Following the holiday weekend, the Federal Trade Commission (FTC) announced a proposed settlement with Humboldt Merchant Services requiring the payment processor to pay $12 million and accept restrictions on servicing certain merchants over allegations that it facilitated merchant fraud and rescinded its 2021 policy statement on breaches by health apps and other connected devices as unnecessary in light of the Commission’s 2024 rule amendments. More on these updates after the jump.
Tuesday, September 8, 2026
Tags: Consumer Protection | Bureau of Consumer Protection | Credit and Finance | Payments and Billing
The FTC announced an action against Humboldt Merchant Services, alleging that the payment processor facilitated payment processing for sham merchants involved in unauthorized billing scams. According to the FTC’s complaint, Humboldt processed payments for more than 1,000 merchants that allegedly operated as shell entities that fraudulent companies, including Legion Media, used to carry out their schemes, despite red flags such as unusually high chargeback rates. The complaint alleges that Humboldt knew, or consciously avoided knowing, that fraud permeated these accounts, in violation of Section 5 of the FTC Act. The FTC also alleges that Humboldt tried to increase transaction approvals by placing these accounts on a lower-risk bank identification number that an affiliated entity maintained. Under the proposed order, Humboldt would pay $12 million in consumer redress and would face a permanent bar from engaging in or assisting credit card laundering. The order would also prohibit Humboldt from processing payments for certain high-risk merchant categories and from using misleading information or evasion tactics, including load balancing, to obtain or maintain payment processing.
Wednesday, September 9, 2026
Tags: Consumer Protection | Bureau of Consumer Protection | Health Breach Notification Rule | Payments and Billing
The FTC announced that it has withdrawn its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. According to the agency, the policy statement is no longer needed because the FTC amended the Health Breach Notification Rule in 2024 to expressly cover health apps and connected devices, including products such as fitness trackers. The FTC’s announcement explains that the rescission is intended to eliminate outdated guidance now that the Rule itself addresses the conduct covered by the 2021 statement.