24
Oct 19

Cachet Financial Reeling from MyPayrollHR Fraud

When New York-based cloud payroll provider MyPayrollHR unexpectedly shuttered its doors last month and disappeared with $26 million worth of customer payroll deposits, its payment processor Cachet Financial Services ended up funding the bank accounts of MyPayrollHR client company employees anyway, graciously eating a $26 million loss which it is now suing to recover.

But on Oct. 23 — less than 24 hours before another weekly payroll rush — Pasadena, Calif.-based Cachet threw much of its customer base into disarray when it said its bank was no longer willing to risk another MyPayrollHR debacle, and that customers would need to wire payroll deposits instead of relying on the usual method of automated clearinghouse (ACH) payments (essentially bank-to-bank checks).

Cachet processes some $150 billion in payroll payments annually for more than 110,000 employers. But payroll experts say this week’s actions by Cachet’s bank may well soon put the 22-year-old company out of business.

“We apologize for the inconvenience of this message,” reads the communication from Cachet that went out to customers just after 6:30 PM ET on Oct. 23. It continued:

“Due to ongoing fraud protocol with our bank, they are requiring pre-funding via Direct Wire for all batches that were uploaded this week, unless employees were already paid or tax payments were already transmitted. This includes all batch files moving forward.”

All files that were uploaded today for collection and disbursement will not be processed. In order to process disbursement, we will need to receive a wire first thing tomorrow in order to release the disbursements.

All collections that were processed prior to today will be reviewed by the bank and disbursements will be released once the funds are cleared. Credit trans

Deadline for wires is 1 P.M. PST.

This will be the process until further notice. If you need a backup processor, please contact us.

If you require wire instructions, please respond to this email and they will be sent to you.

We welcome and anticipate your phone calls and inquiries. We remain committed to our clients and are determined to see this through. We appreciate and thank you for your patience and understanding.”

In a follow-up communication sent Thursday evening, Cachet said all debit transactions with a settlement date of Oct. 23 had been processed, but that any transactions uploaded after Oct. 23 were not being processed at all, and that wires are no longer being accepted.

Cachet’s financial institution, Wilmington, Del. based The Bancorp Bank (NASDAQ: TBBK), did not respond to requests for comment.

Cachet also did not respond to requests for comment. But in an email Thursday evening, the company sought to offer customers a range of alternatives — including other providers — to help process payrolls this week.

Steve Friedl, an IT consultant in the payroll service bureau industry, said the Cachet announcement has sent payroll providers scrambling to cut and mail or courier paper checks to client employees.  But he said many payroll providers also use Cachet to process tax withholdings for client employees, and that this, too, could be disrupted by the funding changes.

“There’s a lot of same day stuff that goes on in the payroll industry that depends on people being honest and having money available at certain times,” Friedl said. “When that’s not possible because a bank in that process says it doesn’t want to be stuck in the middle that can create problems for a lot of people who are then stuck in the middle.”

Another payroll expert at a company that uses Cachet but who asked not to be named said, “everyone I know at payroll providers is scrambling to get it done another way this week” as a result of the decision by Cachet’s bank.

“Those bureaus will do whatever they can to keep their clients happy because something like this can quickly put them out of business,” the source said. “Unlike what happened with MyPayrollHR — which harmed consumers directly — the payment service bureaus are the ones potentially getting hurt here.”

Most corporate payroll is handled through ACH transactions, a system that allows financial institutions to push and pull funds to and from checking accounts between banks. ACH is essentially the same thing as writing a check for a good or service, and it typically involves an element of trust because there is a time delay (24-48h) between which the promised funds are released to the receiving bank and the funds are made available to the recipient.

In contrast, a wire transfer takes minutes and the funds are made available to the recipient almost immediately. Wires are also far more expensive for customers, and they earn banks hugely profitable processing fees, whereas ACH transaction fees are minuscule by comparison.

Ultimately, banks may decide that for certain clients they no longer wish to assume the risk of fraudsters exploiting the float period for ACH transactions to steal tens of millions of dollars, as was the case in the MyPayrollHR fiasco.

It’s worth noting that the MyPayrollHR fraud wasn’t the first time Cachet has been tripped up by the demise of a payroll company: In 2016, the collapse of Monterey, Calif. based payroll processor Pinnacle Workforce Solutions left Cachet holding the bag for more than $1 million. Cachet sued to recover the money stuck in Pinnacle’s frozen accounts. From The Monetery County Weekly:

“Cachet’s lawyers also outline possible nefarious action by Pinnacle. ACH companies act as middlemen for processing payroll and other large transactions. Every pay period, Pinnacle would send Cachet a coded file to tell the ACH how to distribute funds. But, on Sept. 21 [2016] Pinnacle had manipulated the code sent to Cachet so the money collected from its clients went directly to Pinnacle instead of being held in the ACH account before being distributed to its clients’ employees, the suit alleges.”

It will be interesting to see how long the fallout from the MyPayrollHR episode will last and how many other firms may get wiped because of it. Shortly after MyPayrollHR closed its doors last month and disappeared with $35 million in payroll and tax payments, the company’s 49-year-old CEO Michael Mann was arrested and charged with bank fraud.

The government alleges Mann was kiting millions of dollars in checks between his accounts at Bank of America and Pioneer from Aug. 1, 2019 to Aug. 30, 2019. The Times Union reports that Mann and his company are now being sued by Pioneer Bank and a large insurance company over a $42 million loan it gave to Mann and his companies just a month before his payroll business closed up shop.

67 comments

  1. Mind boggling. Proves once again that due diligence in our digital economy is atrocious. You are only as good as your most insecurely structured “trusted”vendor or client, whether technologically, financially, or ethically.

  2. Looking at this from a European perspective, and having read up on US payments processing a bit out of personal interest to get a comparison, it boggles the mind what antiquated payment processes are still in place in a developed economy like the US.
    Europe had D+1 processing for credit transfers for some time now and the europe-wide instant payment credit transfer scheme (admittedly more expensinve, but that will come down and become the new normal down the road) will increase it´s ceiling from 15k to 100k per transaction next year.

    “Virtual cheques” and cheque kiting for up to two day? This sound so 1980´s to us.

    • It’s probably the usual corporate inertia. These processes seem to be straight from the 80’s, and that’s because they are. It worked fine for the past 30-40 years (or longer), so why change it, right? Don’t fix what ”ain’t broke” (even if it actually is, and you just refuse to acknowledge it)

      Europe also has the same issue, although to a lesser degree, since the digitization took place about a decade later. Newer technologies were available by then, and thus European systems aren’t as outdated. That said, I’ve seen my fair share of code older than myself, and some of it contained security holes that wouldn’t even be possible when it was written.

      Point being, we put way too much trust in a fragile backbone. I just hope something will be done about it before we suffer any major consequences.

      • There have certainly been loads of bank- or country-specific solutions prior to 2009 and the PSD1.
        But with SEPA standardization there has been less of that. EBICS as a company transmission protocoll has been adopted by a few countries now, can´t speak for the others as I moved out of corporate payments a long time ago.
        In Germany, some smaller companies may use their tax advisor´s IT center (DATEV) to prepare payroll payment and have them transmitted to the bank´s IT center, but the company would still have to, electronically or on paper, release the prepared payments and funds, which would go from the company account to the employee account, not through some third party.

  3. Is this actually a standard payment method for salaries in the USA?

    Or are there systems like in Europe where the employee receives a normal transfer from his employer to his account at the end of the month?

    • I’ve actually worked on a small desktop application to communicate with payment services (in Europe), and some of the stuff in there could potentially be abused in a similar manner. There are various checks in place, but for the systems I communicated with there did seem to be the possibility of doing some sort of illegitimate redirection of funds.

      That was a decade ago, and those systems were from the 70s/80s, so there’s the possibility that some sort of modernization has happened. But with the amount of companies relying on the protocols and systems, it’s fairly likely that nothing has changed in that regard. The good old “It still works, and no one has abused the security holes, so why spend money on fixing things that may never be an issue.”

    • paper checks are becoming more unusual in the US – I think most employees receive their pay by electronic transfer. The reason that they’d be rushing to make physical checks and deliver them is that there are heavy penalties for employers who do not pay their employees on time. If your e-deposit thing breaks, your alternative is paper checks, and you’d better get them in the employees’ hands by the stated pay date/time (which is required to be posted in the workplace).

      In California, the penalty is a day’s wages for each day that the pay is late. Most companies cannot afford a 20% hit on their weekly payroll.

      Even worse, if you miss the tax deposit, the IRS will come after the company – they view this as particularly bad because it’s not that the company is paying its taxes late (for which there are penalties), it’s that the company is not depositing the employee taxes that have been withheld from their paycheck, and essentially held in trust – which is outright theft.

      It is precisely because of these penalties and consequences that lots of small businesses (and large ones too) hire a third party to do it and make sure it happens.

  4. Cachet is right. There’s no reason why it should be left holding the dirty end of the stick, when some other business screws up or commits fraud.

    This is the same sort of thing that leads some businesses to insist on cash, money order, or bank checks for payment, refusing to accept personal checks or the hassle of credit card fees.

    And they do just fine.

    And customers have come to expect it from certain businesses.

    Cachet will be fine. Any loss of customers over this decision will be offset by knowing they don’t have to deal with headaches in the future.

    • Cachet might be fine, but what are the thousands of people supposed to do without a paycheck this week? Is Cachet going to come pay my bills because they sprung this last minute on my payroll provider?

      The shouldn’t have to hold the dirty end of the stick but maybe some notice so us little people don’t get screwed would be great.

      • Go to your employer and ask for a check. Legally, the employer is responsible to pay you – not the bank or payroll processor.

        • Already have, but its not like they can just write checks up for everyone at the drop of a hat. I’m still out of a paycheck today.

        • The employer is certainly responsible for payment, but in many cases the money for payroll has been pulled from the employer’s account already where it’s sitting in limbo somewhere.

          Surely some employers are able to take a double hit by cutting manual checks in the short term, but many will simply be unable to.

        • Most employers don’t want to write checks after being debited for a large payroll that they were expecting to be direct deposited. The concern being when will they recoup that money. I have dealt with this for 2 days at work, answering these questions and trying to get clients to understand. It’s tough. Totally unfortunate.

    • Cachet will not be fine; this is their last day in business (plus or minus wind-down efforts).

      Once their bank cut them off, they have no service to offer to anybody.

  5. That first message switching to Wires reads just like a scam – completely new procedure dropped out of the sky on a tight deadline.

    “Deadline for wires is 1 P.M. PST.

    This will be the process until further notice. ”

    The only thing missing is “wire this to our new Cayman bank account #xxxxxx”.

    • This was my thought as well, especially the excerpt below:

      “If you require wire instructions, please respond to this email and they will be sent to you.”

      • I understand that the wire instructions could look suspicious, but they weren’t.

        Transferring via ACH carries an automatic coupla day period where something can bounce, so you aren’t *sure* you have the funds immediately. Bank Wire makes it happen Right Now, so this could get things released sooner.

        “Desperate” would be a better term than “suspicious”

  6. What will this mean for FIs who use Cachet as their mobile deposit vendor?

  7. Another great example of why “Blockchain” should be implemented so things like this can’t happen. We need Washington to pass regulation! #Ripple #XRP #XRPArmy

  8. Am I reading this right that Cachet had been burned by this once before with Pinnacle?

  9. There is that really unsettling old metaphor about a “house of cards” among all those actors involved which comes to mind with this entire affair. Certainly hope the analogy doesn’t extend throughout the US financial system, but as every new shoe drops, I become a bit less unwilling to dismiss that wild-hare notion out of hand.

    • For the financial services industry to operate effectively there has to be a high level of confidence and trust between the major players. Without that, everything gets more difficult and the system runs the risk of freezing up. Cachet’s bank is demonstrating a singular lack of trust both in Cachet and the payroll processing system in general, and that can’t be good for the future. What are all these companies – 110,000 of them – going to do, take payroll processing in-house? I doubt it. That means, assuming each employer is responsible for paying anything from 50 to 100 employees, that between 5 and 10 million people may not be paid on time. That’s going to hurt quite a few of them.

    • Unfortunately the more this has unfolded and real victims (both the small business and their employees) have dug and learned the more it’s clear that the entire payroll system is absolutely a house of cards. There is very little regulation, no best practice standards, and no requirement for a fiduciary duty to put clients first. Furthermore, there is next to no ability for clients to have recourse and take action when they’re wronged. So it’s a lack of protection AND a lack of repercussion.

  10. Cachet keeps making bad decisions with no notice. If a stick is dirty it’s because their sticking it in the mid. When mypayroll collapsed cachet violated NACHA protocol and retracted previous paychecks from individual employee accounts. Now they’ve decided they want to change how they process, to reduce liability, but did so with NO notice for clients. That’s just a mind numbingly stupid way to treat clients.

    The only one screwing cachet is themselves.

    • They wouldn’t have asked for this unless their bank was insisting on it.

      And before, it was also some banks fault for processing an incorrectly formatted request.

      They may be making mistakes, but a big chunk is the fault of the banks for having screwed up requirements and procedures they don’t even properly follow!

  11. They kinda deserve getting kicked out for all those panic-stricken ACH reversals somebody processed. that was all kinds of wrong.

  12. Is is possible to find out a client list for Cachet? We work for a Florida company and and have not gotten paid yet, direct deposits were supposed to post yesterday. The payroll company (POA) is saying its a problem with their ACH processor. Money has been taken from the employer bank account but not given to employees.

  13. as a payroll provider, this has been the most stressful time in my life. We are sitting waiting for a 2pm PST time to know if employee were paid. Are hands are tied, because we don’t want to double pay people, in the hopes that the money is released. If not we will be reprocessing today to get people a manual check. Then the employee runs the risk that the bank holds the money for days. Which means it might be best to have a table set up and cash waiting for them to come take.

  14. Payroll Industry

    I can’t believe this started on Wednesday night affecting hundreds of Payroll Companies and Thousands of companies payroll and not one mention in Main Stream News. This is as big if not affecting more than when Wells Fargo had the deposit outage issue earlier last year. Reprtubal payroll companies are getting kicked in the teeth by their clients being blamed for their employees not getting paid.

  15. Well it is 4:52pm and employees still have not received those payments promised and now

  16. As an employee with no pay check for this week I’m outraged. They keep telling us different times it will be available and it’s still not there. So now what? I did my duties. Now they need to do theirs and no one can give me a live check. I have to wait. My check is now 35 hrs late. My bills automatically deducted. My account is overdrawn. And now it’s the weekend… Sometimes it’s hard to be the little man

  17. Well all you Trump voters must feel pretty foolish now. This all is the kind of fallout one would expect from his wild west financial deregulations he been grifting the country with the past 2 years…expect more of this to come!

    • Cite your source that shows the specific financial deregulation that Trump implemented that caused this to happen. I’ll wait.

  18. NYS Dept of Financial Services is investigating dozens of payroll processors. The processors may be breaking existing laws and also DFS is looking at the holistic process. It doesn’t make sense. Cachet was cut off by a bank because they were breaking a law and rather than the bank losing its license, they cut off Cachet.

    Word to the wise… don’t mess with New Yorkers, especially NYSDFS

    https://www.dfs.ny.gov/reports_and_publications/press_releases/pr1908061

  19. We are a payroll provider and we use Cachet Financial for our direct deposits for our clients. Today is Saturday, current time is 8:00 am PST, Two of my large clients still didn’t get their direct deposit. I am worried . Yesterday, I spoke with Cachet representative she assured me the it was procced yesterday and major employee banks will release funds last night.

  20. As of right now, 8:00 PM 26 OCT, the Cachet website appears completely dead. No links work. Seems ominous.

    • Another Old Engineer

      I agree with Old Engineer, sounds fishy. I’ve been around for a while and I’m also waiting on a check with 110 hours for last two weeks and if it looks like a duck…

  21. Well my paycheck that was to come early Friday just showed up in my bank account. Our provider RSI out of Denver must have found another AHC shop besides Cachet or else figured out another way. Thankfully it wasn’t another Michael Mann like fraud. Thank you RSI

  22. The company that processes my paycheck was with Cachet until this debacle and supposedly they have since jumped this sinking ship!

  23. Still no paychecks for our employees. Our payroll company is very quiet today. Not answering emails. Praying the money goes in today, latest tomorrow like we have been told.

  24. Cachet should have learned its lesson the first time fraud happened to them. A better company would not have needed even one lesson.

    The lesson is: “If the fund distribution instructions radically change, there might be something wrong”

    I don’t blame the bank in questioning Cachet’s willingness to process fraudulent transactions. There is too much money involved to allow mistakes like that.

  25. As an employee who worked and still has not been paid by end of day Monday when we were to have been paid Friday, this is crazy.

  26. It is okay if Luke bashes Trump. Is not okay to list my rebuttal.

    I suggest you continue your anti-1st Amendment censoring with your old employer WaPo. They are Trump and America haters too.

    • A Real American

      Hating trump and hating America are not one and the same.

      I love America but what trump has done over the last 3 years makes me very ashamed of what we have become in 3 years.

      So, yes, I hate trump and how far we, as a nation, have sunk!

      • What has Trump done that makes your little fee-fees hurt?

        • @Dunked On You: If you got your head out of your butt and watched real news instead of Faux News and Breitbart, the answer to your question would be obvious.

          So why can’t the employers do ACH’s themselves with their respective financial institutions? Quickbooks, Shelby, and many other financial/payroll applications have that capability, and it eliminates the middleman.

          • @catwhisperer it is not a small undertaking for a company to handle its own payroll once you exceed a certain number of employees. I don’t know what the ratio is, but there’s some x FTEs required for every y number of employees.

            I handle just the tax duties for a small 3-employee S Corp (client handles actual paychecks) and it’s a pain. Add in benefits, multiple tax jurisdictions (e.g., for an employer near a state border or a company with offices in multiple states) and it quickly, exponentially explodes.

            As mentioned elsewhere, regulations put heavy penalties on even honest mistakes. Better to outsource, but with careful due diligence.

  27. Calculating Gambler

    This whole episode is indicative of fundamental misunderstandings regarding the multiple functions fulfilled by parties using technology to move money. New entrants into money transfer, merchant payments, payroll processing and other similar services look at the total client charges and compare those charges to what they believe they can accomplish with some new technology or process to move the money. The problem is that the technology costs of actually moving the money are probably much less than 10% of the total technology costs and the technology costs are a fraction of the total costs. The remainder of the costs involve the necessary processing and controls to minimize the risks of extending credit and moving money legally. Add to the credit risk costs the costs of performing the mandatory money laundering processing (aren’t drug smurfs and mules employees?) and other regulatory compliance activities and the actual costs of moving the money around is a very small portion of what clients must be charged to have a viable business. In this instance the processor’s bank is being asked to extend credit to parties they don’t even know – the various companies using the payroll services. Those parties unknown to the processor’s bank (the clients of the processor) are now being asked to have their banks, who are conceptually aware of their client’s financial circumstances, extend that credit by using the wire process. I suspect if investors better understood when credit was being extended, the costs of extending credit borne by processors in the various financial services spaces and the costs of doing the entire job there would be fewer attempts to enter the financial processing space. I doubt many clients of new wave payroll processing companies correctly assess the potential risk of losing an entire payroll cycle to a black hole and the potential need to find a new processor on short notice when deciding to select a new payroll processor. Yes it is possible to use a gimmick such as piggybacking on a cellular company’s post pay smartphone credit check to temporarily minimize costs or rely on parking credit risks on unsuspecting parties but ultimately those strategies fail because they lack the market breadth and endurance to grow beyond those niches and achieve the required economies of scale. This incident will likely educate an entire group of heretofore unsuspecting parties as to when they hold credit risk and the real costs of holding credit risk.

    • Hard to read that without paragraph breaks, but your points are valid, tying in well with the comment immediately after yours (below).

      Cachet took risks, but so did all their clients. None appeared to have a backup plan or any way to mitigate financial loss.

  28. Cachet had ZERO safety nets set in place. Transferring millions into any account you want was one data entry error away. The money takes two days to complete a transfer like that and it’s long gone before cachet even knows about it. They send a vague email “welcoming” phones calls then shut their phones off. I was on hold for 4.5 hours with Eftps to see what could be done about tax payments because cachet screwed everyone. Their useless emails are a joke. I doubt anyone will get their retainers back. They deserve to be permanently out of business for the complete lack of communication, responsibility and professionalism. What a nightmare!!!!

  29. It’s now Wednesday 10/29 and me/my company has still NOT received our money back. It’s insane. Although they told our company funds had to be wired by 4pm not 1pm last Thursday- which my bosses rushed to the bank to wire funds and now we are almost here a week later – they said they’re now refusing to do the deposit and are supposed to be sending the money back. Now we are stuck waiting for them to transfer funds back so we can get paid. This is a serious crisis.

    Thankfully our company has offered loans to any employees who need it and we’ve all been understanding it’s not our company’s fault but if this continues I’m not sure what’s going to happen. Our last update was 10:30am this Tuesday morning saying to wait for funds to be transferred back so we can write checks but no update since then and no money! I hope someone stares a lawsuit!

    • ““Due to ongoing fraud protocol with our bank, they are requiring pre-funding via Direct Wire for all batches that were uploaded this week,”

      So in your case, they aren’t paying employees / taxes, despite wiring the funds?

    • Sorry to hear this! I work for ADP and would be happy to chat and help however I can. Reach out if I can be a resource. Jacob.stoehr@adp.com

Leave a comment