REVIEW OF THE GUIDELINES FOR UNDERWRITING, TRANSACTION MONITORING

Transcription

1 Electronic Transactions Association March 31, 2015 Moscone Center San Francisco, CA Electronic Transactions Association REVIEW OF THE GUIDELINES FOR UNDERWRITING, TRANSACTION MONITORING AND PORTFOLIO REVIEW Deana Rich, President Rich Consulting

2 Agenda Government Oversight The Purpose of the Guidelines Fraud Trends Underwriting Underwriting Enhanced Due Diligence Risk Management and Transaction Review Tools and Strategy for Investigating Risk Management Enhanced Due Diligence 3 rd Party (ISO) Due Diligence 3 rd Party (ISO) Monitoring 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 2

3 Government Oversight 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 3

4 The Government The Entities 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 4

5 The Government The Regulations US PATRIOT Act BSA/AML The FTC Fair Credit Reporting Act (FCRA) CFPB Unfair, Deceptive or Abusive Acts or Practices (UDAAP) FTC Telemarketing Sales Rule (TSR) OCC Advisory on Merchant Processing and Third Party Relationships Risk Management Guidance FDIC Guidance on Payment Processor Relationships, Risk Management Examination Manual for Credit Card Activities and Supervisory Approach to Payment Processing Relationships with Merchant Customers That Engage in Higher Risk Activities The Restore Online Shopper s Confidence Act *This is a partial list of regulations with potential applicability. Please consult with legal or other counsel for complete guidance on all applicable laws, regulations or guidelines that govern your business. 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 5

6 The Government Hot Issues Third Party Risk Management Banks are expected to actively manage merchant service providers Consumer Deception Merchants engaging in deceptive practices The entities providing such merchants the ability to process Merchants as consumers deceived in the process of merchant account solicitation/contract execution Data Security 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 6

7 The Government Updated Regulatory Focus Third Party Risk Management Updated Guidance Issued Federal Deposit Insurance Corporation (FDIC) Sep 13 Office of the Comptroller of the Currency (OCC) Oct 13 Federal Reserve Board Dec 13 Federal Trade Commission (FTC) The FTC is an active regulator for non-banks, including payment processors Consumer Financial Protection Bureau (CFPB) Operation Choke Point 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 7

8 Enforcement The FTC is Paying Attention CardFlex AND Officers March oposedorder.pdf?utm_source=govdelivery IRN Settles - June Newtek still ongoing June Merchant Services Direct Settles November /9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 8

9 The Government Operation Choke-Point The reason that we are focused on financial institutions and payment processors is because they are the so-called bottlenecks, or choke-points, in the fraud committed by so many merchants that victimize consumers and launder their illegal proceeds. For example, third-party payment processors are frequently the means by which fraudulent merchants are able to get paid. They provide the scammers with access to the national banking system and facilitate the movement of money from the victim of the fraud to the scam artist. And financial institutions through which these fraudulent proceeds flow, we have seen, are not always blind to the fraud. In fact, we have observed that some financial institutions actually have been complicit in these schemes, ignoring their BSA/AML obligations, and either know about or are willfully blind to the fraudulent proceeds flowing through their institutions. Financial Fraud Enforcement Task Force Executive Director Michael J. Bresnick at the Exchequer Club of Washington, D.C., Wednesday, March 20, /9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 9

10 Fraud Trends 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 10

11 Merchant Fraud Bust Out Merchant account set up solely to enable fraudulent charges * Synthetic ID * ID Theft CC Accounts Several merchant and credit card accounts are usually established at the same time Merchant Accounts Will bust out immediately or establish pattern and then bust out 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 11

12 Merchant Fraud Factoring or Laundering Depositing sales drafts that did not originate directly between cardholder and merchant submitting the sale To run sales for illegal items - Drugs, Illegal sale of guns and ammunition, Prostitution, Other Card Brand violations Merchants who have committed fraud before Merchants who have abused the system before and are on MATCH 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 12

13 Merchant Fraud Money Laundering Structurally Vulnerable Country or Areas Can Impact the Processing Ecosystem Electronics/Cellular Freight Forwarding 100% Swipe sales BIN from Vulnerable Country (i.e. Venezuela, Argentina, Ukraine) Even dollar amounts May have excessive declines 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 13

14 Merchant Fraud Consumer Deception Boiler room merchants or affiliate marketers with products that have little or no value (FTC is scrutinizing) Get rich quick Biz Op and Coaching schemes Nutraceuticals Discount insurance cards 419 Lottery Scams Still! High level of customer dissatisfaction High level of chargebacks Possible Association fines Probable FTC, DOJ, CFPB, Treasury Department or States Attorney General investigations Government Task Force with all entities working together 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 14

15 Merchant Fraud Collusion Merchant or an employee knowingly accepts lost, stolen or counterfeit transactions Skimming Counterfeit cards Running credits through terminal on own card 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 15

16 (Not Quite) Merchant Fraud Job Finder Sites Person posts resume on job finder site and is approached by individual or fake company Company offers a job to the applicant and the applicant must set up merchant and bank account using his social security number Applicant is asked to facilitate payments to company The applicant gives company access to the bank account 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 16

17 Customer Fraud Telecommunication Device for the Deaf (TDD) Customer contacts merchant through TDD Communication may continue via TDD or progress to Caller asks for large catered order from far way because they are the best insert food specialty here Caller offers to send a delivery person to pick up due to distance Caller requests shop to wire funds directly to delivery service or pay the service upon arrival 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 17

18 Customer Fraud Merchant is scammed Items purchased over the Internet for resale Easily fenced items like electronics Overseas shipment Cost is not an object for merchandise Rush shipping May use multiple cards for single purchase Items purchased face to face Customer provides fake authorization through cell phone Original sale charges back 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 18

19 Customer Fraud Old Scams Still Around Zero or low-dollar batch Run large credits to debit cards with offsetting sales to stolen cards Immediately pull money from debit card Usually BRIC Nation debit cards Original sale charges back Whether employee fraud or hack, merchant is out funds Many times merchant cannot fund, ISO takes a loss Merchant goes out of business usually future delivery Merchant accepts orders today to pay for orders accepted yesterday When business fails, undelivered purchases are charged back Runs many charges knowing they will not deliver merchandise 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 19

20 The Purpose of the Guidelines 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 20

21 Guidelines Operating under increased regulatory pressure Guidelines will provide benchmarks Merchant Underwriting & Risk Management ISO Underwriting & Risk Management Overall Objectives Identify Thresholds based on Input from industry Many published regulatory documents such as the OCC Guidelines and FTC Consumer Protection Laws The Guidelines are Agile Not a Standard or Required Help with Self Assessment Help with internal Policy Design Help with Policy Requirements for 3 rd Parties Membership has feedback opportunities to inform revision 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 21

22 Defining Underwriting Policies 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 22

23 Underwriting Goals and Objectives ETA Member defined policies and benchmarks Clear business goals for UW with key objectives identified Supporting these goals - Prohibited and Restricted lists Special circumstances defined with appropriate due diligence, documentation and mitigation requirements such as: Tiered policies based on size or risk level Add l considerations for riskier businesses or marketing methods accpt d Greater focus on overall merchant activity Quantitative - Refunds/credits in addition to chargebacks Qualitative - Advertising claims, marketing methods and reputation Detection and prevention of consumer deception by merchants Detection of merchant types or activities requiring registration 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 23

24 Underwriting Goals and Objectives Determine and validate the identity of the merchant and principals Determine and validate the type of business ensure that the merchant is a bona-fide business as well as the acceptability of the products and services and methods of sale Determine the acceptability of the merchant s financial condition and processing history when relevant Determine the extent of risk posed by the merchant including credit, fraud, financial, compliance, regulatory and/or reputational risks When appropriate allow the Underwriter to use their judgment on the above items. Define minimum requirements for downstream ISO merchant UW 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 24

25 Underwriting Merchant Underwriting Policy Standards for Underwriting as defined individually by each ETA Member Timeframes Approving Authority Parameters Escalation Requirements Documentation Requirements Exceptions and Procedures 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 25

26 Underwriting Merchant Underwriting Policy Prohibited & Restricted Merchants - Required Card Scheme Sponsor Bank Processor ETA Member Illegal transactions Prohibited & Restricted Merchants - Suggested Merchant types MCCs Sales Methods Marketing Methods 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 26

27 Underwriting Merchant Underwriting Policy Defining Risk Levels and Requirements Agile Approach be adaptable to changing circumstances and process improvements Defined based on Card Scheme and individual requirements and risk tolerances By merchant demographics Processing volume, card acceptance method Risk exposure based on delayed delivery and chargebacks & refund levels Higher risk merchants defined by product type, MCC, prior issues or by the Card Schemes Tier Policy - Increasing due diligence requirements with associated level of risk Watch List Criteria merchants boarded with special conditions or deemed in need of monitoring for a period of time 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 27

28 Underwriting Merchant Underwriting Policy Suggested Performance Metrics when reviewing a merchant Refund to transaction percentage (%) for both dollar value and item count 4% for retail, card present merchants 8% for card not present merchants or card present future delivery Chargeback to transaction percentage (%) for both dollar value and item count >.05% for retail, card present merchants.30% -.70% for card not present merchants or card present future delivery 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 28

29 Underwriting Merchant Underwriting Policy Example Merchant Risk Levels based on Processing Volume or Exposure Micro Small Medium Large Major Restricted Although often found in the micro category, mobile merchants may be any size 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 29

30 Underwriting Merchant Underwriting Policy Example Tiered Policy (read Guidelines for complete recommendations) Micro level Identify and authenticate merchant Perform MATCH and OFAC Review website and Identify other 3rd parties based on type Execute required legal/bank documents (Application/Agreement) Small More in-depth review which may include review of the CBR Medium More in-depth understanding of business & Business license Previous processing Online reputational review Large Review business bank statements Complete physical site inspections Major Include complete financial review Restricted Typically reviewed one level higher than their processing would require 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 30

31 Helpful Hints Tools Name of business (legal and DBA) or (non profit) Address of business and phone number Mail drop ml Home Prison 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 31

32 Helpful Hint: Tools Merchant Underwriting Policy Ensure reasonableness of application(s) Owner, business type and volume Location of business and owner Multiple applications Similar business type Different owners Commonalities DDA, ABA, or Contact Info Inconsistencies with information* * Examples include: CBR shows dentist and the application states gardener High discount rate for low risk business DDA, corporation, business license, bank account in different parts of country or world 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 32

33 Helpful Hint Bank statement review Review the Past 3 Months Match account numbers on all pages to ensure legitimacy Ensure the balance is consistently large enough to cover possible chargebacks Review wires in and out Are they from or to foreign countries? Are they from or to the principals? Payments to vendors should match product sold Review ACH payments Payments to vendors should match product sold Activity should support processing ACHes in and out from other bankcard processors Ensure volume is consistent If sweep account, obtain operating account bank statements Are they living out of the account? 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 33

34 Helpful Hint Financial Ratios Current Ratio must be > = 2 Current assets divided by current liabilities Indicates merchant has twice as many assets as liabilities. This broadly gauges a business' financial health and assesses whether there is sufficient assets to cover liabilities. Quick/Acid Test Ratio be = to or near 1 Current assets (excluding inventory) divided by current liabilities. This ratio measures a business' liquid assets compared to its liabilities. If at or near 1, indicates liquidity levels are high and is an indication of solid financial health. Defensive interval should be between days Quick assets divided by daily operating expenses. This gauges the threat of insolvency by measuring the number of days the business can survive without cash coming in. 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 34

35 Merchant Underwriting Policy Merchant Reserves Use as a tool to protect against potential risk, including: Credit/financial Establishment of a trusted relationship Pending investigation of issues Should not be used in lieu of mitigating severe or long-term issues, such as: Consumer deception Unacceptable chargeback or refund ratios Expecting a situation that would result in non-compliance or regulatory fines The use of reserves should be well documented 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 35

36 Merchant Underwriting Policy Calculating Reserves Factors to Consider Typical MCC Risk Risk Level Monthly Discount Risk Exposure Future/Delayed Delivery Exposure Chargeback Volume Exposure Refund Volume Exposure PCI Compliance Status 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 36

37 Setting Reserves - Example Traditional 5% - 6 months rolling or with a cap 10% - 1 year rolling or with a cap Less Traditional Based on future service/delivery time frames High Risk Up to 1 to 1 ratio of processing 1 to 1 will not cover fines FTC is now seizing reserves Example Figures Monthly Sales $100,000 $100,000 $100,000 % of sales delayed 25% 50% 25% # days delayed Per month exposure $25,000 $100,000 $75,000 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 37

38 Merchant Underwriting Policy Periodic Review Establish policy requirements for what merchants should be reviewed, such as large or major merchants, and on what schedule Specify minimum required review elements Obtaining updated file documentation Current processing evaluation (6 month trending recommended) Reputation reviews on both the business and the principals A standardized review form is recommended for consistency Escalated management approval requirements Establish red flag criteria that should prompt review outside of scheduled periodic assessments Volume Trending (up or down) Refund Trending Chargeback Trending Otherwise Anomalous Processing 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 38

39 Helpful Hint: 6 Month Trending Sales $ Sales # Credit $ Credit # CB $ CB # Merchant Trending Report Merchant Name Month 1 Month 2 Month 3 Month 4 Month 5 Month 6 Credit % CB % # refunds/# sales # chargebacks/# sales ACH Reject amount Reserve Amount 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 39

40 Merchant Underwriting Policy Merchant Changes Establish policy requirements for performing and monitoring merchant account changes Ensure changes are made in accordance with your policy and do not require additional due diligence Establish priority for multiple changes within a short timeframe Examples can include: Merchant DBA changes Ownership changes DDA Changes Descriptor changes Changes to business type or product/service offerings Phone number/website URL/physical address changes 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 40

41 Merchant Underwriting Policy Management and Bank Reporting Establish regular high-level summary reporting of activity for proper management, senior level, board or bank attention Ensure appropriate oversight of day to day activity at all levels Large organizations should have multiple levels of reporting to respective levels, as appropriate At minimum, senior management should review reporting up to the next level in the Acquiring chain For example, sub-iso to ISO, ISO to Acquirer or Acquirer to bank 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 41

42 Underwriting Enhanced Due Diligence (EDD) 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 42

43 Enhanced Due Diligence Who may require? Underwriting policy should require more diligence on some merchants Cyberlockers Possible IP Infringing items Coaching/Biz Op schemes Future delivery Attorneys often hide collection, debt reduction and other prohibited or high risk services Some construction or housing related industries Non Profit Companies Membership or continuity billing 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 43

44 Enhanced Due Diligence Know Your Customer (KYC) Policy Reputational review through Social Media LinkedIn Facebook Basic Google searches along with BBB and other online reviews should be required Legal information- law suits by and against On-line presence Reputational review Legal Activity Care should be taken to ensure there are no beneficial owners Knowing Your Customer 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 44

45 Helpful Hint Social Media Research Linked In Facebook Does the business profile of the owner make sense? Length of time on LinkedIn Are similar business listed? Do the contacts make sense? Does the business profile of the owner make sense? Length of time on Facebook Are similar business listed? Do hobbies and the overall profile make sense? Do the contacts make sense? 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 45

46 Helpful Hint Online Research Tools Name and Address Restaurants Do the length of ratings match the open date? Services Products Travel 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 46

47 Enhanced Due Diligence Internet or Mail Order-Telephone Order Policy In-depth information Require an appropriate questionnaire Include the product description and pricing Require review and inspection of inventory Understand Method of advertising Method and timeliness of shipment & fulfillment house information Return and refund policy Review scripts when applicable Require product information Ensure it Product overvaluation can cause chargebacks 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 47

48 Enhanced Due Diligence What to include in policy for any merchant with web presence Product sold Return policy Delivery policy Terms and conditions READ Review all Visa required elements Secure payment page Currency type Customer service contact information Review all links 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 48

49 Enhanced Due Diligence Increased website diligence to include in policy URL registration Understand why If registration is hidden If it is registered to a non-us citizen If it is registered outside of the US Understand the legitimacy of the host Review blank space for hidden links Review meta-tags Require a test order from the website to ensure the payment link is operable 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 49

50 Helpful Hints Keywords and Slang Words repeated throughout the site or that do not fit Acapulco gold/red, Kentucky Blue, Blurple ~ Marijuana Quicksilver, Bullet, Whiteout ~ Inhalant (Isobutyl nitrate) Tab Soda, Molly, XTC ~ Ecstasy Ivory Wave, Cloud 9, Meow ~ Herbal Ecstasy Alternative Purple Wave, Zoom, Cloud Nine ~ Bath Salts Salty Water, Max ~ GHB (date rape drug) Resources /9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 50

51 Enhanced Due Diligence Policy Affiliate Networks Should require specific affiliate metrics to be reviewed such as: Throughput Chargebacks and Refunds IP tracking Approval ratio Rebill success ratio Declines by decline code Device ID (not just IP) 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 51

52 Enhanced Due Diligence Policy Processing & Financials Prior Processing Prior Processing should be reviewed regardless of requesting processing limits for current account Understand the fees paid before and being offered by your sales person Financial Review Financials should be required at lower processing levels Enhanced product and sales method review Price vs. value Continuity/Membership billing should be reviewed Marketing method should be more closely reviewed 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 52

53 Best Practices for Underwriting Sharing Sites Policy Processing & Financials Review the Terms and Conditions How is their content stored? Do they have content restrictions? Do they require licenses? Do they prohibit Proxy or Tor access? How do they monitor their restrictions? They should utilize software to screen content Have they had take downs? How many? Test the upload Call customer service and ask about restrictions Upload restricted content, time the removal Upload through a Proxy 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION

54 Defining Risk Management and Transaction Review Policies 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 54

55 Risk Management Goals and Objectives Clear business goals for risk management Key objectives supporting those goals should be identified Identify and investigate anomalous activity Your expectations for the merchant In comparison to your overall portfolio Compared to Industry norms for MCC or business type or other defined and measurable vertical Ensure merchant compliance with Card Scheme requirements Identify suspicious activity related to money laundering, terrorist financing or that requires filing of SARs Identify activity that could cause consumer harm 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 55

56 Risk Management Goals and Objectives ETA Member defined policies and benchmarks Greater focus on overall merchant activity Quantitative - Refunds/credits in addition to chargebacks Qualitative - Merchant advertising claims and marketing methods used as well as reputation Detection and prevention of consumer deception by merchants Detection of merchant types or activities requiring registration Documentation of reviews, decisions made and actions taken Decisions not to act should be noted, with the reasons why the activity is acceptable 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 56

57 Risk Management Goals and Objectives Standards for Risk Management as defined individually by each ETA Member Timeframes for review and merchant notification Approval Authority Parameters Escalation Requirements Documentation Requirements Adverse Actions Exceptions Procedures and Reporting Team Communication & Meetings 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 57

58 Risk Management Policy should set standards Research Timeframes Daily review of transactions Monthly for account level statistics Adverse Action Requirements When to hold funds When to suspend accounts When to terminate Approval Authorities Release limits Title and position Escalation Requirements Based on approvals Based on exceptions to policy 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 58

59 Risk Management Transaction Monitoring Investigations should focus on but not be limited to these items Understand the merchants business Marketing practices Regulatory concerns Consumer Satisfaction implications Question merchant about anomalies Request information from the merchant Invoices Product details Understand any recent changes Notate all findings on the merchant record, including satisfactory reviews 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 59

60 Risk Management Effective Tools and Strategies for Daily Monitoring Approved parameters noted on the merchant record Adjustment of parameters when merited and approved Exceptions clearly noted Classify merchants based on risk Restricted Watch List or Location Marketing method New Merchants General Activity Exception Reports Card Brand required Card type related Changes to the merchant account 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 60

61 Risk Management Transaction Monitoring Daily exception examples Large or small transactions Authorization activity acharacteristic Large batches Volume spikes or drops Month to date volume Same BIN Foreign Activity Forced sales Abnormal time frames approaching or exceeding approved Large credits - refunds CP vs CNP ratios Swipe vs. Keyed ratios 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 61

62 Risk Management Transaction Monitoring Refund Exceptions Chargeback Exceptions Retrieval exceptions Refund with out an offsetting sale Large refund Refund after a chargeback has been issued Acharacteristic single batch refund % (compared to historical averages) Acharacteristic trending refund % (weekly, monthly, etc. compared to historical averages) Large chargeback Increasing amount of chargebacks Fraud, product/service non-delivery or other concerning reason codes or documentation Large retrieval Increasing amount of retrievals Fraud or other concerning retrieval reason codes 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 62

63 Helpful Hint Refund and CB Ratios Recommendations Refunds - Card Present Refund Ratio >4% Refund Ratio >2% & Total > $5,000 Count > 5 Refund Ratio >3% & Total > $2,500 Count > 5 Refunds - Card Not Present Refund Ratio >8% Refund Ratio >3% & Total > $5,000 Count > 5 Refund Ratio >5% & Total > $2,500 Count > 5 Chargeback Exception Criteria Chargeback ratio exceeding 2.5% AND 25 or more chargebacks Chargeback ratio exceeding.75% AND 75 or more chargebacks 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 63

64 Helpful Hint Chargebacks Chargebacks and retrievals must be monitored diligently Watch raw numbers as well as percentages as sales can be generated to change percentages Low $ sales on prepaid debit cards Also watch BINs with high volume Shipping fees billed separately Small dollar donations Monitor reason codes Card lost/stolen Fraud/Not authorized Credit not processed Begin workout before Card Scheme programs Visit merchant and understand business model at.50% Require a work out plan at.70% 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 64

65 Helpful Hint Questionable Transactions Changes in average ticket May mean changes in product May mean un-approved upsells Delayed Delivery The more time that lapses from transaction date to delivery date, the greater the risk of the merchant not being able to pay their vendor and fulfill their obligation to the consumer International Credit Card sales Ensure the country of the card makes sense Ensure the frequency of the country makes sense 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 65

66 Helpful Hint Specific Transactions Liability with a single cardholder Investigate larger transactions focusing on the frequency of that consumer s activity A cardholder that is being charged several times should be investigated to ensure that the consumer is receiving goods and that there has been a transaction conducted As always, monitor for the potential of the merchant s own card being used for a cash advance 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 66

67 Helpful Hints Monthly Reports Top processing merchants Processing Volume Chargeback number and volume* Refund number and volume* Excessive volume merchants 100% for Med. volume merchants 150% for Small volume merchants 200% for Micro volume merchants Decreasing or Cessation of Volume Reports by vertical MCC Sales Method VAR/Reseller/Agent ISO Merchants in Card Brand programs Fraud monitoring Chargeback Monitoring Brand Protection * may be different merchants 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 67

68 Helpful Hint: 6 Month Trending Sales $ Sales # Credit $ Credit # CB $ CB # Merchant Trending Report Merchant Name Month 1 Month 2 Month 3 Month 4 Month 5 Month 6 Credit % CB % # refunds/# sales # chargebacks/# sales ACH Reject amount Reserve Amount 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 68

69 Tools and Strategies for Investigating 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 69

70 Investigation Policy Investigation Basics Activities Increased review scope beyond the transaction/processing holistic review of the merchant Contact with the merchant Verification of card/cardholder details with Issuing Banks Reviewing merchant sales methods Review usage of fraud prevention tools 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 70

71 Investigation Helpful Hints Verify Document Review Verify and understand the transaction Is it fraudulent? Document the investigation Merchant contact when warranted Review the merchant s use of tools AVS & CVC2/CVV2 Is there consumer deception? Interview merchant with open ended questions Device authentication Is it approved merchant activity? Satisfactory results should also be noted IP tracking 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 71

72 Investigation Investigation Actions for your Policy Funds Issue a refund Hold funds Deposit delays Processing Suspend their ability to process Interview merchant with open ended questions Require different account (i.e. if FTF require separate account for Internet transaction) Monitoring with merchant action Add to watch list Require sales method change Require website change Discontinue product line 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 72

73 Investigation Merchant Remediation Policy should define what issues will not be allowed remediation Evaluate whether the issue can be fixed Is there an inherent problem with the product or service? Will remediation be timely? Establish remediation timeframes with goals Evaluate in 30 day intervals Goal should be to remediate in full within 60 to 90 days Consider termination if issue cannot be remediated w/in 6 mos. 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 73

74 Investigation Merchant Reserve Policies When are long term reserves appropriate? Volume spikes as a result of verifiable business growth but is not supported by credit/financial profile Increased ticket size based on newly added products or wholesale orders Merchant is a victim of fraudulent card usage with expected chargebacks (future prevention tools should be put in place) Verifiable short-term increase in refunds needed as the result of temporary back-order or third party fulfillment issues that will be corrected in the short term Reserve should never be used as the sole determinant to keep a merchant open that is engaging in deceptive consumer behavior It is not recommended to use reserves in anticipation of large fines in lieu of correcting the behavior 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 74

75 Policy for Enhanced Due Diligence Risk Management 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 75

76 Policy - EDD & Risk Management Research Using the Internet and Compare to Original Findings Google merchant name (business and principal) Search FTC website for principal and business Google with the word sucks or scam after it The older the merchant the more you should see If merchant is only on merchant circle beware ant4.html Go 5 pages deep on all Google searches Business Name Principals Product Name Descriptors 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 76

77 Helpful Hint Social Media Research Linked In Facebook Does the business profile of the owner make sense? Length of time on LinkedIn Are similar business listed? Do the contacts make sense? Does the business profile of the owner make sense? Length of time on Facebook Are similar business listed? Do hobbies and the overall profile make sense? Do the contacts make sense? 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 77

78 Policy - EDD & Risk Management Secret Shop the Merchant Order product from merchant Telephone order Internet order Measure quality of sales experience Shipping time Product as described Measure quality of return experience Ease of customer service contact Timeliness of return ability 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 78

79 Policy - EDD & Risk Management What to include in policy for any merchant with web presence Product sold Return policy Delivery policy Terms and conditions READ Review all Visa required elements Secure payment page Currency type Customer service contact information Review all links 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 79

80 Policy - EDD & Risk Management Review Website Ensure items have not changed from time of approval (Screen shots should be saved with merchant record) Compare product to original approval Checkout page must still be secure Refund policy must be easily accessible Terms and Conditions must be materially the same No hidden cross sells Billing frequency must make sense Re-check WHOIS record Ensure affiliate policy has not changed 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 80

81 Policy - EDD & Risk Management Membership Websites Policy Best Practices Verbiage should plainly state enrollment and billing option Negative option should be clearly and conspicuously disclosed When clicking order you agree to x term at x $ Pre-checked cross sell or other boxes should not be used The core price should not be billed more than once in a 30 day span Full money back guarantee must be true Cannot have shipping charges not refunded Cannot have buyer pay for shipping to obtain refund 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 81

82 Policy - EDD & Risk Management Membership Websites Up-sells should be clearly disclosed Should not recur Should not be in a pre-checked box Customer should confirm up-sell Trial policy should require diligence Trial periods should be reasonable for the product Require free trials to truly be free Images of celebrities and endorsements are prohibited unless approved by the celebrity 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 82

83 Policy - EDD & Risk Management Membership Websites Claims must not be outlandish (examples are not inclusive) Fat melts away while you sleep Gain muscle without working out Earn money with little effort Endorsed by Obama Blogs used as endorsements must not be manufactured and must follow FTC guidelines (no fake blogs or fake articles) False sense of urgency is prohibited Do not say buy now only 2 left if that is not true Do not imply price will change if they do not purchase now 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 83

84 Policy - EDD & Risk Management Affiliate Marketing Policies Helpful statistics Helpful statistics Ensure merchants are monitoring affiliate performance Require Periodic summary reporting of activity: Approval ratio (should not be 100% for any one affiliate) Rebill success ratio(typically 65%) Refund ratio (generally between 5% - 10%) Declines by decline code Device ID (not just IP) Chargeback ratio (<.50% but NOT 0%) 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 84

85 Policy - EDD & Risk Management Monitoring Internet and Mail Order/Telephone Order Merchants Ongoing MOTO/Internet monitoring even when things are ok Continually or randomly review scripts Secret shop as stated previously Google Search on contact phone and addresses Complaints or signs of consumer deception Association with unapproved products or related companies Potential Sign of beneficial owners Contact a higher % cardholders ~ real time and upon receipt of product Ensure cardholder completed purchase Ensure product was as expected When did they purchase? What URL did they purchase from? Very important 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 85

86 Policy - EDD & Risk Management More than Transaction Monitoring Re-underwrite the account Periodically refresh credit and financial records on file Review FTC, BBB and other reputation and legal resources Review transactions Look at dollars and number of transactions over a 6 month period Sales volume must be compared Credit volume must be compared CB volume must be compared Re-underwrite the account 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 86

87 Helpful Hint Merchant Research Run MATCH again Pay close attention to all inquiries Pull both business and personal credit reports Compare to original for change in status Understand difference if applicable Pay close attention to all inquiries Are they from other ISOs or Acquirers? Check for data breaches 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 87

88 Helpful Hint Know Your Sales Channel Trusted agent/iso list Feet on the street Length of time you have worked with the agent/iso High risk agent/iso list Always sends complete applications Telemarketers only Submits restricted accounts Has had many merchants go bad 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 88

89 ISO Due Diligence and Monitoring 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 89

90 ISO Due Diligence and Monitoring Third Party Oversight The Risk Management Lifecycle The OCC calls out merchant payment processing as a specific example of a bank third-party relationship that must be managed according to the Risk Management Lifecycle defined in updated guidance issued. October 30, /9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 90

91 ISO Due Diligence and Monitoring The many risks posed by 3 rd parties Recent guidelines published by the OCC and the Federal Reserve Board identify the following risks of third parties (including ISOs) used to perform critical organization activities: Operational Risk Compliance Risk Credit Risk Legal Risk Strategic Risk Reputation Risk Concentration Risk Holistic review is mandatory 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 91

92 ISO Due Diligence and Monitoring ISO Policy Overview Portfolio Monitoring Shadow Monitoring Setting Thresholds Remediation Ongoing Mangm t Training Programs Periodic Review Due Diligence Identify the ISO, its principals & related entities Understand financial position Understand op capabilities 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 92

93 ISO Due Diligence and Monitoring Holistic Review Reputation of the Business and Principal(s) Criminal check Law Suit Review Consumer complaints Reference checks Financial Review Business and Principal(s) Financial Statement Tax Returns Credit Check Insurance Coverage Know Your Customer Legal Entity verification Cross check principals listed against databases for prior or additional businesses Understand if ownership layering exists 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 93

94 ISO Due Diligence and Monitoring Holistic Review Business Plan Business Attributes Additional Third Parties Outsourced functions? Security concerns? Onsite Inspection 360 View Marketing Effectiveness Products & Services Referral Partners Marketing & Solicitation Materials ISO Policy & Procedures 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 94

95 ISO Due Diligence and Monitoring Holistic Review Understand the existing portfolio Existing ISO Contracts Portability Profitability Activity Statistics Portfolio Loss History Merchant Demographics along with 6 month trending for large verticals is recommended 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 95

96 ISO Due Diligence and Monitoring ISO Training Policy Formalized Training Credit Policy & Procedures Systems Access & Controls Risk Policies & Procedures Sales Procedures Proper Disclosure Agent/Referral Partner Due Diligence 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 96

97 ISO Due Diligence and Monitoring Periodic Review Policy Mirror the original due diligence process Recommended at minimum annually Onsite is recommended Review for changes from preceding review ISOs with a higher risk concentration should be reviewed more frequently Quarterly statistical monitoring is suggested following anomalous annual review results 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 97

98 ISO Due Diligence and Monitoring Monitoring and Oversight Policy Ongoing Quality Checks Shadow Underwriting Shadow Transaction Review Shadow Account Maintenance Review Terminated Merchants Merchant Reputation Monitoring 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 98

99 ISO Due Diligence and Monitoring Monthly Reporting Policy Portfolio, ISO, Sub-ISO, VAR, Agent Timeframes for review Monthly Quarterly (month to month view) Semi-Annually (month to month view) Different perspectives for review CNP/CP Restricted MCC Business type Geography 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 99

100 ISO Due Diligence and Monitoring Monitoring and Oversight Policy Know the statistics Underwriting Decline, Approval and Pend ratios and reasons MCC concentrations Merchant Periodic Reviews Issues encountered Month over month review for patterns PCI compliance by level Card Brand program registration Attrition Closed by ISO Understand early termination fees Pricing and downgrades new addition no in Guidelines 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 100

101 Helpful Hints Questions to Ask Know how they underwrite their agents Review for sub-isos that should be registered Know their processing statistics individually What are their portfolio chargebacks? Do their statistics drive a large % of your statistics? Are their merchants those in Card Scheme programs? Do their merchants frequently process more than the approved volume? Do they ask for large volumes on start up merchants? Do they ask for multiple MIDs for a single merchant or similar merchants? 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 101

102 ISO Due Diligence and Monitoring Understand Portfolio Concentrations Overall and per ISO What to review Review statistics per MCC # of merchants Overall Processing Volumes % of total portfolio Watch overuse of generic MCCs (5999, 7299, 7399, 8999 etc.) Review top merchants (6 month trending) Review top chargeback merchants (6 month trending) Review top refund merchants (6 month trending) 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 102

103 Helpful Hint: 6 Month Trending Sales $ Sales # Credit $ Credit # CB $ CB # ISO Trending Report ISO Name Month 1 Month 2 Month 3 Month 4 Month 5 Month 6 Credit % CB % # refunds/# sales # chargebacks/# sales ACH Reject amount Reserve Amount 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 103

104 ISO Due Diligence and Monitoring Policy should indicate items to review Know the statistics Chargeback ratios Typically below 10 basis points Know which merchants drive the ISO s statistics Know which ISO/VAR/Agent drives your statistics Credit/refund ratios are typically very low at the portfolio level and are consistent over time, if now know why Use the levels previously discussed as a guide 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 104

105 ISO Due Diligence and Monitoring Policy should indicate tolerances Mirror the original due diligence process Chargeback ratios 30 BPS must review 50 BPS must obtain a workout plan 70 BPS may terminate ISO or Merchant This level should be reported to board or senior management Large ISO losses should also be reported 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 105

106 ISO Due Diligence and Monitoring Management and Board Reporting Policy What to review and understand Merchants in Card Scheme Programs Number many overall and per ISO Frequency with which an ISO produce merchants that are in programs Length of time allowed to remain in programs Reserve activity and balancing Secret shopping 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 106

107 ISO Due Diligence and Monitoring Remediation Policy Clear and concise Workout periods should be defined Should include termination as a possible outcome All action should be clearly documented Increase Onsite presence Increase training Increase oversight Decrease concurrence levels 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 107

108 ISO Due Diligence and Monitoring Risk is Everywhere Overall increase in failed and bankrupt businesses Government action can override your risk mitigation strategies Knowing your Merchants, ISOs, Agents, VARS is the best strategy Proper oversight Comprehensive management and board reporting Do NOT use reserves as a safety net for bad behavior Strong policies are key These Guidelines can help you create those policies 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 108

109 CONTACT US Deana Rich President +1 (818) (818) linkedin.com/in/deanarich

110 Addendum: Basic Chargeback and Other Compliance Programs 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 110

111 Visa ~ Merchant Chargeback Monitoring Program ~ MCMP The MCMP program monitors the total chargeback activity of all merchants on a monthly basis. Program thresholds - a merchant must meet or exceed all of the following: 100 or more Visa Interchange transactions 100 or more Visa chargebacks A 1% or higher ratio of overall Visa chargeback-to-interchange ratio (by count) 10 Month program with Chargeback fees commencing at Month 3: Initial notification: Month 0- no fee 2nd notification: Month 1- Completed Questionnaire and a copy of the Merchant Application and Agreement. 3rd notification: Month 2- Formal Chargeback Reduction Plan to be submitted 4th notification: Month 3- $50 per chargeback fee assessment commences 7th notification: Month 6- $100 per chargeback fee assessment commences 9th notification: Month 8- $25,000 review fee plus $100 per chargeback fee 10th notification: Processing privileges may be revoked 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 111

112 Visa ~ High Risk Merchant Chargeback Monitoring Program ~ HRMCMP The HRCMP program monitors the total chargeback activity of all high-risk merchants on a monthly basis. The program applies to merchants in the following Merchant Category Codes: MCC 5962, 5966, 5967 and 7995 Program thresholds - a merchant must meet or exceed all of the following: 100 or more Visa Interchange transactions 100 or more Visa chargebacks A 1% or higher ratio of overall Visa chargeback-to-transaction ratio (by count) 6 Month program with a $5,000 review fee at Month 1: No warning period Chargeback fees commence immediately Months 1 thru 3: $100 per chargeback fee Months 4 thru 6: $150 per chargeback fee Month 6: $25,000 review fee and Visa may disqualify the merchant from the Visa system. Subsequent fines of $25,000 to $250,000 thereafter for each month the merchant remains in the program. 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 112

113 Visa ~ Global Merchant Chargeback Monitoring Program ~ GMCMP A merchant must now meet or exceed all of the following to enter into the program: 200 or more Visa International Interchange transactions, and 200 or more Visa International first chargebacks, and A 2% or higher international chargeback-to-international sales ratio (by count) 10-Month review program with no warning period: Months 1 thru 3: Workout Period (month 1 = initial notification). No fee, but the merchant is expected to reduce chargebacks below the threshold before the workout period expires, or fines will be applied retroactively, once the workout period is over. A completed questionnaire and detailed action plan is required. **The workout period is not be applicable to high-risk merchants** Months 4 thru 9: $100 per international chargeback for every month the merchant exceeds program thresholds. If the acquirer and merchant don t implement procedures to reduce chargebacks, Visa may assess a fee of $200 for every international chargeback. > 10 months: Visa may assess a $25,000 review fee and impose a restriction of acceptance privileges and potential disqualification from the Visa payment system. 4/9/2015 ELECTRONIC TRANSACTIONS ASSOCIATION 113