The Federal Trade Commission has settled with a payment processor and four affiliated entities over allegations that the companies knowingly enabled deceptive merchants, including foreign tech-support operations, to access the U.S. card-payment system. Beyond the $4.85 million monetary judgment, the case is notable for an accompanying Joint Statement from Chairman Andrew Ferguson and Commissioner Mark Meador articulating a knowledge standard — including actual knowledge, constructive knowledge, and conscious avoidance — for unfair payment-processing claims under Section 5.
Background
Most merchants cannot accept credit or debit cards without support from payment providers that connect them to acquiring banks and card networks. Depending on the model, processors, acquirers, payment facilitators, and other intermediaries may perform or support merchant underwriting, screening against merchant-risk databases, and ongoing monitoring for chargebacks, fraud, and other warning signs. Because these providers may influence merchants’ access to the debit- and credit-card ecosystem, the FTC views them as well-positioned to identify and address merchant misconduct.
The Commission has pursued payment processors for facilitating merchant fraud for more than two decades, and this case continues that trend. In the Commission’s press release, Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said the “action underscores the Commission’s commitment to ensuring that our payments system operates free of fraud.” He added that consumers deserve a payment system that is “competitive, transparent and fortified against fraud” and that the Commission “will take action anytime those standards are threatened.”
Allegations
The FTC’s complaint alleged that the payment processor engaged in unfair payment-processing practices under Section 5(a) of the FTC Act and assisted and facilitated deceptive telemarketing in violation of the Telemarketing Sales Rule (TSR).
The allegations focused primarily on the payment processor’s relationship with Reimage, which also operated as Restoro — an offshore tech-support operation against which the FTC previously took action. According to the FTC, Reimage used fake virus pop-ups that appeared to come from a major technology company, bogus diagnostic scans, and scare tactics to sell “repair” software, then upsold consumers — disproportionately older adults — on telephone-based tech support from call centers in the Philippines and India.
According to the complaint, the payment processor did more than passively process Reimage’s transactions:
- Allegedly ignored its own policies. The payment processor’s written onboarding rules prohibited working with merchants that sold anti-virus software through inaccurate advertisements, were flagged by card brands for deceptive practices, had excessive chargeback or fraud histories, or masked their beneficial ownership. The FTC alleged that the processor onboarded Reimage despite these policies.
- Allegedly masked chargebacks through load balancing. The FTC alleged that the payment processor opened numerous merchant accounts for Reimage and spread the transactions — including alleged chargebacks from deceived consumers — across them, keeping any single account below the card networks’ fraud-monitoring thresholds.
- Allegedly disguised the merchant. The FTC alleged that the payment processor submitted applications containing false information, including nominee directors, fake European business locations, and misleading business descriptions, and processed Reimage’s charges through merchant-of-record (MoR) accounts that did not actually sell Reimage’s products.
- Allegedly kept processing transactions following a card network warning. In early 2020, a card network warned the payment processor that Reimage was allegedly impersonating a major technology company and luring consumers to offshore call centers, and imposed a fine. The FTC alleged the processor then increased its processing for Reimage and began running recurring charges.
The FTC alleged that the payment processor processed more than $30 million in consumer payments for Reimage between 2017 and 2023, and that the processing relationship ended only after Reimage learned of the FTC’s investigation into its practices.
Reimage was not alone: the FTC alleged that the payment processor also served other deceptive tech-support merchants, business-opportunity schemes making baseless earnings claims, tax-authority impersonators, and merchants previously terminated for cause elsewhere.
Settlement
Under the stipulated order entered by the U.S. District Court for the District of Arizona on Sept. 9, 2026, which states that the defendants neither admit nor deny the complaint’s allegations except as specified, the defendants must pay a $4.85 million monetary judgment for consumer redress and comply with extensive injunctive requirements. The order provides for:
- A $4.85 million monetary judgment, entered jointly and severally against all defendants, that the FTC states will be used for consumer redress.
- Specified processing bans covering merchants selling technical-support products or services through telemarketing or security/performance pop-ups, and merchants the payment processor knows or has reason to know are on merchant risk databases for specified reasons, including excessive chargebacks, fraud, laundering, or related grounds.
- A prohibition on evasion tactics — no false statements to obtain merchant accounts, and no load balancing, shell-company applications, transaction splitting, microtransactions, or “prevented chargeback” schemes designed to defeat fraud-monitoring programs.
- Mandatory screening and ongoing monitoring of “covered clients” — a broad category capturing outbound telemarketers and merchants in tech support, computer software, business opportunities, business coaching, negative-option, healthcare-related, and debt-relief lines, as well as any merchant named in an FTC, federal, or state enforcement action in the past decade.
- Standard fencing-in relief — customer-information protections, compliance reporting, and 10-year recordkeeping.
The injunctive terms prescribe a detailed underwriting and monitoring program and make violations of those requirements enforceable through contempt proceedings.
Key Development: Knowledge Standard
The most consequential aspect of the settlement may be the knowledge standard that Chairman Ferguson and Commissioner Meador articulated for unfair payment-processing claims.
In their Joint Statement, Chairman Ferguson and Commissioner Meador articulated the Commission’s current enforcement position on the FTC’s unfairness authority in payment-processing cases: in the Commissioners’ view, an unfair-payment-processing claim under Section 5 requires the FTC to plead and ultimately prove that the processor knew, should have known, or consciously avoided knowing that a merchant was engaged in unfair, deceptive, or otherwise unlawful conduct.
Although prior FTC cases relied on evidence of processor knowledge, the Commission had not previously identified knowledge as a necessary element of this type of claim. The Joint Statement signals the Commission’s current enforcement position and identifies the burden the FTC would undertake in such a case, although the statement is not a Commission rule or adjudicated holding and does not itself have independent legal force.
The Commissioners explained that, in their view, the knowledge requirement follows from Section 5’s unfairness framework and distinguishes good-faith processors from those that knowingly facilitate, ignore, or consciously avoid learning of merchant misconduct. The standard may reduce the risk that a processor will face liability based solely on a merchant’s fraud where the processor maintained and followed reasonable underwriting and monitoring procedures and lacked reason to know of the misconduct. At the same time, constructive knowledge and conscious avoidance remain available to demonstrate that the processor “should have known” about a problem and thereby prevent a processor from relying solely on the absence of direct proof that it actually knew what the merchant was doing.
Practical Takeaways
Although the order binds only the named defendants, payment processors, payment facilitators, ISOs, marketplaces, banking-as-a-service providers, and other intermediaries touching higher-risk merchant flows may wish to treat it as a useful benchmark for the compliance measures the FTC may expect in higher-risk processing relationships. Some considerations include:
- Aligning written policies and actual practices. Departures from written onboarding rules or prohibited-merchant policies — particularly after personnel identify merchant-specific warning signs — may support an inference of actual knowledge, constructive knowledge, or conscious avoidance. Companies should consider reconciling written policies with actual decisions.
- Underwriting and monitoring higher-risk clients with rigor. For higher-risk clients — such as those in technology support, software, business opportunities, coaching, negative-option programs, health-related products and services, and debt relief, as well as any client selling through outbound telemarketing or with a recent FTC or state enforcement history, among other elevated-risk verticals — consider incorporating the order’s specific measures, including reviewing independent online sources, complaint monitoring, test calls, and chargeback-investigation triggers, into risk-based procedures.
- Treating chargeback masking as a critical red flag. The order prohibits the named defendants from using load balancing, transaction splitting, shell-company applications, and “prevented chargeback” services as evasion tactics, regardless of whether headline chargeback metrics remain below network thresholds. Companies may wish to prohibit and audit for them.
- Avoiding overreliance on low chargeback rates. Low or manipulated chargeback metrics do not necessarily negate knowledge. Consider investigating qualitative warning signs, including consumer complaints, network alerts, and merchant marketing.
- Taking network warnings seriously and documenting the response. Fraud notices from card networks may be powerful evidence on the “should have known” question. Businesses may wish to escalate the warning, investigate it, reassess the relationship, and preserve the record of the resulting decision.
- Scrutinizing opaque ownership and merchant-of-record structures. Consider verifying beneficial ownership and the identity of the actual merchant behind any reseller or MoR relationship.
The articulated knowledge standard is a meaningful limit on payment-processor liability, but it does not protect intermediaries that disregard warning signs or fail to investigate them. The practical question may be whether a processor can show that its underwriting and monitoring program was reasonably designed, followed in practice, and responsive to merchant-specific risks. For payment companies, documented and genuinely implemented diligence — not low reported chargeback rates alone — may be critical to rebutting an inference of knowledge or conscious avoidance; documentation alone may not overcome evidence of actual knowledge.