Merchant Account Security

Skimming attacks have long been a concern for financial transactions, particularly at ATMs and gas station pumps, but did you know that POS devices even inside retail locations are also vulnerable? 🔵 What is a skimming attack? The method involves placing an additional, fraudulent keypad overlay on top of the legitimate device's keypad. This overlay looks and feels similar enough to the original that unsuspecting customers might not notice the difference. When a customer enters their PIN on the keypad, the overlay device captures the keystrokes, allowing the attacker to record the PIN. In conjunction with other skimming devices that can capture card information (such as a card reader overlay), this attack can provide a threat actor with all the necessary information to clone a victim's card or perform unauthorized transactions. 🔵 How dangerous are skimming attacks? The sophistication of these skimming devices can vary. Some simply store the captured data for later retrieval by the attacker, while others may have wireless capabilities, allowing the data to be sent in real time to the attacker. This real-time capability significantly increases the risk, as it allows for immediate misuse of the stolen card and PIN information. 🔵 How to protect yourself from this type of attacks? As a consumer, look for any signs of tampering or any elements that seem out of place on the POS device, such as the feeling from clicking on the buttons. As a merchant, regularly inspect their POS devices for any unauthorized modifications and consider security measures such as tamper-evident seals. Additionally, the adoption of EMV chip technology, which is more secure than magnetic stripe transactions, and contactless payments can help mitigate the risks associated with skimming attacks. #cybersecurityawareness

Fraud wasn’t supposed to be a core product challenge. But for most businesses operating online today, it has staunchly become one. In 2024, Indian businesses lost ₹22,842 crore to cybercrime. That’s a 206% increase over the previous year. The first few months of 2025 have already added another ₹7,000 crore in losses. This isn't just a compliance or security concern anymore. It shows up as frozen accounts, locked working capital, rising chargebacks, and misuse through stolen cards, fake UPI payments, and promo abuse. What surprised us most was how quickly chargebacks became part of the everyday reality for merchants: 1. More than half involve deliberate abuse 2. Smaller businesses aren’t spared - around 30 percent of Indian SMEs now report direct losses from fraud, with revenue hits of up to 5 percent. The nature of fraud has changed. Attacks are faster, more coordinated, and more sophisticated. The usual playbook of reacting after the damage doesn't hold up anymore. We decided to rebuild our approach from first principles. RiskShield is what came out of it. It’s a fraud detection engine that runs within the payment flow. It scores every transaction in real time using machine learning, detects fraud rings using graph intelligence, syncs with government risk data like I4C, DoT blacklist, NCRB, and blocks bad actors mid-transaction. It also flags early signs of promo abuse, card testing, and UPI manipulation. So far, RiskShield has helped block over ₹1,700 crore in fraud attempts. It has flagged 2 crore high-risk signals and protected more than 6,600 merchants. The system operates quietly in the background, with an F1 score of 87 percent which is a measure that balances precision (how often fraud alerts are correct) and recall (how much fraud we actually catch) and recall close to 95 percent. Most issues are prevented before anyone files a complaint. There’s still more work to do, but one thing is clear to us now: Fraud cannot be treated as an after-effect. It has to be designed against from the beginning. PS. Here's the flow we have built ⬇️

𝗛𝗼𝘄 𝗕𝗜𝗡 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 𝗔𝗿𝗲 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗶𝗻𝗴 𝗣𝗮𝘆𝗺𝗲𝗻𝘁 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 Payments fraud is evolving, and BIN attacks are one of the fastest-growing threats. By exploiting weaknesses in how card transactions are authorized, fraudsters can test thousands of stolen or algorithm-generated card numbers, often undetected until significant losses occur. So, how do BIN attacks work, and what can merchants do to stop them? Let’s break it down👇 𝗪𝗵𝗮𝘁 𝗶𝘀 𝗮 𝗕𝗜𝗡 𝗔𝘁𝘁𝗮𝗰𝗸? → A Bank Identification Number (BIN) refers to the first 6–8 (soon 10) digits of a card number, which identify the issuing bank and card type. In a BIN attack, fraudsters: 🔹 Use software to generate potential full card numbers. 🔹 Test small transactions (pennies to a few dollars) to see which numbers are valid. 🔹 Sell the successfully tested cards or use them for larger fraud purchases. → These attacks can happen rapidly and at scale, overwhelming merchants with fraudulent declines and chargebacks. 𝗧𝗵𝗲 𝗜𝗺𝗽𝗮𝗰𝘁 𝗼𝗻 𝗠𝗲𝗿𝗰𝗵𝗮𝗻𝘁𝘀 & 𝗜𝘀𝘀𝘂𝗲𝗿𝘀 ▪️High authorization decline rates damage approval rates for legitimate customers. ▪️Chargeback spikes result in added costs and potential penalties. ▪️Fraud monitoring disruptions → Increased failed attempts can flag legitimate transactions as suspicious, frustrating real customers. 𝗖𝗮𝘀𝗲 𝗦𝘁𝘂𝗱𝘆: 𝗘-𝗰𝗼𝗺𝗺𝗲𝗿𝗰𝗲 𝗨𝗻𝗱𝗲𝗿 𝗦𝗶𝗲𝗴𝗲 📌 One global e-commerce platform saw a 400% increase in fraudulent authorizations within 24 hours due to a coordinated BIN attack. Their fraud detection tools initially missed the spike, leading to: 🔹 Over $1.2M in chargebacks from unauthorized transactions. 🔹 A 5% drop in legitimate transaction approvals as banks tightened fraud rules. 🔹 Emergency implementation of velocity checks to block excessive failed attempts. 𝗛𝗼𝘄 𝗠𝗲𝗿𝗰𝗵𝗮𝗻𝘁𝘀 𝗖𝗮𝗻 𝗣𝗿𝗲𝘃𝗲𝗻𝘁 𝗕𝗜𝗡 𝗔𝘁𝘁𝗮𝗰𝗸𝘀 ▪️𝗩𝗲𝗹𝗼𝗰𝗶𝘁𝘆 𝗟𝗶𝗺𝗶𝘁𝘀 → Set limits on how many failed transactions a single card or IP can attempt. ▪️𝗠𝗮𝗰𝗵𝗶𝗻𝗲 𝗟𝗲𝗮𝗿𝗻𝗶𝗻𝗴 𝗙𝗿𝗮𝘂𝗱 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 → Use AI-powered fraud tools to detect unusual transaction patterns in real-time. ▪️𝟯𝗗𝗦 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 → Challenge suspicious transactions with additional verification layers. ▪️𝗕𝗜𝗡-𝗟𝗲𝘃𝗲𝗹 𝗥𝗶𝘀𝗸 𝗠𝗼𝗻𝗶𝘁𝗼𝗿𝗶𝗻𝗴 → Flag and block high-risk BINs associated with known fraud activity. 𝗧𝗵𝗲 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆 BIN attacks exploit weaknesses in payments security, but proactive fraud prevention can minimize the risk. Merchants and issuers must work together to improve real-time detection and response strategies. Sources: Visa, Mastercard, Stripe 🚨Follow Jason Heister for daily #Fintech and #Payments guides, technical breakdowns, and industry insights.

When everything that can go wrong in payment does … who do you want on the other end of the line? Saw a Reddit thread last night (link in first comment) from a platform using Stripe Connect. “A hacker created six Express accounts, linked them to our platform, and drained our balance. Then, they started charging our users and funneling the stolen money to their Express accounts, instantly cashing out via debit card.” The platform immediately called Stripe and took action to remove the fraudulent accounts, but they were already on the hook for $41K. Stripe’s initial response was “We’ll escalate this to our support team.” A day later, the platform received a “canned security email.” It is possible that the platform’s API keys were compromised and payment providers (including Rainforest) generally won’t be liable for losses in that situation. BUT, as a payment provider, Rainforest does a lot of things differently that would have reduced both the likelihood and severity of this situation. 1️⃣Platform onboarding ‼️Stripe allows platforms to self-onboard. ✅Rainforest has mandatory checkpoints including a session key review with every platform before they move to production. 2️⃣Merchant onboarding ‼️Stripe allowed the fraudulent merchants to onboard instantly. ✅Rainforest performs a full due-diligence on every merchant before they start accepting payments. 3️⃣Vertical-specific onboarding ‼️Most payment providers use all-purpose underwriting models designed to score a wide variety of merchants. Like any filter designed to let a lot of things through, it’s also easier for fraudulent merchants to sneak through.  ✅Rainforest uses vertical-specific underwriting models that allow us to score merchants based on the typical customers of a specific software platform, instead of the entire universe of merchants. The criteria are more specific, which makes it harder for fraudulent merchants to sneak through. 4️⃣Restricted funds flows ‼️Every payment provider has some type of internal ledgering system as well as logic determining the timing and destination of deposits. When not properly controlled, these can be exploited to quickly reroute funds. ✅Rainforest was built to allow very specific funds flows and specific deposit timings and destinations, which would impede a bad actor from quickly draining the platform’s funds. 5️⃣Human support ‼️Most payment providers route support tickets through a maze of ticketing, chatbots, and emails… maybe eventually getting an answer. ✅Rainforest’s support team are payments experts who genuinely care about our platform clients. Platforms have a direct line of communication to at least two or three Rainforest team members, each of which know you, your team, and your merchants. It’s normal to not think about risk until it happens, but when something does go wrong… who do you want on your team?

3‑D Secure Can Save Merchants Millions…If They Use It Correctly Card‑not‑present fraud will steal $28.8 billion from merchants this year alone. Yet many payment leaders still call 3‑D Secure (3DS) a “conversion killer.” However, the data tells a different story: - 93% of UK merchants and 76% of US merchants report cart abandonment rates below 15% when 3DS is triggered. - 64% of transactions are authenticated frictionlessly, never requiring the shopper to lift a finger. - Liability‑shift moves fraud chargebacks from the merchant to the issuer, saving roughly 0.4 – 1 % of GMV for high‑risk verticals (IXOPAY benchmark). So why do some merchants still bleed revenue after turning on 3DS? Because HOW you deploy it matters more than IF you deploy it. Let me explain... Having been on both sides of the implementation debate when working on acquiring and issuing projects with Visa and Mastercard for over a decade, I have developed a unique understanding of what motivates Merchants/Acquirers and Issuers regarding how and when to apply 3DS. Because of that, my advice to merchants is primarily practical and very data-driven. Here is my playbook for properly leveraging 3DS. 1. Use Risk‑based routing, not blanket challenges By sending only high‑risk or mandated transactions via 3DS. Wherever the rules allow, apply SCA exemptions (TRA, low‑value, whitelisting, etc.). 2. Feed the issuer better data Pass >100 data points, including device information, account tenure, prior‑auth history, etc., to maximize frictionless approvals. 3DS2 rewards rich context. 3. A/B‑test challenge flows Track abandonment and approval deltas by BIN, issuer, and market. Kill any flow that underperforms the control. 4. Build smart fail‑over If a transaction soft‑declines after a 3DS attempt, automatically retry through another acquirer, payment method, or token format. Don’t leave good orders stranded. 5. Let your orchestrator do the heavy lifting Platforms like IXOPAY let you codify these rules per country, payment method, and even hour of the day, without fresh code deployments. Result? Sub‑1% fraud loss AND higher net conversion. That’s money back to the P&L instead of to fraudsters or lost shoppers. How are you ensuring that your merchants are properly balancing fraud protection and conversion today? Drop your tactics (or horror stories) in the comments. P.S. If you want a more in-depth guide on how to utilize 3-DS, Orchestration, and other tactics, subscribe to my newsletter, the Payments Strategy Breakdown, as I will be sharing them soon https://buff.ly/s32OfBn

One of the marketplaces we protect saw over 30,000 unique visitors attempt to log in with the right password, a realistic device, and a clean IP - but each of these visitors were fake, all under the control of a single fraud ring. Last week I shared the uptick we’ve been seeing on reset takeovers - this is the practice of using compromised inboxes to trigger password resets that give fraudsters control over accounts. We’re continuing to see these roll in, mostly low-and-slow, as we get closer to the holiday season. The 30,000 we show here may seem like a large number of accounts, but this, like most of these attacks, makes up less than 2% of the marketplace’s total traffic. It’s easy to overlook. 💡 What it means if you’re targeted by this: ▪️ Transaction Risk: Fraudsters will exploit policy & model features that give more favorable ratings to accounts with good history. ▪️ Login Risk: Fraudsters will “expand” the digital identity of your account holder to incorporate virtual devices and proxy IPs under their control. ▪️ CS Abuse: Fraudsters will leverage good history on the stolen account to get more lenient treatment from your customer service team. 🔎 How to spot and stop this: ▪️ Put the same level of risk assessment on password resets as you do on logins. ▪️ Use data across the customer journey to assess risk in how a user arrives at the site, browses, enters reset flows, accesses an account, and interacts with your platform. ▪️ Ensure your application isn’t leaking account data to attackers through password reset and sign-up flows. If a fraudster can check if an email address is registered on your platform, you’ve given that fraudster incredibly powerful targeting information. If you’re feeling uncovered in these flows, it’s worth revisiting your risk posture on accounts that have self-initiated a password reset in the last 12 months. As businesses are eager to see as much growth as possible in the coming months, it’ll take a steady hand to ensure this doesn’t lead to a tragic quarter because fraudsters seized the opportunity to capitalize on the breached consumer data they’ve been pigging out on all year. #frauddetection #ato #bots #customerjourney

Agentic Musings #10 When machines can pay, fraud gets a new playbook. Agentic commerce doesn’t just remove clicks; it shifts the attack surface. New threats to plan for: - Agent impersonation & key theft (steal the actor, not the card) - Prompt/tool injection that silently reroutes spend - Consent drift (agents acting beyond what was delegated) - Merchant/API spoofing and replay attacks - Automation abuse at scale (bots that look “legit”) What good control looks like: - Tokenized credentials (per-merchant, per-use, JIT provisioning) - Scoped, revocable consent (amount/time/MCC/vendor binding) - Signed payment intents + non-repudiation on every hop - Agent attestation & device binding before any high-risk action - Real-time policy engine (who/what/where/why) with guardrails - Risk-based step-up (biometric push or passkey only when needed) - Behavioral analytics on agents (telemetry, rhythm, destinations) - Instant kill-switch & credential rotation - Transparent audit trails users can see and regulators can trust Tangible patterns already in the wild: - EV “plug & charge”: certificate-based vehicle auth + auto-pay within limits - Toll/transport: device binding + account caps + rapid revocation - Corporate cards: server-side rules (MCC/amount/geofence) that auto-decline outside policy Security isn’t a checkbox in agentic commerce; it’s the product. Build trust, and you win the right to run in the background. #AgenticCommerce #AIagents #PaymentsSecurity #FraudPrevention #Tokenization #Passkeys #RiskEngine #Compliance #InvisibleUX #viewsmyown

Mastercard and Visa have both introduced new monitoring requirements that platforms are now expected to operationalize. Mastercard’s Merchant Monitoring Program and Visa’s VAMP framework require platforms to verify merchant websites for fraudulent activity if those merchants accept their cards. This is an important moment for compliance teams. For a long time, fraud controls largely focused on transaction monitoring after a merchant was already live. But these card networks are now pushing that responsibility further upstream into onboarding. If you enable a merchant to accept Visa or Mastercard, you are expected to understand what that merchant is actually doing online. That means reviewing websites, checking for prohibited activity, and making sure the business model matches what was declared during onboarding. You’re right if you think that means additional operational effort. But at an ecosystem level, it makes sense. If fraud is caught before a merchant starts processing at scale, chargebacks and downstream losses decrease for everyone in the network. For compliance and risk teams, this reinforces a broader trend: onboarding is becoming the primary control point, not just an administrative step.

Mastercard's 72-hour scam-monitoring clock starts in eight days. That's not enough time to redesign your monitoring process. It's enough to find out whether your response chain actually holds. These standards are less a new merchant-risk threshold and more a test of whether the acquiring chain can investigate, document, escalate, and act inside 72 hours. For sponsor banks of payment facilitators, delegating that to the PayFac by contract doesn't, on its own, discharge the sponsor's accountability. It requires enough visibility into the investigation, the decision, and the action taken to show the standard was met. The triggers come from a mix of inbound Mastercard signals and monitoring you run yourself. A GRIP letter from Mastercard arrives at your door. Authorization-rate deterioration and certain new-merchant thresholds depend on your own systems catching them. Either way, detection only starts the clock. Investigation, escalation, decision, documentation, and action determine whether you meet the standard. Source: Mastercard Security Rules & Procedures, effective July 24, 2026. The response chain worth stress-testing before the date: 1) A threshold breach or an inbound alert flags a potential scam merchant. 2) It reaches the right PayFac or acquirer team, not a shared inbox no one owns. 3) The PayFac pulls the sub-merchant data and investigates. 4) The sponsor bank gets visibility into status and evidence, not a monthly summary after the fact. 5) The right party blocks Mastercard and Maestro acceptance if activity is confirmed. 6) Every step is documented inside the window. If the handoff at step 2 or the visibility at step 4 isn't solid, the clock can run out while everyone waits on someone else. CardTraq view: the exposure that's easy to underestimate sits with the sponsor bank. When Mastercard flags a sponsored merchant, the question isn't whether the PayFac is contractually responsible. It's whether the PayFac can produce the investigation record and evidence fast enough for the sponsor to show it met the standard. Some sponsors already have real-time visibility into sub-merchant investigations. For them, the operational gap is much smaller. Where it lives only in the PayFac's systems, the sponsor can carry an exposure it can't easily see. The point is knowing which one describes your setup. One question worth answering before July 24: if a sponsored merchant trips a trigger tomorrow, who owns the first hour, and can you prove the full response cycle inside 72 hours? Happy to walk through the response chain for your specific portfolio.

Do Funders Have the Right to Log Into a Merchant’s Bank Account After Funding? This question came up recently in a group chat and I think it’s worth unpacking publicly because a lot of people in this industry are unclear on what’s actually allowed. The short answer? 👉 It depends on the contract. ✅ If the merchant signed a funding agreement that includes language allowing account monitoring… Then yes, the funder does have the right to access the merchant’s account via a third-party platform (like Plaid) or by other agreed-upon means. This is usually tied to: • Compliance monitoring • Default risk mitigation • Payment tracking Clauses like: “Merchant authorizes funder to access or monitor business bank accounts at any time during the term of the agreement…” are very common in MCA contracts. ❌ However, if there is no such clause in the signed agreement Then logging into the merchant’s bank account (especially manually or without permission) can absolutely be considered: • A breach of contract • A violation of privacy • And potentially grounds for legal action It’s not about what funders “feel entitled” to. It’s about what was agreed upon in writing. Merchants and brokers alike need to read the fine print. And funders should always act within the scope of what’s contractually allowed - no more, no less. Let’s keep the conversations going that actually help this industry become more transparent and professional. 🧠 Thoughts? Have you seen this clause in your contracts? Or seen it go wrong when it wasn’t there? 👇 Drop your experience in the comments. #MCA #MerchantCashAdvance #ISOlife #Funders #BusinessEthics #ContractsMatter #LinkedInForBrokers #IndustryTalk