Transaction Laundering

Transaction laundering is the practice of putting payments for one business through a merchant account that was approved for a different business, so that the bank, the card schemes and often the customer cannot see who is really being paid. The hidden seller is usually one that could not get card acceptance on its own, such as an unlicensed gambling site, a seller of counterfeit goods or illegal drugs, or a business already banned for excessive fraud.

Card schemes treat it as a form of factoring, meaning one merchant submitting transactions on behalf of another without authorisation, and it is also a channel for money laundering, because criminal proceeds are dressed up as ordinary sales. It is a central risk for every acquirer, payment facilitator and payment service provider that onboards merchants.

Imagine a florist's shop with a card machine. A neighbour who sells banned goods cannot get a card machine of his own, so the florist lets him run his customers' cards through the florist's machine. The bank sees what looks like flower sales. The neighbour gets his money, the florist takes a cut, and nobody at the bank knows what was really sold.

Online, the same thing happens on a much larger scale. A respectable-looking website is approved for card payments, but behind the scenes payments from other, hidden websites are routed through it. The receipts, bank statements and reports all point to the respectable site, which hides the real business and its customers.

• Front or funnel websites. A website created to pass onboarding checks, selling plausible goods, while its payment connection processes sales from other, undisclosed sites.
• Complicit legitimate merchants. An existing business accepts payments for others in return for a fee, sometimes without understanding the risks.
• Unauthorised aggregation. A merchant or intermediary resells its acceptance to many hidden sub-merchants without being registered as a payment facilitator.
• Hijacked accounts. Criminals take over or buy a dormant merchant account, or create a business through a shell company, to start processing.

Transactions are often given a false merchant category code and a misleading merchant descriptor, so that issuers' controls on risky categories such as online gambling do not trigger.

Acquirers and providers look for mismatches between what a merchant said it would sell and what its payments show. Typical indicators include:

• Volume, ticket size or sales times that do not fit the stated business, or a sudden jump in activity soon after approval.
• Customers from countries the merchant does not appear to target, or chargeback and refund reasons describing goods the merchant does not sell.
• A high or rising chargeback ratio, repeated declines from issuers and unusual card testing.
• Many websites, redirects or payment pages linked to one merchant identifier.

Detection combines careful Know Your Business checks at onboarding with ongoing website scanning, test purchases by specialist firms, analysis of transaction data within transaction monitoring, and information shared by card schemes and other acquirers. Monitoring has to continue throughout the relationship, because a merchant that was clean when approved can start laundering later.

Visa and Mastercard rules prohibit factoring, require acquirers to know and monitor their merchants and sub-merchants, and run brand protection programmes that can fine acquirers when illegal or brand-damaging transactions are found, regardless of whether the acquirer knew. Merchants caught laundering transactions usually lose their accounts and can be placed on industry lists of terminated merchants, which ends their access to acceptance. Where the hidden activity is criminal, those involved may face money laundering, fraud or unlicensed gambling charges, and providers that ignore red flags risk regulatory action under anti-money laundering law as well as scheme penalties for failures of card scheme compliance.

The practice exploits the scale and speed of online acceptance. Onboarding is often automated, merchants can create convincing websites cheaply, and payment flows can be moved between front sites as soon as one is shut down. Each acquirer sees only part of the picture, and legitimate businesses can show some of the same warning signs, so firms must balance growth against control. Industry bodies and providers classify merchants through merchant risk classification and treat a high-risk merchant with closer review, but no single control removes the risk.