Scam Alert - Criminal Exploitation of Weak Merchant Credentials

There has been a recent increase in an old fraud scheme in which a criminal will use phishing and other social engineering fraud schemes to target merchants in an effort to gain access to a weak authentication or online account.

Securing your login credentials can make the difference in allowing a criminal unauthorized access to your customer information. When a criminal gains access, they submit fraudulent credit transactions to debit cards that have been setup by other fraudsters. These transactions look like a credit has been applied to the card for returned merchandise; however, no merchandise has ever been purchased or refunded, and the funds go directly to the criminal’s own debit cards, usually setup in other countries.

Here are some steps you can take to prevent these fraudulent credits and avoid losses to your merchant account:

• Protection of credentials is crucial; do not share information with unnecessary personnel and always be sure to use strong authentication when selecting passwords for all your systems.
• Remain diligent in keeping current with social engineering schemes that may be circulating; this will keep you on alert and more likely to identify fraud.
• Verify your merchant deposits (batch totals) to the amount deposited into your bank account; any discrepancies should be thoroughly researched to ensure it is a transaction that you initiated. Always direct any questionable transactions to FiTech by Deluxe, our trusted provider of merchant services equipment.
• Ensure the physical security of your credit card terminal and computer. They should be maintained in a private area to avoid unauthorized access. Immediately report any lost or stolen terminals or any that may have been tampered with.
• Keep your terminal or computer software systems secure and perform periodic system checks to ensure security is maintained and unauthorized access has not occurred.
• Allow only trusted IP filtering connections to access online web portals.
• Immediately report any suspected fraudulent credit schemes to FiTech at (844) 822-1281.

How do I process a proper valid credit to my customer?

It is important to always follow merchant requirements. If a merchant chooses to submit a valid credit to a cardholder for a previously processed transaction, the merchant must:

1. Provide a credit receipt that includes the date the credit was completed.
2. Deposit the credit to the cardholder account within 5 days; Remember to batch daily to avoid any delays.
3. Provide a copy of the credit receipt to the cardholder.
4. Process any refunds/credits provided to a cardholder on the card previously used to complete the initial transaction.