Merchant Fraud

Merchant fraud is fraud committed by a business that accepts card or other electronic payments, or by criminals who set up a business for the purpose, at the expense of acquirers, payment facilitators, card issuers or customers. Typical schemes include processing stolen cards, taking payments for goods that will never be delivered, disguising prohibited activity behind a harmless-looking business, and disappearing with customer funds before refunds and chargebacks arrive. Because the merchant controls the sales records and receives the money, its fraud can be large and fast.

The term is used mainly by acquirers and payment providers, for whom merchants are customers that carry credit and fraud risk. It is sometimes also used loosely for fraud suffered by merchants, such as stolen cards used at an online shop; that is more precisely called payment fraud against merchants or, where the buyer disputes a genuine purchase, friendly fraud. This entry covers fraud committed by merchants.

Under card network rules, the acquirer guarantees its merchants' transactions to the network. If a cardholder disputes a purchase and the merchant cannot or will not repay, the acquirer must cover the chargeback. A fraudulent merchant that takes payments for undelivered goods and then closes leaves the acquirer with the bill. Acquirers therefore treat merchants as a form of credit exposure, which becomes most visible when payment is taken long before delivery, as with airlines, event tickets and subscriptions sold annually.

The same exposure applies to payment facilitators and marketplaces, which are responsible for the sub-merchants they onboard.

• Fake or bust-out merchants. Criminals create a business that passes onboarding, process normal sales for a while, then push a burst of fraudulent volume before vanishing, a pattern described under bust-out fraud.
• Collusion. The merchant knowingly processes stolen cards or fake sales with accomplices, described under merchant collusion.
• Transaction laundering. An approved merchant processes payments for a hidden business, often an illegal or high-risk one, through transaction laundering.
• Misrepresentation. The merchant lies about what it sells, its expected volumes or its delivery times to obtain cheaper pricing or avoid restrictions.
• Non-delivery and deceptive sales. The merchant takes payment for goods or services that are never provided, or uses hidden subscription terms to keep charging customers.
• Refund and credit abuse. Refunds are issued to the fraudster's own cards, or credits are created without matching sales.

Common red flags include volumes far above the business's stated size, a mismatch between the website and the declared merchant category code, many sales on cards from distant countries, sudden changes in average ticket size, rising chargeback ratios and frequent changes to bank details for payouts. New merchants that grow unusually quickly deserve particular attention, since fast growth is a feature of both successful start-ups and bust-out schemes.

Defences operate at three stages. At onboarding, merchant underwriting verifies the business and its owners, reviews its website and products, assigns a merchant risk classification, and checks industry databases of terminated merchants. During processing, monitoring systems compare real activity with the expected profile and flag unusual patterns, while test purchases can uncover laundering. At settlement, acquirers control exposure by delaying payouts for new merchants, setting processing limits and holding a merchant reserve against future chargebacks.

When fraud is found, the provider may freeze funds, terminate the merchant, add it to network databases of terminated merchants and report suspicious activity to the authorities. Card networks run monitoring programmes that fine acquirers whose merchants exceed fraud or dispute thresholds, so acquirers have strong incentives to detect and remove fraudulent merchants early.

Information sharing also helps. Acquirers that terminate a merchant for fraud are generally required to list it in the network databases, so that the same owners cannot simply open an account elsewhere under a new trading name. Some providers also share data on known fraudulent websites and bank accounts through industry groups.

Merchant fraud raises costs for the whole payment system. Acquirers price expected losses into their fees, tighten onboarding and demand reserves, which can make it harder for honest small businesses and new industries to accept cards. Customers who lose money to fraudulent merchants rely on chargebacks and consumer protection rules for recovery, and repeated failures of merchants in particular sectors can lead acquirers to classify the entire sector as high risk.