One website advertised dog products. Another advertised flowers; another, home decorations. All of them were really fronts to process payments for marijuana or designer drugs, prosecutors said.
The Justice Department and the Federal Trade Commission have recently brought a string of criminal and civil cases accusing individuals and companies of using legitimate-looking websites to deceive financial firms into processing unsavory purchases. Such schemes are often called credit-card laundering or transaction laundering.
Illegal purchases, including drugs, are being processed unwittingly by banks and payments networks including Visa Inc., V -0.72% Mastercard Inc. MA -1.11% and American Express Co., AXP 0.13% according to court documents and people familiar with the matter. The yearslong boom in e-commerce, even before it got an extra boost during the coronavirus pandemic, has attracted entities looking to use its infrastructure in unintended ways.
Financial cops are zeroing in on a weak link in the online-payments system: middlemen that connect merchants to the banks that help approve and settle transactions. From low-tech independent sales organizations to Silicon Valley players like PayPal Holdings Inc., Square Inc. and Stripe Inc., an array of companies have sprouted up to help internet businesses take payments.
The companies say they’re committed to fighting misconduct. Jodie Kelley, chief executive at the Electronic Transactions Association, which represents payment processors, said her members regularly terminate fraudulent merchants, including more than 10,000 merchants that were cut off in 2017 because of fraud. Ms. Kelley said her members alert authorities about “bad actors,” citing members who reported merchants for price gouging on face masks and other goods when the coronavirus pandemic hit.
But the amount of due diligence each performs on merchants varies. Some try to detect any fraud on their platform, and major networks will often provide information to law enforcement to help them catch culprits. Others turn a blind eye or willingly enable it, authorities say.
“No processor, even if it spent a fortune, is going to perfectly shield itself from fraudulent merchants,” said Lois Greisman, associate director of the FTC’s Division of Marketing Practices. The FTC, she said, “is seeking to root out processors that are knowingly facilitating fraud.”
In one recent high-profile case, the Manhattan U.S. attorney’s office accused two businessmen, Ruben Weigand and Hamid “Ray” Akhavan, of tricking banks into processing more than $100 million in transactions made through Eaze Technologies Inc., an online marijuana marketplace.
Major card networks don’t allow card purchases of products or services that are deemed illegal, and marijuana is illegal under federal law.
Prosecutors said in court filings that the two men set up online retailers advertising dog products, diving gear and soda and conspired to deceive banks to accept payments for marijuana sales. The Federal Bureau of Investigation is also investigating whether scandal-plagued German payments company Wirecard AG WDI -7.07% worked with Mr. Weigand and Mr. Akhavan, The Wall Street Journal previously reported.
Ira Rothken, a lawyer for Mr. Akhavan, said that the indictment “essentially admits there was no ‘transaction laundering’ ” because major payment networks don’t have merchant category codes for cannabis transactions.
Both men have pleaded not guilty and asked a judge to dismiss the indictment. Eaze, which wasn’t charged, said it is cooperating with authorities. Wirecard didn’t respond; it has previously declined to comment.
The volume of transaction laundering is hard to estimate. Often networks such as Visa and Mastercard aren’t aware of a problem with a merchant until, for example, a large number of people dispute transactions with that merchant. By then, much of the money has already moved.
Roughly $500 billion of money laundering with credit, debit, prepaid and other cards occurs online each year world-wide, according to EverCompliant, which sells anti-money-laundering tools and software. Typically, the merchants or card issuers take the loss when cards are used fraudulently.
First Data Corp., one of the largest U.S. payment processors, agreed in May to pay $40.2 million to settle FTC charges that for years it ignored red flags when it processed consumer payments for deceptive get-rich-quick schemes and debt-relief scams. First Data, now owned by Fiserv Inc., FISV -0.24% said in a statement that it remains committed to ensuring its business partners and merchants operate with integrity. The company didn’t admit or deny wrongdoing.
In 2018, the Justice Department accused the CEO of Backpage.com, a classified-ads website known for its numerous sex-related postings, of facilitating prostitution. Then-CEO Carl Ferrer pleaded guilty and admitted to working “to find ways to fool credit-card companies into believing that Backpage-associated charges were being incurred on different websites.” Mr. Ferrer is awaiting sentencing.
Carl Ferrer, then CEO of Backpage.com, leaving a Senate subcommittee hearing in 2017.
There is an inherent tension around rooting out such problems. Revenue for payments networks, processors and credit-card issuers rises when transaction volumes rise. Payment processors and card issuers often earn higher fees for transactions that look riskier. For example, merchants can pay higher payment-processing fees for online orders versus goods that are bought in person.
Payments companies can be less inclined to turn off a suspicious company if it is generating lots of transactions, said Adam Wandt, a researcher for the Center for Cybercrime Studies at the John Jay College of Criminal Justice.
Card issuers, processors and networks collected $86.2 billion in fees associated with Visa, Mastercard and AmEx credit-card transactions made in the U.S. in 2019, according to the Nilson Report, an industry publication. That was up from $46.9 billion in 2012.
Fighting credit-card laundering is a challenge. Visa and Mastercard track the level of disputed transactions merchants receive and can fine processors or make them terminate accounts where disputes are too numerous. But both networks have found situations where the merchants resurfaced under different names, according to people familiar with the matter.
Also, Visa and Mastercard generally require businesses with annual card sales of about $1 million or more to submit additional paperwork to verify their businesses. But merchants can sign up with multiple processors to bring their annual volume below the $1 million threshold.
In March 2019, the Pittsburgh U.S. attorney’s office charged several people in a criminal conspiracy to sell illegal sedatives and other drugs over the internet. The people were accused of starting shell companies, opening payment-processing accounts on their behalf with PayPal, Square and Stripe, and using those accounts to accept credit cards for drugs sold on other websites.
In one instance, an investigator made an undercover purchase of etizolam, a sedative that can’t be prescribed or sold in the U.S., on an online marketplace called Domestic RCS in October 2017, according to an affidavit submitted by the prosecution. At checkout, the investigator was shown a message that the transaction would show up on a credit-card bill under the name of a courier-delivery service, the affidavit said.
In April 2018, Stripe deactivated the accounts of businesses tied to the alleged scheme after Visa identified them as selling controlled substances, according to the affidavit. Archived versions of their websites showed that they advertised beauty products, home decorations and flowers, respectively.
Three men pleaded guilty to different roles in the scheme. Stripe and Square declined to comment. PayPal said it is committed to combating “the illicit use of our services.”