http:// www.jms1.net / planet-smoothie.shtml

Trespassed from Planet Smoothie!

On January 25, 2007, I went into the Planet Smoothie store located at 155 Cranes Roost Blvd, Suite 1180, in Altamonte Springs, Florida (on the north side of 436, about two blocks east of I-4.) I ordered my usual smoothie (a medium PBJ with an extra shot of "booster blast"), watched the employee (female, name not known and not important to the issue at hand) at the counter run my credit card and add the points to my "customer loyalty" card, and hand me my receipts... just the usual transaction, something I had done roughly once a week in that store, for the past several months.

However, I noticed that she had placed her copy of the credit card slip, which contained my full credit card number (no row of "*" with just a few digits showing- it was the full 16 digits) into a plastic container on the counter- not only in full view of the customers, but where anybody who came to the counter could reach out and grab them. In fact, I reached out and picked up my own slip to verify that the full card number was there, and I was able to plainly see the full card numbers on two or three other customers' receipts (the receipts were curled and laying in several different directions, rather than than laying flat.)

So I asked her, in what I thought was a concerned but professional voice, why they were being kept on the counter, where anybody could see and/or grab them, and tried to explain to her that making customers' account numbers visible to the public like that was a violation of Visa's policies, that a friend had recently had his card number stolen because of something like this, and that in my past retail jobs the credit card receipts were always kept out of the view and/or reach of customers.

Before I could even finish what I was saying, another employee (who later gave me his name as "Joseph Lee") waved her off and proceeded to tell me that I "should speak in a more respectful manner", then told me that she was a minor and that he was 24 and he was the "head of security for this location." I had never mentioned anything about anybody's age, and yet this guy was acting as if I had slapped her across the face and berated her for being young.

So I tried to explain to him that I hadn't said anything about her age (or anybody else's, for that matter) and that as far as I knew I hadn't been rude, and that I just wanted my credit card number to not be visible to every other customer who came up to the counter.

Without answering me at all, Joseph pulled out his cell phone and called somebody, and asked them how to void a credit card transaction. I tried to tell him that I wasn't asking for a refund, I just wanted them to take the proper precautions with customers' credit card numbers- and then I also noticed that the employee who had helped me at first, was dumping my half-made smoothie down the drain.

Once he voided the transaction, he wrote his name at the bottom of it, handed me the void receipt, and told me that they "would not be serving [me] today or ever again", and that if I ever came back into the store I would be arrested for trespass after warning.

Not the reaction I expected when all I wanted was for them to take proper precautions with customers' credit card numbers.

So I took the receipt, and also took the manager's card from the card holder on the counter, and left.

When I got home 45 minutes later, I called Cherri Scoggin, who the card identified as the "Owner/General Manager", on her cell phone (because the normal phone number on the card was actually the store phone number of one of the other Planet Smoothie stores that she owns in Longwood- apparently she had just purchased this location from the previous owner, who I used to see in the store on a regular basis.)

I explained to her what had happened, and explicitly told her that, as far as I knew, I had not been rude or anything, and that I was just concerned about my card number being visible to other customers.

Her response was that she would have to call the store and speak with Joseph, to hear his version of what had happened, and that she would call me back at the same number I had called her from (which was my cell phone.) This is perfectly understandable, and I agree that she should consult with her people before making any kind of gesture toward me, positive or negative.

So at this point (2:00 am on January 26th), I'm waiting to hear back from her. My hope is that this is just a mis-understanding on Joseph's part, because honestly, I wasn't (and still am not) even remotely angry- I was (and am) concerned about my card number being visible to the entire world, but that's it.

I'm going to send Cherri an email with the URL for this page, so that she can see how I have publicly documented the incident, and let her know that however the issue is resolved, this web page will remain visible to the public (and to any search engines which might find it, and decide to add it to the list of results for the phrase "Planet Smoothie".)

I will state this: the only thing I want out of this incident is either an explanation of what it is that I supposedly did wrong, and if I did in fact do something wrong, a chance to apologize to whoever it was that I offended- because no offense was intended.

Or if, as I believe, I did not actually do anything wrong, I would like a written statement from Cherri Scoggin that Joseph's verbal trespass warning is null and void- because the truth is, I do like their products (especially the PBJ smoothie) and this particular store is in a good location for me, as I spend a lot of time in Altamonte.

And either way, I would like to know (and I'm sure all of their other customers would like to know) that customers' credit card numbers are not being left in plain sight anymore.

I'm not even asking for an apology, or for free smoothie coupons, or for anybody to lose their job or anything silly like that- there's no point, since no real damage has been done, other than confusing the heck out of me.

One side note- in all the years I worked retail, including three years of management-level experience, I have only had to trespass ONE customer, and that was because he wrote me a bad check. I have NEVER heard of anybody being trespassed for something as minor as reminding an employee to take the proper precautions with customers' credit card information. And yes, I have had to deal with customers who were going out of their way to be rude and argumentative, including several cases of people screaming in my face about something that one of my staff had done. Even if I WERE being rude (and I maintain that I was not rude in the least), issuing a trespass warning should be the very last resort- it should certainly not be a decision that an employee makes in 90 seconds without even trying to listen to the customer, unless the employee feels that there is a real danger to the staff or to other customers (and in that case the employee should call the police immediately.)

2007-01-26 1620 EST Earlier today I found a PDF file on Visa's web site which gives the rules that merchants are supposed to follow in order to accept Visa cards. I sent them an email, asking them to clarify the rules about whether card numbers were required to be truncated (i.e. replaced with "*****" on the receipt) on BOTH copies of a credit card receipt, or only on the customer copy. I just received their reply:

Dear John M Simpson,

Thank you for contacting Visa.

The first phase of the receipt truncation policy went into effect July
1, 2003 for all new terminals. Effective July 1, 2006, all electronic
terminals that process Visa cards are required to meet this standard.

Keep in mind, the above is on the cardholder's copy of the transaction
receipt only. The merchant copy must contain the full account number and
expiration date for payment processing.

To report any merchant practices that you feel are inappropriate, please
notify the disputes area at the financial institution that issued your
card account. Your card issuing bank has access to the appropriate Visa
rules and regulations as well as to the Notification of Customer
Complaint forms which should be used by your bank to document and file
merchant complaints. It is not necessary for your bank to be the
offending merchant's financial institution in order to file a complaint
for you.

As an alternative, to report merchant practices that you feel are
inappropriate, you may wish to contact the Visa Customer Care Services
at 1-800-VISA-911 (1-800-847-2911). Please advise them that you were
referred to file a merchant complaint. The staff will be able to
initiate a complaint form over the phone.

We hope this information proves helpful. For security reasons, we have
deleted personal information from the message below.

Thank you for writing,

Visa Webmaster

The "personal information" they were referring to was my cell phone number.

So it is within Visa's rules for the full card number and expiration date to be present on the merchant's copy of the receipt, but not on the customer's copy.

And as you can see, they also told me that if I felt that a merchant was not taking the appropriate steps to ensure the security of my account and/or card number, that I should call the bank which issued my card, and tell them that Visa told me to start a "Notification of Customer Complaint". I'm not going to do this yet- I think it's only fair to give Cherri Scoggin a chance to resolve the issue without having to involve anybody else.

2007-01-28 0525 I just checked my email for the first time today and found a response from Cherri Scoggin.

From: xxxxxx@xxxxxx
Subject: Re: Incident at the Cranes Roost store
Date: January 27, 2007 17:46:07
To: jms1@jms1.net

The credit card numbers on the receipts are exposed on all merchant receipts. We have taken the measure to remove the bin of receipts from exposure to anyone who shouldn't have access. Your suggestion was a valid security point, but Joey is our physical security officer not IT/CC.

However, that said, our video cameras and the testimony from my brother (Joey) and the others (2 employees) in the store backup the facts that, after the problem was rectified (bin was placed on safe out of view), you continued on and raised your voice to the employees. No one was ever rude to you but you were unable to be satifisied even after your suggestion was complied with. Joey was not concerned with a supposed mistake on his part, but the treatment of our employees by customers, especially the minors. We have rare customers who seem to be satifsfied with taking their frustrations out through vocal (volume and vocabulary) abuse of these kids. We do not tolerate that as we believe, that, since we honestly try to make our customers happy and provide the best service and product for their money these should always be transactions of mutual respect.

That aside, the verbal trespass is null and void. Not because of the webpage (it doesn't like IE obviously and my husband is the only person I know uses Firefox) but because we feel that you are an intelligent individual and if you feel you can return to the store and treat us with the respect we treat you with, then you are as welcomed as any other customer we have. Also, please, take up any future problems with me directly (my cell number is xxx.xxx.xxxx).

Cherri R. Scoggin

Planet Smoothie #435, #478 and #396

Owner/Manager

Obviously, I am glad that the matter has been resolved.

However, I do wish to clarify a couple of things:

Leaving credit card numbers visible on the counter IS a physical security issue. The problem here had nothing to do with the fact that the full card numbers were on the receipts- according to Visa this is normal, and I had suspected as much before asking them, so I'm not overly concerned with that fact. The problem is that the bin with the credit card slips was PHYSICALLY sitting on the counter where customers could see and take them, and the solution was to PHYSICALLY move the bin out of the view and reach of customers.

Trying to excuse a security risk by splitting hairs over whether it falls under the "physical security" category or the "IT security" category is just a word game. Part of what I do for a living is IT security work- and when a client asks me to do an IT security evaluation, one of the first things I look at is the physical security of the systems involved. The different "types" of security are all tied together, because a failure in one can easily result in a failure in all of them.

The point is that security is security, regardless of whether you're trying to prevent customers from taking credit card slips out of a box on the counter, or trying to prevent "computer hackers" from stealing a file full of credit card numbers from your computer.
The very first words out of Joey's mouth were, as clearly as I can remember, "You should be more respectful when you talk to us." (I'm sure that if the store's video cameras also have sound, that the videotape will confirm this.) HE was the one who turned the situation into a confrontation, by attacking me. My voice was not raised in anger- I used a tone of voice which expressed concern, but not anger.

Joey never stated anything like "thank you for letting us know", or "we're moving it", or even "hello" or "can I help you". Joey didn't explain what he was doing in terms of moving the credit card slips, and he totally ignored me while he was wrestling with the credit card machine- he never gave me a chance to have a civil conversation, his attitude was extremely confrontational from the first word out of his mouth.

If Joey had taken five seconds to acknowledge my concerns and TELL ME that he was moving the plastic bin, that would have ended the entire situation and I would have happily walked out of the store with my smoothie. Instead, he verbally attacked me, ignored me while I tried to respond, and then kicked me out of the store without giving me any chance to talk- it's like his mind was made up before he even opened his mouth.

Again, if the store cameras have sound, I encourage Cherri to go back and listen to who said what, and in what order.

I have spent several years working in retail (including three years of management experience) and I'm sure most people who read this will also have had some kind of job experience where they were dealing with the public on a regular basis. We all know that customers are going to say or do things that you may not like. Sometimes it's because they're unhappy with something in the store, or unhappy about something not related to the store, or sometimes (as in this case) the employee just mis-reads a customer... but regardless of the reason, you don't start a conversation with a customer (or anybody else, for that matter) by attacking them- that's just plain bad customer service.

To me it sounds like Joey had been told to "protect" the minor employees, and he just went way too far in trying to do that. In a way that's admirable- I know that I've dealt with my share of customers over the years who just wanted to blow off some steam at the nearest person who "had to take it" (like a retail employee), and I've listened to a few young employees cry after dealing with difficult customers, usually over something which wasn't their fault.

However, part of hiring young employees is giving them the skills that they will need in future jobs- and one of those skills is dealing with customers... and not just the overly cheerful ones.

Look at it from the other side- when a customer walks into your store, they don't see "a minor" behind the counter... they see an EMPLOYEE, plain and simple. I know that when I walked into this store, the age of the people behind the counter never crossed my mind- it could just as easily have been a 20 year old girl, a 40 year old man, and a 90 year old grandmother. The fact is that they're behind the counter, pushing buttons on the register and scooping fruit into blenders to make smoothies. They are employees.

And when I saw the credit card numbers sitting out like that, I told the nearest employee about the problem. The fact that it happened to be a minor was not an issue, at least not to me... but apparently Joey had "protecting minors" on the brain, and mistakenly gave that priority over "customer service".

Joey was, as near as I can tell, acting in a management role- which means that part of his job is to train the employees, or to at least demonstrate the proper ways to do things. In a retail environment, customer service is the single most important thing that an employee does. Joey's actions in this incident did not teach the employees anything about customer service- how to listen to a customer and then take care of their concerns. If anything, he showed them that if a customer asks a question and you don't know the answer or you don't like their tone of voice, the way to handle it is to attack the customer for asking the question, and then kick them out of the store.

Cherri, you and/or your company may have a policy of being overly protective about your minor employees... but you cannot logically expect every person who walks through the door to know which of your employees are minors, or to treat the minors any differently from adult employees. And to be honest, your customers should not HAVE to treat them any differently- which means that it doesn't make a whole lot of sense for you to treat them any differently. I know that during my time in retail management, I always treated all of my employees the same way, as professionals. This included every employee, from age 16 to age 63. I know that my employees appreciated this, becuase they told me so, and because the company I was working for has a "supervisor review" process and that was on about 90% of my review sheets.

You probably won't agree with this, but I feel that this kind of over-protective attitude toward minor employess is not serving these minors very well. Of course you need to protect your employees from real problems, including customers who are truly abusive, that's a given. However, you should be teaching them that every customer who walks through the door deserves to be LISTENED TO before deciding whether or not they are being abusive.

And in my case, that was not done.

There, I've said my piece. Unless I receive a further response from Cherri, I consider the matter closed... and I'll probably be in there sometime this next week for a smoothie.