Consumer complaint received 2018-06-07
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Fraud or scam — 
Company: First Data Corporation (NM)

I represent a company that has a chain of convenience stores. One of our sites was fraudulently hit for unauthorized refunds to our merchant account 6 different times between XX/XX/XXXX and XX/XX/XXXX. The total amount we got hit for is {$16000.00}. 

We were contacted by our sales rep from First Data ( our credit card processor ) on XX/XX/XXXX by phone to notified us that some possible fraudulent transactions might have taken place on our account. He informed us that the fraud department from First Data was going to contact us to confirm whether these were fraudulent transactions. 

At this point, a visit to the affected convenience store site was performed. A thorough investigation of the site did not reveal any type of skimmers and a review of our credit card sales journals detected no such refunds went through our system. Our in-house auditor reconciled the credit card statements on XX/XX/XXXX XXXX and verified that two fraudulent transactions occurred on the XXXX. These transactions added up to {$5000.00}. 

We looked through our point of sales journal records and could not find the 2 transactions that occurred on XX/XX/XXXX anywhere in our system. Our credit card reconciliation with First Data 's web site showed 2 refunds on that day for {$2500.00} each that were applied to 2 different Visa debit cards. 

Since the First Data fraud department hadn't contacted us as we had been told, we decided to contact the fraud department on our own. They informed us that the transactions initiated through a feature referred to as a dial back up. They stated that this function should be turned off on our P.O.S. ( Point of Sale ) system. A call to our P.O.S. ( point of sale ) technicians confirmed that our P.O.S. system doesn't have dial backup capabilities at all and are non-existent on our system. Our P.O.S. company initiated a protocol to check our system to verify we were compliant and the result was we were in full compliance. Their review of our system confirmed there were no records that existed in the system related to these fraudulent transactions. 

On the Afternoon of the XXXX our rep contacted us and we decided together that we would request a new merchant number as well as disable any refund capabilities. We were also told at that time that First Data would not be responsible for those transactions. 

On XX/XX/XXXX at XXXX XXXX we received an e-mail from my rep stating that the new merchant number was requested and that dial back and refund functions were also to be disabled at the site that was targeted as well as another site that First Data does our processing. 

On XX/XX/XXXX when we received our card statements we noticed that we were breached again for {$2500.00} on the XXXX of XXXX at XXXX XXXX Then again on XX/XX/XXXX, we were hit at XXXX XXXX for {$2900.00}. We were hit again at XXXX XXXX for XXXX and finally again at XXXX XXXX for {$3100.00}. When we contacted our Rep he was dumbfounded how this could happen and he tried reaching out to the Fraud dept for us again. He told us that a higher up from the Fraud dept would be contacting us by phone which never happened. I have tried calling the fraud dept myself and left messages as well as our rep reaching out to them multiple times to contact us. It is XXXX XXXX on XX/XX/XXXX and we have yet to hear what the resolution is going to be. 

We feel that the system was breached through the First Data side as there are no records of any of these transactions anywhere in our point of sale system and that we should be refunded for the full amount of {$16000.00} immediately. 

After the initial {$5000.00} transaction there were supposed to be stops in place to avoid anymore transactions which obviously wasn't the case. This further proves that the breach got through the First Data side and not on our end. 

We have been forced by the card companies to spent thousands of dollars to be PCI and EMV compliant at our sites and we still have been breached and basically brushed off by the Card company. I don't feel the responsibility is ours to bear the brunt of a {$16000.00} chargeback, as we have taken all necessary steps to do what we were asked by the card companies. I am asking for your help to get this matter resolved as soon as possible.