Paul Paolucci, the top cop for one of the world’s biggest credit card companies, sure had some interesting friends.
One made a fortune fronting for pornography websites that needed access to Mastercard’s and Visa’s payment networks. Paolucci, who oversaw Mastercard’s merchant fraud control, was photographed cavorting around the Las Vegas Hard Rock Hotel with him and a group of women in white corset minidresses.
A second was a Lamborghini-driving e-commerce mogul with whom Paolucci used to celebrate family holidays. The mogul ended up in prison for a financial crime he committed, in part, using Mastercard’s network.
An executive at a famously corrupt European bank claimed to have dined with Paolucci and gotten his help evading Mastercard’s regulations.
It was Paolucci’s job to make sure that the banks and companies using Mastercard’s network were playing by the rules. He bent those rules himself by getting close to the very kinds of high-risk businesses he was supposed to be watching like a hawk — so close, in fact, that they sometimes seemed to be working together. Eventually, one of those friendships led him to break the rules entirely, and it cost him his job. But though Paolucci crossed a line, for Mastercard — and its global rival, Visa — a permissive relationship with fraudulent, exploitative, or in some cases even criminal enterprises is no exception. It’s the norm.
A yearlong BuzzFeed News investigation reveals that both Mastercard and Visa, which together process three-quarters of all US credit card payments, move money for businesses with extensive records of fraud — making it possible for them to keep swindling customers, sometimes for years. The credit card giants collect a percentage of every sale, legitimate or not.
BuzzFeed News’ review, based on tens of thousands of pages of court records, confidential investigative reports, secret recordings, internal company records, and more than 120 interviews, shows how Mastercard and Visa continue to accommodate thousands of businesses that have been flagged for issues including lying to customers, lying to banks, and breaking the law.
As credit cards have become an essential part of global commerce, they have also become a common tool for fraud, with scammers on every continent using the card networks to sell fake miracle cures, multilevel marketing schemes, bogus educational opportunities, and pump-and-dump investment scams on a massive scale.
Both credit card giants have the prerogative to kick scammers off their grids, effectively blocking them from a huge share of potential customers. Mastercard even maintains an extensive database of companies that have gotten in trouble at other financial institutions. Yet both companies say that locking out crooks and other bad actors simply isn’t their job. A Visa executive testified that the card company doesn’t think it’s worthwhile, since it would be possible to circumvent. Mastercard has locked companies out on occasion, but typically after intense public scrutiny.
The card companies also have the prerogative to cut off banks that handle fraudulent transactions, but they almost never choose to do so. Mastercard told BuzzFeed News it “does levy financial penalties and has suspended or terminated the license” of banks “based on specific incidents.” It declined to say what they were. As for those fines, the banks typically pass them along to the offending companies, which may simply shrug them off as a cost of doing business.
And the public isn’t warned about any of it.
This might come as a surprise to anyone who has received a notice about a suspicious credit card transaction, perhaps a charge made in a city one has never been to. Those notifications, and the assurance that the cardholder is not on the hook, burnish the card companies’ reputation as tireless watchdogs, committed to protecting consumers. Mastercard and Visa promise customers “zero liability.”
In fact, those card companies have no liability. When consumers get scammed, it’s a bank that has to pay them back. Mastercard and Visa — unlike its competitors American Express and Discover, which operate on a different model — suffer no consequences. They have no direct financial incentive to stop fraud, and they bear no responsibility when it continues under their banner.