Toll roads in Orange County, California are violating federal laws designed to guard against identity theft. That is the contention of Tustin resident Robert Cohen in a class action lawsuit filed last month in the US District Court for the Central District of California.

According to the complaint, the Foothill/Eastern Transportation Corridor Agency and the San Joaquin Hills Transportation Corridor Agency (state government entities collectively known as The Toll Roads) outsourced money collection first to 3M and then BRiC-TPS LLC. These firms, which handle payment information from 250,000 motorist trips every day, have allegedly failed to follow a 2006 law that prohibits the display of more than five digits of a credit card number on a receipt. Cohen received a notice from The Toll Roads disclosing eight digits of his Visa card number.

Congress adopted the Fair and Accurate Credit Transactions Act (FACTA) to keep identity thieves from gathering account numbers by, for example, looking for receipts in the trash. California's own version of this law has been in effect since 2001. Cohen argues the tolling agencies have no excuse for failing to abide by it.

"Since its enactment in 2006, the requirements of FACTA have been widely publicized, including to defendants," Cohen's attorney, Jeff S. Westerman, wrote. "Despite being on notice for over a decade, defendants willfully, knowingly, or recklessly violated FACTA, designed to prevent identity theft, when plaintiff and other class members paid their tolls with a credit or debit card and received an electronically printed receipt from The Toll Roads disclosing more than the last five digits of their card numbers."

Motorists who may not want to subject themselves to the possibility of identity theft have no choice, as these toll roads stopped accepting cash last year.

"Thieves commonly obtain credit or debit card receipts that are stolen, lost, or discarded, and use this information to engage in fraudulent and unauthorized credit and debit card transactions," Westerman wrote. "They are facilitated in deciphering account numbers if more than the last five digits of a credit or debit card are disclosed."

Under FACTA, affected consumers are entitled to damages of between $100 and $1000 for a violation, plus punitive damages.