The FBI's 2025 internet crime report put reported losses at about $20.9 billion, a 26% jump on 2024. None of it carries a "fake payment processors" label, and we found no regulator or card network that publishes a loss figure for them.
Over half of that total involved cryptocurrency, and crypto investment fraud alone made up $7.2 billion of it, so the number describes the climate more than the merchant's problem. What the record does document is how a fake payment processor collects money from businesses, and which verification steps its operators have learned to copy.
How a fake payment processor makes its money
Sources describe two routes. In the first, the company exists to collect something up front: the CEO of National Retail Solutions wrote that some scammers build fake merchant service companies purely to take sensitive information or fees. In the second, the fake gets into your merchant account and manipulates transactions, then is gone before you notice, according to the U.S. Chamber of Commerce.
Both start with a pitch. The easiest buyer is a merchant a mainstream processor has already turned down, which is why "we approve every business" deserves suspicion on its own.
Why fake payment processors pass the checks merchants run
Start with "PCI certified." The PCI Security Standards Council doesn't certify providers, says the only documents it recognizes for validation are its own official forms, and bars anyone from using marks like "PCI Certified." A badge on a homepage is decoration. The document to ask for is the Attestation of Compliance, which for larger providers carries the signature of a qualified security assessor.
Visa goes further. Any service provider that stores, processes or transmits its cardholder data must register with Visa and revalidate every 12 months, and the public Global Registry of Service Providers lists those that pass. Mastercard keeps its own list. One catch: a sales-only reseller that never touches card data may not appear itself, so ask which listed company sits underneath.
Even a clean registry hit proves only that the company exists. It says nothing about whether the person emailing you works there.
Regulator registers have the same gap. The UK's FCA warns that fraudsters copy the names, firm reference numbers and other details of authorised firms, and it has published clone warnings for payment-themed names such as Unique Payment Services Limited. The lookup succeeds because the real firm really is on the register.
So the order matters. Find the listing yourself, phone the number the register gives rather than the one in the email, and ask that company whether this salesperson and this contract are theirs. For Singapore, our walkthrough on checking MAS licensing covers the same lookup.
Real companies, fake promises
Two of this year's FTC cases involve operating processors, not phantom websites, and both show what a bad pitch looks like from the inside.
On November 2, the FTC and the State of Washington announced that Riverside Payments and an affiliate would pay $600,000 to settle allegations that they promised small businesses savings of 40% to 60% when switching. The complaint says merchants typically paid more. It points to fees missing from the quote sheet, a 26-page contract, automatic renewal after a three-year term and a $695 early termination fee, all behind a "risk-free" cancellation promise.
In September, the FTC said Humboldt Merchant Services would pay $12 million over allegations that it processed for more than 1,000 shell merchants. Their chargebacks ran almost 10 times what card brands view as excessive, according to the complaint. The proposed order now bars Humboldt from processing for merchants on Mastercard's MATCH list, straw companies, and e-commerce firms whose only address is a mailbox provider such as a UPS store.
Neither company was a fake in the sense of a vanished domain, but the Humboldt list doubles as a screening question. Ask any provider how it vets the other merchants it takes on, because one that skips underwriting for you probably skips it for everyone. Ask for every fee in writing, activation and batch charges included, and compare the total against our guide to what you should actually be paying.
It isn't only a U.S. problem
In June, India's Enforcement Directorate searched six payment gateway companies and froze 129 bank accounts in a money laundering probe tied to a social media stock scam. The agency alleges that proceeds moved through mule entities, charitable trust accounts and payment gateway companies. Those are allegations, not findings. A merchant whose processor sits inside that kind of flow could see its own settlement account frozen along with the rest.
Six red flags that still hold up
A fee due before any service exists, whether it's called registration, compliance verification or activation. The Chamber flags requests for payment or confidential financial details before the processor has delivered anything.
A savings claim with no itemized quote behind it. Riverside's 40% to 60% is the example.
"PCI certified" with no Attestation of Compliance and no registry listing.
No named legal entity or acquiring bank in the contract. A real provider can tell you who settles your funds.
A deadline. The Chamber lists high-pressure tactics and limited-time deals among its merchant services scam warnings.
Termination fees based on your estimated volume and months left instead of a flat rate, which the Chamber also names.
A polished website proves less than it used to
The FBI's 2025 report counted roughly 22,000 complaints involving AI, with about $893 million in losses. That's small next to the $20.9 billion total, and the FBI counts only what victims report. Even so, a professional design, a wall of testimonials or a smooth sales call counts for little on its own now. Treat them as the starting point of your checks.
If payouts stop
Stop routing new volume through the provider. Ask in writing why funds are held and when they'll be released, and save the contract, the quote sheet and every message. Tell your own bank, then report to the FTC at ReportFraud.ftc.gov and to the FBI's IC3. Our pieces on how fraudsters exploit high-risk merchants and verifying a gateway before signing up cover what to do before it gets that far.
Ten minutes before you sign
Pull the legal entity name from the contract. Find it in the Visa or Mastercard service provider list, or your regulator's register. Phone the number listed there and ask for the Attestation of Compliance and the name of the acquiring bank. If those answers take more than a day, delay signing.
You can also browse providers by category in the TheFinRate directory, then run the same checks on any you shortlist.
