The question divides compliance teams: Do payment processors have a duty to police merchant fraud, or is that the responsibility of law enforcement and the merchants' acquiring banks?
Nuvei's $4.85 million FTC settlement brings this debate into focus. The company processed over $30 million in consumer payments for Reimage, a tech support scam, from 2017 to 2023. The FTC alleges Nuvei knowingly maintained accounts for fraudulent merchants, violating the Telemarketing Sales Rule. The proposed order requires Nuvei to screen and monitor clients, with enhanced investigation when chargeback rates exceed certain thresholds.
This isn't just about one processor. It's about defining where your compliance obligations end and where law enforcement's begin.
The Case for Aggressive Merchant Screening
Payment processors are a crucial link between merchants and card networks. They see transaction patterns, chargeback rates, and consumer complaints before anyone else.
If you process payments for a fraudulent merchant, you're enabling the fraud. That's the FTC's stance, supported by the Telemarketing Sales Rule's prohibition on assisting deceptive telemarketers. You can't claim ignorance when chargeback rates spike, consumer complaints flood in, or when a merchant's previous bank terminated them for fraud.
The FTC's order against Nuvei makes expectations clear. You must screen prospective clients before onboarding, monitor existing clients for fraud indicators, and investigate when chargeback rates exceed limits. You're also banned from processing payments for high-risk categories, like tech support sold through telemarketing or pop-up messages.
This approach positions payment processors as gatekeepers. You're not just moving money; you're vouching for the merchants you serve. When you open an account for a merchant terminated for fraud, you're accepting the associated risk. Ignoring escalating chargebacks means ignoring clear warning signs.
From a consumer protection standpoint, this makes sense. Consumers can't easily distinguish between legitimate merchants and scammers when entering payment details. They rely on the payment infrastructure to filter out bad actors. If processors don't perform that filtering, who will?
The Case for Limited Liability
Here's the counterargument: Payment processors aren't fraud investigators. They lack subpoena power, can't compel testimony, and can't prosecute criminal conduct. They're financial intermediaries, not law enforcement.
Imposing gatekeeper liability creates operational challenges. How do you screen a merchant for fraud before they've processed transactions? You can check business registration, verify identity, and review websites, but you can't predict future deceptive practices.
Chargeback rates indicate issues, but not always fraud. A 2% rate might suggest fraud or simply poor customer service. Terminating accounts based on chargeback thresholds alone punishes businesses that aren't committing fraud.
Enhanced screening for high-risk categories sounds reasonable until you define "high-risk." Outbound telemarketing includes legitimate B2B sales and political campaigns. Tech support covers every software company with a customer service line. Banning entire categories excludes legitimate businesses from the payment system.
There's also a competitive problem. Aggressive screening increases onboarding costs and delays revenue for new merchants. Competing against processors with looser standards means losing business. The FTC's action against Nuvei pressures industry-wide standards, but until they're universal, compliant processors are at a disadvantage.
Finally, where does liability stop? If processors are responsible for merchant fraud, are acquiring banks responsible for processor fraud? Are card networks responsible for acquiring bank fraud? The accountability chain must break somewhere, and processors argue it should break at the merchant level.
Where Practitioners Actually Land
Most payment processors already maintain some form of merchant screening. They're required to comply with card network rules, which mandate Know Your Customer checks, transaction monitoring, and chargeback management. The question isn't whether to screen, but how aggressively.
Processors serving high-risk industries typically implement enhanced due diligence: reviewing merchant websites for advertising compliance, checking the Terminated Merchant File, requiring personal guarantees, and setting transaction volume limits during the first 90 days. They'll also monitor for sudden transaction spikes, changes in transaction size, or geographic patterns that don't match the business model.
But these controls cost money and slow onboarding. A processor serving low-risk merchants might rely on automated screening, escalating accounts that trigger specific risk flags.
The FTC's action against Nuvei suggests this risk-based approach isn't enough when processing payments for merchants with clear fraud indicators. Processing $30 million for a tech support company that others terminated isn't a marginal judgment call; it's ignoring clear warning signs.
Our Take
Payment processors should bear gatekeeper liability, but with two conditions: clear regulatory standards and proportional penalties.
The FTC's proposed order against Nuvei offers useful guidelines. Banning payments for tech support sold through pop-up messages is specific and defensible; those pop-ups are almost always scams. Requiring investigation when chargeback rates exceed thresholds is measurable and actionable. These aren't vague obligations; they're concrete requirements you can build into your compliance program.
But the FTC needs to publish industry-wide guidance, not just enforce through settlements. If chargeback rates above a threshold trigger mandatory investigation, processors need to know what that threshold is. If certain merchant categories are prohibited, define them precisely. Compliance officers can't build programs around case-by-case enforcement.
The penalty structure also matters. Nuvei's $4.85 million settlement is tied to specific, quantifiable harm: $30 million in fraudulent transactions over six years. That's proportional. If the FTC starts imposing massive penalties for isolated compliance gaps or good-faith judgment calls, processors will exit high-risk categories entirely, harming legitimate merchants and reducing competition.
You can't outsource all fraud prevention to payment processors, but you can require them to act on clear warning signs. When chargebacks spike, when merchants are terminated by others, or when consumer complaints document deceptive practices, processors should investigate or terminate the account. That's not asking them to be fraud police; it's asking them to respond to evidence they already possess.
