Brad
Kort
5628
West 120th St.
Alsip,
IL 60803
Dear
Brad Kort,
It
has come to our attention
that a limited number of SKIPJACK merchants may have experienced
fraudulent
activity on one or more of their merchant account(s). We want to advise
you of
this situation so that you and your merchants can take appropriate
action
because certain merchant accounts may be at risk.
Fraud
Profile
In
a small number of cases,
SKIPJACK client merchant account information has been used to program
either a
terminal or a payment processing gateway application to create a clone
of a
valid merchant account. The terminal or application is then used to
connect to
a payment processor to submit transactions for processing. In most
cases, these
transactions were not processed through the SKIPJACK payment
application where
the valid merchant has an established account, but instead through
another
connection to the processor; this, in turn, precludes our ability to
detect
these suspect transactions. Some activity has been seen where debits
were
processed against presumably stolen card accounts with offsetting
credits
processed back to card accounts believed to be in the control of the
perpetrators. The credit dollar amount is often the same as the debit
dollar
amount, creating a zero dollar batch or near zero dollar batch that may
not be
evident to the merchant whose account has been cloned. Most acquirers
have
processes to screen for this type of activity.
Analysis
It
is our understanding from
discussions with others in the industry that this profile of cloning
terminals
to commit fraud is becoming more common. Merchant account information
is
present in many locations, including reseller environments, merchant
environments, the SKIPJACK environment, and processor environments, and
it must
be safeguarded. SKIPJACK regularly updates its security practices as
new
threats emerge and as industry best practices and technologies evolve.
Accordingly, SKIPJACK recently implemented a series of security
enhancements,
among which include the deployment of additional monitoring practices
to detect
and prevent this type of activity from occurring in our system. We
continue to
monitor and evaluate this situation on an ongoing basis.
We
recommend that the
following steps be taken regardless of the payment gateway that your
merchants
are using. Please keep in mind that these actions may not completely
protect
you from all risk of fraud.
Recommended
Actions
Please
contact your
merchants and advise them as follows:
1.
Ensure that all account
users are following best practices with respect to protecting their
payment
gateway login credentials.
2.
If applicable, determine
whether their acquiring bank's risk management procedures and tools are
configured to detect zero dollar, near zero dollar batches, or other
batches
with abnormal credit activity (such as blind credits).
3.
Consider having their
acquiring bank change their merchant account credentials with the
relevant
processor and instruct them to close the former merchant credentials
once new
ones have been issued and updated in the SKIPJACK system. Note that if
the
merchant account information is updated by the merchant's acquiring
bank, the
merchant will need to provide the updated processor information to
Skipjack. In
order to minimize any impact to their payment processing, this should
be
coordinated with Skipjack Customer Support personnel. Please contact
Skipjack
Customer Support if you would like additional information regarding
this
process and for assistance in identifying accounts, which may be at
higher risk
based upon our current evaluation, if applicable.
4.
Ensure that their
acquiring bank has closed any dormant merchant accounts at their
processor that
may not have been used for an extended period of time.
Please
note, SKIPJACK will
only use email to deliver general information. We will never use email
or links
within email to ask you to supply, verify, or update sensitive
information, nor
will we use email as a means to enroll or verify any information
related to any
SKIPJACK product or service.
We
understand that you may
have questions regarding this matter. Please contact Skipjack Customer
Support
at (888) 368-8507 extension 1.
Thank
you for your attention
to this matter,
Sincerely,
Brad
Hoeweler
Vice
President and General
Manager