No Risk, No Rewards: Credit Card Rewards Programs Under Administrative and Legislative Scrutiny

With pandemic-era travel restrictions in the rearview mirror, Americans are turning to their credit card rewards in droves to fund summer flights, lodging, and more. In light of these trends, the state of New York, the Consumer Financial Protection Bureau, and the Department of Transportation have turned their attention in recent months to consumer protection issues associated with these rewards. Below, we cover these developments and then provide some practical guidance for issuers reviewing their credit card programs given such regulatory scrutiny.

Summary

• In May, the CFPB published an Issue Spotlight Report ("Report") on the administration of credit card rewards programs. The Report expresses a broad concern that "consumers are not receiving the rewards they were promised" and that program administrators "distort the true costs of credit cards," creating consumer confusion and harming competition in the marketplace. The Report comes on the heels of recent CFPB enforcement and scrutiny related to credit card rewards, recent CFPB publications detailing findings of price complexity and competition issues in financial markets,[1] and repeated CFPB remarks about rewards program issues in its biennial CARD Act reports.[2]
• Alongside the release of the Report, the CFPB held a joint hearing with DOT focused on consumer complaints related to the acquisition and redemption of travel-specific credit card rewards. The hearing featured a panel of consumer advocates, financial industry executives, and travel executives, and highlighted governmental views on the discrepancies between credit card reward marketing materials and actual rewards program terms and conditions.
• Recent legislation in New York targets credit card rewards policies associated with the modification and expiration of rewards program terms, as well as consumer redemption of rewards. In particular, the legislation requires providing notice to a consumer in conjunction with the modification or expiration of rewards program terms, as well as a grace period during which a consumer may redeem rewards under existing terms prior to the modification or expiration of the program. The New York law contains ambiguities that have not been resolved through regulatory guidance, subsequent legislation, or enforcement, increasing the potential for industry compliance confusion.

The renewed state and federal interest in consumer protection issues associated with credit card rewards programs presages future enforcement, guidance, and scrutiny of such programs from interested state governments, federal regulators, and plaintiffs' attorneys.[3] The CFPB notes in its Report, for example, that it "will continue to monitor credit card rewards programs and work together with government partners to take necessary action on these issues as appropriate."

CFPB Report

On May 9, 2024, the CFPB released an Issue Spotlight Report focusing on consumer complaints and dissatisfaction about the administration of credit card rewards programs. In underscoring the importance of rewards programs to the consumer finance ecosystem, the Report details the popularity of rewards cards and highlights that credit card issuers often market rewards such as cash back and travel, rather than focusing on interest rates and fees.

Despite that focus, however, the CFPB states that for many borrowers, "the benefits of rewards programs fail to exceed the costs of credit cards" and "cardholders … typically pay more in interest and fees on a rewards card than a card without rewards, even after accounting for the value of earned rewards." Additionally, the CFPB notes that "[e]very quarter, four percent of accountholders loses [sic] access to at least some of their rewards."

The Report identifies four main categories of consumer complaints and potential regulatory issues pertaining to rewards programs:

• Vague or hidden conditions: Consumers reported being misled by advertising that failed to adequately disclose important limitations or conditions, potentially constituting deceptive "bait and switch" tactics.
• Devaluing earned rewards or changing program benefits: Consumers complained about issuers or partners devaluing rewards or eliminating certain benefits, particularly without proper notice, which the CFPB suggests may violate the law if it deprives consumers of promised benefits.
• Customer service issues and technical glitches delaying or blocking rewards redemption: Consumers faced difficulties redeeming rewards due to technical problems, poor customer service, or being caught in "doom loops" where they couldn't reach the correct servicing department.
• Revocation and expiration without notice: Consumers reported having their accounts closed and benefits revoked, or their rewards expired or withheld, without notice.

CFPB scrutiny of the above items may lead to enforcement under the Consumer Financial Protection Act's prohibition against unfair, deceptive, or abusive acts or practices (UDAAP). Indeed, based on the tenor of the Report's discussion of current credit card rewards program practices, as well as the uptick in recent regulatory activity on the subject as discussed below, we may see new CFPB enforcement actions related to credit card rewards programs.

To guard against such regulatory actions, issuers and others offering rewards programs should review the guidance in the Report and consider offering customer service support where rewards program issues are identified. Additional practical guidance, including practice points responsive to the Report, may be found in the Practical Guidance section below.

Other Federal Regulatory Activity

Regulatory enforcement

The CFPB's May 2024 Report was not the first time the CFPB has addressed consumer protection issues associated with rewards programs. The CFPB recently concluded an enforcement action based in part on credit card rewards practices the CFPB deemed to violate UDAAP, resulting in a significant financial penalty. Additional CFPB enforcement, as well as enforcement by the FDIC and OCC, has also taken place in recent years against entities operating rewards programs in a manner deemed to violate UDAAP.

Relevant enforcement actions have focused on alleged UDAAP violations including:

• Advertising credit card rewards sign-up bonuses without expressly stating that the sign-up bonuses were only available to consumers who applied for a reward card online, then withholding the bonuses from customers who signed up by telephone or in person.
• Advertising only the highest possible level of cash back earnings, without disclosing the tiered structure of the rewards program that resulted in lower cash back earnings on certain transactions.
• Failing to disclose the limited time period within which underlying transactions must occur in order to earn rewards based on those transactions.
• Advertising the ability to earn a cash rewards bonus when only a points rewards bonus could be earned.

CFPB joint hearing with Department of Transportation

In addition to enforcement, the CFPB has also shown a willingness to work with other interested governmental parties to highlight its consumer protection concerns about rewards programs. In May 2024, for example, the CFPB held a joint hearing with the DOT in which the heads of both agencies discussed ongoing concerns with the transparency and complexity of rewards programs.

Remarks from CFPB Director Rohit Chopra and Secretary of Transportation Pete Buttigieg focused on concerns about transparency in promoting and offering rewards programs and about barriers to competition. The hearing also featured panelists, including consumer advocates, transportation industry executives, and financial industry executives, highlighting the types of rewards program terms and offerings most understood by, and satisfying to, consumers.

CFPB Biennial CARD Act Reports

Scrutiny of rewards programs has been included in each of the CFPB's biennial CARD Act reports from 2013, 2015, and 2023, and is a frequent discussion topic in the CFPB's UDAAP-related guidance and publications. As DWT has discussed, the CFPB devoted a lengthy section to credit card rewards, referencing New York's recent rewards law, in the 2023 CARD Act Report. The CFPB's reference to New York's law – which, as explained below, requires more protective rewards program policies associated with the modification, redemption, and expiration of rewards points – is aligned with the May 2024 Report's emphasizing of revocation and expiration of rewards without notice as one of the four key areas of concern.[4]

New York General Business Law § 520-E

Key Takeaways

New York General Business Law § 520-E was enacted by the state of New York in 2021 and became effective in December 2023. The law establishes consumer protections concerning the devaluation and forfeiture of credit card rewards – in the process addressing many of the UDAAP concerns highlighted in the CFPB's May 2024 Report.

The New York law stipulates that, if any changes are made to a credit card rewards program, such as modification, cancellation, closure, or termination, the cardholder must be notified "as soon as possible" and "in any event within 45 days of such cancellation, closure, termination or modification." The cardholder must then be given a 90-day grace period to redeem, exchange, or use any accumulated credit card points, subject to the availability of the rewards. The term "modified" is broadly defined to include any changes that affect the accumulation, value, or use of points, limit rewards availability, or change the obligations of the cardholder with respect to the rewards program or credit card account.

The law also prohibits any separate agreement between the card issuer and the cardholder that would waive or limit this grace period. The law's protections do not apply in cases of fraud or misuse by the cardholder of the credit card account or related rewards program. The terms "fraud" and "misuse" are not defined in the legislation. Both private litigants and the State Attorney General could bring actions for violations of Section 520-E.

Though this New York law has now been effective for over half a year, and contains a variety of ambiguities, the state has published no relevant guidance. In the absence of such guidance, issuers have scrambled to implement major reward program overhauls while contending with some of the compliance questions outlined below.

Compliance Ambiguities

Timing. The law does not precisely define the timing requirements for notice and grace period. Issuers are required to provide notice "as soon as possible, and in any event within forty-five days" of rewards program cancellation, closure, termination, or modification. The law does not specify whether "within 45 days" is intended to mean prior to or after the cancellation, closure, termination, or modification. From a policy perspective, providing notice prior to the triggering event would put consumers on notice of the upcoming cancellation, closure, termination, or modification. On the other hand, because the 90-day grace period requirement runs from the date of notice, providing notice before the triggering event would give the consumer less time to redeem rewards points under the terms prior to cancellation, closure, termination, or modification.

Third-party rewards programs. The law is applicable to rewards programs operating under an "agreement or agreements between the holder and the issuer which is servicing the applicable credit card account or related rewards programs." While this means the law is of doubtful applicability to rewards programs serviced by a third party that is not a credit card issuer, there remains confusion about the extent of the law's applicability to rewards programs managed by a third party alongside a credit card issuer. For example, would the law apply to a rewards program associated with a co-branded airline card where the rewards program is managed by the airline, but its terms and benefits are referenced throughout card issuer marketing terms and contracts with consumers? Would it apply to a hotel rewards program with an optional affinity card offered by a third-party bank, where the card can be used to earn additional points? (And if the broader interpretation applies, will it affect only program members holding the credit card, or all members of the loyalty program?)

De minimis modification. The law requires that notice and a grace period be provided where an issuer makes a change to the rewards program that has "the effect of … reducing the value of points … limiting or reducing rewards availability, limiting a holder's use of points" or "otherwise diminishing the value of the rewards program." It is unclear to what extent this would require issuers to provide notice and a grace period to consumers where de minimis changes are made to the program. For example, it is unclear whether the law would require notice where certain available flight inventory is reduced, or where rewards previously redeemable for one food delivery service are now redeemable at a different food delivery service.

Population applicability. Additional concerns relate to which population card issuers must apply the New York law's protections. Questions of consumer geography, as well as the time of the consumer's credit card sign-up, may affect the law's applicability.

Other. Additional ambiguities exist and continue to create compliance difficulties for card issuers, especially in the absence of further New York state guidance, legislation, or enforcement. DWT actively monitors for the issuance of such materials, and tracks industry compliance trends, so that it may continue to assist card issuers in the design of compliance programs and infrastructure tailored to the New York law despite those ambiguities.

Practical Guidance

The following practical steps may mitigate the type of scrutiny discussed above in relation to the Report, recent CFPB enforcement actions, and the New York law.

+++

In light of ongoing scrutiny and attention from federal and state lawmakers and regulators, card issuers – and all entities offering consumer rewards programs (including merchant partners in card programs) – should consider proactively reviewing rewards program structures, advertising, disclosures, terms and conditions, and merchant partners' proprietary agreements to help avoid potential UDAAP risks. Additionally, financial institutions should consider analyzing their rewards-related complaints to determine whether any changes are necessary to safeguard their programs from the potential increase in regulatory scrutiny.

DWT advises clients in the financial services industry, travel sector, food and beverage sector, and more on federal and state regulations and guidance pertaining to rewards and loyalty programs. We continue to monitor further developments associated with the New York rewards law, CFPB activity, and other state and federal rewards program updates.