Congress probes Visa, AmEx role in Web scam

Senate commerce committee wants the big credit card companies to explain how a Web marketing scam involving top retailers went on under their noses for years.

Greg Sandoval Former Staff writer
Greg Sandoval covers media and digital entertainment for CNET News. Based in New York, Sandoval is a former reporter for The Washington Post and the Los Angeles Times. E-mail Greg, or follow him on Twitter at @sandoCNET.
Greg Sandoval
5 min read

For years, baffled consumers looked to Visa, MasterCard, and American Express for answers when mysterious charges from "shadowy companies" began appearing on their credit card statements.

Even though all three card companies have rules designed to protect users from unauthorized charges as well as to weed out problem-plagued merchants, thousands of people appear to have complained to their card companies for years about three post-transaction marketing companies: Webloyalty, Vertrue, and Affinion. Perhaps as many as 30 million people were affected, according to a government report.

The U.S. Senate Committee on Commerce, Science, and Transportation launched an investigation last May after learning of the thousands of consumer complaints from online shoppers. As a result of the investigation, lawmakers have concluded that the three marketing firms employed deceptive practices in order to fool consumers into signing up to loyalty programs and paying monthly fees. Now, the commerce committee wants Visa, MasterCard, and American Express to explain how all this went on for years under their noses.

"Credit card networks have hundreds of pages of rules detailing every requirement...but what good are rules when they are not enforced."
--Ben Edelman, Harvard professor

Last week, Commerce Committee Chairman John Rockefeller (D-W.V.) wrote a letter to Kenneth Chenault, CEO of American Express, as well as the chiefs of the other two major card companies. He asked that they provide information about their dealings with the three marketers. Rockefeller wrote: "It concerns me greatly that the companies we are investigating have been able to acquire the credit and debit card numbers of millions of American consumers and bill them every month for services the consumers do not realize they have purchased."

Visa and MasterCard did not respond to interview requests. American Express said: "We share the committee's concerns about the alleged unfair and deceptive practices and are in the process of investigating."

Webloyalty, Affinion, and Vertrue generated $1.4 billion through the misleading practices, according to a report issued by the commerce committee last month. Those firms couldn't have accomplished that without obtaining "unprecedented" access to consumer credit cards, from online merchants according to the government's report and e-commerce experts. To obtain the card data, the marketing firms paid nearly $800 million to 88 e-tail stores, including Orbitz, Buy.com, Travelocity, Barnes & Noble, Pizza Hut, and Priceline.

While some of these stores have otherwise established solid reputations, the material disclosed by Senate investigators indicates these retailers sold their customers' financial data to third parties--something that experts say many consumers are unaware of and would likely find abhorrent.

Sen. John Rockefeller, chairman of the Senate committee wants Visa, MasterCard, and American Express to answer questions how marketers were allowed to buy consumer credit card information from top retail sites. U.S. Senate Commerce Committee

The sheer number of retailers accused of betraying customer trust and the scrutiny now being focused on Visa, MasterCard, and American Express is turning the situation into an unprecedented scandal for the e-commerce sector.

The reason that the commerce committee may be turning the focus onto the credit card companies is that they were in a prime position to halt the deceptive marketing practices long ago, experts say. To understand what responsibility the credit card companies may have had, you have to know how the controversial marketing practices worked.

First, a consumer who is finishing up a transaction at a Web store would be presented with a pop-up ad. An offer for a cash-back reward of, say, $10 is written in large print. Customers are informed, again in bold text that they can get the reward if they enter their e-mail address.

Further down and written in much more obscure text are the full terms of the deal. That's how customers are notified that by entering their e-mail address they will effectively be agreeing to join a membership program and allowing their retailer to turn over their credit card information so it can be charged monthly, perhaps as much as $20. For this reason, the three marketing firms and their retail partners say the whole thing is legal and above board. All the terms are there in the fine print and it's not their fault that consumers don't read them.

Congressional investigators turned up documents, however, that showed they were well aware of the potential deception. Investigators presented internal e-mails from the marketing firms that illustrate how they purposely employ tactics to mislead consumers while staying within the letter of the law.

According to members of the commerce committee, it's a classic loophole play. In addition, documents show that the marketers told retail partners that they were much more likely to make money if the retailers gave them their customers' credit card information rather than to having to ask for it from the cardholder.

"It concerns me greatly that the companies we are investigating have been able to acquire the credit and debit card numbers of millions of American consumers and bill them every month for services the consumers do not realize they have purchased."
--U.S. Senator John Rockefeller

That's where American Express, Visa and Mastercard come in.

Had the big card companies followed their own rules, these dubious marketing tactics would have failed long ago, said Ben Edelman, an assistant professor at Harvard Business School who focuses on electronic marketplaces.

Visa, MasterCard, and American Express require that only a cardholder, not any intermediary or merchant, provide a credit card number to complete a transaction. This is key as many consumers are completely unsuspecting that an e-mail address is enough to authorize a purchase, according to Edelman, who offered written testimony during last month's committee hearing held on the marketers.

"Consumers naturally expect that if they don't type their card numbers they won't be charged," Edelman said. "That's a good rule of thumb, and it's true almost everywhere, but not at these tricky sites."

Another question that Visa, MasterCard, and American Express must answer is why they appear to have ignored what appears, according to the government's report, to be a large volume of customer complaints about Webloyalty, Affinion, and Vertrue.

The card companies have rules in place to boot merchants off their systems who have too many customer complaints or "chargebacks," the term used to describe the refunding of money to a credit card owner who has been charged incorrectly or fraudulently.

The Senate committee has indicated it will hold another hearing sometime after the start of the year and intends to call to testify the CEOs of the marketing firms and many of the Web stores. Perhaps, the chiefs of Visa and the other card companies should be there as well.

"Credit card networks have hundreds of pages of rules detailing every requirement of banks, retailers, and credit card users," Edelman said. "The rules exactly prohibit these practices. But what good are rules when they are not enforced."