The FBI's 2026 ISO broker fraud investigation — what every MCA merchant needs to know.

What the FBI is actually investigating

The investigation, run jointly by the FBI's New York and New Jersey field offices and the US Attorney's Office for the Eastern District of New York, began in 2023 in response to a pattern of merchant complaints filtered up through state banking regulators. The complaints shared a common shape: small businesses taking MCAs they could not service, defaulting within months, and discovering either that the bank statements submitted on their behalf had been altered or that their contracts contained confessions of judgment they had never been told about.

Through 2024 and 2025 the investigation expanded to include funder-side compliance conduct — specifically whether MCA funders were aware of forgery patterns coming from particular ISO shops and continued to fund deals from those shops anyway. The first public indictments were unsealed in March 2026. By June 2026 the count stands at 14 indictments and three convictions, with additional grand jury activity ongoing.

The investigation is structurally significant because it represents the first coordinated federal criminal enforcement against the ISO broker channel in MCA history. State-level civil enforcement under CFDLs in California, New York, New Jersey, and elsewhere has been growing, but federal criminal cases set a different precedent — one that funders and broker shops nationwide are watching carefully.

The four fraud patterns the indictments describe

1. Bank statement forgery

The most common allegation across the unsealed indictments. The mechanic is straightforward: a merchant provides their broker with three to six months of bank statements as part of the funding application. The broker, often working with an in-house "processor," modifies the statements before submitting them to the funder. Typical modifications:

• Inflating monthly deposits. A merchant with $28,000 in real monthly deposits is submitted at $42,000. Funder underwrites to the inflated number; merchant is approved for an advance the real revenue cannot service.
• Removing overdraft or NSF entries. A merchant with three NSFs in the trailing 90 days is submitted as having zero. Funder's automated underwriting flags drop; merchant is approved as low-risk when actual risk is high.
• Removing existing MCA debits. A merchant already servicing an advance is submitted as having no existing financing. Funder doesn't see the existing payment load; the new advance creates a stack that defaults within months.

Two of the 2026 indictments allege broker shops where the forgery rate on submitted deals exceeded 20%. The Department of Justice estimated total funder losses from the indicted conduct at $47 million across the two shops.

2. Coordinated double-funding

Less common than forgery but more damaging per-deal. A broker funds a merchant with Funder A, then within days or weeks submits the same merchant to Funder B without disclosing the first advance. The merchant gets funded twice for what is structurally the same deal. Both ACH debits hit the merchant's account; the merchant defaults; both funders take losses; the broker has earned two commissions and moved on.

Anti-stacking software (clear, MCA Track, Stackr, and similar funder consortiums) has reduced double-funding rates over the past several years by sharing recently- funded deal data across participating funders. But the consortiums don't cover every funder — particularly newer entrants and smaller regional funders. The indictments allege coordinated rings targeted these gap funders specifically, often rotating deals through different funders to avoid the consortium overlap.

3. Confession-of-judgment abuse

A confession of judgment (COJ) is a legal instrument by which a debtor confesses liability in advance, allowing the creditor to obtain a court judgment without notice or hearing if the debtor later defaults. New York banned the use of COJs against out-of-state defendants in 2019; New Jersey's SB 819 prohibits them in covered commercial financing transactions originated after April 1, 2026. But for several years between 2019 and 2026, a parallel ecosystem developed: MCA contracts containing COJs marketed to merchants without explaining what the COJ was or what it meant, then funders filing the COJs in friendly New York jurisdictions (typically Erie or Niagara County) to obtain judgments before the merchant knew they were in litigation.

Several of the 2026 indictments include charges related to COJ abuse — specifically, brokers who marketed MCAs to merchants while affirmatively misrepresenting that the contract contained no confession of judgment. Merchants discovered the judgments only when their bank accounts were frozen, often by ACH attachments that took the entire account balance.

The DOJ's theory is that the broker marketing constituted wire fraud — the merchant was induced to sign the contract based on a material misrepresentation transmitted through interstate wires. The first conviction in May 2026 was on this theory and resulted in a 27-month federal sentence.

4. Reconciliation misrepresentation

MCA contracts typically include a reconciliation clause: if the merchant's actual sales fall below the projected level, the merchant can request a downward adjustment to the daily ACH debit. In practice, most funders treat the reconciliation right as discretionary and narrowly applied — but the legal language in the contracts sounds more automatic.

The indictments allege that several broker shops were affirmatively marketing reconciliation as "automatic" or "guaranteed" — telling merchants "if your sales drop, the payment drops too" in a way that the contract did not actually support. Merchants who later requested reconciliation were denied, defaulted, and faced collection actions. The misrepresentation itself, transmitted by wire, is the basis for the wire fraud charges in three of the 2026 indictments.

Why this investigation is structurally important

For most of the modern MCA industry's history (the channel really took off around 2010), the ISO broker tier has operated with light regulatory oversight. State licensing of commercial finance brokers has been a patchwork — some states require licensing, some don't, and enforcement has been concentrated on the provider side rather than the broker side. The 2026 federal indictments are the first time the broker tier itself has been the focus of coordinated criminal enforcement.

Three downstream effects already visible by June 2026:

• Funder compliance has tightened. Major funders are running enhanced bank statement verification — direct API connections to merchant bank accounts where possible, third-party verification services where not. The era of accepting whatever PDF the broker submitted is ending.
• Broker shop consolidation. Many smaller ISO shops have closed or been absorbed by larger operations with better compliance infrastructure. The channel that used to have thousands of small brokers is consolidating into hundreds of mid-size brokers and dozens of large ones.
• State CFDL enforcement coordination. California DFPI, New York DFS, New Jersey DOBI, and the Texas OCCC have begun sharing enforcement intelligence with the FBI, creating a federal-state enforcement network that didn't previously exist.

How to fund without going near the fraud zone

Five practical rules for any small business considering MCA funding in 2026:

• Never let anyone "help" you with your bank statements. Provide your statements directly, in the form your bank issues them. If a broker offers to "clean them up" or "optimize" them, walk. That offer is itself a hard stop.
• Know which funder is reviewing your application. Legitimate brokers disclose this up front. If your broker is vague or evasive, that is a yellow flag. A broker who refuses to name the funder is a hard stop.
• Read the contract for "confession of judgment." Search the contract PDF for the phrase. If it appears, do not sign without a commercial finance attorney reviewing it. In New York, New Jersey, and an expanding list of other states, COJs are legally prohibited for new transactions — but the contract may still contain the language.
• Test the reconciliation language. Ask the broker, in writing, what happens if your sales drop 30%. Get the answer in email. Then compare the answer to what the contract actually says. If the broker's representation doesn't match the contract, that is evidence of misrepresentation.
• Demand the disclosure block before you sign. If you are in California, New York, New Jersey, Texas, Utah, Virginia, Connecticut, or any of the other disclosure states, the funder must provide a tabular disclosure with estimated APR before contract execution. Demand it. Funders who don't provide it are non-compliant; brokers who push you to sign without it are signaling something.

How Fundnode is structured to avoid the fraud zone

We are a referral platform, not a broker and not a funder. Three things that follow from that structure:

• We never touch your bank statements. Our pre-qualification flow asks you four questions about your revenue and history. We use that information to identify funders likely to approve you, and we hand off directly to those funders. Your bank statements go from you to the funder; they never go through us.
• We never modify your application. We don't fill out the funder application for you; we don't edit your answers; we don't adjust anything. Your application is your own statement to the funder.
• We route only to vetted funders. Funders subject to FBI investigation, federal indictments, or active DFS / DFPI / DOBI enforcement actions are not routed to. Funders who use confessions of judgment as a standard instrument in any jurisdiction are not routed to, period.

What to do if you think you have been a victim

If you suspect you were targeted by one of the patterns described above:

• Preserve everything. Every email, every text, the original application materials you submitted, the bank statements you sent (the originals, not the versions the funder may have on file), the executed contract, and any marketing materials the broker sent you.
• Contact a commercial finance attorney before acting. Defenses against MCA enforcement are technical; the wrong unilateral action (stopping ACH debits, transferring assets) can convert a defensible position into an indefensible one.
• File a complaint with the FBI's IC3. The Internet Crime Complaint Center (ic3.gov) is the FBI's clearinghouse for federal fraud complaints. Your complaint may join a pattern under existing investigation.
• File with your state banking regulator. DOBI in New Jersey, DFS in New York, DFPI in California, OCCC in Texas, Department of Commerce in Ohio. State enforcement is faster than federal and often pairs effectively with federal cases.
• Don't pay anyone offering to "fix" the situation. A secondary fraud ecosystem has developed around the primary one — "debt settlement" operations that promise to resolve MCA debts for fees up front, then disappear. Legitimate commercial finance attorneys do not solicit you with cold calls or emails offering miracle resolutions.

The bigger picture

The 2026 FBI investigation is structurally important not because of the specific indictments — those will work their way through the criminal justice system over the next several years — but because of the precedent. For more than a decade, the MCA broker tier has been the largely unregulated entry point for the industry. The investigation marks the moment when that ended. Combined with the wave of state commercial financing disclosure laws — California SB 1235, NYDFS Part 803, Texas SB 1280, NJ SB 819, Ohio SB 232, and the rest — the industry is moving toward a regime where merchants get honest math at the offer stage and brokers face real consequences for the kinds of conduct that defined the channel's worst decade.

For small businesses considering MCA funding in 2026, the takeaway is two-fold. First, the legal environment is materially safer than it has been since the channel emerged. Second, that safety is not automatic — it depends on choosing funding partners and platforms that operate above the line. Choose accordingly.