PayThink Merchants and acquirers need to be wary of charity payment fraud

One of the major characteristics of any fraud is that it is opportunistic. New technologies, new apps or new payment methods are often hit within moments of general release. With many systems affected before they even get that far. This “opportunism” also applies to fraud in times of crisis. Whenever there is a large event, global or local, there is almost certainly a fraudster looking to exploit it.

The increase in cybercrime, health care and insurance fraud during the COVID-19 global pandemic has been widely reported. With reports of card testing on bank identification number (BIN) lists also increasing, it seems like fraudsters have nothing better to do than test cards and their vulnerabilities.

One area of fraud that is often underreported, and therefore missed, is charity fraud. This type of fraud actually has been around for generations. It was previously easy to purchase a collecting tin and roam the streets raising money for a fake cause; or set up sponsorships for charitable challenges and events that would never happen. However, there have been significant advances in charity fraud’s scale and sophistication. Lockdown and COVID-19 have only accelerated things and highlighted the risks, particularly as we move toward a cashless society and online payments become the new normal.

From the bushfires in Australia, to the COVID-19 global pandemic and equality movements taking place across the globe, each of this year’s major events has increased the need for fundraising and online donations, with donations to certain charities increasing 355% when comparing March to the first two months of 2020. With this increased attention and funding, we have seen cases of charity fraud rise exponentially.

The most common type of charity fraud is False or Fake Charity Fraud, which involves a fraudster registering a fake charity or renaming an existing business to mimic and reflect a charity and registering the fake entity with an acquiring merchant.

In some cases, fraudsters will only register the company if it is necessary to gain a company identification number, while others will have created fake identities. Because these are standard forms, the charity registration number is often not needed as proof, nor is the MCC code, part of the “High Risk” MCC codes for acquirers.

This combination of factors means that it can be very easy to register a false charity with an acquirer capable of processing online or card-not-present, mail / telephone order (MOTO) payments – which have been particularly popular during the COVID-19 pandemic, where physical payments were not possible, or at least restricted.

Once the false charity has been set up through a payment channel, it is as simple as registering a website with the payment link and pulling together some small advertisements. The scam tricks people into thinking the request to donate is relevant to a current cause, while any funds are going straight into the false account and can be spent elsewhere.

At the beginning of the year my team and I advised one of our clients that we were likely to see an increase in charity fraud due to the ongoing Bushfire crisis in Australia. Within days of our warning there were reports of charities being created to raise funds for rescuing Koala bears. Further research showed that one charity had no website and was not on the list of Australian registered charities. The false charity was advertising extensively on Facebook and raising sizeable amounts of money. Fortunately, this charity was quickly identified as being fraudulent and restricted from trading, however there have been reports of several more false charities that were set up during this time and continue to operate.

During the COVID-19 pandemic, there has been a much wider array of information shared regarding charity scams and fraud. Scams have ranged from false, pseudo-scientific charities raising money for “cures” or “medical research,” to fraudsters preying on individuals who want to donate to medical and emergency staff in hospitals or other care facilities.

There have been numerous reports of potential charity scams in the wake of the Black Lives Matter (BLM) and equality movements too. One well-documented case, which turned out to be a case of mistaken identity, rather than fraud, saw a local Los Angeles-based charity, with a similar-sounding name to BLM, raise over $4 million, before realizing there had been a mistake and the new funds were not intended for them. The incident clearly demonstrated how having a name close to that of an existing charity can lead to confusion among donors and potentially an influx of donations.

It requires extra vigilance to avoid falling for, and donating to, any scams or false charities. Whenever a charity is advertised on social media or other website, we should not click the link provided, but manually search for the charity’s website. If it has one, we should check the charity code against any state or national registry of charities, to see if the charity is present and still active.

We need to be aware of suspicious methods of payment, with merchants requesting payments solely by wire transfer or gift card being more suspect that those requesting card or direct debit payments.

To prevent fraud occurring from an acquirer perspective, further checks need to be carried out on the merchant name during onboarding, as well as ensuring coverage in fraud prevention systems for any charities that have been set up recently.

Historically it has been viewed as immoral to have extensive checks on charitable companies, however with the increase in charity fraud during 2020, there must be stricter rules for charity monitoring. Typically, false merchant fraud shows a “bust-out” strategy to try and get as much as possible in as short a space of time, therefore monitoring recently registered charity merchants can improve fraud monitoring.

Donating to charities, particularly during global events, is as important as ever. We should continue to give; however, we need to be careful and check who we are donating to, and if we see any suspicious charities, we need to report them to our local fraud awareness and prevention groups.