by Matt Rej
The FTC’s latest lawsuits against payment processors don’t surprise me in the least.
Credit card processing is an industry that absolutely deserves more scrutiny and regulation at the federal level, as merchants of all sizes nationwide get taken advantage of on a daily basis in excess fees imposed by processors.
But what did surprise me was the processors they targeted.
Toast, for one, is far from perfect but I don’t think they’re even in the top ten worst offenders in this space. And when you look at the FTC’s own language in the complaints, you could easily find dozens of other providers with far more egregious instances of the same violations.
Not sure if this is just a starting point and additional lawsuits will continue to be filed against other processors. But the current filings, while a step in the right direction, don’t do enough to address widespread issues industry-wide.
Why the FTC is Coming After Payment Processors
In the last two months alone, the Federal Trade Commission has either sued, fined, or proposed settlements against four different players in the payment processing space. Each for slightly different reasons.
Toast: Case still pending, but the FTC alleged Toast imposed hidden/unauthorized fees, misleading customer support, unwanted add-ons, and cancellation obstacles. This could basically describe any processor on the market right now, which is why it raised some eyebrows as to why Toast was specifically targeted and others weren’t.
I’m definitely not trying to defend Toast or saying what they’re doing is right. I just think their billing practices aren’t nearly as bad as other players, particularly the large legacy providers.
Riverside Payments: Riverside operates as an ISO, and this lawsuit was tied to falsely promising to save small businesses money and make it nearly impossible to cancel, despite “risk-free cancellation” advertising.
Equipment leasing terms were also a big part of this one, and not properly disclosing fees. Riverside’s affiliate Cascade Equipment Leasing was also included in this $32 million judgment (suspended for a $600,000 proposed settlement).
Corpay (formerly FleetCor): Corpay agreed to a $100 million settlement to redress merchants who were wronged. The FTC says this was about misleading savings claims.
More specifically, the FTC claims there were hidden or unauthorized fees related to its fuel-card business. Not Corpay’s regular merchant processing operation.
Nuvei: According to the FTC, Nuvei and its subsidiaries knew (or should have known) that they were processing payments for merchants who were running scams. This was definitely an interesting one for me when I heard it because Nuvei is a newer and more forward-thinking business that tends to pride itself on its technology.
So even without all of the details, I tend to agree that Nuvei probably should have known certain merchants were running scams. They should have the technology in place to flag that stuff. And part of the FTC’s proposed settlement includes stricter screening requirements for merchants on top of a $4.85 million payment.
What Counts as Deceptive Processor Billing to the FTC
Digging into this a bit deeper, I wanted to know specifically what caused the FTC to come down on Toast and Riverside. Since both of these lawsuits were more aligned with traditional processing and different from the Nuvei and Corpay allegations.
When you look at the language used in the FTC’s own press release on Toast, violations were tied to:
- hidden and unauthorized fees
- unwanted add-ons
- unauthorized charges
- subscription traps
- deceptive subscription and cancellation practices
And for Riverside Payments, the FTC used phrases like:
- failure to clearly inform businesses that they were enrolled in auto-renewing contracts
- buried key information
- not properly disclosing costs of leasing equipment
- failing to include various fees, including activation and batch fees
- negative option enrollment
This is all nearly verbatim to the terminology used by the FTC.
When I look at this, I can tie nearly every single bullet to probably 90% of payment processors on the market right now. Whether that’s an all-in-one provider, PayFac, ISO, traditional acquirer, integrated software: everyone.
That’s not to say that Toast and Riverside shouldn’t have been targets of a federal probe. I just question whether the crackdown ends here or others will continue to follow. Because I think federal regulators could fry far bigger fish for even worse violations using the exact same criteria.
Hidden and Unauthorized Fees Are an Industry-Wide Problem
Calling this an industry-wide problem isn’t just a hunch or something I believe. It’s literally something I see on a daily basis when auditing statements and contracts from practically every processor.
And I can map all of the FTC terms to concrete examples.
For instance, “hidden and unauthorized fees,” I’ve probably published at least 50+ posts over the years calling out these types of billing practices.
- Transaction Network Access Fees
- Risk Assessment Fees
- Settlement Funding Fees
- Amex Support Fees
- International Card Handling Fees
That’s just to name a few. And it just barely scratches the surface.
These fees are all invented by processors and designed to look like legitimate charges, and some are even disguised as network fees.
As for “unwanted add-ons” and “negative options,” that’s a classic free auto-enrollment to a VAS that converts into paid subscription. FraudSight is a perfect example, which adds a monthly fee plus a per-transaction charge for something merchants never actually opted into. PCI Plus is another one that’s presented as a “complimentary upgrade” but is actually a paid service.
Buried Fees and Fine Print on Merchant Statements That Are Hard to Read by Design
“Burying key information” and “failing to disclose fees.”
That’s literally everywhere. The majority of merchant statements are nearly impossible to read by design.
Processor markups are buried randomly throughout line items of mandatory network fees, with no clear breakdown of what charges are paid to who. Even the statement summaries are misleading, totaled in a way to make it look like the processor charges are much less than they actually are.
I’ve audited statements where you literally need three full months of reporting to calculate your fees for a single month.
It’s common practice for processors to use obscure language in a sentence fragment in large blocks of dense text to announce a new fee being added to an account. Hiding behind the network increases so if there’s a change in fees the merchant assumes it’s due to a non-negotiable interchange update.
Auto-renewals, unclear termination fees, equipment leases: I see this stuff every single day. I could go on and on with more examples but I’ll spare you for now. Feel free to reach out to me directly if you genuinely want more.
What the FTC Left Out of the Complaints
None of the FTC lawsuits mentioned mid-contract rate increases, and that’s where merchants often lose the most money.
They also didn’t go after merchants for egregious price jumps, which could potentially fall under the umbrella of unfair pricing practices that falls under the FTC’s umbrella depending on how you look at it.
This might be a stretch, but when you consider the playbook used by some large processors who buy up competitors and then roll out rate increases, they could be fringe cases of anti-competitive pricing too.
Particularly when these massive rate increases come as a genuine surprise to the merchant.
Some processors don’t even specify the amount of an increase. They just say “your rates may go up next month.” Then when the statement comes out, you went from 3% effective to 8% effective basically overnight. And you don’t see that until those funds have already been pulled from your account.
So I think real federal scrutiny should at least cover some of this. Which would be a better start, and it should expand to the biggest offenders (that was another piece totally missing from this fall’s crackdown).
Toast Lawsuit Implications for Merchants Using Other Processors
The Toast case is new and still pending, so nobody quite knows how this will play out yet. But there’s an interesting component that matters for every merchant, regardless of who processes their card payments.
Part of the FTC’s case against Toast relies on the Restore Online Shoppers’ Confidence Act (ROSCA). This is a federal law aimed at auto-renwewing subscription and cancellation practices.
Toast says that no court has ever applied ROSCA to a negotiated B2B agreement. And if the court sides with the FTC, it sets precedent and effectively eliminates that defense for every other payment processor.
Meaning auto-renewing contracts, buried non-renewal windows, and termination fees could all be open to the same scrutiny.
Another piece of the Toast complaint leans heavily on volume. It says that tens of thousands of customers complained to the FTC, both online and directly to Toast. Proving that complaints are how cases get built.
It may seem like a waste of time or something that won’t make an impact. But it has to start somewhere. So if you genuinely believe that your processor is charging you fees that you never agreed to then you can report it to the FTC so there’s a record.
In the meantime, you don’t have to wait for federal regulators to catch up to your processor. Pull out your latest statements and look for fees that you didn’t agree to or anything that looks off.
These charges and excess fees can be negotiated directly with your processor, and that’s something my team here at MCC can help you out with.