12Jun

Today, There’s No Such Thing as Low-Risk Merchants

On: June 12, 2017

The methods used by fraudulent merchants to abuse legitimate payments ecosystem are constantly evolving. The technological advances in ecommerce, combined with proliferation of payment systems and the easiness of establishing online merchants, create ample opportunities for criminals to use Transaction Laundering as a gateway into the legitimate payments ecosystem.

What is Transaction Laundering?

Transaction laundering occurs when a merchant processes credit card transactions on behalf of another merchant. This emerging merchant-based fraud often masks proceeds stemming from illegal activities, and carries with it a high risk of failing to comply with credit card rules and financial regulations, such as AML/CTF requirements. Surprisingly, our definition of risk has not kept pace with the latest developments in merchant-based fraud.

Problems with Risk Scoring

Merchant Service Providers still rely on risk scoring that is largely based on merchant’s perceived exposure to chargebacks. In other words, merchants are assigned a risk score based on the likelihood of chargebacks for a given merchant category; high risk score corresponds to higher processing fees, stricter onboarding procedures and higher scrutiny by the merchant acquirers. MSPs will also look at other factors, such as credit history and liquidity, financial stability and volume of cash; however, the bare definition of ‘high-risk’ vs ‘low-risk’ merchants still mainly revolves around statistical likelihood for chargebacks and line of business.

Indeed, card brands impose clear-cut chargeback rules on the MSPs, making chargeback management a key aspect of MSPs’ risk management programs. However, chargebacks do not  capture the entire risk of a given merchant, far from it. It only represents an aspect of the risk, and in a counter-intuitive manner, sometimes low chargeback ratios can represent higher risks.

One of the main reasons for this is Transaction Laundering, a sophisticated merchant-based fraud scheme that takes advantage of payments networks by funneling illicit transactions through seemingly legitimate merchant accounts.

Why we need to look at “low risk” merchants

Typically criminals will choose a “low risk” merchant category as a storefront, i.e. one that, among other things, will usually have a very low if any chargeback activity. But even low risk merchants have some level of chargebacks. However fraudulent merchants will take precautionary measures to reduce the chargebacks in order to avoid scrutiny, and that is where the catch is.

In a typical Transaction Laundering scenario, the merchant that appears on the credit card statement is not the online store where the customer shopped at.  However, not recognizing the transaction, the customer is likely to cancel it. For this reason, the fradulent merchant will  make sure that their customers are aware that they will be charged with a different merchant name. This strategy, combined with the fact that the customer did indeed shop for an illegal product and is not likely to complain about it, causes chargebacks to go down to nearly zero. By limiting their exposure to chargebacks Transaction Launderers render chargebacks irrelevant when it comes to estimating the real risks associated with servicing such a merchant.

Merchant Service Providers are spending considerable efforts on looking at “high-risk” merchants, whereas illicit activity that exposes them to enormous compliance risks is occurring, ironically, within the so called “low-risk” merchant categories. Such merchants are able to fly under the radar and present a much larger danger for Merchant Service Providers when it comes to risks of financial penalties, regulatory fines and severe reputational and brand damage.

Today, There’s No Such Thing as Low-Risk

By using chargebacks as one of the main  criteria for merchant risk scoring, we have effectively allowed the criminals to operate right under our noses.

Transaction Launderers are most likely to select “low-risk” online storefronts to process transactions for their highly illegal activities. According to our research, illegal ecommerce activity often hides behind merchants with MCC codes corresponding to “low risk” merchant categories such as Book Stores, Miscellaneous Food Stores, Household Appliance Stores, Men and Boys Clothing, Variety Stores, Cosmetic Stores, Gift, Card, Novelty, and Souvenir Shops.

The extent of the problem

EverCompliant has discovered over half a million websites in the US alone that are offering illegal content, goods and services, including illegal drugs, firearms, prostitution – you name it –  and accept major credit card payments.  These sites may very well be processing their credit card transactions through “low-risk” online storefronts leaving an MSPs  exposed  to liability and brand damage associated with facilitating this highly illegal and immoral activities.

As mentioned above, with the traditional approach to risk scoring, Merchant Service Providers consider emerchants risky when there is a higher statistical likelihood of chargebacks, poor credit or poor financial liquidity.  Those factors are completely irrelevant when it comes to detecting Transaction Laundering activities.

Transaction Launderers know the system and excel at appearing legitimate during every step of merchant onboarding and underwriting. Fraudulent merchants know how to appear to have impeccable credit, low chargeback rates, excellent financial liquidity, all while engaging in Transaction Laundering activities.

How to Identify All Risks Within Your Merchant Portfolio

Merchant Service Providers need to shift their focus from “high-risk” clients towards a holistic approach to risk. They should start looking at their entire merchant portfolio, and particularly at the low cash value and seemingly innocent emerchants. As we have demonstrated above, Transaction Launderers are actually often hiding among the “low-risk” merchants.

We need to stop looking at a merchant as a single entity, and instead look at the entire merchant ecosystem. Such an approach would require a solution provider who could continuously monitor all merchants and see all related entities and hidden websites connected to their networks.

To learn more about how transaction laundering affects the payments industry in general and Merchant Service Providers in particular, sign up to our blog today!

Trackback URL: http://evercompliant.com/today-theres-no-such-thing-as-low-risk-merchants/trackback/

Leave reply:

Your email address will not be published. Required fields are marked *