What happened
The FTC announced a proposed order settling allegations that payment processor Humboldt Merchant Services opened accounts for merchants it knew, or deliberately avoided knowing, were shell companies used by fraudsters. Humboldt will pay $12 million for consumer redress and is permanently barred from processing payments for several categories of high-risk merchants.
According to the complaint, the company processed payments for more than 1,000 merchants that were fronts or pass-throughs for businesses running unauthorized billing scams, including Legion Media, which the FTC shut down in 2024. The complaint says the accounts were opened despite red flags and that chargebacks on them ran at close to ten times the rate card networks treat as excessive. The FTC also alleges Humboldt moved those accounts onto a lower-risk bank identification number used by an affiliated entity to improve the odds that attempted transactions would be approved.
Katherine White, deputy director of the FTC's Bureau of Consumer Protection, said Humboldt "was processing payments for companies despite red flags indicating they were scamming consumers." The order also bans credit card laundering and the use of false or misleading information to obtain payment processing. Banned merchant categories include straw companies, merchants on the Mastercard high-risk MATCH list for reasons such as excessive chargebacks, laundering or fraud, merchants already subject to law enforcement action, and e-commerce merchants using third-party mailbox providers as their only business location.
Why this is a GRC story
This is a third-party risk case with a settlement attached. Processors sit directly in the risk chain for their merchant clients, and "knowingly or consciously avoided knowing" is the standard that turns an oversight gap into an enforcement action. Willful blindness is not a defence, and an onboarding process that never asks hard questions about a customer's chargeback profile is itself the finding.
The numbers in the complaint read like a monitoring failure. Chargeback rates near ten times the industry threshold should have triggered escalation long before an outside regulator got involved. Routing high-risk accounts through a friendly bank identification number looks less like a control and more like a control being used to hide a problem.
For any company onboarding merchants, vendors or channel partners, the practical lesson is that red flags which are documented and then ignored are worse than no documented review at all.
What to watch
Watch whether the FTC pursues the people behind the merchant shells and whether card networks tighten their own onboarding standards in response. Enforcement against processors tends to move the risk appetite of the whole industry.
Watch also how "high-risk merchant" gets defined in practice. The four banned categories are specific enough to translate into screening rules a processor can actually apply.
Attribution: Analysis based on the FTC press release and related public reporting. This article is original commentary, not a repost of the source material.