Merchant Sales Podcast · 2026-08-07 · 37 min
Key moments - from our scoring
Substance score
68 / 100
Five dimensions, 20 points each
Alan Koppelman discusses the escalating problem of AI-enabled identity theft targeting merchants and business owners. Scammers now use AI to generate fake websites, manipulate documents (bank statements, merchant statements), create fraudulent LLCs with real federal tax IDs, and steal Google Business profiles - all within days for just a few hundred dollars. By obtaining victims' credit reports from the dark web, they can answer verification questions posed by underwriters. The fraud schemes range from classic bust-outs (accepting payments under fake business names then disappearing) to setting up merchant accounts under stolen identities, leaving innocent people on the MATCH list for 5-6 years. Koppelman shares specific case studies: a dentist whose identity was used to open a restaurant supply merchant account, resulting in $110,000+ in damages; a retail store owner who discovered fraudulent Capital One credit cards opened in their name. He emphasizes the exponential increase in weekly calls from victims compared to the historical 2-3 annual cases. The episode provides actionable prevention strategies for agents and merchants - credit monitoring, claiming Google/Yelp profiles, rigorous document verification - and recovery steps including filing fraud reports with the FTC and working with banks to remove MATCH list entries.
The MATCH list is a database that blocks merchants from processing credit cards for 5-6 years. When a scammer opens a fraudulent merchant account using a stolen identity and that account is shut down for fraud, the processor reports it to the MATCH list under the victim's name and SSN, placing the innocent person on the list.
Scammers use AI to generate professional websites in 30 minutes, manipulate bank and merchant statements using tools like CorelDraw or GitHub, create real LLCs with federal tax IDs (costing a few hundred dollars), generate fake driver's licenses, steal Google Business profiles, and use dark web credit reports to answer verification questions during account setup.
Monitor your credit actively using Credit Karma or your bank's service, claim your Google Business and Yelp profiles to prevent theft, check your credit reports every 2 weeks, watch for mail from unknown processors, and request alerts when credit is pulled. Agents should require driver's licenses and 3 months of bank or merchant statements before submitting applications.
Yes, if you can prove your identity was stolen, you can typically get removed from the MATCH list about 99% of the time. This requires filing reports with the FTC and police, submitting that documentation to your processor and bank, and may take 2+ weeks to restore processing access.
The most common are identity theft (opening accounts under stolen identities), bust-outs (accepting legitimate-looking payments then closing the account and disappearing), selling illegal products while hiding them on masked websites, and stealing established business profiles to route customer payments to fraudulent accounts.
Our reviewer’s read on each dimension, with quotes from the episode.
The episode contains substantial, actionable insights about identity theft scams targeting merchant accounts - a timely and concrete problem. Koppelman provides specific tactics (AI-generated documents, fake corporations, stolen Google profiles, fake driver's licenses checked against Claude/ChatGPT) and concrete remedies (credit monitoring, claiming Google/Yelp profiles, document verification before application submission). However, the conversation includes significant filler: lengthy nostalgic tangents about baud rates, terminal downloads, and ethernet cables (4+ minutes) that add little value to a B2B operator trying to solve this problem. The episode also repeats points and lacks depth on some claims (e.g.,
I would venture the game that 90% of these scammers are not in the U.S
they steal somebody's identity... they're after your credit report
The episode addresses AI-enabled identity theft in merchant account fraud, which is timely and relevant. However, the core insights are largely descriptive rather than contrarian or first-principles: the remedies (credit monitoring, verifying documents, filing FTC reports) are standard practice. The episode lacks original frameworks, business model analysis, or counterintuitive arguments. Most claims are common-sense extensions of existing fraud prevention wisdom. The anecdotes are illustrative but not novel.
because they have AI and all your info is up on the dark web... these scammers have gotten smart... they can really complete a scam for a few hundred bucks
you can just go on and make an AI website in ah, like 30 minutes
Alan Koppelman is the CEO and 25-year veteran of Nationwide Payment Systems with direct operating experience processing merchant accounts and handling fraud at scale. He has seen this problem materialize in real-time (from 2-3 identity theft cases per year to multiple per week) and has hands-on experience reviewing fraudulent documents, working with banks on exceptions, and advising merchants post-incident. His background in the restaurant industry before payments also informed his due diligence skills. This is a genuine practitioner, not a thought leader or consultant speaking theoretically.
started Nationwide Payment Systems back in 2001... 25 years
we had a scammer and we had to fig they got through... it took me quite a while to figure it out, but I did figure it out
The episode includes concrete examples: a dentist's identity stolen, $50k and $60k losses on two processors, a $3M bust-out, a $12k Stripe fee scenario, stolen Google profiles, fake entities created for $200-couple hundred bucks, federal tax IDs obtained for free, Mercury and other online banks used, fake CLOVERs mailed, Velocity filters set to stop thousands of transactions, Capital One credit card fraud, and match list status lasting 5-6 years. However, some claims lack specifics: the "90% of scammers are not U.S." estimate is unsourced, the extent of the AI-document manipulation techniques is mentioned but not deeply detailed, and no specific data on overall loss volumes or breach volumes is provided.
I saw a merchant one time, they got hit with a hundred thousand transactions that to pay authorized net $0.10, Visa... Tesis $0.10
I got an application in, then I googled the name of the business and I found the actual real website for the business, not the fake website that the scammer made
The host asks clarifying follow-ups and does some light probing (asking Koppelman to define the match list, asking for specifics on prevention and recovery steps). However, the questioning is often soft and reactive rather than challenging. The host doesn't push back on vague claims (e.g., "90% of scammers are not U.S."), doesn't dig into the root causes of why banks are vulnerable, and doesn't ask difficult questions about systemic incentives or gaps in bank KYC procedures. The host also allows the conversation to drift into lengthy nostalgic tangents without steering back to substance. The interview feels more like an extended friendly conversation than a rigorous interrogation of a complex problem.
So let's talk about the match list. What is the. What is the match list?
what are some of the steps that both agents and, you know, merchants, uh, could be taking today to say? This sounds really terrible. I don't want this to happen to me
Computed from the transcript - who did the talking, and the words that came up most.
In this episode, James Shepherd sits down with Allen Kopelman, CEO and co-founder of Nationwide Payment Systems, for an in-depth look at the rapidly growing threat of identity theft and merchant fraud - and how AI is making these scams more sophisticated. Allen explains how scammers are using stolen identities, manipulated documents, fake websites, and business profiles to open merchant accounts and execute massive bust-outs, often leaving innocent business owners on the MATCH list for fraud they never committed. James and Allen also discuss the warning signs agents should look for when evaluating internet leads, how merchants can protect their identities and online business profiles, and what agents and ISOs can do when a legitimate merchant gets caught up in identity theft. The conversation also covers excessive chargebacks, illegal products, fraud on platforms like Stripe and Shopify, transaction velocity controls, and why agents need to be more vigilant than ever as AI gives fraudsters new tools to exploit vulnerabilities.
Transcribed and scored by The B2B Podcast Index.
Speaker A: Foreign.
Speaker B: Shepherd here with another edition of the Merchant Sales Pod. Everybody. James shepherd here with another edition of the Merchant Sales Podcast. Uh, excited for this episode. I got Alan Koppelman, uh, on here today, and we were talking about some new ways that, uh, scammers are opening up merchant accounts. Now, this is a very interesting episode for you, both as an individual and a business owner yourself, in terms of the ways that people are stealing identity and using that to cause a lot of really big issues and problems. Um, but also very important information on what to do if your merchant gets on the match list as a result of identity theft, how to help your merchants prepare to make sure they don't fall victim to this. This is exploding with AI, So a lot of really interesting things. Don't have a Today in Payments, uh, for you. I'm actually out of town at the time that this is being aired. Um, but I wanted to make sure we had a great interview lined up for you today. Uh, also want to mention our sponsor, Nativia. Um, you can head over to nativia.com ccsalespro to learn what they have going on. Um, also, if you're interested in the Square reseller program, which I've talked about several times, is this is not something from one of my companies. I have nothing to do with that reseller program. Um, but, uh, it's something that Nativia and order out. Uh, we're working on it. So you can head over to ccsalespro.com square, uh, if you want to check that out as well. Again, that's ccsalespro.com square if you want to learn more about that. We also have the YouTube replay. If, uh, you go to YouTube.com ccsalespro scroll through our recent videos, you'll see that Square reseller replay had a lot of people asking about that. So, uh, Alan and his company are not sponsors or consulting clients of mine. Um, just a great interview with another industry expert. Uh, so I think you're going to get a lot of value out of this one. So, with that being said, let's dive into today's interview.
Speaker A: Welcome to the Merchant Sales Podcast.
Speaker B: Hey, everybody. I'm here today with my friend Alan Koppelman, CEO and co founder of Nationwide Payment Systems. How are you doing today, Alan?
Speaker A: Doing great. Thanks for having me on today.
Speaker B: Always a pleasure to have you on. I feel like we tend to cover, uh, a gamut of broad topics, and today is no exception. We're going to be talking about scammers. So let's kind of start Out Alan, with, you know, a really quick intro of, like, what you do, and then talk about how this kind of new AI version of scamming has impacted your business recently. And then we can kind of dig into the details of where that's coming from.
Speaker A: All right, so started Nationwide Payment Systems back in 2001. And, you know, thinking back 25 years, you know, it's kind of funny. Most people were only in the business for a few years. Didn't have to deal with any of the things I had to deal with. Paper applications, copies, yellow, pink, white, green, telephone lines, you know, now we just take a machine, stick it on WI Fi, and we're done. Or we're, you know, selling software.
Speaker B: Right.
Speaker A: And, you know, going door to door was the way you got business. And today it's. It's that plus the Internet, so.
Speaker B: Right. Yeah. Most of our, most of our audience at this point probably doesn't even know what a baud rate is. Alan.
Speaker A: Right.
Speaker B: You know, remember that trying to set that. You got to get that baud rate correct, because if you mess that up, man, you're going to be sitting at the counter for a long time waiting for that Hypercom T7 plus to download, you know?
Speaker A: Yeah. You're asking the merchant, do you have a fax line? Do you need to. I used to carry around all these things in my car, you know.
Speaker B: Yeah.
Speaker A: Telephone wire splitters.
Speaker B: Yep.
Speaker A: You know, do you had to know the code to cut out the call waiting, Right? Yeah.
Speaker B: You know, it's funny, I actually remember Alan the first time, I can't remember who I was with. Might have been North American bank card. I can't remember. But some processor that allowed me for the first time to do the terminal download over an, uh, Ethernet cable, you know, and this like, changed my life. I was just like, wait a second. I thought it probably messed up because it took like five seconds or something. And I was like, oh, uh, it probably didn't work. And then it like, was fine. And I'm like, oh. I mean, I went from like, you know, average 15 minutes to like, you know, 10 seconds. It was crazy.
Speaker A: Oh, yeah, we had that. We. We ended up getting. We had that vera center and the neurot center on a compute and it was great. You would just get the var sheet, plug it all in, boom, boom, boom. Hook up the wire and the terminals downloaded. Not sitting there for. Right. You know, we could get. We got rid of a bunch of phone lines in our office once we had that thing because we didn't need them anymore. So we could download multiple. You know, you would have three, four phone lines in the back to download terminals because it could take 20, 30 minutes.
Speaker B: Oh, it's crazy. Yeah. So many things have changed since then. One of the things that has always been around is scammers and fraudsters. But lately it does seem like kind of an explosion, uh, largely due from, from AI. So talk about that a little bit. What's, what's happening and how is it impacting you guys?
Speaker A: Well, we've got a, we had a scammer and we had to fig they got through. So we had to figure out what is this scammer actually doing and how did they pull the scam off. And I want to tell you, it took me quite a while to figure it out, but I did figure it out. And basically, I got to tell you something. If you're not watching, if you don't have credit reporting right now, get credit reporting. If you're a business owner listening to this or you're an agent or whatever, pay attention to what we're going to about to talk about. But you need to monitor your credit because people, these scammers, because they have AI and all your info is up on the dark web, you know, uh, we all get those emails. Right? Right. Your info has been exposed. But now what's happening is these scammers have gotten smart. And with AI, they can really complete a scam for a few hundred bucks. Yeah.
Speaker B: Ah.
Speaker A: So what they do is they steal somebody's identity. Not only do they steal the identity, they're after your credit report. And the reason they're after your credit report is so that when they get hit with those challenge questions that come up. So if you're doing electronic applications and things like that, sometimes the bank calls the person on the phone and goes, hey, James, uh, where did you live 10 years ago? How much is your car payment? Because they have your credit report, they can answer all those questions. Yeah. And, uh, we have seen merchants get hit with this. So the scammer basically gets that identity, gets the credit report. Now they got to figure out a business, right? Ah. And they will. Literally today I got an application in, then I googled the name of the business and I found the actual real website for the business, not the fake website that the scammer made. And basically they go out, they form a corporation which costs like couple hundred bucks federal tax ID number free. And so now they have a real corp, a real federal tax id. They make a fake driver's license. And let me tell you, we've taken driver's licenses, uploaded them to Claude or Chat GBT and ask it for the metadata on those items. Or are these real? Is there any telltale sign showing this is not real and it'll tell you whether it's a real document or not a real document? We've received fake bank statements, fake merchant statements. They've been manipulated with things on GitHub, um, on, with Chinese AI, with Corel Draw, with all kinds of stuff. But we've seen three people or more get past the questions from um, the underwriters when they do the verification phone call. And you know, they go get a bank account account, they get on Mercury, found one of these online banks where there's not so much checking going on.
Speaker B: Right.
Speaker A: And they uh, and then they go make an AI website, they go find and they steal business. They. I've seen them where they steal a business's Google business profile because I would tell you there's probably a double digit high percentage of businesses that do not claim that profile.
Speaker B: Right, right.
Speaker A: And they steal it because they go make an email address, they say they're the owner, they verify it and then they change the phone number, they change the, the website and now that's their business profile. Right. And um, you know, unless you really spend time checking these Internet leads, I'll tell you, like the last 10 I got, they were all that. Every one of them was a scammer.
Speaker B: And so I think zooming out for a minute for those who maybe aren't quite as familiar with the industry. So what we're talking about here is I want to be able to take a payment. Most likely it's going to be a fraudulent payment. So you know, I think, and Alan, you can add more to this, but I think there's kind of two camps here. One camp would be in addition to setting up, uh, a merchant account under like a fake entity or a, you know, a scam situation, I'm also going to be getting stolen card information and trying to run payments that way. So that's, that's one way. The other way is I'm going to try to run some legitimate transactions of like people who think they're paying me for something real, but actually it's fake. So I'm going to go run ads and say like I'm selling, you know, yachts for $20,000 and uh, you know, they're normally 2 million and you have the deal of a lifetime and you know, I get payments in. It looks like my business is legitimate, but of course it's not. I get those soon as I get my. My first, you know, seven or eight deposits, you know, batches. And then people start filing chargebacks on that. But I'm long gone. I've closed my entity, closed my business bank account, took the money and run. Right? So what is that? Does that kind of summarize? What else are you seeing? What are the other kind of schemes that you're seeing?
Speaker A: Well, they're running, you know, they're running a bus down. So I've seen. But, you know, I'll give you an example. We get an application in one day for a guy, and it says it's a restaurant supply company. So I go to. I call the guy on the phone, the guy. And, uh, the phone call, the guy doesn't really know anything about the restaurant supply business. Of course, it helps that I came from the restaurant before payments. So the guy doesn't understand. And even if you didn't come from that, you're gonna ask questions, oh, you're a wholesaler. What brands do you carry? Right? And then I go look up the address, and it's a dentist office. So I called the dentist office, and the dentist calls me back, and I go, hey, is this the last four of your social? And the guy goes, yeah. And I go, well, I send him all the information. He's like, well, you know, what about. Why don't. He doesn't worry about it. But I get a call back from him about a week and a half later. He's like, I got four Clovers in the mail. He goes, so, what's the scam? I got the machines. And I go, it's simple. The scam is the person got four Clovers. They got sent to you. Now, he got access to that Clover virtual terminal, and they. And the guy caused damage on one processor for 50 grand, another one, 60 grand. I don't know about the other two, because the dentist started getting phone calls going, hey, uh, do you own this restaurant supply? You know, they tracked him down. Yeah. He's like, no, that's not me. And now the guy's on the match list for identity fraud, right? So he got his dentist office shut down.
Speaker B: So let's. So let's talk about the match list. What is the. What is the match list?
Speaker A: So the match list is basically, you're not taking credit cards for five, six years. And the pro. You know, and right now we're seeing the. Literally the most phone calls of people on the match list than I've gotten in the history of 25 years. I mean, it would be two or three people a year.
Speaker B: Right.
Speaker A: One person here, one person there. You know, maybe two or three people with a stolen identity over a year or two. Now it's people with stolen identities every week, oh, my identity was stolen. My merchant account shut off. Can you help me? Well, the answer is yes. You just have to prove your identity was stolen. And if the bank believes you, you know, we can get you a Merchant account probably 99% of the time.
Speaker B: Right.
Speaker A: And what.
Speaker B: What is. What is that? So. So let's back up for a minute. So how does. How does a merchant get on the match list? Like, why does that. What are the things that can cause that to happen?
Speaker A: Oh, well, there's. I wrote a whole blog about. It's 14 different things. I'm not going to remember them all. But in this case, they get on there because the processor who processed the transactions for the dentist reports identity theft on that dentist. Now, they have the guy's address. His business address is matched. He's matched. His socials matched.
Speaker B: Right, right.
Speaker A: You know, he had nothing to do with that corporation. So. But. Right, so in other words, so the
Speaker B: scammer makes it look as though this dentist opened a fraudulent merchant account claiming to be a restaurant supply company. This merchant accepted payments that were fraudulent that, you know, didn't provide whatever service, 100% chargeback. Clearly a fraudulent account. And this is all going back to this guy because the scammer stole his identity and created the merchant account as if they were. They were that person.
Speaker A: Yep. And they're. And they're doing it. You know, sometimes they hit a. You know, sometime it's a business owner. Sometimes it's just an ordinary consumer that's getting scammed, that doesn't even own a business because they're just using that person because they happen to be in the right city where they're scamming a business. Right, right. And I've called people and, you know, track down like, hey, this is a scam. And I see. Can I find the real owner? I called the guy one time. He goes, I know, I know. I have merchant people calling me all day. Somebody committed fraud on my Social Security number. And the guy was all mad. And we had one of our clients who owned two retail stores call us one day like, my POS isn't working. I called the processor like, hey, your guys on the match list. I'm like, what? So I, uh, go check your credit report. And we found out somebody got a hold of this guy's credit, took out a Capital One credit card blew it up. You know, Capital One offers merchant accounts, got a merchant account, blew that up. So he had to call the cops, report it to the ftc. We had to get all the, that, that paperwork, send it to the bank. And it took like another. Took like 2 weeks total to get him turned back on. He was two weeks without credit card processed. Yeah. And I'm hearing these stories on a weekly basis, literally weekly. We're getting inquiries from merchants. Can you help us? This happened. That happened. And I want to tell you. And the other things you can get on the match list for are excessive chargebacks. Right. And the other thing that's on fire right now is selling illegal product.
Speaker B: Yeah.
Speaker A: And that's just com. You know, people selling, like, Peptides, they. They're setting up these, what they call masked sites or whatever. Cloaked sites.
Speaker B: Huh.
Speaker A: Or they're selling crypto, but they're showing some other product on the website.
Speaker B: Right.
Speaker A: And as the. And you know, with, uh, Visa and Vamp and MasterCard, with their new scam merchant thing. I know you did a podcast with a mutual person I've had on my podcast, Mark from the Speedifier.
Speaker B: Yeah.
Speaker A: And you know, even though that's more aimed at new merchants, but, you know, they're starting mass. You know, the banks are starting to look at these merchant accounts.
Speaker B: Yeah.
Speaker A: And find products on sites that are not supposed to be sold. And, well, I think merch some. You know, if you've been processing a merchant for years, they should get a warning. Hey, you have this product on your site, we're warning you, you need to take it off. Whatever, three days, two days, whatever it is. But, but I see people ending up on the match list, especially from Stripe, QuickBooks, um, Shopify, Wix, they're just, boom, you're on the match list.
Speaker B: Right.
Speaker A: And that's on fire right now. But the identity theft is, Is just completely out, uh, of control right now.
Speaker B: Well, and I want to, So I want to dig into the match list for, for a little bit as far as getting off it. But before that, I want to circle back to something. So just to clarify, it sounds like what you're saying is that, you know, this stuff's been going on for years. I mean, this is, you know, as far as the people trying to. Identity theft and open merchant accounts. But I think what you're saying is in the past, it's been a lot easier to catch because, frankly, these people are typically very bad at this. And so if you do even a little bit of digging, you're like, well, this is obviously not the right business, but I think what you're saying is AI is changing the game and actually making it really, you know, not, maybe not easy, but much easier to make it look like you are this business that you're pretending to be.
Speaker A: Yeah. Well, you can just go on and make an AI website in ah, like 30 minutes.
Speaker B: Right.
Speaker A: You can, you know, and then they're just manipulating documents. So they're.
Speaker B: Right.
Speaker A: Maybe they're stolen document. I mean they're getting these documents from the Dark Web. They're getting these documents off GitHub sites. I have a whole file on my computer, in my chat GBT that's just dedicated. It's the scammer project.
Speaker B: Right.
Speaker A: And, and, and all these websites that they're using because the uh, the scammers are, I don't want to say the, they're stupid, but they. When you send somebody. If I send James this PDF, right. And it's an actual PDF, not something I just did. Even if I did print to PDF. Right. It's gonna, and you searched it and you said, give me the metadata. It's going to tell you when it was created and how it was created.
Speaker B: Right.
Speaker A: And you'll see it's going to say, come up. Oh, banks don't create um, bank statements using CorelDRAW. Right. They don't use Adobe. They have their own software and they have their own fonts and it'll pick up like words misspelled. Because these people, they're not from inside the U.S. i would, I would venture the game that 90% of these scammers are not in the U.S. right, sure, of course.
Speaker B: And, and they, they don't have as much to lose because they're not subject to our laws. So they can, you know, they can pull out if they can pull off the scam and get the money out of the country. It's like, well that's, that's their money at that point.
Speaker A: Yeah. And it's easy to do that because they transfer the money from their bank account to like wise.
Speaker B: Right.
Speaker A: Payoneer or one of those companies and then boom, the money's gone out of the bank account.
Speaker B: Yeah.
Speaker A: And that's it. And it's gone. And then the credit card processor, who do they hunt down? The act they find like James Shepard and they go, hey, James, did you open this merchant account? James, like no, I didn't do that. I don't even know what you're talking about.
Speaker B: Right, right.
Speaker A: The next thing you're finding out is you know, or you get your credit report and there's a collection on there from a com from a few companies. Yeah. You're like, oh, who's trying to collect on me?
Speaker B: Right. All right, so let's approach this from two angles. So let's, uh. I want to finish with how to get people off of the match list and how to help them after the fact. But let's start with what to do before that. So what are some of the steps that both agents and, you know, merchants, uh, could be taking today to say? This sounds really terrible. I don't want this to happen to me. What, um, should they be doing and what should agents and ISOs be advising their merchant clients to do at this point?
Speaker A: At this point, merchants need to make sure you have credit monitoring set up. Uh, use Credit Karma or whatever your bank gives you. Experian or whatever they're giving you for free. There's free. Make sure you're setting it up where you get alerts so you know when somebody's pulling your credit, because sometimes soft pulls don't show up. So I would definitely say, you know, you need to log in every two weeks or once a month at a minimum, and check your credit. And the second thing is, do not. If you don't, you need to claim your Google profile, your Yelp page, things like that, because those are the things these guys are going after. And I don't know, there should be. Someone should come up with a service where you can check if somebody spoofed your website, but that's kind of hard because they're not going to copy your exact name. Right.
Speaker B: It's going to look totally different. Yeah.
Speaker A: Some other kind of way to. To prevent it.
Speaker B: Right.
Speaker A: But that's kind of hard to catch. But agents just need to be really careful because when you're not going face to face with somebody and you're just getting a call or a form on your site getting filled out, you need to just start asking people for documentation. And before you send these apps in, you know, we'll even send people an app and then we ask for the documents. Oh, we need your driver's license. We need three months merchant statements. If you don't have those, we need three months bank statements. And then we check them, and then if those are fake, we just withdraw the application and move on. Or we don't even send. Bother sending it in because, you know, if you start sending in stuff, then, you know, your processor, they get beat for tens of thousands of dollars on one of these. On one of These bus stats, um, I heard about one that's three million dollars that somebody did a three million dollar bus down. And um, if, you know, then your, all your applications are going to come under scrutiny.
Speaker B: Yeah.
Speaker A: All of a sudden, basically tell processors, hey, this lead came from the Internet, you know, hey, we checked it out. This is, these, all these documents are completely legit.
Speaker B: Right.
Speaker A: You know, and if they're not legit, we just don't even bother with it. Yeah.
Speaker B: 100. All right, so now let's go to the other side. So, okay, so this happened to our merchant and they call us. Hey, you know, uh, we, you know, I can't process payments. I got on the match list. Right. So as the agent, as the ISO, like, what do you, what do you do?
Speaker A: Well, you need to tell them you need to go check first thing, check your credit report. They're going to find something on their credit report. Did you get any credit card machines in the mail? Any mail that looked odd, like a letter from, you know.
Speaker B: Yeah.
Speaker A: Processor you don't use or processing company? Hey, thanks for setting up your new merchant account under some business that you never heard of at your business address. I mean, that's the danger of it because it could be something at your business address, but then the signer is not you. It could be somebody else, but it's still going to end up getting tracked to your business because they stole your, they stole your business identity and they either have a new federal tax ID or they used yours and then they opened a new bank account with that information. So, you know, merchants need to really be diligent, you know, and look at their mail. Nobody. I mean, how many times when you were beaten streets back in the day, you'd walk in and say, oh, do you have your merchant statements? And the merchant pulls them out and their envelopes that are unopened. Right, right, right.
Speaker B: So imagine, yeah, imagine what they're doing with the ones that are like for a business that isn't even theirs or whatever, they just assume it's scam or, you know, know, they just assume it's. It's not.
Speaker A: Throw it in the garbage.
Speaker B: Right.
Speaker A: Today, I would say you get some. You get a letter in the mail and it's got a different company name on it. It's something you probably should open up and make sure that you're not getting scammed, because that's what's probably happening. And we've seen dozens of these cases in 2026. We started to see a little bit of it in 2025. But it's full on. On fire now, where, you know, it's three, four, or five of these every week coming in. And then, you know, you have to spend time going, okay, is this real? Is it not real right
Speaker B: now? If so. So again, though, if we do all that, but again, our merchant still ends up going through this, they end up on the match list. You mentioned kind of that ability to maybe help them get off of the match list so they can start processing payments again. What is. What does that process look like? Any tips or thoughts on that?
Speaker A: Well, you can't get them off the match list. So if they're on the match list for identity theft, uh, you. You either have to go back to the processor. If they're your client, like, let's say it's my client, then I got to go back to the processor. I got to go, hey, we're going to need an exception. This guy didn't do that. Here's the proof. Boom. Um, you know, you got to get your proof together. You can't just say, hey, the guy didn't do it. No, they're going to say, we want a police report, we want an FCC report, because that's. You file with the FTC stolen identity report and the. And the police. So you get those, and you get a letter from the merchant explaining it. And you said. And then they have to also go and dispute it on their credit and lock their credit at that point. So, you know, you try to work with it, or you get a merchant that calls you and it's not even your merchant because.
Speaker B: Right.
Speaker A: Maybe they were on Square Stripe, Shopify, QuickBooks, PayPal, one of the companies that has no phone. Right, right. So they can't call those places and go, hey, that's not me. They don't care. They're not answering the phone, and they're not take. And you're not going to get taken off the match list either for that. So then you have to go find somebody who can work with the processor, who. And some of the banks, most banks, I think, will give an exception to the ISO if they prove there was identity theft and it wasn't the merchant. But you got to provide the proof. If you don't have proof, that's a whole, you know, the proof is going to be, you know, police reports, FTC filing, you know, a letter from the merchant explaining they locked their credit, they disputed everything. You have to put a case together.
Speaker B: M. Yeah, interesting. And so what you're saying there is m. You know, a lot of these sponsor Banks will end up making an exception, even though the person is still going to be on the match list for a period of time, because you can't just easily get yourself off of the match list. But they will allow them to continue processing potentially once they see proof that this was identity fraud that caused them to go on the match list in the first place.
Speaker A: Right? Yeah, but stuff like selling illegal items, chargebacks, those are. That stuff, the credit, you know, no, banks want those merchants.
Speaker B: Correct.
Speaker A: Somebody who's got like, you know, you know, oh, you got a 10 chargeback ratio and you're on the match list. Zero. You know, you have, you're done. Unless there's some extenuating circumstances.
Speaker B: Time for you to accept, uh, time for you to accept Bitcoin. That's going to be.
Speaker A: I mean, listen, we ran into something the other day where a merchant got put on the match list for the wackiest thing they were on Stripe.
Speaker B: Yeah.
Speaker A: They sent a payment. They sent that a customer make a payment to them, and the customer by mistake put in $2,999,000 and the payment went through. Now, if you are using a normal merchant account, you could log into the gateway or whatever, or you could get on your machine and void that transaction. Right? And it's voided. But that's not how it works on those platforms. On those platforms, transaction goes through, boom, you're done. Right? And then the Stripe is trying to debit the person's account for like $12,000 of fees. Then they have $12,000 of fees and, you know, boom, they ended up putting the money in the bank account, this and that, and then stripe shut them down.
Speaker B: Wow. Yeah.
Speaker A: You know, they didn't deserve to go on the match list for that because that was.
Speaker B: Right.
Speaker A: Just a mistake. But they're also not giving back the 12 grand in fees, right?
Speaker B: Exactly. Yeah. You know, it's, uh, interesting. I don't think I've told you about this. I mentioned on the podcast, I had a crazy situation. Probably like maybe 18 months ago, there was a weird, um, issue that we had with CC storage that. Something unforeseen. So with CC storage, right. With, uh, an ISV like that, it's a subscription, you know, basically because, yeah, people rent a self storage unit, so they pay, you know, a hundred bucks a month. Well, one of our developers, we got a request to say, hey, we have people that want to make a partial payment, right? So we need a form where people can go. Instead of just like saying, hey, pay my next invoice. They want to Pay part of it. So they can pay an arbitrary amount. Well, the developer added this form that people could go in and put this arbitrary amount in, but they didn't put any like ceiling or whatever on this arbitrary amount. So we had somebody who went in there for one of our merchants and they went in and entered like um, what was the amount? I think the amount was like $973 million or something like that.
Speaker A: Wow.
Speaker B: And they did this like three times in a row. We don't know why. Well, this transaction of course gets declined. Right, Right. Well so I didn't really think much of it. It was like, oh my goodness, we got to add the protections here. That was terrible or whatever. And I just assumed that like between the Gateway and Thesis, somebody had a block to make sure this never actually hit the card network. Now I hit the card network and it was a decline. Well there is this. MasterCard, uh, had just within like literally three weeks prior, had changed one of their fees to where um, if you get a decline transaction it's like you know, $0.12 or like two basis points, whichever is higher.
Speaker A: Right.
Speaker B: So we got this, you know, bill for two basis points on like a billion dollars. It was unbelievable. It was crazy. So of course we were able to reach out to our great contacts at MasterCard. Thank you very much. Uh, and they of course, you know, waived this for us. But it was super scary of like this was a multi million dollar like basically fee on a transaction that was declined. Um, and so yeah, it just. There's so many things in the payments industry that like you just don't necessarily think about until you run into it. And I think all the scammer stuff is the same thing where it's like, man, you know, you have to make sure you don't have any holes in your funnel of your marketing and stuff. Especially if you're doing a lot of online marketing these days.
Speaker A: Yeah. Gateways, you have to have a ah, Velocity filter set up. Yeah. So that like if somebody tries to run like thousands of transactions, after a few it will just stop and put them all in the queue and then you're not going to end up with Gateway fees or.
Speaker B: Right.
Speaker A: I mean I saw a merchant one time, they got hit with a hundred thousand transactions that to pay authorized net $0.10, Visa, you know, buy, you know, Tesis $0.10.
Speaker B: Right.
Speaker A: And you know, and then, and then
Speaker B: you get hit with the chargebacks and everything on those transactions. You know like we had somebody doing the other, the other scam we had with CC Storage was they uh, they were doing the phishing. So they would go in and create, like, a fraudulent account, again with what you described, where it's like, pretended they were a self storage property owner. And they would create the account, and then they would go in and they would just run all of these, like, you know, $1, $5 or $20 transactions, um, across as many accounts as they. So in there. Well, actually, I take that back. In that case, they weren't creating a merchant account. They were, like, going in, like, renting a unit.
Speaker A: Right.
Speaker B: You know, and then running, like, partial transactions. So I remember we had our developer team spend probably like two, three days, the whole team of like, all right, everything stops. This is a vulnerability. And they had to go in and make all, like you said, all the velocity stuff, all this different thing to like, hey, we got to be able to flag this in the future and make sure as we grow that we can't allow this kind of stuff to happen. So, yeah, it's always crazy, but it's
Speaker A: like AI Today, it's like fighting AI it's like there's a battle going on. Scammers have AI, we have AI you know, everybody, everything's trying to outsmart each other from the AI. But what's happening is with these stolen identities is they're getting past. You know, they're creating corporations.
Speaker B: Right.
Speaker A: You know, they're. You know, they're using probably, um, you know, they're where you can mask your IP on your computer.
Speaker B: Right.
Speaker A: Looks like they're in Florida or they're in Texas or wherever.
Speaker B: Right, right.
Speaker A: You know, you know, they're really. They're really, really. I don't want to say they're smart. They're smart because they're. I've talked to several people who told me, ah, yeah, we got blown up for 10 grand, 20 grand, 50 grand. And I know. Know it from merchants because they're the, you know, telling me, like, what happened to them.
Speaker B: Right.
Speaker A: You know, really bad. But the amount of people getting on match right now is.
Speaker B: Yeah, it's crazy.
Speaker A: Is a lot. Because Stripe is not messing around. They're dropping people, like, left and right onto the match list, especially when they find they're selling things that they don't
Speaker B: want they're not allowed to sell. Alan, this has been fascinating. I always like having you on. This has been a really cool topic. Um, before I let you go today, though, I want to give you a chance to talk a little bit. Um, tell us kind of the other things that you do for people that might want to reach out and learn more. I know you have your, the B2B vault, uh, podcast, so talk about that. And then also, um, if you're still in the market looking for agents and ISOs to partner with, maybe give a little bit of context on that if you would too.
Speaker A: So yeah, B2B vault, we're approaching uh, 400 episodes.
Speaker B: Awesome.
Speaker A: So that's pretty cool. And uh, we're in the top. We're, we're like in number. We stay between number 20 and about 30 on the Apple podcast list for business and entrepreneurship. So you know, we kind of took the. We don't really talk about, we talk about payments some, but we really talk more about business and things that business own tools that business owners can use and have people come on and talk about all different things from payroll, accounting, bookkeeping, you know, B2B payments, um, you know, a lot of different subjects, AI, a lot of, there's a lot of really cool AI stuff that, that we've talked about on the podcast. The last episode of Guys giving away a free tool. You can drop one line of basically no code. You can take this one line of code and it will help your E commerce store website be ready for agentic commerce.
Speaker B: Mhm.
Speaker A: Ah, pretty cool. From this company called Firmly. It was a really, really cool podcast.
Speaker B: Sure.
Speaker A: And uh, you know, as far as like what we're doing at nps where you know, we got our NPS gateway, we're working with ISVs, we're working with a lot of some software companies working with, doing a lot of B2B trans. A lot of B2B is our focus right now. So companies doing invoicing B2B using ERPs, using um, systems like that, insurance companies, a lot of different, you know, and E commerce and helping merchants, you know, grow especially um, larger merchants who need to really look at their technology and get their technology stack the way they want it. Because a lot of people, you know, there's a lot of product out there right now that's not going to be PCI compliant anymore. And that happens every, you know, seven or eight years. All of a sudden, you know, people this product that, you know, they, they get, they're gone. But you know, with our gateway we have our API, we have web hooks, so we can do pretty much anything that stripe can do. And so that's one of the focuses that we're focusing on Now. But with SaaS, companies, recurring payments and all that, and we have everything all in one bundle, which is nice. So uh, we can do credit card Ach, Apple Pay, Google Pay. But it's all one help desk. You don't have to have multiple companies you're not worried about. Like, we took away the pieces.
Speaker B: Yeah.
Speaker A: You don't have one credit card company, one Ach, and a gateway. Boom. We have that all one help desk. So awesome. Which is super important.
Speaker B: Very cool. Well, Alan. Yeah. I really appreciate it. Always love having you on here, sharing your expertise. I think, uh, this one, I think is very timely. I think people will be going and checking their credit report right now. Uh, you know, I know I'm going to be checking mine right now again as well. And, uh, that was very helpful. And I think, again, just being able to help these merchants when they do run into these situations and having some idea what to expect, I think is super valuable. So, as always, thanks again for jumping on and taking your time with us today.
Speaker A: All right, thanks. You know, I hope agents listen and, you know, really start to, uh, look at their Internet leads, because that's where all this stuff is coming from. And the Internet's not going away.
Speaker B: No, it's not. And it's only getting crazier with AI, so. Yeah. Yeah. Good stuff, Alan. Thanks again. Appreciate it.
Speaker A: All right, thank you.
Speaker B: Thank you for listening to the Merchant Sales podcast. Whether you are an industry veteran processing executive or just trying to learn. Learn about the payment space, we appreciate your time. We hope you will tune in next week for more information and tips on building your merchant services business.
Classic Sales Tactics That Still Work76 / 100
The New Playbook for B2B Payments75 / 100The Missing Piece in High-Ticket Payments72 / 100How AI Is Transforming Merchant Portfolios68 / 100Building Business Value in the AI Era70 / 100