Category Archives: Institute of Internal Auditors

Federal Court fines Payment Processor for poor Business Practices

Proper business practices are a necessity in business, and when dealing with other people’s money it is paramount.  The FTC, again, has charged a fine against a business for not doing proper due diligence on new accounts within their operations.  ChoicePoint, now owned wholly by Lexis-Nexis, was previously found guilty of such practices in their infamous “breach” where an account was setup and pilfered 100,000s of accounts records.

The latest fine is against a payment provider who did not properly follow its own guidelines for onboarding new merchants.  The result was the fraudulent charges against consumers of more than $2.38 million.  The business has been ordered by Federal Court to pay $1,779,000 in consumer redress and end the illegal practices.

…the payment processor did not follow its own guidelines for new merchants and did not check addresses, phone numbers, or references the bogus merchant provided. The FTC alleged that the defendants anticipated that the scam would generate high return rates, that they did not request or obtain proof that consumers had authorized debits to their accounts, and that they continued to process charges even after receiving complaints from consumers and banks and unacceptable explanations about unauthorized debits from the merchant. The complaint alleged that more than 70 percent of the merchant’s transactions were returned or refused by the consumers’ banks

What is interesting is – what type of risk management practices existed in the business to let this occur for so long, and what audit efforts were conducted that did not catch these deficiencies in existing controls?

Guidelines and proper business practices are NOT check boxes for the sole purpose of checking them, but to be adhered in a manner that ensures the operational integrity of the business and the fidelity of operations.

A great article on the power of “check lists” is available here at the New Yorker.

Best regards,

James DeLuccia IV