It already has been:
Earlier this year, a single seller cost the company approximately $5.7 million, Square revealed.
“In the three months ended March 31, 2015, we recorded a loss of approximately $5.7 million related to fraud by a single seller using our payments services,” Square noted in the filing.
That’s a lot of money to lose from just one seller. Square did not provide any more details about the incident, but noted that its service is particularly vulnerable to abuse.
“The highly automated nature of, and liquidity offered by, our payments services make us a target for illegal or improper uses, including fraudulent or illegal sales of goods or services, money laundering, and terrorist financing. Identity thieves and those committing fraud using stolen or fabricated credit card or bank account numbers, or other deceptive or malicious practices, potentially can steal significant amounts of money from businesses like ours,” Square said.
And when bad things happen, Square acknowledged that it can be the one left holding the bag:
“When our products and services are used to process illegitimate transactions, and we settle those funds to sellers and are unable to recover them, we suffer losses and liability.”
The chargeback risk
This may not be that different from the kinds of risks that other financial transaction and payments companies are exposed to. Here’s more detail about how Square can end up on shouldering the cost of fraud and billing disputes (emphasis ours):
We are currently, and will continue to be, exposed to risks associated with chargebacks and refunds in connection with payment card fraud or relating to the goods or services provided by our sellers. In the event that a billing dispute between a cardholder and a seller is not resolved in favor of the seller, including in situations where the seller engaged in fraud, the transaction is typically “charged back” to the seller and the purchase price is credited or otherwise refunded to the cardholder. If we are unable to collect chargeback or refunds from the seller’s account, or if the seller refuses to or is unable to reimburse us for a chargeback or refunds due to closure, bankruptcy, or other reasons, we may bear the loss for the amounts paid to the cardholder.
A little more color on chargebacks:
When a a person notices a charge for something on their bank statement that they didn’t purchase, they call their credit card company. That person generally gets their money back right away. The credit card company, however, then contacts the processor (in this case, Square), and so begins a complicated documentation process to determine whether or not the seller who handled the fraudulent charge should be held responsible. If Square is unable to get a refund from the sellers account for the reasons above, Square will have to pay.
A change happening this October could make this problem even worse.
On October 15, all businesses will have to start using card readers that can process EMV “chip cards.” Newer models of Square’s card readers do accept chip cards, but older ones don’t. Any seller that doesn’t use a chip card reader will be held financially responsible for fraud that goes through their system.
That’s more risk for sellers, which also translates to more risk for Square. Worst case scenario, card networks could fine Square and increase their transaction fees (again, emphasis ours):
This will shift an increased amount of the risk for certain fraudulent transactions from the issuing banks to these sellers, which may result in our having to seek an increased level of reimbursement for chargebacks from our sellers that do not deploy EMV compliant card readers. Our financial results would be adversely affected to the extent these sellers do not fully reimburse us for the related chargebacks. We do not collect and maintain reserves from our sellers to cover these potential losses, and for customer relations purposes we sometimes decline to seek reimbursement for certain chargebacks. The risk of chargebacks is typically greater with those of our sellers that promise future delivery of goods and services, which we allow on our service. If we are unable to maintain our losses from chargebacks at acceptable levels, the payment card networks could fine us, increase our transaction fees, or terminate our ability to process payment cards. Any increase in our transaction fees could damage our business, and if we were unable to accept payment cards, our business would be materially and adversely affected.