Earlier this month, the mobile payments company Square registered to go public with the Securities and Exchange Commission (SEC). As observers clawed through the long-awaited 198-page document, one unexpected detail stood out: In the risk section of the filing, Square acknowledged a $5.7 million loss "related to fraud by a single seller." That solitary seller represented nearly 23% of Square's transaction and advance losses for the first half of 2015. The Wall Street Journal said it "raised questions" about Square's ability to prevent fraud.
But the mystery seller who cost the company millions wasn't a cunning criminal mastermind or a black hat hacker. BuzzFeed News has learned that the seller was an Omaha events planning company called Creative Creations, owned by a 30-year-old woman named Patricia Urbanovsky.
According to felony charges filed against Urbanovsky in Douglas County District Court, Urbanovsky allegedly sold bogus discounted travel vouchers based on a fake connection to Southwest Airlines. Customers began asking for refunds — refunds Creative Creations would not pay back, leaving Square on the hook for millions of dollars.
"I don't know with 100% certainty, ma'am, but I would guess that [Urbanovsky and the single seller] probably are [the same person]," her lawyer Steven Lefler told BuzzFeed News.
"Yes, ma'am," Lefler said when asked whether the time period mentioned in Square's filing (the three months ending in March 2015) matched the allegations against Urbanovsky. Square is in the "quiet period" that precedes an initial public offering and declined to comment. However, in June, the Omaha World-Herald reported that Square filed a criminal report with the Omaha Police Department. According to the paper, Square told the police that it accepted more than $7 million in credit card and debit card payments from Creative Creations customers between October 2014 and March 2015 and that it was out $2.8 million in chargebacks, payments that are disputed and returned to customers. It's likely that the amount reported in the SEC filing is higher because it reflects the largest potential loss to Square. The company said it would "take the loss" if Urbanovsky did not have the money to cover the chargebacks.
It's worth noting that Square's loss rate for transactions is better than those of some of its competitors. According to an SEC filing from July, PayPal's transaction and loan loss rate was 0.27% of its total payment volume for the three months that ended in June 2015, up from 0.25% year-over-year. Square, on the other hand, reported transaction and advance losses of 0.1% of gross payment volume for 2014 in its S-1 filing.
Local papers have been keeping tabs on the increasingly knotty case, which now involves the FBI and the IRS. (Urbanovsky's home was recently raided.) A Facebook group for complaints against her and the company also closely track developments. "I just got a phone call from Carrie with the FBI!!! I'm at work, but can't wait to call her back," one group member posted in September, closing out with a smiley emoticon.
In its S-1 filing, Square explained that it works directly with payment card networks and banks, so that sellers who sign up to use Square can avoid the hassle. But the ease that affords customers comes with some risk. "We act as the merchant of record for our sellers, which puts us in their shoes with respect to card networks and puts the risk for refunds and chargebacks on us," the company said.
The loss to Square occurred not because of the chargebacks themselves, but because Creative Creations does not have the money to pay for them. Urbanovsky is currently facing three counts of theft-deception in Douglas County District Court. Lefler told BuzzFeed News that Creative Creations had not yet filed for bankruptcy, but acknowledged it was possible in the future. "We've been able to put it off for the last few months."
"I don't want to be rude or disrespectful," Lefler replied when asked whether that meant his client would be able to pay back customers. "I have been asked that from creditors, attorney generals, to better business bureaus. If there's money, we'll pay everybody back, but I don't think there will be any money."
Lefler is also peddling a different version of events. In August, Urbanovsky filed lawsuits against four former Creative Creations employees alleging they were to blame for the voucher debacle.
"This is a case that I didn't charge enough money for," Lefler told BuzzFeed News.
Square's failure to notice that something was amiss is embarrassing regardless of who's at fault or whether there was intent to defraud customers. That said, the fact that Creative Creations appeared to be running a legitimate wedding business before the travel voucher fiasco may have obscured some red flags that would have tipped Square off. The Better Business Bureau of Omaha reported more than 1,500 complaints against Creative Creations related to sales of bogus travel vouchers from October 2014 to March 2015. According to WOWT News in Omaha, those complaints totaled "more than $1.3 million." Lefler told BuzzFeed News that number was now closer to $1.7 million.
In response to questions from BuzzFeed News, Douglas County Attorney Donald "Don" Kleine said that the only reason it elevated the case to the federal level was because Square is a California corporation, so there were a number of interstate transactions. The felony charges filed by Kleine's office are unrelated to Square and "the rest of the investigation is being done by the Department of Justice," he said. "We're working with them and we're waiting to see what they're going to do."
Lefler said that he doesn't have any more details about Square's claims because the federal authorities have not filed criminal charges. "Hopefully I never find out because that means the federal government would not have brought charges against my client," he said.
In the security section of its website, Square says its anti-fraud algorithms are designed to get smarter as it processes more transactions:
Stopping fraud before it happensWe stop fraud via live monitoring programs that analyze transactions as they're happening. This is known as risk visualization. The approach helps us detect and investigate suspicious activity before a fraudulent charge takes place. This method is not only a pioneering way for us to protect merchants, but it's also a better way to build an automated system to detect criminals that will scale as our business grows.
"I use Square myself, they're a good company and everybody is dumping on Square," said Lefler. "They've been good people and tried to refund money and good for them."
According to Lefler, Creative Creations had a legitimate wedding business for years and started selling travel vouchers in the summer of 2014. "Unfortunately," he continued, in March 2015, "this little mom-and-pop company grew in leaps and bounds. As they got bigger, the business model was warped by some problems that I don't think are criminal."
"But of course, I'm her lawyer. So who gives a shit what I think."
Here’s the criminal report filed with the Omaha Police Department. Square’s lawyer told the cops that the alleged theft appeared to be “a Ponzi or Bust out Scheme”
UPDATE
This post has been updated to include a copy of the police report filed by Square, Inc.