The CB Surety plea puts merchant monitoring, not onboarding, in the enforcement frame

The tell sits in the acquirer's own data. Sham sales funded from prepaid debit cards and posted a few dollars at a time push a merchant's transaction count up while its average ticket falls ^[6]. Visa and Mastercard already require acquiring banks to watch for abnormal spikes in a merchant's transaction count, and federal examiners list chargeback history among the things a bank should understand about a payment processor, according to American Banker ^[9]. Those expectations were in force for the entire run of the service.

Do the arithmetic on the plea's own figures and the chargebacks come to roughly 1.9% of the money pushed through the accounts ^[1]. The denominator is the trick: the fabricated sales are inside it, so each client's real dispute rate was worse than the file showed. The size of the fabrication did not have to be dramatic. Average chargeback about $102, average refund about $56 ^[3], against charges initiated in single-digit dollars ^[6].

Spread across the roughly 81 months Eide admitted selling the service, the traffic averaged about $1.37 million and about 260 chargebacks a month ^[4]. That is not a spike an exception report would have to be lucky to catch. It is a standing condition.

The ratio matters because it is a credit gauge, not a hygiene metric. A merchant account works as a line of credit, and when a merchant will not or cannot repay the refunds its customers are owed, the bank that signed it up absorbs them ^[10]. Card networks fine banks whose merchants let the number climb, which is why banks close those accounts, and CB Surety sold a way to avoid the closures ^[11]. Suppress the ratio and you have changed both the closure decision and the collateral the bank thought it needed.

The onboarding half of this is the familiar half. Co-conspirators recruited straw owners for shell companies the clients actually controlled, and propped up the applications with fake websites and fake contracts, according to the U.S. attorney's announcement of the plea ^[8]. That is a one-time failure per account, and the Corporate Transparency Act registry was built to pierce exactly that kind of ownership ^[12]. The second service was different: per the plea agreement, CB Surety sold access to accounts its clients could not get, then sold them a way to keep them ^[3], and the keeping ran on a recurring basis ^[7]. Recurring revenue on one side of the invoice is a recurring control failure on the other. An attorney for Eide declined to comment ^[13].