Merchant accounts victimized by hackers' unusual scheme

By Steven Bryan

Even with the data encryption methods currently in place, hackers still have found a fairly large loophole in the credit card processing system. By exploiting merchant accounts, unscrupulous individuals can commit credit card fraud without ever stepping into a place of business.

To stay competitive, a business owner, no matter how large or small, must accept credit cards for payment. A merchant account, which is more like an extension of credit than a bank account, lets a business owner accept plastic instead of money. At the end of the day, the owner submits the credit card receipts in one batch, and the proceeds are then transferred to the merchant account, minus any transaction fees.

However, some high-tech thieves have discovered the hidden value in merchant accounts. Like ID theft, in which an individual's private information is used to open credit accounts, hackers have illegally acquired merchant account numbers for their own profit.

These thieves are taking advantage of "pre-authorizations," which are used quite frequently at bars, restaurants and hotels. When a credit card holder pays for a meal or orders something online, the business owner "blocks out" the funds needed to complete that transaction. The credit card only is charged when the sale is completed, such as when a guest checks out of a hotel room.

Online thieves have found a way to use this process to commit credit card fraud. Brian Krebs, who writes the "Security Fix" column for The Washington Post, pointed out that cyberthieves use pre-authorizations of just a few dollars to check the available balances of stolen credit and debit card numbers. Once they know how much credit is available on a card, the thieves go after the more high-ticket items.

'A high-stakes game of chess'
Merchant account fraud affects both consumers and legitimate business owners, who may not even be aware that their merchant accounts have been hijacked. Although these small pre-authorizations typically are never completed, a consumer who regularly checks their credit card balance will see a small dip in their available funds. This is a tiny warning flag, one so small that many credit card holders never notice it until it is too late.

Krebs, who refers to this kind of credit card fraud as "a high-stakes game of chess against the U.S. financial system," spoke with Andy Kordopatis, proprietor of the Odyssey Bar in Idaho and a merchant account victim. Kordopatis said he receives approximately three calls a day from people asking why he has placed a small charge on their credit card, especially since they never set foot in his bar. Because he hasn't lost any money, Kordopatis said he has been unsuccessful in getting his credit card processor to stop the bogus authorizations.

Stopping merchant account and credit card fraud
A credit card transaction goes through many stages, which makes it quite vulnerable to fraud. To better safeguard merchant accounts and slow down the spread of credit card fraud, everyone involved in the transaction process needs to share information, such as when a merchant account shows an unusually high number of pre-authorizations.

Krebs' piece serves as a call for action by the credit card industry. While consumers have fraud monitoring tools available to them, business owners also need the ability to carefully monitor anything going on with their merchant accounts.

Article by Steven Bryan

Published: July 29, 2009