Processor due diligence
How Do I Verify That a Payment Processor Is Legitimate?
No single badge, review, registry, or sales claim proves that a payment processor is right for a business. Verify the company through independent records, confirm who will provide each part of the service, read the actual agreement, and contact every named organization through a channel you found independently.
Start with identity
Confirm who is making the offer
Collect the company's legal name, trade name, physical address, website, support contacts, and the name of the entity shown on the proposed agreement. Compare those details across the contract, website, invoices, business records, and communications. Differences are not automatically improper, but they should be explained before sensitive information or signatures are provided.
Use an independent contact path
Type the company's known website address yourself or locate it through reliable records. Do not rely only on a phone number or link in an unexpected message, advertisement, or search result.
Identify each party
Ask which entity is the sales organization, payment processor, acquiring bank, gateway, POS provider, equipment provider, and customer-support contact. Request written clarification when names differ.
Verify bank claims carefully
If an offer names an FDIC-insured bank, use the FDIC's BankFind Suite to confirm the bank and its official website, then contact the bank independently if a claimed role needs confirmation.
Check the operating history
Search the exact legal and trade names with terms such as complaint, scam, lawsuit, or enforcement. Read patterns and responses instead of treating one rating as conclusive proof.
Document review
Match the sales explanation to the written agreement
Company and service scope
Confirm the contracting party, services included, support ownership, term, renewal language, cancellation process, equipment ownership, data access, and every document incorporated by reference.
Costs and changes
Ask where all charges, minimums, pass-through items, equipment obligations, and change provisions appear. This page does not estimate rates or determine whether a proposal is competitive.
Funding and reserves
Locate the written provisions governing settlement, holds, reserves, and account changes. Do not rely on an unsupported timing or availability promise.
Security and access
Ask how credentials, bank documents, tax records, and cardholder information are collected and protected. Confirm the secure upload destination through an official contact path.
Cancellation and equipment
Determine how notice must be delivered, what happens to leased or provided devices, and which party receives returns. Keep copies of signed documents and delivery records.
Unanswered questions
Pause when material terms are missing, inconsistent, or available only as verbal assurances. Ask for a complete written response before authorizing changes to an existing account.
Warning signs
Slow down when the process discourages verification
Unexpected urgency
Be cautious when a caller demands an immediate signature, payment, remote-computer access, credential reset, or disclosure of bank information before independent verification.
Unverifiable claims
Ask for evidence when someone claims to represent a bank, card brand, processor, government agency, or current provider. Verify through the named organization's official channel.
Incomplete documents
Do not sign blank forms or rely on cropped screenshots. Obtain the full agreement, referenced schedules, equipment documents, and a copy bearing the completed terms.
Unsafe information requests
Never send passwords, one-time codes, complete card data, or secret API keys through ordinary email or a general web form. Confirm why each sensitive item is needed.
Practical workflow
Create a repeatable verification record
Before the meeting
- Record the legal and trade names
- Locate official contact information independently
- List every organization named in the offer
- Search for consistent complaint patterns
- Assign an internal reviewer
Before signing
- Read every incorporated document
- Resolve differences between sales claims and terms
- Verify claimed bank or provider roles independently
- Confirm secure handling of sensitive records
- Save the final signed package
The FTC advises businesses to resist urgency, avoid links and attachments in unexpected messages, research unfamiliar companies, and use known contact information to verify requests. These practices help evaluate the contact process; they do not certify a processor or replace legal review.
Common questions
Processor verification FAQ
Does a business registration prove legitimacy?
No. Registration can help confirm identity, but it does not establish service quality, authority to represent another company, or suitability for your business.
Can reviews verify a processor?
Reviews can reveal patterns and questions to investigate, but they can be incomplete or manipulated. Compare them with contracts, official records, and independently confirmed contacts.
How can I verify a claimed bank relationship?
Confirm the bank and its official website through FDIC BankFind when applicable, then contact the bank through independently sourced information. Do not treat a logo as proof.
What if the salesperson will not provide documents?
Pause the process. A merchant cannot evaluate obligations that are unavailable or incomplete. Do not disclose sensitive data or sign until material questions are resolved.
Last editorial review: August 12, 2026. Reviewed against current FTC small-business scam and cybersecurity guidance and the FDIC BankFind Suite.
Next step
Verify identity, authority, and terms independently
Build a written record of the parties, official contacts, agreement terms, security process, and unresolved questions before sharing sensitive information or authorizing a change.
To learn more about how TSYS can help improve the way your organization accepts payments, markets to new customers, or manages its HR responsibilities, get in touch by calling 585-981-8463 to get started.
CONTACT US