Merchant Collusion

Merchant collusion is a form of payment fraud in which a merchant knowingly cooperates with others, such as fraudsters, cardholders or its own staff, to put false, inflated or disguised transactions through its card acceptance or payment accounts. Unlike ordinary card fraud, where the merchant is the victim of a criminal using stolen details, in merchant collusion the merchant is a willing participant and usually shares in the proceeds. Losses typically fall on issuers, acquirers and the payment facilitators that onboarded the merchant.

Merchant collusion is one type of merchant fraud, the broad category of fraud committed by or through merchants. It overlaps with money laundering, since many collusive schemes are used to move criminal funds, and with transaction laundering, in which an approved merchant processes payments for an undisclosed business.

Collusion takes many forms, but several patterns are well known to acquirers and card networks:

• Processing stolen cards. A merchant runs stolen or counterfeit card details through its terminal or website in exchange for a share of the money, knowing that chargebacks will follow later.
• Cash-out schemes. A merchant records fake sales on credit cards or buy-now-pay-later accounts and hands the cardholder cash minus a commission, turning credit into cash outside the issuer's rules. Cardholders may later default or falsely dispute the charges.
• Factoring. A legitimate merchant processes transactions for another business that could not obtain card acceptance itself, such as an unlicensed gambling site, disguising the real activity.
• Bust-out merchants. A business is set up to look legitimate, builds a normal processing history, then sharply increases fraudulent volume before disappearing, a merchant version of bust-out fraud.
• Refund abuse. A merchant issues refunds to cards that never made purchases, or employees refund sales to their own cards, an internal form of refund fraud.
• Skimming with staff. Employees copy card data at the point of sale, sometimes with the owner's knowledge, using card skimming devices.

Colluding merchants often look like normal businesses at the start. They pass onboarding checks, use real addresses and process a mix of genuine and false sales. Because the merchant cooperates, there may be no victim complaining at the time of the transaction; chargebacks may arrive weeks later, if at all, and by then the merchant may have withdrawn the money. Cash-out schemes are especially hard to spot because the cardholders consent to the charges and may never dispute them.

Collusion between a merchant and a cardholder can also defeat controls designed for third-party fraud. The cardholder passes authentication, the card is genuine, and the transaction carries a real signature or PIN.

Acquirers and payment facilitators look for patterns such as:

• Sales volumes or average ticket sizes far above what the stated business type and size would suggest.
• Many transactions from the same cards, or many cards with sequential numbers or the same issuer.
• Round-number amounts, many sales just below review thresholds, or transactions at unusual hours.
• Sudden growth in volume shortly before a spike in chargebacks or fraud reports.
• Refunds that exceed sales or go to cards with no matching purchase.
• A merchant category code that does not match what the website or descriptor shows.

Prevention starts with sound merchant underwriting: verifying the business and its owners, visiting premises or reviewing websites, and checking industry databases such as Mastercard's MATCH list of terminated merchants. Ongoing monitoring then compares actual activity with the expected profile. Acquirers often hold a merchant reserve or a rolling reserve for new or risky merchants so that funds are available to cover later chargebacks.

When collusion is confirmed, the acquirer usually terminates the merchant, keeps reserves to cover losses, reports the merchant to the networks' terminated-merchant databases and, where money laundering is suspected, files a suspicious activity report. Card networks may fine acquirers whose portfolios show excessive fraud, which gives acquirers a strong incentive to act quickly.

Merchant collusion raises costs across the payment system. Issuers absorb fraud losses, acquirers pay network fines, and honest merchants face tighter onboarding and higher reserves as acquirers become more cautious. In some countries, cash-out collusion has also been used to evade credit controls and capital restrictions, drawing regulatory attention to merchant networks that facilitate it.