Invest1 publisher2 min readPublished
Credit union alleges Fiserv's call center switched stolen cards back on for fraudsters
FiCare Federal Credit Union alleges Fiserv's call center unblocked stolen cards for fraudsters, citing at least 18 fraudulent transactions in August. The number on the card is Fiserv's, so FiCare is using court discovery to learn how its members' fraud blocks get lifted.
The Investor · Invest desk
What happened
- FiCare Federal Credit Union of Florida alleged in court this week that fraudsters called Fiserv's card-fraud service line and talked agents into turning stolen cards back on.
- A sworn declaration from FiCare executive Ashley Magill says at least 18 fraudulent transactions hit FiCare cardholders in August after such calls.
- The motion says Fiserv checks callers with a Social Security number and card-face details such as the expiration date and security code, with no multi-factor authentication as far as FiCare knows.
- Magill's declaration names five other credit unions, including MERCO and Galaxy, that reported the same problem to Fiserv.
- Fiserv's answers to FiCare's discovery requests are not due until Oct. 19, and Fiserv declined to respond sooner, according to the motion.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- exposure A credit union that hands fraud blocks to Fiserv learns how its members' cards get unlocked only from what Fiserv chooses to disclose, or, in FiCare's case, from a lawsuit.
- decision Other clients on the same line can press Fiserv for multi-factor checks now, as Magill says Choice One did, instead of waiting for the Oct. 19 answers.
- cost Once someone says who absorbed the August losses, other Fiserv clients will know whether a call-center lapse costs them or the processor; credit unions are about a third of Fiserv's roughly 10,000 clients.
The phone number printed on the back of these cards belongs to Fiserv. According to FiCare's motion, Fiserv blocks a card when it suspects fraud, and the cardholder-services center reached through that number is where a customer calls to have the block lifted [6]. For a FiCare member, a Fiserv agent working from Fiserv's questions is the one who undoes the fraud control [6][9].
FiCare can describe that process only from outside it. On Sept. 17 the credit union served discovery asking Fiserv to admit that the center lifts a block without a one-time passcode or any other multi-factor check [15]. Magill learned of the five other incidents through an email listserv [12], and by her account MERCO reported that the center was not sending PINs to verify callers [13].
The cash is harder to trace. The declaration does not put a dollar figure on the 18 August transactions or say who absorbed the losses [7][8]. Six credit unions (FiCare and the five Magill names) come to about 0.18% of the more than 3,330 credit unions Fiserv serves [1][4]. That share counts only institutions that spoke up on one listserv [12], so it is a minimum.
The Oct. 19 answers can go three ways. Fiserv could show a step-up check the motion missed, such as a one-time passcode, and the 18 transactions would need another explanation; that would sink FiCare's account of the call center. It could admit to knowledge-based verification alone, and the fight moves to how losses split between a processor and the institutions whose cards its agents unlocked. Or the court could leave the deadline where it is. The line would then run unchanged for the 20 days between the Sept. 29 ruling date FiCare asked for and Oct. 19 [3], and the credit union says the fraud continues meanwhile [17].
I think the knowledge-based allegation is the likelier to hold up. Two of the questions the motion lists, the expiration date and the security code, are printed on the card a thief is holding [9], and FiCare argues Social Security numbers are no longer secret [10]. The counter-case is that FiCare is describing another company's process from outside it, and neither Fiserv nor the other credit unions has confirmed the listserv reports [12]. No court has ruled on any of it [3].
A Fiserv employee replied to the listserv emails on Sept. 16 [14], a day before FiCare served its requests [15]. The response window Fiserv is keeping runs 32 days [2].
What to watch
- Whether the court rules by Sept. 29 to shorten Fiserv's Oct. 19 deadline for answering FiCare's discovery requests.
- Fiserv's answer to the request that it admit its call center lifts fraud blocks without a one-time passcode or other multi-factor check.
- Whether Fiserv or any of the five named credit unions confirms the listserv reports or puts a dollar figure on losses.