Taking ‘Know Your Customer’ To The Next Level; A Lesson In Payment Processing

 

By Jamie Rubin

If you’re in the business of helping merchants process payments, this recent FTC settlement with QualPay is a must read. QualPay is a payment processor, which is a company that connects businesses with payment networks like Visa and MasterCard to process credit card transactions. Payment processing is a highly regulated industry. There are legal requirements and requirements imposed by the payment networks, most of which fall under the category of what is known in the industry as “knowing your customer”. According to the FTC, QualPay ignored a number of these requirements and many red flags in connection with MOBE, which was QualPay’s largest customer. MOBE offered online business opportunities (get rich quick schemes) that, according to the FTC, defrauded thousands of customers. The FTC brought a separate case against MOBE in June of 2018 associated with its fraudulent activities. Now we have a more than $46,000,000 settlement directly with QualPay stemming from an FTC complaint alleging that QualPay turned a blind eye to MOBE’s fraudulent ways, failed to follow the law and failed to follow its own “know your customer” policies. For example: (i) MOBE had a very high charge back rate; (ii) MOBE was rejected by 7 other payment processors prior to QualPay agreeing to be its payment processor; (iii) MOBE was a multi-level marketing business, already subject to heightened scrutiny; (iv) MOBE had many poor online reviews and BBB ratings; and (v) other entities in the processing chain warned QualPay. QualPay allowed MOBE to establish payment processor accounts when it could not prove it had business operations in the United States and did not review scripts for MOBE’s telemarketing calls to find out what MOBE was selling.

In addition to the very large monetary penalty, the settlement prohibits QualPay from processing payments for any high risk client without engaging in significant screening and monitoring. A high risk client, according to the settlement, is any client that processes more than twenty-five percent (25%) Card-Not-Present Transactions annually; (b) more than two hundred thousand dollars ($200K) in total Card-Not-Present Transactions annually; or (c) offers continuity programs with negative option features, multi-level marketing programs, nutraceuticals with negative-option features, scholarship finding services, stored value cards, outbound telemarketing, credit restoration, debt consolidation, extended warranty programs, government grants, and mortgage loan modification.

Before allowing a high risk customer to use QualPay’s payment processor services, QualPay must review the customer’s websites; obtain and review copies of monthly payment processing statements issued by other banks or payment processors used by the customer during the preceding three to six months (depending on exact type of customer); obtain and review all current marketing materials for each applicable good or service; review the Better Business Bureau ratings of the prospective customer; and review internet search results related to the prospective customer. The purpose of such steps is to determine whether the prospective customer is engaged in any of the following, activities which would prohibit QualPay from acting as a payment processor for the customer:

  • Failing to clearly and conspicuously disclose all products and services that are sold in conjunction with the offered product or service, and the total cost to purchase, receive, or use, any products or services that are the subject of the sales offer;

  • Misrepresenting any material aspect of the performance, efficacy, nature, or central characteristics of goods or services that are the subject of the sales offer;

  • Failing to clearly and conspicuously disclose all material terms and conditions of an offer;

  • Misrepresenting, expressly or by implication, any material aspect of the customer’s refund, cancellation, exchange, or repurchase policies; and

  • Causing billing information to be submitted for payment without the customer’s express authorization.

This settlement should serve as a wakeup call to any companies in the payment processing chain – even if not for “high risk clients”.

Jamie Rubin