Crucial: Bend Over, Good Samaritan
Posted: 2011-03-26. Categories: California, Idaho

This story starts nearly twenty years ago, when I became the victim of identify theft. After getting out of the Navy, I learned that a woman was using my SSN to collect state disability payments, preventing me from obtaining unemployment while I looked for work. Even through nearly two decades of trying to deal with this – I’m still suffering the effects of my very own “Blanca”.

I’m a good guy. I’m the guy that pulls over to help someone at the side of the road when they’re having car trouble or need to put on their tire chains and really don’t know what they’re doing. I’m the guy that freely answers (literally) hundreds of thousands of questions on support groups, forums and Aardvark to help people develop better websites, applications and support systems. I’m the guy that sees a problem and tries to fix it.

I’m also the guy that discovered a problem on the Crucial website last year, where they declared their Solid State Drives were more reliable because they “have moving parts.” I spent over 20 minutes trying to find the right way to notify them of the obvious error in their website copy, and ultimately sent a correction request to their sales team, since there wasn’t a “contact webmaster” option. I wasn’t even expecting a response, much less a thank you. Believe it or not, most business websites don’t even acknowledge these messages, even if they fix the problem almost immediately.

It really surprised me to receive a personal thank you note from Kathy Lansdowne, Sales and Support Manager for Crucial, offering me a 10% discount and “free overnight shipping” on my next order through Crucial. Very nice! Unfortunately, in order to take advantage of her offer, I had to contact them by phone, and their hours are only 6am-6pm, five days a week. My own web business keeps me on something close to a nocturnal schedule, which means that when I actually needed to order RAM about a month ago, it was a challenge to work around their schedule. 10% off and free overnight? It was worth it, especially since the only local business that sells RAM (Staples) didn’t actually have the style I needed.

Yesterday (Thursday) I finally managed to call during business hours and spoke with the delightful Sally for over a quarter hour. She answered my questions, ensured the discounts were applied (once she understood the difference between 1% and 10%), and actually managed to convince me to buy an extra 8gb to effectively max out not only my own computer and that of a client, but also my sons computer.

I live in the middle of nowhere. It’s wonderful here, but since we are so rural, most locals can’t get postal mail (or packages!) delivered to our homes. This results in a bunch of shipping problems, since most online sellers don’t know how they’re going to ship something until it’s actually being shipped, or the salesperson simply doesn’t know how shipping is ever performed. Sadly, this is the rule, not the exception. I can’t count how many times we’ve ordered through Amazon and the sellers page explicitly states that it’s going to be shipped by USPS only, but they refuse to accept our PO Box for delivery, until they ship it the first time to our home address and it’s returned to them undeliverable. Silly people.

Sally from Crucial said she understood this, and took down our billing address (PO Box) and our FedEx shipping address (home address), but explained that the “overnight shipping” wouldn’t actually deliver my $286.39 order until Monday, since it was too late on Thursday to get the order out the same day. I’ve waited a month already, what’s a couple more days?  At 1:59 PM PayPal (I used a PayPal Credit Card) reported that my payment had been authorized. At 2:05 PM I finished the call with Sally and hung up, happy that my “overnight” RAM would be here in only four days.

This morning I received an email from Crucial which read:

Due to a security check, your order is currently on hold. We will need additional verification before we can ship your order.

To expedite shipping, please fax a current utility statement that can verify your billing address. Also, please include the following sales order number on your fax.

Sales order number:########

Upon our receipt and review of the required verification, we will release your order.  Please contact us before 3-31-2011 or your order may be canceled.

We anticipate your immediate response to allow us to ship your order as quickly as possible. We apologize for any inconvenience this additional step requires; our policies are in place for your protection.

So let me get this straight. My “overnight” order is being delayed up to a full week because they want me to fax a copy of my utility bill? As a victim of ID theft, this terrifies me. Why would any reputable company need to have a copy of any of my bills? Especially when I already provided all of my credit card information to Sally (including the CCV). If they’re accepting credit cards, then I know three things:

  1. Asking for more information than my CC info and CCV is a violation of the terms of service for their credit card processor. Billing and delivery addresses are required for the transaction, of course, and were provided.
  2. Asking for more information actually violates privacy laws in some states, California included. There was a local case just last month that resulted in hefty fines for companies that were asking only for the zip codes of their customers!
  3. There is absolutely no legitimate need to have a copy of any of my bills. I’m not applying for credit. It’s not a bank account. I’m not proposing to anyone or forming a long-term contractual business relationship of any kind. I’m ordering consumer goods — and not even a lot, at that.

So I called. I initially spoke with Mona, who said that it was a “totally random security check” and that in order to fulfill my purchase, I was now required to provide a copy of a utility bill showing both my billing and delivery addresses. I asked to speak with Ms. Lansdowne, but she was busy, so I was passed instead to “another Sales and Support Manager,” Marcie Swenson.

I explained the problem to Marcie, who then told me that it was company policy that when one of these “random security checks” is performed, the customer is required to provide a utility bill or bank statement to Crucial to prove that it’s not fraud, you know, “for their protection.”

Further, I should be happy about providing this personal information to a company I have had no business dealings with, since this policy is to help prevent fraud, and since I’m a victim of identity theft, I should understand why providing a copy of my bank statement to them is for “my own protection.”

Really? That’s what they’re going with?

Let me get that straight…Providing a copy of my personal financial records to a third party that has already been approved by MasterCard for a near-$300 transaction is supposed to make me feel better? As a victim of identity theft, I say “Hell, no!”

When I explained my experience with ID theft and my unwillingness to provide a copy of my bank statement to Marcie, she said she “misspoke” and that it was actually only a utility bill that was required. While she may think this is reassuring, this is actually a perfect alternative piece of documentation to obtain credit in someone elses name. But you know, I can trust them since they’ve done so much for me already…oh, my mistake.

MasterCard has rules that forbid this:

5.8.1 Honor All Cards
A Merchant must honor all valid Cards without discrimination when properly presented for payment. A Merchant must maintain a policy that does not discriminate among customers seeking to make purchases with a Card.

I can’t help but think that this “flag” by Crucial is directly related to discrimination against rural America: No postal mail delivered to your home? Get bent.

5.8.4 Additional Cardholder Identification
A Merchant must not refuse to complete a Transaction solely because a Cardholder who has complied with the conditions for presentment of a Card at the POI refuses to provide additional identification information, except as specifically permitted by the Standards. A Merchant may require additional identification from the Cardholder if the information is required to complete the Transaction, such as for shipping purposes. A Merchant in a country or region that supports use of the MasterCard Address Verification Service (AVS) may require the Cardholder’s ZIP or postal code to complete a Cardholder-Activated Terminal (CAT) Transaction, or the Cardholder’s address and ZIP or postal code to complete a mail order, phone order, or e-commerce Transaction.

I don’t see where it authorizes Crucial to request a utility bill or bank statement, as there is no way that doing so could be a required component of the transaction (unless maybe they were actually my bank or utility provider). Further, since they’re wanting this unauthorized information by fax, I have no guarantee that the documentation would truly be destroyed and “not stored” as is also required. Any business fax system from the last decade stores recent incoming faxes unless the feature is explicitly disabled. What are the chances of that?

How do they justify this policy? They call it an “anti-fraud check.” Their privacy policy provides the following interesting wording:

We may use personal information provided to us to conduct anti-fraud checks that may help us detect and prevent fraud. The personal information we receive may be disclosed to a credit reference agency, fraud prevention agency or other information provider, which may keep a record of that information.

Essentially, both MasterCard and my home state of California forbid requesting this “personal information” from the buyer, but Crucial doesn’t actually mention in their policy that they’ll ever request this information, only that if they receive it, that it might be “used” and “recorded.” Maybe they think this is a good escape clause. Maybe they ought to think again.

5.10 Noncompliance Assessments
If the Corporation becomes aware of a Merchant’s noncompliance with any Standard, the Corporation may notify the Acquirer of such noncompliance and may assess the Acquirer, and the Acquirer must promptly cause the Merchant to discontinue the noncompliant practice. A notification by the Corporation with respect to at any one location of a Merchant requires the Acquirer to ensure that the Merchant is in compliance with the Standards at all locations of the Merchant that are subject to the Merchant Agreement(s).

That means they can be fined by MasterCard (sometimes upwards of $100,000) for failing to comply with MasterCard standards and rules. They have to comply with California law, too – they charged California sales tax, which means that they must have business locations here.

Q: A merchant required me to provide identification to use my MasterCard card
A: There are certain situations when you use your MasterCard card where a merchant may require some personal information: for example for the shipping purposes. Additionally, if the MasterCard card is unsigned, a merchant should request personal identification (but not record it) and ask the cardholder to sign the card before completing the transaction.

This site has a great summary of the industry privacy rules, state and federal, but also as required by credit card issuers:

Can merchants accepting MasterCard or Visa require customers to show a driver’s license or other identification as a condition of credit card acceptance?
While merchants may ask a customer for identification, in most situations, a merchant may not condition acceptance of a Visa or MasterCard credit card upon the customer presenting identification. In other words, you can refuse to provide identification, and the merchant still must accept your credit card. Many merchants are unaware of this rule or simply choose to ignore it.

So does California:

1747.08.  (a) Except as provided in subdivision (c), no person, firm, partnership, association, or corporation that accepts credit cards for the transaction of business shall do any of the following:
   (1) Request, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to write any personal identification information upon the credit card transaction form or otherwise.
   (2) Request, or require as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to provide personal identification information, which the person, firm, partnership, association, or corporation accepting the credit card writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise.

   (b) For purposes of this section “personal identification information,” means information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.

And the federal government provides advice specifically encouraging consumers to avoid sharing any more information than is absolutely necessary, to help prevent ID theft and a practice known as pretexting.

Since I refused to provide a copy of my utility bills or bank statements, Marcie courteously cancelled my order. Then she wrote me the following message:

At your request, Order ######## has been canceled.  I am very sorry that we weren’t able to reach an understanding.  I assure you that our security measures are in place to protect both of us.  Should you decide to send in a utility statement to verify your address, we will happily reinstate the order, and honor the 10% discount and free overnight shipping.

Clearly, Marcie doesn’t understand her business and legal obligations for credit card processing. And she isn’t really interested in fixing the root problem, which is that her business is demanding information from “randomly selected” customers (no doubt, all of which are actually urban Americans without home postal delivery) in violation of merchant policies and state laws.

As for me, my house, and my business, I’m happy to use the CrucialScan application for determining the specifics of the RAM my tech clients require in their computers – but I’ll keep buying RAM elsewhere. Amazon is good – and I’ve had great luck with both PNY or Corsair memory. Now, off to order RAM from Amazon – still gotta have it by Tuesday – and I know that Amazon can deliver!

11 Comments to "Crucial: Bend Over, Good Samaritan"

  1. HI, thanks for pulling my blog reference for your notes. I will NEVER send any retail merchant a bank statement or utility bill- in entirety. However, there really is some defense on their part because of the PO Box. When the billing address and shipping address differ, the merchant will ALWAYS lose any defense against a chargeback. Was there any discussion about editing out the account number on the utility bill, which the merchant can’t verify anyway?

    Here’s what Visa told me recently about another case: When the address differs, a signed approval faxed from the buyer with their drivers license (or passport) is about the only thing that could save the merchant from a chargeback resulting from fraud. Merchants don’t want to ask for it and consumers don’t to give it out. Here’s what I have a merchant do: check the white pages. Is the name there and does it match up with the order info? Call the phone number listed and ask if they are authorizing a charge. If the name, address, phone cannot be verified via public information, and there are many sources, then hold. Otherwise put it through.

  2. Retail Bandit says:

    Thanks for your feedback, 3D. The problem is – they refused to send it via USPS to my post office box. As you know, I’m a victim of ID theft, so I don’t publish my home address anywhere – not in the phone book, not on my Drivers License. It’s not going to happen.

    Instead of working with me (or even obeying the law), Crucial demanded that I provide information unnecessary to process the sale – and wouldn’t consider sending the package to my PO Box. There’s no good reason for that. We get “fedex to USPS” hand-offs all the time (received one on Friday), so their argument is invalid.

    Further, when asked if there was any way to avoid providing a copy of my utility bill or bank statement to Mona, she stated flatly that no matter what, the order couldn’t be processed now until I provided that documentation. Even if they normally would have delivered to PO Boxes, changing this would not bypass their “requirement” to provide unnecessary personal information.

  3. Kathy says:

    Thank you for the opportunity to provide a response to your post.

    It is regrettable that you had a poor experience with Crucial. This situation is an isolated event unique to your rural shipping location. It is also regrettable this poor experience happened to, “A Good Samaritan” and a veteran – both of which we have great respect for.

    The only orders we ask for additional verification on are those we are unable to verify are not fraudulent. All we are asking for is documentation in the form of a utility statement showing the cardholder does indeed live at the address the goods are shipping to. We do this as a courtesy to our customer rather than cancelling their order as potential fraud. In fact, a utility statement is only requested as a last resort if the shipping address cannot be verified by other means.

    Regarding the various laws and rules pointed out, Crucial does not believe it is violating any of those. There are certain rules that apply to card-not-present merchants that differ from card-present merchants and Crucial is not asking for information other than validation of the shipping address already provided to us on the order request. The customer is not required to provide a social security number or bank account number. Card-not-present merchants must take prudent steps to prevent fraud and can lose the ability to accept payment cards if we do not do so.

    I would appreciate it if you would contact us directly at crucialgeneralmanager@micron.com so we can review your order and hopefully get it out to you.

    – Kathy, customer support director, Crucial.com

  4. Retail Bandit says:

    Kathy, I appreciate you taking the time to reply.

    However, I’ll pass on your offer to exploit my decision to live in a rural area as an opportunity to be victimized by your company.

    According to Dan at MasterCard, who I spoke with this morning, you are “outside of compliance” with their Rules.

    Your admission above that this is directly related to my rural location further enforces the fact that you are discriminating against specific cardholders.

    After writing the article above, I placed an order for the RAM I needed through Amazon. I selected PNY, since I’ve had very good quality with them in the past. Amazon included free two-day delivery, so I expect it to be at my PO Box tomorrow. And it was actually 31% less than your “discounted” rates. All in all, I’m satisfied that I made a good decision to refuse to do business with your company.

    Why do so many businesses have such great difficulty with treating each customer the same?

  5. Retail Bandit says:

    If it were truly an isolated event, there wouldn’t be anyone else complaining.

  6. Annette says:

    Everyone these days think they have a right to invade consumers privacy. If more people refused to allow companies to get away with this stuff, it would stop.

  7. Annette says:

    Apparently, folks at Crucial have no clue just how easy it would be to forge the header of the utility bill. Anyone with any graphics skills at all could doctor one up. Whoever decided that was a good way to verify someone’s location isn’t the brightest bulb in the box.

  8. Scott says:

    DO NOT DO BUSINESS WITH CRUCIAL.COM

    Same thing happened to me today 2/8/2012. What they probably do is run an Accurate Report or Lexis Nexis on you and if they don’t like something they ask for additional information. The merchant should warn you verbally over the phone or in writing if you make a web purchase.

    This should be asked prior to making the sale not afterwards. THIS SHOULD BE AN AGAINST THE LAW. I FOUND THEIR WEBSITE BY SURFING THE NET. HOW DO I EVEN KNOW THEY ARE A LEGIT COMPANY. I GAVE THEM MY CREDIT CARD THEY COULD CONTACT AMERICAN EXPRESS SECURITY DEPARTMENT TO FIND OUT IF MY CARD HAS BEEN COMPRIMISED.

    MY ORDER WAS VERY A VERY SIMPLE $211 ORDER. F THESE BASTARDS. MAYBE THEY SHOULD SEND ME THEIR PERSONAL Utility bills or bank statements. CRUCIAL MANAGEMENT ORDER #28193284 IN CASE YOU CARE ABOUT YOUR CO. REPUTATION. I WILL LEAVE NO LESS THAN 10 POOR REVIEWS AND SPREAD THE WORD. I NEEDED THIS ORDER FAST-THE CUSTMER SERVICE REP WHO TOOK THE ORDER WAS GREAT.

    THEN I CHECKED MY EMAIL A FEW HOURS LATER. I WAS AT WORK AND THE NEXT REP PUT ME ON HOLD FOR ABOUT 10 MINUTES AND TOLD ME NOTHING HE COULD DO.

    SPREAD THE WORD THIS COMPANY SUCKS. Will complain to Clark Howard next. Hope he either puts this on his TV show or website as a company not to do business with.

  9. JOELUNCHBOX says:

    GIVE US YOUR IDENTITY FOR YOUR PROTECTION… COMPLETE LIE. YOUR CREDIT CARD HAS VIRTULY ZERO LIABILITY AGAINST THEFT. THEY ARE PROTECTING THEMSELVES….NOT YOU. IF THEY WANT TO PROTECT YOUR IDENTITY THEY WOULD ASK FOR LESS NOT MORE.

  10. JOELUNCHBOX says:

    WHAT CREDIT CARD USER HAS ANY RISK AGAINST FRAUDULENT CHARGES? BE HONEST Crucial is protecting Crucial… IF YOU DO BUSINESS WITH THIS KIND OF COMPANY AND THEY SURVIVE. OTHERS WILL FOLLOW AND INVADE YOUR PRIVACY. YOUR HAVE A RELATIONSHIP WITH YOUR CREDIT CARD COMPANY. CRUCIAL HAS A RELATIONSHIP WITH YOUR CREDIT CARD COMPANY. WHAT IS THE PROBLEM? WHY CANT THEY CALL THE CREDIT CARD COMPANY IF THERE IS AN ISSUE?

    HERE IS WHAT THEY SEND:

    To expedite shipping, please fax or e-mail Crucial a current utility statement verifying your billing address. You may render account numbers and utility usage data unreadable if you wish. Please include the following sales order number on your fax.

    Sales order number: xxxxxxxxx

    Upon our receipt and review of the required verification, we will release your order. Please contact us before 12-10-2010 or your order may be canceled.

    We appreciate your immediate response, allowing the shipment of your order as quickly as possible. We apologize for any inconvenience this additional step requires; this security policy is in place for your protection.

    Regards,

    Customer Support Representative
    Tel: 800-336-8896 option 3
    Fax: 208-368-5763
    mailto:crucial.service@micron.com

    Talk to an Expert Online
    http://www.crucial.com/contact/

    Join the Crucial Community
    Forums: http://forums.crucial.com/
    Facebook: http://www.facebook.com/CrucialMemory
    Twitter: http://twitter.com/crucialmemory
    YouTube: http://www.youtube.com/crucialmemory

  11. upen says:

    Thanks for this site. My friend ordered about $2000 USD worth of memory. Crucial emails asking for his utility bill. Friend is nervous, but even I would be nervous. Is there anyone else in the market who sells quality dimms? I’d like to suggest my friend a new vendor who doesn’t ask for such unnecessary information. By the way, this order was a one of the big cities in US. Who has given them right to ask for additional information. If credit card has a problem, the credit card company themselves will put a hold on the payment. Customer can call them and confirm they ordered.

    Thanks again.
    Up