An Orange County salon had nearly $40,000 in losses from a completely avoidable theft.
You see, this garbage person didn’t go for the cash register, they went for something else.
Thieves aren’t stupid. They know that merchants are taking 90-100% of their revenue electronically and the opportunity to snag a register full of cash is one that went away even before the Covid nonsense.
Security footage from The Grand salon in downtown Brea showed the thief entering the store and instead of going to the cash register, they went for the payment processing terminal. The theft, while non-traditional, was completely avoidable – I’ll tell you how in a second, but first, let’s discuss what the thief did.
They snagged the payment terminal and then, from the comfort of their own home or some other location, they proceeded to electronically steal money in a very difficult to trace way. For those of you who are concerned that this information could be used for new would-be theives to do the same thing and are mad at me for explaining it… tough. First, not too many people (😢) read this. Second, it’s avoidable and if you’re worried about it, you can just process with me and I’ll prevent this from happening.
How This Thief Stole $40,000 from The Grand salon in Brea
In payment processing there are sales and there are refunds. When you make a sale, the balance is deducted from the available balance linked to the card. For a debit card it comes out of your bank account. For a credit card it goes against the account spending limit. For a gift card, it goes against the ledger balance available.
Refunds work in reverse. Pretty simple, right?
This thief used prepaid Visa cards. When you issue a refund to a Visa gift card, it increases the available balance.
They grabbed the credit card terminal and proceeded to process several refunds to prepaid Visa cards and then, we assume, they used those cards at other establishments in the area or more likely, purchased goods online. If they bought locally, they probably masked up like a good little sheeple so they could protect their health (🙄) while hiding their face from security cameras.
How to Avoid Refund Theft
That’s what they did. Frankly, it’s pretty smart. It’s hard to trace, and the opporutnity size is much larger than a cash drawer.
Unfortunately, this merchant’s processor is inept – like completely.
Earlier I discussed refunds and how they impact different card types. There are two ways to keep this from happening and it’s embarrassing that this merchant’s payment processor didn’t enable these settings:
- First, you ALWAYS have a manger password enabled for refunds. Yes, ALWAYS. This way, unless that person is given the password, they can’t issue a refund. Can that create another step during a busy day? Yes. Can it prevent theft like this? Yes, unless they’re an employee who has the password – proceed to #2.
- Second, we ALWAYS disabling unreferenced refunds. If it’s an old terminal that’s out of date, we replace it. If it’s a virtual terminal, smart terminal, or gateway linked device, we disable it on the back end. Also, our processing accounts have risk flags for unreferenced refunds above a total threshold. An unreferenced refund is a refund amount that is not linked to a sale on that specific card. If I walk in and purchase $10 with my Visa card ending in 2009 then the most I can have refunded to that card is $10. Otherwise, it is unreferenced and it will fail. The only time I enable unreferenced refunds is in the first week of a business going live with me. I’ve made exceptions in the past for merchants with a longer receivables cycle, but again, that’s a conversation they have with me and something we still monitor aggressively. See #3 below.
- Third, we have negative batch flags in place. We place automatic risk holds on negative batches. If you meant to do it, no problem – you can tell me that yourself.
Y’all think that your bank is a good partner for payments. You’re wrong.
Bankers wouldn’t know what #2 or #3 are. They’re not experts, they’re not trained and frankly, they’re not focused on payments.
I’ve trained hundreds of not over 1,000 payment processing salespeople and sadly most of them wouldn’t know this because they washed out too quickly or didn’t take this seriously as a career. You would be shocked at how many people treat this as a side hustle and not their occupation.
Kick them to the curb and upgrade your partnership.
