owner or proprietor.

"Payment Card" means a credit card, charge card, debit card, or any other card that is issued to an authorized card user and that allows the user to obtain, purchase, or receive goods, services, money, or anything of value from a merchant.

"Scanning device" means a scanner, skimmer, reader, or any other electronic device used to access, read, scan, obtain, memorize, or store, temporarily or permanently, information encoded on the magnetic strip or stripe of a payment card.

b. In accordance with rules and regulations adopted by the director pursuant to subsection c. of this section, a merchant that accepts payment cards in this State shall implement reasonable security measures to prevent the use of a scanning device at any payment terminal to access, read, obtain, memorize, or store, temporarily or permanently, information encoded on the magnetic strip or stripe of a consumer's payment card.

c. The director shall adopt, pursuant to the "Administrative Procedure Act," P.L.1968, c.410 (C.52:14B-1 et seq.), rules and regulations necessary to effectuate the provisions of subsection b. of this section, which shall include, but not be limited to, the following security measures for merchants:

(1) the regular inspection of payment terminals;

(2) periodic training for employees on how to identify and prevent payment card scanning;

(3) the installation of security cameras or other applicable security devices; and

(4) the use of applicable antivirus or encryption software.

In addition, the director shall provide direction and oversight to merchants on complying with the provisions of this section and for the development and distribution of informational materials regarding best practices that merchants shall implement to prevent the use of scanning devices.

3. This act shall take effect on the first day of the seventh month after enactment, but the Director of the Division of Consumer Affairs may take any administrative action in advance of the effective date as may be necessary to implement the provisions of this act.

STATEMENT

This bill upgrades the criminal penalties for the use and possession of a scanning device and requires merchants to take reasonable safety measures to prevent payment card scanning.

A "scanning device" is any scanner, skimmer, reader, or any other electronic device, such as a reencoder, that is used to access, read, scan, obtain, memorize, or store, temporarily or permanently, information encoded on the magnetic strip or stripe of a payment card. Under current law, it is a crime of the third degree for any person, with intent to defraud an authorized user of a payment card, the issuer of the authorized user's payment card, or a merchant, to use a scanning device to access, read, obtain, memorize or store, temporarily or permanently, any information encoded on the magnetic strip or stripe of a payment card without the permission of the authorized user of the payment card; or to use a reencoder to place the information encoded on the magnetic strip onto a different card, or any electronic medium that allows a transaction to occur, without the permission of the authorized cardholder, issuer or merchant.

In addition, currently, it is a crime of the fourth degree for a person to knowingly possess, with intent to commit an unlawful act, any device, apparatus, equipment, software, article, material, goods, property, or supply that is specifically designed or adapted for use as or in a scanning device or reencoder. A crime of the third degree is punishable by a term of imprisonment of three to five years, a fine of up to $15,000, or both. A crime of the fourth degree is punishable by a term of imprisonment of up to 18 months, a fine of up to $10,000, or both.

This bill upgrades the criminal penalties for the use or possession of a scanning device. The bill provides that the use of a scanning device is to be a crime of the third degree; provided, however, it is to be a crime of the second degree if a subsequent offense results in a theft of at least $50,000 or if the first offense and the subsequent offense result in a combined total theft of at least $50,000. The possession of a scanning device is to be a crime of the fourth degree for a first offense and a crime of the third degree for a second or subsequent offense. A crime of the second degree is punishable by a term of imprisonment of five to 10 years, a fine of up to $150,000, or both.

In addition, this bill requires merchants that accept payment cards to implement reasonable safety measures to prevent the use of scanning devices at any payment terminal in accordance with rules and regulations adopted by the Director of the Division of Consumer Affairs. Under the bill, the director is to create rules and regulations to effectuate the provisions of this bill, which are to include, but not be limited to, the following security measures for merchants:

� the regular inspection of payment terminals;

� periodic training for employees on how to identify and prevent payment card scanning;

� the installation of security cameras or other applicable security devices; and

� the use of applicable antivirus or encryption software.

The bill also requires the director to provide direction and oversight to merchants on complying with the provisions of this bill and for the development and distribution of informational materials regarding best practices that merchants are to implement to prevent the use of any scanning device.

An unlawful practice is punishable by a monetary penalty of not more than $10,000 for a first offense and not more than $20,000 for any subsequent offense. In addition, a violation can result in a cease and desist order issued by the Attorney General, the assessment of punitive damages, and the awarding of treble damages and costs to the injured.