A potential ‘merchants beware’ credit card fraud scheme is making the rounds in Montreal.
The owners of pet store chain Safari Pet Centre said they've been had on multiple occasions, and that despite making police reports and submitting video surveillance evidence, Visa is refusing to reimburse the stolen funds.
Darlene and Robert Mullan say in their many years of business, they were never aware of so-called ‘forced post-purchases.’
When a purchase is made and the card is blocked or refused, the card owner may call the bank to get an authorization code to force the purchase.
In July several men interrupted the cashiers at the pet food store as they made those calls after attempting to buy a parrot and dogs.
“The man had told them I'm over my limit, just punch in these four numbers and you'll get an approval,” said Darlene Mullan.
Only later did the Mullans read the fine print on the receipt. At first glance, the receipts look like approvals - but they aren't.
The letters FP are printed on it, which stand for ‘forced posting.’
The Mullens first went to Longueuil police, then to Visa expecting a refund. Visa, however, told them since the cashier didn't call the bank for authorization, they're liable.
Robert Mullan doesn’t agree.
“The idea of punching in four numbers and its being accepted, it's ludicrous, it's wrong. They have a glitch in their system,” he said.
Credit card security expert and Ecole Polytechnique professor Jose Fernandez agrees.
“The problem here is the code was generated by the fraudsters. That is the bug in their system - that's actually a configuration option called a ‘soft accept,’ which is really for merchants who are somewhere on an island and have no access to phone. But why was that option on in a merchant in Quebec,” said Fernandez.
The reason it's so easy to exploit, he said, is because swipe purchases are still allowed instead of the more secure chip and PIN system.
Visa, however, said its system is solid.
“This issue about forced posting is about educating merchants on proper acceptance when it's not a chip and PIN transaction. In the consumers’ case they're protected from liability, but in this case with forced posting, it falls back on the merchant,” said Gord Jamieson, head of risk services for Visa Canada.
In this case, the Mullans know they'll never see their animals or money again. They say they’re upset their banks didn't tell them about this until it was too late.
In the meantime, they're warning their cashiers to be on the lookout and are advising other businesses too.
“It's hurting the retailers and the retailer needs to have Visa, needs to have Mastercard, needs to have all these things,” said Robert Mullan.
