They were supposedly authorizing the purchases without ever taking what most consumers would consider a crucial step: giving the merchants their account numbers. They didn't have to, because the banks already had them.
Cox may have solved the mystery back then. He helped give it a name — "preacquired account marketing" — and filed successful suits against financial institutions linked to the marketers, such as Fleet Mortgage Co. and US Bank. He even helped U.S. Sen. Jay Rockefeller (D., W.Va.) win passage of 2010's Restore Online Shoppers' Confidence Act, which barred similar marketing on the Internet.
But it was only last week when Cox, now a University of Minnesota law professor, had reason to see victory on the horizon.
After years of efforts by Cox and others to eliminate various versions of the same scheme, two federal financial regulators finally cracked down hard on it. They ordered Capital One, a major credit-card issuer, to pay $210 million in consumer refunds and penalties for nearly a decade of deceptive marketing that was much like what Cox first saw in the '90s.
One of the regulators was the Consumer Financial Protection Bureau, which turned a year old this weekend — a birthday that Cox and other consumer advocates are happy to celebrate.
"I've been trying to get attention focused on this for 15 years now," Cox told me. In addition to helping Rockefeller, he published an article lambasting the practice — and regulators' blind eye toward it — in the Harvard Journal on Legislation.
"This case is exactly why we needed the CFPB," Cox says. "This has been going on for 20 years, and no federal regulator had the power or interest in going after them."
To be sure, that inaction partly reflects the fact that the cases involve businesses' skirting the line in ways that they could at least contend weren't outright deception. But Cox says there's abundant evidence that some of the nation's largest banks, including JPMorgan Chase, Citigroup and Bank of America, are involved in the same kinds of practices.
Cox says the Capital One scheme differed only slightly from the tactic he first saw in the '90s, in which banks provided consumers' names and account numbers directly to third-party vendors. With that crucial information already in hand, Cox says, a seller can turn a time-honored market dynamic on its head.
Think about it. When you buy something, you know exactly when you've agreed to the purchase: when you hand over your cash, check or other form of payment. If you don't retain that control, you'll be at risk any time you encounter an unscrupulous merchant.
That's exactly what happens here. Cox says the business model "flips the power dynamic in the solicitation process by shifting the burden to the consumer" to stop a transaction rather than start one. At the very least, it's a recipe for misunderstanding.
In Capital One's case, the bank didn't provide the account details to its vendors. Instead, it hired them to answer the phones in call centers where customers called to activate their cards.
But not just any customers or call centers. According to the CFPB, Capital One apparently steered its low-end and less-credit-worthy customers — "subprime" cardholders with low credit scores, and cardholders with credit limits under $5,000 — to the call centers staffed by the vendors.
When they called, they were pitched services such as "Payment Protection" and credit monitoring. And just like 15 years ago, no one had to ask for their credit-card number. The vendor, quite obviously, started out with it.
"You have the exact same problem, which is that the consumer is being charged for something without ever giving their account number," Cox says.
To be fair, the Office of the Comptroller of the Currency joined in the enforcement against Capital One, albeit under a new director, Thomas J. Curry, appointed last July by President Obama. But the OCC's previous record on this subject only helps prove Cox's point.
When he worked in law enforcement a decade ago, Cox sought the OCC's help in his efforts against preacquired account marketing. Ironically, the only times it intervened were on behalf of the banks it regulated — to argue for the narrowest readings of rules, or against state efforts to enforce consumer-protection laws against them.
Cox made that point in a 2010 letter to former Sen. Christopher Dodd, a chief sponsor of that year's Dodd-Frank financial reform — the law that established the CFPB despite fierce lobbying against it by the banking industry. He called the case "one obvious example among many that the OCC identifies with the interests of the banks it regulates and has no understanding of, even hostility to, consumer protection concerns."
Let's face it: Consumer protection isn't sexy. No regulation is. It's just the nuts-and-bolts business of government, which we need to do things we can't always do as individuals.
I can only speculate why Capital One targeted those low-end consumers for its vendors' questionable pitches. Perhaps surprisingly, Cox says, "a lot of sophisticated consumers bite on this."
The case is just a small part of the agency's first year. Via e-mail Friday, CFPB director Richard Cordray mentioned efforts to "fix the broken mortgage market — a leading cause of the financial crisis and a key part of our economic recovery," as well as efforts to cut down on fine print, improve student loans and credit cards, and give consumers a place to find answers or complain when their financial dealings go awry.
For his part, Cox isn't willing to count his victories just yet. But he was happy to see that the CFPB chose a major bank's mystery charges as its "first public enforcement action."
"This is huge," he says, "because there's finally a real cop on the beat."
Contact Jeff Gelles at 215-854-2776 or firstname.lastname@example.org.