I came across a merchant who would not sign a coj or do log in but had a cash advance company pulling. They actually edited the daily cash advance pulls into the bank statements that were sent in. With Certain banks it's easy to listen to transaction history on their automated system with info that's on the app, that's how I figured out it was fraud. If they're not willing to give up log in or decision logic don't waste too much time with them, it's almost always fraud from my experience.