Fighting fraud, one scam at a time

Every morning, Jonathan Trivelas wakes up, makes himself an oversized mug of coffee and, like many of us in this age of anxiety, sits down in front of his laptop and opens up his search engine.

Coronavirus cure, he types. COVID-19 at-home test. COVID-19 vaccine.

There is no shortage of results — the top ones making it clear that there is no miracle cure, a vaccine is many months away, and the Food and Drug Administration in the United States has approved a single at-home diagnostic test that is only available to healthcare workers and first responders. But digging deeper, anyone can find websites steeped in pseudoscience hawking tests and treatments that are ineffective and a waste of money at best, and dangerous at worst.

In March alone, at least 100,000 new domain names containing words like “covid,” “corona” and “virus,” were registered, with the number of malicious COVID-related domains likely in the thousands.

After some searching, Trivelas finds an online merchant offering an at-home test kit ready to ship today. He takes out his Mastercard and types in the account number. And this is where his story takes a left turn.

Trivelas is a director with Mastercard’s Franchise Brand Performance team, and the account number he uses has unique features just for Mastercard testing purposes. He is performing what is called a “trace message,” which helps him and his team identify the true merchant  and initiate an investigation under the company’s Business Risk Assessment and Mitigation Program, or BRAM.

In order to accept Mastercard transactions, merchants must have an account with an acquiring bank that submits transactions to the cardholders’ bank via the Mastercard network. Acquiring banks, which are licensed entities authorized to participate in Mastercard’s network, are ultimately responsible for the activity of their merchants. Trivelas and his colleagues identify merchants who may use their merchant accounts to facilitate illegal and/or brand-damaging transactions — including child exploitation, unlicensed gambling, illegal sale of prescription drugs and intellectual property rights violations — and work with the acquirers to investigate those merchants.

A typical transaction processed over Mastercard’s network involves four parties: the cardholder, the merchant, the issuer (the cardholder’s bank) and the acquirer (the merchant’s bank).

“We’re trying to see what we can find just as if we were consumers or cardholders,” says Trivelas, whose team gets referrals but also relies on what he calls “good, old-fashioned Googling.” And it’s a global program, so any merchant who accepts Mastercard is fair game.

“Our cardholders are global, and our merchants are global, so we have to be too,” says Samantha Medina, who works on the Franchise Brand Performance team. “Law enforcement is often limited to what they can do when the criminal or scammer is located in a different country or jurisdiction, but our team doesn’t have that problem. We can take action to get bad actors off our global network no matter where they are.”

The Mastercard team is just one of many across government and law enforcement agencies, financial institutions, major retailers, internet infrastructure providers, commerce platforms and consumer advocacy groups working to combat COVID-19 fraud.

From January to May 6, the U.S. Federal Trade Commission received more than 37,600 coronavirus-related complaints, more than half of which involved fraud at an estimated total of $26 million. The claims range from unproven treatments to stimulus check scams to even elaborate but fake drive-through testing sites. During the first three months of 2020, the European Anti-Fraud Office opened 104 new investigations, a historical record it credits to COVID-19 scammers.

The FTC has been sending warning letters to companies, both in the United States and abroad, that are hawking purported corona preventative therapies and cures, ranging from ozone and stem-cell therapy and sound frequency healing to “anti-virus” essential oil blends, boneset tea, elderberry tinctures, and silver (“a particle-cluster of silver to kill multiple bacteria, viruses and yeast/candida pathogens through the body until it is safely excreted”).

There are no FDA-approved products to prevent or cure COVID-19, and the FDA warns that using unproven products without consulting with licensed health care professionals can put you at risk for serious health consequences. What’s more, the false sense of security such “cures” may provide can delay proper diagnosis and treatment — and put others at risk in the spread of COVID-19.

“We know that there is no current cure for COVID-19,” says Paul Paolucci, vice president of the Franchise Brand Performance team. “Anybody saying it or selling it is not being truthful.” 

Once the Mastercard team identifies a potential violation, they notify the acquirer, which investigates and takes action. That may include requiring the merchant to remove the suspect items or terminating the relationship with the merchant altogether.

Despite the increased scrutiny, fraudsters can still play a high-tech version of “whack-a-mole,” their dubious products popping up on new platforms once removed from others. That’s why acquirers who find their merchants are promoting fraudulent products must not only cease the activity or terminate their relationship but, report the merchant to Mastercard Alert to Control High Risk (MATCH) database.

All the merchant’s details are logged in the MATCH system — which all acquirers must check before bringing on a new merchant — helping them make a more informed decision, potentially minimizing risk, and giving them the opportunity to begin targeted monitoring before bringing a merchant on board.

“It feels good to be able to try and stop consumers from being ripped off,” says Trivelas, who notes that one of the most prevalent scams he is currently seeing is the sale of likely counterfeit testing kits. “You think to yourself, what kind of a person does this? What kind of a person does this in a crisis like a global pandemic, affecting so many people in so many terrible ways? It really drives us, knowing that we’re making sure they’re not using our network to profit from that pain.”