The FTC Will Now Have to Show Payment Processors Knew

The US Federal Trade Commission has changed how it sues payment processors over their merchants' fraud. In a statement dated 2 September and released with a $4.85 million settlement with Nuvei on 8 September, the two commissioners who voted on the case said the FTC must now plead, and eventually prove, that a processor "knew, should have known, or consciously avoided knowing" about the wrongdoing.

The statement says the FTC had never pleaded that before. HaiPay checked the six earlier processor complaints the statement itself cites, from 2020 to 2025. None puts a knowledge requirement in its unfairness count. The two complaints filed on 8 September, against Nuvei and Humboldt Merchant Services, both do.

What the statement says

The FTC's main tool against processors is Section 5 of the FTC Act, which bans unfair practices. Chairman Andrew Ferguson and Commissioner Mark Meador wrote that the Commission has never brought such a case without evidence that the processor knowingly helped scammers, but "we have never actually pleaded that a defendant had it."

They now read Section 5 as requiring it. Their reasoning is that any processor that takes on unproven merchants will eventually serve a bad one, even with every industry-standard control in place. Without a knowledge requirement, they wrote, processors would be liable for all their merchants' fraud and would shut out legitimate small businesses to protect themselves.

The standard is not a narrow one. It covers what a processor should have known, not only what it did know. The statement says a low chargeback rate does not prove a processor was unaware, and that the FTC will treat a processor as knowing whatever it would have found by doing the checks the card networks already require.

Checked against six earlier complaints

The statement cites six processor complaints filed since 2020: Qualpay, First Data and Complete Merchant Solutions in 2020, Nexway in 2023, BlueSnap in 2024 and Paddle in 2025. HaiPay read the unfairness count in each.

All six describe conduct without a knowledge element: opening accounts for shell companies, processing for merchants engaged in fraud, ignoring evidence of fraudulent activity. Where knowledge language appears in those complaints, it is in separate counts under the Telemarketing Sales Rule, whose own text requires that a person "knows or consciously avoids knowing".

The FTC's own 2020 press release on Complete Merchant Solutions said the firm processed payments when it "knew or should have known" about the fraud. The complaint's unfairness count did not say so.

The Nuvei complaint uses "knew or should have known" five times in its unfairness count, in each of the first four types of conduct it lists. The Humboldt complaint uses it three times.

The two September cases

Nuvei, based in Canada, is accused of processing more than $30 million from 2017 to 2023 for Reimage, a tech support scheme the FTC sued in 2024, partly through its acquiring bank registered in Cyprus. The order bans it from processing for tech support sellers that use telemarketing or pop-up warnings, and requires enhanced screening of any client whose chargebacks exceed limits set in the order.

Humboldt Merchant Services will pay $12 million. The FTC says it processed for more than 1,000 shell merchants fronting billing scams, with chargeback rates almost ten times what card networks treat as excessive, and moved some accounts onto a lower-risk bank identification number used by an affiliate so more transactions would be approved. It is banned from processing for four categories of merchant, including those on Mastercard's MATCH list.

Both votes were 2-0.

A third payments case followed on 17 September, but it is a different kind. FleetCor, now Corpay, and its chief executive agreed to pay $100 million over fuel card fees the company itself charged, after courts found in the FTC's favour in 2023 and 2026. That vote was 1-0-1, with Ferguson recused, and the order will be open to public comment for 30 days once it is published in the Federal Register.

What it means for processors

The statement cuts both ways. A processor that runs network-standard checks in good faith and still misses a fraud now has the Commission's written position on its side. A processor whose own files show red flags, or which never looked, is treated as knowing.

It is a statement of how the two commissioners read the law, not a rule. The complaints are allegations until a court decides otherwise, and the Nuvei and Humboldt orders were agreed rather than tried.

HaiPay read the FTC documents through Internet Archive copies, because ftc.gov was not reachable from HaiPay's network on 22 September. HaiPay did not contact any company named.

What to watch

Whether the next processor complaint pleads knowledge the same way, which would confirm this as practice rather than a one-case position.

How courts treat the "should have known" limb. The statement says knowledge can be inferred from a wide range of evidence and that no single fact settles it, which leaves the line to be drawn case by case.

And whether the orders' merchant bans spread. Merchants on Mastercard's MATCH list, tech support telemarketers and shell companies are now written into several FTC processor orders as categories to refuse or screen.