Consumer complaint received 2026-03-10 00:00:00
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Wrong amount charged or received — 
Company: HEARTLAND PAYMENT SYSTEMS INC
State: VA

Complaint narrative:
# # Description of Incident Involving Heartland Payment Systems and XXXX XXXX XXXX. Beginning in XX/XX/XXXX, merchant payment processing services were established for the business XXXX XXXX XXXX and XXXX XXXX through Heartland Payment Systems, which operates under XXXX XXXX XXXX. The relationship was initiated after the merchant was referred to XXXX through a banking relationship with XXXX XXXX Bank. The merchant account was created for the purpose of allowing the accounting and tax preparation business to accept electronic payments from clients. Beginning XX/XX/XXXX, the owner of the business began preparing operational infrastructure for the XXXX tax filing season. This preparation included purchasing and configuring tax preparation software, accounting systems, payment processing systems, and related operational workflow infrastructure required to serve tax clients. As a small woman-owned accounting practice, the majority of annual revenue is generated during the tax filing season, making advance preparation critical to business operations. Approximately forty hours per week were devoted to preparing systems between XX/XX/XXXX and XX/XX/XXXX, representing approximately XXXX hours of preparation. Beginning XX/XX/XXXX, multiple withdrawals associated with Heartland merchant processing activity began appearing in the operating account used by the business. These withdrawals included debits of {$610.00} on XX/XX/XXXX ; {$600.00} on XX/XX/XXXX ; {$600.00} on XX/XX/XXXX ; {$98.00} on XX/XX/XXXX ; {$600.00} and {$600.00} on XX/XX/XXXX ; {$600.00} on XX/XX/XXXX ; and a chargeback debit of {$840.00} on XX/XX/XXXX. These transactions were not authorized by the merchant. The fraudulent activity was reported to the bank on XX/XX/XXXX. Subsequent communications with Heartlands fraud investigation personnel confirmed that unauthorized activity had occurred on the merchant account. Written correspondence from a Heartland Risk Investigator stated that fraudulent sales and refunds had been processed using credentials associated with the merchant account and that the activity was believed to have occurred through exposure of an API key linked to the account. In a later communication, Heartland indicated that the exposed API key was believed to have been inadvertently exposed through a third-party technology vendor environment associated with the payment processing infrastructure. The merchant did not provide API credentials to any third party and does not operate an online payment portal capable of exposing such credentials. Because the merchant processing system could no longer be trusted to securely process payments, the business was forced to discontinue using the Heartland payment platform and migrate to a new payment processor and new software infrastructure during the beginning of tax season. This emergency transition significantly disrupted the firms ability to invoice clients, collect payments, and operate normally during the busiest operational period of the year. In addition to the financial withdrawals themselves, the business owner has spent more than 142 hours investigating the incident, reviewing transaction records, communicating with Heartland Payment Systems and the bank, filing a police report documenting the fraudulent activity, and reconstructing financial records. The incident caused significant operational disruption to the business during tax season and resulted in financial harm associated with unauthorized debits, chargebacks, bank fees, and the time required to investigate and correct the issue. The matter also raised serious concerns regarding the security of merchant credentials managed by Heartland Payment Systems and the controls in place to prevent unauthorized access to merchant processing infrastructure. Specifically, the exposure of a merchant API credential through a vendor environment suggests weaknesses in credential management, monitoring, or access controls within the payment processing system. The merchant is requesting a full explanation of the security incident, identification of the third-party vendor referenced in the investigation, confirmation that the exposed credentials were secured, reimbursement of unauthorized transactions and related financial losses, and confirmation that corrective actions have been implemented to prevent similar incidents from affecting other merchants. They swiped at me like I was a bug and ignored my complaints. This should be illegal, I am a small business owner and it makes me so upset to think that I got taken out by three XXXX. Help please.After all of this they had the nerve to bill me XXXX dollars last month and XXXX dollars this month. And the bank did not protect me either.

Company response to consumer: Closed with explanation