CNP Series: Lessons from a CNP Fraud Scheme – Part 4

Recently, the criminal case against online merchant Jeremy Johnson in Utah that started back in June 2011 finally came to a close. After more than four years of litigation and six weeks of trial, the jury found Johnson guilty of eight counts of making false statements to a bank, but acquitted him on 78 other charges, including bank fraud, wire fraud, conspiracy and money laundering.

By far the biggest legal spectacle involving card-not-present high-risk processing in more than a decade, the Johnson case poses a cautionary tale to banks and ISOs inclined to bend the rules in search of profits; and to merchants willing to “bend the truth” to get access to the payments system.

This is the last of four articles that will use the case to examine card-not-present fraud from a legal perspective. Part 1 described the case and some of the issues the decision turned on. Part 2 examined the involvement of CardFlex, one of the ISOs charged by the FTC of aiding Johnson in his alleged fraud. Part 3 looked at credit card laundering, one of the crimes Johnson was charged with. The last installment describes what a company can expect when it runs afoul of the FTC.

Anatomy of an FTC Action

Most payment processors understand that certain classes of high-risk merchants are popular targets for scrutiny by the FTC and other regulatory authorities. Trial, free-to-pay conversions, recurring billing, onerous return policies, paid testimonials and unsubstantiated advertising claims are just a few of the most common sins that will land a merchant squarely in FTC’s crosshairs. In such cases, the agency will not hesitate to look past the merchant to every entity in the payment chain it deems knowingly or recklessly facilitated the merchant’s access to the payments system in the face of such red flags, or in violation of its own underwriting policies. One need only consider the FTC’s prosecution of Jeremy Johnson and the associated ISOs and sales agents that boarded his straw merchant accounts, or the commission’s more recent pursuit of CardReady in connection with its alleged role for helping to launder credit card transactions in connection with a massive debt relief scam.

Nonetheless, many banks and processors have no idea what an FTC lawsuit looks like until the merchant gets sued and the operating account and merchant reserves are already frozen. So, rather than leaving you to learn the hard way by experience, we offer you this brief primer on the anatomy of an FTC lawsuit.

Civil Investigative Demand

If the FTC has a standard playbook, it usually begins with serving a court-ordered subpoena, known as a Civil Investigative Demand (“CID”), on the acquirer, processor, ISO and even the sales agents. The CID typically demands production of the underwriting file and complete transaction processing history of the merchant(s) or individual(s) under investigation, and generally requires the subpoenaed party to refrain from disclosing the existence of the investigation to the merchant. In addition to furthering its investigation into the subject merchant, the FTC also carefully evaluates whether such materials suggest any wrongdoing by those in the processing chain, such as falsifying merchant applications, circumventing underwriting requirements, setting up multiple MIDs for load-balancing or otherwise helping the merchant to set up straw merchant accounts to factor the merchant’s transactions.

Indeed, the suit against Jeremy Johnson was pending for more than three-and-a-half years before the FTC finally filed a separate suit against the ISOs and sale agents allegedly responsible for knowingly boarding his merchant accounts in violation of their own underwriting policies.

Temporary Restraining Order and Asset Freeze

The agency’s next move usually is to file a civil complaint against the merchant for violations of Section 5 of the FTC Act, which prohibits “unfair or deceptive acts or practices in or affecting commerce.” Typically, the complaint is filed under seal along with an ex parte application for a temporary restraining order (TRO) imposing an asset freeze on all merchant funds. Such papers are filed under seal to prevent the merchant and its principals from diverting or dissipating funds in anticipation of a lawsuit, which means that the merchant has no real chance to defend itself against the TRO. Moreover, the parties processing for the merchant generally have no prior notice of the government action unless previously served with a CID.

The asset freeze typically extends to all third parties in possession or control of funds attributable to the merchant or its principals, including all banks and payment facilitators. While the acquirer and ISO may attempt to argue otherwise, reserve funds are also subject to the asset freeze. Most TROs also appoint a temporary receiver to take control of the merchant’s business and all frozen funds to prevent further consumer fraud, and ensure that such funds are preserved for the purposes of consumer redress (discussed below).

Preliminary Injunction

Once the merchant has been served and its assets frozen, the Court unseals the complaint and the action becomes public. Indeed, often it is publicly touted via press release on the FTC Website alerting consumers to the alleged scam or scheme at issue. The agency then moves for an order of preliminary injunction, prohibiting the merchant from engaging in the challenged conduct, maintaining the asset freeze, and confirming the receiver’s power and authority to control the merchant’s business and funds pending resolution of the action. In order to prevail on a preliminary injunction motion, the FTC must meet a four-part test by proving: (1) a likelihood of success on the merits; (2) a likelihood of irreparable harm in the absence of preliminary relief; (3) that the balance of equities tips in favor of a preliminary injunction; and (4) that an injunction is in the public interest.

To defeat such a motion, the merchant must convince the Court of the FTC’s inability to prove any of these four elements. For example, the merchant may present evidence tending to prove that it did not deceive consumers or engage in unfair business practices; or that the balance of equities weighs against preliminary relief because the merchant has already stopped the challenged business practice and is otherwise engaging in a lawful business with numerous employees that would lose their jobs if the injunction issued. Yet, it is ultimately up to the Court to decide these questions within its own discretion.

Stipulated Permanent Injunction

If the FTC prevails on the preliminary injunction motion, it usually signals a death knell for the merchant because the merchant is often left with no funds to pay its lawyers to defend the action, and, as we all know, lawyers rarely work for free. Thus, at that point, the merchant and its principals often settle the action by stipulating to a permanent injunction banning them for life from engaging in the challenged conduct, requiring them to pay a substantial monetary judgment and requiring them to file annual reports with FTC regarding their future business activities for a period of at least ten years.

On the other hand, if the merchant successfully defeats the motion (in whole or in part) and gains access to sufficient funds or if it has access to friends and family funds, to pay its lawyers to defend against the action, it thereby gains a significant bargaining chip with respect to the ultimate outcome. While most merchants who prevail at this stage still end up stipulating to a permanent injunction in order to settle the action, they may gain tactical leverage by their ability to continue the fight, and thus may find themselves in a far better position to negotiate more favorable settlement terms, such as a more narrowly tailored ban (whether in regard to the scope of the prohibited conduct or the duration of the ban), or a lesser monetary judgment.

Consumer Redress

So what happens to the frozen funds after they are turned over to the receiver? Pursuant to section 13(b) of the FTC Act, the Commission may seek monetary consumer redress only on a strictly equitable basis. This means that the FTC may seek monetary consumer redress in only one of two forms: equitable restitution or disgorgement of a defendant’s ill-gotten gains. Equitable restitution is money or property in the defendant’s possession that is identified as belonging in good conscience to injured consumers and is intended to make them whole. It often is unavailable as a remedy, however, because the defendant has already dissipated or commingled the funds with other assets prior to the action being filed. Thus, in most cases, the FTC must pursue disgorgement of a defendant’s ill-gotten gains as the only available monetary remedy. Notably, the primary purpose of disgorgement is not to compensate the victims of the deceptive advertising, but to deprive the wrongdoer of his ill-gotten gains. Disgorgement is normally measured by the amount of ill-gotten revenues connected to the defendant’s wrongful conduct. Not surprisingly, that inevitably includes all of the gross proceeds of the merchant’s illegal processing activity.

Looking Past the Merchant

As mentioned, the FTC and the receiver invariably will take the position that merchant reserves are proceeds of the merchant’s illegal activities (subject to the asset freeze) and will ultimately seek a transfer order moving the funds into the receiver’s possession. Thus, upon being served with the TRO, the acquirer and ISO must make a strategic decision about whether (and to what extent) to oppose the FTC’s efforts. Where the acquirer has contractual indemnity from the ISO for chargebacks and merchant-related losses, the acquirer will often be loath to join the fray and will instead simply look to the ISO to make it whole.

For this same reason, the ISO may feel it has a strong incentive to challenge the scope of the asset freeze and attempt to obtain a carve-out for the merchant reserves to cover chargebacks and other merchant-related losses. However, by doing so, it may also incur FTC’s ire and invite further scrutiny regarding its business activities. This presents an especially tricky problem for those that may have failed to satisfy applicable underwriting standards in regard to a merchant because they may increase their chances of being added as defendants to the action, or even having a separate action filed against them by FTC. Again, in the case of Jeremy Johnson, FTC waited more than three and a half years after filing suit against him to file suit against the ISOs and sales agents that allegedly boarded him in violation of their own underwriting standards. Whether an ISO has a good argument to carve-out reserves from the asset freeze depends in no small part on the merchant agreement, and most merchant agreements are decidedly not well-drafted in this regard.

Thus, if you are transacting in the high-risk CNP space or providing processing for such merchants, you are well advised to choose your merchants carefully, and put your ducks in a row before the FTC comes knocking.