CBSurety touted itself as a Chargeback Fraud Protection Company, but they were anything but that.

The Justice Department accuses them of running a sham of an operation, processing payments for high-risk merchants, and then burying the evidence of that fraud with thousands of tiny legitimate transactions. They filed a civil case against the company to stop them from operating the scheme.

Instead of helping merchants prevent fraud, they allegedly just helped disguise the fraud from the banks.

Don’t bother going to the site. CB Surety has taken it down and all the other sites in their network. You’ll have to go to internet archives to see what all these sites looked like if you are curious.

The Company Was Founded in 2017 For Chargeback Fraud Protection

CB Surety was founded in 2017, and the DOJ alleges that two people, Thomas Eide and Travis Smith, organized the scheme.

The company claimed to be the nation’s “Most Comprehensive Chargeback Fraud Protection Company,” helping merchants avoid chargebacks with “AI.”

Keeping your merchant bank happy was their motto.

The company’s location on their website (since taken down) indicates they operated out of a small house in San Mateo, California.

Perhaps the company had good intentions when it started, but as time progressed, the DOJ claimed it masterminded a heavy-duty transnational fraud ring designed to make money off illegal and high-risk websites.

What CB Surety Became – A Network Of Sham Companies and Websites

As most good fraud schemes do, they can get quite complicated. And that is the whole point of money laundering and crime – creating layers so the organizers are shielded from the actual fraud.

The alleged scheme was designed so illegal or high-risk merchants (which often can be those running scams, selling drugs, and other crimes) could do business online and take customer payments.

It went something like this ?

• CB Surety organized a scheme to process payments for high-risk merchants
• Motion Marketing would recruit and onboard those high-risk merchants
• Reseller Consultants would recruit straw owners as a front for fake merchants
• Think Processing would hide the fraud of the high-risk merchants with the fake merchants created

This is how the DOJ says the scheme worked:

CB Surety Did Business With Bad Guys And Helped Keep Chargebacks Low

CB Surety’s claims to “Keep The Bank” happy were actually what they did. But not in the way you would expect.

According to the DOJ, CB Surety’s network would seek out high-risk merchants, sign them up, and then “keep the bank” happy through a series of deceptions.

It was a simple business model that generated millions

• Sign up lots of high-risk merchants.
• Disguise their activity through fake low-risk merchant sites.
• Extend the fraud by processing microtransactions designed to keep chargeback rates low.

The Sham Websites They Setup Acted As A Good Front For Fraud

For CBSurety’s scheme to work, it required legitimate-looking merchants that would not arouse suspicion. For that, they reportedly turned to straw owners. Straw owners would agree to act as “owners” of e-commerce websites.

Those websites sold nothing, however, and were reportedly a sham. One website they used was called TiannyBikeHelmets.com. To the untrained eye, or even the trained one, it looks genuine, selling specialty bike helmets.

But instead of processing payments for bike helmet orders, that account was allegedly processing orders for illicit merchants – like gambling websites.

This was just one of many websites, most now deleted from the internet. But the Wayback Time Machine captures others like this one – AasherDecor.com. This was another sham website run by a straw owner.

Burying The Fraud With Microtransactions

One of the ways that CB Surety and affiliates kept the chargeback rate low was by burying the fraudulent transactions with tons of microtransactions so that they wouldn’t trigger suspicion at Visa and Mastercard.

Visa Fraud Monitoring Program and Mastercard Dispute Monitoring Program monitor the rate of chargebacks relative to a merchant’s total volume.

Whenever a merchant exceeds a chargeback rate of 1%, they are entered into the card brand’s monitoring program to not only be subject to high fines but also additional scrutiny by the merchant processor.

If the merchant is found to be fraudulent and/or charge cards without cardholder knowledge they can be terminated and blacklisted.

By submitting tons of microtransactions, CBSurety and affiliates were able to bury the fraud by inflating the “denominator” (# of monthly sales) for high-risk merchants allowing them to skirt these monitoring programs.

An Elavon Fraud Analyst Became Suspicious And Pressed For Answers

Fraud analysts are often the first to unravel major fraud schemes, according to the complaint filed by the Department of Justice, and one fraud analyst working for Elavon raised a red flag.

Based on suspicious transaction activity, the fraud analyst from Elavon emailed the straw owner’s email address, [email protected], telling them they were under review.

The fraud analyst asked where Tianny Bike Helmets’ inventory was stored for a photo of the inventory, a receipt showing the business name and address, and a bill with the business name and address. In response, [email protected] claimed that Tianny Bike Helmets could not provide any photos because it was an e-commerce business and did not have access to its inventory.

But they did provide an invoice for $50 for a “synthe pad helmet” as proof they were processing legitimate transactions. Investigators from the DOJ matched that $50 charge and found out it was actually for a payment to an offshore casino run by Palau Holdings. The payment was not for a helmet but an illicit gambling charge.

Esquire Bank Detected The Scheme, Shutting Down 97 Accounts

As fraud schemes do, they eventually unravel, revealing the shocking scale of the fraud.

And Esquire Bank was one of those companies that caught on to the shenanigans after reviewing merchant reports for excessive declines and reported fraud.

Esquire Bank found two merchant accounts they determined to be sham companies. Doing some link analysis, they found an additional 59 merchant accounts linked to those two merchants. And later, they detected another 38 accounts.

This set off a domino effect, and other banks started shutting down connected merchant accounts too.

The Shady Way CBSurety Buried The Fraud Transactions

Keeping the “bank happy” meant CB Surety and affliliates needed to keep the chargeback rates for their sham merchants low. So allegedly, CBSurety through their affiliates used prepaid debit cards to create sham “microtransactions”. These sham microtransactions would be fake transactions that would never get charged back.

The merchant, in these cases, would take their own money, fund prepaid debit cards, and then process thousands of sham debit card transactions, which would return the money to themselves while at the same time ensuring they had lots of “good volume” to keep chargeback rates low.

The Damage Done By The Scheme Cannot Be Underestimated

The damage cannot be underestimated. The Justice Department says that it involved millions in payments that ultimately hurt consumers.

Between July 2020 and June 2023, through transaction laundering, they processed approximately $97 million in payments for their merchant clients, thereby causing losses to consumers, and fraudulently causing federally insured banks to risk substantial losses.

CB Surety Is Not The Only Company The Justice Department is Going After

The DOJ announced a crackdown against this fraudulent behavior this week, and CBSurety was not the only company in the crosshairs.

A company named Altitude Processing was also named doing precisely the same thing. Their indictment has not been unsealed but you can imagine it might be soon.

Altitude Processing used sham companies to cover their tracks and make the unauthorized charges appear legitimate.

The company appears to have a lot of consumers out there who have been scammed from ACH transactions posted as checks to their bank accounts.

Fraud Experts Say Gaming Chargeback Rates Is Not An Isolated Problem

According to chargeback experts, there have long been rumors of other chargeback management companies involved in similar activity; “playing the numbers game” to over-inflate their merchants’ accounts with low-dollar microtransactions (often on prepaid credit cards).

This is done to dilute the “numerator” of the equation to identify merchants with a chargeback threshold of over .9% (for Visa) or 1% (for MasterCard).

Do Your Due Diligence With Chargeback Management Companies

Karisse Hendrik, Founder of Chargeback consultancy “Chargelytics” and the host of the Fraudology podcast says due diligence is more critical than ever.

“It’s important to note that not ALL chargeback management companies use schemes like these”, she says “Merchants that are looking to do business with a chargeback company that plays by the rules should do their due diligence. They should ask how the company will help them if their monthly chargeback ratio exceeds the acceptable ratios at the associations.”

Getting wrapped up in fraud schemes or taking bad advice from unscrupulous players can hit a merchant pretty hard evidently.

“If your company ends up being associated with this kind of activity,” says Hendrick, “there could be unexpected consequences that could be detrimental to your business.”

The Right Way To Keep Chargeback Rates Low And Keep Your Bank Happy

There is a always a right way, and a wrong way to do things. According to Hendrick, if you want to truly keep the banks happy do it the right way.

“The best ways to ensure that online companies stay under the thresholds is to reduce unauthorized transactions (on stolen cards and/or charges the cardholder didn’t approve) and increase customer service like ensuring the customer knows what they’re purchasing, when it will arrive, and what business will be on their credit card statement.” says Hendrick

And there are companies spending billions to do just that. In a complaint filed against by Amazon against “REKK” last week, Amazon disclosed that they spent over $1.5 Billion and employed over 15,000 employees to identify fraud & theft in all ways across their websites, warehouses, and stores internationally. A large chunk of that undoubtedly is dedicated to preventing payment fraud and other chargeback related issues.

Read The Whole Complaint Here

This complaint was just unsealed last week, so you can read it all right here if you want to get into the nitty-gritty details.

Keep in mind this is a civil case against the defendants, not criminal at this point.