The Clinical Research Support Office is aware of escalating fraudulent activity impacting participant debit cards and the significant burden this could place on your participants to submit fraud claims to the Hyperwallet Visa team. It is unacceptable that some participants are receiving cards with depleted funds due to this activity. We understand that replacement cards issued by departments have also been compromised.
Background on Fraudulent Activity:
- November 15, 2024: Advarra was informed that Hyperwallet (a PayPal service) banned all TikTok shop transactions within the payment program to mitigate suspicious activity.
- March 2025: Advarra reported “suspicious transactions from TikTok shop” affecting participants’ Payments Visa Cards to the University of Utah. Despite Hyperwallet’s proactive measures, these transactions continued, prompting Advarra to instruct Hyperwallet to investigate.
- May 2025: Advarra reported to the University of Utah that Hyperwallet, in collaboration with their banking partner, FIS (Financial Institution Services), implemented enhanced fraud prevention controls. These included stronger merchant-level restrictions and security monitoring protocols across the card network to safeguard participant Visa cards from unauthorized transactions and improve the authorization process.
- July 2025: CRSO contacted Advarra regarding a continued increase in fraudulent activity on Hyperwallet cards. Advarra confirmed that despite new prevention methods, criminals are still able to predict additional card numbers from the same batch, leading to ongoing compromise. This indicates a sophisticated cybercriminal operation targeting cards before they are even used.
Immediate Action Required:
Effective immediately, all study teams must temporarily cease distributing debit cards to participants. The current cycle of issuing and reissuing compromised cards is unsustainable and unapproved.
Alternative Payment Methods:
Please utilize direct deposit or one of the other approved forms of compensation: gift cards, or ePR, as outlined in the “Payments to Human Research Participant” guidelines. This temporary measure will remain in effect until a secure replacement for debit cards is identified.
Refund Process for Compromised Cards:
The CRSO team is actively reviewing the process for refunding departments for compromised and invalid cards. We are halting all requests for new cards until the Hyperwallet debit card issue is fully resolved. For departments that have had to repay participants for stolen funds where fraud claims were denied, CRSO will work to refund your study accounts for the amount stolen.
We sincerely apologize for the inconvenience this issue and understand the frustration it has created for your teams and study participants. We are committed to finding a better, more secure option.
Please note that this is a temporary measure. The IRB is aware of the issue and does not require an amendment submission at this time. If you have any questions, feel free to contact the CRSO Payments Support Teams Channel, Marlyn Galindo at marlyn.galindo@hsc.utah.edu or Jaci Skidmore at jaci.skidmore@hsc.utah.edu.
Thank you.