Merchant fraud is not something you would necessarily relate to a Sunday afternoon lunch with your family. Seems like I’m up to my eyeballs lately in credit card fraud of one type or another, and I guess by now I shouldn’t be surprised when fraud sneaks into my happy moments and gives me something else to deal with yet it never ceases to surprise me when it happens.
While at lunch with my 16-year-old son, he said his car’s engine was sputtering a little when it started and having trouble turning over. We immediately suspected the starter or alternator, so we drove over to the closest auto parts store for a diagnosis. Indeed, the starter was the culprit, so out pops my Amex to pay for a new one.
When you purchase a starter, in addition to the charge for the part itself you are charged what’s called a core charge. A core charge is when the auto parts store charges you what is essentially a deposit on the piece of the part that requires recycling, and the store refunds you the core charge when you return the defective part. My son and I agreed he would return the starter when he replaced it in his jeep, and the other night called me to tell me he had indeed done what he agreed to do and asked me if he got the credit or I did. (Teenagers! Really son? Who paid for the part in the first place? But I digress…)
So after our call, I logged in to my Amex to see if the credit had hit, but there was nothing there. Usually, credits aren’t pending, they just hit once they are processed. But in the pending area of my charges, there were two really weird transactions. One for $1.73 from a hardware store in Seattle; the other, $9.65 from a home medical supply company in Lincoln, Nebraska.
Uh-Oh. Someone’s got my Amex again. I am a dutiful cardholder and watch my account like a hawk, and I KNOW that I haven’t been in Washington or Nebraska, so I call Amex to report the fraud. Here’s where things get weirder.
The Amex rep says that neither charge was done with a real card, and there is a $9.65 charge and a credit, but the $1.73 is just an authorization. Why would someone steal my credit card info and then make a charge AND a credit moments later? And why charge my account for such little amounts? Usually, you hear about big fraud – $1,500, $5,000, or some obnoxious amount of money that is obvious. Amex’ stance is that it’s pending and since it has been refunded the charges will never hit my actual statement. Pay attention to that fact – a pending charge that has been charged and refunded will never hit the cardholder account. So it’s a ghost charge that doesn’t hurt me now, but more importantly, it doesn’t leave any trace that the charge even happened after a few days.
So I decided to call the two merchants that have charged my card. I’ve never done that before, but I looked them up based on my pending charges and gave them a call. The hardware store in Seattle was pretty frustrating. “Ma’am, there’s just no way we processed your card. All of our cards are processed in person, we don’t do any sort of on the phone transactions at all. There’s no record of any charge in our system for that amount.” I was given over to a manager who said that while they did do internet business, it was from their parent company who processed everything at the headquarters level.
The home medical company, who I got to the next day, was more helpful, probably because a day or so had gone by and there were other credit card holders calling them as well. Apparently, I was one of a few hundred that had a charge from them on their pending charges. The local office gave me to accounting, and I spoke with a lovely woman who knew exactly what had happened.
There are two thefts going on. Thieves had obtained the merchant ID processing numbers and either programmed machines or created fraudulent virtual terminals to run stolen credit card numbers. This is the merchant fraud. There are a number of articles out there about protecting your terminals in your office but none that I could even find about this type of theft. Then they ran my stolen Amex number to see if it was a good number, and by running a charge and a credit they guaranteed they had a good number. But since the charge would negate and never hit my account, I would never see it. It would be a ghost. Bingo. Credit card fraud. Two for the price of one.
I was telling this story in my office, and someone asked, why would they steal a merchant ID and program a machine? What is the point of merchant fraud? The money would not be deposited into the thieves’ accounts – it would be deposited in the unsuspecting merchant account. This is true. However, the thieves weren’t after the first deposits of the fraudulent charges, which is why they returned them. They were after checking the card numbers that were stolen to see what they could charge later.
And the little amounts? Often charges are done under $10 the first time because so many people don’t actually look at the detail of their bill until the end of the month, and who worries about $10? It’s not till they hit in the hundreds, or thousands of dollars until someone pays attention.
Unfortunately, there’s no way to know how the thieves got the merchant accounts in the first place. If you’re a business and you take credit cards, you have a merchant number, which opens you up to merchant fraud. The number is usually 16 digits like a credit card number. It’s printed on the top of any merchant statements you receive and sometimes listed on the deposit line of your bank account statement. It’s also online when you log in.
The bottom line is that we are all trained to protect our credit card numbers as consumers, but this is the first time I’ve seen or heard of merchant numbers being stolen. I guess it goes to show that as our lives get more technical, so does the crime.
My advice would be for a business to protect their merchant numbers as they would their federal ID number and company credit card numbers. And consumers need to make sure they’re checking their credit card accounts regularly for pending charges. Waiting until the end of the month when the paper statement arrives won’t necessarily show you all the transactions that have been done on your account.
