Wednesday, May 27, 2020
In addition, an FTC attorney warned that other payment processing companies should consider themselves on notice that the FTC expects them to be vigilant against scammers using the card processing networks to perpetrate fraud.
The FTC Act provides FTC jurisdiction over payment processing companies and prohibits specified activities such as opening or maintaining accounts for shell companies and those engaged in other types of fraud, as well as ignoring evidence of fraud in merchant accounts. The TSR addresses credit card laundering and can be used against payment processing companies whose clients use false and misleading statements to market debt relief and investment opportunities to consumers.
The settlement money collected from Fiserv and Ko will be disbursed for refunds to defrauded consumers, the FTC said.
The FTC's allegations relate to transactions, which occurred between 2012 and 2014, tied to rogue sales agents of First Pay Solutions, an ISO owned by Ko. The rogue agents, who were eventually arrested for fraud, submitted falsified applications and generated fake invoices and shipping labels, among other things, to avoid detection, according to lawyers for Ko.
First Data acquired First Pay in 2015, taking over its office space and hiring most of its employees, the FTC noted. In 2017, First Data named Ko vice president of strategic partnerships.
In addition to the monetary judgements against First Data and Ko, the settlement requires First Data to submit to annual audits by an FTC-approved independent assessor who will oversee compliance with the settlement for the next three years. The company also must screen and monitor certain high-risk merchants and implement an oversight program to monitor its wholesale ISOs. In addition, Ko agreed to a lifetime ban from selling payment processing services to high-risk merchants.
"First Data is paying $40 million because it repeatedly looked the other way while its payment processing services were being used to commit fraud," Daniel Kaufman, deputy director of the FTC's Bureau of Consumer Protection, said in announcing the settlement on May 19. "When companies fail to screen out fraudsters exploiting the payment processing system to steal people's money, they're breaking the law — and injuring consumers."
In a statement released at the time, Fiserv said the problems stemmed from isolated bad business practices. "This agreed resolution, which relates to a single U.S.-based ISO within the wholesale channel, is in the best interest of First Data Merchant Services, our clients and their customers, and consumers," the company noted. "We remain committed to ensuring that our business partners and merchants operate with integrity, and our enhanced practices will enable us to continue to lead the industry in fraud prevention, and business and consumer protection."
The FTC vote authorizing its staff to file a complaint and stipulated final orders with the U.S. District Court for the Southern District of New York was nearly unanimous, with one commissioner recusing herself from the vote. Stipulated final orders with the FTC have the force of law once approved by a federal District Court judge.
According to the FTC's allegations First Pay Solutions boarded hundreds of "facially false" merchant accounts that were tied to four scams. Three of them – Thrive Learning, Coaching Department and E.M. Systems – were subjects of FTC enforcement actions. The fourth, which used stolen credit card information to bill consumers without their consent, resulted in criminal prosecutions by the Department of Justice.
The FTC alleged that Ko should have known First Pay was boarding questionable accounts, given that some of his merchant level salespeople (MLSs) had criminal records, F ratings with the Better Business Bureau, and/or civil judgments for deceptive conduct. In fact, the FTC alleges several of Ko's staff warned him that some MLSs were opening accounts based on phony applications.
Jim Walden, managing partner of Walden Macht & Haran and an attorney representing Ko, claimed Ko was an unwitting victim. "Mr. Ko is confident that if the matter were to proceed to trial, the facts of the case would definitively demonstrate that First Pay exceeded its underwriting obligations and was itself a victim of these fraudulent agents," Walden said. "Mr. Ko decided to resolve this matter expeditiously by paying an additional monetary penalty that was far less than the legal fees he would have spent defending against this lawsuit."
First Data was aware of the problems at First Pay Solutions as early as April 2012, according to the FTC complaint. "For the next several years, First Data and First Pay Solutions communicated about deceptive conduct and high chargeback rates, but never seemed to do much about them," Lesley Fair, a senior attorney at the FTC wrote in a May 20, 2020, blog post. "At one point, First Pay Solutions' merchants accrued over 300,000 chargebacks in less than a year, totaling approximately 40 percent of First Data's excessive chargeback violations for its entire wholesale merchant business."
The situation was troubling enough to prompt executives at Well Fargo, an acquiring partner of First Data, to sound the alarm, and to terminate its processing contract with First Pay Solutions.
Visa was also troubled, Fair stated, and in December 2014, banned First Pay Solutions from boarding high-risk merchants until a full audit could be performed.
"Visa also required First Data to pay $18.7 million restitution in connection with First Pay Solutions' merchants," Fair wrote. "In April 2015, a forensic accounting firm found major failures in risk management practices, including deficient monitoring of merchant transactions and failures in due diligence by Ko and his company."
Considering what transpired, "[Y]ou might expect that First Data cut First Pay Solutions loose for highly questionable conduct, right? On the contrary," Fair wrote. Instead First Data purchased the ISO and asked Wells Fargo to allow former First Pay Solutions employees to board high-risk merchants.
While Wells agreed, there were restrictions, including that Vincent Ko have "no influence," according to the FTC's complaint.
Fair concluded that the First Data-Ko settlements should warn other companies of "the hazards of looking the other way when fraud stares you in the face" 
The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.
