A merchant services scam is a scheme that exploits how your business accepts card payments, typically to overcharge you or steal your sensitive information.
For many businesses, the first warning sign isn’t a suspicious website or email. It’s an unsolicited phone call from someone claiming to be your payment processor. They may say your rates are increasing, that your account needs urgent attention, or that they can save you money if you act immediately.
This guide explains the most common merchant services scams, how to tell a fake representative from a legitimate one, how to verify who’s really contacting you, and what to do if you’ve been targeted. You don’t need to be a payments expert to protect your business; you have to recognize the pattern.
Key Takeaways
- The most common merchant services scam starts with an unsolicited phone call from someone claiming to be your payment processor or warning that your rates are about to increase.
- Never sign a contract, make a payment, or share sensitive account information during an inbound call. Hang up and verify the request using your processor’s official contact information.
- Legitimate payment processors clearly identify themselves, communicate important account changes in writing or through your customer portal, and don’t pressure you to act immediately over the phone.
- Hidden fees often show up in the fine print. Review processing agreements and check your monthly statements for unexpected charges.
- If you believe a scam has targeted you, report it to the FTC, the FCC (for scam calls), and your state’s consumer protection office to help protect your business and others.
What Is a Merchant Services Scam?
A merchant services scam is any scheme that tricks businesses into paying unnecessary fees, signing misleading processing agreements, or handing over sensitive financial information. While some scams target your money directly, others rely on deception by impersonating a legitimate payment processor or using misleading sales tactics to get access to your account.
Merchant services scams aren’t rare. According to the Better Business Bureau, nearly 80% of businesses experienced attempted fraud, and more than 60% reported being targeted by scammers in 2024. The methods vary, but the goal is the same: trick businesses into handing over money or sensitive information.
These scams generally fall into three categories: hidden or misleading pricing, impersonation of a legitimate payment provider, and outright theft of sensitive business or payment information. Within these three categories, there are five specific forms that these scams take: merchant-services scam calls, hidden-fee scams, fraudulent merchant scams, identity-theft scams, and backdoor scams. Each works differently, but they all rely on creating urgency, confusion, or false trust to convince business owners to act before verifying the facts. We’ll go over these specific types of scams in more detail in the following sections.
Merchant Services Scam Calls
Merchant services scam calls are the most common way scammers target businesses. The caller often claims to be from “your current processor” or says that your processing rates have increased, that your account needs updating, or that you’re eligible for lower fees. They’re looking to create urgency, so you’ll share account information, sign paperwork, or switch providers without ever verifying who you’re talking to.
If you’ve ever wondered, “Why do I keep getting calls from merchant services?” the answer is simple: if your business accepts card payments, you’re a target. Business contact information is widely available through public records, business directories, and lead lists that are bought and sold throughout the payments industry. Legitimate sales organizations use these lists for prospecting, but scammers use them too.
Many scam calls follow a familiar script. The caller ID may say “merchant services,” or you may receive an after-hours voicemail, sometimes dropped straight into your inbox without your phone ringing, urging you to call back immediately. The caller might refuse to identify their company, insist your rates are about to increase, or pressure you with a limited-time offer that expires today. Some go a step further, warning that if you don’t call back, your silence will be treated as acceptance of the new, higher rates. This is a bluff designed to panic you into responding. If someone won’t tell you exactly who they work for, that’s one of the clearest signs you’re not dealing with a legitimate representative.
Red flags and signs of a fake representative
A few behaviors reliably separate a legitimate representative from someone fishing for your information. Here’s what to watch for, alongside what a real processor does instead.
| Red flags | Green flags |
| Won’t identify their company by name | Clearly states the company they represent |
| Claims to be “your processor” without identifying the account | References your existing account and identifies themself |
| Pressures you to sign or pay immediately | Gives you time to review information and ask questions |
| Asks for bank account, card, or login information over an inbound call | Never asks you to re-share sensitive financial information during an unsolicited call |
| Claims your rates are increasing and demands immediate action | Communicates pricing changes in writing or through your customer portal |
If you’re ever unsure whether a caller is legitimate, don’t rely on the phone number they provide. Hang up and contact your payment processor using the phone number listed on your statement, your customer portal, or the company’s official website. That’s the quickest way to separate a real representative from a scammer, and it’s exactly how legitimate processors expect you to verify their identity.
Other Common Merchant Services Scams to Watch For
Aside from phone calls, merchant scams can also take place during the sales process. There are also scammers who appear after you’ve signed up or target your business information directly. Consider the following.
The hidden fees scam
This is one of the most common scams businesses encounter during the sales process. As its name suggests, the hidden fee scam involves false or misleading pricing information. In this scam, a legitimate provider will quote your business an impressively reasonable rate for their services.
Once you’ve signed up and started processing, the provider will start adding hidden fees or charges to your account that were not previously disclosed. Many victims of this type of scam don’t realize they are being charged extra fees for several weeks, months, or even longer. If you’re not careful, you might be locked into a lengthy contract or at risk for hefty cancellation fees by the time you catch on to the scam. Either way, the provider makes a fortune, and you’re stuck paying for something you never wanted.
Here are a few tips to help you avoid falling victim to the hidden fees scam:
- Always ask for an itemized list of pricing and fee percentages when considering a merchant services provider.
- Read your merchant agreement very carefully before signing. If your business has legal representation, ask your attorney to review the agreement as well.
- When your merchant statement (or credit card processing statement) arrives, read it over thoroughly and make sure you understand each line item. If you need help deciphering something, reach out to your provider.
The fraudulent merchant scam
Another scam to watch for when researching new providers is the fraudulent merchant scam. This is not as common as the hidden fees scam, but it is still a threat to businesses and livelihoods. When running this scam, an individual or group will craftily create a fraudulent “company” that appears to be a legitimate merchant services provider. They’ll usually draw your unsuspecting businesses in with an online ad for free or incredibly inexpensive merchant services. The deal sounds too good to be true, so you fill out a short online form to get more information. The phony provider will then reach out to you with a high upfront cost disguised as an initial deposit. Once you pay this fee, the “provider” disappears with your hard-earned money.
Keep that money where it belongs. Here are some tips for avoiding the fraudulent merchant scam:
- Always do your research. Look for the provider’s website, customer reviews, and profiles with reputable sources like the Better Business Bureau. If you can’t find any such online presence, you may have discovered a scammer.
- Be wary of companies that advertise on social media and through search engines but lack an established reputation. Trust your instincts. If something seems off, it probably is.
- If the provider’s website is hosted on a subdomain (i.e., domain.com/merchant provider), it is most likely a scam.
The identity theft scam
Identity theft scams focus on stealing your business’s financial or account information rather than selling you a processing service. A scammer may impersonate your processor, send a phishing email, or direct you to a fake login page to collect banking details, account credentials, or tax information.
These tactics are increasingly common. In 2023 alone, the FTC received more than 330,000 reports of business impersonation scams, making them one of the most frequently reported types of fraud.
Here are some tips to help you protect your identity and avoid getting tangled up in an identity theft scam:
- Inspect links and email addresses before entering anything. Hover over links to confirm they lead to the provider’s official domain, and be suspicious of login pages reached through an email or ad rather than one you navigated to yourself.
- Never enter banking credentials or tax information in response to an unsolicited message, even if the page looks legitimate.
- Find out which banks the provider claims to do business with and contact those banks to confirm that the provider is legitimate.
The backdoor merchant services scam
This scam is the least common, but the most threatening. If your online business is the victim of a backdoor scam, the livelihood of you and your entire customer base could be at risk.
The backdoor merchant services scam paves the way for card-not-present fraud. Here’s how it works: a hacker edits the source code of your payment gateway to allow third-party access (a.k.a. the backdoor). Once your gateway has been compromised, the hacker can access your customers’ confidential card information, redirect payments to an unauthorized account, and even potentially access your financial information.
Depending on the security measures you have in place, your business could be liable for any compromised or stolen customer card information. The good news is that today’s payment gateways are highly advanced. It would take a professional hacker to compromise your payment gateway. However, these scams do still happen and can cause irreparable damage to any business.
Here are a few ways you can protect your business and customers from a backdoor scam:
- Make sure the merchant services provider you choose is PCI-Certified and requires their customers to maintain PCI compliance.
- Choose a provider who offers chargeback monitoring and assistance as an added security measure.
- Make sure your website is protected by a security service that performs regular scans for malware or vulnerabilities that could compromise your business.
How Legitimate Processors Contact You
A legitimate payment processor won’t expect you to make important account decisions during an unexpected phone call. While providers may contact you by phone, email, or mail, they’re always upfront about who they are and why they’re reaching out. They also give you a way to verify the communication through your existing account or their official support channels. Important changes, such as pricing updates or account notices, are typically delivered in writing, through your customer portal, or by a named account representative.
One of the biggest differences between a legitimate representative and a scammer is how they handle sensitive information. A real payment processor may ask you to verify basic account details. Still, they wouldn’t require you to read your full bank account number, your full payment card number, or your online account credentials over the phone during an unsolicited inbound call. If a caller insists you do, end the conversation immediately.
If you receive an unexpected call about your merchant account, take a minute to verify who you’re talking to before taking any action, with these steps:
- Ask for the company’s full legal name. A legitimate representative should be able to tell you exactly which company they work for. Be cautious if they only say “merchant services” or claim to be “your processor” without identifying themselves.
- Hang up and call the official support number. Get in touch using the customer service number listed on your merchant statement, your payment processor’s website, or your customer portal.
- Verify the company online. Check that the representative’s email comes from the company’s official domain, and look up the business on the Better Business Bureau to confirm it matches the company they claim to represent. Searching the company name along with terms like “scam” or “complaint” can also reveal patterns of fraudulent activity.
- Confirm any claimed rate changes yourself. If someone says your processing fees have increased, compare the claim against your latest merchant statement or contact your processor directly.
Taking a few minutes to verify a caller’s identity can prevent headaches from merchant scams. Also, note that while scam calls are the tactic most merchants encounter first, they’re only one way fraudsters target businesses.
What to Do If You’ve Been Scammed
If you think you’ve fallen for a merchant services scam, act quickly and take these steps.
- Contact your payment processor immediately. Let them know what happened and ask them to review your account for unauthorized changes or suspicious transactions.
- Cancel or secure any exposed accounts. If you shared bank account information, payment card details, passwords, or other sensitive credentials, contact your bank and card issuers right away. They can help freeze or replace affected accounts and monitor for unauthorized activity.
- Document everything. Save emails, contracts, invoices, voicemails, text messages, screenshots, caller IDs, and any notes from your conversations. Having a clear record can help your payment processor and law enforcement investigate what happened.
- Notify your legal or compliance team, if applicable. If your business has in-house counsel, outside legal counsel, or a compliance officer, involve them early. They can help determine whether you have contractual obligations, reporting requirements, or potential legal remedies.
Once you’ve secured your accounts, report the scam to the appropriate authorities:
- Federal Trade Commission (FTC): Report scams, fraud, and deceptive business practices at ReportFraud.ftc.gov. The FTC uses these reports to identify patterns, investigate scammers, and coordinate enforcement actions.
- Federal Communications Commission (FCC): If the scam involved unwanted or spoofed phone calls, file a complaint with the FCC to help combat illegal robocalls and caller ID spoofing.
- Your state attorney general or consumer protection office: Many states investigate deceptive business practices and may be able to assist with complaints or enforcement actions.
- Better Business Bureau (BBB) Scam Tracker: Submitting a report helps warn other business owners about the scam and creates a public record that others can search.
Reporting a scam may not immediately reverse the damage, but it provides regulators and law enforcement with valuable information that can help identify repeat offenders and protect other businesses. If unwanted merchant services calls are the problem, there are also practical steps you can take to reduce them before they reach you.
How to Stop Merchant Services Scam Calls
While you may not be able to eliminate merchant services scam calls entirely, you can make your business a much harder target by following a few simple practices.
- Register any personal cell numbers you use for business on the National Do Not Call Registry. Note that dedicated business lines themselves aren’t eligible
- Use your phone carrier’s call-blocking and spam-filtering tools
- Don’t engage with suspicious callers
- Report repeat scam calls to the FCC
Businesses are also protected under the Telephone Consumer Protection Act (TCPA), which limits certain telemarketing calls and the use of automated dialing systems and prerecorded messages. While scammers don’t always follow the law, reporting violations can help regulators identify and investigate illegal activity.
The best long-term defense, however, starts before the phone ever rings. Choosing a transparent payment processor with clear communication practices can help you avoid the uncertainty that scammers rely on in the first place.
Choosing a Merchant Services Provider You Can Trust
The best way to protect your business from merchant services scams is to work with a payment processor you chose on your terms, not one that contacted you unexpectedly. Look for providers that offer transparent, itemized pricing, identify their support team by name, communicate important account changes in writing or through a secure customer portal, and never rely on high-pressure sales tactics.
That’s the standard Kurv aims to uphold. With transparent pricing, secure account management, and a U.S.-based support team, you’ll always know who you’re working with and where to turn if you have questions. When your payment processor is easy to verify, scammers have a much harder time impersonating it.
Ready to Grow Your Business?
Apply and start accepting payments within a day
Frequently Asked Questions
Why do I keep getting calls from merchant services?
If your business accepts credit card payments, your contact information may be included in business directories or lead lists that are sold to payment providers and sales organizations. While some of these calls come from legitimate sales teams, scammers also use these lists to target businesses.
How do I know if a merchant services call is a scam?
Be cautious if the caller won’t identify their company, claims to be “your processor” without specifics, pressures you to act immediately, or asks for bank account, card, or login information over the phone. If you’re unsure, hang up and contact your payment processor using the official number listed on your statement or in your customer portal.
How do legitimate merchant services companies contact you?
Legitimate payment processors clearly identify themselves, communicate important account updates in writing or through your customer portal, and give you time to verify any requests. They don’t rely on high-pressure tactics or ask you to share sensitive financial information during an unsolicited phone call.
Where do I report a merchant services scam?
Report scams to the Federal Trade Commission (FTC) at ReportFraud.ftc.gov. If the scam involved unwanted or spoofed phone calls, you can also file a complaint with the Federal Communications Commission (FCC). Depending on the situation, you may also want to notify your state attorney general or consumer protection office and submit a report to the Better Business Bureau (BBB) Scam Tracker.
Is it safe to sign a new processing contract over the phone?
No. A legitimate processor will send the full agreement in writing — by email or through your customer portal, or go over it with you in person — so you can review the pricing, fees, and terms before you sign. What they won’t do is pressure you to commit on the spot during a phone call.
