The holiday season is upon us, and as consumers are busy preparing their lengthy wish lists, so too are the fraudsters. With an influx of sales, it becomes increasingly difficult to detect and prevent suspicious transactions. What’s more: this year’s holiday season is breaking records in both overall projected sales volumes as well as eCommerce sales specifically.
Inevitably then, one can reasonably expect online fraud records to be broken as well. Last year’s holiday season saw an increase of 31% in fraudulent purchase attempts worldwide. There is no reason to expect that 2017 will be any different.
With this perfect shopping storm in place, merchant acquirers and processors need to ensure that they are not taken advantage of by fraudulent merchants. From chargebacks to compliance fines, acquirers may end up paying for much more than presents. Standard transaction monitoring simply won’t suffice, a full understanding of consumers, transactions and merchants is required to fully protect your portfolio from fraud, and your wallet from fines.
One of the serious concerns for merchant acquirers to watch out for this holiday season is transaction laundering - a sophisticated merchant based fraud that has been making headlines in 2017 for facilitating terrorism, illegal drugs trade and money laundering.
In a transaction laundering scam, fraudsters utilize legitimate websites, taking advantage of their payment and shipping platforms, to sell illicit goods. In essence, transaction laundering is a digital version of money-laundering, with cyber-criminals seeking to get the best of both worlds: engaging in illicit commerce while using legal means to get paid. And like other forms of money laundering, transaction laundering does not only go against card brand rules, it is also illegal. What’s more, transaction laundering exposes both merchants and acquirers to the liability of facilitating criminal activity, along with the accompanying risk of fines, chargebacks, legal action and brand or reputational damage.
This holiday season, cybercriminals will attempt to infiltrate payment infrastructure in numerous ways. Here are two common ways cybercriminals set themselves up for transaction laundering, that acquirers and merchants should be on the lookout for:
Most KYC and onboarding programs are not geared towards continuous content monitoring. Since it’s difficult to effectively monitor content after onboarding – especially for tens of thousands of merchants, each with a massive volume of transactions – it becomes easy for merchants for whom the MCC code does not correspond to actual merchant activity to slip by.
This holiday season, keep a close eye on merchants that have established websites in a “low-risk” merchant category. To avoid high processing fees and scrutiny, transaction launderers can easily change the content on the website after successfully passing the KYC checks and start selling illegal goods and services while retaining a legitimate merchant account.
A transaction launderer can easily set up an affiliate account with a legitimate store, while running a completely separate e-commerce website that sells illegal goods and services. The criminal then uses the card details entered by the customer on the website selling the illegal goods to make a “purchase” from his own affiliate site. By doing this, he earns sales commision, receives the goods to resell elsewhere, while at the same time launders illegally obtained funds.
Typically high risk affiliate networks are especially vulnerable to this kind of scheme, since high risk goods such as adult content, naturaceuticals and igaming offer extremely high commissions for their affiliates. Average high risk affiliate commission is 80-90%, and can reach as high as 200%, making affiliate transaction laundering a very attractive money laundering method with high returns.
Tracing affiliate payments, especially between multiple and seemingly-unconnected e-commerce websites and merchant accounts, to illegal activity on undisclosed website is extremely difficult and something acquirers need to be especially vigilant about.
Quite often, to take advantage of the holiday season fraudsters will set up simple websites for a single purpose of funneling transactions.
Since the single purpose of the website is to process transactions, and not to draw legitimate customers in, the quality of this websites will be quite poor. Merchant processors and acquirers should be on the lookout for such poorly designed dummy websites, as as a possible indicator of transaction laundering
One of the oldest methods in the book used by fraudsters to legitimize fraudulent online stores, is generating fake customer reviews. Customers are 90% more likely to make a purchase if they see 3 to 5 star ratings and good reviews on a website. The same principle works for fooling acquirers KYC procedures. It is far more likely for a store to seem legitimate with multiple positive customer reviews.
To reduce the risk of transaction laundering, acquirers should be on the lookout for merchants with large amount of fake reviews. Specifically, reviews that were posted within a short time frame of each other, auto-translated reviews with bad grammar and especially if a bulk of the reviews is dated just at the start of the holiday season: all this indicates high risk of transaction laundering and merchant based fraud.
The last but not least indication of transaction laundering is based on the decades old "Trade-Based Money Laundering" principle, whereby prices of goods are artificially inflated or deflated in order to secretly transfer value from one individual to another.
Transaction laundering is essentially the online equivalent of trade based money laundering, and the fundamental principle at work is the same. If an online retailer sells brand-name purses for significantly less than it’s worth, it is likely to be dealing in counterfeits, putting acquirer at risk of fines. The same items can be significantly overpriced since the only purpose of them appearing in an online store is to launder proceeds. Cheap items can be sold at a significant premium to complete the money laundering loop, so significantly mispriced items should raise the red flag for acquirers.
It is a responsibility of merchant acquirers to prevent transaction laundering from entering their merchant portfolios. Failure to do so puts acquirers at risk of fines, regulatory scrutiny, penalties by the card brands and serious reputational damage. With the holidays fast approaching, the attention of watchdogs, regulators, merchant acquirers and processors needs to be on both the bottom line and the more sophisticated forms of online fraud like transaction laundering. ‘Tis the season for huge profits – but this year, let’s make it a sorry holiday for transaction launderers!