A $111 million scheme to keep bad merchants banked

• Key insight: The scheme did not defeat account opening so much as what comes after it. CB Surety sold clients access to merchant accounts and then sold them a way to survive the ongoing monitoring that decides whether an account stays open.
• What's at stake: Visa and Mastercard already require acquiring banks to watch for abnormal spikes in a merchant's transaction count, and federal examiners list charge-back history among the things a bank should understand about a payment processor.
• Supporting data: The transactions Eide admitted pushing through the sham accounts produced more than $1.2 million in consumer refunds across at least 21,465 transactions and more than $2.15 million in charge-backs across at least 21,037.

Overview bullets generated by AI with editorial review.

A California man has admitted his role in a scheme that pushed more than $111 million in transactions through sham accounts on behalf of clients.

Thomas Emil Eide, 51, formerly of South Lake Tahoe, California, who owned CB Surety, pleaded guilty on Aug. 20 in federal court in Sacramento to conspiracy to commit bank fraud.

His payments company, CB Surety, sold clients a way to open and maintain bank accounts they ordinarily could not have accessed due to illegal or questionable business practices.

CB Surety used a series of tactics to secure bank accounts for these clients, many of them fraudsters or scammers. The tactic at the center of the case buried customer-disputed transactions under a flood of legitimate-appearing but sham sales.

The case turns on a ratio every bank in the card business watches: the share of a merchant's sales that customers dispute and get reversed; in other words, the charge-back ratio.

That number is a credit gauge. A merchant account works as a line of credit, and when a merchant will not or cannot repay the refunds its customers are owed, the bank that signed it up absorbs them.

Card networks fine banks whose merchants let the number get too high, so banks close those accounts. CB Surety sold a way to avoid these closures.

Eide and his co-conspirators recruited individuals to serve as straw owners of shell companies and directed them to open the accounts, according to the U.S. attorney's announcement of the plea. In reality, CB Surety's clients controlled them.

With the account open, the client would send CB Surety a large deposit. CB Surety loaded that money onto prepaid debit cards and spent it back at the client's own merchant account, a few dollars at a time.

The money returned to the client looking like ordinary sales. Meanwhile, the client's real customers (or victims, in many cases) kept disputing charges at the same high rate as before. Every sham charge added another legitimate-looking sale, which pushed down the client's dispute ratio.

Eide sold the service from about March 2017 through about December 2023, according to his plea agreement.

An attorney for Eide declined to comment.

What CB Surety sold

CB Surety sold two things, according to the plea agreement: access to merchant accounts its clients could not get on their own, and a way to keep those accounts open.

The first service relies on a tried-and-true scheme: recruiting someone to open a bank account that hides who actually controls it.

(The Corporate Transparency Act's registry, built to pierce exactly that kind of ownership, no longer covers U.S. companies. The Financial Crimes Enforcement Network narrowed it to foreign entities in March 2025.)

The second service CB Surety offered worked on a recurring basis. Banks decide whether a merchant keeps its account by watching the dispute ratio, and CB Surety sold a way to hold it down.

How CB Surety operated

CB Surety worked with clients that banks did not want, Eide admitted in his plea. Some of the clients defrauded consumers, elderly victims among them. Some sold goods and services that violated state or federal law or the banks' own rules.

Others simply had charge-back rates (the share of a merchant's sales that consumers successfully dispute and get reversed) their banks would not tolerate or that sat on a terminated merchant file (the industry blacklist for businesses that banks have cut off).

Getting those clients a merchant account required a supporting cast; Eide's co-conspirators recruited straw owners, incorporated shell companies in their names and opened accounts at federally insured banks.

They propped up the applications with fake websites and fake contracts, Eide admitted. From there, CB Surety worked to keep the merchant accounts open.

To do this, Eide and his co-conspirators would first collect a deposit from the client. They would then return that deposit (minus a fee) to the client using prepaid debit cards.

Specifically, they initiated small-dollar, sham transactions designed to look to the acquiring banks (the banks that provide merchant accounts and which are tasked with monitoring charge-back rates) like payments for legitimate goods or services, according to the plea agreement.

The merchant made no money from these small transactions; it was just getting its own deposit back, less CB Surety's cut.

The real win for the merchant was a diluted charge-back rate; the multitude of microtransactions hid the underlying illegal or questionable activity the client used the bank account to conduct.

Eide understood what he was doing; he admitted in his plea agreement to knowing banks "would close merchant accounts when merchants' charge-back rates exceeded a certain threshold."

A count, not a dollar figure

The reason Eide's tactic worked was arithmetic that both Visa and Mastercard tell acquirers to use to identify risky merchants.

Mastercard's Security Rules and Procedures, updated earlier this month, set the measure behind its excessive charge-back program.

That measure divides the number of charge-backs an acquirer received for a merchant in a calendar month by the number of Mastercard transactions the acquirer processed for that merchant the month before.

The math doesn't involve the dollar amount of the transactions; it only involves the number of transactions.

Visa calls its own measure "a single, count-based ratio," according to Visa's fact sheet on the program: fraud and dispute counts divided by the count of settled transactions.

So, within both networks, a 50-cent charge counts the same as a $500 sale when it comes to calculating whether a merchant has excessive charge-backs. Eide's scheme relied on this blindness to transaction values.

Neither Visa's fact sheet nor Mastercard's rulebook says why the networks count transactions rather than weigh them.

A spokesperson for Mastercard did not immediately respond to a request for comment. A spokesperson for Visa also did not immediately respond.

The ratio is not the only thing acquirers are told to watch. Mastercard's manual separately requires a bank to track each merchant's daily transaction count and value against at least a 90-day average, to detect any "abnormal or suspicious increase of Merchant activity."

Federal examiners ask for less. A major federal anti-money-laundering manual lists "charge-back history" among the things a bank should understand about a payment processor, but says nothing about the size of the transactions behind that number.

Tripwires existed, yet the scheme ran for nearly seven years.

What the plea put on the record

Eide and his co-conspirators pushed more than $111 million in transactions through the sham accounts on behalf of their clients, according to his guilty plea. That figure is the total of all transactions, not losses or profit.

None of the filings say how much the banks themselves lost. They do say that the $111 million includes more than $1.2 million in refunds across at least 21,465 transactions. The $111 million also includes more than $2.15 million in consumer-initiated charge-backs across at least 21,037 transactions.

In total, customers got back or fought to get back more than $3.3 million across at least 42,500 card payments.

Eide agreed to give up $2.17 million in what the plea agreement calls a forfeiture money judgment, which is an order to surrender the proceeds of the crime.

Shell companies are still being counted

The Justice Department's victim notification page lists 197 shell companies by name, but that list does not appear to be exhaustive.

The Justice Department sued CB Surety, Eide and others in December 2023 under a law that lets it go to court to halt an ongoing bank fraud. A judge froze the defendants' assets and put a receiver over them. The judge issued an injunction the following month.

That receiver said in June that he has compiled a list of roughly 5,000 entities set up under the guidance of Eide and others.

Some banks did catch on to the scheme, according to the civil complaint. Esquire Bank flagged two merchant accounts as possible money laundering and closed those and 104 others it linked to them. U.S. Bank identified and closed shell companies' accounts during its own vetting.

However, in both cases, CB Surety kept operating through other shell companies at the same banks, the lawsuit alleges. When one shell company got caught, Eide and his co-conspirators routed their clients' transactions through others they controlled.

Spokespeople for Esquire Bank and U.S. Bank did not immediately respond to requests for comment.

Eide is set to appear in court again on Nov. 12 to schedule his sentencing. The plea to which he has agreed obligates him to pay restitution to every victim of the scheme but says the amount he must pay "has not yet been determined."