A Rogue First Data ISO Will Cost Fiserv $40 Million in a Proposed Settlement With the FTC

Fiserv Inc. and the former head of an independent sales organization will pay $40.2 million to settle charges brought by the Federal Trade Commission stemming from alleged illegal actions committed by the ISO from 2012 to 2014 while it obtained processing services from First Data Merchant Services, whose parent company Fiserv acquired last year.

The ISO, First Pay Solutions LLC, headed by Chi “Vincent” Ko, allegedly facilitated payment services for merchants involved in scams ranging from a debt-relief program sold through deceptive telemarketing to peddling business opportunities thorough deceptive Web sites to using stolen credit card data to bill consumers without their consent, according to an FTC complaint filed Tuesday in U.S. District Court for the Southern District of New York. 

“At one point, FPS’s merchants accrued over 300,000 chargebacks in less than one year, representing approximately 40% of First Data’s excessive chargeback violations for its entire wholesale merchant business,” the complaint says.

Ko’s attorney, however, cast the blame on “bad actors”—independent agents who allegedly created unlawful Web sites, registered shell companies, and generated fake invoices and shipping labels to avoid detection by First Pay and First Data. “Mr. Ko unequivocally denies prior knowledge that these agents and merchants were engaged in fraud,” Jim Walden, managing partner of Walden Macht & Haran in New York City, said in a statement.

The complaint alleges First Data Merchant Services, a major part of parent company First Data Corp., knew or should have known what FPS and Ko were up to. They reportedly opened hundreds of merchants accounts in the names of phony entities and shell corporations and provided sponsor bank Wells Fargo Bank with false or deceptive information to open the accounts. Wells ended its relationship with FPS in late 2014. 

According to the FTC, a 2014 investigation by Visa Inc. required First Data to repay $18.7 million in charges processed by Ko and temporarily banned First Data from signing high-risk merchants. “A 2015 forensic audit conducted as part of Visa’s investigation indicated that First Data had ‘no controls’ on how the company managed high-risk merchants,” an FTC news release says.

“First Data is paying $40 million because it repeatedly looked the other way while its payment-processing services were being used to commit fraud,” Daniel Kaufman, deputy director of the FTC’s Bureau of Consumer Protection, said in the release. “When companies fail to screen out fraudsters exploiting the payment-processing system to steal people’s money, they’re breaking the law—and injuring consumers.”

In its own news release Tuesday, Brookfield, Wis.-based Fiserv said the case “relates to isolated business practices by a single U.S.-based wholesale independent sales organization (ISO), its merchants, and affiliates of the ISO that referred merchants to the ISO.” The settlement “is in the best interest of First Data Merchant Services, our clients and their customers, and consumers,” the release says.

“We remain committed to ensuring that our business partners and merchants operate with integrity, and our enhanced practices will enable us to continue to lead the industry in fraud prevention, and business and consumer protection,”

The settlement funds will be used to compensate consumers harmed by the scams. In addition, the FTC will require First Data to screen and monitor certain high-risk merchant clients, implement an oversight program to monitor its wholesale ISOs, and hire an independent assessor to oversee the company’s compliance with the settlement’s oversight program for the next three years.

Fiserv said it had already implemented some of the measures before the settlement and “has increased its investments in areas that improve detection of attempted fraud on its platforms, underwriting requirements, activity reviews and fraud alert protocols.”

Ko was hired as an executive at First Data in 2017, according to the FTC. He is to pay $270,374 under the proposed settlement, which also will ban him from processing payments for certain types of high-risk merchants and impose other conditions. Ko is no longer an employee of Fiserv, a company spokesperson says.

Ko built his business by providing payment processing to traditionally underserved Asian merchants, according to Walden. “First Pay’s risk department ultimately failed to effectively screen out deceptive merchant applications submitted by a small set of fraudulent sales agents,” Walden said. “That failure caused substantial financial harm to both First Pay and Mr. Ko, who agreed to turn over his entire $100 million First Pay portfolio to First Data in 2014 so that the income could be used to repay consumers harmed by the dishonest activities of these fraudulent agents and merchants.”