# Payments & Risk - Full Documentation > Complete documentation from paymentsandrisk.com. Free knowledge base for payments, fraud, and chargeback professionals targeting merchants and SMBs. > Generated: 2026-08-05 --- ## All Guides: Payments, Chargebacks, Fraud and Compliance Source: https://paymentsandrisk.com/docs/index # All Guides Every page on the site, grouped. If something is going wrong right now, the [front page routes by symptom](/) instead. ## The seven sections | Section | What is in it | |---------|---------------| | [Accepting payments](/docs/payments) | How money moves, processor choice, fees, approval rates | | [Chargebacks and disputes](/docs/chargebacks) | Reason codes, deadlines, fighting them, preventing them | | [Fraud prevention](/docs/fraud) | Detection, tools, what to buy and when not to buy | | [Rules and compliance](/docs/compliance) | Network rules, PCI, consumer protection law | | [Day-to-day operations](/docs/operations) | Reconciliation, payouts, holds, running a risk team | | [Step-by-step playbooks](/docs/playbooks) | For the day it is already going wrong | | [Reference tables](/docs/reference) | Codes, thresholds, deadlines, definitions | ## Look something up | Table | Use it for | |-------|-----------| | [Chargeback reason codes](/docs/reference/reason-codes) | The code on a dispute notice, and what evidence beats it | | [Decline codes](/docs/reference/decline-codes) | Why a payment failed at checkout, and whether to retry | | [Benchmarks](/docs/reference/benchmarks) | Whether your approval, fraud and chargeback numbers are normal | | [Response deadlines](/docs/reference/time-frames) | How many days you get, by network and stage | | [Business category codes (MCC)](/docs/reference/mcc-codes) | Your merchant category code, and why it affects your rates | | [Glossary](/docs/reference/glossary) | Plain-English definitions for every term used here | ## Start where you are Not a course, just the order these topics make sense in for the job you actually do. **Running a small business.** [Choosing a processor](/docs/payments/buying-payments) then [preventing chargebacks](/docs/chargebacks/prevention) then [reducing them fast](/docs/playbooks/reduce-chargebacks-fast) when the ratio moves. **Running an online store.** [Checkout conversion](/docs/payments/checkout-conversion) then [getting more payments approved](/docs/payments/auth-optimization) then [3D Secure](/docs/fraud/prevention/3ds) once fraud starts costing more than the friction. **Working in fraud or risk.** [Fraud types](/docs/fraud/types) then [risk scoring](/docs/fraud/prevention/risk-scoring) then [velocity rules](/docs/fraud/detection/velocity-rules) then [fraud metrics](/docs/fraud/metrics) to know if any of it worked. **Running payment operations.** [Settlement and reconciliation](/docs/payments/settlement) then [processor management](/docs/operations/processor-management) then [chargeback metrics](/docs/chargebacks/metrics). **Buying a tool.** [Chargeback vendors](/docs/chargebacks/vendors), [fraud vendors](/docs/fraud/vendors/landscape), and [how to evaluate one](/docs/fraud/vendors/selection-guide) without being sold to. ## Prefer to learn it in order? [The Guide](/docs/learning-pathways) is 15 short lessons, about 105 minutes, in sequence. Start at [pathway 1](/docs/learning-pathways/getting-started-with-payments/introduction) if you only do one, because processor choice and fees drive everything else. --- # Payments ## Getting More Payments Approved (Auth Optimization) Source: https://paymentsandrisk.com/docs/payments/auth-optimization # Getting More Payments Approved (Auth Optimization) :::warning[Customers being declined right now?] If customers are actively telling you their cards won't go through, don't start here - start with the [Fix Declining Auth Rates playbook](/docs/playbooks/fix-declining-auth-rates), an hour-by-hour diagnostic for a sudden decline spike. If the problem is customers abandoning checkout (not card declines), see [Checkout Conversion](/docs/payments/checkout-conversion). Come back to this page for the longer-term optimization work. ::: :::info[Match the effort to your size] **Under $100K/month?** Check your auth rate in your processor dashboard. Above 90%: no urgent problem, and the heavier optimizations below (network tokens, 3DS exemptions) won't pay back yet - just make sure your retry logic is sane. Below 90%, or customers complaining: run the [Fix Declining Auth Rates playbook](/docs/playbooks/fix-declining-auth-rates) to find out why. **$100K-$500K/month?** Start with retry logic and 3DS exemptions. Network tokens are worth a look. **Over $500K/month?** All of it applies. Every 1% you claw back is real revenue. ::: :::info[TL;DR] - **Baseline first**: CNP e-commerce averages 85-90%. The top merchants clear 95%. Know yours before optimizing - **Network tokens**: +2-5% auth lift; tokenized credentials outperform raw PANs with issuers - **Retry logic**: Soft declines (51, 91) = retry in 3-5 days; hard declines (41, 43, 54) = never retry - **[3DS](/docs/fraud/prevention/3ds) exemptions**: Request TRA, low-value, recurring exemptions where you qualify - **Flag correctly**: MIT vs. CIT matters. Wrong flags = higher declines ::: Your auth rate is the share of attempted card payments that the customer's bank approves, and auth optimization is the work of pushing that share up. That rate is revenue. Every 1% you gain is 1% more money. ## Popular in This Section - **[Fix Declining Auth Rates Playbook](/docs/playbooks/fix-declining-auth-rates)** - Emergency diagnostic when declines suddenly spike - **[Optimization Tactics](./tactics)** - Network tokens, retry logic, 3DS exemptions, and transaction flags - **[Increase Auth Rates Playbook](/docs/playbooks/increase-auth-rates)** - Step-by-step guide to improving approval rates - **[Decline Codes Reference](/docs/reference/decline-codes)** - Understanding why transactions fail and what to do --- Most SMBs don't know theirs, and when you ask, they guess high. In reality, CNP e-commerce averages 85-90%. The top merchants clear 95%. That gap's real money you're not collecting. ```mermaid flowchart TD A[TransactionSubmitted] --> B{Decline?} B -->|Approved| C[RevenueCaptured] B -->|Declined| D{DeclineType?} D -->|Hard| E[Do Not RetryLost Card, Fraud] D -->|Soft| F{RetryStrategy} F -->|Wait 3-5 days| G[RetryTransaction] G --> B subgraph LEVERS["Optimization Levers"] L1[Network Tokens+2-5%] L2[3DS Exemptions+1-3%] L3[Smart Retry+1-2%] L4[Correct FlagsMIT vs CIT] end style C fill:#22c55e,color:#fff style E fill:#ef4444,color:#fff style L1 fill:#3b82f6,color:#fff style L2 fill:#3b82f6,color:#fff style L3 fill:#3b82f6,color:#fff style L4 fill:#3b82f6,color:#fff ``` ## What Matters 1. **Know your auth rate.** Can't fix what you don't measure. 2. **Network tokens lift approval 2-5%.** Issuers trust a token more than they trust a raw PAN. 3. **Retry logic matters.** Wrong retries burn issuer trust. Right retries recover revenue. 4. **3DS is a lever, not just compliance.** Used well it improves auth. Used badly it kills conversion. 5. **Issuer declines have patterns.** Learn your top decline reasons and fix the fixable ones. --- ## Auth Optimization Topics [ ๐Ÿ”ง Optimization Tactics Network tokens, retry logic, 3DS optimization, transaction flags ](/docs/payments/auth-optimization/tactics) [ ๐Ÿ“ˆ Increase Auth Rates Playbook Step-by-step guide to improving approval rates ](/docs/playbooks/increase-auth-rates) --- ## Know Your Auth Rate Baseline before you touch anything. ### How to Calculate ``` Auth Rate = Approved Transactions / Total Attempted Transactions ร— 100 ``` ### What's Normal | Business Type | Typical Auth Rate | Top of Range | |---------------|-------------------|---------------| | E-commerce (US domestic) | 85-90% | 95%+ | | Subscription (initial) | 80-85% | 90%+ | | Subscription (recurring) | 90-95% | 97%+ | | Card-present (CP) | 98-99% | 99%+ | | International CNP | 75-85% | 90%+ | If you're below "typical," there's low-hanging fruit. ### Where to Find It Check your processor dashboard. Look for: - "Authorization rate" or "Approval rate" - Filter by: card brand, card type, geography, transaction type :::note[Ask Your Dev] "Where can I see our overall auth rate? Can I filter by card brand and geography?" ::: --- ## Quick Reference: Decline Types | Type | Examples | Action | |------|----------|--------| | **Soft decline** | Insufficient funds (51), Issuer unavailable (91) | Retry in 3-5 days | | **Hard decline** | Lost card (41), Stolen (43), Expired (54) | Do not retry | | **Ambiguous** | Do not honor (05) | Try once more, then stop | How to handle each one's in [optimization tactics](./tactics#hard-vs-soft-decline-logic). --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Know your auth rate. Ensure basic retry logic is sane. Enable 3DS for high-risk only. | | **$100k-$1M/mo** | Monthly decline code analysis. 3DS exemption strategy. Network token migration. | | **Over $1M/mo** | Issuer-level optimization. Dedicated auth rate monitoring. A/B test 3DS strategies. Multiple processor routing for auth lift. | --- ## Where This Breaks 1. **International transactions.** Cross-border declines are structurally higher. Local acquiring helps, but it's more moving parts. 2. **High-risk MCCs.** Some industries have elevated decline rates regardless of optimization. Issuers are more conservative. 3. **New merchants without history.** Issuers trust a track record. Until you've got one, you'll see higher declines. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Overall auth rate** | Baseline health | Over 90% US domestic CNP | | **Auth rate by card brand** | Network-specific issues | Visa/MC should be similar | | **Auth rate by geography** | Cross-border friction | Domestic > international | | **Soft vs. hard decline ratio** | Retry opportunity | Soft should be over 50% of declines | | **Retry success rate** | Retry logic effectiveness | Over 20% of soft declines recovered | | **3DS challenge rate** | Friction level | Under 20% of 3DS transactions challenged | | **3DS conversion rate** | Challenge completion | Over 80% complete challenge | ### Trend Over Snapshot Auth rate fluctuates. Track weekly trend, not daily snapshot. A 0.5% week-over-week decline is a signal. A 0.5% daily swing is noise. --- ## Next Steps **Just starting auth optimization?** 1. Pull your current auth rate from your processor dashboard โ†’ Baseline before optimizing 2. Identify your top 5 decline codes โ†’ Focus fixes on highest-impact issues 3. Check if you're using network tokens โ†’ If not, migrate stored cards to tokens **Ready to improve?** 1. Review [optimization tactics](./tactics) โ†’ Network tokens, retry logic, 3DS 2. [Follow the increase auth rates playbook](/docs/playbooks/increase-auth-rates) โ†’ Step-by-step optimization 3. Implement smart retry logic โ†’ Recover soft declines without burning issuer trust **Already optimizing?** 1. Set up weekly auth rate monitoring โ†’ Track trends, not snapshots 2. Segment by card brand and geography โ†’ Find specific weak spots 3. Consider multi-processor routing โ†’ Route to best-performing processor by issuer --- ## See Also - [Fix Declining Auth Rates](/docs/playbooks/fix-declining-auth-rates) - Emergency diagnostic for sudden decline spikes - [Optimization Tactics](./tactics) - Detailed optimization techniques - [3DS Deep Dive](/docs/fraud/prevention/3ds) - Authentication optimization - [Increase Auth Rates Playbook](/docs/playbooks/increase-auth-rates) - Step-by-step guide - [Subscriptions and Recurring](/docs/payments/subscriptions-recurring) - Recurring billing - [Checkout Conversion](/docs/payments/checkout-conversion) - Reducing abandonment - [Decline Codes Reference](/docs/reference/decline-codes) - Understanding failures - [Payments Metrics](/docs/payments/metrics) - Performance tracking --- ## Buying Payments Source: https://paymentsandrisk.com/docs/payments/buying-payments # Buying Payments :::tip[Launching soon? Here's the short answer] If you're opening a new business or online store and just need to accept cards next month: **sign up with an aggregator - Stripe, Braintree or Square for most businesses, Shopify Payments if you're on Shopify.** All are no monthly fee and no contract. Published rates, verified against each vendor's own pricing page on 2026-08-02: | | Online | In person | |---|---|---| | [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | 2.89% + $0.29 | Not separately published | | [Square](https://squareup.com/us/en/payments/our-fees) | 3.3% + 30c (Free plan), 2.9% + 30c (Plus and Premium) | **2.6% + 15c** (Free plan) | | [Stripe](https://stripe.com/pricing) | 2.9% + 30c domestic | Terminal **2.7% + 5c** | | [Helcim](https://www.helcim.com/pricing/) | Interchange + 0.50% + 25c, $0/month | Interchange + 0.40% + 8c, $0/month | At your starting volume, none of these will beat the others by enough to matter, and you can switch later once you have real numbers. The one exception worth knowing on day one: if you're taking cards in person and your customers pay mostly with debit and ordinary consumer credit, Helcim's published interchange-plus rate is cheaper than Square's flat rate on almost every sale, and it also charges $0 a month. There's no volume you have to reach first. Then set it up right in your first week: [Stripe first week](/docs/playbooks/stripe-first-week) ยท [Square first week](/docs/playbooks/square-first-week) ยท [Shopify first week](/docs/playbooks/shopify-first-week) The rest of this section is for when you have volume worth negotiating over - roughly $50k/month and up. ::: :::info[TL;DR] - **Overpaying is the default**: 30-50 basis points separate a good deal from a bad one, costing $1,500-$2,500/year on $500k volume - **All-in cost is the only real number**: a clean 2.5% all-in beats a quoted 2.2% plus seven junk fees - **Volume dictates your stack**: under $100k/mo use aggregators, $100k-$1M/mo negotiate direct, over $1M/mo require custom pricing and token portability - **Contract terms beat pricing**: early termination fees, reserves, and auto-renewals cost more than basis points - If you're paying over 2.9% all-in above $50k/mo, pull 3 months of statements and get one competitive bid ::: Most SMBs overpay for payments because they don't know what questions to ask. The difference between a good processor deal and a bad one is 30-50 basis points. On $500k/year, that's $1,500-$2,500 walking out the door. ## What Matters 1. **All-in cost, not quoted rate.** The rate they advertise isn't the rate you pay. 2. **Contract terms, not just pricing.** Early termination fees, reserves, and auto-renewals hurt more than basis points. 3. **Volume-appropriate stack.** What works at $20k/mo is wrong at $200k/mo. 4. **Exit strategy.** Can you leave with your tokens? If not, you're locked in. 5. **Support quality.** When money stops moving, response time matters. ## Buying Payments Topics :::tip[Recommended Reading Order] If you're choosing a processor for the first time, read these in order: 1. **Selection** - How to evaluate and choose a processor 2. **Contracts** - What to look for (and watch out for) in processor agreements 3. **Underwriting** - What processors check and how to get approved 4. **Integration** - Technical setup options and PCI scope ::: [ ๐Ÿข Processor Profiles Stripe vs Square vs PayPal vs Adyen - when to use which one ](/docs/payments/processors) [ ๐ŸŽฏ Processor Selection The 3-bid method, volume-based recommendations, PayFac vs direct ](/docs/payments/buying-payments/selection) [ ๐Ÿ“ Contracts Fee breakdown, contract gotchas, negotiation tactics ](/docs/payments/buying-payments/contracts) [ ๐Ÿ” Underwriting Approval process, documents needed, limits, and ongoing monitoring ](/docs/payments/buying-payments/underwriting) [ ๐Ÿ”ง Integration & Exit API vs hosted, token portability, card-present, Level 2/3 ](/docs/payments/buying-payments/integration) ## Popular in This Section - **[Processor Selection](./selection)** - The 3-bid method and volume-based recommendations - **[Contracts](./contracts)** - Fee breakdowns, contract gotchas, negotiation tactics - **[Underwriting](./underwriting)** - Approval process and documentation needed ## Quick Reference: Volume Recommendations | Volume | Recommendation | Focus | |--------|----------------|-------| | **Under $100k/mo** | Aggregators (Stripe, Braintree, Square) for simplicity, or Helcim for the lowest published cost in person | Simplicity over optimization, unless your card mix is debit-heavy | | **$100k-$1M/mo** | Shop for rates, consider direct. Benchmark every bid against Helcim's published band for your volume | Negotiate reserves and terms | | **Over $1M/mo** | Custom pricing, redundancy | Token portability required | Square's own page says custom pricing conversations start above **$250,000 a year**, or about $21K/month, so don't wait for $1M to ask. ## Quick Reference: Legitimate vs Junk Fees | Legitimate | Junk (Negotiate Away) | |------------|----------------------| | Interchange (about 0.9% in person, 1.4% online, blended) | PCI compliance fee | | Network assessments (not published, assumed 0.14%) | Batch fee | | Processor markup (0.1-0.5%) | Statement fee | | | Annual fee | | | Minimum monthly fee | Interchange is a blend, not a rate. Individual cards run from 0.05% + $0.21 on regulated debit to 3.15% + $0.10 on a non-qualified penalty rate, per Visa's US schedule of 18 April 2026 and Mastercard's of 17 April 2026. [The blend and its derivation](/docs/payments/reference/cost-model-assumptions). **Reality check:** A processor with a clean 2.5% all-in is often cheaper than one quoting 2.2% plus seven line-item fees. **You have a published benchmark for the junk column.** [Helcim](https://www.helcim.com/pricing/) charges $0 monthly, and no setup, PCI, cancellation or statement fees, with the interchange markup published band by band ([verified 2026-08-02](https://www.helcim.com/pricing/)). When an ISO tells you a PCI fee or a statement fee is standard, that's the counterexample. ## The $50k/mo Exit Test **Every 6 months, ask yourself:** 1. What's my all-in effective rate? 2. Is my current processor still the best fit for my volume? 3. Have I outgrown my current contract terms? 4. Could I leave if I wanted to? (Token portability) If you're paying more than 2.9% all-in above $50k/mo, you're likely overpaying. ## Test to Run **2-week exercise:** 1. Pull your last 3 months of statements 2. Calculate your true all-in rate: (Total fees / Total volume) 3. Get one competitive bid 4. Compare **Success criteria:** You either confirm you're well-priced, or you find savings worth pursuing. --- ## Next Steps **Just picked a processor?** 1. [Stripe first week](/docs/playbooks/stripe-first-week) โ†’ Day-by-day setup checklist 2. [Square first week](/docs/playbooks/square-first-week) โ†’ Day-by-day setup checklist 3. [Shopify first week](/docs/playbooks/shopify-first-week) โ†’ Day-by-day setup checklist **Shopping for a processor?** 1. Use the [3-bid method](./selection#the-3-bid-method) โ†’ Get three competitive quotes 2. Calculate your all-in effective rate โ†’ Compare apples to apples 3. Review [contract terms](./contracts) before pricing โ†’ Termination fees matter more than basis points **Already have a processor?** 1. Audit your current effective rate โ†’ Are you paying what you expected? 2. Review your contract terms โ†’ When does it renew? ETF clause? 3. [Check processor management](/docs/operations/processor-management) โ†’ Ongoing optimization --- ## See Also - [Payment Provider Types](/docs/payments/reference/provider-types) - Gateway vs processor vs ISO vs PayFac - [Processor Management](/docs/operations/processor-management) - Ongoing relationship management - [Processor Comparison](/docs/payments/processor-comparison) - Side-by-side comparison - [Reading Statements](/docs/operations/reading-statements) - Understanding fees - [Holds and Reserves](/docs/operations/holds-and-reserves) - Cash flow impact --- ## Payments Source: https://paymentsandrisk.com/docs/payments # Payments :::info[TL;DR] - How card transactions actually work, from swipe to deposit - Authorization asks "can this card pay?". Capture commits to it. Settlement is when money actually moves, one to three days later - Treat every control on these pages as a test. Start small, measure, then roll out - Looking for one answer? The Quick Answer table below routes you straight there ::: You're either working out why a transaction failed, or where your money went. Both start here. Treat every control on these pages as a test. Start small, measure it, then roll it out if it's working. ## Quick Answer | Looking for... | Go here | |---------------|---------| | **Which processor should I use?** | [Processor Comparison](/docs/payments/processors) | | **How much will processing cost?** | [Total Cost Model](/docs/payments/total-cost-model) | | **Why are transactions failing?** | [Auth Optimization](/docs/payments/auth-optimization) | | **How does settlement work?** | [Settlement](/docs/payments/settlement) | | **What payment methods should I accept?** | [Payment Methods](/docs/payments/payment-methods) | | **Understanding my statement** | [Reading Statements](/docs/operations/reading-statements) | --- ## Are You Card-Present or Card-Not-Present? *Not sure? If customers swipe/tap in person, you're CP. If they type their card online, you're CNP.* ๐Ÿช Card-Present (In-Person) [Terminal Decisions](/docs/payments/card-present-terminal-decisions) [Terminal Operations](/docs/operations/terminal-operations) [Card-Present Fraud](/docs/fraud/card-present-fraud) Lower interchange, higher liability shift ๐Ÿ’ป Card-Not-Present (Online) [Checkout Conversion](/docs/payments/checkout-conversion) [Auth Optimization](/docs/payments/auth-optimization) [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) Higher fraud risk, more prevention options ## Pick Your Mode [ ๐Ÿ”ง Operator Action guides for day-to-day decisions. Start here. ](/docs/payments/buying-payments) [ ๐Ÿ“Š Analyst Metrics, measurement, and optimization tactics. ](/docs/payments/metrics) [ ๐Ÿ“š Reference Lookup tables, codes, and specifications. ](/docs/reference/decline-codes) Popular --- :::tip[If You Only Have 2 Hours This Week] 1. Calculate your effective rate (total fees / total volume). On interchange-plus pricing, above 2.9% deserves investigation. On aggregator pricing (Stripe at 2.9% + $0.30, Square at 2.6-3.3% depending on plan), your effective rate will naturally be 3.0-3.5% depending on average ticket size - that's normal for that pricing model. 2. Pull your top 5 decline codes from last month. Pick the most common one and read what it means. 3. Got recurring billing? Check how many customers failed payment in the last 30 days. Are you retrying intelligently? That's it. Dashboards and optimization can wait. ::: :::info[Scale Matters] **Under $50K/month:** Use a simple all-in-one processor (Stripe, Square, PayPal). Don't negotiate rates yet. Your volume doesn't justify it. Focus on getting paid reliably. **$50K-$150K/month:** You've got a little leverage, not much. Work on [checkout conversion](/docs/payments/checkout-conversion) first, it pays back hardest. Make sure guest checkout is smooth. Check your auth rate monthly, 85-90% for US domestic CNP. Watch that your effective rate isn't creeping up. Don't touch interchange, fraud tools or orchestration yet. At this size the money's in growing revenue, not shaving payment costs. **$150K-$1M/month:** your effective rate matters now. Compare it to benchmarks, ask your processor about interchange-plus, and start tracking decline codes monthly. You're big enough that they'll answer. **Over $1M/month:** Negotiate interchange-plus pricing if you haven't. Consider a dedicated payment gateway vs. all-in-one. Auth optimization becomes worth the effort. **Over $10M/month:** Multi-processor strategy, dedicated payment operations person, and formal vendor reviews. See [Scaling Milestones](/docs/operations/scaling-milestones). ::: ### How a Transaction Flows From checkout to cash in your bank account. ```mermaid flowchart LR subgraph CHECKOUT["Checkout (Seconds)"] A[CustomerEnters Card] --> B[PaymentGateway] end subgraph AUTH["Authorization (2-3 sec)"] B --> C[Processor] C --> D[Card Network] D --> E[Issuing Bank] E -->|Approve/Decline| D D --> C C --> B end subgraph SETTLE["Settlement (1-3 days)"] B -->|Batch Close| F[Clearing] F --> G[InterchangeFees Deducted] G --> H[Funds toYour Bank] end style A fill:#3b82f6,color:#fff style E fill:#8b5cf6,color:#fff style H fill:#22c55e,color:#fff ``` | Phase | What Happens | Timing | |-------|--------------|--------| | **Authorization** | "Can this card pay?" - Funds reserved | 2-3 seconds | | **Capture** | "Charge it now" - Transaction finalized | Same day or delayed | | **Clearing** | Networks calculate who owes what | End of day | | **Settlement** | Money moves between banks | T+1 to T+3 | | **Funding** | Cash hits your account | T+1 to T+3 | **Deep dives:** [Authorization & Capture](/docs/payments/auth-and-capture) | [Settlement](/docs/payments/settlement) | [Money Flow](/docs/payments/settlement/money-flow) --- Planning & Budgeting [ ๐Ÿ’ฐ Business Model Viability Can you afford payment costs? Unit economics calculator. ](/docs/payments/business-model-viability) [ ๐Ÿ“Š Total Cost Model Complete budgeting worksheet - fees, chargebacks, tools, reserves. ](/docs/payments/total-cost-model) [ ๐Ÿ› ๏ธ Tool Stack by Tier What fraud/chargeback tools to buy at each volume tier. ](/docs/payments/tool-stack) [ โš ๏ธ Top 10 Mistakes Preventable errors costing $5K-$50K+ each. ](/docs/payments/common-mistakes) [ ๐Ÿ“ˆ Scaling Milestones What changes at each volume tier as you grow. ](/docs/operations/scaling-milestones) --- Getting Started [ ๐Ÿ”Œ Gateway Basics What gateways do and when you need one. ](/docs/payments/reference/gateway-basics) [ ๐Ÿข Processor Profiles Stripe vs Square vs PayPal vs Adyen - which to use. ](/docs/payments/processors) [ ๐Ÿ›๏ธ Buying Payments Choosing a processor, negotiating rates, avoiding contract traps. ](/docs/payments/buying-payments) [ โšก Stripe First Week Day-by-day setup after Stripe approval. ](/docs/playbooks/stripe-first-week) [ โ–ช๏ธ Square First Week POS setup, staff training, prevent keyed-in fees. ](/docs/playbooks/square-first-week) [ ๐Ÿ›’ Shopify First Week Shopify Payments setup and optimization. ](/docs/playbooks/shopify-first-week) [ ๐Ÿ“Ÿ Card-Present Terminal Decisions Picking terminals, EMV vs contactless, keyed entry risk. ](/docs/payments/card-present-terminal-decisions) [ ๐Ÿ”’ E2EE vs P2PE Terminal encryption and PCI scope reduction. ](/docs/payments/reference/e2ee-vs-p2pe) --- Core Concepts If you're new to payments, read these in order: [ 1๏ธโƒฃ Payment Ecosystem Who's who in payments: processors, acquirers, networks, and why it matters. ](/docs/payments/payment-ecosystem) [ 2๏ธโƒฃ Authorization & Capture What happens in the 2 seconds after a card is swiped. ](/docs/payments/auth-and-capture) [ 3๏ธโƒฃ Settlement & Reconciliation How money moves and who takes what cut. ](/docs/payments/settlement) [ 4๏ธโƒฃ Payment Methods Cards vs. ACH vs. wallets vs. everything else. ](/docs/payments/payment-methods) :::tip[Experiment to Run] **Test capture timing:** For one product line, compare capture-at-shipment vs. capture-at-order. Measure "goods not received" disputes vs. operational complexity over 30 days. ::: --- --- ## Next Steps New to payments? [Authorization & Capture](/docs/payments/auth-and-capture) - How transactions work [Settlement & Reconciliation](/docs/payments/settlement) - Where your money goes [Payment Methods Overview](/docs/payments/payment-methods) - Your options [Selling Internationally](/docs/payments/selling-internationally) - If you get foreign orders Running a business? [Buying Payments](/docs/payments/buying-payments) - Choose the right processor [Checkout Conversion](/docs/payments/checkout-conversion) - Stop losing sales [Auth Optimization](/docs/payments/auth-optimization) - Improve approval rates Scaling up? [Interchange](/docs/payments/reference/interchange) - Optimize your fees [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Add Apple Pay, Google Pay [Going Global](/docs/payments/going-global) - International expansion --- :::tip[New to payments?] Start with **[The Guide, Pathway 1: Getting Started with Payments](/docs/learning-pathways/getting-started-with-payments/introduction)**, It's a 20-minute walkthrough of how money moves, choosing a processor and understanding fees. This page is the deep dive. ::: :::tip[Looking for a definition?] See the [Glossary](/docs/reference/glossary) for quick definitions of payments and fraud terms. ::: ## See Also [โŒ Decline Codes](/docs/reference/decline-codes) [๐Ÿ›ก๏ธ Fraud Prevention](/docs/fraud) [๐Ÿ’ณ Chargebacks](/docs/chargebacks) [๐Ÿ”’ PCI DSS](/docs/compliance/pci-dss) [๐ŸŒ Selling Internationally](/docs/payments/selling-internationally) - [Processor Management](/docs/operations/processor-management) - Multi-processor strategy - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification signals - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and liability shift - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Transaction scoring - [Holds and Reserves](/docs/operations/holds-and-reserves) - Cash flow impacts - [Payments Metrics](/docs/payments/metrics) - Performance tracking - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund --- ## Payment Methods Source: https://paymentsandrisk.com/docs/payments/payment-methods # Payment Methods :::info[TL;DR] - The method your customer picks changes your fees, your fraud exposure, your settlement timing and your dispute rules - A 1% fee difference across $1M of volume is $10,000 a year. Your method mix is a cost lever, not a detail - Card-not-present fraud runs about 10x card-present. ACH fraud doesn't look like either - In a hurry? The [Cheat Sheet](./cheat-sheet) has cost, timing, disputes and fraud for every method in one place ::: Say "accept payments" and most people picture a credit card. That's one method out of a dozen, and the one your customer picks changes your fees, your fraud exposure, your settlement timing and what happens when they dispute it. Why it matters depends on where you sit: - **Merchants**: 1% on $1M is $10,000 a year. That isn't a rounding error. - **Fraud teams**: card-not-present runs about 10x card-present, and ACH doesn't behave like either. - **Finance**: settlement runs from same-day to a week depending on the method. - **Issuers**: every rail has its own economics, risk profile and dispute mechanism. :::tip[Need Quick Answers?] The **[Cheat Sheet](./cheat-sheet)** has all the key tables in one place: cost, timing, disputes and fraud by method. It's the one to bookmark. ::: ## What This Guide Covers - Credit, debit, and prepaid cards (including commercial cards and Level 2/3 data) - ACH, SEPA, and direct debit systems worldwide - Real-time payments (RTP, FedNow, Faster Payments, PIX, UPI) - Instant card payouts (Visa Direct, Mastercard Send) - Digital wallets (Apple Pay, Google Pay, PayPal, Venmo, Cash App, Skrill, Neteller, Alipay) - Pay by Bank and Open Banking - BNPL (Klarna, Affirm, Afterpay) - Crypto and stablecoins - Mobile money (M-Pesa, GCash, GrabPay) - Carrier billing and voucher/eCash methods (OXXO, Boleto, Konbini, Paysafecard) - Wires (domestic and international) ## Payment Methods at a Glance | Method | Typical Cost | Settlement | Chargebacks? | Best For | |--------|--------------|------------|--------------|----------| | **Credit Card** | 2.5-3.5% all-in | T+2-3 | Yes (120 days) | Retail, e-commerce | | **Debit Card** | 0.5-1.5% all-in on interchange-plus | T+1-2 | Yes (60 days) | Everyday purchases | | **ACH** | $0.20-$1.00 | T+1-2 | Returns (60 days) | Recurring, B2B | | **RTP/FedNow** | $0.01-$0.50 | Instant | No | Urgent payouts | | **Digital Wallets** | Same as card | T+2-3 | Via card | Mobile checkout | | **BNPL** | 2-8% | T+1-2 | Provider handles | Discretionary goods | | **Wire** | $25-$40 flat | Same day | No | Large B2B | | **Mobile Money** | 1-3% | Varies | Provider-specific | Emerging markets | Those are all-in costs, markup included. They aren't interchange. Debit only gets to 0.5-1.5% on interchange-plus. On a flat rate you're paying the same for debit as for credit. The interchange underneath is a lot lower than either row looks. Regulated debit is 0.05% + $0.21, and a normal card mix blends to about 0.89% + $0.158 in person, 1.36% + $0.152 online. [Where that comes from](/docs/payments/reference/cost-model-assumptions). ## Detailed Guides ### [Card Payments](./cards) Credit, debit, prepaid, and commercial cards. Interchange rates, network differences, Level 2/3 data optimization. ### [Bank Transfers & ACH](./bank-transfers) ACH, SEPA Direct Debit, UK Direct Debit, BECS. Return codes, timing, and when they beat cards. ### [Real-Time Payments](./real-time-payments) RTP, FedNow, and global instant payment systems. Plus push-to-card payouts via Visa Direct and Mastercard Send. ### [Digital Wallets & Pay by Bank](./digital-wallets) Apple Pay, Google Pay, PayPal, Venmo, Cash App. Open Banking and A2A payments. ### [Regional Payment Methods](./regional/) When to add iDEAL, Boleto, Pix, OXXO, Alipay and the rest. Which processors support them, and whether it's worth the integration. - **[Europe](./regional/europe)** - iDEAL, Bancontact, SEPA, Klarna - **[Latin America](./regional/latin-america)** - Boleto, Pix, OXXO, Mercado Pago - **[Asia-Pacific](./regional/asia-pacific)** - Alipay, WeChat Pay, GrabPay, Konbini ### [Alternative Methods](./alternative-methods) BNPL, wires, international APMs, mobile money, carrier billing, vouchers, and crypto. ### [International Payments](./international) Cross-border payments, FX, local entities, tax and regulatory questions, and how you get your money home. ### [Choosing Payment Methods](./choosing-methods) Decision frameworks, industry recommendations, fraud profiles, and the push vs. pull mechanics that decide how much risk you're carrying. ### [Cheat Sheet](./cheat-sheet) Every key reference table in one place. Cost, timing, disputes, fraud. It's the one to bookmark. --- ## Popular in This Section - **[Card Payments](./cards)** - Credit, debit, prepaid, and commercial cards - **[Digital Wallets](./digital-wallets)** - Apple Pay, Google Pay, PayPal - **[Cheat Sheet](./cheat-sheet)** - All key reference tables in one place - **[Choosing Methods](./choosing-methods)** - Decision framework by use case ## Next Steps **New to payment methods?** 1. [Card Payments](./cards) - Start with the one you're already taking 2. [Cheat Sheet](./cheat-sheet) - Quick reference for cost, timing, and disputes 3. [Choosing Methods](./choosing-methods) - Which ones you'll actually need **Building your payment stack?** 1. [Digital Wallets](./digital-wallets) - Add Apple Pay, Google Pay, PayPal 2. [Bank Transfers](./bank-transfers) - Reduce costs with ACH and direct debit 3. [Buying Payments](/docs/payments/buying-payments) - Select the right processor **Expanding internationally?** 1. [International Payments](./international) - Cross-border considerations 2. [Alternative Methods](./alternative-methods) - Local payment methods by region 3. [Going Global](/docs/payments/going-global) - Full international expansion guide ## See Also - [Authorization and Capture](/docs/payments/auth-and-capture) - Transaction flow - [Settlement & Reconciliation](/docs/payments/settlement) - Funding and fees - [Payments Overview](/docs/payments) - Payment fundamentals - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing checkout - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Going Global](/docs/payments/going-global) - International expansion - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [3D Secure](/docs/fraud/prevention/3ds) - Authentication requirements - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes - [Fraud Prevention](/docs/fraud/prevention) - Payment method fraud profiles - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring billing - [Decline Codes](/docs/reference/decline-codes) - Understanding failures --- ## Regional Payment Methods Source: https://paymentsandrisk.com/docs/payments/payment-methods/regional # Regional Payment Methods :::info[TL;DR] - Cards work everywhere. In plenty of countries people would rather use something else. - Add a local method once roughly 10% of your customers come from that market. Under 5%, skip it. - On Stripe or Shopify Payments it's a dashboard toggle. On Square it's impossible. - Several local methods cost **less** than cards, not more. iDEAL and Bancontact are flat-fee. ::: Add the method your customers already use, in the markets where enough of them are. Get it right and conversion goes up 20-60%. ## When to Add Regional Payment Methods **Add regional methods when:** - 10%+ of your customers are from that region - Conversion data shows cart abandonment from lack of local methods - You're serious about that market (not just testing) - Your processor supports it (check before committing) **Skip regional methods when:** - Under 5% of customers from that region - You're using a processor that doesn't support it (Square, most US processors) - Implementation cost exceeds expected revenue lift - You can't handle refunds/disputes in local method --- ## Processor Support Reality Check | Processor | Regional Methods Supported | Implementation | |-----------|---------------------------|----------------| | **Stripe** | 40+ methods across EU, LATAM, Asia | Enable in dashboard + add to checkout | | **Shopify Payments** | Same as Stripe (powered by Stripe) | Enable in settings | | **Adyen** | 250+ methods globally | Full integration required | | **Square** | None (US, Canada, UK, Australia, Japan cards only) | Not applicable | | **PayPal** | PayPal wallet in 200+ countries | PayPal button | | **Braintree** | PayPal + Venmo + some regional | API integration | **Bottom line**: on **Stripe or Shopify Payments** this is easy. On **Square** it can't be done. Cards only. --- ## Regional Methods by Market ### Europe [ ๐Ÿ‡ช๐Ÿ‡บ European Payment Methods iDEAL - Netherlands (60% of Dutch checkouts) Bancontact - Belgium (dominant) SEPA Direct Debit - EU-wide bank transfers Klarna - Buy now pay later across EU SOFORT - EU bank transfers (being deprecated) Supported by: Stripe, Shopify Payments, Adyen ](/docs/payments/payment-methods/regional/europe) **When to add**: 10%+ EU customers, especially Netherlands/Belgium/Germany --- ### Latin America [ ๐ŸŒŽ Latin America Payment Methods Boleto - Brazil cash voucher (declining as PIX grows) Pix - Brazil instant payments (60%+ adoption) OXXO - Mexico cash voucher (30% prefer cash) Mercado Pago - Argentina, Mexico, Brazil Supported by: Stripe, Adyen, dLocal ](/docs/payments/payment-methods/regional/latin-america) **When to add**: 10%+ LATAM customers, especially Brazil/Mexico --- ### Asia-Pacific [ ๐ŸŒ Asia-Pacific Payment Methods Alipay - China (1B+ users) WeChat Pay - China (900M+ users) GrabPay - Southeast Asia Konbini - Japan convenience store payments FPX - Malaysia online banking Supported by: Stripe, Adyen, regional processors ](/docs/payments/payment-methods/regional/asia-pacific) **When to add**: Selling to China or SEA, 5%+ customers from region --- ## Quick Decision Framework ```mermaid flowchart TD A[International Sales?] --> B{What % ofrevenue?} B -->|Under 5%| C[Cards onlyNot worth it yet] B -->|5-20%| D{Which region?} B -->|Over 20%| E[Add regional methodsfor top 2-3 countries] D -->|EU| F{Netherlands/Belgium?} D -->|LATAM| G{Brazil/Mexico?} D -->|Asia| H{China/SEA?} F -->|Yes| I[Add iDEAL + Bancontact] F -->|No| J[Cards + Klarna] G -->|Brazil| K[Add Pix + Boleto] G -->|Mexico| L[Add OXXO] H -->|China| M[Alipay + WeChat Pay] H -->|SEA| N[GrabPay + FPX] style C fill:#6b7280,color:#fff style I fill:#22c55e,color:#fff style J fill:#22c55e,color:#fff style K fill:#22c55e,color:#fff style L fill:#22c55e,color:#fff style M fill:#22c55e,color:#fff style N fill:#22c55e,color:#fff ``` --- ## Implementation Effort by Processor ### On Stripe/Shopify Payments **Effort**: Low (1-2 days) **Steps**: 1. Enable method in Stripe dashboard (Payment methods โ†’ Regional) 2. Add method to checkout (Stripe Elements auto-detects customer location) 3. Test with test cards 4. Go live **Cost**: $0 additional (same rates as cards, or published rates per method) ### On Square **Not possible**. Square doesn't support regional payment methods beyond cards. **Workaround**: Use Stripe for international, Square for US card-present. ### On Adyen **Effort**: Medium-High (2-6 weeks) **Steps**: 1. Negotiate rates for each payment method 2. Integration per method (API differs) 3. Certification if required 4. Regional compliance review 5. Go live **Cost**: Negotiated per method --- ## Cost Comparison: Regional Methods ### Stripe Pricing by Method | Method | Region | Stripe Fee | vs Card Rate | |--------|--------|------------|--------------| | **iDEAL** | Netherlands | 0.29โ‚ฌ flat fee | Often cheaper than cards | | **Bancontact** | Belgium | 0.29โ‚ฌ flat fee | Often cheaper than cards | | **SEPA Direct Debit** | EU | 0.8% (capped at 5โ‚ฌ) | Much cheaper than cards | | **Klarna** | EU, US | 3.3% + $0.30 | More expensive (Klarna takes cut) | | **Boleto** | Brazil | 2.95% + R$2 | Similar to cards | | **OXXO** | Mexico | 1.85% + MX$11 | Cheaper than cards | | **Pix** | Brazil | 1.4% + R$0.45 | Cheaper than cards | | **Alipay** | China | 3.1% + $0.30 | Similar to cards | | **WeChat Pay** | China | 3.1% + $0.30 | Similar to cards | :::warning[These are one PSP's prices, and we haven't re-verified them] The figures above are the kind of local-method prices PSPs publish. But this table carries no source and no verification date. And local method pricing **varies a lot between providers**. Treat it as a rough shape, not a quote. Check your own PSP's local-method page before you model anything on it. The numbers aren't reliable. The shape is. Several regional methods really are **cheaper than cards**, and the flat-fee ones get relatively cheaper as your ticket grows. ::: Many regional methods cost **less** than cards, not more. That's the opposite of what most merchants assume. It's also why local methods earn back their integration cost wherever they carry real volume. Check the channel first, though. Several of these can't bill a customer again next month. See [what each method can actually do](/docs/payments/payment-methods/choosing-methods). --- ## Conversion Impact Data **When you add regional methods in their home markets:** | Region | Method | Conversion Lift | Adoption Rate | |--------|--------|-----------------|---------------| | **Netherlands** | iDEAL | 30-50% | 55-65% of checkouts | | **Belgium** | Bancontact | 25-40% | 40-50% of checkouts | | **Germany** | SEPA/PayPal | 15-25% | 20-30% of checkouts | | **Brazil** | Pix | 40-60% | 50-70% of checkouts | | **Brazil** | Boleto | 20-30% | 15-25% of checkouts | | **Mexico** | OXXO | 20-35% | 25-40% of checkouts | | **China** | Alipay + WeChat | 50-80% | 70-90% of checkouts | **Reality**: in some markets people **prefer local methods to cards**. Skip them and you lose the sale. --- ## Test to Run **Regional method ROI calculator:** **Week 1: Analyze your geography** 1. Pull last 3 months of sales by customer country 2. Identify top 5 countries outside US 3. Calculate % of revenue from each **Week 2: Identify applicable methods** 4. For each top country, check which regional methods exist 5. Check if Stripe/your processor supports them 6. Estimate adoption rate (use table above) **Week 3: Calculate ROI** 7. Example: 15% of revenue from Netherlands (โ‚ฌ100K/month) 8. iDEAL adoption: 60% of Dutch customers 9. Potential additional revenue: โ‚ฌ100K ร— 60% ร— 30% conversion lift = โ‚ฌ18K/month 10. Implementation cost: 8-16 hours dev time 11. Payback: Immediate **Success criteria**: If potential monthly revenue lift > $5K and implementation < 40 hours, add the method. --- ## Common Mistakes ### 1. Adding Methods Too Early **Wrong**: "We might sell to Brazil someday, let's add Boleto" **Right**: "We have 500 Brazilian customers and 40% abandon at checkout. Let's add Pix and Boleto." **Rule**: Don't add regional methods until you have **material volume** from that region. ### 2. Adding Methods Your Processor Doesn't Support **Wrong**: "We want to add iDEAL" (while on Square) **Right**: "We're on Square for US, we'll use Stripe for EU sales" or "We'll switch to Stripe for iDEAL support" **Reality**: Check processor support BEFORE committing to a market. ### 3. Ignoring Refund/Dispute Complexity Refund flows differ by method: - Boleto: no refund. You issue a new payment instead - OXXO: cash only, and refunds get messy - SEPA Direct Debit: chargeback windows don't match cards **Know the operational cost** before you switch it on. ### 4. Not Localizing the Entire Experience You add iDEAL. Then: - Checkout is still English only - Prices are still in USD - Shipping doesn't reach that country **The payment method is the last mile.** Fix pricing, language and shipping first. --- ## Scale Callout **Under $50K/month total:** - Don't add regional methods yet - Focus on US market optimization - Cards work for international customers **$50K-$250K/month, 10%+ international:** - Add regional methods for your top country - Start with easiest: iDEAL (EU) or Pix (Brazil) - Use Stripe for easy implementation **$250K-$1M/month, 20%+ international:** - Add regional methods for top 3 countries - Consider Klarna for EU (BNPL) - Optimize method mix by country **Over $1M/month, 30%+ international:** - Full regional method suite - Consider Adyen for global optimization - Local acquiring for better rates --- ## Next Steps **Just starting international sales?** 1. Read [Going Global](/docs/payments/going-global) first 2. Set up multi-currency pricing 3. Add regional methods once you have 10%+ from a region **Ready to add regional methods?** 1. Check your [processor](/docs/payments/processors) supports them 2. Start with your largest international market 3. Read region-specific guide: - [Europe](/docs/payments/payment-methods/regional/europe) - iDEAL, Bancontact, SEPA, Klarna - [Latin America](/docs/payments/payment-methods/regional/latin-america) - Boleto, Pix, OXXO - [Asia-Pacific](/docs/payments/payment-methods/regional/asia-pacific) - Alipay, WeChat Pay **High-volume international?** 1. Consider [Adyen](/docs/payments/processors/adyen) for 250+ methods 2. Implement payment method optimization (route to cheapest) 3. Monitor adoption rates by country --- ## See Also - [Going Global](/docs/payments/going-global) - International expansion strategy - [International Payment Methods](/docs/payments/payment-methods/international) - Overview - [Stripe](/docs/payments/processors/stripe) - Easiest for SMBs to add regional methods - [Adyen](/docs/payments/processors/adyen) - Enterprise global payment methods - [Checkout Conversion](/docs/payments/checkout-conversion) - Method optimization - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Multi-currency considerations --- ## Payment Processors Source: https://paymentsandrisk.com/docs/payments/processors # Payment Processors :::info[TL;DR] - **[Helcim](/docs/payments/processors/helcim) is cheapest in 20 of the 24 combinations this site models.** [PayPal Zettle](/docs/payments/processors/paypal) wins 3, all card-present at a $15 ticket. [Stax](/docs/payments/processors/stax) wins 1, online at a $25 ticket near $20,000 a month - **Helcim has no monthly fee. There's no volume you need to reach.** It beats Square's Free plan above roughly a **$9.23 card-present ticket** and a **$9.38 online ticket**, at any volume. The old advice was to stay flat-rate until $20,000 a month. That came from an interchange assumption that turned out to be wrong - **Every claim above rests on an assumed interchange cost. Ours is published.** 1.03% + $0.178 card-present, 1.50% + $0.172 online, derived at [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions). No vendor comparison states its own assumption. Stating it lets you check the maths - **No processor verified here publishes a minimum volume requirement.** Not [Adyen](/docs/payments/processors/adyen), not [Checkout.com](/docs/payments/processors/checkout-com), not anyone. The "$10M a year for Adyen" and "$5M a year for Checkout.com" figures were invented - **Five rates that get reported as unpublished are published.** Stripe and Shopify's US cards, Clover's full vertical rate card, both of Toast's processing percentages, and Lightspeed's 2.6% + 10c card-present. [Where each one actually lives](/docs/payments/reference/cost-model-assumptions#how-we-tier-every-figure) - **Every figure on this site now carries a confidence tier**: VENDOR, REPORTED, DERIVED or NOT PUBLISHED. The source and its date sit next to the number. [The system, and why](/docs/payments/reference/cost-model-assumptions#how-we-tier-every-figure) - Still genuinely unrankable: [Checkout.com](/docs/payments/processors/checkout-com), Global Payments and Nuvei (nothing published, verified), Adyen (labels its own rates indicative), Stax above $250,000 a year ("$199+") - Dispute costs vary more than processing rates do. The whole span is **$0 to $30**. Square charges nothing. Helcim charges $0 when you win. PayPal's $15 dispute fee and $20 chargeback fee hit different channels and never stack. On a dispute-prone business that spread outweighs the rate ::: Most businesses agonise over processor selection and then pick on brand. The arithmetic below isn't close in most cells. And the biggest single lever isn't the processor at all. It's whether your average ticket is above or below about $10. That's where fixed per-transaction fees stop dominating. :::note[How the numbers on this page were checked] Every figure carries a **source tier**. VENDOR is from the vendor's own page, with the URL and access date. REPORTED is from a named third party, with who, when, and what kind of source. DERIVED is calculated from published figures, not a company disclosure. NOT PUBLISHED means the vendor doesn't publish it, and the page says what to ask for instead. [The full system is here](/docs/payments/reference/cost-model-assumptions#how-we-tier-every-figure). Every cost comparison uses one published interchange assumption, set out at [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions). You can't compare an interchange-plus processor against a flat-rate one without assuming what interchange costs. If you disagree with the assumption, the arithmetic is published. Redo it. **A blank isn't neutrality.** Five rates here get reported as unpublished and aren't: Clover's, Toast's, Square's plan prices, Shopify's and Stripe's US cards, and Lightspeed's card-present rate. Every one is filled in below and tagged. What genuinely stays blank says what to ask for instead. ::: ## Quick Decision Tree The first question is your average ticket, not your volume. Below about $10 the fixed fee decides everything. Above it, the percentage does. ```mermaid flowchart TD A[Choose a Processor] --> B{Do you need a priceyou can check today?} B -->|Yes| C{Main channel?} B -->|Quotes are fine| D{Multi-market withlocal acquiring needs?} C -->|In person| E{Average ticket?} C -->|Online| F{Average ticket?} E -->|Under 10| G[PayPal Zettle] E -->|10 to 20| L[Zettle or Helcim.Crossover 13 to 20by volume band] E -->|Over 20| H[Helcim] F -->|Under 10| I[Square Free or Braintree] F -->|Over 10| M{Ticket under 30and 11K to 21Ka month?} M -->|Yes| N[Price Stax against Helcim] M -->|No| H D -->|Yes| J[Adyen or Checkout.com,and benchmark against Helcim] D -->|No| K[Get a quote, then benchmarkagainst Helcim] style G fill:#22c55e,color:#fff style H fill:#22c55e,color:#fff style I fill:#22c55e,color:#fff style L fill:#22c55e,color:#fff style N fill:#22c55e,color:#fff style J fill:#3b82f6,color:#fff ``` --- ## Compare Them Yourself Filter by what you run. Sort by what you care about. Every rate carries its source tier, so you can see which figures the vendor publishes and which somebody else reported. ## At-a-Glance Comparison The same data as a static table, if you'd rather scan than filter. | Processor | Online | Card-present | Chargeback | Monthly | Ranked on cost here? | |-----------|--------|--------------|------------|---------|----------------------| | **[Helcim](/docs/payments/processors/helcim)** | IC + 0.50% + $0.25 down to IC + 0.15% + $0.15 | IC + 0.40% + $0.08 down to IC + 0.15% + $0.06 | **$0 if you win**, $15 if you lose | $0 | **Yes** | | **[Square](/docs/payments/processors/square)** | 3.3% + $0.30 Free | 2.6% + $0.15 Free | **$0** | $0 on Free | **Yes**, Free plan only | | **[PayPal](/docs/payments/processors/paypal)** | 3.49% + $0.49 wallet, 2.99% + $0.49 card | 2.29% + $0.09 Zettle | $15 wallet ($0 if you win), $20 card, $30 above a 1.5% ratio | $0 standard | **Yes** | | **[Braintree](/docs/payments/processors/braintree)** | 2.89% + $0.29 | Not separately published | $15 | Not published | **Yes**, online | | **[Stax](/docs/payments/processors/stax)** | IC + **0%** + $0.15 | IC + **0%** + $0.08 | Not published. $25 protection add-on | $99 to $199+, by **annual** volume | Only to $250K/year | | **[Stripe](/docs/payments/processors/stripe)** | **2.9% + $0.30** | Terminal **2.7% + $0.05** | $15 to receive + $15 to counter | $0 | **Yes** | | **[Shopify Payments](/docs/payments/processors/shopify-payments)** | **2.9% + 30c** Basic | **2.6% + 10c** Basic | Not published | $29 to $2,300+ | **Yes** | | **[Clover](/docs/payments/processors/clover)** direct | **3.5% + 10c** | **2.3% + 10c** restaurant, **2.6% + 10c** retail entry | Not published | $0 to $129.85 | Yes, at direct rates only | | **[Toast](/docs/payments/processors/toast)** | 3.50% + 15c *reported* | **2.49%** Traditional, **3.09%** Pay-as-you-Go. Cents *reported* at 15c | Not published | $0 to $90 | Yes, with a reported input | | **[Lightspeed](/docs/payments/processors/lightspeed)** | Not published | **2.6% + 10c** retail | **$15** | $69 to $399 | Card-present only | | **[Moneris](/docs/payments/processors/moneris)** | 2.85% + $0.30 CAD | 2.65% + $0.10 CAD. Interac $0.12 | CA$25 **plus** CA$80 handling | CA$5 software fee | No. Canadian, CAD | | **[Adyen](/docs/payments/processors/adyen)** | Not published. IC++ plus $0.13, indicative 0.60% | Not published. Same model | Not published | No monthly fee. Undisclosed minimum invoice | No. Rates are indicative | | **[Checkout.com](/docs/payments/processors/checkout-com)** | Not published | None. Online only | Not published | Not published | **No** | Tier key: unmarked figures are VENDOR, from the vendor's own page. *Italicised* figures are REPORTED by a named third party, and the source sits on that vendor's page here. "Not published" means the vendor doesn't publish it. **Toast's card-present cell is the one to read carefully.** The percentages are Toast's own. The "+ 15c" is reported by NerdWallet and two content sites, not published by Toast. Don't quote the two as a single vendor rate. Square Plus and Premium are **$49 and $149 a month per location**, now confirmed. All three Square tiers can be modelled. Per location matters: three sites on Plus is $147 a month. :::tip[Nobody publishes a minimum volume] Every processor above was checked for a published volume floor. **None of them has one.** Adyen publishes no annual minimum. Nor does Checkout.com. Square publishes only an upward threshold. It invites custom pricing conversations above $250,000 a **year**, a much lower bar than most merchants assume. You'll find claims that Adyen requires $10 million a year and Checkout.com $5 million. Both are invented, and neither appears on either vendor's site. If you think you're too small for an enterprise processor, ask. Don't assume. ::: --- ## What $100 Actually Costs One transaction, $100, on the blended card mix described at [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions). Pass-through is **$1.67 online** and **$1.21 card-present**. Every processor pays it. Only the markup differs. **Online, $100 transaction:** | Processor | Model | Fee on $100 | Effective | |-----------|-------|-------------|-----------| | **Stax** | IC + 0% + $0.15, plus subscription | **$1.82** plus your share of the subscription | 1.82%+ | | **Helcim**, $100K-$500K band | IC + 0.35% + $0.20 | **$2.22** | 2.22% | | **Adyen**, indicative | IC++ + 0.60% + $0.13 | **$2.40** | 2.40% | | **Helcim**, first band | IC + 0.50% + $0.25 | **$2.42** | 2.42% | | **Braintree** | 2.89% + $0.29 | **$3.18** | 3.18% | | **PayPal**, standard card | 2.99% + $0.49 | **$3.48** | 3.48% | | **Square**, Free plan | 3.3% + $0.30 | **$3.60** | 3.60% | | **PayPal**, wallet | 3.49% + $0.49 | **$3.98** | 3.98% | **Card-present, $100 transaction:** | Processor | Model | Fee on $100 | |-----------|-------|-------------| | **Stax** | IC + 0% + $0.08, plus subscription | **$1.29** plus subscription | | **Helcim**, $100K-$500K band | IC + 0.25% + $0.07 | **$1.53** | | **Helcim**, first band | IC + 0.40% + $0.08 | **$1.69** | | **Adyen**, indicative | IC++ + 0.60% + $0.13 | **$1.94** | | **PayPal Zettle** | 2.29% + $0.09 | **$2.38** | | **Square**, Free | 2.6% + $0.15 | **$2.75** | | **Clover Direct**, restaurant | 2.3% + 10c | **$2.40** | | **Shopify**, Basic | 2.6% + 10c | **$2.70** | | **Stripe Terminal** | 2.7% + $0.05 | **$2.75** | | **Lightspeed**, retail | 2.6% + 10c | **$2.70** | | **Moneris** (CAD) | 2.65% + $0.10 | **CA$2.75** | The Moneris row is in a different currency. It isn't comparable to the USD rows above it. It's there so the structural difference shows, not so you can rank the column end to end. **A $100 ticket is one point on a curve, not a ranking.** Each of these carries a condition. - **PayPal Zettle publishes the lowest flat card-present rate verified here**, at 2.29% + $0.09. That's the opposite of PayPal's reputation. Its 9-cent fixed fee is the lowest of any US flat rate on this site. At small tickets that fixed fee decides it. Zettle beats Helcim's entry band below a **$19.53** ticket, and Helcim's $500K-$1M band below **$13.96** - **Helcim beats Zettle above those tickets, with no subscription to earn back.** At $100 it's $1.69 against $2.38 - **Stax's $1.29 excludes the subscription, and the subscription is the whole question.** Against Zettle at a $100 card-present ticket, Stax saves $1.09 a transaction. So the $99 tier is earned back at about **91 transactions a month**, or $9,100 of volume. Against Helcim the advantage is $0.40 a transaction on the entry band. That needs 248 transactions, or $24,750 a month. And $297,000 a year is not the $99 tier. See [Stax](/docs/payments/processors/stax) for why that matters - **Shopify's US in-person rate is 2.6% + 10c.** Its fixed fee is the lowest of the flat rates that charge one. Against Helcim's entry band at 1.43% + $0.258, the crossover is `0.026A + 0.10 = 0.0143A + 0.258`, so **A = $13.50**. Below a $13.50 ticket Shopify Basic is cheaper in person. Above it, Helcim is. The zero-cents claim you'll see for Shopify in person is Canada only. It would push the crossover out to $22.05. That's why using the Canadian card on a US merchant matters The debit point is the one people miss. These tables use a blended card mix. Regulation II caps regulated US debit interchange at 0.05% + $0.21, plus a $0.01 fraud-prevention adjustment. On one of those cards Helcim's entry band costs about **$0.91** on a $100 card-present sale. Zettle costs $2.38. On a premium rewards credit card Helcim costs about **$2.84**, which is worse than Zettle. Flat rate is insurance against your card mix. Interchange-plus is a bet on it. --- ## Cost by Volume Online, $100 average ticket, on the pass-through assumption of 1.50% + $0.172. Your card mix will differ. Trust the ranking more than the absolute numbers. ### $150,000/Month, 1,500 Transactions Pass-through is $2,508 for everyone. The table shows total cost. | Processor | Markup | Total | Effective | |-----------|--------|-------|-----------| | **Helcim** ($100K-$500K band) | $825 | **$3,333** | 2.22% | | **Braintree** | flat rate | **$4,770** | 3.18% | | **PayPal**, standard card | flat rate | **$5,220** | 3.48% | | **Square**, Free plan | flat rate | **$5,400** | 3.60% | | **PayPal**, wallet | flat rate | **$5,970** | 3.98% | | *Adyen (indicative, not rankable)* | *$1,095* | *$3,603* | *2.40%* | | *Stax at the "$199+" floor (not rankable)* | *$424* | *$2,932* | *1.95%* | ### $1,500,000/Month, 15,000 Transactions Pass-through is $25,080 for everyone. | Processor | Markup | Total | Effective | |-----------|--------|-------|-----------| | **Helcim** ($1M-$5M band) | $4,500 | **$29,580** | 1.97% | | **Braintree** | flat rate | **$47,700** | 3.18% | | **Square**, Free plan | flat rate | **$54,000** | 3.60% | | *Adyen (indicative, not rankable)* | *$10,950* | *$36,030* | *2.40%* | | *Stax at the "$199+" floor (not rankable)* | *$2,449* | *$27,529* | *1.84%* | :::warning[Why two rows are in italics, and what that costs Stax and Adyen] The italic rows are arithmetic, not verdicts. **Stax** publishes "$199+" for everything above $250,000 a year. $1.8 million and $18 million a year both sit in that band. The plus sign has no ceiling. Computing Stax at exactly $199 assumes the friendliest possible answer. This site won't rank a processor on its own best case. If Stax gives you a written number, put it in the table yourself. It may well win. **Adyen** captions its own rate table: "The fees outlined above are indicative; please get in touch to discuss pricing options." It also has "a minimum invoice depending on industry or business model", with no amount published. An indicative rate plus an undisclosed floor isn't a price. The indicative figure still deserves an honest read, and it gets read wrong in both directions. **No published number supports** Adyen rates of 1.2 to 2.2%, or a 0.8 to 1.5 point saving for merchants over $10 million a month. Nor is the reverse claim true, that Adyen's 0.60% + $0.13 is higher than Helcim's markup in every band. Card-present it's higher than every Helcim band on both components. Online it's **lower** than Helcim's entry band below a $120 ticket, because Adyen's 13 cents undercuts Helcim's 25. See [Adyen](/docs/payments/processors/adyen) for the full crossover table. **Where that leaves it:** single-market, comparing on cost, Helcim wins on published numbers. Adyen has to prove otherwise with a written quote. Multi-market with real cross-border volume, Adyen's case is strong. It's a local-acquiring case, not a markup case. That saving lands in the interchange line, which is identical across every row above. ::: --- ## When to Use Each Processor ### Helcim: Cheapest in 20 of 24 Modelled Scenarios **Choose Helcim if:** - Your average ticket clears roughly $9.23 card-present or $9.38 online against Square Free. Against PayPal Zettle the bar is $19.53 card-present, which is the harder test. No volume threshold, because no monthly fee - You have real dispute volume. Helcim charges **$0 for a chargeback you win**, which nobody else here does - Your volume moves month to month, so a subscription would be dead weight **Pricing:** five published monthly bands. Card-present runs from interchange + 0.40% + 8c down to interchange + 0.15% + 6c. Online runs from interchange + 0.50% + 25c down to interchange + 0.15% + 15c. No monthly fee, no setup fee, no PCI fee. **Where it loses:** card-present at a small ticket, to [PayPal Zettle](/docs/payments/processors/paypal). That's below about a $19.53 ticket in the entry band, $13.96 in the $500K-$1M band. It also loses online at a $25 ticket, to [Stax](/docs/payments/processors/stax), between roughly $11,000 and $20,800 a month. There's a gap in the middle. From about $12,500 to $15,400 Stax's subscription steps up to $139 and Helcim retakes the lead. So the interval sawtooths rather than running straight. Ticket size creates it, not volume. **[Read full Helcim profile](/docs/payments/processors/helcim)** --- ### PayPal Zettle: The Small-Ticket Card-Present Answer **Choose Zettle if:** - You're in person with an average ticket under about $19.53, or under $13.96 once Helcim reaches its $500K-$1M band - You don't need a POS ecosystem - You want one flat rate you can predict, with no interchange statement to read **Pricing:** 2.29% + $0.09 card-present. That 9-cent fixed fee is the lowest published by any US flat rate here. At a $15 ticket it beats Helcim by $52 a month on $20,000 of volume. **Where it loses:** above about a $19.53 ticket, and at higher volumes where Helcim's bands step down. PayPal's dispute pricing is also the most expensive verified here. **[Read full PayPal profile](/docs/payments/processors/paypal)** --- ### Stax: One Cell, and It's a Narrow One **Choose Stax if:** - You're online at roughly a $25 ticket, doing $11,000 to $12,500 a month on the $99 tier, or $15,400 to $20,800 on the $139 tier. That's where its 15-cent online charge and zero percentage beat Helcim. In between, the subscription steps up and Helcim is cheaper again - Your annual volume is under $250,000, so the subscription you'd pay is a published number **Pricing:** interchange + 0% + $0.08 card-present, interchange + 0% + $0.15 online, plus $99 to $199+ a month set by **annual** volume. **Two things everyone gets wrong.** First, the volume bands are annual. $99 covers up to $150,000 a **year**. So a merchant doing $20,000 a month is at $240,000 a year, which is the $139 tier. Second, fixing that error doesn't make Stax cheapest. Helcim charges the same 8 cents card-present with no subscription. **Stax never beats Helcim card-present at a volume where Stax still publishes its price.** **[Read full Stax profile](/docs/payments/processors/stax)** --- ### Square: Best Card-Present Default If You Want a POS **Choose Square if:** - You're primarily in person and need POS as well as payments. The POS is the reason, not the rate - You need to start today with no technical work - You want a price you can check completely before signing anything **Pricing:** 2.6% + $0.15 card-present and 3.3% + $0.30 online on the Free plan. Plus and Premium publish lower rates, at $49 and $149 a month per location. Only Free is ranked here. **Note the 15 cents.** Square's card-present fixed fee is 15 cents, not the 10 cents that circulates widely. On a $10 ticket that's the difference between 3.6% and 4.1%. **On cost, Square Free loses to Helcim above a $9.23 card-present ticket and a $9.38 online ticket.** At $20,000 a month card-present with a $50 ticket the gap is $190.80 a month, or $2,290 a year. That's larger than most comparisons show, and the difference is the interchange assumption, not the rates. **[Read full Square profile](/docs/payments/processors/square)** --- ### Braintree: Cards, PayPal, and Venmo in One Integration **Choose Braintree if:** - You want cards, PayPal, and Venmo in one integration - You need the full Venmo checkout, which PayPal Checkout alone doesn't give you - You take large ACH payments. 0.75% capped at $5 is cheap **Pricing:** 2.89% + $0.29 for cards and digital wallets, 3.49% + $0.49 for Venmo, $15 per dispute. **Don't choose between Braintree and Stripe on price.** Stripe's confirmed US online rate is 2.9% + $0.30. Braintree's is 2.89% + $0.29. One hundredth of a point and one cent, about a penny on a $50 order. There's no breakeven ticket to compute. Choose on features. **[Read full Braintree profile](/docs/payments/processors/braintree)** --- ### PayPal Online: Two Rates, and Most Comparisons Show the Wrong One **Choose PayPal online if:** - Your customers ask for it, as a second method alongside cards - You invoice large amounts. ACH at 1% capped at $10 is excellent **Pricing:** 3.49% + $0.49 through the PayPal wallet, but **2.99% + $0.49 for standard card payments**. Most comparisons only show the first. **The catch is disputes, but only above a 1.5% ratio.** The $15 dispute fee and the $20 chargeback fee cover different channels. They never both apply to one dispute. Below 1.5% PayPal is mid-pack, and a dispute you win costs $0. Cross 1.5% with 100+ sales in the prior three months and every dispute costs $30, wins included. **[Read full PayPal profile](/docs/payments/processors/paypal)** --- ### Stripe: Best Developer Experience, and Now a Readable Price **Choose Stripe if:** - You have developers and are building custom checkout - You need subscription billing with real complexity - You're expanding internationally **Pricing:** **2.9% + $0.30 online and 2.7% + $0.05 on Terminal**, US figures confirmed from a US connection on 2 August 2026. No setup or monthly fee. Keyed adds 0.5%. **Cards issued abroad add 1.5%, and currency conversion adds 1%.** Both are roughly the inverse of Stripe's Canadian card. Check which country any Stripe rate you read came from. **Against Square card-present**, 2.7% + 5c crosses Square Free's 2.6% + 15c at exactly a **$100 ticket**. Stripe below, Square above, by cents either way. **Watch the disputes.** $15 to receive a dispute, never returned, plus $15 to counter it, returned only on an outright win. A partial win costs $30, the same as losing. **[Read full Stripe profile](/docs/payments/processors/stripe)** --- ### Shopify Payments: Mandatory If You're on Shopify **Choose Shopify Payments if:** - You're on Shopify. Use anything else and Shopify charges a third-party gateway fee: 2% on Basic, 1% on Grow, 0.6% on Advanced, 0.2% on Plus. That fee is the real lock-in - You take in-person payments. The fixed fee is **10 cents in the US and zero in Canada**, lowest of the flat-rate options either way. That's real money at a low ticket **Pricing, US:** Basic **2.9% + 30c** online and **2.6% + 10c** in person, at $39 a month or $29 billed annually. Grow 2.7% / 2.5% at $105 or $79. Advanced 2.5% / 2.4% at $399 or $299. Plus from $2,300 with rates described only as "most competitive rates". **Watch the geography.** "Shopify charges no per-transaction cents in person" is Canada only. The US charges 10 cents. US online rates run 0.1 points above Canadian at every tier. shopify.com/us/pricing 404s because there's no US path. Shopify resolves country by connection. **[Read full Shopify Payments profile](/docs/payments/processors/shopify-payments)** --- ### Moneris: Canadian, and Interac Cuts Both Ways **Choose Moneris if:** - You're a Canadian business with heavy in-store volume - Interac Debit is a big share of your in-store baskets. At $0.12 flat it beats credit on essentially every purchase **But check your online mix.** Online Interac Debit is $1.00 CAD flat. It only beats credit above about a $25 order. Below that it's your most expensive method. **Pricing:** 2.65% + $0.10 CAD in person, 2.85% + $0.30 CAD online, all CAD. Chargebacks are CA$25 plus a separate CA$80 authorization chargeback handling fee. That's the most expensive dispute structure verified here. **[Read full Moneris profile](/docs/payments/processors/moneris)** --- ### Adyen: Global Acquiring, and the Markup Claim Needs Splitting by Channel **Consider Adyen if:** - You sell across many markets and want local acquiring rather than cross-border routing - You want online, in-store, and mobile on one platform - You have developers and months of runway **Pricing:** not published. Adyen publishes a model: Interchange++ plus a $0.13 processing fee, with an indicative 0.60% card markup. Then it caveats that the figures are indicative. No monthly fee, but a minimum invoice with no published amount. **No annual volume floor.** **On the indicative figure:** card-present, Adyen's markup is higher than every published Helcim band, on both the percentage and the cents. So it costs more at every ticket. Online it depends on ticket size, because Adyen's 13 cents undercuts Helcim's 25. Adyen is lower than Helcim's entry online band below a $120 ticket, higher above it. **Ask for:** the minimum monthly invoice in dollars, the full method-by-method schedule, whether the $0.13 applies to declined attempts, and the chargeback fee. **[Read full Adyen profile](/docs/payments/processors/adyen)** --- ### Checkout.com: Quote-Only, Online Only **Consider Checkout.com if:** - You need global acquiring with Stripe-quality developer tooling - You're prepared to run a sales process to find out what it costs **Pricing:** nothing published. It offers a flat-rate model and an Interchange++ one, priced "based on your business profile and risk category." It states no setup fees and no account maintenance fees. No volume floor is published. **[Read full Checkout.com profile](/docs/payments/processors/checkout-com)** --- ### Clover: The Reseller Sets Your Price **Consider Clover if:** - You need the widest POS hardware range in the SMB market - You're prepared to negotiate a reseller contract properly **Pricing, Clover Direct:** **2.3% + 10c** card-present for restaurants and quick service, **2.6% + 10c** on entry retail and services plans, **3.5% + 10c** keyed and online. Software $0 to $129.85 a month. Rapid Deposit 1.75%. **What's still true:** the reseller sets your actual rate. Clover says so on its own pricing page. Treat the published direct rates as your anchor. Anything above them is markup. **Ask for:** who the merchant of record is, the effective rate on your card mix, the chargeback fee (the one figure Clover doesn't publish at any tier), the contract term and termination fee, and whether hardware is **subscribed or bought**. Clover publishes both prices per bundle. Its own arithmetic puts the 36-month subscription premium at $227 to $3,622, with no ownership at term end. **That's where the cost hides. Now you can check it.** **[Read full Clover profile](/docs/payments/processors/clover)** --- ### Toast: Restaurant-Specific, Bundled, Quote-Only **Consider Toast if:** - You run a full-service restaurant and would genuinely use kitchen displays, tableside ordering, and commission-free online ordering **Pricing:** **2.49% on Traditional and 3.09% on Pay-as-you-Go**, both published by Toast on its shop pages. The **+ $0.15 fixed component is reported, not published**. Never quote the two as one vendor rate. Software $0 Starter Kit, $69 Point of Sale. **The plan choice is arithmetic.** The 0.60 point gap breaks even at about **$11,500 a month** ignoring hardware, or about **$25,300** including an illustrative $2,000 of hardware over 24 months. Below that, Pay-as-you-Go, which Toast says includes hardware you own from day one. Above it, Traditional. **Sanity check any quote against 2.58%**, Toast's own blended gross take on $195.1bn of volume across 164,000 locations, from its FY2025 10-K. A quote above 3.09% is above Toast's most expensive published plan. **Ask for:** the fixed cents component. The card-not-present rate, which Toast publishes nowhere and is reported at 3.50% + $0.15. Whether the rate can rise mid-contract. The term, which Toast's own filing puts at 12 to 36 months, so push for 12. The chargeback fee and the hardware price. And **whether payments are contractually locked to Toast**. That last one is still the critical term. **[Read full Toast profile](/docs/payments/processors/toast)** --- ### Lightspeed: Inventory Depth, Card-Present Priced, Online Still Dark **Consider Lightspeed if:** - You need matrix inventory, purchase orders, or serialised tracking. That's the reason to buy it **Pricing:** **card-present is 2.6% + 10c** and the **chargeback fee is $15**, both published. Retail software is $89, $149 and $289 a month; restaurant is $69, $189 and $399, plus $30 per kitchen display screen. The bare "1.5%" that turns up for Lightspeed appears nowhere on Lightspeed's page. It's an artefact. The real rate matches Shopify Basic exactly in person. So the choice between them is a software decision, not a rate one. **Still not published:** the online, keyed and card-not-present rates, on either product line. Nor the processing rate for the restaurant product at all. Lightspeed's own filing shows a blended take of about 1.90% against a 2.6% + 10c list price. Its payments page lists "negotiate a competitive rate" as a bullet. There's headroom. **Ask for:** the online rate, a card-present rate below 2.6% + 10c, confirmation that $15 is the whole dispute cost, the contract term, hardware cost, and the restaurant rate specifically. **[Read full Lightspeed profile](/docs/payments/processors/lightspeed)** --- ## Disputes Cost More Than People Model Processing rates cluster within a point of each other. Dispute pricing doesn't. | Processor | Dispute you win | Dispute you lose | |-----------|-----------------|------------------| | **[Helcim](/docs/payments/processors/helcim)** | **$0** | $15 | | **[Square](/docs/payments/processors/square)** | **$0** | **$0** | | **[Authorize.net](https://www.authorize.net/en-us/sign-up/pricing.html)** | **$0.00** on cards, $25.00 on eCheck.Net | Same. Gateway fee only | | **[Braintree](/docs/payments/processors/braintree)** | $15 | $15 | | **[Shopify Payments](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process)** | **$0**, the $15 is returned on a win | $15 | | **[Toast](https://support.toasttab.com/en/article/Chargeback-FAQ)** | $15 | $15 | | **[Stripe](/docs/payments/processors/stripe)** | $15 outright win, **$30 partial win** | $30 | | **[PayPal](/docs/payments/processors/paypal)** | **$0** on a wallet dispute, $20 on a card chargeback | $15 wallet, $20 card | | **[PayPal](/docs/payments/processors/paypal)** above a 1.5% dispute ratio | **$30** | $30 | | **[Moneris](/docs/payments/processors/moneris)** | CA$25 plus CA$80 handling | Same | | **[Lightspeed](/docs/payments/processors/lightspeed)** | **$15**, described as a single fee covering the defence | $15 | | **Adyen, Checkout.com, Clover, Worldpay, Global Payments, Nuvei, Stax** | Not published | Not published | All read 2 August 2026. Lightspeed's payments page states "the only thing you can expect is a $15 chargeback fee". It also says "you will be charged a single $15 fee and we will fight tooth and nail to dispute the claim on your behalf." That wording implies no separate representment charge. It would put Lightspeed between Helcim and Stripe. Confirm it in writing. **The whole published span is $0 to $30.** Nothing here reaches the "$100 a chargeback" you'll read elsewhere. [That figure traces to one unsourced sentence in a vendor marketing article](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated). Two caveats on the zeros. Authorize.net is a gateway, so the merchant account behind it charges its own fee. That one isn't on Authorize.net's schedule. Shopify says the returned fee is charged by "your bank", not by Shopify. **Clover is now the interesting absence.** It publishes a full rate card and no dispute fee, at any tier. Toast turned out to publish one after all, at $15, on its support site rather than its pricing page. At 20 disputes a month with a 60% win rate, the annual dispute fee bill runs **$1,440 on Helcim** and **$0 on Square**. On PayPal it's **$1,440 on wallet traffic, $4,800 on card traffic, and $7,200 if you're over the 1.5% line**. For a merchant with $2 million of annual volume, that spread is larger than a 0.15 point difference in processing rate. Two specifics: - **Stripe never returns the dispute received fee**, and returns the countered fee only on an outright win. Winning partially costs the same as losing - **Square charges $0 per dispute and states it outright.** Its Payment Terms separately reserve the right to recover network fines and penalties, which is a different thing from a dispute fee If your business runs disputes, model this before you model the rate. See [Chargeback Prevention](/docs/chargebacks/prevention). --- ## Common Processor Combinations ### 1. A Published-Rate Processor Plus a PayPal Button **Best for:** online businesses that want PayPal's conversion effect without PayPal's cost as a primary **How it works:** run cards through [Helcim](/docs/payments/processors/helcim) or [Braintree](/docs/payments/processors/braintree), and offer PayPal as a second method. **Cost at $150,000 a month, $100 average ticket, 20% of customers choosing the PayPal wallet:** | | Volume | Rate | Cost | |---|--------|------|------| | Cards via Helcim ($100K-$500K band) | $120,000 | IC + 0.35% + $0.20 | $2,666.40 | | PayPal wallet | $30,000 | 3.49% + $0.49 | $1,194.00 | | **Blended** | $150,000 | | **$3,860.40 (2.57%)** | Compare all-Helcim at $3,333.00. The PayPal button costs you **$527.40 a month**. So the question is whether it adds more than $527 of margin in incremental sales. Measure that, don't assume it. The answer also moves with your primary processor. On Braintree the same button costs about $240 a month, because Braintree's own rate is closer to PayPal's. ### 2. Square In Store, Something Else Online **Best for:** omnichannel merchants where in-person is the bulk and the POS is the reason to be on Square **Why:** Square's POS is strong. Its Free-plan online rate at 3.3% + $0.30 is the worst on this page. Splitting channels avoids paying it. **The honest caveat:** you're paying for the POS, not the rate. Above a $9.23 card-present ticket Helcim is cheaper in store too. At $20,000 a month with a $50 ticket the difference is $190.80. If you'd genuinely use Square's POS, that's a fair price for it. Decide it as a software purchase, not a payments one. ### 3. Braintree Alone for Multi-Method Checkout **Best for:** online merchants who need cards, PayPal, and Venmo without three integrations **Why:** one SDK. The saving is engineering time, not processing cost. Braintree costs about $1,437 a month more than Helcim at $150,000 a month with a $100 ticket. ### 4. Interchange-Plus From Day One **Best for:** anyone whose average ticket clears about $10 **Why:** Helcim has no monthly fee. There's no volume at which you "graduate" to it. The old advice here was to stay flat-rate until $20,000 a month. It came from an interchange assumption that overstated pass-through by 79 basis points card-present. Corrected, the saving at $20,000 a month card-present with a $50 ticket is $190.80. Not the roughly $10 the old model implied. --- ## Switching Costs Reality Check Switching costs include development, testing, downtime risk, team training and card data migration. None of it is free. A saving has to clear it. **The calculation:** ``` Monthly saving = (current effective rate - new effective rate) x monthly volume Switching cost = (developer hours x your rate) + testing + training Payback months = switching cost / monthly saving ``` Get the switching cost scoped by whoever would do the work. Don't use a number from an article. A plugin swap and a custom integration are nothing alike. **Rules of thumb that survive the corrected arithmetic:** - **At $20,000 a month card-present with a $50 ticket**, Square Free to Helcim saves **$190.80 a month**, or $2,290 a year. That pays for a plugin swap immediately and a modest custom job inside a year - **At $20,000 a month online with a $25 ticket**, Square Free to Helcim saves **$162.40 a month**. Braintree to Helcim saves $72.40. The second one is close enough that a painful migration probably isn't worth it - **At $150,000 a month online with a $100 ticket**, Square Free to Helcim saves **$2,067 a month** and Braintree to Helcim saves **$1,437**. That pays back most integrations inside a year - **At $1,500,000 a month**, the same moves save **$24,420** and **$18,120** a month. At that point the switching cost is a rounding error. Staying on flat-rate is the expensive decision **Worth it for reasons other than cost:** better dispute economics, better support, better developer tooling, or getting off a contract you can't audit. --- ## Test to Run **Processor decision audit, whether you're choosing or reconsidering:** **Week 1: Usage analysis** 1. Calculate your transaction mix: card-present ____%, online ____%, keyed ____% 2. Calculate monthly volume and monthly transaction count 3. Calculate your average ticket. It matters more than volume. It decides whether fixed fees or percentages dominate 4. Pull your blended interchange from your statement. If your processor won't give it to you, that itself is informative. If you can't get it, use [this site's assumption](/docs/payments/reference/cost-model-assumptions) and mark the result an estimate **Week 2: Cost modelling** 5. Model at least one flat-rate processor and both interchange-plus options ([Helcim](/docs/payments/processors/helcim) and [Stax](/docs/payments/processors/stax)), all from published rates 6. Include the subscription for Stax and the plan fee for anything that has one. If Stax quotes you "$199+", get the real number before modelling it 7. Add your annual dispute cost to each. This line frequently reorders the ranking **Week 3: Feature comparison** 8. List must-haves: subscription billing, multi-currency, API depth, POS features, specific payment methods 9. Eliminate anything that fails a must-have, regardless of price **Week 4: Close the unpublished gaps** 10. For any quote-only vendor still in the running, get the missing numbers in writing: rate, minimum, chargeback fee, contract term, termination fee 11. If a vendor won't put those in writing, remove them **Decision matrix:** | Factor | Helcim | Stax | Square | PayPal | Quote-only option | |--------|--------|------|--------|--------|-------------------| | Effective rate | __% | __% | __% | __% | __% | | Annual dispute cost | $ | $ | $ | $ | $ | | Monthly fees | $ | $ | $ | $ | $ | | Switching cost | $ | $ | $ | $ | $ | | Has must-haves? | Y/N | Y/N | Y/N | Y/N | Y/N | | **Total annual cost** | $ | $ | $ | $ | $ | **Success criteria:** a total annual cost for at least four options, built from published rates and your own statement. Every figure carries the ticket size and volume it assumes. And the winner wins on arithmetic, not on brand. --- ## Recommendations by Ticket Size and Volume Volumes are monthly. Every line carries its channel and ticket, because a recommendation without them isn't one. ### Card-present, ticket under about $19.53 **Recommended:** [PayPal Zettle](/docs/payments/processors/paypal) at 2.29% + $0.09. **Why:** its 9-cent fixed fee is the lowest published US flat rate here. At a small ticket the fixed fee is most of the cost. At a $15 ticket Zettle beats Helcim at $5,000, $20,000 and $100,000 a month, by $13.00, $52.00 and $43.33. The gap narrows as Helcim's bands step down. At $500,000 a month Helcim takes the lead. **Watch for:** the crossover. It's a $19.53 ticket in Helcim's entry band, $15.64 in the $100K-$500K band, $13.96 in the $500K-$1M band. If your average is drifting up, recheck. ### Card-present, ticket above about $19.53 **Recommended:** [Helcim](/docs/payments/processors/helcim), with no volume threshold to reach first. **Why:** it wins every card-present cell above a $19.53 ticket in the model, from $5,000 a month to $500,000. At a $50 ticket and $20,000 a month it's $389.20 against Square Free's $580.00 and Zettle's $494.00. There's no monthly fee to earn back, so there's nothing to wait for. **Also:** [Stax](/docs/payments/processors/stax) never beats Helcim card-present at a volume where Stax publishes a price. In the entry band both charge 8 cents. The only difference is Helcim's 0.40% against Stax's subscription. Above $50,000 a month Helcim drops to 7 cents and takes a cent-per-transaction advantage too. **Above roughly $58,000 to $70,000 a month, depending on your ticket, get a Stax quote.** Stax would overtake Helcim there at its published $199 floor. But above $250,000 a year that floor is "$199+" with no ceiling. So it's the earliest possible crossover, not a price. The crossover falls as the ticket rises: about $70,200 at a $15 ticket, $60,300 at $50, $58,500 at $100 and $58,000 at $150. ### Online, ticket under about $10 **Recommended:** [Braintree](/docs/payments/processors/braintree) or [Square](/docs/payments/processors/square) Free. **Why:** below a $9.38 ticket Square Free's 30-cent fixed fee beats Helcim's combined 42.2 cents. Below $14.83 Braintree's 29 cents does. At a $10 ticket Braintree is $0.58 against Helcim's $0.62 and Square's $0.63. ### Online, ticket around $25, volume $11,000 to $20,800 a month **Recommended:** price [Stax](/docs/payments/processors/stax) against [Helcim](/docs/payments/processors/helcim). This is the one modelled cell Stax wins. **Why:** Stax's 15-cent online charge undercuts Helcim's 25 cents by enough to pay a $99 or $139 subscription at that transaction count. At $20,000 a month it's $696.60 against $737.60. The window closes at $20,833 a month, where Stax's subscription becomes "$199+". **Caveat:** it's ticket-sensitive, and it sawtooths with the subscription tiers. Treat it as two windows, not one range. On the $99 tier Stax wins from about $11,000 to $12,500 a month. From $12,500 to about $15,400 the subscription is $139 and Helcim is cheaper again. From $15,400 to $20,833 Stax wins again. Then the subscription becomes "$199+" and Helcim leads until about $22,100. At a $50 ticket the only window is about $19,900 to $20,800 a month. At a $100 ticket there's no rankable window at all. ### Online, ticket above about $15, most volumes **Recommended:** [Helcim](/docs/payments/processors/helcim). **Why:** it wins every online cell modelled at $75 and $200 tickets, and every $25-ticket cell except the Stax window. At $100,000 a month with a $75 ticket it's $2,346 against Braintree's $3,277. ### Over $5,000,000/Month, or Multi-Market at Any Volume **Recommended:** run two processes in parallel. 1. Negotiate with [Helcim](/docs/payments/processors/helcim). Its pricing genuinely goes custom above $5 million a month, so anchor on the published $1M-$5M band 2. Get quotes from [Adyen](/docs/payments/processors/adyen) and [Checkout.com](/docs/payments/processors/checkout-com). Judge them on local acquiring in your markets, not on headline rate **The deciding question isn't volume, it's geography.** A large single-market merchant is usually better off with a transparent domestic processor. Real cross-border volume is where the global platforms earn their integration cost. They earn it in interchange, not in markup. --- ## Next Steps **Choosing your first processor?** 1. Work out your average ticket first. It decides more than your volume does 2. Use the [decision tree above](#quick-decision-tree) 3. Read the full profile for your top choice 4. Check [the interchange assumption](/docs/payments/reference/cost-model-assumptions) against your own statement **Reconsidering your current processor?** 1. Run the [processor decision audit](#test-to-run) 2. Model [Helcim](/docs/payments/processors/helcim) and [Stax](/docs/payments/processors/stax) from their published schedules. Neither needs a sales call 3. Add your dispute costs to the comparison 4. Read [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) if you're switching **Want to optimise what you've already got?** 1. [Auth Optimization](/docs/payments/auth-optimization) - improve approval rates, which is usually worth more than a rate cut 2. [Chargeback Prevention](/docs/chargebacks/prevention) - reduce disputes, which is worth more than winning them 3. [Fraud Detection](/docs/fraud/detection) - better screening --- ## See Also - [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions) - The interchange assumption behind every number here - [Buying Payments](/docs/payments/buying-payments) - Full processor selection framework - [Processor Comparison](/docs/payments/processor-comparison) - Detailed comparison table - [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) - How to switch - [Payment Ecosystem](/docs/payments/payment-ecosystem) - Processors versus acquirers - [Provider Types](/docs/payments/reference/provider-types) - PayFac, ISO, and acquirer - [Gateway Basics](/docs/payments/reference/gateway-basics) - Gateway versus processor - [Interchange Reference](/docs/payments/reference/interchange) - The cost every processor passes through --- ## Payments Reference Source: https://paymentsandrisk.com/docs/payments/reference # Payments Reference :::info[TL;DR] - Deep-dive reference for the mechanics under your payment system - Grouped three ways: how transactions work, what they cost, and how the money settles - New to this? Start at [Authorization Basics](./authorization-basics). Chasing cost? Start at [Interchange](./interchange) ::: Detailed reference material for when you need to understand the mechanics behind your payment system. ## How Transactions Work | Page | What It Covers | |------|---------------| | **[Authorization Basics](./authorization-basics)** | How card authorization works, response codes, and processing best practices | | **[Auth Windows](./auth-windows)** | Network-specific authorization validity windows and chargeback protection periods | | **[Capture Operations](./capture-operations)** | Voiding vs. refunding, partial captures, and re-authorization | | **[Gateway Basics](./gateway-basics)** | What gateways do, how they differ from processors, and when you need one | | **[Provider Types](./provider-types)** | Gateway vs. processor vs. ISO vs. PayFac vs. Merchant of Record | ## Costs and Fees | Page | What It Covers | |------|---------------| | **[Interchange](./interchange)** | How interchange works, what determines your rate, and why some transactions cost more | | **[Debit Routing](./debit-routing)** | Durbin Amendment, debit routing requirements, and interchange optimization | | **[BNPL Economics](./bnpl-economics)** | Buy Now Pay Later costs for merchants and when it makes sense | | **[FX and Settlement](./fx-and-settlement)** | FX markup, cross-border fees, and when local acquiring saves money | ## Security and Compliance | Page | What It Covers | |------|---------------| | **[Tokenization](./tokenization)** | Network tokens vs. gateway tokens, and how tokenization improves auth rates | | **[E2EE vs P2PE](./e2ee-vs-p2pe)** | Both encrypt card data at the terminal; only P2PE reduces PCI scope automatically | ## Specialized | Page | What It Covers | |------|---------------| | **[B2B Commercial](./b2b-commercial)** | Level 2/3 data, commercial card optimization, and B2B payment best practices | --- ## Settlement & Reconciliation Source: https://paymentsandrisk.com/docs/payments/settlement # Settlement & Reconciliation :::info[TL;DR] - **Settlement** = When card networks/banks actually move money between accounts (T+1 to T+3) - **Funding** = When your processor deposits money in YOUR bank account - **Reconciliation** = Matching what you sold vs. what you got paid (they won't match exactly due to fees, [chargebacks](/docs/chargebacks), timing) - Deposits โ‰  sales. Understand the fee waterfall: [interchange](/docs/payments/reference/interchange) + assessments + [processor markup](/docs/operations/reading-statements) ::: Settlement is the step that actually moves your money, and it's the one nobody explains. ## Popular in This Section - **[Settlement Lifecycle](./lifecycle)** - The 6 phases from capture to funding, including clearing vs settlement - **[Reconciliation](./reconciliation)** - Three-way matching, common discrepancies, and automation strategies - **[Money Flow & Fees](./money-flow)** - Who pays whom, interchange breakdown, net vs gross settlement - **[Settlement Timing](./timing)** - Batch cutoffs, weekend delays, and faster funding options ## Overview Authorization approves a sale. Capture commits to it. Neither one moves money. Settlement does. Tap a card for $5 and it doesn't jump to the coffee shop. It gets bundled with thousands of other sales, run through clearing, skimmed at every step, and dropped in the merchant's bank 1-3 days later. Three reasons that matters: - **Cash flow.** A Friday sale might not land until Tuesday. - **Chargebacks.** [They](/docs/chargebacks) can show up weeks after settlement and claw back money you'd counted. - **Your books.** What you sold and what you got paid won't match. You'll need to know why. ## Settlement Topics [ ๐Ÿ”„ Settlement Lifecycle The 6 phases from capture to funding, plus clearing vs settlement distinction ](/docs/payments/settlement/lifecycle) [ ๐Ÿ’ธ Money Flow & Fees Who pays whom, interchange breakdown, net vs gross settlement ](/docs/payments/settlement/money-flow) [ โฐ Settlement Timing Batch cutoffs, weekend delays, same-day and instant funding options ](/docs/payments/settlement/timing) [ โœ… Reconciliation Three-way matching, common discrepancies, automation strategies ](/docs/payments/settlement/reconciliation) ## Quick Reference: Settlement Timeline | Scenario | Captured | Batched | Settled | Funded | |----------|----------|---------|---------|--------| | Monday 2pm, 5pm cutoff | Monday | Monday 5pm | Tuesday | Wednesday | | Monday 6pm, 5pm cutoff | Monday | Tuesday 5pm | Wednesday | Thursday | | Friday 2pm, 5pm cutoff | Friday | Friday 5pm | Monday | Tuesday | | Friday 6pm, 5pm cutoff | Friday | Monday 5pm | Tuesday | Wednesday | ## Quick Reference: Common Fee Ranges | Fee Type | Typical Range | Who Receives | |----------|---------------|--------------| | Interchange (debit) | 0.05% + $0.21 to 0.80% + $0.15 | Issuing bank | | Interchange (credit) | 1.50% + $0.10 to 2.50% + $0.10 | Issuing bank | | Network assessment | Not published. Assumed 0.14% + $0.02 | Card network | | Processor markup | 0.15% + $0.06 to 0.50% + $0.25 | Your processor | | **Effective rate (total)** | **2.0% to 3.5%** | **All parties** | That markup range isn't an estimate. It's [Helcim's published schedule](https://www.helcim.com/pricing/), verified 2026-08-02. In person it runs +0.40% + 8c at the entry band, down to +0.15% + 6c at $1M-5M a month. Online it's +0.50% + 25c down to +0.15% + 15c. [Stax](https://staxpayments.com/pricing/) charges 0% markup plus 8c in person, on a monthly subscription set by annual volume. Most other processors bundle the markup into a flat rate and never break it out. **On flat-rate pricing, none of this shows up on your statement.** Square, Stripe, Braintree, PayPal and Shopify Payments charge one number and absorb the split. It's simpler to reconcile and impossible to audit. That's the trade. ## Next Steps **Just learning settlement?** 1. Start with [Settlement Lifecycle](./lifecycle) โ†’ Understand the 6 phases 2. Then [Money Flow](./money-flow) โ†’ See where fees go 3. Finally [Reconciliation](./reconciliation) โ†’ Match your books **Optimizing cash flow?** 1. [Settlement Timing](./timing) โ†’ Understand cutoffs and delays 2. [Holds and Reserves](/docs/operations/holds-and-reserves) โ†’ Why funds get held 3. [Payout Strategy](/docs/operations/payout-strategy) โ†’ Faster funding options --- ## See Also - [Authorization and Capture](/docs/payments/auth-and-capture) - Transaction flow - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - International settlement - [Chargebacks](/docs/chargebacks) - Dispute impact on settlement - [Reading Statements](/docs/operations/reading-statements) - Fee breakdown - [Interchange](/docs/payments/reference/interchange) - Fee structures --- ## Authorization vs Capture: How Card Payments Actually Work Source: https://paymentsandrisk.com/docs/payments/auth-and-capture # Authorization vs Capture: How Card Payments Actually Work :::info[TL;DR] - **Authorization** = "Can this cardholder pay?" (issuer checks credit limit, fraud risk, account status) - **Capture** = "Actually move the money" (triggers clearing and [settlement](/docs/payments/settlement)) - **Auth hold** = Temporary hold on funds; expires if not captured (5 to 30 calendar days, depending on network and authorization type) - **The gap between auth and capture is your fraud review window** - use it wisely ::: Authorization is the issuer's real-time check that a card is valid, unfrozen, and has sufficient funds. Capture is the instruction to actually move the money. Most retail transactions combine both instantly, but separating them gives you a fraud review window of 5-30 days (depending on card network) to investigate before committing. Voiding during that window costs nothing; refunding after capture costs you interchange twice. :::tip[For Merchants Under $500/Day] If you're processing under $500/day in transactions, the auth-and-capture distinction is simple: **capture immediately.** Don't hold authorizations waiting for shipment unless your average order is over $500. Why? Auth holds expire, often inside a week, causing failed captures and customer confusion. Your processor may cut the window shorter than the network does. At low volume, the downside of capturing before shipping (occasional refund if you can't fulfill) is smaller than the downside of expired auths. The partial authorization, split shipment, and multi-processor coordination sections below are for merchants with complex fulfillment workflows. ::: --- ## The Authorization-Capture Flow ```mermaid flowchart TD A[Customer initiates payment] --> B[Authorization Request] B --> C{Issuer Decision} C -->|Approved| D[Hold placed on funds] C -->|Declined| E[Transaction fails] D --> F{Merchant Action} F -->|Capture| G[Funds transfer to merchant] F -->|Void| H[Hold releases] F -->|No action| I[Auth expires, hold releases] G --> J[Settlement completes] ``` --- ## What is Authorization? Authorization is asking: **"Can this card pay for this?"** When you request authorization, the [issuer](/docs/fraud/issuer-perspective) checks: 1. **Does this card exist and is it valid?** (Not expired, not reported stolen) 2. **Is the account in good standing?** (Not frozen, not over limit, not flagged for [fraud](/docs/fraud)) 3. **Are there sufficient funds or credit available?** If all three answers are yes, the issuer sends back an **approval code** - a 6-digit alphanumeric promise: "We've verified the funds and are holding them for you." :::info[Key Concept] **An authorization is not a charge.** No money has moved. The issuer has placed a "hold" on that amount, temporarily reducing available credit. Think of a hotel putting a hold on your card at check-in - they haven't charged you yet. ::: --- ## What is Capture? Capture (also called "presentment" or "clearing") is when you say: **"Okay, now actually take the money."** This is when the transaction becomes real: 1. You submit the transaction for [settlement](/docs/payments/settlement) 2. The issuer debits the cardholder's account 3. Funds flow: Issuer โ†’ Network โ†’ [Acquirer](/docs/payments/buying-payments) โ†’ You After capture, the "pending" charge becomes a "posted" charge. The transaction is complete. --- ## Combined vs. Separated **Combined (Auth + Capture together):** Most retail transactions. Tap your card at a coffee shop, and auth/capture happen simultaneously. **Separated (Auth now, Capture later):** Some businesses deliberately separate them. This is "manual capture" or "auth-only" followed by capture. --- ## Why Separate Auth and Capture? ### 1. Final Amount Unknown | Industry | Why | |----------|-----| | **Hotels** | Don't know final bill until checkout (minibar, room service, extended stay) | | **Restaurants** | Tip added after authorization | | **Gas stations** | Auth fixed amount ($100-150), capture actual pump amount | | **Vehicle rentals** | Auth estimated, capture based on actual duration, fuel, tolls | ### 2. Fulfillment Not Complete | Scenario | Approach | |----------|----------| | **E-commerce** | Auth at order, capture at shipment | | **Pre-orders** | Auth to validate card, capture when item ships | | **Custom goods** | Auth confirms payment ability, capture when ready | ### 3. Fraud Review Window This is the big one for [fraud teams](/docs/fraud). **The window between authorization and capture is your opportunity to review before committing.** Why this matters: Once you capture, reversing requires a refund: - Costs you [interchange fees](/docs/payments/interchange-optimization) you don't get back - Creates accounting complexity - May take days to post to customer's account - Looks bad if customer disputes instead But if you void before capture, the hold simply releases. Cleaner operationally and financially. --- ## The Fraud Review Window This section covers what you can do between authorization and capture to screen for fraud. For improving your overall authorization approval rate (retry logic, network tokens, 3DS exemptions), see [Auth Optimization](/docs/payments/auth-optimization). ### What You Can Do During the Window | Check | Purpose | |-------|---------| | **[Velocity checks](/docs/fraud/detection/velocity-rules)** | Card used at unusual speed? Multiple orders quickly? | | **[Device fingerprinting](/docs/fraud/detection/device-fingerprinting)** | Device matches previous fraud patterns? VPN/proxy? | | **[AVS/CVV verification](/docs/fraud/prevention/avs-cvv)** | Billing matches issuer records? Shipping to reshipping service? | | **[Manual review](/docs/fraud/detection/manual-review)** | High-risk orders flagged for human review | | **[3D Secure step-up](/docs/fraud/prevention/3ds)** | Challenge with additional authentication | | **[Behavioral analysis](/docs/fraud/detection/behavioral-analytics)** | Session recordings, mouse movements, typing patterns | ### Void vs. Decline Decision **Decline at authorization:** Transaction never approved. Customer sees "card declined." Clean, but friction for legitimate customers. **Approve, then void before capture:** Authorization succeeds, but you cancel before capturing. Hold releases. Softer approach - you're giving yourself time to investigate without hard-declining at checkout. ### Segment Your Approach | Risk Level | Capture Timing | |------------|----------------| | Low-risk orders | Capture immediately (no review needed) | | Medium-risk orders | Capture same-day after automated checks | | High-risk orders | Hold for [manual review](/docs/fraud/detection/manual-review), capture next day if approved | --- ## Authorization Windows Authorizations don't last forever. Each network sets validity windows, and they don't slice them the same way. | Network | Standard Window | How the network splits it | |---------|-----------------|---------------------------| | **Visa** | 10 calendar days CNP, 5 calendar days card-present | By channel | | **Mastercard** | 7 calendar days final auth, 30 calendar days preauth | By authorization type, not channel | | **Amex** | 7 calendar days | No split at all | Only Visa varies the number by card-present versus card-not-present. Mastercard cares whether the message was flagged as a preauthorization, and a card-present final auth gets the same 7 days as an online one. **Miss the window?** Auth expires, hold releases, you need to re-authorize (might fail if card is now maxed/closed/stolen). For detailed network-specific windows, see [Authorization Windows Reference](/docs/payments/reference/auth-windows). --- ## Why Fast Capture Sometimes Wins Delayed capture isn't free: ### Customer Confusion Statements don't clearly distinguish pending vs. posted. Customer might see: 1. "Pending" charge when they order 2. Pending disappears (auth expired/voided) 3. New charge appears (re-authorized and captured) To the customer: looks like double charge. They call support. Or worse, [file a dispute](/docs/chargebacks). ### Authorization Decay The longer you wait, the more likely something changes: - Customer spends available credit elsewhere - Card reported lost/stolen - Account closed or flagged for [fraud](/docs/fraud) ### Reconciliation Complexity Every auth-capture pair is two events to track in [settlement](/docs/payments/settlement): - Did this auth get captured? - Did this capture match the right auth? - Partial captures? Split shipments? --- ## When to Use Which Approach ### Use Immediate Capture When: - Transaction is low-risk (known customer, low value, consistent pattern) - Goods/services delivered immediately - Customer experience is priority - [Reconciliation](/docs/payments/settlement) simplicity matters ### Use Delayed Capture When: - You need time for [fraud review](/docs/fraud/detection) - Fulfillment is delayed (pre-orders, backorders, custom items) - Final amount isn't known yet - Regulatory or business rules require it --- ## Industry-Specific Patterns | Industry | Auth | Capture | Special Rules | |----------|------|---------|---------------| | **Hotels** | At check-in (estimated + buffer) | At checkout (actual) | 30-day window, but only with the right indicator in the message | | **Vehicle Rentals** | At pickup (estimated + deposit) | At return (actual charges) | Can capture more than auth for fuel/tolls | | **E-commerce** | At checkout | At shipment | 10 days on Visa, 7 on Mastercard and Amex | | **Restaurants** | Pre-tip amount | With tip added | Can exceed auth by tip tolerance (~20%) | | **[Subscriptions](/docs/payments/subscriptions-recurring)** | $0 or $1 validation | At billing period start | Specific recurring indicators required | --- ## Pre-Authorization Holds When you authorize but don't immediately capture, customers see a "pending" or "hold" on their account. This confuses customers and drives support calls. ### How Holds Appear to Customers | What You Did | What Customer Sees | Duration | |--------------|-------------------|----------| | Auth only | "Pending: $X" | Until capture or expiration | | Auth + void | "Pending" then disappears | 1-7 days to clear | | Auth expired | "Pending" then disappears | 7-30 days depending on issuer | | Auth + capture | "Pending" becomes "Posted" | 1-3 days | **The problem:** Customers don't understand "pending." They see the charge, assume they were billed, and when the pending disappears (auth expired), they think they got a free refund. Then the real charge posts and they dispute for "duplicate billing." ### Industries That Create Holds | Industry | Hold Amount | Why | |----------|-------------|-----| | **Hotels** | Room rate ร— nights + 20-50% buffer | Incidentals, minibar, damages | | **Gas stations** | $100-150 fixed | Unknown pump amount | | **Car rentals** | Daily rate ร— days + $200-500 | Fuel, tolls, damages | | **Restaurants** | Bill amount | Tip to be added | ### Managing Customer Expectations ``` Best practices for hold-heavy businesses: โ–ก Disclose hold amount at point of sale โ–ก Explain when and how holds release โ–ก Provide hold reference on receipt โ–ก Train support staff on hold timing โ–ก Consider email/SMS when hold releases ``` ### Hold Release Timing You don't control when holds release. The issuer does. | Card Type | Typical Release Time | |-----------|---------------------| | Debit cards | 1-3 business days after void/expiration | | Credit cards | Up to 7 days after void/expiration | | Prepaid cards | Up to 10 days (highly variable) | **Debit card pain:** For debit cards, holds reduce actual available cash, not credit limit. A $500 hotel hold on a debit card with $600 balance leaves the customer with $100 accessible. This generates the angriest calls. :::tip[Reducing Hold Complaints] For high-hold industries: capture as quickly as possible. A captured transaction posts faster than a voided authorization releases. If the final amount is known, capture immediately rather than holding. ::: --- ## Authorization Expiration and Re-Authorization Authorizations expire. If you don't capture in time, the hold releases, and you need to re-authorize. This creates risk and customer confusion. ### Network Expiration Windows Visa is the only network that sets a different number by channel, so it gets its own table. **Visa**, counted in calendar days from the authorization approval: | Transaction Type | Window | |------------------|--------| | Card-present | 5 calendar days | | Card-not-present, cardholder-initiated | 10 calendar days | | Merchant-initiated (any channel) | 5 calendar days | | Cruise, lodging, vehicle rental with the estimated authorization indicator | 30 calendar days | **Mastercard** splits by authorization type instead. Card-present and card-not-present get the same number: | Authorization Type | Window | |--------------------|--------| | Final authorization | 7 calendar days | | Deferred or undefined authorization | 7 calendar days | | Preauthorization (flagged as such) | 30 calendar days | **Amex** sets one number: 7 calendar days, any channel. The exception is lodging, cruise and vehicle rental on estimated charge amounts, where the authorization stays valid for the life of the stay or the rental agreement. **Discover** doesn't publish current merchant operating regulations, so there's no number we can stand behind. Get your Discover window from your acquirer in writing. *Sources: Visa Core Rules 18 October 2025, section 5.7.3.5, Table 5-11; Mastercard Transaction Processing Rules 9 December 2025, sections 2.5.1 to 2.8; American Express Merchant Reference Guide - U.S., section 5.4. Full detail in [Authorization Windows Reference](/docs/payments/reference/auth-windows).* ### What Happens at Expiration ```mermaid flowchart TD A[Auth expires] --> B[Hold releases] B --> C{Need to charge?} C -->|Yes| D[Re-authorize] D --> E{Card still valid?} E -->|Yes| F[New auth succeeds] E -->|No| G[Decline - card maxed/closed/stolen] C -->|No| H[Done - no charge] ``` ### Re-Authorization Risks | Risk | What Happens | |------|--------------| | **Card maxed** | Customer spent available credit elsewhere | | **Card closed** | Account closed, reported lost/stolen | | **Fraud flag** | Second auth attempt triggers fraud decline | | **Customer confusion** | Two "pending" charges visible | | **Higher decline rate** | Re-auths have ~5-15% lower approval vs. original | ### Preventing Auth Expiration | Strategy | Implementation | |----------|----------------| | **Track auth timestamps** | Alert before expiration window | | **Capture earlier** | Ship faster or capture at earlier fulfillment stage | | **Use proper indicators** | Extended windows for hotels/rentals | | **Incremental auth** | For changing totals, use incremental instead of full re-auth. It buys you time on Mastercard only | | **Customer communication** | If re-auth needed, warn customer | :::warning[Incremental auth doesn't extend a Visa window] Mastercard lets you restart the clock by submitting an additional preauthorization, even a zero-amount one. Visa doesn't. The rule says an incremental authorization request "does not extend the processing timeframes," full stop. On Visa the clock runs from the original approval, and the only route to a longer window is the correct indicator on that original authorization. Hotel and rental software often sells incremental auth as a way to hold longer. That's true on one network and false on the other. ::: ### When Re-Authorization Is Required | Scenario | Action | |----------|--------| | Auth expired, need to charge | Re-authorize with customer notification | | Auth amount increased | Incremental auth (if supported) or void + new auth | | Long fulfillment delay | Consider auth closer to ship date | | Subscription renewal | New auth each period (not re-auth) | :::note[Ask Your Dev] "Are we tracking authorization timestamps? Do we have alerts for approaching expiration? What's our re-authorization decline rate?" ::: --- ## Partial Authorization Sometimes the card doesn't have enough available credit for the full amount, but the issuer approves a partial amount. You decide what to do with the remainder. ### How Partial Auth Works ```mermaid flowchart LR A[Request $100 auth] --> B{Issuer decision} B -->|Full approval| C[$100 approved] B -->|Partial approval| D[$60 approved$40 remaining] B -->|Decline| E[$0 approved] D --> F{Merchant choice} F -->|Accept partial| G[Charge $60] F -->|Void + retry| H[Ask for different payment] F -->|Split tender| I[$60 this card + $40 another] ``` ### When Partial Auth Happens | Scenario | Example | |----------|---------| | **Prepaid cards** | Card has $60 balance, purchase is $100 | | **Debit cards** | Account has $60, purchase is $100 | | **Credit at limit** | Available credit is $60, purchase is $100 | | **Gift cards** | Remaining balance less than purchase | ### Handling Partial Authorization | Option | When to Use | UX Consideration | |--------|-------------|------------------| | **Accept partial** | Low-friction preferred | Customer pays remainder with second method | | **Void and retry** | Single payment required | Customer must use different card | | **Split tender** | POS supports it | Smooth for in-person, complex online | | **Decline entire** | Simplicity over conversion | Bad UX, customer frustrated | ### Processor Support Not all processors handle partial auth the same way: | Processor Behavior | What You See | |--------------------|--------------| | **Returns partial** | Auth response includes partial amount approved | | **Auto-declines** | Returns decline if full amount unavailable | | **Configurable** | You choose whether to accept partials | ### Online vs. In-Person | Environment | Partial Auth Handling | |-------------|----------------------| | **Card-present (POS)** | Display approved amount, prompt for second payment method | | **E-commerce** | More complex - must handle in checkout flow | | **Mobile app** | Similar to e-commerce, needs UI support | | **Unattended (kiosk/gas pump)** | Often auto-accepts partial for prepaid | ### Implementation Considerations ``` Partial auth checklist: โ–ก Does your processor support partial auth responses? โ–ก Can your checkout flow handle split payments? โ–ก What's your policy: accept partial or decline? โ–ก How do you handle partial for digital goods (can't partial-deliver)? โ–ก Staff training for in-person split tender? ``` :::tip[Prepaid Card Reality] Prepaid cards are the main source of partial authorizations. If you sell to demographics that use prepaid heavily (gift recipients, unbanked customers, teens), build proper partial auth handling into your checkout flow. ::: --- ## Partial Captures (Split Shipments) Partial capture lets you capture less than the authorized amount. This is essential for split shipments and order modifications. ### When to Use Partial Capture | Scenario | How It Works | |----------|--------------| | **Split shipment** | Auth $100, ship item A ($60), capture $60. Ship item B ($40), capture $40. | | **Item out of stock** | Auth $100 for 2 items, one unavailable, capture $50 for delivered item. | | **Order modification** | Customer removes item after auth, capture reduced amount. | | **Partial fulfillment** | Service partially delivered, capture proportional amount. | ### Partial Capture Flow ```mermaid flowchart TD A[Auth $100] --> B[Ship Item A - $60] B --> C[Capture $60] C --> D{More items?} D -->|Yes| E[Ship Item B - $40] E --> F[Capture $40] F --> G[Auth fully used] D -->|No| H[Void remaining $40] ``` ### Network Rules for Multiple Captures | Network | Multiple Captures | Notes | |---------|-------------------|-------| | **Visa** | Supported | Must complete within auth window | | **Mastercard** | Supported | Final capture should close auth | | **Amex** | Limited | Check with processor | | **Discover** | Supported | Standard window applies | ### Accounting Implications | Consideration | Impact | |---------------|--------| | **Revenue recognition** | Recognize when captured, not authorized | | **Refund complexity** | Partial captures + partial refunds = reconciliation headaches | | **Interchange** | Each capture may incur separate fees | | **Reporting** | One order = multiple settlement records | ### Implementation Checklist ``` Partial capture readiness: โ–ก Does your processor support multiple captures per auth? โ–ก Can your OMS track remaining auth balance? โ–ก How do you handle auth expiration mid-shipment? โ–ก Does your accounting system handle split captures? โ–ก What's your policy if remaining items are cancelled? ``` ### Common Pitfalls | Pitfall | Prevention | |---------|------------| | **Capturing more than auth** | Track remaining balance | | **Auth expires between shipments** | Re-authorize or ship faster | | **Lost track of captures** | Single source of truth for auth state | | **Customer confusion** | Explain multiple charges upfront | :::note[Ask Your Dev] "Can we do multiple captures against a single authorization? How do we track remaining authorized balance? What happens if we try to capture more than the remaining amount?" ::: --- ## Operational Best Practices ### For Merchants 1. **Track authorization timestamps.** Know exactly when each auth expires. 2. **Build automated capture triggers.** When order ships, capture immediately. 3. **Void unused authorizations.** Don't let them expire - release holds faster for customers. 4. **Use proper transaction indicators.** Ensure [processor](/docs/operations/processor-management) flags transactions correctly for extended windows. ### For Fraud Teams 1. **Segment by risk for capture timing.** Not every transaction needs review. 2. **Set review SLAs inside the auth window.** Build to the shortest network you accept, not the longest. 3. **Use void wisely.** Softer than decline at auth for uncertain cases. 4. **Track void reasons.** Analyze why transactions are voided to improve upstream detection. --- ## Void vs. Refund: Which To Use One of the most expensive mistakes SMBs make is refunding when they should have voided. The cost difference is real. ### The Decision Tree ```mermaid flowchart TD A[Need to reversea transaction?] --> B{Has it beencaptured yet?} B -->|No| C[VOID] B -->|Yes| D{Same batch/day?} D -->|Yes| E[Check if voidstill possible] D -->|No| F[REFUND] E -->|Yes| C E -->|No| F C --> G[Hold releasesNo fees lost] F --> H[Interchange notreturned + refund fee] style C fill:#22c55e,color:#fff style F fill:#f59e0b,color:#fff ``` ### Cost Comparison | Action | What Happens | Your Cost | |--------|--------------|-----------| | **Void (before capture)** | Authorization hold releases. Transaction never settles. | $0 | | **Void (same-day after capture)** | Some processors allow. Transaction reverses before settlement. | $0 - $0.10 | | **Refund (after settlement)** | New transaction crediting the customer. Original interchange not returned. | Original interchange + refund fee (~$0.30) | ### Real Money Example A $100 order with 2.9% + $0.30 processing: - **Void before capture:** You pay $0 - **Refund after settlement:** You pay $3.20 (interchange) + $0.30 (refund fee) = **$3.50 lost** At 100 refunds per month, that's **$350/month** you could save by voiding earlier. ### When to Void | Scenario | Action | |----------|--------| | Order cancelled before fulfillment | Void | | Fraud detected before capture | Void | | Customer changes mind same day | Void (if still possible) | | Duplicate authorization | Void the duplicate | | Wrong amount authorized | Void and re-authorize | ### When to Refund | Scenario | Action | |----------|--------| | Customer returns product days later | Refund (partial or full) | | Service complaint after delivery | Refund | | Chargeback prevention (already settled) | Refund | | Order already shipped | Refund (void not possible) | ### Processor-Specific Behavior Not all processors handle voids the same way: | Processor Type | Same-Day Void | Next-Day Void | |----------------|---------------|---------------| | **PayFac (Stripe, Square)** | Usually works | Usually works (before batch close) | | **Traditional processor** | Works before batch | Depends on settlement timing | | **Gateway + Processor** | Check both systems | May need to void in gateway | :::note[Ask Your Dev] "What's our batch settlement schedule? Can we void transactions after capture but before batch close? What's the cutoff time?" ::: ### Operational Practice 1. **Build void-first workflows.** When cancelling orders, check if void is possible before issuing refund. 2. **Track batch timing.** Know your daily cutoff for same-day voids. 3. **Train support staff.** "Can we void this?" should be the first question. 4. **Monitor void-to-refund ratio.** High refund rate when voids were possible = money leak. --- ## Next Steps **Just learning auth/capture?** 1. Check your processor's default behavior - auth-only or combined? 2. Understand your [auth validity window](/docs/payments/reference/auth-windows) 3. [Learn what happens after capture](/docs/payments/settlement) **Optimizing your flow?** 1. [Review auth optimization](/docs/payments/auth-optimization) to improve approval rates 2. Consider separated auth/capture for [fraud review](/docs/fraud/detection) 3. Track auth-to-capture timing to stay within windows **Troubleshooting issues?** 1. "Ghost charges" on statements - check if auths are being voided properly 2. Declined at capture - auth expired or amount mismatch; see [decline codes](/docs/reference/decline-codes) 3. Amount mismatches - verify industry tolerance rules (tips, fuel, hotels) --- ## See Also - [Authorization Windows Reference](/docs/payments/reference/auth-windows) - Detailed network-specific timing - [Capture Operations](/docs/payments/reference/capture-operations) - Holds, voids, partial captures - [Settlement & Reconciliation](/docs/payments/settlement) - Where money flows after capture - [Decline Codes](/docs/reference/decline-codes) - Why transactions fail - [Fraud Prevention](/docs/fraud/prevention) - Using the auth-capture window for fraud review - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - When auth timing affects disputes - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring billing patterns - [Processor Management](/docs/operations/processor-management) - Multi-processor strategy - [Manual Review](/docs/fraud/detection/manual-review) - Fraud review workflows - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Detection during auth window - [3D Secure](/docs/fraud/prevention/3ds) - Authentication step-up --- ## The Four Outcomes of an Authorization (and What You're Allowed to Do Next) Source: https://paymentsandrisk.com/docs/payments/auth-optimization/four-authorization-outcomes # The Four Outcomes of an Authorization :::info[TL;DR] - Merchants see two authorization outcomes (approved or declined). Inside the issuer there are **four**: approve, approve-and-flag, soft decline, hard decline - **Approve-and-flag is invisible to you** but explains "clean" approvals that turn into disputes days later, and why some customers suddenly get 3DS challenges - Soft declines are an invitation to retry **on a schedule**; hard declines are a command to stop. Visa caps reattempts at **15 per card per 30 days** and bans retries entirely on Category 1 codes - Mastercard sends **Merchant Advice Codes** that literally tell you whether and when to retry. Most billing systems ignore them - Retrying hard declines costs you integrity fees, poisons your merchant reputation in issuer models, and recovers nothing ::: Your gateway shows you two answers: approved or declined. The issuer made a four-way decision. Two of those four never reach you, and they're the ones that explain the "clean" approval that becomes a chargeback on Thursday, and the customer whose card suddenly starts asking for extra verification. I spent years on the issuer side making this call. Here's what the other two buckets are, and what each outcome lets you do next. :::info[Scope] This page covers what an authorization decision **means** and what you're allowed to do next. For how issuers make the call, see [How Issuers Decide to Approve or Decline](/docs/fraud/detection/authorization-decisioning). For what issuers can and can't see about your transaction, see [Why Issuers Decline and Dispute](/docs/fraud/issuer-perspective). For code-by-code lookups, see [Decline Codes](/docs/reference/decline-codes). ::: --- ## The Four Buckets | Outcome | What you see | What actually happened | Your move | |---------|--------------|------------------------|-----------| | **Approve** | Code 00 | Transaction passed cleanly | Nothing | | **Approve-and-flag** | Code 00 | Approved, but marked for review, cardholder notification, or step-up on the next attempt | Watch for the follow-up dispute; consider 3DS on risky segments | | **Soft decline** | 05, 51, 61, 65, 91, 1A... | "Not this transaction, right now." Funds, velocity, risk score, or a request for authentication | Retry is allowed, on a schedule, within network limits | | **Hard decline** | 04, 07, 14, 41, 43, 46, 57, R0, R1, R3 | "Stop. This card is dead, stolen, closed, or the cardholder revoked permission" | Never retry. Get a new payment method | Two of those cost real money when you misread them: approve-and-flag, and the line between soft and hard. --- ## Approve-and-Flag: The Outcome You Never See Issuers don't just approve or decline. A big middle band gets approved **and** something else happens: - The transaction is queued for a fraud analyst to review after the fact - The cardholder gets a push notification or text: "Did you just spend $84.99 at ACME STORE?" - The account is marked so the **next** transaction gets a 3DS challenge or a decline - A fraud report (Visa TC40 / Mastercard SAFE) is filed later, even if no chargeback ever arrives **Why this matters to you:** 1. **An approval isn't an exoneration.** A "perfectly clean" transaction turns into a fraud chargeback three days later. Here's what usually happened: the issuer approved it borderline, texted the cardholder, and the cardholder said "that wasn't me." The dispute was born at authorization. You just couldn't see it. 2. **Step-up behavior is sticky.** If a customer complains that your checkout "suddenly started asking for extra verification," their card is probably flagged at the issuer. It isn't your gateway misbehaving. 3. **TC40/SAFE reports pile up silently.** They shape how issuer models treat your merchant name even when your chargeback ratio looks fine. See [Network Programs](/docs/chargebacks/reference/network-programs). :::tip[What you can do] You can't see issuer flags. You can stop feeding them. Borderline traffic you push through without authentication is exactly what lands in this bucket. Route your riskiest segment through [3DS](/docs/fraud/prevention/3ds) and the issuer's decision moves from "approve and flag" to "authenticated approve." Fewer surprise disputes, and a liability shift on top. ::: --- ## Soft Declines: An Invitation With Rules A soft decline is the issuer saying "not this one, right now." The common ones: | Decline | Typical code | What it usually means | Sensible retry | |---------|--------------|----------------------|----------------| | Insufficient funds | 51 | Balance or credit limit | 3-5 days later (paydays matter), then next billing cycle | | Velocity limit | 61, 65 | Cardholder hit their own bank's limits | 24 hours or more | | Issuer unavailable | 91 | Issuer system down or timing out | Pause retries for that BIN 30-60 minutes, then once after recovery | | Authentication requested | 1A (Visa), 65 in some regions | Issuer wants 3DS before approving | Retry **immediately** with a 3DS challenge. This is the highest-value retry in payments | | Do not honor | 05 | Catch-all. Could be risk score, could be anything | Treat with caution: space retries days apart, cap attempts low | Two habits separate a billing system that recovers money from one that burns it: 1. **The 1A retry.** "Additional authentication required" isn't a rejection. It's the issuer telling you the approval is sitting behind a 3DS challenge. Retry instantly with 3DS and you'll recover a large share of these at near-zero cost. If your billing system treats 1A like a generic decline, you're donating revenue. 2. **Code 05 discipline.** "Do Not Honor" is where issuers hide fraud suspicion. Some 05s recover on a later attempt. Hammering them trains issuer models to treat your merchant name as hostile. Limited, spaced retries only. --- ## Hard Declines: A Command, Not a Suggestion Hard declines mean the account is gone, or the cardholder pulled permission. Card reported lost (41) or stolen (43). Account closed (46). Invalid number (14). "Pickup card" (04/07). Transaction not permitted (57). Revocation of authorization (R0/R1/R3), which means the cardholder told their bank to stop a recurring charge. Every retry against these codes: - **Costs you money.** You pay auth fees on declines, plus network integrity fees for excessive reattempts (below) - **Damages your reputation.** Issuers score merchants on retry discipline. A merchant name that hammers dead cards looks like a card-testing operation. See [Card Testing](/docs/fraud/types/card-testing) - **Recovers nothing.** The issuer's answer isn't going to change R0 and R1 matter most if you bill on a subscription. Retrying after a revocation code isn't just wasted money. It's the fastest route to a "cancelled recurring" chargeback you'll lose, and a stored-credential compliance problem on top. --- ## The Network Rulebook on Retries This is where the fines live. ### Visa: decline categories and the 15-in-30 rule Visa sorts decline codes into categories that dictate retry rights: | Category | Meaning | Common codes | Retry rule | |----------|---------|--------------|------------| | **Category 1** | Issuer will never approve | 04, 07, 12, 14, 15, 41, 43, 46, 57, R0, R1, R3 | **Zero retries.** Reattempts are billed as violations | | **Category 2** | Issuer cannot approve right now | 05, 51, 61, 65, 91, 93, 96 | Up to **15 reattempts per card per 30 days**, counted from the first decline | | **Category 3** | Fix your data first | 54 (expired), 55, 82, N7 | Correct the data (account updater, re-collect CVV), then retry. Blind retries count against you | Go past those limits and you generate integrity fees. Your acquirer bills them per excess attempt, usually with markup, buried somewhere in your processing statement. If you've never looked, look. Serial retry fees are one of the quietest leaks in subscription billing. ### Mastercard: Merchant Advice Codes Mastercard answers many declines with a **Merchant Advice Code (MAC)** that tells you exactly what to do. Your processor gets it on every relevant decline. Whether they pass it through to you is worth asking. | MAC | Instruction | Your move | |-----|-------------|-----------| | 01 | New account information available | Run account updater, then retry with fresh credentials | | 02 | Try again later | Scheduled retry is fine | | 03 | **Do not try again** | Stop. Get a new payment method | | 21 | Payment cancelled by cardholder | Recurring charge was revoked. Stop billing, or the next contact is a chargeback | | 24-29 | Retry after N hours/days | Follow the stated wait | Mastercard's Transaction Processing Excellence program bills merchants for retry abuse: repeated attempts on the same card inside 24 hours, and any reattempt after MAC 03 or 21. Fee schedules change. The principle doesn't. **The network tells you the answer, then charges you for refusing to listen.** :::note[Ask Your Dev] "When we get a decline, do we receive and store the Visa decline category and the Mastercard Merchant Advice Code? Does our retry logic branch on them, and do we enforce a hard cap of 15 attempts per card per 30 days?" If any answer is no, your retry logic is guessing. The networks fine guessers. ::: --- ## A Retry Decision Flow ```mermaid flowchart TD A[Decline received] --> B{Hard decline?\nVisa Cat 1 / MAC 03 / MAC 21} B -->|Yes| C[Stop permanently.\nRequest new payment method] B -->|No| D{Authentication requested?\n1A or equivalent} D -->|Yes| E[Retry immediately\nwith 3DS challenge] D -->|No| F{Data problem?\nExpired, bad CVV} F -->|Yes| G[Account updater /\nre-collect card, then retry] F -->|No| H{Issuer unavailable?\nCode 91} H -->|Yes| I[Pause retries for this BIN\n30-60 min, retry after recovery] H -->|No| J[Scheduled retry:\nspace by days, cap total\nattempts well under 15/30] ``` --- ## Where This Breaks - **Treating 05 as one thing.** Code 05 spans everything from a temporary risk score to permanent fraud suspicion. Retry every 05 aggressively and you'll get more 05s. Issuer models learn your merchant name. - **Retry logic that never reads advice codes.** Most billing systems branch on "approved or declined" and nothing else. The networks have sent machine-readable retry instructions for years. Ignoring them is now a billable offense. - **Counting outage declines as churn.** When code 91 spikes, the subscriptions that failed aren't cancellations. Queue them for re-presentment after recovery instead of dunning your customers. - **"Smart retry" vendors with no cap.** Some recovery tools brag about persistence. Persistence past Category 1 or MAC 03 isn't recovery. It's a fee generator. Ask any retry vendor how they handle Visa categories and MACs before you sign. - **Assuming an approval means the issuer trusts the transaction.** The approve-and-flag bucket is big. If a customer segment shows approvals followed by fast fraud disputes, that segment's getting flagged at authorization. Authenticate it. --- ## Next Steps **Building or fixing retry logic?** 1. [Check your top decline codes](/docs/reference/decline-codes) - Know what you're actually getting 2. [Review optimization tactics](/docs/payments/auth-optimization/tactics) - Network tokens, MIT/CIT flags, account updater 3. [Understand card testing](/docs/fraud/types/card-testing) - What bad retry patterns look like to issuers **Reducing surprise disputes?** 1. [Implement 3DS on risky segments](/docs/fraud/prevention/3ds) - Move flagged approvals to authenticated approvals 2. [Understand TC40/SAFE reports](/docs/chargebacks/reference/network-programs) - The silent reputation ledger 3. [Review the issuer perspective](/docs/fraud/issuer-perspective) - What issuers see and why they decline --- ## Related Topics - [How Issuers Decide to Approve or Decline](/docs/fraud/detection/authorization-decisioning) - The decisioning process behind these outcomes - [Why Issuers Decline and Dispute](/docs/fraud/issuer-perspective) - Issuer constraints and incentives - [Decline Codes](/docs/reference/decline-codes) - Full code reference - [Auth Optimization Tactics](/docs/payments/auth-optimization/tactics) - Network tokens, retry logic, 3DS optimization - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and liability shift - [Card Testing](/docs/fraud/types/card-testing) - Retry abuse from the fraud side - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM, TC40 impact --- ## Optimization Tactics Source: https://paymentsandrisk.com/docs/payments/auth-optimization/tactics # Auth Optimization Tactics :::info[TL;DR] - Network tokens replace stored PANs with issuer-managed tokens. They update themselves when a card changes, and they typically lift auth rates 2-5% - A soft decline means the issuer wants more authentication. A 3DS challenge retry often recovers it. Hard declines - code 05, lost, stolen - can't be retried - MIT/CIT flagging matters for recurring billing. Merchant-initiated transactions skip fraud checks that would reject them as cardholder-initiated - Idempotency keys stop duplicate charges on network timeouts. Add them before you scale, not after your first double-charge complaint ::: This page covers the tactics themselves. For the overview and the metrics, see [Auth Optimization](/docs/payments/auth-optimization). --- ## Network Tokens Network tokens replace raw card numbers with network-issued credentials. Visa and Mastercard issue them, and your processor manages them for you. ### What Network Tokens Fix | Problem | How Tokens Help | |---------|-----------------| | Card reissuance | Token stays valid when card is replaced | | Fraud screening | Issuers trust tokenized transactions more | | Auth rates | 2-5% lift on tokenized vs. raw PAN | ### How They Work 1. Customer enters card at checkout 2. Processor requests token from Visa/Mastercard 3. Token is stored instead of card number 4. Future transactions use the token 5. Network keeps token mapped to current card credentials ### When to Use - Recurring billing (tokens stay valid through card updates) - Repeat customers (stored payment methods) - Digital wallets (Apple Pay/Google Pay are tokenized) ### Operator Questions :::note[Ask Your Dev] "Are we using network tokens or raw PANs for stored cards? If raw PANs, can we migrate to network tokens?" ::: Network tokens are free or low-cost from most processors. There's little reason not to use them. --- ## Card-on-File Transaction Flags How you flag a transaction changes your auth rate. It's one of the cheapest fixes on this page. ### MIT vs. CIT | Type | Meaning | Example | |------|---------|---------| | **CIT** (Customer-Initiated) | Customer is present for the transaction | One-time purchase, initial subscription signup | | **MIT** (Merchant-Initiated) | Merchant charges without customer present | Recurring billing, delayed charges | ### Why Flagging Matters Issuers apply different rules: - CIT may require 3DS challenge - MIT skips 3DS but requires prior consent - Wrong flag = higher declines ### Common Flags | Flag | Use Case | |------|----------| | `recurring` | Subscription billing | | `installment` | Scheduled payment series | | `unscheduled` | Variable charges on stored card | | `resubmission` | Retry of previously declined | :::note[Ask Your Dev] "What transaction flags are we sending on recurring charges? Are we flagging MIT correctly?" ::: --- ## Retry Logic Rules Retrying declines cuts both ways. Do it right and you recover revenue. Do it wrong and you'll burn your issuer reputation. ### What's Allowed | Decline Type | Retry? | Strategy | |--------------|--------|----------| | Soft decline (insufficient funds) | Yes | Wait 3-5 days, retry around payday | | Issuer unavailable | Yes | Wait 4-24 hours | | Velocity limit exceeded | Maybe | Wait 24 hours, try once | | Card expired | No | Request new card | | Do not honor | Once | Try once more, then stop | | Fraud/stolen | Never | Stop immediately | ### What Burns You - Retrying hard declines (stolen, invalid, closed) - Excessive retries (more than 2-3 on same card) - Immediate retries (no wait time between attempts) - Ignoring decline codes ### Issuer View > We track merchants who repeatedly hit declined cards. Excessive retry behavior is a fraud signal. Merchants with bad retry patterns see lower auth rates across all their transactions. ### Retry Velocity Limits Card networks have rules: - Visa: Max 15 retries in 30 days per card - Mastercard: Similar limits with monitoring Go past them and you're looking at fines or processing restrictions. --- ## Hard vs. Soft Decline Logic ### Soft Declines: Retry-Eligible | Decline Code | Meaning | Retry Strategy | |--------------|---------|----------------| | 51 | Insufficient funds | Wait 3-5 days | | 91 | Issuer unavailable | Wait 4-24 hours | | 85 | Card not activated | Wait 1-2 days | | 61 | Exceeds withdrawal limit | Wait a few days | | 65 | Activity limit exceeded | Wait 24 hours | ### Hard Declines: Do Not Retry | Decline Code | Meaning | Action | |--------------|---------|--------| | 05 | Do not honor | Try once more max | | 14 | Invalid card number | Stop, request new card | | 41 | Lost card | Stop immediately | | 43 | Stolen card | Stop immediately | | 54 | Expired card | Stop, request new card | | 57 | Function not permitted | Stop, different card needed | ### Processor Translation Different processors return different codes. Yours should map network codes to categories you can act on. If it doesn't, ask for a mapping document. :::note[Ask Your Dev] "Are we handling soft vs. hard declines differently? Can I see how we're categorizing decline codes?" ::: --- ## 3DS Optimization 3DS (3D Secure) adds an authentication step. It'll help or hurt depending entirely on how you use it. ### 3DS Impact Reality | Scenario | Auth Rate Impact | Liability Shift | |----------|------------------|-----------------| | 3DS challenge, customer completes | -5 to -15% conversion | Yes | | 3DS frictionless (no challenge) | Neutral to +1% | Yes | | No 3DS | Baseline | No | ### When 3DS Helps - High-risk transactions (new customer, new shipping address) - International transactions (required in EU, recommended elsewhere) - High-ticket purchases - Transactions you'd otherwise decline ### When 3DS Hurts - Low-risk returning customers - Mobile transactions (challenge UX is painful) - Guest checkout (adds friction to already-fragile flow) ### 3DS Exemptions Request exemptions when you qualify: | Exemption | Criteria | Best For | |-----------|----------|----------| | **TRA (Transaction Risk Analysis)** | Low-risk based on your fraud rate | Low-risk merchants | | **Low-value** | Under โ‚ฌ30 (EU) | Small purchases | | **Recurring** | Subsequent subscription charges | Recurring billing | | **Trusted beneficiary** | Customer whitelisted the merchant | Returning customers | :::note[Ask Your Dev] "Are we requesting 3DS exemptions where we qualify? What's our frictionless vs. challenge rate?" ::: ### 3DS2 vs. 3DS1 3DS2 supports frictionless authentication. 3DS1, the legacy version, challenged every single time. If you're still on 3DS1, upgrade - the auth rate difference is big. **Related:** [3DS Deep Dive](/docs/fraud/prevention/3ds) --- ## Idempotency: Why Customers Get Charged Twice Double charges happen when the same transaction gets submitted twice. Usually it's a timeout, not a customer. ### How It Happens | Cause | Scenario | |-------|----------| | Customer retry | Customer clicks "Pay" twice | | Network retry | Network retransmits due to timeout | | Merchant retry | Your system retries on ambiguous response | ### The Fix: Idempotency Keys Idempotency keys are unique identifiers attached to each payment attempt. If the same key is submitted twice, the processor returns the original result instead of charging again. ### Operator Impact Without idempotency: - Duplicate charges - Customer complaints - Support tickets - Chargebacks ("I was charged twice!") ### How to Verify :::note[Ask Your Dev] "Are we using idempotency keys for payment attempts? Show me the implementation." ::: This isn't code you need to understand. It's a question to ask. --- ## Issuer Decline Patterns Declines aren't random - they cluster by cause, and the clusters tell you what to fix. ### Common Patterns and Fixes | Pattern | Cause | Fix | |---------|-------|-----| | High decline rate on one BIN | Issuer-specific policy | Contact issuer, adjust fraud rules | | International cards declining | Cross-border friction | Consider local acquiring | | First-time customers declining more | New card, no history | Add 3DS for liability shift | | Weekend declines higher | Bank staffing/limits | Adjust retry timing | | High declines on specific amount | Velocity or limit triggers | Vary transaction amounts | ### Decline Code Analysis Run a monthly report: 1. Pull all declines 2. Group by decline code 3. Identify top 5 codes by volume 4. Research causes and fixes for each ### Issuer View > The top 3 reasons we decline: > 1. Suspected fraud (velocity, geography, mismatch) > 2. Insufficient funds > 3. Card restrictions (international, e-commerce) > > Merchants who address #1 (better fraud signals) see the biggest lift. --- ## Test to Run **3-week auth rate improvement:** **Week 1:** Baseline. - Record current overall auth rate - Pull decline code breakdown - Identify top 5 decline reasons **Week 2:** Implement fixes. - Adjust retry logic for soft declines - Request 3DS exemptions where qualifying - Verify idempotency is in place **Week 3:** Measure. - Compare auth rate to baseline - Track decline code distribution **Success criteria:** 1-3% improvement in overall auth rate. --- ## Next Steps 1. **Start with network tokens** โ†’ Biggest lift for least effort 2. **Fix your retry logic** โ†’ Stop burning issuer trust 3. **Optimize 3DS** โ†’ Request exemptions where you qualify 4. **Track weekly** โ†’ Monitor trends, not snapshots --- ## See Also - [Auth Optimization Overview](/docs/payments/auth-optimization) - Metrics and scale guidance - [3DS Deep Dive](/docs/fraud/prevention/3ds) - Complete 3DS reference - [Decline Codes Reference](/docs/reference/decline-codes) - Code meanings - [Increase Auth Rates Playbook](/docs/playbooks/increase-auth-rates) - Step-by-step guide - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification signals - [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Tokenized payments - [Cards](/docs/payments/payment-methods/cards) - Card acceptance - [Processor Management](/docs/operations/processor-management) - Multi-processor routing - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Fraud vs auth balance - [Authorization Basics](/docs/payments/reference/authorization-basics) - Auth fundamentals --- ## Business Model Viability with Payment Costs Source: https://paymentsandrisk.com/docs/payments/business-model-viability # Business Model Viability with Payment Costs :::info[TL;DR] - Processing fees are 2.5-3.5% of revenue, but all-in payment costs (fees + chargebacks + fraud tools + reserves) typically run 4-6% for online merchants - A business model with 20% gross margin and 5% payment costs leaves 15% for everything else - validate this math before launch, not after your first month of revenue - High-risk categories (digital goods, supplements, travel) face higher processor rates, mandatory reserves, and limited processor options - model these costs explicitly - Chargeback costs compound: 1% chargeback rate means losing ~4% of gross revenue when you account for fees, lost product, and operational time - **Check whether chargebacks are actually your problem before you spend money fixing them.** [Example 2](#example-2-30-product-30-margin-15-cb-ratio-not-viable-at-any-chargeback-rate) below loses money at a *zero* chargeback rate. Run the model at 0% disputes first; if it's still negative, the fix is price, COGS or CAC, not fraud tooling - Which processor you pick moves the number more than most operators expect. The same $50 order costs $1.74 on Braintree and $2.24 on PayPal Checkout, both published rates ::: Your business model might not survive payment costs. A product with 25% gross margin and 4% payment costs leaves 21% to cover marketing, ops, and profit. Add 1% chargebacks and you're at 20%. This page helps you validate viability BEFORE launch. ## The Question This Answers **"Can I actually make money after payment costs?"** Most SMBs calculate: - Product cost: $30 - Sell for: $50 - Margin: 40% = $20 profit - Conclusion: Viable! **But they forget**: - Payment fees: $1.74 (3.47% effective, at Braintree's published 2.89% + $0.29 on a $50 order) - Chargebacks: $0.50/order average (0.5% ratio ร— $100 true cost) - Fraud decline recovery: $0.25/order - **Real profit: $17.51 (35.0% net margin)** **Add marketing/CAC** ($15/customer) and net profit is $2.51 (5.0%). **One spike in chargebacks to 1.5%** and you're losing money. :::note[Where the processing rates here come from] Every worked example below uses **Braintree's published US card rate of 2.89% + $0.29** ([source](https://www.paypal.com/us/enterprise/paypal-braintree-fees), verified 2026-08-02), because it's the flat online rate this site could verify in USD. Substitute your own processor's published rate. It matters: the same $50 order costs $1.74 on Braintree, $1.75 on Square's Plus plan at 2.9% + 30c, and $2.24 on PayPal Checkout at 3.49% + $0.49. ::: --- ## Unit Economics Calculator ### Step 1: Base Economics | Your Numbers | Calculation | |--------------|-------------| | Selling price: $______ | A | | Product cost: $______ | B (COGS) | | **Gross margin**: $______ | C = A - B | | **Gross margin %**: ___% | C / A | ### Step 2: Payment Costs Per Transaction | Cost | Calculation | Amount | |------|-------------|--------| | Processing fee | A ร— rate + fixed | $____ | | Chargeback cost | CB ratio ร— true CB cost | $____ | | Fraud false positive | FP rate ร— A | $____ | | **Total payment cost** | Sum above | $____ | ### Step 3: Net Margin After Payments | Metric | Calculation | |--------|-------------| | **Net margin after payments** | C - payment costs | | **Net margin %** | Above / A | ### Step 4: Viability Check **You need minimum 15-20% net margin** after payment costs to cover: - Marketing (CAC) - Operating expenses - Profit **If net margin B{Gross Margin?} B -->|Under 20%| C[Not viable forCNP payments] B -->|20-30%| D{Expected CB Ratio?} B -->|30-50%| E{Expected CB Ratio?} B -->|Over 50%| F[Viable if CBunder 2%] D -->|Under 0.5%| G[MarginalMonitor closely] D -->|Over 0.5%| H[Not viableMargins too thin] E -->|Under 0.8%| I[ViableAcceptable buffer] E -->|Over 0.8%| J[At riskReduce or fail] style C fill:#ef4444,color:#fff style H fill:#ef4444,color:#fff style G fill:#f59e0b,color:#fff style J fill:#f59e0b,color:#fff style I fill:#22c55e,color:#fff style F fill:#22c55e,color:#fff ``` --- ## Industry-Specific Viability Checks ### Physical Goods E-Commerce **Minimum requirements**: - Gross margin: 35%+ (after COGS, before payments) - Expected CB ratio: Under 0.7% - AOV: $40+ (fixed fees hurt below this) **Red flags**: - Margin under 25% (no buffer) - Commodity products (price competition kills margins) - Long shipping times (more disputes) **Verdict examples**: - Luxury goods (60% margin): Highly viable - Apparel (40% margin): Viable if CB controlled - Low-cost accessories (25% margin): Fragile --- ### Subscription SaaS **Minimum requirements**: - Gross margin: 60%+ (SaaS should have high margins) - LTV/CAC: 3:1 minimum - Churn: Under 5%/month **Red flags**: - Margin under 50% (something's wrong with business model) - High involuntary churn (payment failures) **Verdict**: Most SaaS is viable. Margins are high enough to absorb payment costs. --- ### Digital Goods / Downloads **Minimum requirements**: - Gross margin: 70%+ (minimal COGS) - CB ratio: Under 0.8% (digital has higher fraud) - AOV: $25+ (fixed fees hurt below this) **Red flags**: - High CB ratio (2%+) - fraud or quality issues - Low AOV (under $20) - fixed fees eat margin - No delivery proof - will lose disputes **Verdict examples**: - Software downloads (90% margin): Highly viable - Courses/education (85% margin): Highly viable - Low-price PDFs (90% margin but $10 AOV): Marginal --- ### Card-Present Retail **Minimum requirements**: - Gross margin: 30%+ (can be lower than CNP) - CB ratio: Under 0.3% (CP fraud is lower) - Foot traffic reliability **Red flags**: - Margin under 25% - High-ticket items with long warranty periods **Verdict**: Most retail is viable. Lower fraud and CB rates help thin margins. --- ## When Payment Costs Kill Your Business Model **Unviable scenarios**: ### 1. Commodity E-Commerce (Thin Margins + Price Competition) **Model**: - Product: $25 - Margin: 20% = $5 - Payment cost: 4.05% = $1.01 (Braintree at 2.89% + $0.29 on a $25 order) - **Net: $3.99 (16.0%)** - CAC: $8 - **Result: $4.01 loss per customer** **Why it fails**: Commodity pricing leaves no room for payment costs. **Fix**: Impossible. Don't sell commodities on thin margins online. --- ### 2. High-CB Rate Business (Supplements, CBD-Adjacent) **Model**: - Product: $60 - Margin: 50% = $30 - Payment cost: 3.37% = $2.02 (Braintree at 2.89% + $0.29 on a $60 order) - CB ratio: 2.5% - CB cost: 2.5% ร— $90 = $2.25 - **Net: $25.73 (42.9%)** **Math works, but**: - CB ratio 2.5% = MATCH listing within 3 months - No processor will keep you - Business model isn't sustainable **Fix**: Reduce CB ratio to under 0.9% or find processors that accept high-risk. --- ### 3. Low-AOV Digital Goods (Fixed Fee Problem) **Model**: - Product: $10 digital download - Margin: 95% = $9.50 - Payment cost: 5.79% = $0.58 (Braintree at 2.89% + $0.29). On PayPal Checkout at 3.49% + $0.49 it's $0.84, or **8.4%** - **Net: $8.92 (89.2%)** **Math works, but**: - CAC for $10 product: $5-8 - Limited profitability - Volume needed is huge **Fix**: Bundle products (3 for $25) to reduce fixed fee impact. --- ## Viability Quick Test **Answer these 5 questions:** 1. **Gross margin after COGS**: ____% - Under 20%: STOP (not viable for CNP) - 20-30%: Marginal (requires perfect execution) - 30-50%: Viable (if CB controlled) - Over 50%: Highly viable 2. **Expected chargeback ratio**: ____% - Under 0.5%: Excellent - 0.5-0.7%: Manageable - 0.7-0.9%: At risk - Over 0.9%: Will be terminated 3. **Average order value**: $______ - Under $20: Fixed fees hurt - $20-50: Acceptable - Over $50: Fixed fees irrelevant 4. **Product cost if chargebacked**: $______ - Digital: Low cost (just fee) - Physical: Product + shipping lost - High cost = need very low CB ratio 5. **CAC (customer acquisition cost)**: $______ - CAC > gross margin: Not viable - CAC = 50-70% of margin: Fragile - CAC 0.9% or Question 4 is expensive: At risk - Question 5 CAC > margin: Not viable regardless of payments --- ## Test to Run **Pre-launch viability audit:** **Week 1: Calculate unit economics** 1. Product price: $______ 2. COGS: $______ 3. Gross margin: $______ (___%) **Week 2: Add payment costs** 4. Processing fee: $______ 5. Expected CB ratio: ____% 6. CB cost/transaction: $______ (ratio ร— true CB cost) 7. **Net margin after payments**: $______ (___%) **Week 3: Add acquisition costs** 8. CAC estimate: $______ 9. **Contribution margin**: $______ (net margin - CAC) 10. If negative: Business not viable 11. If under 10%: Fragile, optimize before launch 12. If over 15%: Viable, proceed **Success criteria**: Contribution margin over 15% after all costs including payments. **Then stress the margin. Simulate the worst case:** **Scenario 1: CB ratio doubles** - Current CB ratio: ____% - Double it: ____% - Recalculate contribution margin: $______ - Still profitable? Y/N **Scenario 2: Processor raises rates 0.5%** - Current rate: ____% - New rate: ____% - Recalculate contribution margin: $______ - Still viable? Y/N **Scenario 3: Enter monitoring program** - Monthly fine: $25,000 - Divide by monthly orders: $______ per order - Add to costs, recalculate margin: $______ - Can you survive? Y/N **Success criteria**: Your business stays profitable in all three scenarios. If it doesn't, you have no safety margin. --- ## Scale Callout **Pre-launch:** - Run this calculation BEFORE processing first payment - Model pessimistic scenario (1% CB ratio, not 0.3%) - Ensure 20%+ buffer **Under $100K/month:** - Re-run calculation every quarter - Actual CB ratio may differ from projection - Adjust if contribution margin drops under 10% **$100K-$500K/month:** - Model impact of hitting processor chargeback threshold (~0.9% ratio) - Calculate if business survives monitoring program fines - Need 25%+ margin to absorb payment spikes **Over $500K/month:** - Quarterly model updates - Stress test: What if CB doubles? - What if processor raises rates? --- ## When to Pivot or Quit **Red flags your business model isn't viable:** ### 1. Negative Contribution Margin **If CAC + payment costs > gross margin**: - You lose money on every sale - More sales = more losses - This is not fixable with scale **Action**: Raise prices, reduce CAC, or quit ### 2. Can't Sustain Sub-0.9% CB Ratio **If your business inherently has 1.5-3% CB ratio**: - Supplements with aggressive marketing - High-ticket with long delivery (6+ weeks) - Digital goods without good evidence collection **Action**: Either fix CB rate or accept you'll be terminated ### 3. Margin Compression Makes Payments Unaffordable **If margin drops from 40% โ†’ 25% due to competition**: - Payment costs stay fixed (3.5-4.5%) - Room for profit evaporates - Race to bottom **Action**: Differentiate or exit market ### 4. Fixed Fee Problem on Low AOV **If selling $15 products**: - Processing: $0.72 (4.82% effective, Braintree at 2.89% + $0.29) - On PayPal Checkout at 3.49% + $0.49 the same order costs $1.01, or **6.7%** - Almost 5% to payments alone, and nearly 7% through the wrong button - Margin must be 30%+ just to break even **Action**: Increase AOV (bundles, upsells) or raise prices. The 29c to 49c fixed fee is the part you can't out-scale, so bundling three $15 items into one $45 order takes the fixed-fee drag from 1.93% to 0.64% on Braintree. --- ## Viability by Business Model ### High Viability | Business Type | Why Viable | |---------------|------------| | **SaaS (high ARPU)** | 70-90% margins, low CB ratio, recurring revenue | | **Luxury goods** | 50-70% margins, low fraud, high AOV | | **B2B services** | 40-60% margins, very low CB ratio, high AOV | | **Digital products (courses)** | 80-95% margins, provable delivery | **Characteristics**: High margin, low CB ratio, or both --- ### Marginal Viability (Requires Perfect Execution) | Business Type | Why Marginal | |---------------|--------------| | **Apparel** | 35-45% margins, moderate CB (0.5-0.8%) | | **Consumer electronics** | 20-35% margins, higher fraud risk | | **Subscription boxes** | 35-50% margins, involuntary churn adds cost | | **Print-on-demand** | 30-40% margins, shipping disputes common | **Characteristics**: Moderate margin with moderate CB risk **Requirement**: Must keep CB under 0.6% and optimize processing costs --- ### Low Viability (High Risk of Failure) | Business Type | Why Risky | |---------------|-----------| | **Dropshipping** | 15-25% margins, high CB (long shipping), high fraud | | **Supplements** | 40-60% margins BUT 1.5-3% CB ratio (MATCH risk) | | **CBD products** | Good margins BUT processors reject, MATCH risk | | **High-ticket furniture** | Decent margins BUT long delivery = 2% CB ratio | **Characteristics**: Either thin margins OR unsustainably high CB ratio **Reality**: These businesses struggle with payments regardless of demand --- ## Alternative Payment Methods for Low Margins **If your margin can't sustain 3-4% card processing:** | Alternative | Published cost | Pros | Cons | |-------------|----------------|------|------| | **ACH / bank transfer** | [Helcim](https://www.helcim.com/pricing/) 0.5% + 25c, capped $6. [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees) 0.75%, capped $5 ($5 on returns and disputes). [Square](https://squareup.com/us/en/payments/our-fees) 1% via Invoices, $1 min, $10 cap, on Plus and Premium. [PayPal](https://www.paypal.com/us/business/paypal-business-fees) 1%, capped $10 | The caps are the point. Cost stops rising above a few hundred dollars | Slow, returns, friction | | **Cash (card-present)** | $0 | Free | Only works for local retail | | **SEPA Direct Debit (EU)** | [Adyen](https://www.adyen.com/pricing) $0.13 + EUR 0.27 per transaction | Flat fee, no percentage | EU only, 8-week dispute window | | **Invoice / NET 30** | $0 | No processing fees | B2B only, collection risk | All figures verified against the vendor's own pricing page on 2026-08-02. **The caps are what make ACH work for B2B.** On a $500 invoice, Braintree's ACH costs $3.75 and Helcim's costs $2.75, against $14.74 for the same invoice on a card. On a $2,000 invoice, ACH is capped at $5 on Braintree and $6 on Helcim, while the card cost rises to $58.09. That's a 10x difference that grows with ticket size, which is why every B2B business with invoices over about $300 should be pushing customers to ACH. **For sub-20% margin businesses**: alternatives to cards aren't optional, they're the business model. --- ## Where This Breaks 1. **LTV assumptions for subscriptions**: If you assume 12-month LTV but actual churn is 30%/month (3-month LTV), CAC destroys viability. 2. **CB ratio projections**: First-time merchants assume 0.3% CB ratio. Reality is often 0.8-1.2% in first 6 months. Model pessimistically. 3. **Marketing cost creep**: CAC doubles over time as channels saturate. Initial viability doesn't guarantee long-term viability. 4. **Returns not modeled**: Returns are separate from chargebacks. If you have 10% returns + 0.5% chargebacks, your effective loss rate is 10.5%. 5. **Reserve lock-up not in P&L**: $50K locked in reserves costs $4K/year in opportunity cost. Not in P&L but very real. --- ## Next Steps **Planning a new business?** 1. Calculate unit economics using this worksheet 2. Model pessimistic payment costs (4.5% all-in) 3. Ensure contribution margin >15% 4. Review [Total Cost Model](/docs/payments/total-cost-model) for detailed budgeting **Existing business, margins compressing?** 1. Recalculate contribution margin with current costs 2. If under 10%, you're at risk 3. Optimize: [Reduce chargebacks](/docs/playbooks/reduce-chargebacks-fast) OR raise prices OR reduce CAC **Evaluating new market/product?** 1. Run viability model for new segment 2. Compare to current business 3. Don't launch if new segment has worse economics --- ## See Also - [Total Cost Model](/docs/payments/total-cost-model) - Complete budgeting worksheet - [Processor Fees Guide](/docs/payments/processor-fees-guide) - Understanding fee structures - [Chargeback Economics](/docs/fraud/fundamentals/economics) - Cost of disputes - [Holds and Reserves](/docs/operations/holds-and-reserves) - Working capital impact - [Processor Comparison](/docs/payments/processor-comparison) - Finding lowest cost - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing ratio - [Fraud Economics](/docs/fraud/fundamentals/economics) - Fraud impact on margins --- ## Contracts Source: https://paymentsandrisk.com/docs/payments/buying-payments/contracts # Contracts :::info[TL;DR] - The traps are early termination fees ($200-$500+), PCI non-compliance fees and auto-renewal clauses. - Reserves and the right to hold funds are the worst clauses for your cash flow. Know exactly when they can keep your money. - Month-to-month costs a little more and kills the termination fee. Worth it under two years old, or if you might switch. - Your MCC sets your pricing tier and your risk class. Check it before you sign. A wrong one costs 0.5-1.5% per transaction. ::: The rate is the easy part. The contract language is where you get hurt. --- ## Junk Fees vs. Real Costs Every processor has fees. Some are legitimate. Some are padding. ### Legitimate Costs | Fee Type | What It Is | Typical Cost | |----------|------------|---------------| | Interchange | Card network cost, non-negotiable | 0.89% + $0.158 in person, 1.36% + $0.152 online (blended) | | Assessments | Visa/MC fees, non-negotiable | Not published. Assumed 0.14% + $0.02 | | Processor markup | Their profit margin | 0.1-0.5% | That interchange line is a blend across a normal US card mix. It comes from Visa's US schedule of 18 April 2026 and Mastercard's of 17 April 2026. One card can sit far off it. Regulated debit is 0.05% + $0.21, and a commercial card runs up to 3.00% + $0.10. [How we derive the blend](/docs/payments/reference/cost-model-assumptions). The assessments line is weaker, and we say so. Both networks publish interchange in full. Neither publishes assessments at all. Visa's 18 April 2026 fee document runs to hundreds of rates and never uses the word. So the 0.13-0.15% everyone quotes has no primary source behind it. We carry 0.14% + $0.02 as an assumption and flag it every time it appears. ### Padding to Negotiate or Avoid | Fee Type | What It Is | Action | |----------|------------|--------| | PCI compliance fee | Monthly charge for "compliance help" | Often removable if you're compliant | | Batch fee | Per-batch settlement charge | Should be $0 or pennies | | Statement fee | Paper statement charge | Request electronic, remove fee | | Minimum monthly fee | Charge if you don't hit volume | Negotiate away if possible | | Annual fee | Yearly account charge | Often removable | | Gateway fee | Separate from processor fee | Ask if included in rate | **Reality check:** a clean 2.5% all-in often beats 2.2% plus seven line items. :::tip[Your published benchmark for every line above] [Helcim](https://www.helcim.com/pricing/) charges **$0 monthly, and no setup, PCI, cancellation or statement fees**. Its interchange markup is published band by band, from +0.40% + 8c down to +0.15% + 6c. [Stripe](https://stripe.com/pricing) states it "does not charge setup fees, monthly fees, or any other hidden fees." [Adyen](https://www.adyen.com/pricing) states it has "no monthly fees, set-up fees, integration fees or closure fees." It does carry an unquantified minimum invoice. All verified 2026-08-02. An ISO will call a PCI fee, a statement fee or a cancellation fee industry standard. Those three pages are your answer. None of them is standard. ::: ### How to Calculate All-In Rate ``` All-in rate = Total fees / Total volume ``` Example: - Volume: $100,000 - Interchange: $2,100 - Assessments: $140 - Markup: $300 - PCI fee: $25 - Batch fees: $15 - **All-in: $2,580 / $100,000 = 2.58%** The "2.2% + $0.10" quote became 2.58% after all fees. This happens constantly. --- ## Contract Gotchas Beyond Pricing ### Early Termination Fees - **Range:** $0 to $500+ or "liquidated damages" (percentage of remaining contract value) - **Watch for:** Multi-year contracts with steep ETFs - **Ask:** "What's the early termination clause, and what triggers it?" ### Reserve Release Schedules - **The clause:** the processor keeps a slice of your volume as protection - **Typical holds:** 5-10% of volume, released 30/60/90 days after transaction - **Problem:** Cash flow crunch if you're growing fast - **Ask:** "Under what conditions do you increase my reserve? What's the release schedule?" :::info[Reserve, Hold, Withhold: All the Same Thing] Holds, withholds and reserves are one thing. Your processor keeps a slice of your sales as a cushion against chargebacks. Typical reserves run 5-10% of monthly volume, released after 6-12 months of clean processing. A freeze on your entire balance is different. That's an account hold, and it usually follows a risk review. ::: **Related:** [Holds and Reserves](/docs/operations/holds-and-reserves) for detailed guidance ### Volume Commitments and Rate Reversion - **The clause:** your quoted 2.2% becomes 2.9% if you miss volume targets - **Watch for:** Minimum monthly volume requirements - **Ask:** "Are rates conditional on volume? What happens if I miss the target?" ### Auto-Renewal Traps - **The clause:** the contract renews for another year unless you cancel 30-90 days out - **Problem:** Miss the window, you're locked in - **Ask:** "What's the notice period for non-renewal? Can we do month-to-month after initial term?" ### Liability Language - **The clause:** who eats the loss on fraud and chargebacks - **Watch for:** Broad indemnification clauses - **Ask:** "What's my liability cap for fraud losses?" ### The Chargeback Fee Clause This is the term merchants skim and then pay for. Published fees differ more than the card rates do. The refund behavior matters as much as the number. | Processor | Published fee | Comes back if you win? | |---|---|---| | [Helcim](https://www.helcim.com/pricing/) | $0 if resolved in your favor, $15 if lost | Yes, by design | | [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | $15.00 | Not stated | | [Stripe](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) | $15 to receive, plus $15 to counter | Received fee never returned. Countered fee returned on an outright win only, **not on a partial win** | | [PayPal](https://www.paypal.com/us/business/paypal-business-fees) | $15 on wallet and Guest Checkout disputes, $20 on card chargebacks. The two never both apply. $30 above a 1.5% dispute ratio | The $15 isn't charged when the case is decided in your favor. The $20 and the $30 are charged either way | | [Moneris](https://www.moneris.com/en/pricing) | CA$25, plus CA$80 authorization chargeback handling | Not stated | | [Square](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough) | **$0.** "There are no fees for dispute management services for chargebacks" | Nothing to refund | | [Shopify Payments](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process) | $15.00 in the US | Yes, returned on a win | | [Toast](https://support.toasttab.com/en/article/Chargeback-FAQ) | $15.00 | No, charged win or lose | | [Authorize.net](https://www.authorize.net/en-us/sign-up/pricing.html) | **$0.00** on cards, $25.00 on eCheck.Net | Gateway fee only. Your merchant account bills its own | | Adyen, Clover, Worldpay, Global Payments | Not published | Unknown. Ask before you sign | | [Nuvei](https://document.nuvei.com/tos/us/Wells-TOS-MBA-20200206.pdf) | Per contract, on Schedule A of your merchant application | Unknown | All read 2026-08-02. The full published US span is **$0 to $30**. **Ask:** "What is the per-dispute fee, is it charged again if I respond, and is any of it refunded when I win?" Get that in the contract, not from a support chat. If a rep quotes anything above $30, ask which published schedule it came from. --- ## Contract Negotiation Checklist Before signing, confirm these items in writing: | Item | What to Look For | |------|------------------| | **All-in rate** | Explicit, including all fees | | **ETF** | Ideally $0 or capped | | **Contract length** | Avoid multi-year without exit | | **Auto-renewal** | At least 60 days notice | | **Reserve terms** | Clear release schedule | | **Volume requirements** | No rate reversion traps | | **Token portability** | Can export stored cards | | **PCI/compliance fees** | Removed or justified | --- ## MCC Implications Your Merchant Category Code (MCC) affects more than you think. ### What Your MCC Affects | Impact Area | How MCC Matters | |-------------|-----------------| | **Interchange** | Some MCCs qualify for lower rates (grocery, utilities) | | **Reserve requirements** | High-risk MCCs face higher reserves | | **Processor tolerance** | Some processors won't touch certain MCCs | | **Chargeback thresholds** | High-risk MCCs may have lower tolerance | | **3DS requirements** | Some MCCs require 3DS in certain regions | ### Common MCC Misclassification Problems - **Supplements under "general retail":** works until chargebacks spike. Then you lose the account. - **SaaS coded as "computer services":** you miss subscription-friendly interchange. - **Multi-product with the wrong primary code:** your main product should drive it. ### When to Request MCC Review - You've added product lines that don't fit your current code - Your chargeback pattern doesn't match your MCC - You're paying higher interchange than similar businesses --- ## Underwriting and Approval Signing isn't the end. The processor underwrites you before you can process a thing. **See [Underwriting](./underwriting.md) for the complete guide:** - What documents you need (and why) - Risk factors processors evaluate - Common rejection reasons and how to fix them - How to graduate from low limits to higher volume - Ongoing monitoring and how to avoid holds --- ## Where This Breaks 1. **High-risk MCCs with limited options.** Sometimes one processor will take you. They know it. 2. **Rapidly scaling businesses hitting reserve triggers.** Growing 10x in 6 months? Your processor will notice and hold cash. 3. **Contract signed without reading.** The ETF and auto-renewal you didn't notice will cost you. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **All-in effective rate** | True cost of payments | Under 2.5% for most US e-commerce | | **Reserve as % of monthly volume** | Cash flow impact | Under 5% unless high-risk | | **Time to document response** | Relationship health | Under 24 hours | | **Contract renewal date** | Avoid auto-renewal trap | Calendar reminder 90 days out | --- ## Next Steps 1. **Calculate your current all-in rate** โ†’ [Reading Statements](/docs/operations/reading-statements) 2. **Review your contract terms** โ†’ Check ETF, auto-renewal, reserves 3. **Prepare underwriting documents** โ†’ Have them ready before applying 4. **Plan for ongoing compliance** โ†’ Set up document refresh process --- ## See Also - [Processor Selection](./selection.md) - Choosing the right processor - [Underwriting](./underwriting.md) - Approval process and requirements - [Integration & Exit](./integration.md) - Technical and exit planning - [Holds and Reserves](/docs/operations/holds-and-reserves) - Cash flow impact - [Reading Statements](/docs/operations/reading-statements) - Understanding fees - [Processor Management](/docs/operations/processor-management) - Ongoing relationship --- ## Integration & Exit Source: https://paymentsandrisk.com/docs/payments/buying-payments/integration # Integration & Exit :::info[TL;DR] - How you integrate determines your PCI scope: hosted checkout (Stripe Checkout, Shopify) is SAQ A (lightest); API with card data touching your servers is SAQ D (heaviest) - Token portability is your exit strategy - before you integrate, confirm you can export your stored payment methods in a format your next processor can import - Embedded/redirect checkout is the fastest path to launch but the hardest to customize; API integration takes 2-4x longer but gives full control over UX and fraud flow - Level 2/3 data submission for B2B transactions requires API integration - you can't pass line-item data through most hosted checkout tools ::: Your exit strategy is part of the purchase decision. How you integrate affects PCI scope, conversion, flexibility, and whether you can leave. --- ## Choosing Integration Method How you connect to your processor affects PCI scope, conversion, and flexibility. ### API vs. Hosted Checkout vs. Plugin | Method | PCI Scope | Control | Speed to Market | Best For | |--------|-----------|---------|-----------------|----------| | **Hosted checkout** | Lowest | Limited | Fast | Most SMBs | | **Plugin** | Low | Limited | Fast | Platform users (Shopify, WooCommerce) | | **API** | Higher | Full | Slow | Custom flows, omnichannel | ### You Probably Don't Need an API If you're asking "should I use the API?", the answer is probably no. **Use hosted checkout if:** - You're under $1M/mo - Standard checkout flow works for you - You don't have dedicated dev resources - PCI compliance scares you (it should) **Use API if:** - You need custom checkout flows - You're building omnichannel (online + in-person unified) - You're a marketplace or platform - You have dev resources to maintain it ### Integration Method Decision Tree ``` Do you need custom checkout UI? โ”œโ”€โ”€ No โ†’ Use hosted checkout or plugin โ””โ”€โ”€ Yes โ†’ Do you have dedicated dev resources? โ”œโ”€โ”€ No โ†’ Reconsider. Hosted checkout is fine. โ””โ”€โ”€ Yes โ†’ Are you prepared for SAQ D (PCI)? โ”œโ”€โ”€ No โ†’ Use tokenization (SAQ A-EP) โ””โ”€โ”€ Yes โ†’ Full API integration ``` ### Ask Your Dev > "What's our PCI scope with our current integration? What would change if we switched methods?" --- ## Token Portability: The Golden Handcuffs Your exit strategy is part of the purchase decision. ### Why This Matters If you have stored cards (subscriptions, repeat customers), those cards are tokenized by your processor. If you leave, you need those tokens. If your processor won't export them, your customers have to re-enter cards. That means churn. ### Operator Questions to Ask Before Signing 1. **"If I leave, do you export my tokens to a new PCI-compliant vault?"** 2. **"What is the process, cost, and timeline?"** 3. **"Is this supported for network tokens and processor tokens?"** ### Network Tokens vs. Processor Tokens - **Processor tokens:** Tied to that processor. Portability depends on their policy. - **Network tokens:** Visa/Mastercard tokens. More portable, but still need processor cooperation. ### Contract Language to Look For - "Token export" or "data portability" clauses - Fee structure for token export (some charge per-token) - Timeline for export (30 days? 90 days?) If it's not in the contract, assume you can't do it. ### Token Portability Comparison | Processor Type | Typical Portability | Notes | |----------------|---------------------|-------| | **Stripe** | Supported (to PCI-compliant vault) | Well-documented process | | **Square** | Limited | May require customer re-entry | | **PayPal/Braintree** | Supported | Standard migration tools | | **Traditional ISOs** | Varies widely | Get in writing | | **Legacy processors** | Often not supported | Major migration risk | **Related:** [Subscriptions and Recurring](/docs/payments/subscriptions-recurring) --- ## Card-Present Considerations If you have in-person sales, processor selection gets more complex. ### Terminal Bundling vs. Separate Purchase - **Bundled terminals:** Often "free" but locked to processor. Leave, and the terminal is a paperweight. - **Separate purchase:** More upfront cost, but you own the hardware. **Ask:** "If I switch processors, can I use my terminals with the new processor?" ### In-Person Transaction Pricing Differences - CP (card-present) transactions typically have lower interchange than CNP - Some processors quote blended rates that hide the CP advantage - Ask for separate CP and CNP rate breakdowns ### Omnichannel Processor Requirements If you sell online and in-person, you want one processor for both. Why: - Unified reporting - Single reconciliation - Token sharing between channels Not all processors do omnichannel well. Ask for a demo of the unified dashboard. ### Card-Present Checklist | Item | Question to Ask | |------|-----------------| | **Terminal ownership** | Do I own the hardware? | | **Terminal portability** | Can I use it with another processor? | | **CP vs CNP rates** | What's my interchange for in-person? | | **Unified reporting** | One dashboard for all channels? | | **Token sharing** | Can I charge a card saved in-store online? | **Related:** [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) --- ## Level 2/3 Processing: B2B Savings :::tip[B2B Sellers] If you sell B2B, ask about Level 2/3 processing rates. This can be meaningful savings on corporate and purchasing cards. ::: ### What Level 2/3 Data Is - **Level 2:** Tax amount, customer code, merchant postal code - **Level 3:** Line-item detail (SKU, quantity, unit price) ### Why It Matters Commercial cards qualify for lower interchange when you submit Level 2/3 data. On a small business credit card that's **0.75 percentage points**, 2.65% down to 1.90%, published by both networks. On a corporate or purchasing card with full Level 3 it's 0.80 to 0.95. On a commercial prepaid card it's nothing at all. [The tables](/docs/payments/reference/b2b-commercial#what-the-schedules-actually-say). ### Level 2/3 Savings Example | Card Type | Standard Rate | With L2/3 | Savings | |-----------|--------------|-----------|---------| | Commercial card | 2.95% | 2.15% | 0.80% | | Purchasing card | 2.85% | 2.05% | 0.80% | | Corporate card | 2.70% | 2.10% | 0.60% | On $500k/year in B2B sales, that's $3,000-$4,000 saved. ### Operator Questions - "Does your gateway support Level 2/3 data submission?" - "Do I need to change my integration to submit it?" - "What's the expected savings based on my card mix?" --- ## Migration Planning When switching processors, plan carefully to minimize disruption. ### Migration Checklist | Phase | Actions | |-------|---------| | **Pre-migration** | Token export confirmed, new processor approved, integration tested | | **Cutover** | Update payment endpoints, test live transactions, monitor errors | | **Post-migration** | Verify settlement, confirm token migration, cancel old account | ### Common Migration Failures 1. **Tokens didn't migrate** โ†’ Customers forced to re-enter cards 2. **Webhook endpoints not updated** โ†’ Missing payment notifications 3. **Old processor still charging fees** โ†’ Forgot to cancel 4. **Settlement timing changed** โ†’ Cash flow surprise ### The 90-Day Rule Run both processors in parallel for 90 days if possible: - New transactions on new processor - Recurring/subscriptions migrated in batches - Old processor for remaining refunds and disputes --- ## Where This Breaks 1. **Legacy integration debt.** If your checkout is deeply integrated with a specific processor's API, migration is a major project. 2. **Stored cards without portability.** Subscription businesses can lose significant revenue from forced card updates. 3. **International expansion with cross-border complexity.** US processors with "international support" often means cross-border (expensive), not local acquiring (cheaper). --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Auth rate by processor** | Processor performance | Over 95% for domestic cards | | **Payout timing** | Cash flow predictability | T+1 to T+2 standard | | **Token migration success rate** | Migration health | 99%+ | | **L2/3 qualification rate** | B2B optimization | Over 80% for eligible cards | --- ## Next Steps 1. **Decide on integration method** โ†’ Match to your resources and PCI appetite 2. **Confirm token portability** โ†’ Get it in the contract 3. **Plan for omnichannel** โ†’ If you have or plan in-person sales 4. **Ask about Level 2/3** โ†’ If you sell B2B --- ## See Also - [Processor Selection](./selection.md) - Choosing the right processor - [Contracts & Underwriting](./contracts.md) - What to negotiate - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Terminal selection - [Subscriptions and Recurring](/docs/payments/subscriptions-recurring) - Recurring billing setup - [PCI DSS](/docs/compliance/pci-dss) - Security requirements - [Processor Management](/docs/operations/processor-management) - Ongoing relationship --- ## Processor Selection Source: https://paymentsandrisk.com/docs/payments/buying-payments/selection # Processor Selection :::info[TL;DR] - Under $50K/month online: Stripe or Braintree, both month-to-month, no negotiation needed. They're the same price, so choose on features. - Under $50K/month in person: Square if you need the POS, **Helcim for the lowest published cost above about a $19.53 ticket**. Below that, PayPal Zettle's 9-cent fixed fee wins. It keeps winning up to $500,000 a month at a $15 ticket. Helcim is $0/month with no contract, so the old advice to stay on flat rate until you hit some volume doesn't hold. Ticket size and card mix decide this, not volume ([the assumptions behind those figures](/docs/payments/reference/cost-model-assumptions)). - $50K-$500K/month: get three bids off the same transaction data set. Effective rate comparison only works when everyone quotes on identical volume and mix. - Over $500K/month: negotiate interchange-plus pricing, dedicated account management, and custom reserve terms. Flat-rate at this volume costs thousands a month extra. - You can start that conversation much earlier than people say. Square's own page invites custom pricing talks **above $250,000 a year**, or about $21K/month. - PayFac (Stripe, Square) versus a direct merchant account is the key decision. PayFac is faster to start and easier to use. A direct account is cheaper at scale and gives you more control. ::: Choosing a processor isn't about the lowest rate. It's about fit: your volume, your risk profile, and where you're heading. --- :::tip[Quick Answer] All rates verified against each vendor's own pricing page on 2026-08-02, with Stripe's US figures read from a US connection on 2026-08-04. **If you're selling online/e-commerce** โ†’ [Stripe](/docs/payments/processors/stripe) or [Braintree](/docs/payments/processors/braintree) - Braintree publishes **2.89% + $0.29**. Stripe publishes **2.9% + 30c**. Both in USD, both confirmed. - That's 1.25 cents apart on a $25 order and 1.5 cents on a $50 one, with no crossover in either direction. Domestically there's no cost argument between them. Pick Braintree for native PayPal and Venmo, Stripe for the broader product surface and docs. - **Selling internationally changes it.** Braintree adds +1% on cards issued outside the US; Stripe adds +1.5%. That half-point dwarfs the domestic gap and is the only real cost difference between the two. **If you're card-present retail/restaurant** โ†’ [Square](/docs/payments/processors/square), [Helcim](/docs/payments/processors/helcim) or [PayPal Zettle](/docs/payments/processors/paypal) - Square: **2.6% + 15c** on the Free plan, $0/month, the strongest POS here, 15-minute setup. - Helcim: **interchange + 0.40% + 8c** in the entry band, also $0/month, no setup fee, no PCI fee, no cancellation fee, and $0 on chargebacks you win. - PayPal Zettle: **2.29% + 9c**. That's the lowest published fixed fee among the US flat rates this site could verify, and it's exactly why Zettle wins on small tickets. - Helcim beats Square above a **$9.23** ticket on this site's blended card mix. The real crossover runs **$7.94 to $12.20**, depending on which card the customer hands you: $8.46 on regulated debit, $7.94 on exempt debit, $9.09 on no-rewards credit, $12.20 on standard rewards credit. On premium rewards and commercial cards there's no crossover at all, and Square is cheaper at every ticket. - Helcim beats Zettle above a **$19.53** ticket in the entry band. That drops to $15.64 and $13.96 as Helcim's volume bands step down. So below about $19.53, Zettle is the cheapest of the three. - None of the three charges a monthly fee, so volume isn't the deciding variable here. Ticket size and card mix are. Work it out on your own mix with [the card-mix test](/docs/payments/processor-comparison#the-card-mix-test-not-the-volume-test) and [the interchange assumption these crossovers rest on](/docs/payments/reference/cost-model-assumptions). **If you don't know your model yet** โ†’ [Stripe](/docs/payments/processors/stripe) - More flexible while you figure things out. - Anything is fine under $100K/month. Don't overthink this. **If you're on Shopify** โ†’ Use [Shopify Payments](/docs/payments/processors/shopify-payments) - The reason is the third-party gateway fee, not the card rate. **2% on Basic, 1% on Grow, 0.6% on Advanced, 0.2% on Plus**, charged on every order if you process elsewhere. - Shopify's US card rates are confirmed: online 2.9% / 2.7% / 2.5% + 30c, in person **2.6% / 2.5% / 2.4% + 10c** by plan. There's no shopify.com/us/pricing path, because Shopify resolves country by connection rather than by URL. The widely repeated "no per-transaction cent charge in person" claim is **Canada only**. The US charges 10 cents. See full [Processor Profiles](/docs/payments/processors) for detailed comparisons. ::: --- ## The 3-Bid Method Get three bids. Not one. Not two. Three. **Why this works:** - Processors assume you're not shopping. - Rates are negotiable, especially above $50k/mo. - You learn what's standard and what's padding. **How to run it:** 1. Request pricing from your top 3 candidates. 2. Get everything in writing. Verbal quotes mean nothing. 3. Compare all-in cost, not the interchange-plus rate. 4. Use the lowest bid to negotiate with your preferred choice. Don't spend more than a week on this. Paralysis costs more than a few basis points. ### What to Include in Your Request When requesting quotes, provide: - Monthly volume and transaction count - Average transaction size - Card-present vs card-not-present split - Chargeback ratio (if you have processing history) - Current processor and rates (optional, but helps) The more context you give, the more accurate the quote. ### What to Demand Back Get all five in writing. A percentage on its own tells you almost nothing. 1. **Effective rate on your actual mix**, not a headline rate. 2. **Per-transaction fixed fee.** On a $20 ticket, 30c is 1.5% on its own. 3. **Monthly, minimum and PCI fees.** Helcim publishes $0 for all three, so you have a benchmark. 4. **Chargeback fee, and whether it comes back when you win.** The published US range is $0 to $30. Square charges $0 outright. Helcim charges $0 on a win. Most charge $15. PayPal's high-volume tier at $30 is the worst published figure. Stripe charges $15 to receive and $15 to counter, and returns neither on a partial win. 5. **Contract term and the early termination fee.** :::note[Two questions that catch the expensive answers] "Is hardware leased or purchased, and what happens to it if I leave?" Then: "if I switch processors, does anything in your contract stop me?" Clover's leases and Toast's payments lock-in are where these deals get costly. Neither one shows up in a rate quote. ::: --- ## SMB Stack Recommendations by Volume ### Under $100k/mo **Use an aggregator.** Stripe, Square, Braintree, PayPal. Don't overthink it. - Instant approval, no underwriting friction. - All-in pricing, published and easy to compare: Braintree 2.89% + $0.29 online, Square 2.6% + 15c in person and 3.3% + 30c online on the Free plan, PayPal Checkout 3.49% + $0.49. - You're paying for simplicity, and that's fine. - Focus on running your business, not optimizing payments. One caveat at this size. PayPal Checkout is the most expensive published option here, by a wide margin. On a $20 order it's 5.94% against Braintree's 4.34%. If PayPal is a button next to your card form, that's fine. If it's your only processor, price the alternative. **What to watch:** - Reserve holds if you're in a risky-looking category. - Account stability at scale, the "PayPal freeze" problem. :::info[Scale Callout] Under $100k/mo: don't spend time optimizing payments. The savings aren't worth the effort. Use an aggregator and grow revenue instead. ::: ### $100k-$1M/mo **Time to shop.** You have negotiating power. - Interchange-plus pricing starts making sense. - A dedicated merchant account may beat aggregator pricing. - Account manager access starts to matter. - You can negotiate reserves and terms. **What to ask:** - "What's my all-in effective rate including assessments?" - "What triggers a reserve on my account?" - "What's the early termination fee?" :::info[Scale Callout] $100k-$1M/mo: shop for rates, negotiate reserves, and consider a direct merchant account. **What "good" looks like at this size, from published rates.** Flat rate at 2.89% + $0.29 on a $75 ticket is an effective 3.28%. Any target under 2.5% all-in means moving to interchange-plus. Helcim publishes interchange + 0.35% + 20c online for the $100K-$500K band, and interchange + 0.25% + 7c in person, with no monthly fee ([source](https://www.helcim.com/pricing/), verified 2026-08-02). On this site's blended online pass-through of 1.50% + $0.172, that band is 1.85% + 37.2c all-in. On the same $75 ticket, that's **2.35%** ([assumptions](/docs/payments/reference/cost-model-assumptions)). Use it as your benchmark. If a bid can't beat a published, no-contract, no-monthly-fee rate, it isn't a good bid. ::: ### Over $1M/mo **You're enterprise now.** Different game. - Custom pricing is standard. - Multiple processor redundancy gets smart. - Direct Visa and Mastercard relationships are possible for the largest. - Dedicated support and SLAs. **What changes:** - Processor negotiation and redundancy planning become real work. - Token portability is non-negotiable. - A payments consultant may earn their fee on the contract alone. :::info[Scale Callout] Over $1M/mo: custom pricing, processor redundancy, and token portability are non-negotiable. A payments consultant may pay for themselves in savings. ::: --- ## PayFac vs. Direct Merchant Account ### When Aggregators Work (PayFac Model) - Under $50k/mo volume. - Simple business model, retail or basic e-commerce. - You need to accept payments today. - Low tolerance for paperwork. **Examples:** Stripe, Square, PayPal for most uses. **Tradeoff:** higher rates, instant setup, minimal underwriting. ### When to Graduate to Direct - Volume above $50k/mo, where negotiating power starts. - High-risk MCC: adult, CBD, travel, nutraceuticals. - International volume that needs local acquiring. - Chargeback ratio concerns. Aggregators have lower tolerance. - You need processor redundancy. **Migration friction:** - Expect 2-4 weeks for underwriting. - Documentation: bank statements, processing history. - Token migration if you have stored cards (see [Integration & Exit](./integration.md#token-portability-the-golden-handcuffs)). ### PayFac vs Direct Comparison | Factor | PayFac/Aggregator | Direct Merchant Account | |--------|------------------|------------------------| | **Setup time** | Minutes to hours | 2-4 weeks | | **Underwriting** | Minimal | Full review | | **Pricing** | Fixed and published (Braintree 2.89% + $0.29; Square 2.6% + 15c in person) | Interchange-plus, negotiable. Helcim publishes its schedule; most others quote | | **Account stability** | Lower tolerance for risk | More flexibility | | **Support** | Self-service / email | Dedicated account manager | | **Token portability** | Usually supported | Varies by processor | | **Best for** | Under $50k/mo | Over $50k/mo | --- ## Processor Comparison Factors Weight these by what your business actually needs: | Factor | Under $100k/mo | $100k-$1M/mo | Over $1M/mo | |--------|---------------|--------------|-------------| | **All-in rate** | Less important | Important | Critical | | **Setup speed** | Critical | Moderate | Less important | | **Underwriting friction** | Critical | Moderate | Expected | | **Token portability** | Nice to have | Important | Critical | | **Redundancy support** | Not needed | Nice to have | Critical | | **International** | Rarely needed | Sometimes | Often critical | | **Support quality** | Email is fine | Important | Critical | --- ## When to Hire Help ### When a Payments Consultant Is Worth It - **Negotiating enterprise-level contracts ($1M+/mo).** The savings justify the fee. - **Migrating off a legacy processor with complex integrations.** You're buying project management. - **High-risk MCC needing a specialist broker.** They know who will approve you. ### What to Ask Before Hiring 1. **"What's your fee structure?"** Avoid percentage-of-savings for simple work. 2. **"Can you show me comparable deals you've negotiated?"** 3. **"What happens if we don't save money?"** No-results-no-fee is a good sign. ### Caution Avoid retainers with no measurable outcome. Somebody wants $5k/mo to "manage your payments"? Ask what they'll do, and how you'll measure it. --- ## Test to Run **2-week exercise:** 1. Pull your last 3 months of statements. 2. Calculate your true all-in rate: total fees divided by total volume. 3. Get one competitive bid. 4. Compare. **Success criteria:** you either confirm you're well-priced, or you find savings worth chasing. --- ## Next Steps 1. **Know your volume tier** โ†’ Match your approach to your scale 2. **Use the 3-bid method** โ†’ Get competitive quotes in writing 3. **Review [contracts and underwriting](./contracts.md)** โ†’ Understand what you're signing 4. **Consider [integration requirements](./integration.md)** โ†’ Plan your technical approach --- ## See Also - [Contracts & Underwriting](./contracts.md) - What to negotiate beyond rates - [Integration & Exit](./integration.md) - Technical and exit considerations - [Payment Provider Types](/docs/payments/reference/provider-types) - Gateway vs processor vs ISO vs PayFac - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - The interchange blend every crossover on this page is computed from - [Processor Management](/docs/operations/processor-management) - Ongoing relationship management - [Reading Statements](/docs/operations/reading-statements) - Understanding your current costs --- ## Underwriting Source: https://paymentsandrisk.com/docs/payments/buying-payments/underwriting # Underwriting :::info[TL;DR] - **Underwriting = risk assessment.** Processors decide if you're worth the liability before letting you accept cards. - **PayFacs approve instantly** because they absorb initial risk and monitor you later. Traditional accounts take days/weeks because the bank underwrites upfront. - **Your limits reflect your risk tier.** Low limits at first are normal. Demonstrate good behavior to graduate. - **Documents prevent rejection.** Missing paperwork is the #1 reason for delays and declines. - **Ongoing monitoring never stops.** Volume spikes, chargebacks, or business changes trigger re-review. ::: You clicked "Apply" on a payment processor's website. Now they're asking for your business license, bank statements, and government ID. What's going on? This is underwriting. It's the process where the processor decides whether to take you on as a customer and, if so, under what conditions. ```mermaid flowchart LR A[You Apply] --> B{UnderwritingReview} B -->|Approved| C[Set Limits& Terms] B -->|Declined| D[Rejection+ Reason] B -->|Need More| E[DocumentRequest] E --> B C --> F[StartProcessing] F --> G{OngoingMonitoring} G -->|Volume Spike| H[Re-Underwrite] G -->|Chargebacks Up| H G -->|Business Change| H H --> B style D fill:#ef4444,color:#fff style F fill:#22c55e,color:#fff ``` ## Why Processors Underwrite When you accept a card payment, money moves from the cardholder's bank to yours. But here's the catch: **you get paid before the cardholder's bank has fully committed.** If the cardholder disputes the charge 60 days later, that money gets pulled back. If you're already gone (or broke), the processor eats the loss. Underwriting is how they avoid that. **What they're really asking:** - Are you a real business? - Will your customers be happy (low chargebacks)? - If disputes happen, can you cover them? - Are you likely to disappear with the money? Every document request, every verification step, exists to answer these questions. --- ## PayFac vs. Traditional: Why Stripe Approves in Minutes There are two paths to accepting payments, and they have very different underwriting experiences. ### Payment Facilitators (PayFacs) **Examples:** Stripe, Square, PayPal, Toast **How it works:** You become a "sub-merchant" under their master merchant account. They're already approved by the banks. You're riding on their approval. | Aspect | PayFac Model | |--------|--------------| | **Approval time** | Minutes to hours | | **Initial limits** | Low ($10K-$50K/month typical) | | **Documentation** | Minimal upfront (ID, bank account) | | **Risk approach** | Approve fast, monitor closely, shut down bad actors | | **Who eats losses** | PayFac absorbs initial losses, passes to you via reserves | **Why it's fast:** They accept the risk upfront and manage it through: - Low initial limits - Aggressive monitoring - Quick account termination if problems arise - Reserves held from your payouts ### Traditional Merchant Accounts **Examples:** Direct bank relationships, Worldpay, First Data (Fiserv), traditional ISOs **How it works:** You get your own merchant account. The acquiring bank underwrites you directly. | Aspect | Traditional Model | |--------|-------------------| | **Approval time** | Days to weeks | | **Initial limits** | Based on underwriting (can be higher) | | **Documentation** | Extensive upfront | | **Risk approach** | Underwrite thoroughly before approving | | **Who eats losses** | You (via reserves) or the processor | **Why it takes longer:** The bank does full due diligence before saying yes. Less monitoring after approval because they've already vetted you. ### Which Path for You? | Situation | Recommendation | |-----------|----------------| | Just starting, under $50K/month | PayFac (Stripe, Square) | | Established, $100K+/month | Get quotes for both | | High-risk MCC | Traditional (PayFacs often reject) | | Need higher limits fast | Traditional with good docs | | Hate paperwork | PayFac | --- ## What Documents You Need The documentation ladder scales with your risk level and volume. ### Tier 1: Basic (Most SMBs) Required for almost any processor: | Document | Why They Need It | |----------|------------------| | **Government-issued ID** | Verify you're a real person (KYC) | | **Business registration** | Prove the business exists (EIN letter, articles of incorporation) | | **Bank account details** | Where to send your money (voided check or bank letter) | | **Website URL** | Review what you're selling | ### Tier 2: Elevated ($50K+/month or Higher Risk) | Document | Why They Need It | |----------|------------------| | **3-6 months bank statements** | Verify cash flow matches claimed volume | | **Processing statements** | See your history with previous processor | | **Beneficial ownership** | Identify all 25%+ owners (required by law) | | **Business license** | Verify you're legally operating | ### Tier 3: High Volume or High Risk | Document | Why They Need It | |----------|------------------| | **Financial statements** | Assess ability to cover chargebacks | | **Business plan** | Understand your model if it's unusual | | **Personal financial statement** | Backup if business can't cover losses | | **Product samples/marketing** | Verify you're not selling prohibited goods | :::note[Document Quality Matters] Blurry photos, expired IDs, or bank statements with account numbers redacted = delays. Give them clean, complete documents the first time. ::: --- ## Risk Factors Processors Evaluate Underwriters score you across multiple dimensions. Here's what moves the needle. ### The Big Five ```mermaid flowchart TD subgraph RISK["Risk Evaluation"] A[MCC / Industry] B[Volume & Ticket] C[Business History] D[Chargeback History] E[Owner Credit] end A --> F{Risk Score} B --> F C --> F D --> F E --> F F -->|Low Risk| G[Standard TermsHigher Limits] F -->|Medium Risk| H[Moderate LimitsSome Reserve] F -->|High Risk| I[Low LimitsHigh ReserveMonitoring] F -->|Too High| J[Declined] style G fill:#22c55e,color:#fff style H fill:#f59e0b,color:#fff style I fill:#ef4444,color:#fff style J fill:#7f1d1d,color:#fff ``` | Factor | Lower Risk | Higher Risk | |--------|------------|-------------| | **MCC/Industry** | Retail, restaurants, professional services | Supplements, travel, digital goods, subscriptions | | **Volume** | Consistent, predictable | Spiky, rapidly growing | | **Average ticket** | Under $100 | Over $500 | | **Time in business** | 2+ years | Under 6 months | | **Chargeback history** | Under 0.5% | Over 1% | | **Owner credit** | 680+ | Under 600 | | **Delivery timing** | Immediate | Delayed (travel, events, pre-orders) | | **Card-present vs CNP** | Mostly card-present | Mostly card-not-present | ### What Triggers Enhanced Review Even if you're generally low-risk, these factors trigger extra scrutiny: - **MATCH/TMF listing** - You or your business is on the industry blacklist - **Previous processor termination** - Why did they drop you? - **International structure** - Non-US owners, offshore fulfillment - **Negative option billing** - Free trials that convert to paid - **Affiliate marketing** - Who's selling on your behalf? --- ## Common Rejection Reasons Most rejections fall into a few categories. Knowing them helps you avoid them. ### Prohibited Industries Some processors won't touch certain MCCs regardless of your history: - Adult content - Cannabis/CBD (varies by processor) - Weapons/ammunition - Gambling (unlicensed) - Cryptocurrency - Debt collection - Multi-level marketing **Solution:** Find a high-risk specialist processor. They exist, they'll charge more, but they'll take you. ### Documentation Issues | Problem | Fix | |---------|-----| | Missing documents | Submit everything they ask for | | Inconsistent information | Business name on application must match bank account | | Expired ID | Renew before applying | | PO Box as business address | Use a real address | | Unverifiable business | Get proper registration | ### Risk Profile Too High | Issue | What To Do | |-------|------------| | Bad personal credit | Apply with a different principal, or improve credit first | | High chargebacks at previous processor | Document what you've fixed | | New business, no history | Start with PayFac, build track record | | Volume too high for your financials | Apply for lower volume, graduate up | ### MATCH/TMF Listing If you're on the MATCH list (Mastercard's terminated merchant file), most processors will auto-decline. You got on this list because a previous processor terminated you for: - Excessive chargebacks - Fraud - Violating card network rules - Business failure with outstanding chargebacks **What to do:** - Ask the acquirer who listed you for the reason code and the listing ICA. They're required to give you both - File a removal request with them if the listing is wrong. Mastercard's rules say you don't need a lawyer, and the acquirer owes you a response in 30 calendar days - Work with MATCH-friendly processors (they exist, expect higher rates) - Otherwise wait 5 years. Listings purge automatically --- ## Tiered Approvals and Volume Limits Getting approved doesn't mean unlimited processing. Most SMBs start with limits and graduate up. ### How Limits Work | Limit Type | What It Controls | |------------|------------------| | **Monthly volume cap** | Total $ you can process per month | | **Daily volume cap** | Maximum $ per day | | **Single transaction cap** | Maximum $ per transaction | | **Weekly payout cap** | Maximum $ paid out per week | ### Why You Got Low Limits Low initial limits are normal, not a rejection. Processors: - Don't know your actual chargeback rate yet - Need to see you deliver products and handle customers - Want to limit exposure until you prove yourself ### How to Graduate to Higher Limits | Timeframe | What Helps | |-----------|------------| | **0-3 months** | Process consistently, zero chargebacks, respond to all requests | | **3-6 months** | Request limit increase, provide updated bank statements | | **6-12 months** | Demonstrate sustained performance, provide financials if needed | | **12+ months** | Renegotiate terms, consider traditional account if PayFac limits constrain you | **The graduation request:** > "I've been processing $30K/month for 6 months with a 0.2% chargeback rate. I'd like to increase my limit to $75K/month. Attached are my last 3 bank statements showing the volume." ### Card Network Thresholds PayFacs have hard limits set by Visa and Mastercard: - **$100K/month per sub-merchant** - Standard threshold - **$1M/year** - Must transition to direct merchant relationship If you're approaching these, your PayFac will tell you. Start planning your transition to a traditional account. ### The $1M Graduation Requirement This is a hard rule. When you hit $1M in annual volume with Visa or Mastercard through a PayFac, you must "graduate" to a direct merchant account with the acquiring bank. This means: - Re-underwriting under traditional standards - Direct contract with the acquiring bank - Different (often better) pricing - More documentation requirements - Settlement may flow differently Plan ahead. If you're at $800K/year and growing, start conversations about graduation before you hit the threshold. --- ## Ongoing Monitoring Underwriting doesn't end at approval. Processors watch you continuously. ### What Gets Flagged | Activity | Why It's Flagged | |----------|------------------| | **Volume spike** | 2-3x normal volume in a week | | **Chargeback increase** | Approaching 0.9% (card network threshold is 1%) | | **Refund spike** | Over 10% refund rate | | **Average ticket change** | Suddenly processing much larger transactions | | **New product/service** | Selling something different than approved | | **Bank account change** | Could indicate ownership change or fraud | ### What Happens When Flagged ```mermaid flowchart TD A[Flagged Activity] --> B{Severity?} B -->|Low| C[Automated AlertNo Action Yet] B -->|Medium| D[Document RequestExplain Activity] B -->|High| E[Funds HoldPending Review] B -->|Critical| F[Account SuspensionImmediate Review] D -->|Satisfied| G[Continue Processing] D -->|Not Satisfied| E E -->|Resolved| G E -->|Not Resolved| H[Account TerminationPossible MATCH] style G fill:#22c55e,color:#fff style H fill:#ef4444,color:#fff ``` ### How to Avoid Surprise Holds 1. **Warn your processor before volume spikes** - "Black Friday is coming, expect 3x volume" 2. **Respond to document requests within 24 hours** - Delays = holds 3. **Keep documents current** - Updated bank statements, renewed licenses 4. **Report business changes proactively** - New products, ownership changes, address moves --- ## Critical Thresholds to Know Cross these thresholds and you trigger enhanced monitoring, reserves, or termination. **Chargeback ratio:** Stay under 0.9%. Processors flag you around this level, and network programs bring escalating fees (Visa VAMP charges $8/dispute at merchant excessive; Mastercard ECM fines escalate from $1K to $100K+/month). Sustained high ratios risk termination and MATCH listing. See [Network Monitoring Programs](/docs/chargebacks/monitoring/thresholds) for detailed thresholds. **Refund ratio:** Processors flag refunds over 4% (card-present) or 8% (card-not-present). High refunds signal customer dissatisfaction even without chargebacks. **Volume spikes:** 150%+ of daily average triggers review. 200%+ of approved [monthly volume](/docs/payments/metrics) likely triggers a funds hold pending explanation. --- ## Reserve Requirements Reserves are money the processor holds as protection against future chargebacks. Typical amounts: | Risk Level | Reserve % | Hold Period | |------------|-----------|-------------| | Low risk | 0-5% | 0-30 days | | Medium risk | 5-10% | 30-90 days | | High risk | 10-20%+ | 90-180 days | After 6-12 months of clean processing, request a reserve reduction with evidence of low chargebacks and consistent volume. **For detailed guidance on reserves, holds, and what to do when funds are stuck:** See [Holds and Reserves](/docs/operations/holds-and-reserves). --- ## What Processors Check on Your Website Before approving you (and periodically after), processors review your website. Here's their checklist: ### Required Elements | Element | What They Look For | |---------|-------------------| | **Business name and address** | Must match your application | | **Customer service contact** | Phone, email, or chat clearly displayed | | **Products/services** | Clearly described, consistent with your MCC | | **Pricing** | Transparent, in USD, no hidden fees | | **Refund/return policy** | Clear and accessible | | **Privacy policy** | Required for card acceptance | | **Terms and conditions** | Especially for subscriptions | | **Card brand logos** | Properly displayed (Visa, MC, Amex) | ### Red Flags They Look For - Products don't match your MCC (you said "retail" but you're selling supplements) - No customer service information - Unrealistic claims ("guaranteed results," "miracle cure") - Fake testimonials or celebrity endorsements without proof - Pre-checked boxes for additional purchases - Hidden subscription terms - Website content in different language than business location - Shipping times don't match delivery model ### Secret Shopping Processors may buy from you without identifying themselves. They're checking: - Is the product as described? - Is the checkout experience clean? - How easy is it to cancel or return? - Does the billing descriptor match expectations? --- ## Billing Descriptors Your billing descriptor (what appears on customer card statements) is reviewed during underwriting. It must be recognizable to customers and include a working phone number. Poor descriptors cause "I don't recognize this charge" disputes. **For detailed descriptor optimization:** See [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms). --- ## Enhanced Due Diligence Industries Some business models trigger extra underwriting scrutiny. If you're in these categories, expect more questions and higher reserves. ### Subscription and Recurring Billing What they check: - How do customers cancel? - Are terms clearly disclosed before purchase? - What's your involuntary churn (failed payments) rate? - Do you send billing reminders? ### Free Trials (Negative Option) Processors are especially cautious because of high chargeback history in this category. **Requirements:** - Trial must be long enough for product delivery and use (14+ days for physical, 10+ for digital) - Clear disclosure of what happens after trial - No pre-checked boxes for enrollment - Easy cancellation process (can't require phone call if signup was online) - Reminders before first charge ### Affiliate Marketing If you use affiliates to drive sales: - You're responsible for their marketing claims - Processors may check affiliate websites - High-pressure tactics by affiliates = your problem - Must be able to track which affiliate drove which sale ### Future Delivery (Travel, Events, Pre-orders) Higher risk because customers pay now, receive later: - Expect higher reserves (sometimes 100% until delivery) - Must demonstrate fulfillment capability - May need to provide event/travel partner contracts - Chargebacks spike if delivery fails ### Tech Support / Remote Services High fraud history in this category: - Must demonstrate legitimate expertise - No "cold call" or popup-based sales allowed by most processors - Extra scrutiny on elderly customer demographics - Must have clear service descriptions --- ## Scale Callout | Volume | Underwriting Experience | |--------|------------------------| | **Under $50K/mo** | PayFac, instant approval, low limits, graduate up | | **$50K-$250K/mo** | Either path works. PayFac for simplicity, traditional for better terms | | **$250K-$1M/mo** | Traditional recommended. Better rates, higher limits, more paperwork | | **Over $1M/mo** | Direct acquiring relationship. Custom terms, dedicated support | --- ## Test to Run **Before applying anywhere:** 1. **Gather your documents** - ID, business registration, bank letter, website 2. **Check your credit** - Know your score before they pull it 3. **Calculate your actual volume** - Monthly average, not peak month 4. **Review your website** - Does it clearly show what you sell, pricing, refund policy? 5. **Search MATCH** - If you've been terminated before, know before they tell you --- ## Where This Breaks 1. **High-risk industries with limited options.** Sometimes one processor is willing to take you, and they know it. Expect to pay more. 2. **Rapid growth triggering repeated re-underwriting.** Growing 10x in 6 months means constant document requests and potential holds. 3. **Previous processor problems following you.** MATCH listings and bad history don't disappear. Plan for a longer, more expensive path. 4. **International complexity.** Non-US structures, offshore fulfillment, or international customers add underwriting friction. --- ## Next Steps **Just starting out?** 1. [Choose a processor](./selection.md) - PayFac vs traditional 2. Gather Tier 1 documents - ID, business registration, bank account 3. Apply and accept initial limits - Build history first **Hit your limits?** 1. Request limit increase with documentation 2. Consider adding a second processor 3. Evaluate transition to traditional account **Got rejected?** 1. Ask for the specific reason 2. Fix what's fixable (documents, credit, website) 3. Try a different processor or high-risk specialist --- ## See Also - [Processor Selection](./selection.md) - Choosing the right processor - [Contracts](./contracts.md) - Contract terms and fee breakdown - [Holds and Reserves](/docs/operations/holds-and-reserves) - Managing cash flow impact - [Processor Management](/docs/operations/processor-management) - Ongoing relationship - [MCC Codes](/docs/reference/mcc-codes) - Industry classification --- ## Card-Present Terminal Decisions Source: https://paymentsandrisk.com/docs/payments/card-present-terminal-decisions # Card-Present Terminal Decisions :::info[TL;DR] - The terminal decides your liability shift. Chip and contactless push counterfeit fraud to the issuer. Swipe-only or keyed leaves it on you - **Square's card-present rate is 2.6% + 15c, not the widely quoted 2.6% + 10c.** At 5,500 transactions a month that five-cent gap is worth $275. Verified against Square's own fee page on 2026-08-02 - **There's no single cheapest card-present processor.** Below about a $19.50 ticket, PayPal Zettle's 9c fixed fee wins. Above it, Helcim wins. That holds until Stax's subscription is earned back, somewhere north of $58,000 a month. Every ranking here states its ticket size, volume and [interchange assumption](/docs/payments/reference/cost-model-assumptions) - Mobile card readers (Square, Stripe Reader) do fine under $500K/year of card-present volume. Countertop terminals suit fixed locations with higher throughput - **Clover, Toast and Lightspeed all publish card-present rates**, but Clover's real rate is set by your reseller, not by Clover. Ask for the five things in the [warning below](#what-card-present-processing-actually-costs) - Verify EMV certification and contactless support before buying. An older certified terminal may not meet the newer contactless tap requirements - Leasing hardware is almost always a worse deal than buying it. Most leases are hard to cancel ::: Your terminal decides three things on every in-person sale. What the [fees](/docs/payments/buying-payments) look like, how much [fraud](/docs/fraud/card-present-fraud) you see, and who carries the [liability](/docs/fraud/reference/emv-liability) when a card turns out to be stolen. An EMV chip or contactless terminal pushes counterfeit fraud liability to the issuer. A swipe-only or keyed transaction keeps it on you. This page covers chip against tap against swipe, mobile POS, countertop selection, keyed entry risk and omnichannel. :::tip[Single Location, Single Terminal?] One store, one terminal? The answer turns on your average ticket first, your monthly volume second. It doesn't turn on brand. And there isn't one right answer for everybody. Everything below is **card-present only**. It assumes the blended pass-through this site publishes at [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). That's 0.89% + $0.158 of interchange plus an assumed 0.14% + $0.02 of network assessments, so **1.03% + $0.178**. Change the assumption and the crossovers move. That's why it's published. - **Average ticket under about $19.50:** **PayPal Zettle at 2.29% + $0.09** ([source](https://www.paypal.com/us/business/paypal-business-fees), verified 2026-08-02). At small tickets the fixed fee decides it, and 9c is the lowest anyone here publishes. The catch is disputes. PayPal charges **$20** on card chargebacks either way, and **$30** on every dispute once your ratio passes 1.5%. Square charges $0. A dispute-prone business should price that in before taking the 9c. - **Average ticket above about $19.50, up to roughly $58,000 a month:** **Helcim at interchange + 0.40% + 8c**. $0 a month, no setup, PCI, statement or cancellation fee ([source](https://www.helcim.com/pricing/), verified 2026-08-02). All in that's 1.43% + $0.258. It passes Square at a **$9.23** ticket and Zettle at **$19.53**. Neither charges a monthly fee, so there's no volume you have to reach first. On a $50 ticket at $20,000 a month it costs $389 against Square's $580. That's $191 a month. - **Simplest path, and it isn't the cheapest:** **Square Terminal at 2.6% + 15c** on the Free plan. No subscription, no contract ([source](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02). Square isn't cheapest at any ticket or volume in the table below. What you're buying is POS software and the hour you don't spend on setup. That's a legitimate thing to buy. Hardware is bought outright, and the device price isn't on the fee page. Check Square's shop before you budget. - **Somewhere above $58,000-$70,000 a month:** get a **Stax** quote. It passes interchange through at **0% markup + 8c**, on a subscription priced by **annual** volume, not monthly ([source](https://staxpayments.com/pricing/), verified 2026-08-02). At its published $199 floor it overtakes Helcim at roughly $70,300 a month on a $15 ticket, $60,400 on a $50 ticket and $58,000 on a $150 ticket. Treat those as the earliest possible crossovers, not promises. Above $250,000 a year Stax publishes "$199+" with no ceiling, so your quote sets the real number. Be careful with any advice that names a fixed monthly volume for switching pricing models. A volume threshold only exists when the interchange-plus provider charges a monthly fee. Stax does, so its thresholds are real. Helcim doesn't, so with Helcim the question is your ticket size, not your volume. The fleet management, omnichannel and device hygiene sections below are for multiple locations or a complex POS setup. ::: ## What Card-Present Processing Actually Costs Every figure here came from the vendor's own pricing page on 2 August 2026. Where a vendor doesn't publish, this table says so rather than guessing. The flat rates and the interchange-plus rates in this table are **not directly comparable as printed**. A flat rate already contains interchange. An interchange-plus rate doesn't. To rank them you have to assume what interchange costs, and that assumption changes the answer. Ours is published in full at [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). | Provider | Card-present rate | Monthly | Chargeback fee | Source | |---|---|---|---|---| | **Square** | 2.6% + 15c (Free); 2.5% + 15c (Plus); 2.4% + 15c (Premium) | None on Free | Not published | [squareup.com](https://squareup.com/us/en/payments/our-fees) | | **Helcim** | Interchange + 0.40% + 8c, falling to +0.15% + 6c at $1M-5M/month | $0 | $0 if you win, $15 if you lose | [helcim.com](https://www.helcim.com/pricing/) | | **Stax** | Interchange + 0% + 8c | $99-$199+ by **annual** volume | $25 with the optional protection add-on | [staxpayments.com](https://staxpayments.com/pricing/) | | **PayPal Zettle** | 2.29% + $0.09 | None | $15 wallet ($0 if you win), $20 card, $30 above a 1.5% ratio | [paypal.com](https://www.paypal.com/us/business/paypal-business-fees) | | **Shopify Payments** | US: Basic **2.6% + 10c**, Grow 2.5% + 10c, Advanced 2.4% + 10c. Canada carries **no cents** on any plan | US $39-$2,300+, or $29-$299 billed annually | Not published | [shopify.com/pricing](https://www.shopify.com/pricing) | | **Stripe Terminal** | **2.7% + $0.05**. Cards issued abroad add 1.5% | None | $15 to receive plus $15 to counter | [stripe.com/pricing](https://stripe.com/pricing) | | **Moneris** (Canada) | CA$: 2.65% + $0.10 credit, Interac Debit $0.12. Foreign cards +0.80% | No monthly stated for Flat Rate; CA$5 minimum merchant discount, CA$5 Moneris Go software fee, CA$34.95 Moneris Go terminal | CA$25, plus CA$80 authorization chargeback handling | [moneris.com](https://www.moneris.com/en/pricing) | | **Clover** (direct) | **2.3% + 10c** restaurant and QSR, **2.6% + 10c** entry retail and services. Keyed and online 3.5% + 10c. Reseller-dependent in practice | $0 to $129.85 | **Not published at any tier** | [clover.com/pricing](https://www.clover.com/pricing) | | **Toast** | **2.49%** Traditional, **3.09%** Pay-as-you-Go. The + 15c is reported by third parties, not published by Toast | $0 Starter Kit, $69 restaurant, $90 retail | **Not published at any tier** | [pos.toasttab.com/shop/starter-kits](https://pos.toasttab.com/shop/starter-kits) | | **Lightspeed** | **2.6% + 10c** retail (X-Series). No rate published for the restaurant product | Retail $89-$289, restaurant $69-$399 | **$15**, described as a single fee covering the defence | [lightspeedhq.com](https://www.lightspeedhq.com/pos/retail/pricing/) | The widely quoted "Stripe Terminal at 2.6% + $0.10" matches no Stripe geography. The US figure is 2.7% + $0.05, read from a US connection. :::warning[Clover, Toast and Lightspeed all publish rates, and all three are easy to miss] Comparison content routinely says they don't. All three do, and the rates are in the table above. Lightspeed's supposed "1.5%" appears nowhere on its site. What's still true: **Clover's actual rate is reseller-dependent, and Clover says so on its own pricing page.** Treat the published direct rates as your anchor. Anything above them is markup. **Get these five things in writing before signing any of the three:** 1. Effective rate including every markup, on your actual card mix, benchmarked against the vendor's own published rate 2. Monthly software cost per device or terminal 3. The chargeback fee. Clover and Toast publish none at any tier; Lightspeed publishes $15 4. Contract term and the early termination fee. Clover's hardware promotions require three years and auto-renew unless you give 30 days' notice. Toast's own 10-K says 12 to 36 months, so push for 12 5. Whether hardware is **subscribed or bought**. On Clover's own published figures the 36-month subscription premium runs $227 to $3,622. Its FAQ confirms you don't own the device at term end For Clover, the hardware subscription is where the cost hides. You can now check it against Clover's own outright prices. For Toast, it's the payments lock-in. A Toast contract typically stops you switching processors without replacing the POS. ::: --- ## What Matters 1. **EMV chip transactions shift liability.** If you accept a dipped chip card and it's fraudulent, the issuer eats it. If you swipe, you eat it. 2. **Contactless is expected.** Customers increasingly tap. If you can't accept tap, you look dated. 3. **Keyed transactions are high-risk.** Every keyed entry is a liability and fraud exposure. 4. **Terminal security is your problem.** Tampered terminals mean stolen cards and your account shutdown. 5. **Omnichannel needs planning.** If you sell online too, unified processing matters. --- ## EMV vs. Contactless vs. Swipe ### EMV (Chip Dip) | Aspect | Details | |--------|---------| | Security | Highest for card-present. Chip generates unique cryptogram per transaction. | | Liability | Fraud liability shifts to issuer when chip is read. | | Speed | 2-4 seconds. Slightly slower than tap. | | Customer expectation | Standard. Everyone expects chip readers. | ### Contactless (Tap) | Aspect | Details | |--------|---------| | Security | Same cryptogram technology as chip. | | Liability | Same liability shift as EMV. | | Speed | 1-2 seconds. Fastest card method. | | Customer expectation | Growing. Post-COVID, many prefer no-touch. | | Requirements | NFC-enabled terminal. Most modern terminals include this. | ### Swipe (Mag-stripe) | Aspect | Details | |--------|---------| | Security | Lowest. Static data, easily cloned. | | Liability | Fraud liability stays with merchant. | | Speed | Fast, but irrelevant given liability. | | When acceptable | Fallback only when chip fails. Should be rare. | **Rule:** Chip and tap always. Swipe as last resort. --- ## Mobile POS Options Mobile POS (mPOS) means a card reader connected to a phone or tablet. ### When Mobile POS Works - Mobile businesses (food trucks, market vendors) - Pop-up retail - Service businesses at customer locations - Low-volume retail testing a location - Backup terminal when primary fails ### When Mobile POS Doesn't Work - High-volume retail (too slow, battery issues) - Situations requiring receipt printer integration - Complex inventory/POS needs - Unreliable phone connectivity ### Common Mobile POS Options | Device | Published card-present rate | Best For | Notes | |--------|---------------------------|----------|-------| | Square Reader | 2.6% + 15c (Free plan) | Very low volume, simplicity | Locked to Square ecosystem | | Stripe Terminal | **2.7% + $0.05** US | Developers, omnichannel | More technical setup | | PayPal Zettle | 2.29% + $0.09 | PayPal users, low volume | Lowest published US flat card-present rate here. Card chargebacks cost $20, and $30 once your dispute ratio passes 1.5% | | Clover Go | Not published, set by your reseller | SMBs wanting Clover ecosystem | Ask about hardware leasing before signing | Rates verified against each vendor's own pricing page on 2026-08-02 ([paypal.com](https://www.paypal.com/us/business/paypal-business-fees), [squareup.com](https://squareup.com/us/en/payments/our-fees), [stripe.com/pricing](https://stripe.com/pricing)). Among the **US** flat rates verified here, PayPal Zettle's 2.29% + $0.09 is lowest at every ticket size. On a $40 sale it costs $1.01 against Square's $1.19. Stripe Terminal's US rate is 2.7% + $0.05, so the same sale costs $1.13. The fixed fee decides small-ticket rankings, and Zettle's 9c is the lowest of the three. That advantage narrows if you take disputes. PayPal's $20 card chargeback fee is charged win or lose. Above a 1.5% dispute ratio every dispute costs $30, wins included. Square charges $0. Zettle's fixed fee undercuts Square's by 6c a transaction, so one $20 chargeback eats the fixed-fee advantage on about 330 sales. Run your own dispute rate before you take the rate. **The bigger caveat: "cheapest flat rate" isn't "cheapest".** Every device in the table above is flat-rate. A flat rate charges the same on regulated debit as on a premium rewards card. An interchange-plus reader from [Helcim](/docs/payments/processors/helcim) at interchange + 0.40% + 8c behaves completely differently by card type. Using the [published pass-through assumption](/docs/payments/reference/cost-model-assumptions) and Visa's card-present schedule: | $40 card-present sale | Zettle (2.29% + 9c) | Helcim (interchange + 0.40% + 8c) | |---|---|---| | Regulated debit | $1.01 | **$0.56** | | Standard rewards credit | $1.01 | $1.08 | | Premium rewards credit | $1.01 | $1.26 | | Blended SMB retail mix | $1.01 | **$0.83** | So Helcim is far cheaper on debit. Slightly dearer on a standard rewards card. Clearly dearer on a premium rewards card. And cheaper on the blend once your average ticket clears **$19.53**. Below that, Zettle wins on the blend too. Pull your own card mix off a statement first. It's the input doing all the work here. One more structural point. [Shopify Payments](/docs/payments/processors/shopify-payments) charges 10c per in-person transaction in the US, and no cents at all in Canada. Ten cents is among the lowest fixed fees here. That matters most on tickets under $10. ### Mobile POS Trade-offs | Pro | Con | |-----|-----| | Low upfront cost | Higher per-transaction fees | | Portable | Battery dependent | | Quick setup | Limited integration | | Good for testing | May outgrow quickly | --- ## Countertop Terminals Traditional terminals that sit at checkout. ### Key Features to Require - EMV chip reader - NFC/contactless - PIN pad (for debit) - Internet connectivity (Ethernet preferred, WiFi fallback) - Receipt printer (built-in or separate) ### Key Features to Evaluate | Feature | Why It Matters | |---------|----------------| | Dual-facing screen | Customer can see amount, enter PIN, tip | | Integrated printer | Fewer failure points | | Battery backup | Continues during brief power outages | | PCI PTS certification | Security compliance | ### Terminal Manufacturers vs. Processors Terminal hardware comes from **PAX Technology**, **Ingenico** and **Verifone**. They make the devices. They aren't payment processors. Your processor decides which terminals are compatible. - **Locked terminals** (Toast, Clover, Square): Hardware only works with that processor's software and processing. Cheaper or "free" upfront but no portability. - **Open terminals** (PAX, Ingenico, Verifone): Can be programmed to work with many processors. More expensive upfront but portable if you switch. Buying standalone terminals rather than a POS bundle? PAX A920/A80 and the Ingenico Move/Desk series are the usual SMB picks. Your processor's support team can tell you which models they certify. ### Terminal Locking Some processors bundle "free" terminals that only work with them. When you leave: - Terminal becomes paperweight - No token portability - Forced to start over **Ask before accepting bundled hardware:** "If I switch processors, can this terminal work with others?" --- ## MOTO/Keyed Transaction Risk MOTO (Mail Order / Telephone Order) and keyed transactions are high-risk. They're also the one channel where every processor publishes a penalty rate. | Provider | Card-present | Keyed | The penalty | Source, verified 2026-08-02 | |---|---|---|---|---| | Square | 2.6% + 15c | 3.5% + 15c (keyed and card on file) | **+0.9%** | [squareup.com](https://squareup.com/us/en/payments/our-fees) | | PayPal | 2.29% + $0.09 (Zettle) | 3.49% + $0.09 | **+1.2%** | [paypal.com](https://www.paypal.com/us/business/paypal-business-fees) | | Stripe | Terminal rate | Terminal rate **+0.5%** for manual entry | **+0.5%** | [stripe.com/pricing](https://stripe.com/pricing) | | Helcim | Interchange + 0.40% + 8c | Billed at the online rate, interchange + 0.50% + 25c | **+0.10% + 17c** | [helcim.com](https://www.helcim.com/pricing/) | | Stax | Interchange + 8c | Billed card-not-present, interchange + 15c | **+7c** | [staxpayments.com](https://staxpayments.com/pricing/) | On Square, a shop running $50,000 a month through keyed entry instead of the reader pays $450 extra for the same sales. On interchange-plus the markup penalty is smaller. But the underlying interchange downgrades too, so the real gap is wider than the markup suggests. ### When Keyed Entry Is Acceptable - Established B2B customer calling with a repeat order - Card present but chip won't read (1 attempt only) - Phone orders with verified existing accounts ### When Keyed Entry Is a Red Flag | Scenario | Risk | |----------|------| | Walk-in customer says chip "doesn't work" | Possible counterfeit or card testing | | Employee keying cards at end of shift | Possible collusion or internal fraud | | High keyed ratio at one register/employee | Internal fraud signal | | Keyed transactions for pickup orders | Card may not be present at all | ### Liability Shift Loss Keyed transactions don't get EMV liability shift. If the charge is fraudulent, you eat the loss. ### Employee Training Train staff: - Never key a card if the customer refuses to try chip/tap - If chip fails twice, ask for different card - Document why any keyed transaction was necessary - Never key a number read over the phone by a walk-in customer ### Monitoring Keyed Ratio Track keyed transactions as percentage of total CP volume. | Ratio | Status | |-------|--------| | 5% | Problem. Review immediately. | :::note[Ask Your Dev] "Can we pull a report showing keyed transaction percentage by employee or register?" ::: --- ## Device Fleet Hygiene If you have multiple terminals, fleet management matters. ### Reader Labeling and Inventory - Label each terminal with unique identifier - Track serial numbers and locations - Know which terminal is at which register/location - Maintain spare for quick replacement ### Connectivity Best Practices | Connection | Pro | Con | |------------|-----|-----| | Ethernet | Most reliable, fastest | Requires wired infrastructure | | WiFi | Flexible placement | Interference, security concerns | | Cellular (LTE) | Works anywhere | Monthly cost, slower | | Bluetooth to phone | Portable | Battery dependent, pairing issues | **Recommendation:** Ethernet for fixed locations. Cellular for mobile. WiFi as middle ground. ### Firmware Update Cadence - Terminals require firmware updates for security and features - Schedule updates during off-hours (after close or before open) - Test after update before peak hours - Some processors push updates automatically (verify this is happening) ### Offline Mode Risks Many terminals can accept transactions offline and batch-upload later. **Risks:** - Offline transactions have no real-time auth - If card is actually declined, you don't find out until batch - Fraud risk is higher - Weekend offline batches can mean Monday surprises **Guidance:** Disable offline mode unless absolutely necessary. If required, set low limits. ### Battery and Charging Discipline For mobile and battery-backup terminals: - Charge overnight - Replace batteries proactively - Don't drain to zero (damages battery) - Have backup charger/battery ### When a Reader Disappears from Dashboard If a terminal stops appearing in your processor dashboard: - Check power and connectivity first - Verify firmware is current - Check if it was reassigned or removed - Contact processor support if unresolved - Consider it potentially compromised until explained --- ## IVR/Phone Payment Risk Taking card numbers over the phone creates PCI scope and fraud exposure. ### PCI Scope Implications If staff hear or transcribe card numbers: - Your environment is in PCI scope - Call recordings with card data are violations - Systems that display card numbers need protection ### Authentication Challenges Phone payments have: - No 3DS option - No device fingerprint - No address verification at point of call - Only CVV as protection ### Fraud Patterns | Pattern | Description | |---------|-------------| | Social engineering | Fraudster calls claiming to be customer, provides stolen card | | ATO via support | Fraudster calls to add card or change details | | Employee collusion | Staff takes card info for personal use | ### When Phone Payments Are Acceptable - Established B2B relationships with known contacts - Follow-up to in-person transaction (card failed, callback with different card) - Low-ticket, low-risk items ### Better Alternatives | Instead of Phone | Do This | |------------------|---------| | Customer reads card over phone | Email/text a payment link | | Staff keys card number | Send hosted checkout link | | Repeat B2B orders by phone | Set up on-file billing | **Related:** [Invoicing](/docs/payments/invoicing) --- ## Omnichannel Considerations If you sell in-person and online, unified processing simplifies everything. ### Benefits of One Processor for Both | Benefit | Why It Matters | |---------|----------------| | Unified reporting | One dashboard for all transactions | | Single reconciliation | One deposit, one statement | | Token sharing | Cards saved online work in-person and vice versa | | Consistent pricing | No managing two rate structures | ### When Separate Processors Make Sense - Specialized CP processor with better terminal support - Legacy in-person setup that works, new online launch - Temporary while migrating ### Omnichannel Pitfalls - Different merchant IDs for CP and CNP can confuse reconciliation - Customer disputes may land in wrong system - Token portability between channels isn't automatic - Reporting gaps between systems :::note[Ask Your Dev] "Are our in-person and online transactions on the same merchant account? Do saved cards work across channels?" ::: --- ## Terminal Security Terminal tampering leads to card skimming, data theft, and account termination. ### Tamper Inspection Checklist Weekly check: - [ ] Terminal casing intact, no unusual gaps - [ ] Card slot matches original design - [ ] No overlay on PIN pad - [ ] No loose cables or wires - [ ] Tamper stickers/seals unbroken - [ ] Serial number matches your records ### Physical Security Basics - Terminals should be visible to staff, not hidden - Cable terminals to prevent grab-and-run theft - Limit who can access back of terminal - Lock terminals in safe overnight (high-risk locations) ### What to Do If Tampering Suspected 1. Stop using the terminal immediately 2. Do not process transactions 3. Contact your processor security team 4. Preserve the terminal as evidence 5. Review recent transactions for anomalies 6. File police report if theft confirmed --- ## Test to Run **2-week terminal audit:** **Week 1:** Baseline and inspect. - Pull keyed transaction percentage by terminal/employee - Inspect all terminals for tampering - Verify firmware is current - Check connectivity type and reliability **Week 2:** Remediate and measure. - Address any high keyed ratios - Update firmware if needed - Fix connectivity issues - Re-check keyed ratio **Success criteria:** Keyed ratio under 2%, all terminals current on firmware, no tampering signs. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo CP** | Get a basic EMV/NFC terminal and don't overthink the hardware. On cost, Helcim or Zettle beat Square at this volume, and which one depends on your ticket. Pick Square and you're paying for the software, not saving on the rate. Stripe Terminal at 2.7% + $0.05 sits between them on a mid-size ticket. | | **$100k-$1M/mo CP** | Fleet management matters. Standardize terminals, track keyed ratios, schedule firmware updates. This is also the band where a Stax quote starts to be worth getting. | | **Over $1M/mo CP** | Multi-location consistency, dedicated terminal support, employee training programs, regular security audits. Helcim publishes bands to $5M/mo; above that everyone is negotiating. | --- ## Where This Breaks 1. **Multi-location businesses with inconsistent terminal versions.** Old terminals at some locations create liability gaps and reporting inconsistencies. 2. **Mixed CP/CNP with reconciliation complexity.** Separate merchant IDs for channels creates accounting headaches. 3. **High-turnover staff requiring constant retraining.** Security and procedure training gets neglected with frequent staff changes. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Keyed transaction %** | Liability exposure and fraud risk | 99% | | **Chargeback ratio by channel** | CP should be lower than CNP | CP < 0.3% | --- ## Next Steps **Choosing terminals?** 1. [Compare EMV vs contactless vs swipe](#emv-vs-contactless-vs-swipe) - Know the trade-offs 2. [Evaluate mobile POS](#mobile-pos-options) - When mPOS works and doesn't 3. [Check countertop features](#key-features-to-require) - What to require **Managing existing fleet?** 1. [Monitor keyed transaction ratio](#monitoring-keyed-ratio) - Under 2% target 2. [Implement tamper inspection](#tamper-inspection-checklist) - Weekly checks 3. [Follow fleet hygiene](#device-fleet-hygiene) - Labeling, connectivity, firmware **Concerned about security?** 1. [Train employees on keyed transactions](#employee-training) - When to refuse 2. [Secure physical terminals](#physical-security-basics) - Cable, lock, visible 3. [Know response protocol](#what-to-do-if-tampering-suspected) - Stop, preserve, report --- ## Related Pages - [Card-Present Fraud](/docs/fraud/card-present-fraud) - In-person fraud risks - [Terminal Operations](/docs/operations/terminal-operations) - Day-to-day management - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Invoicing](/docs/payments/invoicing) - Phone payment alternatives - [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Chip security - [PCI DSS](/docs/compliance/pci-dss) - Physical security requirements - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Reading Statements](/docs/operations/reading-statements) - Fee analysis - [Decline Codes](/docs/reference/decline-codes) - Transaction failures - [Chargeback Prevention](/docs/chargebacks/prevention) - Dispute reduction - [EMV Liability](/docs/fraud/reference/emv-liability) - Liability shift rules - [Checkout Conversion](/docs/payments/checkout-conversion) - Omnichannel integration --- ## Checkout Conversion Source: https://paymentsandrisk.com/docs/payments/checkout-conversion # Checkout Conversion :::info[TL;DR] - 70% of carts abandon at checkout, and half of that's payment friction. Fix checkout before you add fraud rules, they'll only add more - Guest checkout is the highest-impact change for first-time customers. If you require an account at checkout, you're losing 25-30% of them - Apple Pay and Google Pay cut checkout from 12+ fields to 2 taps, and they're worth 3-5% on auth rates through network tokenization - Decline recovery messaging at the point of failure ("your card was declined, try a different card") recovers 20-30% of soft declines, and you don't need backend changes ::: 70% of shopping carts abandon at checkout, and half of that's payment friction. Fix the checkout before you touch [fraud rules](/docs/fraud/processor-rules-configuration), because rules only add more friction. ```mermaid flowchart LR A[100 Carts] --> B[70 ReachCheckout] B --> C[45 StartPayment] C --> D[35 SubmitPayment] D --> E{AuthResult} E -->|Approved| F[30 CompletePurchase] E -->|Declined| G[5 Declined] G --> H{RecoveryFlow?} H -->|Yes| I[1-2 Recovered] H -->|No| J[Lost] style A fill:#3b82f6,color:#fff style F fill:#22c55e,color:#fff style G fill:#ef4444,color:#fff style I fill:#f59e0b,color:#fff ``` **Where you're losing customers:** - 30% never reach checkout (site/product issues) - 25% abandon at checkout (friction, forced account creation) - 10% abandon during payment (too many fields, unclear errors) - 5% decline (auth issues, fraud blocks) A 5% lift in checkout conversion beats a 5% lift in [fraud prevention](/docs/fraud/prevention). Do the math: if you're stopping $10k/mo in [fraud](/docs/fraud) but losing $50k/mo at checkout, your priorities are backwards. Set the balance with your [risk appetite](/docs/fraud/fundamentals/risk-appetite). ## What Matters 1. **[Payment method](/docs/payments/payment-methods) order decides what gets picked.** The method you list first takes 60-70% of clicks. 2. **Guest checkout isn't a nice-to-have.** Forcing an account kills 25-30% of your first-time buyers. 3. **Fewer fields means more completed orders.** Every extra field you ask for costs 5-10% conversion. 4. **Mobile is its own problem.** Thumb-zone layout, autofill, and [digital wallets](/docs/payments/payment-methods/digital-wallets) matter far more on phones. 5. **[Decline](/docs/reference/decline-codes) recovery is your second chance.** Good UX wins back 20-30% of the declines you'd otherwise lose. --- ## Payment Method Order The first method people see is the one most of them pick. That isn't an accident, so set the order on purpose. ### Default Order Recommendation | Position | Method | Why | |----------|--------|-----| | 1 | [Apple Pay / Google Pay](/docs/payments/payment-methods/digital-wallets) | Fastest completion, highest [auth rates](/docs/payments/auth-optimization) | | 2 | [Credit/Debit Card](/docs/payments/payment-methods/cards) | Universal fallback | | 3 | PayPal | Broad reach, especially older demographics | | 4 | [BNPL](/docs/payments/reference/bnpl-economics) (if offered) | Niche appeal, lower priority | ### When to Reorder - **Older customer base:** Move PayPal up - **High-ticket items:** Consider BNPL higher - **B2B checkout:** Cards or bank transfer first - **International:** Local methods may need top position ### Test Before Changing Method order is easy to test, so test it. Run a 2-week A/B test before you make anything permanent. --- ## Guest Checkout Forcing people to create an account is conversion suicide. ### The Numbers - 25-30% of first-time buyers abandon when forced to create an account - "Guest checkout" should be the default, not the alternative - Account creation can happen post-purchase: "Want to save your info for next time?" ### What Guest Checkout Must Include - Email (for receipt and order updates) - Payment info - Shipping address (if physical) for [AVS verification](/docs/fraud/prevention/avs-cvv) That's it. You get the name off the card, and phone is optional. ### Account Creation Done Right Post-purchase prompt: > "Your order is confirmed. Want to create an account to track orders? Just add a password." This converts 15-25% of guests to accounts without blocking the sale. --- ## Field Reduction Every field you add costs you conversion, so audit them ruthlessly. ### Fields to Kill | Field | Action | |-------|--------| | Phone number (optional) | Remove unless required for delivery or [3DS verification](/docs/fraud/prevention/3ds) | | Company name | Remove for B2C | | Address line 2 | Make optional, collapse by default | | Separate billing address | Default to "same as shipping" | | Title/salutation | Remove entirely | | Date of birth | Remove unless legally required | ### Fields to Combine - First + Last name can be one field (autofill handles it) - City + State + ZIP can auto-populate from ZIP - Card number + expiry + CVV benefit from single-line design ### The Card Form Sweet Spot The best card forms show 3-4 fields: 1. Card number 2. Expiry 3. CVV 4. Cardholder name (optional, can default from billing) Anything beyond that list is friction you're choosing to add. --- ## Mobile Patterns Mobile checkout runs into constraints desktop never has. ### Thumb Zone Design - Primary buttons in bottom third of screen - Form fields should be tap-targets (44px minimum) - Keyboard should match field type (numeric for card/CVV/ZIP) ### Autofill Optimization Use proper HTML autocomplete attributes: - `autocomplete="cc-number"` for card number - `autocomplete="cc-exp"` for expiry - `autocomplete="cc-csc"` for CVV :::note[Ask Your Dev] "Are we using proper autocomplete attributes on payment fields? Test by checking if your phone offers to autofill." ::: ### Digital Wallets on Mobile [Apple Pay and Google Pay](/docs/payments/payment-methods/digital-wallets) convert 2-3x better than manual card entry on mobile. - Biometric auth = fast - No typing = fewer errors - Tokenized = higher [auth rates](/docs/payments/auth-optimization) If you're not offering [digital wallets](/docs/payments/payment-methods/digital-wallets) on mobile checkout, you're leaving money on the table. --- ## Which Payment Methods Do You Actually Need? :::info[Payment Method Decision by Volume] | Your Volume | Offer | Skip For Now | |------------|-------|-------------| | Under $50K/month | Cards + one digital wallet (Apple/Google Pay) | BNPL, ACH, regional methods | | $50K-$250K/month | Cards + Apple/Google Pay + PayPal | BNPL (unless average order >$150), regional methods | | $250K-$1M/month | Cards + wallets + PayPal + BNPL (if AOV >$100) | Regional methods (unless >10% international traffic) | | Over $1M/month | Full method stack based on customer data | Nothing - test everything | If you're under $100/day in revenue, don't optimize checkout yet. Get more traffic first, because checkout work only pays once you have visitors. ::: ## Digital Wallets Quick Decision ### Apple Pay / Google Pay **Add these.** Almost always. | Benefit | Impact | |---------|--------| | Faster checkout | 50%+ reduction in time-to-complete | | Higher [auth rates](/docs/payments/auth-optimization) | Tokenized credentials, biometric auth | | Lower [fraud](/docs/fraud) | Device-bound, no manual entry | **Implementation complexity:** Low if you're on hosted checkout, medium if you build against the API. ### PayPal **Depends entirely on who your customers are.** | Pro | Con | |-----|-----| | Broad reach, especially 45+ | Higher [fees](/docs/payments/buying-payments) (typically 3.49% + fixed) | | Trust signal for some buyers | Different [dispute process](/docs/chargebacks) | | One-click for PayPal users | Redirects can cause abandonment | **When to skip:** Younger customers, high-margin products where the fee bites, or when you'd rather run one dispute process. ### BNPL (Klarna, Affirm, Afterpay) **Add for high-ticket or impulse purchases.** - Sweet spot: $100-$1,000 AOV - Increases AOV by 20-30% for some categories - Adds checkout complexity **When to skip:** Low-ticket items, B2B, subscription-first businesses. **Related:** [Digital Wallets](/docs/payments/payment-methods/digital-wallets) --- ## Decline Recovery UX Good UX wins back 20-30% of [declined](/docs/reference/decline-codes) transactions. Check the [decline code reference](/docs/reference/decline-codes) to see which ones you can actually save. ### Soft Decline Recovery For [soft declines](/docs/reference/decline-codes) (insufficient funds, try again later): 1. **Don't show the error right away.** Retry once behind the scenes first. 2. **If the retry fails, show a helpful message:** "Payment didn't go through. Try a different card or try again in a few minutes." 3. **Keep the form filled in.** Don't make them retype everything they already entered. ### Error Message Design **Bad:** "Transaction declined. Error code 51." **Good:** "This card was declined. Please try a different card or contact your bank." **Bad:** Clearing the form on error **Good:** Keeping all fields except CVV (re-entry required for security) ### Alternative Payment Prompt After a decline, surface alternatives: > "Having trouble? Try Apple Pay or PayPal instead." Plenty of customers carry more than one payment method. A decline on Card A doesn't mean they can't pay with Card B. ### Retry Limits Don't let customers hammer the submit button over and over. That's a fast way to trip your own [velocity rules](/docs/fraud/detection/velocity-rules). - Allow 2-3 attempts per card - After 3 failures, require different card or cooling period - Log excessive attempts for [fraud review](/docs/fraud/detection) :::note[Ask Your Dev] "What happens when a payment is declined? Does the customer see a helpful message? Do we offer alternatives?" ::: --- ## When Conversion Beats Fee Optimization Sometimes paying higher fees is the right call. ### The Math Scenario: You're considering removing PayPal (3.49%) to save on [fees](/docs/payments/buying-payments) vs. [cards](/docs/payments/payment-methods/cards) (2.9%). - 10% of customers prefer PayPal - Removing it loses 5% of those customers (they leave instead of switching) - On $100k/mo, that's $500/mo lost revenue - Fee savings on remaining volume: ~$50/mo **Verdict:** Keep PayPal. You'd lose ten times more revenue than you'd save. ### When to Optimize for Conversion Over Cost - Early-stage (growth > margin) - High customer acquisition cost - Competitive market where friction = lost customer forever ### When to Optimize for Cost Over Conversion - Mature business with strong brand loyalty - Customers who will complete purchase regardless - Very low margin where 0.5% matters --- ## Checkout Security Signals Trust signals affect conversion, especially for unfamiliar brands. ### What Works | Signal | Placement | |--------|-----------| | Lock icon near card form | Reinforces security at decision point | | "Secure checkout" text | Near submit button | | Familiar payment logos | Apple Pay, Visa, MC, PayPal badges | | SSL indicator in browser | Automatic with HTTPS | ### What Doesn't Work - Security badge overload (4+ badges looks desperate) - "Guaranteed safe" claims without backing - Overly long security explanations ### What Hurts - HTTP (not HTTPS) = browsers warn users - Unfamiliar payment processor names - "Powered by [unknown processor]" in footer --- ## Test to Run **2-week checkout audit:** **Week 1:** Baseline and quick wins. 1. Measure current checkout completion rate 2. Add guest checkout if missing 3. Remove 2-3 unnecessary fields 4. Ensure digital wallets are visible on mobile **Week 2:** Measure and iterate. 1. Compare completion rate to Week 1 2. Analyze drop-off by step (where do people leave?) 3. Review decline recovery UX **Success criteria:** 5-10% improvement in checkout completion rate. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Implement best practices. Guest checkout, minimal fields, digital wallets. Don't A/B test yet. | | **$100k-$1M/mo** | A/B test method order, analyze drop-off by step, optimize decline recovery messaging. | | **Over $1M/mo** | Dedicated checkout optimization, multivariate testing, personalized payment method ordering by customer segment. | --- ## Where This Breaks 1. **[Fraud](/docs/fraud)-heavy verticals.** Sometimes the friction *is* the [fraud control](/docs/fraud/prevention). Digital goods and [high-risk categories](/docs/reference/mcc-codes) need more verification even when it costs conversion. That's a trade you're making on purpose. 2. **B2B transactions.** Business buyers need purchase orders, company billing or approval workflows, and that's more fields. See [invoicing](/docs/payments/invoicing) for B2B flows. 3. **International customers.** Local [payment methods](/docs/payments/payment-methods), currency display, and address formats all vary. "Best practices" here are US-centric defaults, so check before you copy them. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Checkout completion rate** | Overall funnel health | > 65% for returning, > 45% for new | | **Drop-off by step** | Where friction lives | Identify steps with > 20% drop-off | | **Method selection distribution** | What customers prefer | Compare to what you're promoting | | **[Decline rate](/docs/reference/decline-codes) at checkout** | [Auth](/docs/payments/auth-optimization) issues | under 5% of attempts | | **Decline recovery rate** | UX effectiveness | over 20% of declines recovered | | **Mobile vs desktop completion** | Platform parity | Mobile should be within 10% of desktop | ### Funnel Visualization Track step-by-step: 1. Cart โ†’ Checkout initiated 2. Checkout initiated โ†’ Payment entered 3. Payment entered โ†’ Payment submitted 4. Payment submitted โ†’ Order confirmed Whichever step loses the most people is where you start. --- ## Next Steps **Starting checkout optimization?** 1. [Measure your baseline](#analyst-layer-metrics-to-track) - Know current completion rate 2. [Enable guest checkout](#guest-checkout) - Remove account creation barrier 3. [Add digital wallets](/docs/payments/payment-methods/digital-wallets) - Fastest checkout experience **Already optimizing?** 1. [Run the 2-week audit](#test-to-run) - Systematic improvement 2. [Optimize decline recovery](#decline-recovery-ux) - Recover 20-30% of declines 3. [A/B test method order](#payment-method-order) - Find optimal order **Approval rate too low?** 1. [Focus on auth optimization](/docs/payments/auth-optimization) - Approval rate deep dive 2. [Review decline codes](/docs/reference/decline-codes) - Understand failures 3. [Follow auth playbook](/docs/playbooks/increase-auth-rates) - Step-by-step guide --- ## Related Pages - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Subscriptions and Recurring](/docs/payments/subscriptions-recurring) - Recurring billing UX - [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Apple Pay, Google Pay - [Fraud Prevention](/docs/fraud/prevention) - Balancing security and conversion - [3DS Optimization](/docs/fraud/prevention/3ds) - Authentication flow - [Decline Codes](/docs/reference/decline-codes) - Understanding failures - [Cards](/docs/payments/payment-methods/cards) - Card acceptance - [Risk Appetite](/docs/fraud/fundamentals/risk-appetite) - Friction tradeoffs - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Fraud rule tuning - [Increase Auth Rates](/docs/playbooks/increase-auth-rates) - Approval optimization - [Buying Payments](/docs/payments/buying-payments) - Processor capabilities - [Payment Methods](/docs/payments/payment-methods) - All payment options --- ## Top 10 Preventable Payment Mistakes Source: https://paymentsandrisk.com/docs/payments/common-mistakes # Top 10 Preventable Payment Mistakes :::info[TL;DR] - Wrong billing descriptor (customers don't recognize the charge) causes 20-30% higher chargebacks in the first 30-90 days of operation - fix this before processing a single live transaction - Not enabling dispute alerts means you miss the narrow response windows and lose by default - chargebacks you could have won simply expire - Using a mismatched MCC inflates your interchange costs by 0.5-1.5% on every transaction - verify your code is accurate with your processor - **You can negotiate far earlier than people tell you.** Square's own pricing page says "if you process over $250,000 per year, talk to our team about custom pricing." That's about $21,000 a month, not $1 million - **Shopify's third-party gateway fee is exact, not a range**: 2% on Basic, 1% on Grow, 0.6% on Advanced, 0.2% on Plus, charged on every order if you don't use Shopify Payments - Restrictive refund policies backfire: customers who can't get a refund go to their bank, and banks almost always side with cardholders ::: These 10 mistakes cost SMBs $5,000 to $50,000+ each. All are completely preventable with 30 minutes to 2 hours of work. 10 Preventable mistakes that cost real money $5K-$50K+ Cost per mistake (annualized) 30 min - 2 hrs Time to fix each one If you're new to payments, read this list first. If you've been processing for months, audit yourself against it. ```mermaid %%{init: {'themeVariables': {'xyChart': {'titleColor': '#3b82f6', 'plotColorPalette': '#ef4444'}}}}%% xychart-beta title "Annualized Cost of Top 5 Mistakes ($K)" x-axis ["Wrong Descriptor", "No Alerts", "Early Fraud Tools", "True Cost Blind", "Ignoring Warnings"] y-axis "Cost ($K)" 0 --> 80 bar [5, 11, 4, 77, 48] ``` Each of these is recomputed below from published processor fees, verified against each vendor's own pricing page on 2 August 2026. Where a vendor doesn't publish, the number says so rather than filling in a plausible figure. ## Mistake #1: Wrong Billing Descriptor ### What It Is Your billing descriptor is what appears on customer's card statements. "WEBSERV*PROD" or "SQ*RANDOM TEXT" instead of your actual business name. :::danger[The Cost] **20-30% higher chargebacks** for "I don't recognize this charge" disputes for the first 30-90 days. At $250K/month with a $75 average order, that's 3,333 transactions. A 0.6% baseline ratio is 20 disputes a month. A 25% increase is **5 extra disputes**, at $85 all-in each = **$425/month**, or about **$850** over the 60 days it takes to notice and for the fix to take effect. Left unfixed for a year it's **$5,100**. The $85 assumes a $15 chargeback fee, which is what most US processors publish. On PayPal card transactions the fee is $20, so the same five disputes cost $90 each and the annual figure is **$5,400**. Above a 1.5% dispute ratio PayPal charges $30 and the annual figure is **$6,000**. On Square the fee is $0. On Helcim, disputes you win cost $0. ::: ### How to Prevent **Day 1 of processor setup**: 1. Set descriptor to your recognizable business name 2. Test: Would your mother recognize this on a statement? 3. Include phone number if space allows 4. Never use: Generic terms, abbreviations, processor defaults **Stripe**: Dashboard โ†’ Settings โ†’ Public Details โ†’ Statement Descriptor **Square**: Auto-set from business name, verify it's correct **Shopify**: Settings โ†’ Payments โ†’ Statement Descriptor **Time to fix**: 15 minutes **Time to take effect**: 30 days **See**: [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) --- ## Mistake #2: No Dispute Alerts at $500K+ Volume ### What It Is Not enabling chargeback alerts (RDR, Ethoca, Verifi) when processing over $100K-$500K/month. ### The Cost :::danger[The Cost] **40% of chargebacks are preventable** with dispute alerts. At $500K/month and a $75 average order, that's 6,667 transactions. A 0.6% ratio is 40 disputes a month. Preventing 40% of them is **16 disputes at $85 = $1,360/month** saved, against a quoted alert cost of $400-600. **Net benefit: $760-960/month, or $9,100-$11,500 a year.** ::: ### How to Prevent **At $100K/month OR 0.65% CB ratio, enable alerts**: 1. Ask your processor which alert networks are already wired into your account. Visa RDR and the Ethoca and Verifi feeds are often resold through the processor rather than bought direct. 2. Get quotes from Verifi (Visa) and Ethoca (Mastercard) for the networks your processor doesn't cover. :::note[Alert pricing is not published] Neither Verifi nor Ethoca publishes a rate card. The $400-600/month used above is a planning placeholder, not a verified figure. Get your own quote and put the real number in the calculation before you decide. ::: **Time to implement**: 1-2 weeks **ROI**: Positive immediately **See**: [Setup Dispute Alerts Playbook](/docs/playbooks/setup-dispute-alerts) --- ## Mistake #3: Buying Fraud Tools Too Early ### What It Is Buying a standalone fraud platform when processing under $250K/month. ### The Cost :::danger[The Cost] **The tool costs more than the entire problem.** At $100K/month with a $60 average order, that's 1,667 transactions. A 0.5% ratio is **8 disputes a month at $85 all-in = $680**. That is the whole chargeback bill. [SEON](https://seon.io/pricing/) publishes its Starter tier at **$699/month for 2,500 fraud checks** (verified 2026-08-02). Even a tool that stopped every single dispute would lose you $19/month. A tool that catches half loses you **$359/month, or $4,308 a year**. SEON is the cheap end and the only fraud vendor here that publishes a price at all. Sift, Signifyd, Riskified, Forter, Sardine, Kount and Accertify are all quote-only, and enterprise quotes run well above SEON's Starter tier. ::: ### How to Prevent **Use this decision matrix**: | Volume | CB Ratio | Recommendation | |--------|----------|----------------| | Under $250K | Any | Processor built-ins only (Stripe's Radar Lite is included free with Stripe Payments; Square's ML detection, CVV/AVS and velocity checks are included) | | $250K-$500K | Under 0.6% | Processor built-ins sufficient | | $250K-$500K | 0.6-0.8% | Consider a fraud tool. Price SEON's published $699 tier first, so you have a number to judge the quote-only vendors against | | Over $500K | 0.7%+ | Buy fraud tool immediately | **Wait to buy fraud tools until**: - Volume over $500K/month OR - CB ratio over 0.7% despite using processor built-in tools (Stripe Radar Lite, Square's included detection) OR - Fraud losses exceed $3K/month :::note[What to ask a quote-only fraud vendor] Signifyd is the only one that publishes its pricing *model*: "Signifyd charges a percentage of the order total when an order is approved," with "no charge when an order is declined due to fraud" ([source](https://www.signifyd.com/pricing/), verified 2026-08-02). No percentage is published. Ask any guarantee vendor for the percentage on your vertical and ticket size, exactly what the guarantee covers, whether item-not-received abuse is included, and how fast they reimburse. ::: **Time to decide**: Run ROI calculation (30 minutes) **See**: [Tool Stack by Tier](/docs/payments/tool-stack) --- ## Mistake #4: Processing Without Understanding True Costs ### What It Is Budgeting only for processing fees (3%) and forgetting chargebacks, tools, reserves, labor. ### The Cost :::danger[The Cost] **Running out of cash** or discovering the business isn't profitable. Example at $500K/month on Braintree's published 2.89% + $0.29 with a $75 average order: you budgeted 3% ($15,000) but all-in costs land at 4.28% (**$21,393**). **Shortfall: $6,393/month, or $76,700 a year.** Business impact: undercapitalized, cash flow crisis, can't cover reserves. Take the same orders through PayPal Checkout at 3.49% + $0.49 with its $15 dispute fee, and the all-in rate is 5.15% (**$25,727**). The shortfall against a 3% budget is $10,727/month. The gap is the card rate, not the dispute fee. ::: ### How to Prevent **Before launch, calculate total costs**: Use the [Total Cost Model](/docs/payments/total-cost-model) worksheet: 1. Processing fees, using your processor's published rate rather than a round 3% 2. Chargeback costs (ratio ร— the all-in cost per dispute, and check your processor's actual dispute fee, which runs from $0 on Square to $30 on PayPal's high-volume tier) 3. Tools ($0 to $5K depending on volume, but note that almost no fraud vendor publishes a price) 4. Labor (hours ร— rate) 5. Reserve lock-up (10-30% of volume) 6. Working capital cost **Budget for 4-5% all-in**, not 3%. **Time to calculate**: 1 hour **Prevents**: Cash flow crisis **See**: [Total Cost Model](/docs/payments/total-cost-model) and [Business Model Viability](/docs/payments/business-model-viability) --- ## Mistake #5: Ignoring Chargeback Ratio Threshold Emails ### What It Is Receiving "Your chargeback ratio is approaching our threshold" email from processor and ignoring it. :::danger[The Cost] **Entering monitoring programs** (VAMP, ECM) with escalating per-dispute fees and fines, or **MATCH listing** (5 years unable to process). A warning at 0.7% ignored for 3 months escalates to 0.95%, triggering VAMP fees ($8 per CNP dispute) and ECM fines ($25K-$100K/month). **MATCH listing cost: 5 years unable to accept cards through normal processors.** ::: ### How to Prevent **Read every processor email same-day**: **Warning signs**: - "Chargeback ratio monitoring" - "Approaching threshold" - "Account review" - "Risk department" **Action immediately**: 1. Check actual ratio (don't assume email is wrong) 2. If over 0.65%: Implement [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) 3. Respond to processor within 24 hours 4. Submit action plan **Time to respond**: 2-4 hours **Prevents**: $25K-$100K+ in fines or MATCH listing **See**: [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) and [MATCH/TMF List](/docs/chargebacks/match-tmf) --- ## Mistake #6: Using Third-Party Gateway on Shopify ### What It Is Using Stripe, PayPal, or another gateway on Shopify instead of Shopify Payments. ### The Cost Shopify's third-party gateway fee is published per plan, and it applies to **every order** you take through an outside processor: | Shopify plan | Third-party gateway fee | Cost at $100K/month | |---|---|---| | Basic | **2.0%** | $2,000/month, $24,000/year | | Grow | **1.0%** | $1,000/month, $12,000/year | | Advanced | **0.6%** | $600/month, $7,200/year | | Plus | **0.2%** | $200/month, $2,400/year | Source: [shopify.com/pricing](https://www.shopify.com/pricing), verified 2026-08-02. That fee is charged **on top of** whatever your outside processor charges. So on Basic at $100K/month, running Stripe or PayPal instead of Shopify Payments costs you their rate plus $2,000. The gateway fee alone is more than most processors' entire markup. :::note[About the Shopify Payments rate itself] The US Shopify Payments card rates are confirmed: online **2.9% / 2.7% / 2.5% + 30c** and in person **2.6% / 2.5% / 2.4% + 10c** by plan, with plans at $39 / $105 / $399 a month or $29 / $79 / $299 billed annually. There is no shopify.com/us/pricing path; Shopify resolves country by connection, so the bare URL served to a US IP is the US card. One widely repeated fact about Shopify is Canada-only: the in-person rate carries **no fixed cent charge in Canada, and 10 cents in the US**. What does hold in every market is the third-party gateway fee above, which applies whenever you don't use Shopify Payments. That fee, not the card rate, is the lock-in. ::: ### How to Prevent **If you're on Shopify**: 1. Use Shopify Payments (default) 2. Never add third-party gateway unless Shopify Payments unavailable in your country 3. Verify Settings โ†’ Payments shows "Shopify Payments" not Stripe/PayPal **Time to check**: 5 minutes **Savings**: $2,000/month at $100K volume **See**: [Shopify Payments Profile](/docs/payments/processors/shopify-payments) and [Shopify First Week](/docs/playbooks/shopify-first-week) --- ## Mistake #7: Keying In Transactions Instead of Using Card Reader ### What It Is Staff manually keys in card numbers instead of swiping/dipping/tapping. ### The Cost **0.5-1.2% higher fees** for keyed-in versus card-present, depending on your processor. All figures verified 2026-08-02. | Processor | Card-present | Keyed | Penalty | |---|---|---|---| | [Square](https://squareup.com/us/en/payments/our-fees) | 2.6% + 15c | 3.5% + 15c | **+0.9%**, same fixed fee | | [PayPal](https://www.paypal.com/us/business/paypal-business-fees) | 2.29% + $0.09 (Zettle) | 3.49% + $0.09 | **+1.2%**, same fixed fee | | [Stripe](https://stripe.com/pricing) | Terminal rate | Terminal rate + 0.5% | **+0.5%** | **At $100K/month on Square with 50% keyed-in**: - Keyed volume: $50,000 - Extra cost: $50K ร— 0.9% = $450/month - **Annual waste: $5,400** The per-transaction cent charge is the **same** on Square whether you key or dip, at 15c either way, on every plan. It's the percentage that moves, so the penalty is a clean 0.9% of keyed volume with no ticket-size effect. **Plus**: Higher fraud risk on keyed transactions, and no EMV liability shift. ### How to Prevent **Train staff on Day 1**: - "Use the reader for EVERY transaction unless customer doesn't have physical card" - Only key in for phone orders or missing cards - Monitor keyed-in % weekly (should be under 10%) **If over 20% keyed-in**: Retrain staff or fix broken reader. **Time to train**: 15 minutes **Savings**: $450/month at $100K volume **See**: [Square First Week](/docs/playbooks/square-first-week) and [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) --- ## Mistake #8: No Delivery Confirmation for Physical Goods ### What It Is Shipping products without signature confirmation or detailed tracking. ### The Cost **Auto-lose 100% of "not received" disputes** (Visa 13.1, Mastercard 4855). **At $500K/month, 15% "not received" disputes**: - Total chargebacks: 30/month - "Not received": 5/month (15%) - Without tracking: Win rate 0% - With signed tracking: Win rate 70% - Lost: 5 ร— $90 = $450/month - **Annual cost: $5,400** **Plus**: Ratio stays elevated from unwinnable disputes. ### How to Prevent **Shipping policy Day 1**: 1. Require signature confirmation for orders over $100 2. Use carriers with detailed tracking (USPS, UPS, FedEx) 3. Send tracking number to customer immediately 4. Save tracking data in system (for disputes) **For digital goods**: - Log download IP, timestamp, file delivered - Send confirmation email with access details - See [Digital Goods Evidence](/docs/chargebacks/digital-goods-evidence) **Time to implement**: 1-2 hours **Saves**: $450/month on "not received" disputes **See**: [Chargeback Prevention](/docs/chargebacks/prevention) and [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) --- ## Mistake #9: Enabling 3DS Without Testing First ### What It Is Turning on 3D Secure authentication for all transactions without measuring conversion impact. ### The Cost **2-5% authorization rate drop** if implemented poorly, and you only discover it weeks later. **At $500K/month with 88% baseline auth rate**: - Before 3DS: 88% auth = $440K approved - After 3DS (no testing): 83% auth = $415K approved - **Lost sales: $25K/month** **3 months to discover and fix**: $75,000 in lost sales. ### How to Prevent **Test 3DS on a segment first**: 1. Enable only for high-risk transactions (over $200, new customers) 2. Run for 2 weeks 3. Measure: Auth rate, fraud rate, CB ratio 4. If auth drops over 5%, kill or adjust 5. Only expand if metrics justify **Never**: Turn on 3DS globally without testing **Always**: A/B test with control group **Time to test**: 2 weeks **Prevents**: $25K/month in lost sales **See**: [3D Secure](/docs/fraud/prevention/3ds/) and [First-Time 3DS Setup](/docs/playbooks/first-time-3ds-setup) --- ## Mistake #10: Single Processor with No Backup ### What It Is Processing 100% of volume through one processor (Stripe, Square, etc.) with no backup. ### The Cost **One account hold or termination = business dead** for days/weeks. **Real scenario**: - $1M/month business, 100% on Stripe - Stripe holds account for review (volume spike, fraud flag, etc.) - Hold duration: 3-7 days - Volume lost: $230K-540K - **Plus**: Customer trust damage, order fulfillment crisis **If terminated**: 90-180 days to access funds, 2-4 weeks to get approved elsewhere. ### How to Prevent **Multi-processor strategy at $1M+/month**: - Primary: Stripe for 70-80% of volume - Secondary: Braintree or traditional processor for 20-30% - Backup: Can route traffic if primary has issues **Or**: Build relationship with backup processor - Get approved but route minimal volume - If primary terminates, flip traffic immediately **Cost of backup**: $500-1,000/month in minimums **Benefit**: Business continuity insurance **Time to set up**: 2-4 weeks **Prevents**: Business-ending downtime **See**: [Processor Management](/docs/operations/processor-management) and [Holds and Reserves](/docs/operations/holds-and-reserves) --- ## Honorable Mentions (Mistakes 11-15) ### 11. Waiting Until $1M/Month to Ask for Better Pricing **Cost**: whatever the discount would have been, for however many months you waited. The advice that you can't negotiate under $1M a month is wrong, and one major processor says so on its own page. Square's fee page states: **"If you process over $250,000 per year, talk to our team about custom pricing."** That's about $21,000 a month ([source](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02). Stripe publishes no volume threshold at all. Helcim goes further and publishes the discounts instead of making you ask: five card-present bands from interchange + 0.40% + 8c down to interchange + 0.15% + 6c at $1M-5M a month, applied automatically, with custom pricing only above $5M ([source](https://www.helcim.com/pricing/)). If your current processor won't show you a schedule, you have a published one to compare against. **How much a discount is worth** depends entirely on what you can negotiate, and no processor publishes that. At $2M/month a 0.3% reduction would be $6,000/month, but treat that as a target rather than a quoted figure. **See**: [Processor Contracts](/docs/payments/buying-payments/contracts) --- ### 12. Immediate Refunds Training Customers to Dispute **Cost**: 15-20% higher friendly fraud rate If you refund immediately without investigation, customers learn disputing works better than asking. **Policy**: Investigate first, refund if warranted, don't reward abuse. **See**: [Refund Strategy](/docs/chargebacks/refund-strategy) and [Friendly Fraud](/docs/fraud/types/friendly-fraud) --- ### 13. Processing High-Risk Products Without Experience **Cost**: MATCH listing within 3-6 months Supplements, CBD-adjacent, adult, high-ticket with long delivery = 1.5-3% CB ratio. **Sustained high ratios risk processor termination and MATCH listing** = 5 years unable to process. **Prevention**: Start in lower-risk category, scale into high-risk with systems in place. **See**: [MATCH/TMF List](/docs/chargebacks/match-tmf) --- ### 14. No Account Updater for Subscriptions **Cost**: 2-4% of recurring revenue lost to expired cards **At $100K MRR**: Lost $2,000-4,000/month to preventable declines. Ask your processor whether account updater is included in your plan and whether it's switched on. Neither Stripe nor Shopify lists it as a line item on the pricing pages checked on 2026-08-02, so get the answer from support rather than assuming it's free or assuming it's running. **See**: [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) --- ### 15. Assuming Business Model is Viable Without Calculating **Cost**: Launching a fundamentally unprofitable business **Product at $30 with 25% margin + 4% payment costs + 1% CB** = 20% net margin. Add $15 CAC = 5% contribution margin. One bad month and you're losing money. **Prevention**: Run unit economics BEFORE launch. **See**: [Business Model Viability](/docs/payments/business-model-viability) --- ## The Mistakes Ranked by Cost | Rank | Mistake | Typical Cost | Prevention Time | |------|---------|--------------|-----------------| | **1** | Processing high-risk without experience | MATCH listing (5 years) | Research before launch | | **2** | Single processor at $1M+ | $230K-540K if held | 2-4 weeks setup | | **3** | Not understanding true costs at $500K/mo | $76,700/year shortfall | 2 hours | | **4** | 3DS without testing | $75,000 in 3 months | 2 weeks testing | | **5** | No rate negotiation | Target 0.3% at $2M/mo, but unpublished | 2-4 hours negotiation | | **6** | Third-party gateway on Shopify Basic | $24,000/year at $100K/mo | 5 minutes | | **7** | No dispute alerts at $500K | $9,100-$11,500/year | 1-2 weeks | | **8** | Keying in vs swiping | $5,400/year | 15 min training | | **9** | No delivery confirmation | $5,400/year | 1-2 hours | | **10** | Wrong descriptor | $850 over 60 days, $5,100/year unfixed | 15 minutes | | **11** | Buying a fraud tool too early | $4,308/year at $100K/mo | Immediate | **Total preventable losses**: $100K-$500K+ depending on volume and mistakes made. Costs recomputed 2026-08-02 from published processor fees. The two that moved most: the wrong-descriptor figure came down (the old $2,040 assumed a chargeback count roughly three times the stated ratio), and the true-cost shortfall went up, because processing at 2.89% + $0.29 on a $75 ticket is 3.28%, not the 3.2% previously assumed, and dispute fees are higher than $15 on several processors. --- ## Test to Run **Week 1: Checklist audit** Go through each mistake: - [ ] Billing descriptor is recognizable - [ ] Dispute alerts enabled (if over $100K/mo) - [ ] No fraud tools (if under $250K) OR have fraud tools (if over $500K+) - [ ] Calculated true all-in costs - [ ] CB ratio threshold emails read and acted on - [ ] Using Shopify Payments (if on Shopify) - [ ] Keyed-in transactions under 10% - [ ] Delivery confirmation for all physical goods - [ ] Tested 3DS before enabling globally - [ ] Backup processor relationship (if over $1M) **Week 2: Fix priorities** Count how many boxes you DIDN'T check. - 0-2: You're doing well - 3-5: Fix the high-cost ones immediately - 6+: You're leaving $10K-$50K/year on table **Week 3: Implement fixes** Fix in order of cost/impact: 1. High cost, low effort: Wrong descriptor, no alerts, wrong Shopify setup 2. High cost, medium effort: 3DS testing, backup processor 3. Lower cost but important: Account updater, delivery confirmation **Success criteria**: All 10 checkboxes checked within 30 days. --- ## Scale Callout **Under $100K/month:** - Focus on mistakes #1, #7, #8, #10 (descriptor, keying, delivery, costs) - Skip #2 (alerts not ROI-positive yet) - Skip #6 (unless on Shopify) **$100K-$500K/month:** - All mistakes matter - Priority: #2 (dispute alerts), #4 (true costs), #5 (threshold emails) - Add #3 (don't overbuy tools) **$500K-$2M/month:** - Mistakes #2, #3, #5 are most expensive at this scale - Add #10 (backup processor) - Start negotiating rates (#11) **Over $2M/month:** - All mistakes are expensive - Priority: #10 (backup), #11 (negotiation), #5 (thresholds) - You should have systems to prevent 1-9 --- ## Where This Breaks 1. **High-growth businesses**: If you go from $100K to $1M in 3 months, you'll make 5-8 of these mistakes. Normal when scaling fast. 2. **High-risk industries**: Even with perfect execution, high-risk (supplements, CBD) may hit MATCH. Not always preventable. 3. **Seasonal businesses**: Mistakes matter more. One bad Q4 can't be recovered if you make mistake #1 or #5. 4. **First-time operators**: You'll make 3-5 mistakes. That's normal. Learn and fix quickly. 5. **Resource constraints**: Some mistakes are "don't have time/money" not "didn't know." Prioritize by ROI. --- ## Quick Reference All figures are at $100K-$500K/month unless stated, and are recomputed from published fees verified 2026-08-02. | # | Mistake | Annualized Cost | Fix Time | |---|---------|----------------|----------| | 1 | Wrong billing descriptor | $5.1K unfixed, $6.3K on PayPal | 15 min | | 2 | No dispute alerts at $500K/mo | $9.1-11.5K | 1-2 days | | 3 | Buying fraud tools too early | $4.3K wasted at $100K/mo | Immediate | | 4 | Not understanding true costs | $76.7K shortfall at $500K/mo | 2 hours | | 5 | Ignoring threshold emails | $25-100K+ fines | Same-day | | 6 | Third-party gateway on Shopify | $2.4K (Plus) to $24K (Basic) at $100K/mo | 30 min | | 7 | Keyed-in vs card reader | $5.4K at 50% keyed on Square | 1 hour | | 8 | No delivery confirmation | $3-8K in lost disputes | 2 hours | | 9 | 3DS without testing | $5-15K in lost sales | 2 hours | | 10 | Single processor, no backup | $10-50K+ if terminated | 1-2 weeks | --- ## Next Steps **Just starting?** 1. Read this list before processing first transaction 2. Check off each prevention step 3. Reference [First Week Setup](/docs/playbooks/stripe-first-week) guides **Already processing?** 1. Audit yourself against the 10 mistakes 2. Calculate cost of mistakes you're currently making 3. Fix high-cost mistakes first **Scaling fast?** 1. Re-audit every $250K volume increase 2. New mistakes emerge at each tier 3. What worked at $100K breaks at $1M --- ## See Also - [Total Cost Model](/docs/payments/total-cost-model) - Prevent mistake #4 - [Tool Stack by Tier](/docs/payments/tool-stack) - Prevent mistake #3 - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevent mistakes #1, #8 - [MATCH/TMF List](/docs/chargebacks/match-tmf) - Consequences of mistake #5 - [Stripe First Week](/docs/playbooks/stripe-first-week) - Prevent mistakes #1, #9 - [Shopify First Week](/docs/playbooks/shopify-first-week) - Prevent mistake #6 - [Square First Week](/docs/playbooks/square-first-week) - Prevent mistake #7 - [Business Model Viability](/docs/payments/business-model-viability) - Prevent mistake #15 - [Setup Dispute Alerts](/docs/playbooks/setup-dispute-alerts) - Prevent mistake #2 - [3DS Setup](/docs/playbooks/first-time-3ds-setup) - Prevent mistake #9 --- ## Going Global Source: https://paymentsandrisk.com/docs/payments/going-global # Going Global :::info[TL;DR] - Cross-border transactions cost roughly 1-2% more all in, and authorize at 75-85% against 90%+ domestic. Local acquiring fixes both, but you need a local entity - FX markup (50-150 bps over mid-market) is often the biggest silent fee in international processing. Ask for the spread, because "competitive rates" isn't a number - Add local payment methods only when a country exceeds 10% of your volume; before that threshold, the integration cost doesn't justify the conversion gain - SCA compliance is required for European transactions no matter where you're headquartered. You need 3DS for EU cardholders ::: :::tip[If You Just Got Your First International Order] Your processor already handles it. International cards are processed automatically - you pay slightly higher fees (cross-border surcharge of 0.5-1.5%) and the customer's bank handles currency conversion. No action required on your end. **When to start optimizing:** - Under $50K/month international revenue - Just accept cross-border payments. Don't optimize. - $50K-$200K/month - Consider showing prices in local currency (see [international payments](/docs/payments/payment-methods/international#smb-quick-start-adding-your-first-foreign-currency)) - Over $200K/month - Consider local acquiring to reduce cross-border fees. Read the rest of this page. The entity formation, local acquiring, and fund repatriation sections below are for businesses with significant international volume. If you're under $200K/month international, they don't apply yet. ::: Going global means accepting payments in foreign markets. Cross-border transactions cost roughly 1-2% more all in, and they [decline](/docs/reference/decline-codes) harder: 75-85% auth rates against 90%+ domestic. [Local acquiring](/docs/payments/buying-payments) fixes both, but you'll need a local entity, a bank account and processor onboarding. What follows is cross-border vs local acquiring, FX strategy, regional payment methods, and how compliance shifts by market. ```mermaid flowchart LR subgraph CROSS["Cross-Border"] C1[US Processor] --> C2[Card Network] --> C3[Foreign Issuer] end subgraph LOCAL["Local Acquiring"] L1[Local Processor] --> L2[Domestic Network] --> L3[Local Issuer] end CROSS --> R1[Higher Fees75-85% Auth] LOCAL --> R2[Lower Fees90%+ Auth] style R1 fill:#ef4444,color:#fff style R2 fill:#22c55e,color:#fff ``` Most merchants assume their US processor "supports international." It does, at 3%+ effective rates and 75% auth rates. That's cross-border, not local. ## What Matters 1. **Cross-border vs. local acquiring.** Cross-border is your US processor charging foreign cards. Local means you've got an entity and a processor in that market. 2. **FX is a hidden cost.** The exchange rate markup can exceed the processing fee. 3. **Payment methods vary by region.** Cards aren't king everywhere. iDEAL in Netherlands, Boleto in Brazil, UPI in India. 4. **Compliance varies.** PSD2/SCA in Europe, data localization in some markets, different consumer protection rules. 5. **Start with one market, prove it, then expand.** All at once and you're running operational chaos in five languages. --- ## Cross-Border vs. Local Acquiring ### Cross-Border (Your US Processor) You use your existing US merchant account to accept international cards. | Aspect | Reality | |--------|---------| | **Setup** | None. Already works. | | **Cost** | Higher cross-border interchange + network cross-border assessment + FX markup. Roughly 1-2% all in | | **Auth rates** | Lower (75-85% typical vs. 90%+ domestic) | | **Chargebacks** | Harder to fight across borders | | **Best for** | Testing a market, low international volume | ### Local Acquiring You establish a local entity and merchant account in the target market. | Aspect | Reality | |--------|---------| | **Setup** | Entity formation, local bank account, separate processor onboarding | | **Cost** | Lower interchange (domestic rates), better FX control | | **Auth rates** | Higher (local issuer trust, no cross-border friction) | | **Chargebacks** | Easier to manage with local representation | | **Best for** | Significant volume in a market (usually 20%+ of revenue) | ### When to Switch from Cross-Border to Local Consider local acquiring when: - Market represents more than 20% of total volume - Auth rate gap exceeds 10 percentage points vs. domestic - FX and cross-border fees exceed 1% of market revenue - Local payment method support is required --- ## FX Strategy Foreign exchange is where money disappears quietly. ### Where FX Costs Hide | Cost Type | What It Is | Typical Range | |-----------|------------|---------------| | **Card network FX rate** | Visa/MC base rate | Usually fair | | **Processor markup** | Added to network rate | 0.5-2% | | **DCC margin** | If you offer cardholder's currency | 2-4% | | **Settlement timing** | Rate at auth vs. settlement | Varies | ### DCC (Dynamic Currency Conversion) DCC lets cardholders pay in their home currency. Sounds nice. Usually isn't. | Aspect | Reality | |--------|---------| | **Who profits** | You and processor (DCC revenue share) | | **Who loses** | Cardholder (2-4% worse rate) | | **Customer experience** | Savvy travelers decline it | | **Recommendation** | Skip it. The margin isn't worth the reputation hit. | ### Multi-Currency Pricing Show prices in local currency. Charge in local currency if you can. | Approach | Complexity | Best For | |----------|------------|----------| | **USD only** | Low | Testing, B2B, US-centric | | **Display local, charge USD** | Medium | Marketing localization | | **Charge in local currency** | High | Serious international presence | **Cross-link:** [FX and Settlement](/docs/payments/reference/fx-and-settlement) for operational details. --- ## Regional Payment Method Requirements Cards aren't universal. Know what matters in your target markets. ### Europe | Method | Coverage | Notes | |--------|----------|-------| | **Cards** | Primary | Visa/MC dominant, some local schemes | | **iDEAL** | Netherlands | Bank transfer, 60%+ of Dutch e-commerce | | **Bancontact** | Belgium | Local card scheme | | **SEPA Direct Debit** | EU-wide | For recurring, requires mandate | | **Klarna/BNPL** | Nordics, Germany | Popular for fashion/retail | ### Latin America | Method | Coverage | Notes | |--------|----------|-------| | **Cards** | Primary but different | High installment usage | | **Boleto** | Brazil | Cash voucher, declining share (~8%) as PIX grows | | **OXXO** | Mexico | Cash payment at convenience stores | | **PIX** | Brazil | Instant bank transfer, now dominant in Brazilian payments | ### Asia-Pacific | Method | Coverage | Notes | |--------|----------|-------| | **Cards** | Varies | Strong in Australia, weak in SE Asia | | **Alipay/WeChat Pay** | China | Required for Chinese consumers | | **UPI** | India | Dominant, low cost | | **GrabPay** | Southeast Asia | Super-app payments | ### Decision Framework Before entering a market: 1. Research top 3 payment methods by volume 2. Verify your processor supports them (or find a local partner) 3. Calculate total cost including method-specific fees 4. Test checkout flow with local testers --- ## Canada PAD Agreements If you're expanding to Canada and want to debit bank accounts, understand that Canadian Pre-Authorized Debit (PAD) is not US ACH. ### Key Differences | Aspect | US ACH | Canadian PAD | |--------|--------|--------------| | **Authorization** | Can be verbal, flexible | Requires written agreement | | **Agreement content** | Varies | Specific required elements | | **Cancellation** | Varies | Specific customer rights | | **Dispute window** | 60 days typical | 90 days for personal, 10 days for business | ### PAD Agreement Requirements Your PAD agreement must include: - Amount (fixed or variable with limits) - Frequency (one-time, recurring, sporadic) - Start date - Payor's bank account information - Cancellation rights and process - Recourse statement **Keep PAD agreements on file.** You'll need them for disputes. --- ## Compliance Variations ### Europe (PSD2/SCA) Strong Customer Authentication (SCA) requires 3DS for most transactions. | Exemption | Criteria | |-----------|----------| | **Low value** | Under โ‚ฌ30 (cumulative limits apply) | | **Trusted beneficiary** | Customer whitelisted merchant | | **TRA** | Low-risk based on fraud rate | | **Recurring** | Subsequent charges on same subscription | ### Data Localization Some markets require data to stay local: - **Russia:** Payment data must be stored in Russia - **China:** Various data localization requirements - **India:** Payment data storage rules (evolving) ### Consumer Protection | Market | Key Difference | |--------|----------------| | **EU** | 14-day cooling-off period for online purchases | | **UK** | Similar to EU post-Brexit (for now) | | **Australia** | Strong consumer guarantees beyond contract terms | --- ## Test to Run **8-week market entry pilot:** **Weeks 1-2:** Research - Identify top payment methods in target market - Calculate cross-border cost vs. local acquiring estimate - Research compliance requirements **Weeks 3-4:** Setup - Enable cross-border for target market - Add top 1-2 local payment methods if supported - Localize checkout (currency display, language) **Weeks 5-8:** Measure - Track auth rate by market vs. US baseline - Monitor chargeback rate - Calculate effective cost per market **Success criteria:** Auth rate within 10% of domestic. Path to local acquiring if volume justifies. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo international** | Cross-border is fine. Focus on checkout localization and top 1-2 local methods. | | **$100k-$1M/mo international** | Evaluate local acquiring for top market. Add regional payment methods. | | **Over $1M/mo international** | Local acquiring in major markets. Multi-currency treasury. Regional payment method coverage. | --- ## Where This Breaks 1. **Underestimating operational complexity.** Each market means different support hours, language, dispute processes, and compliance requirements. 2. **FX exposure without hedging.** Price in local currency with USD costs and currency swings eat your margin. That's a CFO conversation, not a payments one. 3. **Assuming card dominance.** In many markets, not offering the local method means losing 30-50% of potential customers. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Auth rate by market** | Local friction level | Within 10% of domestic | | **Effective rate by market** | True cost | Track trend | | **Payment method mix** | Local method adoption | Matches market norms | | **Chargeback rate by market** | Regional fraud/dispute patterns | Below threshold | | **FX impact** | Currency cost | Track monthly | --- ## Next Steps **Planning international expansion?** 1. [Research payment methods](#regional-payment-method-requirements) - Know what matters in target market 2. [Calculate cross-border costs](#cross-border-vs-local-acquiring) - Understand true cost 3. [Run the market pilot](#test-to-run) - Test before committing **Already accepting cross-border?** 1. [Evaluate local acquiring](#when-to-switch-from-cross-border-to-local) - When volume justifies 2. [Add local payment methods](#regional-payment-method-requirements) - Improve conversion 3. [Optimize auth rates](/docs/payments/auth-optimization) - Reduce cross-border declines **Entering Europe specifically?** 1. [Understand SCA/PSD2](#europe-psd2sca) - 3DS requirements 2. [Review exemptions](/docs/fraud/prevention/3ds) - Request where you qualify 3. [Check compliance](/docs/compliance) - Regional requirements --- ## Related Pages - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Currency operations - [Payment Methods: International](/docs/payments/payment-methods/international) - Regional methods guide - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing checkout - [Auth Optimization](/docs/payments/auth-optimization) - Improving cross-border approvals - [3D Secure](/docs/fraud/prevention/3ds) - SCA and European requirements - [Compliance Overview](/docs/compliance) - Regional compliance requirements - [Fraud Prevention](/docs/fraud/prevention) - Cross-border fraud considerations - [Chargeback Prevention](/docs/chargebacks/prevention) - International dispute handling - [Network Programs](/docs/chargebacks/reference/network-programs) - Global thresholds - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - International AVS limitations - [Launch New Country](/docs/playbooks/launch-new-country) - Market entry playbook --- ## Lowering Your Card Fees (Interchange Optimization) Source: https://paymentsandrisk.com/docs/payments/interchange-optimization # Lowering Your Card Fees (Interchange Optimization) :::info[TL;DR] - **On flat-rate pricing, most of this page can't save you a cent.** Square charges 2.6% + 15c in person and 3.5% + 15c keyed, whatever card shows up. Level 2 data changes nothing on your bill. This only pays on interchange-plus or pass-through - Downgrades are where the money leaks. Missing Level 2/3 data, late settlement, a mismatched transaction type. Each one can add 0.2-0.8% per sale - B2B on interchange-plus? Submit Level 2 on every commercial card. It's a 30-minute config change and it saves a published **0.75 points** on that volume - Settle daily, before your processor's cutoff. Anything sitting more than 2-3 days past authorization downgrades - Ask your processor for an interchange qualification report. It names the downgrades hitting you and what each one costs ::: :::info[Before You Read This Page] Two filters. The first one matters more. **1. What pricing are you on?** Check your statement. - **Flat rate** (Square, Stripe, PayPal, Braintree, Shopify Payments, Toast): your processor eats interchange and bills you one published rate. Square's fee page lists three card-present numbers by plan and one keyed number. No card-type variation at all. Level 2/3 data, downgrades and qualification tiers never reach your bill, so you can't optimize them. One lever still works for you: **channel**. Keyed costs 3.5% + 15c on Square against 2.6% + 15c in person, and Stripe adds 0.5% for manual entry. Source: [squareup.com fee page](https://squareup.com/us/en/payments/our-fees) and [stripe.com/pricing](https://stripe.com/pricing), verified 2026-08-02 - **Interchange-plus or pass-through** (Helcim, Stax, Adyen, most direct merchant accounts): interchange lands on your statement line by line. Every fix below reaches your bottom line **2. Then filter on volume and mix.** - **Under $250K/month, not B2B-heavy, on interchange-plus?** You'll save $50-200/month. Read the [quick wins](#for-all-merchants) and skip the rest. - **B2B with corporate card volume on interchange-plus?** The Level 2/3 section is your quick win. - **Over $250K/month on interchange-plus?** Read the full page. On flat rate and this page looks attractive? Then the real question isn't how to optimize interchange. It's whether you belong on interchange-plus at all. See [the card-mix test](/docs/payments/processor-comparison#the-card-mix-test-not-the-volume-test). ::: Interchange is the fee your bank pays the cardholder's bank on every card sale, and it's the biggest single line in what processing costs you. The rate itself isn't negotiable. What is avoidable, on interchange-plus pricing, is a downgrade: being charged a more expensive rate because the transaction was missing data, settled late, or was sent with the wrong transaction type. ## The Interchange Puzzle ```mermaid flowchart TD A[Transaction$100] --> B{CardType?} B -->|RegulatedDebit| C[$0.270.05% + $0.22] B -->|RewardsCredit| D[$1.751.65% + $0.10] B -->|CorporateCard| E{DataLevel?} E -->|Level 1Basic| F[$2.602.50% + $0.10] E -->|Level 2/3Enhanced| G[$1.901.90% + $0.10] F --> H[DowngradeRisk] G --> I[OptimalRate] style C fill:#22c55e,color:#fff style G fill:#22c55e,color:#fff style I fill:#22c55e,color:#fff style F fill:#ef4444,color:#fff style H fill:#ef4444,color:#fff ``` Card-present Visa rates on a $100 sale. The commercial branch shows the Level 1 to Level 3 gap. That gap is where enhanced data pays. Those two numerals are indicative, not verified. [Interchange](/docs/payments/reference/interchange) rates aren't uniform. They vary by: ### Card Type ```mermaid %%{init: {'themeVariables': {'xyChart': {'titleColor': '#3b82f6', 'plotColorPalette': '#3b82f6'}}}}%% xychart-beta title "Interchange on a $100 Card-Present Sale ($)" x-axis ["Reg Debit", "Exempt Debit", "Basic Credit", "Rewards", "Premium", "Commercial"] y-axis "Interchange ($)" 0 --> 3 bar [0.27, 0.95, 1.61, 1.75, 2.2, 2.6] ``` US Visa rates, from the schedule published 18 April 2026. Cross-checked against Mastercard's of 17 April 2026. Split by channel, because the same card costs different amounts in person and online: | Card Type | Card-present | Online (CNP) | |-----------|--------------|--------------| | Regulated debit (US, large banks) | 0.05% + $0.22 | 0.05% + $0.22 | | Exempt debit (US, small banks) | 0.80% + $0.15 | 1.65% + $0.15 | | Exempt prepaid | 1.15% + $0.15 | 1.75% + $0.20 | | Consumer credit, no rewards | 1.51% + $0.10 | 1.89% + $0.10 | | Standard rewards credit | 1.65% + $0.10 | 2.05% + $0.10 | | Premium rewards (Signature Preferred) | 2.10% + $0.10 | 2.50% + $0.10 | | Top consumer tier (Visa Infinite, MC World Elite) | 2.30% + $0.10 | 2.60% + $0.10 | | Commercial and business cards | 2.10% to 3.00% + $0.10 | 2.79% + $0.10 | | Non-qualified (failed qualification) | 3.15% + $0.10 | 3.15% + $0.10 | The regulated debit line is the $0.21 Durbin cap plus 0.05%. Add the $0.01 fraud-prevention adjustment most issuers qualify for. Outside the US it's a different shape entirely. Interac debit in Canada is a flat fee, roughly $0.05-$0.10. EU consumer debit is capped at 0.20% under the Interchange Fee Regulation. :::caution[These are single card types, not your blended rate] Every row above is one card. Your statement is a mix of all of them. That mix decides whether interchange-plus beats a flat rate. Don't take any single row here as "your interchange". This site's blended assumption is **0.89% + $0.158 card-present** and **1.36% + $0.152 online**, weighted by transaction count. Workings at [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). The rewards-credit row deserves a callout. Most fee comparisons quietly use something near 1.80% + $0.10 as a blended interchange rate. It isn't a blend. It's one card type, a consumer rewards credit card. Use it as a blend and you overstate card-present interchange by about 79 basis points on a $50 ticket. On $20,000 of volume that's roughly $159 a month of phantom cost. And it lands entirely on the interchange-plus side of the comparison. ::: ### Merchant Category ([MCC](/docs/reference/mcc-codes)) - **Grocery stores**: Lower interchange (thin margins, high volume) - **Gas stations**: Lower interchange (competitive market) - **Utilities**: Lower interchange (essential services) - **Restaurants**: Medium interchange - **Retail**: Medium interchange - **Jewelry/Electronics**: Higher interchange (higher [fraud risk](/docs/fraud)) - **Online/CNP**: Higher interchange (highest fraud risk) ### Transaction Method - **Chip card (EMV)**: Lowest (most secure) - **Contactless (NFC)**: Low (secure, fast) - **Swiped (mag stripe)**: Medium (less secure) - **Keyed/manual entry**: Higher (least secure) - **Card-not-present**: Highest (no physical card verification) So interchange on a $100 sale can be $0.27 (regulated debit, tapped in store) or $2.57 (a premium rewards card entered online). Same money, same product, nearly ten times the cost of moving it. --- ## What Your Processor Adds On Top Interchange is what the issuing bank keeps. On interchange-plus, your processor's markup sits on top. The markup is the only part you can shop. Two processors publish theirs in full. That makes them the benchmark for any quote you get. | Processor | Card-present markup | Online markup | Monthly | Source, verified 2026-08-02 | |---|---|---|---|---| | **Helcim** | +0.40% + 8c ($0-50K/mo); +0.35% + 7c ($50-100K); +0.25% + 7c ($100-500K); +0.20% + 6c ($500K-1M); +0.15% + 6c ($1M-5M); custom above $5M | +0.50% + 25c ($0-50K/mo); +0.45% + 20c ($50-100K); +0.35% + 20c ($100-500K); +0.25% + 15c ($500K-1M); +0.15% + 15c ($1M-5M) | $0 | [helcim.com/pricing](https://www.helcim.com/pricing/) | | **Stax** | +0% markup, 8c per transaction | +0% markup, 15c per transaction | $99/mo up to $150K **per year**; $139/mo to $250K/year; $199+/mo above that | [staxpayments.com/pricing](https://staxpayments.com/pricing/) | | **Adyen** | Not published. Interchange++ plus a $0.13 processing fee, indicative card markup 0.60% | Same model | No monthly fee, but "a minimum invoice depending on industry or business model" with no amount attached | [adyen.com/pricing](https://www.adyen.com/pricing) | Helcim's bands say "monthly credit card volume", and they mean it. Stax's bands are **annual**. Misread that and Stax looks about twelve times more expensive than it really is. Use these as your yardstick. Say an ISO quotes you interchange plus 0.60% on $80K a month card-present. Helcim publishes 0.35% for that band. No monthly fee, no PCI fee, no cancellation fee. That's the conversation to have. --- ## Interchange Downgrades Process a transaction wrong and it "downgrades" to a higher rate: | Downgrade Reason | Impact | |------------------|--------| | Missing [AVS](/docs/fraud/prevention/avs-cvv) data for CNP transactions | +0.50% or more | | Late settlement (captured after auth window) | Loses preferred rate | | Missing Level 2/3 data for B2B | Misses lower corporate rates | | Incorrect [MCC](/docs/reference/mcc-codes) | Wrong interchange category | | Missing CVV for e-commerce | Higher rate | Sloppy processing costs you money on every single sale. --- ## Level 2 and Level 3 Data You can cut interchange on B2B and B2G (business-to-government) sales by sending a few extra data fields. Most merchants never do it. The networks built Level 2 and Level 3 to get richer, safer transaction records. You hand over the data. They hand back a lower rate, sometimes 0.5% to 0.8% per sale. ### Data Requirements by Level **Level 1 (Standard)**: card number, expiration, amount, date, merchant name, MCC. The bare minimum to authorize. It pays the highest rates. **Level 2**: All Level 1 data plus: - Sales tax indicator and amount - Merchant tax ID - Merchant postal code - Invoice number - Order number - Customer code (for government/purchasing cards) **Level 3**: All Level 1 and Level 2 data plus detailed line-item information: - Product descriptions and codes - Unit prices, quantities, and totals - Freight and shipping costs - Duty and import taxes - Destination ZIP code - Discounts applied ### Who Qualifies - Level 2/3 data primarily applies to commercial, corporate, and purchasing cards - **Visa**: Level 2/3 applies only to commercial credit cards - **Mastercard**: Applies to commercial credit, debit, and prepaid cards - **American Express**: Broadly aligns to Level 2 enhanced data; Level 3-style line-item programs exist but are more limited ### The Savings Are Real | Card Type | Standard CNP Rate | With Level 2 | With Level 3 | |-----------|------------------|--------------|--------------| | Visa Business | 2.65% + $0.10 | 1.90-2.25% + $0.10 | 1.90% + $0.10 | | Visa Corporate/Purchasing | 2.70% + $0.10 | 2.50% + $0.10 | 1.90% + $0.10 | | Mastercard Commercial | Similar rates | ~0.75% savings | ~0.80% savings | Those Level 2 and Level 3 rows are indicative. They weren't part of the 2026-08-02 rate verification. Read the size of the gap, not the specific numerals. The commercial online rate this site uses elsewhere is 2.79% + $0.10, off Visa's 18 April 2026 schedule. It covers commercial products as a group. It doesn't split business from purchasing. Check the live schedule for the product you actually accept before you build a case on it. **Run $500,000 a year of B2B and the Level 1 to Level 3 gap is worth $3,000-$4,000.** Visa Business drops from 2.65% to 1.90%. That's 0.75% of $500,000, or $3,750. **None of that reaches you on flat rate.** That same $500,000 bills at Square's card-on-file rate, 3.5% + 15c, whether you send Level 1 or Level 3. Square's published schedule has no card-type dimension and no data-level dimension. The saving goes to whoever absorbs interchange. On flat rate, that isn't you. So if you're B2B on flat rate, the move is to interchange-plus. Configuring Level 2 fields comes after. ### Large Ticket Programs Visa and Mastercard both run large-ticket programs. High-value corporate sales, usually over $8,000-$10,000, can price around 1-1.5% plus a fixed amount like $35. Thresholds move often. Check the live tables before you quote it to anyone. ### Implementation Real B2B volume and no Level 2/3 data? You're overpaying on every [settlement](/docs/payments/settlement). Ask your [processor](/docs/operations/processor-management). Many will capture and submit the fields for you. --- ## Quick Wins for Interchange Optimization ### For All Merchants 1. **Always submit AVS and CVV** for CNP transactions 2. **Settle within 24 hours** of authorization 3. **Use chip/contactless** for [card-present](/docs/fraud/card-present-fraud) transactions 4. **Verify your MCC** is correct for your business 5. **Stop keying cards.** The one lever that works on every pricing model, because processors publish separate keyed rates. Square charges 3.5% + 15c keyed against 2.6% + 15c in person, a 0.9 point gap on identical money. Stripe adds 0.5% for manual entry. PayPal charges 3.49% + $0.09 keyed against 2.29% + $0.09 through Zettle in person. Sources: [Square](https://squareup.com/us/en/payments/our-fees), [Stripe](https://stripe.com/pricing), [PayPal](https://www.paypal.com/us/business/paypal-business-fees), verified 2026-08-02 ### For B2B Merchants 1. **Ask your processor** about Level 2/3 data capabilities 2. **Identify commercial card volume** - which customers pay with corporate cards? 3. **Calculate potential savings** - 0.75 points on commercial card volume 4. **Update your checkout/invoicing** to capture required fields ### For High-Volume Merchants 1. **Audit your downgrade rate** - what percentage of transactions miss optimal interchange? 2. **Identify patterns** - which transaction types downgrade most? 3. **Fix the root causes** - missing data, late settlement, incorrect MCCs 4. **Renegotiate processor markup** - interchange savings shouldn't just go to your processor --- ## Next Steps **Understanding interchange basics?** 1. [Review rate factors](#the-interchange-puzzle) - Card type, MCC, method 2. [Learn downgrade causes](#interchange-downgrades) - Missing data = higher rates 3. [Calculate potential savings](#the-savings-are-real) - Level 2/3 impact **Optimizing for B2B?** 1. [Understand Level 2/3 data](#level-2-and-level-3-data) - What data is required 2. [Check processor capabilities](#implementation) - Can they submit this data? 3. [Explore large ticket programs](#large-ticket-programs) - $8K+ transactions **Quick wins for all merchants?** 1. [Submit AVS and CVV always](#for-all-merchants) - Avoid downgrades 2. [Settle within 24 hours](#for-all-merchants) - Don't miss windows 3. [Verify your MCC](#for-all-merchants) - Correct category --- ## See Also - [Settlement & Reconciliation](/docs/payments/settlement) - How money moves - [Processor Fees Guide](/docs/payments/processor-fees-guide) - Hidden fees to watch for - [Buying Payments](/docs/payments/buying-payments) - Choosing processors - [Interchange Reference](/docs/payments/reference/interchange) - Rate tables - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - The blended card mix behind every cost comparison here, and why one card type isn't a blend - [Understanding Payment Processing Fees](/docs/learning-pathways/getting-started-with-payments/understanding-fees) - The Guide lesson, if fees are new to you - [Card Types](/docs/payments/payment-methods/cards) - What's actually in your card mix --- ## Invoicing and Payment Links Source: https://paymentsandrisk.com/docs/payments/invoicing # Invoicing and Payment Links :::info[TL;DR] - Payment links close 40% faster than Net 30 invoices. Send a link when you need the cash and you don't need the paper trail - Net terms are a loan you're giving your customer at your own cost of capital; price net terms into your pricing or negotiate shorter terms for new customers - ACH is the right method for invoices over $500: under $1 against 2.5%+ for cards, and there's no chargeback risk on B2B - Automated reminders 3 days before the due date and on the due date cut late payments 40-60%, and you're not doing any of the work ::: Invoicing is how B2B and service businesses ask to get paid: formal invoices, payment links or hosted checkout, depending on the deal. Payment links close 40% faster than Net 30, and net terms are a loan you're making at your own cost of capital. What follows is when to use which, how to think about net terms, partial payments, and the B2B specifics like ACH and surcharging. :::info[Scope Note] This page covers manual invoices, payment links, and normal SMB B2B flows. **When NOT to use this page:** - High-volume enterprise invoicing (use ERP/AR systems) - Full SaaS subscription billing systems (use platform billing features like Stripe Billing, Chargebee, etc.) ::: ## What Matters 1. **Payment links close faster than invoices.** Less friction, immediate action. 2. **Net terms are a loan you're giving.** Price them accordingly or skip them. 3. **Partial payments create [reconciliation](/docs/payments/settlement) chaos.** Decide upfront if you accept them. 4. **B2B buyers prefer [ACH](/docs/payments/payment-methods/bank-transfers) for large amounts.** Credit card [fees](/docs/payments/buying-payments) on a $10k+ transaction aren't small. 5. **Expired links cause unnecessary friction.** Set appropriate expirations. --- ## When Invoicing Beats Checkout ### Use Invoices When | Scenario | Why Invoice Works | |----------|-------------------| | B2B with net terms | Buyer expects formal document with due date | | High-ticket requiring approval | Buyer needs to route internally before paying | | Services with detailed line items | Client needs itemized breakdown | | Ongoing relationship with credit terms | Established account, not one-time purchase | | Tax/accounting requirements | Buyer needs formal invoice for records | ### Use Checkout When | Scenario | Why Checkout Wins | |----------|-------------------| | One-time purchases | Faster, less friction | | Consumer transactions | No need for formal document | | Impulse or quick decisions | Speed matters | | Digital products | Immediate delivery expectation | ### Use Payment Links When | Scenario | Why Links Win | |----------|---------------| | Quick quote follow-up | "Here's the link to pay" closes fast | | Phone orders | Alternative to keyed entry | | Service deposits | Collect before starting work | | Event or appointment booking | Secure spot with payment | | Outstanding balance collection | "Click here to pay what you owe" | --- ## Payment Links vs. Hosted Checkout vs. Invoice ### Payment Link A unique URL that leads to a payment page for a specific amount. | Characteristic | Details | |----------------|---------| | Best for | One-time transactions, quick collections | | Formality | Low. No document, just "pay this amount" | | Terms | None. Pay now. | | Expiration | Usually 24 hours to 30 days | | Example | "Pay $500 for design deposit" | ### Hosted Checkout Your [checkout page](/docs/payments/checkout-conversion) embedded in or linked from your site. | Characteristic | Details | |----------------|---------| | Best for | Product purchases, cart-based shopping | | Formality | Low. Standard e-commerce flow | | Terms | Pay at purchase | | Expiration | Session-based (cart timeout) | | Example | Standard e-commerce checkout | ### Invoice Formal document with line items, due date, and [payment](/docs/payments) terms. | Characteristic | Details | |----------------|---------| | Best for | B2B, services, formal accounting needs | | Formality | High. Document of record | | Terms | Often Net 15, Net 30, Net 60 | | Expiration | Due date (not payment page expiration) | | Example | "Invoice #1234 for consulting services, due in 30 days" | --- ## Invoice Workflow for SMBs ### Standard Flow ``` Quote โ†’ Invoice โ†’ Payment โ†’ Receipt ``` ### Quotes - Use quotes for approval before invoicing - Quote should convert to invoice with one click - Set quote expiration (7-14 days typical) - Don't invoice without quote acceptance for large deals ### Invoice Issuance Send immediately after: - Work completed (services) - Goods shipped (products) - Contract signed (deposits) - Milestone reached (phased projects) Delayed invoicing delays payment. Invoice the day work is delivered. ### Payment Collection | Net Term | When to Use | |----------|-------------| | Due on receipt | Default for new customers, small amounts | | Net 15 | Established relationship, fast-paying industries | | Net 30 | Standard B2B, larger enterprises | | Net 60+ | Large enterprise only, price it in | ### Receipt/Confirmation Auto-send receipt when payment received. Include: - Invoice number - Amount paid - Payment method - Date received --- ## Net Terms Strategy Net terms are a loan. Treat them that way, because that's what your bank would call it. Factor it into your [cash flow planning](/docs/operations/payout-strategy). ### The Real Cost of Net Terms Net 30 on a $10,000 invoice: - You're lending $10,000 for 30 days - At 6% annual cost of capital, that's ~$50 - If they pay on Day 45 (common), it's more - Plus you're taking payment risk ### Who Gets Net Terms | Customer Type | Suggested Terms | |---------------|-----------------| | New customer, first order | Due on receipt or deposit required | | Repeat customer, clean history | Net 15 | | Established account, high volume | Net 30 | | Enterprise with formal procurement | Net 30-60 (but negotiate) | ### Enforcing Terms - Send reminder at 7 days before due - Send notice on due date - Follow-up at 3 days past due - Escalate at 15 days past due - Collection process at 30+ days past due Most SMBs are too polite about collections. Don't be. Unpaid invoices can become [disputes](/docs/chargebacks) if customers later claim they never received service. --- ## Partial Payments and Deposits ### When to Accept Partial Payments - Large projects with milestones - Customer cash flow constraints (with agreement) - Deposit + balance model ### When to Avoid Partial Payments - Creates reconciliation complexity - Small invoices (not worth the overhead) - One-time transactions with new customers ### Deposit Model | Stage | Payment | |-------|---------| | Contract signed | 50% deposit | | Milestone 1 | 25% | | Final delivery | 25% | Deposits cut your risk and improve cash flow. Require them for new customers and large projects. Nobody's offended by a deposit. ### Reconciliation Warning If you accept partial payments: - Your accounting gets complicated (see [reconciliation best practices](/docs/payments/settlement)) - Tracking becomes manual - Customer may [dispute](/docs/chargebacks) final amount - AR aging is harder to read Decide upfront. "We accept full payment only" is a valid policy. --- ## Payment Link Operational Reality ### Expiration Settings | Link Type | Suggested Expiration | |-----------|---------------------| | Quote follow-up | 7-14 days | | Service deposit | 24-48 hours | | Balance due | 30 days | | Time-sensitive offer | Hours to days | Shorter expirations create urgency. Longer expirations reduce re-sending friction. ### Tracking Opens vs. Completions Good payment link tools show: - Link sent - Link opened (not all tools track this) - Payment started - Payment completed Gap between "opened" and "completed" is friction. Gap between "sent" and "opened" is awareness. ### Mobile Optimization Over 50% of payment links are opened on mobile. Test your payment links on phone: - Does the page load fast? - Are fields easy to tap? - Does autofill work? - Is the amount clearly visible? ### Embedding in Emails Without Spam Filters Payment links can trigger spam filters. **Reduce spam risk:** - Send from your domain (not generic @gmail) - Include the recipient's name - Keep email short (less text = less spam score) - Avoid excessive caps or urgency words - Use a reputable email provider **Test delivery:** - Send test to yourself - Check spam folder - Try different email providers (Gmail, Outlook) --- ## B2B Considerations B2B payments differ from consumer payments. ### ACH/Bank Transfer Preference For invoices over $1,000, offer [ACH](/docs/payments/payment-methods/bank-transfers). | Method | Fee on $10,000 | |--------|----------------| | [Credit card](/docs/payments/payment-methods/cards) (2.9%) | $290 | | [ACH](/docs/payments/payment-methods/bank-transfers) (typically $0.50-$5 flat) | $0.50-$5 | Big difference. Large B2B buyers expect a bank transfer option, and they'll ask for it. See [buying payments](/docs/payments/buying-payments) for fee comparisons. ### Credit Card Surcharging for B2B If B2B buyers insist on [credit cards](/docs/payments/payment-methods/cards): - Consider [surcharging](/docs/payments/surcharging-compliance) to recover fees - Must comply with [network](/docs/compliance/network-rules) and state rules - Disclose before transaction **Related:** [Surcharging Compliance](/docs/payments/surcharging-compliance) ### Purchase Order Matching Enterprise buyers may require: - PO number on invoice - Invoice matching to PO exactly - Approval workflows before payment **Ask buyers:** "Do you need a PO number on invoices?" before invoicing. ### Multi-Approver Workflows Large organizations have approval chains: - AP clerk receives invoice - Manager approves - Finance releases payment Your invoice sits in a queue at each step. Follow up on a schedule that isn't annoying. ### Tax on Invoices :::note[Tax Is Complex] Sales tax and VAT on invoices is jurisdictional chaos. This site doesn't provide tax guidance. **What you need to know:** - **Nexus matters:** You owe tax where you have tax presence - **Economic thresholds:** Many states trigger nexus at $100K+ sales - **B2B exemptions:** Many B2B transactions are tax-exempt but require certificates - **Multi-state/international:** Consider Avalara, TaxJar, or processor-native tools **Talk to your accountant before making tax decisions.** ::: --- ## Where This Breaks 1. **Customer disputes on invoice terms.** "I never agreed to these terms" turns into a [chargeback](/docs/chargebacks). Get the terms acknowledged at the quote stage, because by invoice stage it's too late. See [friendly fraud](/docs/fraud/types/friendly-fraud) for prevention. 2. **Partial payment reconciliation chaos.** Customer pays $800 on $1,000 invoice. Now you're chasing $200 and manually reconciling. 3. **Expired links and re-sending friction.** Customer opens link two weeks later, it's expired, they give up. Balance expiration against friction. --- ## Test to Run **2-week invoicing audit:** **Week 1:** Baseline. - Calculate average days-to-payment for recent invoices - Identify outstanding AR over 30 days - Review current terms by customer segment **Week 2:** Optimize. - Shorten terms for appropriate customers - Send payment links instead of invoices for quick collections - Follow up on overdue balances **Success criteria:** 10-20% improvement in average days-to-payment. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo invoicing** | Use processor-provided invoicing. Stripe Invoicing, Square Invoices, PayPal. Simple is fine. | | **$100k-$1M/mo invoicing** | AR aging reports, systematic follow-up cadence, consider ACH for large invoices, standardize terms. | | **Over $1M/mo invoicing** | AR automation, ERP integration, credit management, professional collections for past-due. | --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Days Sales Outstanding (DSO)** | Average time to collect | under 30 days for Net 30 terms | | **AR aging buckets** | Payment health by age | 70% of links result in payment | | **Invoice-to-payment time** | Collection speed | Track trend over time | | **Dispute rate on invoices** | Terms clarity ([chargeback risk](/docs/chargebacks/metrics)) | under 1% of invoices disputed | ### AR Aging Buckets Track outstanding invoices by age: - Current (not yet due) - 1-30 days past due - 31-60 days past due - 61-90 days past due - 90+ days past due Movement from bucket to bucket indicates collection health. --- ## Next Steps **Setting up invoicing?** 1. [Decide invoice vs payment link vs checkout](#payment-links-vs-hosted-checkout-vs-invoice) - Which to use 2. [Follow invoice workflow](#invoice-workflow-for-smbs) - Quote to receipt 3. [Set net terms appropriately](#net-terms-strategy) - By customer type **Improving collections?** 1. [Enforce terms](#enforcing-terms) - Reminder cadence 2. [Use payment links](#payment-link-operational-reality) - Faster than invoices 3. [Track DSO metrics](#analyst-layer-metrics-to-track) - Days sales outstanding **Handling B2B payments?** 1. [Offer ACH for large amounts](#achbank-transfer-preference) - Save on card fees 2. [Consider surcharging](#credit-card-surcharging-for-b2b) - Recover card costs 3. [Handle PO matching](#purchase-order-matching) - Enterprise requirements --- ## Related Pages - [Surcharging Compliance](/docs/payments/surcharging-compliance) - Fee pass-through rules - [Settlement and Reconciliation](/docs/payments/settlement) - Funding flows - [Payout Strategy](/docs/operations/payout-strategy) - Cash flow optimization - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Phone payment alternatives - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - ACH for B2B - [Cards](/docs/payments/payment-methods/cards) - Card acceptance - [Chargeback Prevention](/docs/chargebacks/prevention) - Dispute reduction - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Dispute patterns - [Checkout Conversion](/docs/payments/checkout-conversion) - Payment completion - [Reading Statements](/docs/operations/reading-statements) - Fee analysis - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring B2B billing --- ## Payments Metrics Source: https://paymentsandrisk.com/docs/payments/metrics # Payments Metrics :::info[TL;DR] - **Auth rate**: 85-95% benchmark; alert on 5%+ drops within 1 hour - **Settlement**: 1-3 days typical; reconciliation rate should be over 99.5% - **Cost**: Effective rate varies by MCC; interchange is roughly 60% of fees on interchange-plus and closer to 40% on a flat rate, not the 70-80% usually quoted - **Advanced**: Track token vs. PAN auth lift (+2-5%), 3DS conversion (over 80%), issuer-level performance - Scale: Under $100K/mo just track basic auth rate; over $2M/mo needs real-time monitoring ::: Most merchants watch revenue and ignore everything between the tap and the deposit. These are the numbers that tell you whether that middle part is healthy. Start with auth rate, because it's the one that moves money today. ## Authorization Metrics | Metric | Definition | Benchmark | |--------|------------|-----------| | **Authorization Rate** | Approved transactions / Total attempts | 85-95% | | **Soft Decline Rate** | Retriable declines / Total declines | 20-40% | | **Hard Decline Rate** | Non-retriable declines / Total declines | 60-80% | :::tip[CNP Auth Rate Benchmarks] Typical US domestic CNP auth rate runs 85-90%. Well-optimized merchants target 90-95%, and above 95% is the top of the range. Below 85% means something's broken, and you shouldn't guess at which thing. Pull a breakdown of [decline codes](/docs/reference/decline-codes) first. A spike in code 05 ("Do Not Honor") points at the issuers. Heavy blocking points at your fraud tool, and over-triggered 3DS looks much the same. If it's neither of those, check your processor configuration. See [Auth Optimization](/docs/payments/auth-optimization) for benchmarks by business type. ::: ## Settlement Metrics If your reconciliation rate isn't clearing 99.5%, you're losing money you can't see. | Metric | Definition | Benchmark | |--------|------------|-----------| | **Settlement Time** | Authorization to funds received | 1-3 days | | **Reconciliation Rate** | Matched transactions / Total | >99.5% | | **Exception Rate** | Unmatched items / Total | Under 0.5% | ## Cost Metrics Effective rate is the one to watch, because it nets out everything else. | Metric | Definition | Notes | |--------|------------|-------| | **Effective Rate** | Total fees / Transaction volume | Varies by MCC | | **Interchange %** | Interchange / Total fees | ~60% on interchange-plus, ~40% on flat rate at a $50 card-present ticket. [Why](/docs/payments/reference/cost-model-assumptions) | | **Assessment Fees** | Network fees / Volume | Not published by any network. Assumed 0.14% + $0.02 | ## Monitoring Recommendations An auth rate drop costs you money every hour it goes unnoticed, so don't wait for a monthly report to catch it. - Track authorization rates by BIN, issuer, and card type - Alert on >5% auth rate drops within 1 hour - Review decline reason codes weekly --- ## Auth Optimization Analytics Once you've got the basics running, these are the numbers that move auth rate. ### Token vs. Non-Token Performance | Metric | How to Measure | What to Look For | |--------|----------------|------------------| | **Token auth rate** | Auth rate on network token transactions | Should be 2-5% higher than raw PAN | | **Token coverage** | % of stored cards using network tokens | Target >80% of recurring | | **Token update rate** | % of tokens auto-updated vs. expired | Higher = less involuntary churn | ### 3DS Impact Measurement | Metric | Formula | Benchmark | |--------|---------|-----------| | **3DS challenge rate** | Challenged / Total 3DS | 5-15% is typical | | **3DS conversion** | Completed / Challenged | >80% is healthy | | **3DS auth lift** | 3DS auth rate - Non-3DS rate | +3-10% typical | | **Frictionless rate** | Frictionless / Total 3DS | >85% is good | ### Soft vs. Hard Decline Trends | Metric | What It Tells You | |--------|-------------------| | **Soft decline %** | Opportunity for retry recovery | | **Soft decline recovery rate** | How effective is your retry logic | | **Hard decline by code** | Where you're losing customers permanently | ### Recurring Retry Analytics | Metric | Calculation | Action | |--------|-------------|--------| | **First attempt success** | Success / Total first attempts | Baseline health | | **Retry success rate** | Success / Total retries | Measure retry value | | **Optimal retry timing** | Compare success by retry delay | Tune retry windows | | **Max retry effectiveness** | Recovery rate by attempt number | When to stop retrying | ### Issuer-Level Performance Track auth rates by your top 10 issuing banks, because they won't all behave the same: | Issuer | Auth Rate | % of Volume | Trend | |--------|-----------|-------------|-------| | Chase | 94% | 22% | โ†‘ | | Bank of America | 91% | 15% | โ†’ | | Wells Fargo | 89% | 12% | โ†“ | | ... | ... | ... | ... | **Action triggers:** - Single issuer drops 5%+ โ†’ investigate specific decline codes - Overall auth drops 2%+ โ†’ check for system issues - New decline code pattern โ†’ research and adapt ### Processor Performance Comparison If you're running more than one processor, compare them head to head: | Metric | Processor A | Processor B | Delta | |--------|-------------|-------------|-------| | Auth rate | 92.1% | 90.3% | +1.8% | | Average latency | 245ms | 312ms | -67ms | | 3DS success | 87% | 82% | +5% | | Decline code clarity | High | Medium | N/A | ### Weekly Auth Optimization Review 1. **Pull auth rate by day** โ†’ spot anomalies 2. **Review top 5 decline codes** โ†’ identify new patterns 3. **Check retry recovery rate** โ†’ validate retry logic 4. **Compare issuer performance** โ†’ flag outliers 5. **Track token migration progress** โ†’ measure modernization ### Scale Callout | Volume | Analytics Focus | |--------|-----------------| | **Under $50K/mo** | Track auth rate monthly. That's enough. | | **$50K-$250K/mo** | Track auth rate + decline code breakdown monthly. Watch for "do not honor" spikes. | | **$250K-$1M/mo** | Add issuer-level performance tracking. Some issuers decline you more than others. | | **Over $1M/mo** | Full issuer analysis, retry logic optimization, network token evaluation. Real-time monitoring. A/B test auth strategies. | ## Next Steps **Setting up basic monitoring?** 1. [Track authorization rate](#authorization-metrics) - 85-95% benchmark 2. [Monitor settlement metrics](#settlement-metrics) - Reconciliation rate 3. [Calculate effective rate](#cost-metrics) - Total fees / volume **Optimizing auth performance?** 1. [Measure token vs PAN](#token-vs-non-token-performance) - 2-5% lift expected 2. [Track 3DS impact](#3ds-impact-measurement) - Challenge and conversion rates 3. [Analyze issuer-level performance](#issuer-level-performance) - Top 10 issuers **Building weekly review process?** 1. [Follow optimization review](#weekly-auth-optimization-review) - 5-step process 2. [Compare processors](#processor-performance-comparison) - If multi-processor 3. [Scale appropriately](#scale-callout) - By volume tier --- :::info[Other Metrics Pages] Payments is just one piece of what you should be watching. See also: [Fraud Metrics](/docs/fraud/metrics) ยท [Chargeback Metrics](/docs/chargebacks/metrics) ยท [Compliance Metrics](/docs/compliance/metrics) ยท [Operations Metrics](/docs/operations/metrics) ::: ## Related Topics - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Decline Codes](/docs/reference/decline-codes) - Understanding decline reasons - [3D Secure](/docs/fraud/prevention/3ds) - Authentication impact on auth rates - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Retry and dunning metrics - [Chargeback Metrics](/docs/chargebacks/metrics) - Related dispute measurement - [Fraud Metrics](/docs/fraud/metrics) - Related fraud measurement - [Settlement & Reconciliation](/docs/payments/settlement) - Post-capture metrics - [Processor Management](/docs/operations/processor-management) - Comparing processor performance - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold monitoring - [Buying Payments](/docs/payments/buying-payments) - Cost metrics - [Reading Statements](/docs/operations/reading-statements) - Fee analysis - [Operations Metrics](/docs/operations/metrics) - Operational KPIs --- ## Payment Ecosystem Source: https://paymentsandrisk.com/docs/payments/payment-ecosystem # Payment Ecosystem :::info[TL;DR] - Every card transaction involves four parties: cardholder, issuing bank, card network, and acquiring bank (your processor) - each takes a cut - Interchange is paid by your acquirer to the issuer on every transaction; it's the largest component of your processing fees and is set by the card networks, not your processor - Your processor (Stripe, Square, Adyen) is your acquiring bank or a third-party agent sitting in front of one - when you call support, you're calling the processor, not Visa - The four-party model explains why you can't negotiate interchange directly and why different card types cost different amounts to accept ::: Before you can optimize payments, you need to know who's taking a cut and why. The payment industry has a lot of players with confusing titles. This page maps the territory. ## The Four-Party Model Every card transaction involves four parties (plus the networks that connect them): ```mermaid flowchart LR subgraph Left["Buyer Side"] CH[Cardholder๐Ÿ‘ค Customer] IS[Issuer๐Ÿฆ Their Bank] end subgraph Middle["Networks"] N[Card NetworksVisa, MC, Amex] end subgraph Right["Seller Side"] M[Merchant๐Ÿช You] AC[Acquirer๐Ÿฆ Your Bank] end CH |Uses card| IS IS |Routes through| N N |Routes to| AC AC |Provides account| M style CH fill:#3b82f6,color:#fff style M fill:#22c55e,color:#fff ``` ### The Four Parties | Party | What They Do | Examples | |-------|--------------|----------| | **Cardholder** | The customer paying with a card | You, your customers | | **Issuer** | Bank that issues the card and extends credit/debit | Chase, Capital One, your local bank | | **Acquirer** | Bank that provides your merchant account | Wells Fargo Merchant Services, Elavon | | **Merchant** | Business accepting the payment | You | ### The Networks Card networks (Visa, Mastercard, Discover, Amex) connect issuers and acquirers. They: - Set the rules for transactions - Route authorization requests - Facilitate settlement between banks - Set interchange rates **Amex and Discover are different:** They're both network AND issuer for most of their cards. This is the "three-party model" (they play two roles). --- ## Where All the Other Players Fit The four-party model is clean, but real life is messy. Here's where the other players fit: ```mermaid flowchart TD subgraph Merchant["Your Stack"] M[Your Business] G[Gateway] P[Processor] PF[PayFac] end subgraph Acquiring["Acquiring Side"] ISO[ISO] AC[Acquirer] end subgraph Networks["Networks"] N[Visa / Mastercard] end subgraph Issuing["Issuing Side"] IS[Issuer] CH[Cardholder] end M --> G G --> P P --> PF PF --> ISO ISO --> AC AC --> N N --> IS IS --> CH style M fill:#22c55e,color:#fff style AC fill:#3b82f6,color:#fff ``` ### Processor **What they do:** Route transactions between you and the acquiring bank. **Key points:** - Connects to card networks on acquirer's behalf - Provides the technology layer (APIs, SDKs, dashboards) - May or may not be the same company as your acquirer **Examples:** First Data (Fiserv), TSYS (Global Payments), Worldpay, Adyen ### Gateway **What they do:** Securely transmit payment data from your website/app to the processor. **Key points:** - Handles the technical integration (JavaScript libraries, APIs) - Encrypts and tokenizes card data - Often bundled with processing (Stripe, Square) - Sometimes separate (Authorize.net with separate processor) **Examples:** Stripe (bundled), Authorize.net, Braintree, NMI ### ISO (Independent Sales Organization) **What they do:** Resell processing services from acquirers/processors. **Key points:** - Sales and support layer - May mark up pricing - Wide variation in quality and pricing - Your contract is often with the ISO, not the acquirer directly **Examples:** Many local payment companies, "merchant services" providers ### PayFac (Payment Facilitator) **What they do:** Let you start processing quickly by putting you under their merchant account. **Key points:** - You're a "sub-merchant" under their master account - Fast onboarding (often same-day) - Higher rates, less negotiation - They handle compliance, you get simplicity - If they terminate you, you may land on [MATCH](/docs/chargebacks/match-tmf) **Examples:** Stripe, Square, PayPal, Shopify Payments --- ## The Key Distinction: PayFac vs. Direct Processor | Factor | PayFac | Direct Processor | |--------|--------|------------------| | **Onboarding** | Minutes to hours | Days to weeks | | **Your merchant ID** | Sub-merchant under theirs | Your own MID | | **Pricing** | Fixed (2.9% + $0.30 typical) | Negotiable | | **Contract** | Month-to-month typical | 1-3 year terms | | **Support** | Self-service / chat | Dedicated rep (maybe) | | **Compliance burden** | Lower (they handle much) | Higher (you handle more) | | **Termination risk** | Higher (faster decisions) | Lower (more process) | | **Best for** | Startups, small businesses | Mid-market, high volume | **The tradeoff:** Simplicity vs. control and cost. --- ## How Money Flows ### Authorization Flow (Real-time) When a customer swipes/taps/enters their card: ```mermaid sequenceDiagram participant C as Customer participant M as Merchant participant G as Gateway participant P as Processor participant N as Network participant I as Issuer C->>M: Pays with card M->>G: Send card data G->>P: Authorization request P->>N: Route to network N->>I: Check funds/fraud I->>N: Approve/decline N->>P: Response P->>G: Response G->>M: Response M->>C: Approved! ``` **Time:** 1-3 seconds total ### Settlement Flow (Daily) After transactions are captured: ```mermaid sequenceDiagram participant M as Merchant participant AC as Acquirer participant N as Network participant I as Issuer M->>AC: Batch of transactions AC->>N: Submit for settlement N->>I: Collect from issuers I->>N: Funds + interchange N->>AC: Net funds AC->>M: Deposit (minus fees) ``` **Time:** 1-3 business days typically --- ## Fee Flow Everyone takes a cut. Here's who gets what: ```mermaid pie title Where a 75 dollar online order goes on flat-rate pricing "Interchange (Issuer)" : 47 "Network (Visa/MC)" : 5 "Processor" : 48 ``` On a flat rate, your processor keeps about as much as the issuer does. That surprises people. The arithmetic, at 2.9% + 30c: a $75 order costs you $2.48, of which interchange is $1.17, network assessments about $0.13, and the processor pockets the remaining $1.18. [Where those inputs come from](/docs/payments/reference/cost-model-assumptions). ### Fee Breakdown | Fee Type | Goes To | Typical Cost | |----------|---------|---------------| | **Interchange** | Issuer | About 0.9% in person, 1.4% online blended. 0.05% + $0.21 to 3.15% + $0.10 by card type | | **Assessment** | Network | Not published. Assumed 0.14% + $0.02 | | **Acquirer/Processor markup** | Your processor | 0.2-1.0%+ | Interchange rates are from Visa's US schedule of 18 April 2026 and Mastercard's of 17 April 2026, both verified 2 August 2026. The blend weights them by Federal Reserve transaction counts. ### Why This Matters 1. **Interchange is the biggest cost you don't control**, and the networks set it. You can't negotiate it directly, but you can qualify for lower tiers (see [Interchange Optimization](/docs/payments/interchange-optimization)). On a flat rate your processor's cut is roughly the same size, and that part you can negotiate. 2. **Processor markup is negotiable** for higher volume. If you're paying 2.9% + $0.30 and doing $1M+/year, you can probably do better. 3. **Bundled pricing hides the breakdown.** Flat-rate pricing (2.9% + $0.30) is simple but doesn't let you see where money goes. --- ## Understanding Your Stack ### Who Am I Actually Working With? Many merchants don't know who their acquirer is. Here's how to figure it out: | Clue | What It Tells You | |------|-------------------| | **Who signed your contract?** | Might be ISO, PayFac, or processor | | **Who deposits your money?** | Usually the processor or acquirer | | **Who handles disputes?** | Processor or acquirer | | **What's on your statement?** | May show acquirer name | ### Common Stack Configurations | Configuration | Example | Who's Involved | |---------------|---------|----------------| | **PayFac (all-in-one)** | Stripe | You โ†’ Stripe (PayFac + Processor + Gateway) โ†’ Wells Fargo (Acquirer) | | **Traditional** | Restaurant with Elavon | You โ†’ POS system โ†’ Elavon (Acquirer + Processor) | | **Split** | Enterprise e-commerce | You โ†’ Custom Gateway โ†’ Processor โ†’ Bank acquirer | | **ISO layer** | Local payment provider | You โ†’ ISO (reseller) โ†’ Processor โ†’ Acquirer | --- ## Why This Matters for You ### For Negotiations Knowing the layers helps you negotiate: - Can you go direct to the processor instead of through an ISO? - Are you paying PayFac simplicity fees when you've outgrown them? - Is your interchange actually what you're being charged? ### For Troubleshooting When things break, knowing who does what helps: - Transaction declined? Issuer's decision. - Settlement delayed? Processor or acquirer issue. - Dispute? Processor routes it, network rules apply. ### For Compliance Different players have different requirements: - PCI compliance flows up the chain - Network rules apply to everyone - PayFacs handle some compliance for you ### For Risk Understanding relationships affects your risk: - PayFac termination = potentially [MATCH listed](/docs/chargebacks/match-tmf) - Direct processor = more control, more responsibility - ISO in between = another layer that can change or fail --- ## Glossary Cheat Sheet | Term | Meaning | |------|---------| | **Acquirer** | Bank that provides your merchant account and settles funds | | **Issuer** | Bank that issued the customer's card | | **Processor** | Company that routes transactions between you and acquirer | | **Gateway** | Technology that transmits payment data to processor | | **ISO** | Reseller of processing services | | **PayFac** | Payment facilitator (you're under their merchant account) | | **Network** | Visa, Mastercard, Amex, Discover | | **Interchange** | Fee paid to issuer on each transaction | | **Assessment** | Fee paid to network on each transaction | | **MID** | Merchant ID (your account number with acquirer) | --- ## Test to Run **Map your payment stack:** 1. Who provides your gateway? (The JavaScript/API you integrate with) 2. Who is your processor? (Who shows up in your dashboard) 3. Who is your acquirer? (Who actually holds your merchant account) 4. Are you on a PayFac or direct? (Check if you have your own MID) If you can't answer these, ask your account rep or check your contract. --- ## Scale Callout | Volume | Where to Focus | |--------|----------------| | **Under $100k/mo** | PayFac is fine. Don't over-optimize. | | **$100k-$500k/mo** | Consider direct processing. Run the numbers on IC+ pricing. | | **$500k-$2M/mo** | Definitely evaluate direct. Negotiate rates. Consider multiple processors. | | **Over $2M/mo** | Optimize everything. Multi-processor. Dedicated support. Custom pricing. | --- ## Where This Breaks 1. **PayFac termination.** If your PayFac terminates you for chargebacks or fraud, you may be MATCH listed and have trouble finding a new processor. 2. **ISO instability.** ISOs come and go. If your ISO goes out of business, your processing may be interrupted. 3. **Acquirer compliance.** If your acquirer decides your business is too risky, they can hold funds or terminate you, even if you're technically compliant. --- ## Next Steps **Just starting out?** 1. Pick a PayFac โ†’ [Buying Payments](/docs/payments/buying-payments) 2. Understand your fees โ†’ [Reading Your Statement](/docs/operations/reading-statements) 3. Learn the basics โ†’ [Authorization & Capture](/docs/payments/auth-and-capture) **Scaling up?** 1. Evaluate direct processing โ†’ [Processor Comparison](/docs/payments/processor-comparison) 2. Negotiate rates โ†’ See [Buying Payments](/docs/payments/buying-payments) 3. Optimize interchange โ†’ [Interchange Optimization](/docs/payments/interchange-optimization) **Troubleshooting?** 1. Map your stack โ†’ Use the questions above 2. Know who to call โ†’ Different issues go to different parties 3. Understand the layers โ†’ Each has their own rules and timelines --- ## See Also - [Card Networks](/docs/reference/card-networks) - Visa, Mastercard, Amex, Discover rules and programs - [Buying Payments](/docs/payments/buying-payments) - Choosing a processor - [Gateway Basics](/docs/payments/reference/gateway-basics) - What gateways do - [Provider Types](/docs/payments/reference/provider-types) - Gateway vs ISO vs PayFac vs MoR - [Authorization & Capture](/docs/payments/auth-and-capture) - Transaction mechanics - [Settlement & Reconciliation](/docs/payments/settlement) - Money movement - [Interchange Optimization](/docs/payments/interchange-optimization) - Reducing fees - [Processor Comparison](/docs/payments/processor-comparison) - Comparing options - [Reading Your Statement](/docs/operations/reading-statements) - Understanding fees - [Processor Management](/docs/operations/processor-management) - Working with processors - [MATCH / TMF List](/docs/chargebacks/match-tmf) - What happens if you're terminated --- ## Alternative Payment Methods Source: https://paymentsandrisk.com/docs/payments/payment-methods/alternative-methods # Alternative Payment Methods :::info[TL;DR] - **BNPL** (Klarna, Affirm): 2-8% merchant fee, but 20-40% conversion lift; provider absorbs credit risk - **Wires**: $25-40 flat, same-day, irrevocable - use for large B2B only; watch for BEC fraud - **Local APMs**: Essential in many markets (PIX in Brazil, UPI in India, OXXO in Mexico, M-Pesa in Africa) - **Crypto via PSP**: 1-2% fees, no chargebacks but PSP can still freeze/claw back for sanctions/AML - **Vouchers/eCash** (Paysafecard, Boleto, Konbini): Very low chargebacks, high friction, good for unbanked markets ::: Beyond cards, wallets, and bank transfers, there's a rich ecosystem of alternative payment methods. Each is essential in specific contexts, regions, or customer segments. --- ## Buy Now, Pay Later (BNPL) BNPL has gone from niche to mainstream. Klarna, Affirm, Afterpay and PayPal Pay Later are all at checkout across major retailers now. It isn't an experiment any more. ### How BNPL Works The classic "Pay in 4" model: 1. Customer selects BNPL at checkout 2. BNPL provider runs soft credit check (usually no hard pull) 3. If approved, customer pays 25% now 4. BNPL provider pays merchant full amount (minus fees) immediately 5. Customer pays remaining 75% in three bi-weekly installments 6. If customer misses payments, BNPL provider bears the loss **Key point for merchants**: you get paid in full upfront. The credit risk isn't yours, it's the BNPL provider's. ### BNPL Economics BNPL providers make money from: 1. **Merchant fees**: 2-8% of transaction value (yes, higher than credit cards) 2. **Late fees**: Charged to customers who miss payments 3. **Interest**: On longer-term financing products (not classic Pay in 4) **Why do merchants pay more than credit card fees?** The math works because BNPL increases: - **Conversion**: Customers who can't or won't pay full price upfront convert - **Average order value**: Studies show 20-87% increase in AOV - **Cart completion**: Lower abandonment rates A 2024 study by Frankfurt University found merchants increased sales by 20% when offering BNPL compared to PayPal. If your margins can absorb a 5% fee and you're getting 20% more sales, the economics work. If they can't, they don't. ### The BNPL Risk Profile From the fraud perspective, BNPL is interesting. **Fraud rates are lower than credit cards** because: - BNPL providers verify identity at signup - Multiple payments make fraud less attractive (fraudster would need to make ongoing payments) - Newer systems with modern fraud detection **But BNPL creates different risks:** - **First-party / friendly fraud** (customer never intends to pay): Unlike card chargebacks, BNPL friendly fraud is just the customer stopping payment. The provider eats that loss, but if your rate runs high they'll approve fewer of your customers. - Return abuse (buy with BNPL, return for refund, stop payments) - Debt stacking (customer uses multiple BNPL providers simultaneously) ### BNPL Regulation BNPL regulation remains in flux. In May 2024, the CFPB classified certain BNPL lenders as "card issuers" under Regulation Z, but that interpretive rule was revoked in April 2025. BNPL providers aren't currently subject to uniform Reg Z obligations, though some follow similar standards voluntarily. Each one has its own dispute and refund policy. Don't assume they match, and read the one you're signing. BNPL providers are also now beginning to report to credit bureaus, which will affect: - Customer credit scores (for better or worse) - Debt visibility across lenders - Underwriting decisions ### When to Offer BNPL **BNPL makes sense when:** - Your average order value is $50-$1,000 (sweet spot) - Your margins can absorb 4-6% fees - Your customer demographic skews younger (Gen Z and Millennials are primary users) - You sell discretionary goods (fashion, electronics, home goods) - You have return policies that work with BNPL **BNPL is less compelling for:** - Very low-ticket items (fees eat the margin) - Very high-ticket items (longer financing terms change economics) - Subscriptions (BNPL isn't designed for recurring) - B2B (different financing needs) If your average order is under $50, skip it. The fee eats a margin that small tickets don't have, and you're below the sweet spot anyway. --- ## Wire Transfers Wires are the oldest electronic payment method and remain essential for large, time-sensitive transactions. ### How Wires Work **Domestic wires** (Fedwire): - Real-time gross settlement (each transaction settles individually) - Final and irrevocable - Same-day settlement during Fed operating hours - Typical cost: $25-40 to send, $15-25 to receive **International wires** (SWIFT): - Message network connecting banks globally - Settlement through correspondent banking relationships - 1-5 business days depending on route - Typical cost: $35-50 plus intermediary fees plus FX spread ### When to Use Wires **Wires make sense for:** - Large transactions ($10,000+) where the flat fee is justified - Time-sensitive payments that can't wait for ACH - International payments to countries without better alternatives - Real estate closings (often required) - Same-day certainty (irrevocable, confirmed) **Wires are overkill for:** - Small transactions (fee makes no sense) - Recurring payments (ACH is cheaper and automated) - Situations where you need recall ability Below $10,000 domestically, use ACH. The flat fee isn't justified at that size, and a wire gives up any ability to recall the money. ### Wire Fraud Wire fraud is one of the most damaging fraud types because wires are irrevocable. Common schemes: **Business email compromise**: a fraudster impersonates an executive or a vendor. They send you new wire instructions. By the time you notice, the money's gone. **Real estate wire fraud**: Fraudster monitors real estate transactions, sends fake closing instructions to buyers. Massive losses. **Vendor impersonation**: Fraudster sends "updated banking information" posing as legitimate vendor. **Always verify wire instructions through a number you already have** (not the one in the email). Call your contact directly. It's the only check that works. --- ## International Payment Methods If you sell internationally, cards aren't always the dominant payment method. ### Regional Preferences | Region | Dominant Methods | |--------|------------------| | US/Canada | Cards, ACH | | UK | Cards, Open Banking, Direct Debit | | EU (Euro) | Cards, SEPA, iDEAL (NL), Bancontact (BE) | | Germany | Cards, SEPA, PayPal | | Brazil | PIX, Boleto, Cards | | China | Alipay, WeChat Pay, UnionPay | | India | UPI, Cards | | Japan | Cards, Konbini (convenience store), JCB | ### Key Alternative Methods **SEPA (Single Euro Payments Area)**: European equivalent of ACH. Covers Euro-denominated payments across 36 countries. SEPA Instant Credit Transfer settles in seconds. **iDEAL (Netherlands)**: Bank-based payment method used by ~60% of Dutch online shoppers. Customer authenticates with their bank; payment is guaranteed. **PIX (Brazil)**: Brazil's instant payment system, launched 2020. Free for individuals, very low cost for merchants. Now processes more transactions than card and cash combined in Brazil. **Alipay/WeChat Pay (China)**: The dominant mobile payment methods in China. If you want Chinese tourists or cross-border Chinese customers, you're not getting them without these. **UPI (India)**: Unified Payments Interface. Mobile-based instant payment system. Processes 20+ billion transactions monthly. Near-zero merchant discount rate for many categories (government-subsidized to drive adoption). ### Mobile Money In Africa and parts of Asia, mobile money is often more important than cards or bank transfers. **M-Pesa (Kenya, Tanzania, other African markets)**: - Mobile wallet linked to phone number, not bank account - Used for everything: retail, bills, person-to-person, even salaries - Over 50 million active users - Critical for reaching unbanked populations **MTN MoMo, Airtel Money, Orange Money**: - Competing mobile money services across Africa - Similar model: phone-based wallet, agent network for cash-in/cash-out **GCash, GrabPay (Southeast Asia)**: - Mobile wallets with broad merchant acceptance - Often integrated with ride-hailing and e-commerce super-apps **Why mobile money matters**: in many emerging markets, phones outnumber bank accounts. If you're selling into Sub-Saharan Africa, mobile money acceptance may matter more than card acceptance. Build that first. ### Carrier Billing Charge purchases directly to phone bills. Niche but important for specific verticals. **How it works**: Customer's purchase is added to their mobile phone bill. Carrier collects payment and remits to merchant (minus significant fees). **Common use cases**: - Digital content (games, apps, streaming) - Subscriptions - Charitable donations - Adult content **Economics**: carrier billing fees are high, often 15-30%+. Conversion is excellent anyway, because there's no card entry. One click, authenticated by the carrier. At that rate it only works where the alternative is no sale at all. **Fraud/compliance**: carriers impose strict content rules and they watch refund rates. If your content is questionable you'll get cut off, and that's not a slow process. **Fraud profile:** - SIM swap (fraudster takes over phone number, authorizes charges) - Social engineering (tricking customer into authorizing) - Very different from card fraud patterns ### eCash and Voucher Methods Cash-like methods where the customer pays at a physical location and you receive guaranteed funds. If you're selling into cash-heavy markets or to unbanked customers, they matter. **How voucher/eCash methods work:** 1. Customer selects voucher payment at online checkout 2. System generates a payment code/barcode 3. Customer takes code to physical location (convenience store, bank branch, etc.) 4. Customer pays cash 5. Merchant receives confirmation and guaranteed funds ### Major Voucher Methods **Boleto Bancรกrio (Brazil)**: - Bank slip that can be paid at banks, ATMs, lottery outlets, or online banking - Very common for Brazilian e-commerce (alongside PIX and cards) - Settlement: 1-3 business days after payment - No chargebacks (cash payment) - Challenge: Non-payment rate can be high (customer generates boleto but never pays) **OXXO (Mexico)**: - Payment at OXXO convenience stores (20,000+ locations) - Customer receives voucher code, pays cash at store - Settlement: 1-2 business days - Critical for Mexican customers without cards or who prefer cash - Challenge: Cart abandonment between voucher generation and store payment **Konbini (Japan)**: - Payment at convenience stores (7-Eleven, Lawson, FamilyMart, etc.) - Customer receives payment slip or barcode - Very common for Japanese e-commerce - Settlement: 1-2 business days **Paysafecard (Europe, global)**: - Prepaid voucher sold at retail locations - Customer buys voucher with cash, enters 16-digit PIN online - Popular in gaming, gambling, digital content - Very low chargebacks (cash purchase) - Challenge: AML concerns, often associated with high-risk verticals ### Voucher Economics and Risk **Economics:** - Fees: Typically 2-5% depending on method and volume - No interchange (not card-based) - Settlement: Usually 1-3 business days after customer payment **Fraud profile:** - Very low chargebacks (customer paid cash) - Main risk is non-payment/abandonment (voucher generated but never paid) - Some voucher methods are attractive for money laundering (cash-based, anonymous) - AML scrutiny can be significant for certain methods (Paysafecard) **Conversion impact:** - Essential in cash-heavy markets (significant portion of population unbanked or underbanked) - High friction (customer must leave checkout, go to store, pay, wait for confirmation) - Completion rates lower than instant payment methods **When to use voucher methods:** - Selling into cash-heavy markets (Brazil, Mexico, Japan, parts of Europe) - Gaming and digital content (where Paysafecard is expected) - Customer segment is unbanked or prefers cash - Worth the settlement delay and abandonment rate for access to customer segment Outside those cases, skip vouchers. You pay for the integration and then eat the abandonment. ### Expanded Local APM Reference **Brazil:** - PIX: Real-time, near-zero cost, dominant and growing - Boleto: Cash voucher, still significant but declining relative to PIX - Cards: Important but lower penetration than US/EU **Mexico:** - OXXO: Cash voucher at convenience stores, essential for unbanked - SPEI: Bank transfer system (same-day/instant depending on bank) - Cards: Growing but still lower penetration **Southeast Asia:** - GrabPay (regional): Integrated with Grab super-app, strong in Singapore, Malaysia, Philippines - GoPay (Indonesia): Integrated with Gojek super-app - ShopeePay: E-commerce platform wallet - PromptPay (Thailand): Real-time payment system - DuitNow (Malaysia): Real-time payment system **Japan:** - Konbini: Convenience store payment - JCB: Domestic card network - PayPay: Mobile wallet (dominant) - Rakuten Pay: E-commerce integrated wallet **Africa:** - M-Pesa: Dominant in East Africa (Kenya, Tanzania) - MTN MoMo: West and Central Africa - Airtel Money: Pan-African - Orange Money: Francophone Africa - Chipper Cash, Flutterwave, Paystack: Aggregators/PSPs for African payments **Key insight**: in a lot of markets, no local method means no market. A Brazilian without PIX or Boleto doesn't buy. Neither does a Mexican without OXXO or an Indonesian without GoPay. ### Cross-Border Considerations When accepting international payments: **Currency**: should customers pay in their currency or yours? Local currency converts better. But then you carry the FX risk, or you pay someone to carry it. Take the conversion lift and price the FX in. **Payment methods**: local methods move conversion a lot in many markets. Dutch customers expect iDEAL, German customers expect SOFORT, and they won't hunt for an alternative. **Interchange**: Cross-border card transactions have higher interchange than domestic. **Fraud**: International card-not-present transactions have higher fraud rates. Apply stricter controls. **Settlement**: you get paid in foreign currencies, then convert and settle to your domestic account. That adds complexity and cost. --- ## Cryptocurrency and Stablecoins Crypto payments are still niche for mainstream commerce, and there are legitimate use cases. There are three distinct approaches. They don't carry the same risk or the same operational load. Don't treat them as one thing. ### Subtype 1: Native Crypto to Your Own Wallet (BTC, ETH, etc.) Customer sends cryptocurrency directly to your wallet address. You hold the crypto. **How it works:** 1. You generate a wallet address and display it (or QR code) at checkout 2. Customer sends crypto from their wallet 3. Transaction confirms on blockchain (seconds to minutes depending on network) 4. You now hold crypto in your wallet 5. You decide when/whether to convert to fiat **Risks:** - **Volatility**: You bear price risk from moment of receipt until conversion. BTC can move 5-10% in hours. - **Custody**: You're responsible for securing private keys. Exchange hacks, key loss, and theft are real. - **Tax complexity**: Each transaction is a taxable event. Accounting burden is significant. - **Conversion friction**: You need exchange account, liquidity, potential slippage on large amounts. **Disputes:** - No chargebacks (blockchain transactions are irreversible) - But customers still complain. Support load doesn't disappear just because you can't reverse the payment. - Regulatory complaints are possible even without chargeback mechanism **When it makes sense**: you're crypto-native. Or you have a treasury strategy for holding crypto. Or a real use for it, like paying crypto-denominated suppliers. ### Subtype 2: Stablecoins (USDC, USDT, etc.) Stablecoins are crypto tokens pegged to fiat currencies, usually USD. You're receiving a crypto asset, just one that's meant to hold its value. **How it works:** - Same as native crypto, but USDC/USDT maintain ~$1.00 value - Settlement on various chains (Ethereum, Solana, Tron, etc.) with different fees and speeds - You can hold stablecoins or convert to fiat **Risks:** - **Peg stability**: stablecoins can de-peg. USDT and USDC have had brief ones, and smaller stablecoins haven't always come back. - **Regulatory risk**: USDC (Circle) is regulated; USDT (Tether) has ongoing questions about reserves. Regulatory action could affect value. - **Chain/network risk**: Blockchain congestion, network outages, or protocol failures can delay settlement. - **Conversion still required**: Unless you pay suppliers in stablecoins, you eventually convert to fiat with associated costs. **Disputes:** - Same as native crypto: no chargebacks, but customer complaints don't disappear - Refund policy questions: Refund in stablecoin? At what rate? In fiat? **When it makes sense**: cross-border B2B, where traditional wires are expensive and slow. Markets with currency instability. Crypto-adjacent businesses. ### Subtype 3: Crypto via PSP with Instant Fiat Conversion (BitPay, Coinbase Commerce, etc.) Customer pays in crypto; you receive fiat. The PSP handles conversion instantly. **How it works:** 1. Customer selects crypto payment 2. PSP generates payment request (amount in crypto based on current exchange rate) 3. Customer sends crypto to PSP 4. PSP converts to fiat immediately 5. You receive fiat settlement (minus fees) **Major providers**: BitPay, Coinbase Commerce, PayPal (in some markets) **Economics:** - Fees: Typically 1-2% (competitive with cards) - FX spread: PSP takes a margin on the conversion. You don't see this directly, but it's built into the rate. - Settlement: Usually next business day to your bank account **Risks (even with instant conversion):** - **FX spread/margin**: there's a hidden cost in the conversion rate. It's 0.5-1% on top of the stated fees. - **AML/sanctions/chain-origin risk**: Even if the PSP is a licensed Money Services Business (MSB), you've still got brand and compliance exposure if funds come from sanctioned addresses. PSPs run chain analytics, but it isn't clean: you'll get false positives and false negatives. - **Compromised wallet risk**: If a customer's wallet was hacked and used to pay you, you may face legal pressure or complaints even without chargebacks. - **Refund complexity**: someone wants a refund. Do you pay it in fiat? At what rate? In the original crypto, at the original coin amount or the original fiat value? You'll want that written down before it happens. - **Regulatory uncertainty**: Crypto regulations are evolving. PSP licensing, reporting requirements, and merchant obligations vary by jurisdiction. **Disputes:** - No network chargebacks - But customers dispute through other channels: complaints to regulators, BBB, social media, legal threats - You lose the chargeback mechanism but gain support/complaint load - **PSP clawback/freeze risk**: Even with instant fiat conversion, your PSP can freeze or reverse settlements under their terms (e.g., sanctions hits discovered after the fact, law enforcement requests, upstream exchange flags). "No chargebacks" doesn't mean "no reversals under any circumstance." Read your PSP agreement carefully. ### When Crypto Actually Makes Sense for Merchants โœ… **Good fit:** - Crypto-native businesses (Web3, NFT, gaming, DeFi) - Cross-border B2B where wires and FX are painful - Markets with currency controls or instability - Customer base that actively wants to pay in crypto โŒ **Marginal ROI:** - Standard retail e-commerce - SaaS/subscription businesses - Domestic US commerce For most "normal" retail and SaaS, crypto is optional and usually low ROI versus complexity. The customer segment that insists on paying in crypto is small, and adding crypto doesn't meaningfully increase your addressable market. Skip it. Focus on cards, wallets, and local payment methods first. --- ## Request to Pay Request to Pay (RtP) is a messaging layer on top of real-time payment rails. Instead of sending money, you send a request. The recipient reviews it and approves it, and then the money moves. It's a pull, not a push. **Use cases**: - Bill presentment (utility sends request, customer approves and pays) - Invoice payment (B2B invoicing with one-click payment) - Service payments (gig worker requests payment upon completion) Both RTP and FedNow support Request for Payment functionality. --- ## Next Steps **Evaluating BNPL?** 1. [BNPL Economics](/docs/payments/reference/bnpl-economics) - Deep dive on costs and ROI 2. [Checkout Conversion](/docs/payments/checkout-conversion) - Measure conversion impact 3. [Choosing Methods](./choosing-methods.md) - Decision framework by use case **Adding local payment methods?** 1. [International Payments](./international.md) - Cross-border considerations 2. [Going Global](/docs/payments/going-global) - Market-by-market recommendations 3. [Digital Wallets](./digital-wallets.md) - Regional wallets like Alipay, UPI **Managing APM-specific fraud?** 1. [Fraud Prevention](/docs/fraud/prevention) - Method-specific fraud controls 2. [AML Basics](/docs/compliance/aml-basics) - Compliance for vouchers and crypto 3. [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Risk assessment by method ## See Also - [Cheat Sheet](./cheat-sheet.md) - Quick reference tables - [Digital Wallets](./digital-wallets.md) - PayPal, Alipay, and wallet-based APMs - [Choosing Methods](./choosing-methods.md) - When to add which APM - [Real-Time Payments](./real-time-payments.md) - RTP, FedNow, instant payments - [Bank Transfers](./bank-transfers.md) - ACH and direct debit methods - [Going Global](/docs/payments/going-global) - International market entry - [Checkout Conversion](/docs/payments/checkout-conversion) - Conversion optimization - [Fraud Prevention](/docs/fraud/prevention) - Managing APM fraud - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Method-specific risk - [AML Basics](/docs/compliance/aml-basics) - APM compliance considerations - [Promo Abuse](/docs/fraud/types/promo-abuse) - BNPL abuse patterns --- ## Bank Transfers & ACH Source: https://paymentsandrisk.com/docs/payments/payment-methods/bank-transfers # Bank Transfers & ACH :::info[TL;DR] - **ACH** costs $0.20-$1.00 per transaction, settles T+1-2 (Same Day ACH available) - **ACH returns** are the "chargeback equivalent" - 60 days for unauthorized (R10/R29) - **Same Day ACH** limit: $1M per transaction (as of 2024) - **SEPA Direct Debit** (EU) has 8-week no-questions-asked refund right for consumers - **Checks** still exist in US B2B; convert to ACH via Check 21 / Remote Deposit Capture ::: ACH is the backbone of American [payments](/docs/payments/payment-ecosystem). Direct deposit of your paycheck? ACH. Utility bill auto-pay? ACH. Rent payment? Probably ACH. In 2024, the ACH Network processed 33.6 billion payments valued at $86.2 trillion. That's "trillion" with a T. --- ## How ACH Works ACH is batch-based. Cards authorize in real time; ACH doesn't. Transactions get collected through the day and processed in batches. ### The Players - **Originator**: The entity initiating the payment (could be sender or receiver) - **ODFI**: Originating Depository Financial Institution (the originator's bank) - **ACH Operator**: The Fed or The Clearing House, which routes the transaction - **RDFI**: Receiving Depository Financial Institution (the receiver's bank) - **Receiver**: The entity receiving the payment ### ACH Credits vs Debits **ACH Credit** (Push): You send money to someone else. Examples: payroll, vendor payments, tax refunds. You initiate; money flows from your account to theirs. **ACH Debit** (Pull): you authorize someone to take money from your account. Utility bills, subscription payments, rent. They initiate it, and it's your account the money leaves. This distinction matters for fraud. ACH debits require authorization from the account holder. If you process unauthorized debits, you're exposed to returns and potential NACHA violations. --- ## ACH Timing Traditional ACH settles in 1-2 business days. Same Day ACH, introduced in 2016, settles the same business day if you're in before the cutoff. ### Same Day ACH Settlement Windows (All Times Eastern) - Window 1: Submission by 10:30am, settlement at 1:00pm - Window 2: Submission by 2:45pm, settlement at 5:00pm - Window 3: Submission by 4:45pm, settlement at 6:00pm ### Same Day ACH Limits - Current limit: $1 million per transaction (as of March 2022) - Proposed increase: Nacha is considering raising to $10 million - No limit on aggregate batch size ### Why ACH Is Slower Than Cards Cards use real-time authorization and batch settlement. ACH batches both. The ODFI collects transactions and sends them to the operator, the operator sorts and distributes to RDFIs, and the RDFIs post to accounts. That's why it isn't instant. --- ## ACH Costs ACH is dramatically cheaper than cards. | Transaction Type | Typical Cost | |------------------|--------------| | ACH Credit | $0.20-$0.50 per transaction | | ACH Debit | $0.20-$1.00 per transaction | | Same Day ACH | Additional $0.10-$0.50 premium | Compare that to credit cards at 2.5-3.5%. On a $1,000 B2B payment that's $0.50 via ACH against $25+ on a card. --- ## ACH Returns ACH transactions can be returned for various reasons. Common return codes: | Code | Meaning | Implication | |------|---------|-------------| | R01 | Insufficient Funds | Most common. Retry or contact customer. | | R02 | Account Closed | Find alternate payment method. | | R03 | No Account/Unable to Locate | Bad account number. Verify with customer. | | R10 | Customer Advises Unauthorized | Potential fraud. Investigation required. | | R29 | Corporate Customer Advises Not Authorized | B2B equivalent of R10. Serious. | ### Return Timeframes - Most returns: 2 business days - Unauthorized returns (R10, R29): Up to 60 calendar days That extended return window is the ACH version of a chargeback. Process an unauthorized debit and the customer's got 60 days to come back at you. :::warning[Reconcile ACH Against Your Bank Statement] ACH debits and credits don't always appear on your bank statement with clear descriptions. Processor-initiated ACH deposits may show as a lump sum, while individual ACH debits you originate may post separately. If you accept ACH payments and also originate ACH debits (vendor payments, refunds), reconcile both directions weekly. Mismatches between your processor's ACH report and your bank statement are common - especially when returns (R01, R10) reverse transactions days later. See [Reconciliation](/docs/payments/settlement/reconciliation) for a step-by-step process and [ACH Operations](/docs/operations/ach-operations) for return handling. ::: :::warning[ACH Reconciliation Is Harder Than Cards] ACH transactions don't include the same metadata as card payments. Bank reference numbers change between origination and settlement, making automated matching difficult. If you're processing significant ACH volume: - Use unique invoice/reference numbers in the addenda field - Reconcile ACH credits and debits separately - Build a 60-day buffer for potential returns (R10 unauthorized can arrive up to 60 days later) - Consider a reconciliation tool like [A2X](/docs/payments/settlement/reconciliation) or [Synder](/docs/payments/settlement/reconciliation) if you're also reconciling e-commerce payments See [ACH Operations](/docs/operations/ach-operations) for the full operational playbook and [ACH Return Codes](/docs/reference/return-codes/ach) for decoding failed transactions. ::: --- ## When to Use ACH ### ACH Is Ideal For - Recurring payments (subscriptions, memberships, rent) - B2B payments (vendor invoices, supplier payments) - Large-value transactions where card fees would be prohibitive - Payroll and disbursements ### ACH Is Less Ideal For - Point-of-sale retail (too slow) - E-commerce where instant confirmation matters - Customers who don't want to share bank account info - International payments (ACH is US domestic only - see [PAD for Canada](#canada-pad-and-interac-e-transfer) and [SEPA for EU](#sepa-direct-debit-sdd-european-union)) --- ## ACH Fraud Considerations ACH fraud looks different from card fraud. **Account takeover**: Fraudster gains access to legitimate account credentials and initiates unauthorized debits or redirects credits. **Business email compromise**: a fraudster impersonates a vendor or an executive and gives you a new bank account. You send the ACH credit and it's gone. **Unauthorized debits**: Fraudster originates debits without valid authorization. When caught, transactions return as R10/R29. From an issuer perspective, we see ACH fraud clusters differently than card fraud. It's often targeted at specific companies rather than broad attacks. A fraudster might compromise one payroll system and redirect hundreds of direct deposits. --- ### ACH Fraud Typologies Understanding how ACH fraud manifests helps you build better defenses. | Fraud Type | How It Works | Detection Signals | |------------|--------------|-------------------| | **Account Takeover (ATO)** | Fraudster gains legitimate credentials | Unusual login location, device change, sudden payout changes | | **New Account Fraud** | Fraudster opens account with stolen/fake identity | Velocity of account creation, identity mismatch signals | | **Business Email Compromise** | Impersonate vendor, change bank details | Recent bank info change, email domain spoofing, urgency | | **Authorized Push Payment (APP)** | Trick customer into sending money | Customer-initiated, irreversible once sent | | **First-Party Fraud** | Customer disputes legitimate transaction | History of disputes, pattern matching | | **Synthetic Identity** | Fraudster creates blended fake identity | Identity elements don't fully match | | **Payroll Redirect** | Redirect direct deposit to fraudster account | Direct deposit change + immediate withdrawal | #### ACH Fraud Prevention Checklist | Control | Purpose | |---------|---------| | **Verify bank account ownership** | Confirm account belongs to intended recipient | | **Implement dual approval for payout changes** | Prevent single-point-of-failure BEC attacks | | **Monitor for velocity anomalies** | Detect unusual transaction patterns | | **Use positive pay / debit blocks** | Authorize specific debits in advance | | **Validate payee before large transfers** | Call verified number, not email-provided number | | **Delay first payout to new accounts** | Allow time for fraudulent accounts to be identified | --- ### ACH Balance Validation Before initiating an ACH debit, verify the account has sufficient funds to prevent R01 (Insufficient Funds) returns. #### Balance Validation Methods | Method | Coverage | Timing | Cost | |--------|----------|--------|------| | **Real-time balance check** | ~85-90% of US accounts | Instant | $0.10-0.50/check | | **Plaid balance** | Good for consumer accounts | Real-time | Varies | | **MX balance** | Financial institutions | Real-time | Varies | | **Aggregator APIs** | Multi-source | Real-time | Varies | #### When to Validate | Scenario | Validation Strategy | |----------|---------------------| | **First debit from new account** | Always validate | | **Amount exceeds typical threshold** | Always validate | | **Previous R01 on this account** | Always validate | | **Recurring debit, established account** | Sample or skip | | **Low-value transactions** | Cost may not justify | #### Balance Check Caveats | Caveat | Why It Matters | |--------|----------------| | **Balance is a snapshot** | Can change between check and debit | | **Not all accounts covered** | Some banks don't support real-time balance | | **False security** | Balance check doesn't prevent R10 (unauthorized) | | **Privacy concerns** | Some customers uncomfortable sharing bank access | #### Best Practice ``` New customer + first ACH debit: 1. Verify account ownership (micro-deposits or instant verification) 2. Check real-time balance 3. If balance >= amount + buffer, proceed 4. If balance = debit amount + 10-20%. Accounts fluctuate, so a $100 debit shouldn't go out against less than ~$110-120. --- ## Non-US Bank Transfer Systems ACH is a US system. Other countries have their own bank transfer and direct debit mechanisms. ### Canada: PAD and Interac e-Transfer Canada uses two main bank transfer systems: **Pre-Authorized Debit (PAD):** Canada's equivalent of ACH debit. Used for recurring payments (rent, subscriptions, loan payments). Governed by Payments Canada (not Nacha). | Aspect | US ACH | Canadian PAD | |--------|--------|--------------| | Governing body | Nacha | Payments Canada | | Settlement | T+1-2 (Same Day available) | T+1-2 | | Return window (unauthorized) | 60 days | 90 days (personal), 10 days (business) | | Consumer protection | Regulation E | Payments Canada Rule H1 + provincial laws | | Authorization | Written/electronic | Written/electronic/online | **Key difference for merchants:** PAD returns for unauthorized transactions have a **90-day window** for personal accounts (vs 60 days for US ACH). Business PAD returns are limited to 10 business days. **Interac e-Transfer:** Canada's primary bank-to-bank transfer system, widely used for P2P payments, invoice payments, and business transfers. Settlement is near-instant. Unlike Zelle (US equivalent), Interac e-Transfer is universally supported by all major Canadian banks and is the standard way Canadians send money between accounts. This is the closest Canadian equivalent to ACH for most business and personal transfers. **Interac Debit:** Canada's domestic debit network for in-store POS transactions. When Canadians pay with a bank debit card at a terminal, the transaction typically routes through Interac at flat per-transaction fees ($0.05-0.10). See [Card Payments](/docs/payments/payment-methods/cards#canadian-debit-interac) for details on pricing differences. ### SEPA Direct Debit (SDD): European Union - Covers Euro-denominated debits across 36 countries - Two schemes: Core (consumer) and B2B (business) - Key quirk: **8-week no-questions-asked refund right** for Core SDD - Mandate-based (customer signs authorization) - Settlement typically D+1 ### UK Direct Debit - Dominant for subscriptions, utilities, and recurring payments - Protected by Direct Debit Guarantee (bank refunds customer, sorts out with merchant later) - Very high consumer trust - Mandate managed through Bacs system ### BECS Direct Debit (Australia/New Zealand) - Similar model to ACH debits - Requires valid Direct Debit Request (DDR) - 7-day return window for most transactions ### Why This Matters If you're a global subscription business, you need different direct debit integrations for different regions. SEPA DD for EU, UK DD for Britain, ACH for US, BECS for ANZ. The concepts are similar (pull funds with mandate) but the rails, rules, and dispute windows differ. --- ## Legacy Methods: Checks and Cash Yes, these still exist. Understanding them provides useful context. ### Cash - Zero chargebacks, zero processing fees - Instant "settlement" (you have the money) - But: theft risk, handling costs, armored car fees, employee shrinkage - Declining but still ~20% of in-person US transactions - Some businesses (cannabis, some service industries) are cash-heavy due to banking restrictions ### Checks - Still significant in US B2B (legacy accounting systems, vendor preferences) - Risk: NSF (insufficient funds), check kiting, fraud - Often converted to ACH at point of deposit (Check 21, Remote Deposit Capture) - Settlement: 1-2 days for check clearing, but funds may be held longer - Declining rapidly but not dead ### Why Mention These? Cash and checks are the baseline when you're pricing payment methods. A 2.5% card fee sounds high until you count cash handling (1-2% for many retailers) or check fraud losses. --- ## Next Steps **New to ACH payments?** 1. [Cheat Sheet](./cheat-sheet.md) - Quick reference for cost and timing 2. [Real-Time Payments](./real-time-payments.md) - Compare with instant payment alternatives 3. [Choosing Methods](./choosing-methods.md) - When to use ACH vs. cards **Implementing ACH?** 1. [Identity Verification](/docs/fraud/detection/identity-verification) - Verify account ownership 2. [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Set up recurring ACH billing 3. [Processor Management](/docs/operations/processor-management) - Select ACH providers **Managing ACH fraud and returns?** 1. [ACH Return Codes](/docs/reference/return-codes/ach) - Handle returns by code type 2. [Account Takeover](/docs/fraud/types/account-takeover) - Prevent ATO-driven ACH fraud 3. [ACH Operations](/docs/operations/ach-operations) - Operational best practices ## See Also - [Cheat Sheet](./cheat-sheet.md) - Quick reference tables - [Real-Time Payments](./real-time-payments.md) - Faster alternatives to ACH - [ACH Return Codes](/docs/reference/return-codes/ach) - Full return code reference - [Regulation E](/docs/compliance/consumer-protection/reg-e) - Consumer protections for EFT - [Account Takeover](/docs/fraud/types/account-takeover) - ATO fraud patterns - [Synthetic Identity](/docs/fraud/types/synthetic-identity) - Fabricated identities - [Identity Verification](/docs/fraud/detection/identity-verification) - Verifying account ownership - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring ACH billing - [Settlement & Reconciliation](/docs/payments/settlement) - How settlement works - [AML Basics](/docs/compliance/aml-basics) - Anti-money laundering - [Processor Management](/docs/operations/processor-management) - Working with ACH providers - [ACH Operations](/docs/operations/ach-operations) - Operational details --- ## Card Payments Source: https://paymentsandrisk.com/docs/payments/payment-methods/cards # Card Payments :::info[TL;DR] - **Credit cards** cost 2.5-3.5% (interchange + assessments + processor markup) - **Debit cards** are cheaper: regulated banks capped at 0.05% + $0.21 (Durbin Amendment) - **Prepaid** is low risk for merchants (funds pre-loaded) but high compliance burden for issuers - **Friendly fraud** (legitimate cardholder disputes valid purchase) is [the majority of chargebacks](/docs/fraud/types/friendly-fraud) for most merchants - Submit **Level 2 data** on commercial cards and interchange drops **0.75 points**, from 2.65% to 1.90%. Both networks publish it ::: Card payments are still the dominant method in the US, moving trillions of dollars a year. But "cards" isn't one product. It's several, and the economics are not the same. --- ## Credit Cards Pay with credit and the [issuing bank](/docs/payments/payment-ecosystem) is lending the money. You get paid now. The cardholder pays the bank later, and that's the bank's risk, not yours. **How the money flows:** 1. Cardholder swipes/taps/enters card 2. Authorization request goes: Merchant โ†’ Processor โ†’ Network โ†’ Issuer 3. Issuer approves and places hold on credit line 4. At settlement, issuer funds the transaction to the network 5. Network settles with acquirer, minus fees 6. Acquirer deposits to merchant account ### Why Credit Cards Are Expensive The issuer is taking real risk. They pay you today, and they might not collect from the cardholder for 30-60 days. Or ever, if the cardholder defaults. Interchange compensates for: - Credit risk (cardholders might not pay) - Fraud risk (the transaction might be disputed) - Float (the issuer fronts the money) - Rewards funding (those 2% cash back points come from somewhere) *Note: numbers below are representative US values as of 2024-2025. They will change. Always consult current network rate tables for precise pricing.* ### Typical Credit Card Interchange | Card Type | Card-Present | Card-Not-Present | |-----------|--------------|------------------| | Consumer credit, no rewards | 1.51% + $0.10 | 1.89% + $0.10 | | Standard rewards | 1.65% + $0.10 | 2.05% + $0.10 | | Premium rewards (Signature Preferred) | 2.10% + $0.10 | 2.50% + $0.10 | | Top consumer tier (Visa Infinite, MC World Elite) | 2.30% + $0.10 | 2.60% + $0.10 | | Commercial / business | 2.26% + $0.10 | 2.79% + $0.10 | | Non-qualified (failed qualification) | 3.15% + $0.10 | 3.15% + $0.10 | _Visa USA Interchange Reimbursement Fees, effective 18 April 2026. Cross-checked against Mastercard 2026-2027 U.S. Region Interchange Programs and Rates, effective 17 April 2026. Commercial is a blend of Business Product 2 and Commercial Card Present. Corporate and purchasing cards run to 3.00% + $0.10. Both verified 2 August 2026._ The two networks agree at the bounds. Top consumer tier on both is 2.30% + $0.10 in person, 2.60% + $0.10 online. Non-qualified is 3.15% + $0.10 on both. Neither schedule contains a 3.5% rate anywhere. On top of interchange you pay network assessments, which neither network publishes. This site estimates them at 0.14% + $0.02 and labels that unverified. See [how we model processing cost](/docs/payments/reference/cost-model-assumptions) for the full build-up and the card mix behind it. These are single card types, not a blend. **Blended across a real card mix, your rate is much lower than any rewards-credit row above.** Debit is the majority of transactions by count, and it drags the average down hard. Most merchants who overestimate interchange take a rewards-credit rate as their average. It's usually off by a lot. **What the markup actually is, where it's published.** Most processors bundle interchange into one flat rate and never show you the split. Two publish the markup in full, which makes them the yardstick for any quote: | Processor | Published markup over interchange | Monthly | Source, verified 2026-08-02 | |---|---|---|---| | [Helcim](https://www.helcim.com/pricing/) | +0.40% + 8c in person, +0.50% + 25c online at the entry band, falling to +0.15% at $1M-5M/month | $0 | helcim.com/pricing | | [Stax](https://staxpayments.com/pricing/) | **0%** markup, 8c in person and 15c online | $99-$199+, set by **annual** volume | staxpayments.com/pricing | | [Adyen](https://www.adyen.com/pricing) | Not published. Interchange++ plus a $0.13 processing fee, indicative card markup 0.60% | No monthly fee, but an unquantified "minimum invoice" | adyen.com/pricing | Flat-rate processors publish the all-in number instead. Square is 2.6% + 15c in person on the Free plan, 3.3% + 30c online. Braintree is 2.89% + $0.29 online. PayPal Checkout is 3.49% + $0.49. Which model is cheaper depends on the cards your customers actually use, not on how much you're doing. See [the card-mix test](/docs/payments/processor-comparison#the-card-mix-test-not-the-volume-test). Stax is the one to watch on that math. A 0% markup sounds unbeatable. But the $99-$199+ monthly fee is fixed, and the markup you'd pay at Helcim scales with your volume. Small merchants pay the fee and never earn it back. Both charge 8c in person, so the real comparison is Helcim's +0.40% against Stax's monthly fee. Run it at your volume, and only take Stax if the markup wins. ### Card-Not-Present Fraud and Friendly Fraud CNP transactions (online, phone, mail order) run significantly higher fraud rates than card-present. But not all "fraud" is stolen credentials: - **Third-party fraud**: Stolen card numbers used without cardholder knowledge (the classic fraud scenario) - **Friendly fraud / first-party misuse**: Cardholder makes a legitimate purchase, then disputes it claiming "I didn't make this purchase" or "I didn't receive it." This is a major component of card chargebacks, especially in digital goods, subscriptions, and services where there's no physical delivery proof. For most e-commerce merchants, [friendly fraud](/docs/fraud/types/friendly-fraud) is the majority of chargebacks. It isn't always intentional, and "buyer's remorse" or "forgot I signed up" are real. But the economics hit you the same way. Stop sorting disputes by intent. Sort them by cause. --- ## Debit Cards Debit is fundamentally different from credit. The money comes directly from the cardholder's bank account. No loan, no credit risk. ### Two Flavors of Debit **PIN Debit**: Customer enters PIN. Transaction routes over debit networks (STAR, NYCE, Pulse, etc.). Generally lowest cost. **Signature Debit**: Customer signs (or doesn't, for small transactions). Routes over Visa/Mastercard networks. Slightly higher cost than PIN, but still cheaper than credit. ### The Durbin Amendment Effect Banks over $10 billion in assets have their debit interchange capped by federal regulation: - Regulated rate: 0.05% + $0.21 (plus up to $0.01 for fraud prevention) For smaller banks, debit rates are unregulated and higher: - Exempt rate: Typically 0.80% + $0.15 for signature debit That creates a quirk: a debit card from a small credit union costs you more than one from Chase or Bank of America. It isn't intuitive, and there's nothing you can do about it. ### Why Debit Is Cheaper - No credit risk (money is already in the account) - Lower fraud rates (PIN verification, real-time account access) - Lower dispute rates (harder to claim "I didn't authorize this" when your PIN was used) - No rewards to fund (most debit cards don't offer significant rewards) ### Canadian Debit: Interac {/* #canadian-debit-interac */} Canadian debit cards process through the **Interac** network in store, with Visa Debit and Mastercard Debit cards alongside them. Those can route through either Interac or the card network. Credit cards are still the most popular method in Canada overall, same as the US. **Why Interac matters for Canadian merchants:** | Factor | US Debit | Canadian Interac Debit | |--------|---------|----------------------| | **Network** | Visa/Mastercard debit (with PIN networks like STAR, Pulse) | Interac | | **Pricing** | Percentage-based (regulated: 0.05% + $0.21) | Flat fee per transaction, set by your processor | | **Cost on a $100 sale** | $0.26 (regulated) to $0.95 (unregulated) | CA$0.09 in person on [Helcim](https://www.helcim.com/pricing/), CA$0.12 for tap. CA$0.12 in person on [Moneris](https://www.moneris.com/en/pricing), but **CA$1.00 card-not-present** | | **Regulation** | Durbin Amendment (banks over $10B) | Voluntary Interac fee schedule | | **Contactless** | Visa/MC contactless | Interac Flash (tap) | Interac pricing verified against Helcim's and Moneris's own pricing pages on 2026-08-02. For a Canadian merchant with real in-person debit volume, this isn't close. Interac's flat fee is about 9 to 12 Canadian cents, against CA$2.75 on a $100 credit sale at Moneris's published 2.65% + $0.10. Put the debit prompt first at the terminal and let customers take it. **Online is a different story.** Moneris publishes Interac Debit card-not-present at **CA$1.00 per transaction**. That's more than eight times its in-person fee. On a CA$25 online order it's 4% before anything else. Got a low average online ticket? Check what your processor charges for online Interac specifically. The in-person number tells you nothing about it. On a small enough online ticket, a percentage credit rate can land cheaper than a flat CA$1.00, so run both against your own average order value. Many Canadian debit cards also carry Visa Debit or Mastercard Debit branding. Online, those transactions often route through Visa/MC networks rather than Interac. **Interac e-Transfer** is Canada's dominant bank-to-bank transfer system. It handles P2P payments, invoice payments, and business transfers. It's what ACH is in the US, but with near-instant settlement. See [Bank Transfers](/docs/payments/payment-methods/bank-transfers#canada-pad-and-interac-e-transfer) for details. Processors with strong Canadian support: [Moneris](/docs/payments/processors/moneris), [Helcim](/docs/payments/processors/helcim), [Square](/docs/payments/processors/square) (Canada), [Stripe](/docs/payments/processors/stripe) (Canada). Helcim publishes Interac and EFT-PAD pricing openly. One Canadian fee is worth knowing before you sign: Moneris charges CA$25 per chargeback. Then a separate CA$80 "Authorization Chargeback Handling" fee ([source](https://www.moneris.com/en/pricing), verified 2026-08-02). That's unusual, and it doesn't appear on any other processor checked. Get it struck or discounted in writing before you sign, not after your first dispute. --- ## Prepaid Cards Prepaid cards are funded in advance. No credit line, no bank account required. But "prepaid" covers several products with very different risk profiles. ### Types of Prepaid **Closed-loop gift cards** (Starbucks, retailer gift cards) only work at the issuing merchant. There's no network dispute, so your policy decides. Breakage (unused balances that expire or go forgotten) is real margin. **Open-loop general purpose reloadable (GPR)**: Visa/Mastercard branded, works anywhere. Functions like a debit card. Network disputes exist, but chargeback rates run lower than credit cards. **Payroll and government disbursement cards**: used for direct deposit. The recipients are unbanked or underbanked. Low fraud and chargebacks, but heavy compliance requirements for issuers. **Corporate prepaid/expense cards**: Used for employee expenses, travel. Similar to commercial cards but prefunded. ### Risk by Perspective (This Is Important) Prepaid risk looks completely different depending on where you sit: **For merchants:** - Chargeback rates are typically *lower* than credit cards (often lower than debit too) - "I didn't authorize this" disputes are rare once funds are loaded and spent - Fraud tends to concentrate at load and cash-out points, not retail spend - **Bottom line**: Prepaid is usually lower risk for merchants than credit **For issuers/program managers:** - High risk across three types: [fake identities](/docs/fraud/types/synthetic-identity) and fake KYC, plus mule accounts, which are [second party](/docs/reference/fraud-classification) rather than first - Exposure on load channels (card-to-card loads, ACH loads that return) - Higher operational burden: KYC verification, ongoing monitoring - **Bottom line**: Prepaid programs require significant fraud and compliance infrastructure **For AML/compliance teams:** - Open-loop GPR is a regulatory focus area - Easy to buy with cash, can be layered and moved between accounts - Historically used in money-mule chains and smurfing patterns - Heavy KYC, load limits, and transaction monitoring requirements - **Bottom line**: High AML/CTF scrutiny regardless of actual fraud rates ### The Merchant Takeaway If you see prepaid transactions, don't automatically treat them as high-risk. On chargebacks they're often safer than credit cards. The fraud concerns around prepaid are real, but they're mostly issuer-side and compliance-side problems, not yours. Your risk goes up in one place: cash-out verticals like crypto, gambling, remittance, and peer-to-peer marketplaces, where prepaid might be part of a money movement scheme. Everywhere else, blocking prepaid BINs costs you good customers and buys you nothing. --- ## Commercial Cards Business, corporate, and purchasing cards have their own interchange categories, which usually run higher than consumer cards. **Why higher?** - Larger average transaction sizes - Often card-not-present (phone/online orders) - Additional features (expense reporting, spending controls) - Different fraud patterns ### The Level 2/3 Data Opportunity If you process real B2B volume, submit enhanced transaction data. It cuts interchange. The [Settlement guide](/docs/payments/settlement) has the full write-up. Short version: | Data Level | Additional Fields | Potential Savings | |------------|-------------------|-------------------| | Level 1 (Standard) | Basic transaction info | Baseline | | Level 2 | Tax amount, customer code, merchant tax ID | 0.75 points, small business credit | | Level 3 | Line-item detail, freight, duty | 0.80-0.95 points, corporate and purchasing cards only | Take a business doing $500K/year in B2B transactions. Proper Level 2/3 data submission could save $2,500-$4,000 annually. If you sell to businesses at all, this is the first thing to fix. --- ## Network Differences Visa and Mastercard are four-party networks: cardholder, issuer, acquirer, merchant. They don't issue cards. They operate the rails. American Express and Discover are three-party networks. They issue their own cards and they run the network. That's more control for them and, historically, higher fees for you. ### Practical Differences | Network | US Market Share | Typical Interchange | Notes | |---------|-----------------|---------------------|-------| | Visa | ~53% | Varies by category | Largest network, most complex rate structure | | Mastercard | ~26% | Varies by category | Very similar to Visa | | American Express | ~10% | 2.0-3.5% | Higher rates, but the OptBlue program offers lower rates for small merchants | | Discover | ~3% | Similar to Visa/MC | Often slightly lower than comparable Visa/MC rates | ### Should You Accept Amex? Yes. The old advice was "Amex is too expensive," and it's outdated for most merchants. Amex's OptBlue program covers merchants under $1M in Amex volume. Its rates compete with premium Visa/MC cards. The customers who carry Amex tend to spend more. Refusing Amex usually costs more in lost sales than it saves in fees. **There is no single published OptBlue rate.** OptBlue is sold through acquirers. Each one sets its own rate inside Amex's wholesale structure. Your rate depends on who signs you up, not on Amex. So ask your acquirer for the OptBlue rate in writing, and get the Visa and Mastercard rates the same way. Compare all three on one statement. Flat-rate processors usually fold Amex into their headline Visa/Mastercard rate. Confirm that rather than assume it. --- ## Next Steps **Understanding card costs?** 1. [Review credit vs debit economics](#credit-cards) - Why credit costs more 2. [Learn the Durbin effect](#the-durbin-amendment-effect) - Regulated vs exempt debit 3. [Check Level 2/3 opportunity](#the-level-23-data-opportunity) - B2B savings **Optimizing card acceptance?** 1. [Evaluate Amex acceptance](#should-you-accept-amex) - OptBlue may be worth it 2. [Consider payment method routing](/docs/payments/payment-methods/cheat-sheet) - Lower-cost options for B2B 3. [Review auth optimization](/docs/payments/auth-optimization) - Improve approval rates **Understanding card risk?** 1. [Know prepaid risk by perspective](#risk-by-perspective-this-is-important) - Merchant vs issuer view 2. [Understand friendly fraud](#card-not-present-fraud-and-friendly-fraud) - the majority of chargebacks 3. [Review chargeback prevention](/docs/chargebacks/prevention) - Reduce disputes --- ## See Also - [Cheat Sheet](./cheat-sheet.md) - Quick reference tables - [Bank Transfers & ACH](./bank-transfers.md) - Lower-cost alternatives for B2B - [Digital Wallets](./digital-wallets.md) - Apple Pay, Google Pay - [Settlement & Reconciliation](/docs/payments/settlement) - How card fees flow - [Interchange](/docs/payments/reference/interchange) - Detailed interchange rates - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and liability shift - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party dispute abuse - [Third-Party Fraud](/docs/fraud/types/third-party) - Stolen card fraud - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes - [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Card-present security - [Debit Routing](/docs/payments/reference/debit-routing) - PIN vs signature debit --- ## Payment Methods Cheat Sheet Source: https://paymentsandrisk.com/docs/payments/payment-methods/cheat-sheet # Payment Methods Cheat Sheet :::info[TL;DR] - Cards are the most expensive method and have the highest acceptance rate. All-in on a flat rate you'll pay 2.5-3.5%. Underneath that, consumer credit interchange is 1.51-2.30% + $0.10 card-present and regulated debit is 0.05% + $0.21, which is why a debit-heavy card-present merchant does far better on interchange-plus - ACH ($0.20-$1.00) wins on cost for B2B and high-ticket recurring billing; the tradeoff is 2-5 day settlement and return risk instead of real-time authorization - Apple Pay and Google Pay have lower fraud and higher auth rates than raw card entry - they cost the same as a card transaction but perform better - International payment methods matter when a region exceeds 10% of volume; below that threshold, card acceptance covers most cross-border transactions ::: Use this page when you need the answer in 30 seconds, not 30 minutes. --- ## Cost Comparison | Method | Per-Transaction Cost | Notes | |--------|---------------------|-------| | Credit Card | 2.5-3.5% all-in on a flat rate | Interchange underneath is 1.51-2.30% + $0.10 card-present, 1.89-2.60% + $0.10 online | | Debit (US Regulated) | 0.05% + $0.21-$0.22 interchange | Durbin-regulated banks (over $10B assets). Identical on Visa and Mastercard | | Debit (US Exempt) | 0.7-0.8% + $0.15 interchange | Small bank cards | | Debit (Canadian Interac) | ~$0.05-$0.10 flat | Per-transaction, not percentage-based | | Debit (EU) | Capped at 0.20% | EU Interchange Fee Regulation | | ACH | $0.20-$1.00 | Plus potential return fees | | Same Day ACH | $0.30-$1.50 | Premium over standard ACH | | RTP/FedNow | $0.01-$0.50 | Varies by volume | | Push-to-Card | 0.5-1.5% | Visa Direct / Mastercard Send | | Wire | $25-$40 flat | Plus receiving fees | | BNPL | 2-8% | Varies by provider and volume | | PayPal | 2.99-3.49% + $0.49 | Varies by product | | Open Banking (UK/EU) | 0.1-0.5% | Much cheaper than cards | | Mobile Money | 1-3% | Varies by market | | Carrier Billing | 15-30% | High fees, high conversion | | eCash/Vouchers | 2-5% | Boleto, OXXO, Paysafecard | The card rows mix two measurements, and the Notes column says which is which. **Interchange** is the network's wholesale cost before your processor marks it up. An **all-in** rate is what actually leaves your account. Card interchange comes from Visa's US schedule of 18 April 2026 and Mastercard's of 17 April 2026. Blended across a normal mix it's about 0.89% + $0.158 in person and 1.36% + $0.152 online, and [the derivation is published](/docs/payments/reference/cost-model-assumptions). --- ## Settlement Timing | Method | Authorization | Settlement | Funding | |--------|---------------|------------|---------| | Credit Card | Real-time | T+1-2 | T+2-3 | | Debit Card | Real-time | T+1 | T+1-2 | | ACH | Batch | T+1-2 | T+1-2 | | Same Day ACH | Batch (intraday) | Same day | Same day | | RTP/FedNow | Real-time | Instant | Instant | | Wire | Real-time | Same day | Same day | | Push-to-Card | Real-time | Minutes | Minutes | | BNPL | Real-time | T+1-2 | T+1-2 | *T = Transaction date. All times are business days.* --- ## Push vs. Pull & Reversibility | Method | Push/Pull | Reversible? | Who Can Reverse | Reversal Window | |--------|-----------|-------------|-----------------|-----------------| | Credit Card | Pull | Yes | Cardholder/Issuer | 120 days | | Debit Card | Pull | Yes | Cardholder/Issuer (Reg E) | 60 days | | ACH Credit | Push | Limited | ODFI in special cases | 5 days (most) | | ACH Debit | Pull | Yes | RDFI/Customer | 60 days (unauthorized) | | RTP/FedNow | Push | No | Only voluntary refund | N/A | | Wire | Push | No | Only bank cooperation | N/A | | PIX/UPI/etc. | Push | Very limited | Scheme-specific | Varies | | SEPA Credit | Push | Limited | Very limited recall | 10 days | | SEPA Direct Debit | Pull | Yes | Customer | 8 weeks (no questions) | **Key insight:** - **Pull methods** (cards, direct debit) = merchant at risk of reversal - **Push methods** (RTP, wire) = sender at risk, irrevocable --- ## Dispute/Chargeback Windows | Method | Dispute Window | Merchant Response Window | |--------|----------------|-------------------------| | Credit Card | 120 days from transaction | Varies (often 7-20 days) | | Debit Card | 60 days (Reg E) | Varies (often 7-20 days) | | ACH | 2 days (most) / 60 days (unauthorized) | Limited | | RTP/FedNow | None (irrevocable) | N/A | | Wire | None (irrevocable) | N/A | | BNPL | Provider-specific | Provider handles | | PayPal | 180 days | 10 days typically | | SEPA DD | 8 weeks (no questions) / 13 months (unauthorized) | N/A | --- ## Fraud & Risk Matrix (Simplified) | Method | Primary Fraud Pattern | Dispute Mechanism | Conversion Impact | |--------|----------------------|-------------------|-------------------| | Credit Card (CNP) | Stolen cards, friendly fraud | Network chargeback | Baseline | | Credit Card (CP) | Lost/stolen (reduced by EMV) | Network chargeback | Baseline | | Debit Card | ATO, lost/stolen | Chargeback + Reg E | Slightly lower | | Apple/Google Pay | Very low (tokenization + biometrics) | Card chargeback | 30-50% uplift on mobile | | PayPal | ATO, INR/SNAD claims | Wallet dispute (buyer-friendly) | 30-50% uplift | | ACH Debit | Unauthorized debits | R10/R29 returns | Lower (friction) | | RTP/FedNow | Social engineering, BEC | None | N/A (mostly payouts) | | Push-to-Card | ATO, misdirected payouts | None | N/A (payouts only) | | Wire | BEC, vendor impersonation | None | N/A (B2B only) | | BNPL | First-party "never pay" | Provider handles | 20-40% uplift | | Crypto via PSP | Compromised wallets, AML | None (complaints only) | Niche | | Mobile Money | SIM swap | Provider-specific | Essential in market | --- ## Quick Decision Tree ### US Consumer E-commerce ``` Cards + Apple Pay + Google Pay + PayPal โ†’ Add BNPL if AOV > $50 โ†’ Add Venmo/Cash App if young demographic ``` ### B2B / SaaS / Invoice ``` Cards + ACH โ†’ Add wires for > $50K โ†’ SEPA DD for EU recurring ``` ### Global Marketplace ``` Cards + PayPal + local APMs per market (PIX, UPI, iDEAL, OXXO, M-Pesa, etc.) โ†’ RTP or push-to-card for instant seller payouts ``` ### Payouts ``` ACH (cheap, 1-2 days) โ†’ Same Day ACH (same day) โ†’ RTP/FedNow (instant, needs bank enrollment) โ†’ Push-to-card (instant, any debit card, 0.5-1.5%) ``` --- ## Regional Payment Preferences | Region | Dominant Methods | |--------|------------------| | US/Canada | Cards, ACH | | UK | Cards, Open Banking, Direct Debit | | EU (Euro) | Cards, SEPA, iDEAL (NL), Bancontact (BE) | | Germany | Cards, SEPA, PayPal | | Brazil | PIX, Boleto, Cards | | Mexico | Cards, OXXO, SPEI | | China | Alipay, WeChat Pay, UnionPay | | India | UPI, Cards | | Japan | Cards, Konbini, PayPay, JCB | | Southeast Asia | GrabPay, GoPay, ShopeePay | | Africa | M-Pesa, MTN MoMo, Cards | --- ## Cross-Border Cost Factors | Factor | Typical Cost/Impact | |--------|---------------------| | FX conversion | 1-3% of transaction value | | Cross-border interchange | +0.5-1% vs domestic card rates | | Local entity setup | $5K-$50K+ per jurisdiction | | VAT/GST collection | 15-25% of revenue (remitted to government) | | Payment method localization | Dev time + ongoing maintenance per market | | Fund repatriation | Bank/wire fees + potential delays | For the full international picture, see [International Payments](./international.md). --- ## ACH Return Codes (Common) | Code | Meaning | Action | |------|---------|--------| | R01 | Insufficient Funds | Retry or contact customer | | R02 | Account Closed | Find alternate payment | | R03 | No Account/Unable to Locate | Verify account number | | R10 | Customer Advises Unauthorized | Investigate fraud | | R29 | Corporate Customer Not Authorized | Serious, investigate | --- ## Network Comparison | Network | US Market Share | Typical Interchange | Notes | |---------|-----------------|---------------------|-------| | Visa | ~53% | Varies by category | Largest, most complex rates | | Mastercard | ~26% | Varies by category | Very similar to Visa | | American Express | ~10% | 2.0-3.5% | OptBlue for small merchants | | Discover | ~3% | Similar to Visa/MC | Often slightly lower | --- ## Next Steps **New to payment methods?** 1. [Choosing Methods](./choosing-methods.md) - Decision framework for your business 2. [Card Payments](./cards.md) - Deep dive on credit, debit, and prepaid 3. [Payment Methods Overview](/docs/payments/payment-methods) - Full guide to all payment types **Implementing specific methods?** 1. [Digital Wallets](./digital-wallets.md) - Apple Pay, Google Pay, PayPal setup 2. [Bank Transfers & ACH](./bank-transfers.md) - ACH implementation details 3. [Alternative Methods](./alternative-methods.md) - BNPL and local APMs **Optimizing payments performance?** 1. [Checkout Conversion](/docs/payments/checkout-conversion) - Improve payment success rates 2. [Interchange Optimization](/docs/payments/interchange-optimization) - Reduce card fees 3. [Benchmarks](/docs/reference/benchmarks) - Industry performance targets ## See Also - [Card Payments](./cards.md) - Full details on credit, debit, prepaid - [Bank Transfers & ACH](./bank-transfers.md) - ACH, SEPA, returns - [Real-Time Payments](./real-time-payments.md) - RTP, FedNow, push-to-card - [Digital Wallets](./digital-wallets.md) - Apple Pay, PayPal, Open Banking - [Alternative Methods](./alternative-methods.md) - BNPL, wires, crypto, mobile money - [International Payments](./international.md) - Cross-border, FX, entities, regulations - [Choosing Methods](./choosing-methods.md) - Decision frameworks and recommendations - [Settlement & Reconciliation](/docs/payments/settlement) - How funds flow - [Interchange](/docs/payments/reference/interchange) - Card fee reference - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing payment success - [Fraud Prevention](/docs/fraud/prevention) - Method-specific fraud controls - [Benchmarks](/docs/reference/benchmarks) - Industry performance targets --- ## Choosing Payment Methods Source: https://paymentsandrisk.com/docs/payments/payment-methods/choosing-methods # Choosing Payment Methods :::info[TL;DR] - **US e-commerce baseline**: Cards + Apple/Google Pay + PayPal. Add BNPL if AOV >$50. - **B2B/SaaS**: Cards + ACH. Wires for $50K+. SEPA DD for EU recurring. - **Global**: Cards + major wallets + 1-2 local APMs per priority market. - **Payouts**: ACH (cheap, slow) vs RTP/FedNow (instant) vs push-to-card (instant to any debit card). - **Pay-ins and payouts have different fraud profiles.** Pay-in is chargebacks and friendly fraud. Payout is ATO and misdirected payments. ::: You're balancing four things: customer preference, cost, fraud exposure, and operational complexity. Here's how to decide. --- ## The Decision Framework ### 1. Customer Preference What do your customers want to use? Refuse it and you'll lose sales. Survey data and benchmarks help, but your own abandonment rates help more. ### 2. Economics Work out the true cost per method: - Direct fees (interchange, processing) - Fraud losses and chargebacks - Settlement timing, which is a cash flow cost - Operational overhead ### 3. Fraud Profile Every method has its own fraud profile. Your risk tolerance shapes what you accept, and so does what your tools can catch. ### 4. Integration Complexity Some methods take real engineering time, so weigh that cost against the expected benefit. ### 5. Settlement Needs Cash flow tight? Favor the faster-settling methods, or pay for accelerated settlement. ### 6. Pay-ins vs Payouts Think about pay-ins and payouts separately. Pay-ins are how customers pay you, and payouts are how you send money out. The best rails differ: **Pay-ins** (receiving money): - Cards + wallets + BNPL for consumer checkout - ACH / SEPA Direct Debit for recurring and B2B - Local APMs for international markets **Payouts** (sending money): - ACH for standard payouts, cheap and 1-2 days - RTP / FedNow for urgent or instant payouts - Push-to-card (Visa Direct / Mastercard Send) for instant-to-debit-card UX - Wires for large, urgent, or international **Different fraud profiles.** Pay-in fraud is stolen credentials and chargebacks, while payout fraud is ATO and misdirected payments. A marketplace needs strong controls on both sides. --- ## The Cannibalization Problem Adding payment methods doesn't automatically mean more sales. A lot of the adoption is existing customers switching, not new customers converting. ### Why This Matters You add BNPL and see 1,000 BNPL transactions in month one. That's not 1,000 new sales. It might be: - 300 genuinely new conversions, customers who wouldn't have bought - 700 existing customers who'd have paid with a card anyway BNPL costs you 5% and cards cost 2.5%. On those 700 transactions you've just paid an extra 2.5% for nothing. ### How to Measure Cannibalization **Before launching a new method:** - Baseline your conversion rate, AOV, and payment method mix - Track cart abandonment by stage **After launching:** - Compare total conversion rate, not just new method adoption - Watch for drops in other payment method usage - Calculate true incremental revenue: `New method revenue ร— (1 - cannibalization rate)` **Warning signs of pure cannibalization:** - Total conversion rate unchanged despite new method adoption - Card transaction count drops in step with new method growth - Same customers switching methods month over month ### Quick Example **Before BNPL launch:** - 10,000 orders/month - 95% cards, 5% PayPal - 2.8% blended payment cost **After BNPL launch:** - 10,200 orders/month, up 2% - 80% cards, 5% PayPal, 15% BNPL - 3.2% blended payment cost **The math:** - 200 incremental orders ร— $80 AOV = $16,000 new revenue - 1,500 orders switched to BNPL ร— $80 AOV ร— 2.5% cost increase = $3,000 extra cost - Net benefit: $16,000 - $3,000 = $13,000, assuming ~30% margin on new orders In this case, BNPL is worth it. But if you only got 50 incremental orders? The math flips negative. ### Hidden Costs of More Methods It doesn't have to cost more per transaction to cost you: **Reconciliation complexity** Each payment method you add is one more data source to reconcile. Five methods means five reconciliation streams, five sets of edge cases, five vendor relationships. **Subscription/recurring limitations** Methods don't all handle recurring equally: - Cards: excellent (card-on-file, account updater) - ACH: good (mandates persist) - PayPal: good (billing agreements) - BNPL: poor (built for one-time, not recurring) - Crypto: very poor (no recurring mechanism) Running a subscription business? A method that handles recurring badly means customers can't easily subscribe. Or you're handling payment method changes at every renewal. **Refund complexity** Refunds don't work the same way everywhere: - Cards: straightforward, same rails - ACH: ACH credit back, or a check if the account closed - BNPL: coordinate with the provider, unwind the installments - Crypto: which currency? At what rate? To which wallet? - Vouchers and cash methods: usually manual, or store credit **One-click / conversion optimization** You've tuned your card checkout for one-click. A new method that needs a redirect, a login, or verification may: - Cut overall conversion. More choices means more friction. - Train customers onto slower methods - Break A/B tests and conversion work already done ### When Cannibalization Is Acceptable Sometimes it's fine, and here's when. **Cost reduction** Customers switch from cards at 2.5% to ACH at 0.3%, and you've saved money with zero new sales. Calculate: `Transactions ร— cost difference = savings`. **Fraud reduction** High-fraud customers switch from raw card entry to Apple Pay, and your fraud losses drop. **Customer preference** Customers who strongly prefer a method you don't offer may still buy, but they won't be happy about it. Offering it lifts NPS even with no conversion lift. **Competitive necessity** Every competitor offers BNPL and you don't, so you may lose the customer entirely. The math is "cannibalize yourself or lose them." ### The Right Approach 1. **Don't add methods speculatively.** Have a hypothesis about who'll use it and why. 2. **Measure incrementality.** Track total conversion, not just new method adoption. 3. **Count the total cost.** Ops overhead, not just transaction fees. 4. **Sunset underperformers.** If a method adds complexity and no incrementality, it's gone. 5. **A/B test when you can.** Show the new method to a subset and compare total conversion. --- ## Payment Method Matrix | Method | Cost | Speed | Fraud Risk | Chargeback Risk | Best For | |--------|------|-------|------------|-----------------|----------| | Credit Card | High | T+2-3 | Medium-High | High | Retail, e-commerce | | Debit Card | Medium | T+1-2 | Lower | Medium | Retail, everyday purchases | | ACH | Low | T+1-2 | Different | Returns (60 days) | Recurring, B2B | | RTP/FedNow | Low | Instant | Emerging | None | Urgent disbursements | | Digital Wallets | Medium | T+2-3 | Lower | High (via card) | Mobile, e-commerce | | BNPL | High | T+1-2 | Lower | Provider handles | Fashion, discretionary | | Wire | Flat fee | Same day | High (social engineering) | None | Large B2B | --- ## Fraud, Risk, and Conversion Matrix | Method | Typical Cost | Fraud Pattern | Dispute Mechanism | Conversion Impact | |--------|--------------|---------------|-------------------|-------------------| | **Credit Card (CNP)** | 1.89-2.60% + $0.10 interchange | Stolen cards, synthetic ID, card testing | Network chargeback (120 days) | Baseline for e-commerce | | **Credit Card (CP)** | 1.51-2.30% + $0.10 interchange | Lost/stolen, counterfeit (reduced by EMV) | Network chargeback (120 days) | Baseline for retail | | **Debit Card** | 0.05% + $0.21 regulated, 0.70-0.80% + $0.15 exempt | ATO, lost/stolen | Network chargeback + Reg E (60 days) | Slightly lower than credit | | **Prepaid** | Similar to exempt debit | Low for merchants (mule risk in specific verticals) | Network chargeback available | Neutral to slightly lower | | **Card-Token Wallets** | Same as card (often CP rates) | Very low (tokenization + biometrics) | Standard card chargeback | Strong uplift on mobile | | **Online Account Wallets** | 3.49% + $0.49 | ATO at wallet level | Wallet provider dispute (buyer-friendly) | Strong (saved credentials) | | **P2P Wallets** | 2.75-3.49% | ATO, social engineering | Complex (wallet + underlying funding) | Strong with young US demos | | **ACH Debit** | $0.20-1.00 | Unauthorized debits, ATO | ACH returns (R10/R29), 60 days | Lower (bank login friction) | | **ACH Credit** | $0.20-1.00 | BEC, misdirected payments | Very limited (push payment) | N/A (push, not checkout) | | **Pay by Bank (US)** | 0.5-1.5% | ATO, social engineering | ACH returns (if ACH-based) | Lower (friction), improving | | **Open Banking (UK/EU)** | 0.1-0.5% | ATO (mitigated by SCA) | Very limited (push) | Lower than cards, improving | | **RTP/FedNow** | $0.01-0.05 | Social engineering, BEC | None (irrevocable) | N/A (mostly disbursements) | | **Push-to-Card** | 0.5-1.5% | ATO, misdirected payouts | None (irrevocable) | N/A (payouts only) | | **Wire** | $25-40 flat | BEC, vendor impersonation | None (irrevocable) | N/A (B2B only) | | **BNPL** | 2-8% | First-party "never pay," return abuse | Provider handles | Strong uplift | | **Crypto via PSP** | 1-2% | Compromised wallets, AML exposure | None (complaints only) | Niche | | **Mobile Money** | 1-3% | SIM swap, social engineering | Provider-specific | Essential in market | | **Carrier Billing** | 15-30% | SIM swap, unauthorized charges | Carrier dispute process | Excellent for digital content | | **eCash/Vouchers** | 2-5% | Low (cash payment) | None/merchant policy | Lower (must pay at store) | | **SEPA Direct Debit** | โ‚ฌ0.20-0.50 | Unauthorized mandates | 8-week no-questions refund | Good for EU recurring | Don't read straight down that cost column. The card rows are **interchange**, the network's cost before your processor's markup. The wallet, BNPL and carrier rows are the provider's **all-in merchant rate**, markup included. They aren't the same measurement. Card interchange comes from Visa's US schedule of 18 April 2026 and Mastercard's of 17 April 2026. Blended across a normal card mix, that's about 0.89% + $0.158 in person and 1.36% + $0.152 online. [The derivation is published](/docs/payments/reference/cost-model-assumptions). --- ## Fraud Pattern Details by Method ### Card-Not-Present (CNP) Credit - Primary attack: stolen credentials from breaches and dark web purchases - Secondary: synthetic identity, built from mixed real and fake data - Pattern: high-velocity testing, then larger purchases reshipped to mules - Mitigation: 3DS, AVS, CVV, velocity limits, device fingerprinting ### Card-Token Wallets (Apple Pay, Google Pay) - Fraud rates run 50%+ lower than raw CNP - Tokenization kills stored credential theft - Biometric authentication blocks unauthorized use - Main risk: social engineering to add a stolen card to the wallet, called provisioning fraud - Mitigation: network and issuer controls at provisioning, device binding ### Online Account Wallets (PayPal, Skrill) - Primary attack: account takeover via credential stuffing and phishing - Secondary: first-party "item not received" claims - Pattern: ATO, change the shipping address, buy high-value items - Disputes: the wallet provider decides, and usually leans buyer-friendly - Mitigation: wallet-level 2FA, shipping to confirmed addresses ### ACH - Primary attack: unauthorized debits, a fraudster pulling from a victim's account - Secondary: ATO leading to debits that look authorized - Return codes: R10 (unauthorized), R29 (corporate unauthorized) - Pattern: fraudster gets routing and account numbers, then starts pulling - Mitigation: account verification (Plaid and similar), micro-deposits, behavioral analysis ### Real-Time Payments (RTP/FedNow/Faster Payments) - Primary attack: social engineering, or "authorized push payment" fraud - Pattern: the victim is tricked into sending money. Romance scams, invoice fraud. - The fraudster targets the sender, not the recipient. Merchants receiving RTP see low fraud. - Mitigation: Confirmation of Payee, friction on first-time recipients ### BNPL - Primary attack: first-party "never pay." The customer never intends to finish the installments - Secondary: return abuse. Buy, return, stop payments, keep the refund. - Pattern: apply at several providers at once, max out the credit - Mitigation: cross-provider data sharing (still emerging), identity verification ### Mobile Money (M-Pesa, etc.) - Primary attack: SIM swap, where the fraudster takes over the phone number - Secondary: social engineering. "Send money to unlock prize." - Pattern: SIM swap, drain the wallet, transfer to a cash-out agent - Mitigation: carrier security, transaction limits, agent monitoring --- ## Conversion Characteristics ### Highest Conversion (vs Baseline Cards) - Apple Pay / Google Pay on mobile: 30-50% lift (one-tap, biometric) - PayPal, for PayPal users: 30-50% lift (saved credentials) - BNPL: 20-40% lift (financing removes the price objection) - Stored card / card-on-file: 10-30% lift (no re-entry) ### Baseline - Credit card with manual entry - Debit card with manual entry ### Lower Conversion (vs Baseline) - Pay by Bank / Open Banking: 10-30% lower (bank login friction, redirect) - ACH: 20-40% lower (bank credentials, verification steps) - eCash / Vouchers: 30-50% lower (leave the site, go to a store, come back) - Crypto: highly variable. Niche audience, heavy friction for everyone else. **You're trading conversion against cost.** Lower-cost methods like ACH and Pay by Bank carry a conversion penalty. Higher-converting methods like wallets and BNPL carry a cost premium. Pick for your customer base and your margin. --- ## Rails vs. Products: An Important Distinction Separate **rails** from **products**. Rails are the infrastructure, and products are what your customer actually sees. ### Rails (Underlying Infrastructure) - Card networks: Visa, Mastercard, Amex, Discover - ACH: the Nacha network for US bank transfers - RTP: The Clearing House's real-time rail - FedNow: the Federal Reserve's real-time rail - SEPA: European bank transfer infrastructure - Faster Payments: the UK real-time rail - PIX: Brazil's instant rail, run by the central bank - UPI: India's Unified Payments Interface, run by NPCI - SWIFT: messaging for international wires, and not a settlement rail itself - Blockchain networks: Bitcoin, Ethereum, Solana ### Products (Customer-Facing) - Credit, debit and prepaid cards, built on card network rails - Apple Pay and Google Pay: a tokenization layer on card rails - PayPal and Venmo: account wallets that pull from cards or ACH - Zelle: a product built on RTP or bank networks - Cash App: cards, ACH, or internal transfers - Klarna and Affirm: BNPL products, often funded by cards or ACH - "Pay by Bank" products: built on ACH, Open Banking APIs, or local rails - Instant card payouts (Visa Direct, Mastercard Send): same card rails, pushed instead of pulled **Why this matters:** - Fraud and dispute rules come from the **rail**, not the product - A Venmo payment funded by a card falls under card chargeback rules - A Venmo payment funded by bank balance follows Venmo's policies - When you evaluate a payment method, find out which rail it runs on --- ## Industry-Specific Recommendations ### E-commerce / DTC (US Focus) - Cards. You don't get a choice - Digital wallets: Apple Pay, Google Pay, PayPal - BNPL for AOV $50+ - Local payment methods if you sell internationally ### Subscription/SaaS - Cards, primary - ACH for B2B customers who prefer it - Backup payment methods for failed cards ### B2B - ACH for most transactions, for the cost savings - Cards for small transactions and customers who insist - Wire for large, urgent payments - Level 2/3 data on card transactions ### Marketplace - Cards and PayPal for buyers - ACH for seller payouts - Real-time payments if sellers want instant payouts ### Healthcare - Cards for patient payments - ACH for insurance reimbursements - Financing or payment plans for large balances --- ## What Should Merchants Actually Use? Treat this as a default starting stack, then adjust for your business. ### US E-commerce / DTC **Must have:** - Credit and debit cards (Visa, Mastercard, Amex, Discover) - Apple Pay and Google Pay - PayPal **Add if relevant:** - BNPL (Klarna, Affirm, Afterpay) if AOV > $50 and the products are discretionary - Venmo or Cash App Pay if your demographic skews young US - Shop Pay if you're on Shopify. Saved credentials convert well. **Optional / situational:** - Crypto, only for a crypto-native audience or real demand - Pay by Bank. It's cheaper, but it costs conversion. Worth a look on high-ticket items. **Don't bother (usually):** - Wire transfers. They're not for consumer checkout. - ACH direct debit for one-time purchases. Too much friction. ### B2B / SaaS / Invoice-Based **Must have:** - Cards, for smaller invoices and expense-card customers - ACH, for larger invoices and recurring payments. The cost savings aren't small. **Add if relevant:** - Pay by Bank or instant bank verification, which makes ACH setup faster - SEPA Direct Debit for EU customers - Wire for large one-time payments, over $50K where ACH limits or timing matter **Optional / situational:** - BNPL or financing, for SMB customers who want to spread payments - Crypto, only on meaningful demand. It's rarely worth the complexity. **Operational note:** for recurring SaaS, turn on card account updater and dunning. Expired cards are the biggest source of involuntary churn. ### Global E-commerce / Marketplaces **Must have:** - Cards, for global acceptance - Major wallets: PayPal, Apple Pay, Google Pay **Add by region:** - **EU**: SEPA Direct Debit (recurring), iDEAL (Netherlands), Bancontact (Belgium), PayPal/Klarna (Germany) - **UK**: Open Banking / Pay by Bank, Direct Debit - **Brazil**: PIX (essential), Boleto (declining but still used) - **Mexico**: OXXO (essential for unbanked) - **India**: UPI (essential), Paytm - **China**: Alipay, WeChat Pay (essential for Chinese customers) - **Southeast Asia**: GrabPay, GoPay, local wallets - **Africa**: M-Pesa, MTN MoMo (essential in covered markets) - **Japan**: Konbini, PayPay, JCB **For marketplaces specifically:** - Real-time payouts. RTP/FedNow for US sellers, Faster Payments for the UK. - Local payout rails in each market - Payout providers (Stripe Connect, Adyen for Platforms, Payoneer) absorb the complexity ### Gaming / Digital Content **Must have:** - Cards - PayPal **Add if relevant:** - Paysafecard, which matters in gaming, especially the EU - Carrier billing (Boku and similar) for mobile games and apps - Crypto, if the audience is crypto-native, Web3, or NFT **Watch out for:** - Gaming runs high chargeback rates, so you'll need strong fraud prevention - Carrier billing has high fees and excellent conversion ### High-Risk / Regulated Verticals For gambling, adult content, cannabis (where legal), forex, and the like: **Common patterns:** - Fewer processor options. Expect to pay higher rates. - Wallets like Skrill and Neteller matter in gambling and forex - Cash and voucher methods (Paysafecard) cut chargeback exposure - ACH and bank transfers often beat cards on economics **Key considerations:** - Build relationships with processors who know your vertical - Watch your chargeback ratios obsessively. Network thresholds don't bend. - Plan for processor redundancy. Getting cut off isn't rare. ### Decision Framework Summary 1. **Start with cards plus major wallets.** Apple Pay, Google Pay, PayPal. 2. **Add BNPL** for discretionary products with AOV > $50. 3. **Add local APMs** for each significant international market. 4. **Consider ACH or Pay by Bank** where the savings beat the conversion hit. 5. **Add niche methods** (crypto, carrier billing, vouchers) only on clear demand. 6. **Monitor and adjust** on your actual conversion, fraud, and cost data. The goal is covering what your customers want, without drowning in complexity. Start simple, add the methods that move the needle, and cut the ones that don't earn their operational cost. --- ## Push vs Pull and Reversibility This is the framework that matters most for payment risk: | Method | Push/Pull | Reversible? | Who Can Reverse | Reversal Window | |--------|-----------|-------------|-----------------|-----------------| | Credit Card | Pull | Yes | Cardholder/Issuer | 120 days | | Debit Card | Pull | Yes | Cardholder/Issuer (Reg E) | 60 days | | ACH Credit | Push | Limited | ODFI in special cases | 5 days (most) | | ACH Debit | Pull | Yes | RDFI/Customer | 60 days (unauthorized) | | RTP/FedNow | Push | No | Only voluntary refund | N/A | | Wire | Push | No | Only bank cooperation | N/A | | PIX/UPI/etc. | Push | Very limited | Scheme-specific | Varies | | SEPA Credit | Push | Limited | Very limited recall | 10 days | | SEPA Direct Debit | Pull | Yes | Customer | 8 weeks (no questions) | **Why this matters:** - **Pull methods** like cards and direct debit put the merchant at risk. You ship, the customer disputes, the money comes back. - **Push methods** like RTP and wire put the sender at risk. Once it's sent, it's gone. Fraudsters love push payments. - **Reversibility** sets your dispute exposure. Irrevocable methods have zero chargebacks, and they leave you zero recourse if you're defrauded. --- ## Regional Regulation Snapshot Regulation changes payment economics a lot by region. **United States:** - The Durbin Amendment caps regulated debit interchange at 0.05% + $0.21 - No cap on credit. Consumer credit runs 1.51-2.30% + $0.10 in person and 1.89-2.60% + $0.10 online (Visa 18 April 2026, Mastercard 17 April 2026). - There isn't much regulation on payment methods overall **European Union:** - Interchange Fee Regulation caps: 0.2% consumer debit, 0.3% consumer credit, intra-EEA - PSD2 requires Strong Customer Authentication on most e-commerce - SEPA standardizes payments across Europe **United Kingdom:** - Interchange caps close to the EU, retained post-Brexit - Open Banking mandates. Banks have to provide API access. - Heavy adoption of Faster Payments and Direct Debit **India:** - UPI merchant discount rate is zero or near-zero for many categories - The government subsidizes digital payments to drive adoption - Result: UPI processes 20+ billion transactions monthly **Brazil:** - PIX is run by the central bank at near-zero cost - Boleto, the bank slip, still matters for the unbanked - Card interchange is high by global standards **China:** - Alipay and WeChat Pay dominate, roughly 90% of mobile payments combined - QR code payments are the standard - Cross-border restrictions limit foreign card acceptance **Why this matters.** Evaluating payment economics across borders? Local regulation changes the math completely. A 2.5% credit card rate in the US becomes 0.3% in the EU. UPI in India is basically free. Your strategy has to be region-specific. --- ## The Issuer's Perspective How issuers see each method shapes what you should do. ### What Issuers Care About **Interchange revenue.** Credit cards generate the most interchange. Debit generates less, and ACH generates none. Issuers want customers on credit cards. **Fraud losses.** Issuers eat fraud losses on unauthorized transactions. They prefer secure methods (chip, tokenization, biometrics) over manual entry. **Dispute costs.** Processing chargebacks costs issuers real money in staff time, systems, and investigation. **Float.** On credit cards, issuers front the money before collecting from cardholders. On debit, it comes out of existing deposits. **Customer experience.** Declines frustrate cardholders. Issuers want high approval rates, but not at the price of fraud. ### Why This Matters for You Issuers influence: - Approval rates on your transactions - Which fraud signals get transactions declined - Chargeback outcomes. Issuers often side with the cardholder. - Card reissuance, which'll break your stored credentials High fraud rates, excessive chargebacks, or odd transaction patterns get you flagged. Issuers start declining more of your transactions, and some block your MID entirely. From the issuer side, we track merchant reputation. A merchant at a 3% chargeback rate sees more declines than one at 0.3%. Even when the individual transaction looks identical. ### Building Issuer Trust - Keep chargeback rates well below network thresholds - Use modern security features: 3DS, tokenization - Give cardholders a descriptor they'll recognize - Respond promptly to fraud alerts and retrieval requests - Don't retry declined transactions over and over --- ## Operational Considerations ### Reconciliation Across Methods Each payment method reconciles differently. **Cards.** Match batch totals to processor reports to bank deposits. Account for fees deducted from settlement. **ACH.** Track origination files against returns, and monitor return rates by customer and type. **Real-time payments.** Individual confirmation for each transaction. Simpler to reconcile, but higher volume. **Mixed methods.** More methods means messier reconciliation, so build systems that handle multiple sources. ### Reporting and Analytics Track key metrics by payment method: - Volume and value - Acceptance and approval rate - Decline reasons - Fraud rate - Chargeback and return rate - Settlement timing - Effective cost These numbers point at real money. ACH returning 3% while cards charge back 1%? Push customers toward cards. Wallet transactions running half the fraud rate? Prioritize wallet checkout. ### Disaster Recovery What happens when a payment method fails? **Card processor outage.** You'll want a backup processor, or the ability to fail over. **ACH delays.** That's what same-day ACH is for. Wire for anything urgent. **Bank issues.** Keep relationships with more than one bank. **Network outages.** They're rare, but carrying Visa, Mastercard and Amex gives you redundancy. Write the contingency plans down, because a payment outage hits revenue directly. --- ## Next Steps **Building your initial payment stack?** 1. [Card Payments](./cards.md) - Start with card fundamentals 2. [Digital Wallets](./digital-wallets.md) - Add Apple Pay, Google Pay, PayPal 3. [Cheat Sheet](./cheat-sheet.md) - Quick reference for all methods **Optimizing payment costs?** 1. [Bank Transfers](./bank-transfers.md) - ACH for lower-cost recurring payments 2. [Real-Time Payments](./real-time-payments.md) - RTP/FedNow for instant, low-cost payouts 3. [Interchange Optimization](/docs/payments/interchange-optimization) - Reduce card processing costs **Expanding payment options?** 1. [Alternative Methods](./alternative-methods.md) - BNPL, local APMs, crypto 2. [International Payments](./international.md) - Cross-border method selection 3. [Going Global](/docs/payments/going-global) - Market-specific recommendations ## See Also - [Cheat Sheet](./cheat-sheet.md) - All key tables in one place - [Card Payments](./cards.md) - Deep dive on card economics - [Real-Time Payments](./real-time-payments.md) - RTP, FedNow, push-to-card - [Alternative Methods](./alternative-methods.md) - BNPL, local APMs, crypto - [Digital Wallets](./digital-wallets.md) - Apple Pay, Google Pay, PayPal - [Bank Transfers](./bank-transfers.md) - ACH and bank payment methods - [Checkout Conversion](/docs/payments/checkout-conversion) - Conversion optimization - [Fraud Prevention](/docs/fraud/prevention) - Fraud considerations by method - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes - [Going Global](/docs/payments/going-global) - International considerations - [Benchmarks](/docs/reference/benchmarks) - Method performance targets --- ## Digital Wallets & Pay by Bank Source: https://paymentsandrisk.com/docs/payments/payment-methods/digital-wallets # Digital Wallets & Pay by Bank (Operator Field Manual) :::info[TL;DR] - Apple Pay and Google Pay cut fraud 50%+ against raw card entry (tokenized, biometric auth) and lift auth rates 3-5%. There's no good reason not to add both, and you'll notice it on mobile - Wallets are products built on existing rails (cards, ACH). It's the underlying rail that sets your cost, settlement timing and dispute process - PayPal conversion is situational. Add it when your demographics favor it (50+, B2C, international), but don't pay the premium card rate when Braintree does the same job - Pay-by-bank (open banking) is still niche in the US but growing. At 0.5-1% against 2.9% for cards, it's hard to ignore on B2B and high-ticket, even if your customers haven't asked for it ::: Most merchants should add Apple Pay and Google Pay. PayPal is situational. Everything else is niche. Wallets are products built on top of payment rails (cards, ACH, bank transfers); they're not rails themselves. The underlying rail determines settlement, disputes, and economics. _Last verified: Dec 2025. Wallet fees and policies change; confirm with your provider._ ## What Matters (5 bullets) - **Apple Pay / Google Pay improve auth and lower fraud.** Tokenized, biometric auth = issuer trust. 50%+ lower fraud than raw CNP. - **PayPal has reach but higher fees.** 3.49%+ but strong conversion. Buyer-friendly disputes (INR/SNAD = friendly fraud vectors). - **Wallet disputes follow different flows.** PayPal disputes aren't card chargebacks; handled by PayPal under their policies. - **Pay by Bank is cheaper but has more friction.** 0.1-1.5% cost, limited chargebacks, but redirect + bank login hurts conversion. - **Each wallet = separate reconciliation stream.** Plan for accounting complexity. --- ## Category 1: Card-Token Wallets (Apple Pay, Google Pay, Samsung Pay) These wallets tokenize an underlying card. The transaction still runs on card rails, just with enhanced security. ### How Tokenization Works 1. Customer adds a card to the wallet 2. Network generates a Device Account Number (DAN/DPAN) that replaces the real card number 3. Token is stored on device (Apple: Secure Element hardware chip; Google: Host Card Emulation software) 4. At payment, token + one-time cryptogram is sent; real card number never exposed ### Economics - **Interchange:** Often qualifies for card-present rates even online (lower than standard CNP) - **Processor fees:** Similar to card transactions - **No additional wallet fees to merchant** ### Auth Rate Lift Expect 2-5% auth rate improvement over manual card entry: - No typing errors - Tokenized credential (issuer trusts it more) - Biometric proves cardholder presence - Network token stays current through card updates ### Fraud Profile - 50%+ lower fraud than raw card-not-present transactions - Tokenization means breaches don't expose usable card numbers - Biometric authentication adds security layer - Device-bound token provides strong evidence for fraud disputes (CE 3.0 eligible) ### Disputes Standard card chargeback rules apply (it's still a card transaction). Dispute goes through card network, not wallet provider. Same reason codes, same response timelines, same representment process. ### Implementation Complexity | Integration Type | Complexity | Notes | |------------------|------------|-------| | **Hosted checkout** | Low | Usually one config toggle | | **Platform plugin** | Low | Shopify, WooCommerce handle it | | **API integration** | Medium | Requires Apple/Google merchant registration | **Bottom line:** card-token wallets are almost always worth it. Lower fraud, higher approval, better conversion on mobile, and it doesn't cost you more than the card would have. --- ## Category 2: Online Account Wallets (PayPal, Skrill, Neteller, Alipay) Account-based wallets where the customer has a stored balance or linked funding sources. The wallet provider acts as intermediary. ### How They Work 1. Customer has account with wallet provider 2. Account is funded via linked card, bank transfer, or balance from prior transactions 3. At checkout, customer authenticates with wallet provider 4. Wallet provider confirms payment to merchant 5. Wallet provider settles to merchant (typically next business day) ### Major Players **PayPal**: The original. 400+ million accounts. Strong buyer protection reputation. - Cost: 3.49% + $0.49 standard (lower for high volume) - Strong conversion lift (saved credentials, trust) - Disputes handled by PayPal (separate from card chargebacks, but PayPal often sides with buyers) **Skrill / Neteller** (Paysafe group): Popular in gambling, forex, gaming, and high-risk digital content. - Cost: Varies by industry (often 3-5%) - Strong in Europe and for niche verticals - Higher dispute exposure, but necessary for conversion in their niches **Alipay**: Essential for Chinese tourists and cross-border Chinese customers. - Different dispute mechanics than Western wallets - Required if serving Chinese customer base ### PayPal Disputes vs. Card Chargebacks | Aspect | PayPal Dispute | Card Chargeback | |--------|----------------|-----------------| | **Filed with** | PayPal | Card issuer | | **Timeline** | 180 days to file | 120 days typical | | **Resolution** | PayPal decides | Issuer/network decides | | **Your response** | PayPal Resolution Center | Processor/acquirer portal | | **Fee if lost** | $15 on PayPal-account and Guest Checkout disputes, $30 above a 1.5% dispute ratio | $20 on PayPal card transactions, $15 at most other US processors | | **Ratio impact** | Separate PayPal ratio | Card network ratio | ### PayPal Seller Protection Requirements To qualify for seller protection: - Ship to address on transaction details - Provide tracking for physical goods - Respond to PayPal requests within deadline - Follow PayPal's acceptable use policies ### Friendly Fraud via Wallet Disputes "Item Not Received" (INR) and "Significantly Not As Described" (SNAD) claims function as friendly fraud rails. The buyer says it never arrived or wasn't what they ordered, and you're the one who has to prove otherwise. For digital goods, that's a hard proof to produce. **Bottom line:** fees are higher than cards, and the conversion usually pays for it. The dispute exposure is real. In gambling, digital content and cross-border you don't really have a choice, and that's worth knowing before you price it. --- ## Category 3: P2P / Social Wallets (Venmo, Cash App, Zelle) Originally peer-to-peer payment apps, increasingly accepted at merchant checkout. ### Venmo (Owned by PayPal) - 97+ million US users, skews younger demographic - Cost: 3.49% + $0.49 for merchants - Users pay from Venmo balance, linked bank, or linked card - If funded by card, card chargeback rights exist. If funded by bank, more limited. ### Cash App Pay (Block/Square) - Similar demographic to Venmo - Cost: 2.75% per transaction - Growing merchant acceptance via Square ecosystem ### Zelle (Bank Consortium) - Primarily P2P, limited merchant use cases - Near-irrevocable (bank-to-bank push), very limited dispute mechanisms - Mostly relevant for service businesses, not e-commerce checkout **Bottom line:** good for reaching younger US customers. It doesn't eliminate chargeback risk, it moves the complexity. Worth adding if your demographic skews young. --- ## Category 4: Pay by Bank / Open Banking / A2A Payment products that move money directly from customer bank accounts, bypassing card rails entirely. ### US Pay by Bank (ACH-based) 1. Customer selects "Pay by Bank" at checkout 2. Connects bank account (via Plaid, MX, or similar aggregator) 3. Merchant initiates ACH debit 4. Some providers offer payment guarantees (merchant gets paid even if ACH returns) **Economics:** 0.5-1.5% or flat fee, much cheaper than cards. Guaranteed variants cost more (provider takes return risk). **Fraud profile:** Account takeover, unauthorized ACH debits (R10/R29 returns), social engineering. ### UK/EU Open Banking Payments 1. Customer selects "Pay by Bank" or specific bank 2. Redirected to bank app or website 3. Customer authenticates (often biometric on mobile) 4. Customer approves specific payment 5. Payment initiates via Faster Payments (UK) or SEPA (EU) **Economics:** 0.1-0.5% or flat fee (much cheaper than cards). No interchange. **Disputes:** very limited for push payments, because the customer initiated it. There aren't scheme chargebacks. Some Open Banking providers sell buyer protection on top, and that costs. ### When to Use Pay by Bank **Good fit:** - Recurring payments / subscriptions - B2B invoices (fee savings significant on large amounts) - High-ticket purchases where 2-3% card fee is material - Markets with strong Open Banking adoption (UK, Netherlands, Nordics) **Less ideal:** - Low-ticket impulse purchases (friction kills conversion) - Mobile-first checkout where wallet tap is instant - Markets with low bank API adoption **Bottom line:** cheaper than cards, and push-based payments cut or kill chargebacks. The conversion friction is real though, so it's an option alongside cards, not a replacement. Don't build the checkout around it yet. --- ## Merchant-Specific Wallets (Closed-Loop) Starbucks, Walmart and Target run their own closed-loop wallets. Customers load value (via card or ACH) and then they're spending it at that retailer only. **Why merchants build wallets:** - Lower payment costs (ACH to load is cheaper than card per transaction) - Customer lock-in (balance creates commitment) - Data (full visibility into spending behavior) - Float (money sits in wallet between loads and spending) - "Breakage" revenue (unused balances that expire or go forgotten) **Disputes:** there's no network chargeback, it's closed-loop. The fraud risk moves to the load channel (card fraud at load, ACH returns). It only makes sense at scale. --- ## Should You Add Digital Wallets? ### Default Answer: Yes for Apple Pay / Google Pay | Benefit | Impact | |---------|--------| | **Faster checkout** | 50%+ reduction in time-to-complete | | **Higher auth rates** | Tokenized credentials, biometric auth | | **Lower fraud** | Device-bound, no manual card entry | | **Customer expectation** | Increasingly expected, especially mobile | **When to skip:** B2B-only businesses, very low mobile traffic, legacy systems that can't support them. ### PayPal: Depends on Your Audience | Consider Adding If | Consider Skipping If | |--------------------|----------------------| | Older customer demographic (45+) | Younger, mobile-native audience | | Trust signal matters (new brand) | Established brand recognition | | Customers don't have cards saved | High repeat purchase rate with card on file | | International customers (broad reach) | US-only, card-dominant market | ### BNPL (Klarna, Affirm, Afterpay): Situational | Add If | Skip If | |--------|---------| | AOV $100-$1,000 | Low-ticket items (under $50) | | Impulse-driven category (fashion, electronics) | B2B transactions | | Conversion lift matters more than margin | Margin-sensitive business | | Competitors offer it | Subscription-first model | ### Regional Wallets | Region | Wallets to Consider | |--------|---------------------| | **China** | Alipay, WeChat Pay (essential for Chinese customers) | | **Europe** | Local bank apps vary by country | | **Southeast Asia** | GrabPay, GCash | | **India** | UPI-based wallets (Paytm, PhonePe) | **Rule:** Only add regional wallets if you have significant traffic from that region. --- ## Test to Run **Week 1:** Baseline - Measure current checkout completion rate - Identify wallet availability gaps - Survey customer payment preferences (optional) **Week 2:** Enable - Add Apple Pay / Google Pay if missing - Evaluate PayPal based on audience **Weeks 3-4:** Measure - Compare checkout completion to baseline - Track auth rate by payment method - Monitor support tickets about payment confusion **Success criteria:** Checkout completion improves. Auth rate on wallets exceeds cards. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Enable Apple Pay / Google Pay. Skip PayPal unless customers ask. | | **$100k-$1M/mo** | Full wallet suite based on customer demographics. Monitor dispute rates by wallet. | | **Over $1M/mo** | Optimize button placement. A/B test wallet prominence. Separate dispute handling by source. | --- ## Where This Breaks - **Wallet disputes handled like card chargebacks.** PayPal disputes are different. Train support accordingly. - **Reconciliation across multiple wallets.** Each wallet is a separate money flow. Plan for accounting complexity. - **Customer confusion.** "I paid with my phone" doesn't tell support which wallet. Add clear transaction identifiers. - **Regional wallet overhead.** Adding Alipay for 0.5% of traffic isn't worth it. Set a threshold. - **Pay by Bank conversion.** Redirect + bank login kills conversion for low-ticket impulse purchases. --- ## Implementation: Checkout Button Order Wallet buttons should appear prominently: | Position | Method | Why | |----------|--------|-----| | 1 | Apple Pay / Google Pay | Fastest, highest auth | | 2 | Card form | Universal fallback | | 3 | PayPal | Broader reach | | 4 | BNPL | Niche appeal | ### Mobile vs. Desktop - Apple Pay only on Safari / Apple devices - Google Pay broader but still device-dependent - PayPal works everywhere - Test on actual devices, not just simulators --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Checkout completion by method** | Wallet effectiveness | Wallets > cards | | **Auth rate by method** | Issuer trust | Apple/Google Pay > cards | | **Dispute rate by method** | Risk profile | Track separately | | **Method adoption %** | Customer preference | Match to offering | | **Mobile vs desktop completion** | Platform parity | Mobile within 10% of desktop | --- ## Next Steps **Adding digital wallets to checkout?** 1. [Checkout Conversion](/docs/payments/checkout-conversion) - Optimize wallet button placement 2. [Card Payments](./cards.md) - Understand the underlying card rails 3. [Auth Optimization](/docs/payments/auth-optimization) - Maximize approval rates **Evaluating PayPal vs. alternatives?** 1. [BNPL Economics](/docs/payments/reference/bnpl-economics) - Compare with Buy Now Pay Later options 2. [Choosing Methods](./choosing-methods.md) - Decision framework by customer segment 3. [Cheat Sheet](./cheat-sheet.md) - Cost comparison across wallets **Managing wallet disputes?** 1. [Chargeback Prevention](/docs/chargebacks/prevention) - Reduce disputes across all wallets 2. [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Handle INR/SNAD abuse patterns 3. [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 for wallet transactions ## Related - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing checkout flow - [Card Payments](./cards.md) - Underlying card rails - [Going Global](/docs/payments/going-global) - International wallet considerations - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Cheat Sheet](./cheat-sheet.md) - Quick reference tables - [3D Secure](/docs/fraud/prevention/3ds) - Authentication requirements - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device-based fraud signals - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 and wallet transactions - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Dispute abuse patterns - [BNPL Economics](/docs/payments/reference/bnpl-economics) - Buy Now Pay Later details - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Wallet-based subscriptions - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing wallet disputes --- ## International Payments Source: https://paymentsandrisk.com/docs/payments/payment-methods/international # International Payments :::info[TL;DR] - Selling internationally often requires **local entities** for tax, regulatory, and payment acceptance reasons - **Currency conversion** costs 1-3% and someone always pays (you, your customer, or your processor) - **Regulations vary dramatically**: PSD2/SCA in Europe, auto-renewal laws, data localization requirements - **Repatriating funds** (getting money back to your home country) has costs and sometimes restrictions - Local payment methods aren't optional in many markets - they're required for meaningful conversion ::: Going global is five separate problems, and payment acceptance is only one of them. ## The Hidden Complexity of "Going Global" Accepting international payments isn't just "turn on more currencies." It involves: 1. **Legal/entity structure** - Where are you incorporated? Where do you need subsidiaries? 2. **Payment acceptance** - What local methods do you need? What processors work in each market? 3. **Currency and FX** - Who bears FX risk? When do you convert? 4. **Regulatory compliance** - What local laws apply? 5. **Fund repatriation** - How do you get money back home? 6. **Tax implications** - VAT, GST, withholding taxes, permanent establishment risk --- ## Local Entities: When and Why ### Why You Might Need a Local Entity **Payment acceptance** - Some bank transfer schemes are domestic-only - Some processors won't onboard foreign entities - Local acquiring often gives better pricing and approval rates **Tax obligations** - VAT/GST registration and collection (EU, UK, AU, etc.) - Corporate tax if you have "permanent establishment" - Digital services taxes in some markets **Regulatory compliance** - Data localization (e.g., Russia, China, some others) - Financial services licensing in some jurisdictions - Consumer protection differences **Customer trust** - Local support, local returns, local legal venue ### Common Structures **Single entity, sell globally**: Simplest. One company, accepts payments everywhere possible. Works for small-scale international sales. **Local subsidiaries in key markets**: Entity in US, entity in EU (often Ireland or Netherlands), entity in UK, etc. It's more complex, and it unlocks local payment methods, better rates and proper tax treatment. **Merchant of Record (MoR) / Reseller model**: Third party (Paddle, FastSpring, Gumroad, etc.) becomes the seller. They handle local tax, compliance, and payment acceptance. You receive net revenue. It's the simplest thing operationally, and you're paying for that in margin and control. --- ## Currency and FX ### Who Pays for FX? Somewhere in the flow, 1-3% gets taken in FX spread. Options: **Option 1: Customer pays in your currency (e.g., USD)** - Customer's card issuer converts at their rate (often 2-3% markup + foreign transaction fee) - You receive USD, no FX risk - Customer sees unfamiliar amount, potential for disputes - Conversion: Customer-side **Option 2: Customer pays in local currency, you hold FX risk** - You price in EUR, GBP, etc. - Customer sees familiar price - You receive foreign currency, must convert to USD - Conversion: Your-side (at your bank/processor rate, typically 1-2%) - You bear FX risk between sale and conversion **Option 3: Customer pays in local currency, processor converts instantly** - You price in local currency - Processor converts to USD at time of transaction - You receive USD (or your home currency) - Conversion: Processor-side (built into their rate, often 1-2.5%) - No FX risk but you pay the spread **Option 4: Multi-currency accounts** - You maintain accounts in multiple currencies (USD, EUR, GBP, etc.) - Receive funds in local currency, convert strategically - Most complex but most control over FX timing and rates ### FX Cost Reality Assume 1-3% total FX cost somewhere in the chain. If you're pricing at thin margins, this matters. A US business selling to EU: - Customer pays โ‚ฌ100 - FX rate is 1.10 USD/EUR = $110 equivalent - Processor charges 1.5% FX fee = $1.65 - You receive $108.35 That 1.5% comes off your margin, not your fees. ### Dynamic Currency Conversion (DCC) DCC lets customers pay in their home currency even when transacting with a foreign merchant. Example: US tourist in France can pay in USD at a EUR-priced store. **Reality**: DCC rates are typically terrible (3-8% markup). Customers who know this decline DCC. Customers who don't know get surprised on their statement. --- ## Regulatory Patchwork ### Strong Customer Authentication (SCA) - Europe PSD2 (Payment Services Directive 2) requires Strong Customer Authentication for most European e-commerce: - Two of: something you know (password), something you have (phone), something you are (biometric) - Implemented via 3D Secure 2.0 for cards - Exemptions exist (low value, trusted beneficiary, low risk) **Impact**: 10-30% of transactions may require step-up authentication. This adds friction and can reduce conversion. But it's legally required. **If you sell to EU without SCA**: Issuers can decline you, and you'll carry the fraud liability on what does go through. ### Auto-Renewal and Subscription Laws Different jurisdictions have different rules on subscription billing: - **California (US)**: Must clearly disclose auto-renewal terms, provide easy cancellation - **EU**: Similar disclosure requirements under consumer protection directives - **UK**: CMA actively enforcing subscription fairness - **Germany**: Recent laws require cancellation to be as easy as signup ("Kรผndigungsbutton") **Impact**: You may need different checkout flows, cancellation processes, and disclosure language by market. ### Data Localization Some countries require personal data stored locally: - **Russia**: Personal data of Russian citizens must be stored in Russia - **China**: Various data localization requirements under PIPL and Cybersecurity Law - **India**: Evolving rules on payment data localization **Impact**: May require local infrastructure, local cloud providers, or simply not serving certain markets. ### Consumer Protection Variations - **EU**: 14-day cooling-off period for online purchases (right to return for any reason) - **UK**: Similar Consumer Contracts Regulations - **Australia**: Strong consumer guarantees under ACL - **Brazil**: 7-day return right for online purchases **Impact**: local law can override your refund policy. "All sales final" isn't always enforceable. --- ## Fund Repatriation Getting money out of a country and back to your home country. ### Why It's Not Always Simple - **Capital controls**: Some countries restrict how much money can leave (Argentina, various emerging markets) - **Tax withholding**: Some countries withhold tax on outbound payments to foreign companies - **Documentation requirements**: May need to prove the transaction was legitimate business activity - **Banking relationships**: Your local bank needs correspondent banking relationships to move money cross-border ### Common Issues **Trapped cash**: You collect payments in Brazil (BRL), but getting BRL out of Brazil and into USD has friction, cost and delay. You can end up with cash sitting in a Brazilian account you can't easily reach. **Withholding taxes**: India withholds tax on certain payments to foreign companies. You'll either claim treaty benefits, file for refunds, or eat the cost. **Timing**: Cross-border fund movement can take days to weeks, especially for large amounts or unusual corridors. ### Solutions **Local reinvestment**: If you have ongoing local costs (marketing, operations, team), spend local currency locally rather than repatriating. **Processor aggregation**: Some processors (Stripe, Adyen) aggregate your global funds and pay out in your home currency, handling cross-border movement for you. You're paying for that convenience in their rates. **Treasury management**: Large companies have treasury teams that optimize currency holdings, FX timing, and cross-border movements. --- ## Practical Recommendations ### Crawl, Walk, Run **Crawl (starting out)** - Accept cards globally through your existing processor - Price in USD, let customers deal with conversion - Use your processor's built-in FX conversion - Focus on markets with easy card penetration (US, Canada, UK, Western EU) **Walk (growing international)** - Add local payment methods for top 2-3 international markets - Consider local currency pricing in major markets - Work with processor that handles multi-currency well - Understand your VAT/GST obligations **Run (significant global presence)** - Local entities in major markets - Local acquiring for better rates - Multi-currency treasury management - Local payment methods across all significant markets - Local compliance and legal support ### Market-Specific Quick Hits | Market | Key Considerations | |--------|-------------------| | **EU** | SCA required, SEPA available, VAT registration likely, 14-day returns | | **UK** | Post-Brexit separate from EU, Open Banking strong, GBP pricing expected | | **Canada** | Similar to US but CAD pricing expected, French language requirements in Quebec | | **Australia** | AUD pricing, BECS for direct debit, consumer guarantees strong | | **Japan** | Konbini important, JCB acceptance expected, Japanese language strongly preferred | | **Brazil** | PIX essential, BRL pricing, complex tax system, capital controls | | **India** | UPI dominant, INR pricing, RBI regulations on payment data | | **China** | Alipay/WeChat required for Chinese customers, many restrictions for foreign businesses | --- ## When to Get Help Cross-border payments get complex fast. Consider expert help when: - Revenue from a single foreign market exceeds $100K+ - You're triggering VAT/GST registration thresholds - You need local entities for strategic reasons - You're dealing with restricted markets (China, Russia, etc.) - Fund repatriation is becoming a real operational issue Merchant of Record services (Paddle, FastSpring) exist specifically to absorb this complexity. You trade margin for simplicity. For many businesses, that's the right trade. --- ## SMB Quick Start: Adding Your First Foreign Currency If you're a US-based SMB getting international orders and wondering whether to do anything about it, here's the short version. **When to act:** When more than 10% of your traffic (not sales - traffic) comes from a single foreign country. Check your analytics by country. If you're seeing UK, Canada, or Germany consistently, those visitors are converting worse than your US traffic because they're seeing USD prices. **The simplest path by platform:** | Platform | How to Add Local Currency | Effort | |----------|--------------------------|--------| | **Shopify** | Settings > Markets > Add market > Set local pricing | 10 minutes | | **Stripe** | Dashboard > Settings > Payment methods > Enable currency | 5 minutes | | **WooCommerce** | Install Currency Switcher plugin, configure rates | 30 minutes | | **Square** | Not natively supported for online; use Stripe or PayPal for international | Varies | **Display currency vs settlement currency:** You can show prices in EUR to European customers while still receiving USD in your bank account. Your processor converts at settlement. That's the right answer for most SMBs: you get the conversion benefit and you don't have to run foreign currency bank accounts. **What "multi-currency" actually costs you:** Your processor charges 1-2% for currency conversion on top of your normal processing fees. That's fair. If you're being charged more than 2.5% for FX, shop around. See [FX and Settlement](/docs/payments/reference/fx-and-settlement) for the full breakdown. **Don't enable Dynamic Currency Conversion (DCC).** DCC lets international customers pay in their home currency at the point of sale, but the markup is typically 3-8% and savvy customers know to decline it. It creates a bad experience for exactly the customers you're trying to win. **FX markup guide:** | Markup | Verdict | |--------|---------| | Under 1% | Great deal (Wise, some fintechs) | | 1-2% | Fair and standard | | 2-3% | Acceptable for convenience | | Over 3% | You're overpaying - negotiate or switch | **Next step:** If you're seeing significant international traffic and want to go deeper, read the full [Going Global](/docs/payments/going-global) guide. For most SMBs under $1M international revenue, the steps above are enough. --- ## Next Steps **Planning international expansion?** 1. [Going Global](/docs/payments/going-global) - Comprehensive international expansion strategy 2. [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Understand currency conversion costs 3. [Cheat Sheet](./cheat-sheet.md) - Regional payment preferences at a glance **Adding local payment methods?** 1. [Regional Payment Methods Overview](./regional/index.md) - When to add regional methods 2. [Europe](./regional/europe.md) - iDEAL, Bancontact, SEPA, Klarna 3. [Latin America](./regional/latin-america.md) - Boleto, Pix, OXXO 4. [Asia-Pacific](./regional/asia-pacific.md) - Alipay, WeChat Pay, GrabPay 5. [Alternative Methods](./alternative-methods.md) - Full guide to local APMs 6. [Digital Wallets](./digital-wallets.md) - Regional wallet options 7. [Choosing Methods](./choosing-methods.md) - Decision framework for each market **Managing cross-border compliance?** 1. [3D Secure](/docs/fraud/prevention/3ds) - SCA requirements for European transactions 2. [AML Basics](/docs/compliance/aml-basics) - Anti-money laundering for cross-border payments 3. [Consumer Protection](/docs/compliance/consumer-protection) - Regional consumer rights ## See Also - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Detailed FX mechanics and settlement in foreign currencies - [Going Global](/docs/payments/going-global) - Comprehensive international expansion guide - [Alternative Methods](./alternative-methods.md) - Local payment methods by region - [Cheat Sheet](./cheat-sheet.md) - Regional payment preferences table - [Choosing Methods](./choosing-methods.md) - Decision framework --- ## Real-Time Payments Source: https://paymentsandrisk.com/docs/payments/payment-methods/real-time-payments # Real-Time Payments :::info[TL;DR] - **RTP** (The Clearing House): $10M limit, 1,000+ institutions, 343M transactions in 2024. - **FedNow** (Federal Reserve): $10M network limit (raised November 2025), 1,600+ institutions, newer and much smaller volume. - Both are **instant, irrevocable, 24/7/365**. No chargebacks, but no recall either. - **Push-to-card** (Visa Direct, Mastercard Send): instant payouts to debit cards, 0.5-1.5% cost. - Great for payouts like gig work and insurance claims. Risky for pay-ins, because social engineering doesn't reverse. ::: Real-time payments move money bank to bank in seconds, any hour of any day, and you can't take it back. ## RTP vs FedNow | Feature | RTP | FedNow | |---------|-----|--------| | Operator | The Clearing House (bank consortium) | Federal Reserve | | Launched | 2017 | July 2023 | | Transaction Limit | $10 million | $10 million (raised November 2025; default per-institution limit is $100K with opt-in to higher) | | Participating FIs | ~1,000+ | ~1,600+ | | 2024 Volume | 343 million transactions | 1.5 million transactions | | 2024 Value | $246 billion | $38.2 billion | | Average Transaction | $719 | ~$22,000 | The US runs two real-time networks now. RTP came from The Clearing House in 2017. FedNow came from the Federal Reserve in July 2023. --- ## What Makes Them "Real-Time" ACH settles in batches. Cards authorize live and settle in batches. Real-time payments just settle. Money leaves one account and lands in the other in seconds, any day, any hour. **Key characteristics:** - Settlement in seconds. FedNow guarantees under 20. - Available 24/7/365. No weekends, no holidays. - Irrevocable once settled. No chargebacks, no reversals. - Push-only. The sender initiates, and nobody can pull from an account. --- ### Why Two Networks? The Clearing House is owned by large banks. Smaller banks and credit unions didn't want to run on a competitor's rails. FedNow gives them an alternative backed by the Federal Reserve, with potentially broader reach. ### Current State (2025) 58% of US financial institutions that enable instant payments use both networks. Multi-rail is becoming the default. RTP has more volume. FedNow has more registered institutions, though many aren't processing yet. --- ## Use Cases Real-time payments earn their keep here: **Emergency disbursements**: insurance claims, gig worker payouts, emergency loans. When someone needs money now, not in 2-3 days. **Account-to-account transfers**: moving money between your own accounts at different banks, instantly. **Bill pay at the last minute**: pay a bill due today, know it's settled today. **B2B urgent payments**: a supplier needs paying before they release the shipment. **Payroll funding**: fund payroll same-day instead of pre-funding days ahead. --- ## Costs Real-time payments typically cost: - $0.01-$0.05 per transaction for high-volume senders. - Roughly ACH pricing, sometimes a little more, for occasional use. The math works for anything urgent. A wire costs $25-$40. The same transfer on RTP costs a nickel. --- ## The Irrevocability Problem Real-time payments are irrevocable. Once settled there's no chargeback and no recall. The receiver can send it back voluntarily. That's the whole remedy. That's a **feature when you're receiving** and a **risk when you're sending**. Trick someone into pushing a payment and the money is gone. Business email compromise crews target these rails for exactly that reason. The money moves before anyone notices. From the issuer side, we're watching this closely. Speed compresses the fraud detection window. With ACH you might have hours or days to flag something. With RTP or FedNow you have seconds. --- ## Global Real-Time Systems RTP and FedNow aren't unique. Most developed economies now have real-time payment infrastructure: | Country/Region | System | Key Characteristics | |----------------|--------|---------------------| | UK | Faster Payments (FPS) | Launched 2008, ยฃ1M limit, 24/7 | | EU | SEPA Instant Credit Transfer | 10-second max, no fixed cap (โ‚ฌ100K cap removed October 2025 under Instant Payments Regulation) | | Brazil | PIX | Central bank-run, near-zero cost, massive adoption | | India | UPI | 20+ billion monthly transactions, near-zero MDR | | Singapore | PayNow | Links to phone numbers, 24/7 | | Australia | NPP/PayID | Real-time with addressing via phone/email | | Mexico | SPEI | Same-day, moving toward instant | ### Common Characteristics Across Systems - Push-only. The sender initiates. - Available 24/7/365. - Settlement in seconds. - Mostly irrevocable, with very limited recall. - ISO 20022 messaging, increasingly. **Why this matters**: sell globally and you'll find real-time rails in most major markets. The pattern is the same everywhere. Instant, final, push-based. Rails and limits differ, but the use cases travel. --- ## Instant Card Payouts (Visa Direct / Mastercard Send) There's a third instant payout option people forget. You can push money to a debit card. Normal card acceptance pulls money from customers. This runs the same rails backwards. ### How Push-to-Card Works Visa Direct and Mastercard Send are Original Credit Transactions, or OCTs. A credit pushed to a card number with no matching debit. **The flow:** 1. You collect the recipient's debit card number. 2. You initiate a push transaction through your processor. 3. It routes through the Visa or Mastercard network. 4. Funds appear on the card, usually inside 30 minutes. 5. The recipient can spend it or pull it from an ATM right away. **Rails**: the card networks, pushing a credit instead of pulling a debit. ### Economics - Cost: 0.5-1.5% of the payout amount. - Per-transaction cap: usually $10,000-$25,000, varying by processor and network. - Daily limits may apply too. ### Comparison to Other Payout Methods | Method | Speed | Cost | Recipient Experience | |--------|-------|------|---------------------| | ACH | 1-2 days | $0.20-$1.00 | Slow but free | | Same Day ACH | Same day | $0.50-$2.50 | Better, still not instant | | RTP/FedNow | Seconds | $0.01-$0.50 | Instant, requires bank enrollment | | Push-to-Card | Minutes | 0.5-1.5% | Instant, works with any debit card | | Wire | Same day | $25-$40 | Fast, expensive | ### Use Cases **Gig worker payouts**: a driver finishes a ride and earnings hit their debit card in minutes. That wins drivers. **Marketplace seller payouts**: a seller makes a sale and gets funds same day, not after an ACH wait. **Insurance disbursements**: claim approved, funds pushed to the policyholder's card instantly. **Earned wage access**: an employee wants earned wages before payday, so you push to their card. **Refunds**: the customer returns an item and sees the money now, not in 3-5 business days. **Gaming and gambling payouts**: the winner cashes out and the funds are there. ### Fraud Profile Push-to-card fraud looks nothing like card acceptance fraud: - **Account takeover and misdirected payouts** are the main risk. A fraudster gets into your platform, changes the payout card, and drains funds. - **Synthetic identity** comes second. Fake worker or seller accounts built to collect payouts. - **Stolen card numbers aren't the problem here.** The cardholder receives money instead of paying it, so a stolen number gets a fraudster nothing. **Mitigation:** - Strong KYC on payout recipients. - ATO controls: device binding, step-up auth on payout changes. - Velocity limits on new accounts. - Confirmation of payee. Does this person actually own this card? ### Operational Considerations **Card eligibility**: not every card can receive a push. Visa Direct Fast Funds and Mastercard Send cover most US debit cards. Some credit and prepaid cards aren't eligible. Your processor gives you an eligibility check. **Cross-border**: it works internationally, with FX, country restrictions and network rules stacked on top. **Fallback**: keep ACH ready for cards that can't take a push. **The UX advantage**: "get paid instantly to your debit card" sells itself to gig workers, sellers, and anyone waiting on money. The 0.5-1.5% usually pays for itself in retention. --- ## Next Steps **New to real-time payments?** 1. [Bank Transfers & ACH](./bank-transfers.md) - Compare with traditional bank payment methods 2. [Cheat Sheet](./cheat-sheet.md) - Quick reference for cost and settlement timing 3. [Choosing Methods](./choosing-methods.md) - Decision framework for payment rails **Implementing instant payouts?** 1. [Identity Verification](/docs/fraud/detection/identity-verification) - Verify payout recipients before sending 2. [Account Takeover](/docs/fraud/types/account-takeover) - Protect against ATO-driven payout fraud 3. [Processor Management](/docs/operations/processor-management) - Select RTP/FedNow-capable providers **Optimizing payout operations?** 1. [Settlement & Reconciliation](/docs/payments/settlement) - Reconcile instant payments 2. [Velocity Rules](/docs/fraud/detection/velocity-rules) - Detect suspicious payout patterns 3. [Payments Metrics](/docs/payments/metrics) - Track payout performance ## See Also - [Cheat Sheet](./cheat-sheet.md) - Quick reference tables - [Bank Transfers & ACH](./bank-transfers.md) - Slower but cheaper alternatives - [Going Global](/docs/payments/going-global) - International payment considerations - [Account Takeover](/docs/fraud/types/account-takeover) - ATO and payout fraud - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Detecting fraud patterns - [Identity Verification](/docs/fraud/detection/identity-verification) - Verifying payout recipients - [AML Basics](/docs/compliance/aml-basics) - Anti-money laundering for instant payments - [Settlement & Reconciliation](/docs/payments/settlement) - How settlement differs - [Processor Management](/docs/operations/processor-management) - RTP/FedNow providers - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring payouts - [Payments Metrics](/docs/payments/metrics) - Tracking payment performance - [Card Payments](./cards.md) - Card rail comparison --- ## Asia-Pacific Payment Methods Source: https://paymentsandrisk.com/docs/payments/payment-methods/regional/asia-pacific # Asia-Pacific Payment Methods :::info[TL;DR] - China runs on Alipay and WeChat Pay. If you're selling to Chinese customers and only accept cards, you're leaving most of the market on the table - Alipay and WeChat Pay require a Chinese business entity or a licensed payment facilitator (Stripe, Adyen, Airwallex) to accept internationally - Southeast Asia is fragmented: GrabPay dominates in Singapore/Malaysia/Thailand; GoPay and OVO in Indonesia; each requires separate integration - Add APAC payment methods only when 10%+ of your traffic comes from the region; below that threshold, the integration complexity doesn't justify the conversion gain - **Alipay and WeChat Pay both cost 2.9% + 30c on Stripe, identical to a domestic card**, plus 1% when currency conversion is required. The wallet isn't the expensive part; [the conversion is](#what-alipay-costs-you-against-cards) ::: China has virtually no credit cards. The large majority of consumer transactions use Alipay or WeChat Pay. Southeast Asia prefers e-wallets (GrabPay, Touch 'n Go). If you're selling to APAC and only accepting cards, you should expect to convert a fraction of what you otherwise would. :::warning[About the conversion percentages on this page] The market-share and conversion-lift figures here are widely cited industry estimates. They weren't verified against a primary source in the 2 August 2026 pass that produced the fee handling on this page, and nobody publishes a clean number for "how much conversion you lose without Alipay." Treat them as direction, not as arithmetic you can budget from. Your own APAC traffic and cart-abandonment data are better evidence than any of them. ::: ## When to Add APAC Payment Methods **Add APAC methods when:** - 10%+ of customers from China or Southeast Asia - You're seeing high cart abandonment from APAC countries - You're using Stripe, Adyen, or regional processors - You've localized pricing and shipping for APAC **Skip APAC methods when:** - Under 5% APAC customers - You're on Square or US-only processor - China/APAC isn't a strategic market - Compliance costs outweigh potential revenue --- ## Processor Support for APAC Methods | Method | Stripe | Shopify Payments | Square | Adyen | Airwallex | |--------|--------|------------------|--------|-------|-----------| | **Alipay** | โœ… | โœ… | โŒ | โœ… | โœ… | | **WeChat Pay** | โœ… | โœ… | โŒ | โœ… | โœ… | | **GrabPay** | โœ… | โœ… | โŒ | โœ… | โœ… | | **PayNow (Singapore)** | โœ… | โœ… | โŒ | โœ… | โœ… | | **FPX (Malaysia)** | โœ… | โœ… | โŒ | โœ… | โœ… | | **Konbini (Japan)** | โœ… | โœ… | โŒ | โœ… | โœ… | **Bottom line**: Stripe/Shopify support major APAC methods. Square doesn't. --- ## Alipay (China) ### What It Is Alipay is **China's dominant mobile payment app**: - 1.4 billion+ monthly active users - QR code payments - Integrated with Alibaba ecosystem - Works with Chinese bank accounts and wallets **Market share in China**: 50-55% of mobile payments. ### Why It Matters **China payment preferences**: - Alipay: 50-55% - WeChat Pay: 40-45% - Cards: 3-5% **Without Alipay + WeChat Pay, you can't sell to China.** ### Implementation (Stripe) **Effort**: 8-16 hours **Steps**: 1. Enable Alipay in Stripe dashboard 2. Add Alipay to checkout 3. Customer scans QR code with Alipay app 4. Payment processed in CNY (converted to USD for you) 5. Settlement in 3-5 days **Stripe fee**: **2.9% + 30c** per successful charge, plus **1% if currency conversion is required** ([stripe.com/pricing/local-payment-methods](https://stripe.com/pricing/local-payment-methods), US list, 4 August 2026). ### What Alipay Costs You Against Cards {/* #what-alipay-costs-you-against-cards */} **On rate, nothing.** Alipay's 2.9% + 30c on Stripe. A domestic card's 2.9% + 30c. Same percentage, same fixed fee. The wallet doesn't cost you a premium. WeChat Pay's identical. The cost sits one line down. Alipay settles in CNY and converts, and Stripe charges **+1% when conversion's required**. So it's really 3.9% + 30c against 2.9% + 30c, and the whole gap is FX. That holds more widely. Where a processor publishes a wallet rate and a card rate, they're within a fraction of a percent. Conversion's where the money goes. Ask your processor what its spread is. That's the real cost, not the headline rate. **The fee's rarely the decision anyway.** A Chinese customer without a usable international card doesn't pay a bit more, they don't buy at all. What matters is whether you've got enough China traffic to justify the integration. That's the [10% test](#when-to-add-apac-payment-methods) at the top of this page. ### Gotchas 1. **QR code expiration**: Alipay QR codes expire in 5-15 minutes. Build refresh logic. 2. **CNY conversion**: Transactions are in CNY, settled to you in USD. FX spread applies. 3. **China compliance**: Requires Chinese business entity for some use cases. Check with Stripe. 4. **Settlement delay**: T+3-5 (longer than cards). 5. **Refunds complex**: Alipay refunds go to Alipay wallet, different flow than cards. --- ## WeChat Pay (China) ### What It Is WeChat Pay is **Tencent's mobile payment system**: - 935 million+ payment users (WeChat overall: 1.38B+ MAU) - Integrated with WeChat (China's dominant messaging app) - QR code payments - Social commerce integration **Market share in China**: 40-45% of mobile payments. ### Why It Matters **You need BOTH Alipay and WeChat Pay** for China: - Some users only have Alipay - Some users only have WeChat Pay - Offering both covers 95%+ of Chinese consumers ### Implementation (Stripe) **Effort**: 8-16 hours (similar to Alipay) **Steps**: 1. Enable WeChat Pay in Stripe 2. Add to checkout 3. Generate QR code 4. Customer scans with WeChat app 5. Settlement in 3-5 days **Stripe fee**: Not verified, for the same reason as Alipay above. Read it at [stripe.com/pricing](https://stripe.com/pricing) from a US connection, and compare it against your card rate using [the method above](#what-alipay-costs-you-against-cards). ### Gotchas 1. **Same as Alipay**: QR expiration, CNY conversion, settlement delays 2. **WeChat ecosystem**: WeChat users expect in-app experience. QR-based checkout is clunky. 3. **Regulatory complexity**: China has strict payment regulations. Consult legal for large volumes. --- ## GrabPay (Southeast Asia) ### What It Is GrabPay is Southeast Asia's **super-app wallet**: - Singapore, Malaysia, Indonesia, Thailand, Philippines, Vietnam - Ride-hailing app turned payment platform - Part of Grab's 100M+ user super-app (~48M monthly transacting users) **Market share**: 20-40% in SEA countries (varies by country). ### Why It Matters **Southeast Asia prefers e-wallets** over cards: - E-wallets: 40-60% - Cards: 30-40% - Bank transfers: 10-20% **GrabPay is one of the top wallets** in SEA. ### Implementation (Stripe) **Effort**: 4-8 hours **Steps**: 1. Enable GrabPay in Stripe 2. Add to checkout 3. Customer authorizes via Grab app 4. Settlement in 3-5 days **Stripe fee**: Not verified. It varies by country, so any single quoted range is wrong somewhere. Read it per country at [stripe.com/pricing](https://stripe.com/pricing) from a US connection - and note that a single "GrabPay rate" doesn't exist, because Singapore, Malaysia, Indonesia, Thailand, the Philippines and Vietnam are priced separately. ### Gotchas 1. **Multi-country**: GrabPay works across SEA but rates vary by country. 2. **Mobile-first**: Works best in mobile checkout. Desktop is clunky. 3. **Settlement delays**: T+5-7 in some SEA countries. --- ## Konbini (Japan) ### What It Is Konbini is **cash payment at Japanese convenience stores**: - Customer gets voucher - Pays cash at 7-Eleven, Lawson, FamilyMart - Common in Japan (20-30% of online transactions) **Used by**: Japanese customers without cards or who prefer cash. ### Implementation (Stripe) **Effort**: 4-8 hours **Stripe fee**: not on the US rate card, and that's structural rather than an oversight. **Konbini requires a Japanese Stripe account**, so the fee only appears once you're registered in Japan. Don't read its absence from US pricing as a signal about cost, and don't budget from the flat per-transaction yen figures that circulate without a source. Worth knowing before you get there: if Konbini really is a flat fee with no percentage, it inverts the usual logic. It gets relatively cheaper as the ticket rises and relatively brutal on small ones. Work it out at your own average ticket once you have a JP entity and can see the real number. ### Gotchas 1. **Cash-only**: Same refund complexity as Boleto/OXXO 2. **Payment delay**: 1-3 days for customer to pay 3. **High non-payment**: 20-30% never complete payment --- ## Implementation Priority for APAC **If you have APAC customers, add in this order:** ### Tier 1: China (Must-Have) If 10%+ sales from China: 1. **Alipay** - 50-55% market share 2. **WeChat Pay** - 40-45% market share **Implementation**: 1-2 days for both ### Tier 2: Southeast Asia (Should-Have) If 10%+ sales from SEA: 1. **GrabPay** - Singapore, Malaysia, Indonesia 2. **FPX** - Malaysia online banking 3. **PayNow** - Singapore instant payments **Implementation**: 2-4 days total ### Tier 3: Japan (Nice-to-Have) If 5%+ sales from Japan: 1. **Konbini** - Convenience store payments **Implementation**: 1 day --- ## Test to Run **APAC payment method ROI calculator:** **Week 1: Customer geography** 1. Calculate % of revenue from: - China: ____% - Southeast Asia: ____% - Japan: ____% - Australia (cards work fine): ____% **Week 2: Method impact estimate** 2. China revenue ร— 80% (Alipay/WeChat adoption) ร— 50% (conversion lift) = potential revenue 3. SEA revenue ร— 40% (e-wallet adoption) ร— 30% (conversion lift) = potential revenue **Week 3: Implementation decision** 4. Total potential monthly lift: $_____ 5. Implementation effort: 16-24 hours 6. If lift > $5K/month, implement 7. Start with China methods if China is largest APAC market **Success criteria**: If China is 10%+ of revenue, adding Alipay + WeChat Pay is worth it. --- ## Scale Callout **Under $50K/month, under 10% APAC:** - Skip APAC methods - International cards work - Focus on US/EU first **$50K-$250K/month, 10-20% APAC:** - Add Alipay + WeChat for China customers - Skip SEA methods unless SEA is 10%+ - Monitor adoption rates **$250K-$1M/month, 20%+ APAC:** - Full China methods (Alipay + WeChat) - Add GrabPay for SEA - Consider local pricing in CNY **Over $1M/month, 30%+ APAC:** - Consider Adyen or Airwallex for local acquiring - Full APAC method suite - Optimize routing by country --- ## Where This Breaks 1. **China compliance is complex**: Large-scale China sales may require Chinese business entity, ICP license, and local banking. Consult legal. 2. **Currency conversion costs**: Alipay/WeChat transactions are in CNY. FX spread is 1-2% on top of processing fees. 3. **QR code UX on desktop is terrible**: Mobile-first markets expect mobile checkout. Desktop QR codes feel clunky. 4. **Settlement delays are long**: T+5-7 for some APAC methods. Cash flow impact. 5. **Refunds are complicated**: Each method has different refund flows. Some can't refund at all (Konbini, cash methods). --- ## Next Steps **Selling to China?** 1. Enable Alipay + WeChat Pay in Stripe 2. Test with Stripe test accounts 3. Consider local currency pricing (CNY) **Selling to Southeast Asia?** 1. Enable GrabPay for Singapore/Malaysia 2. Add FPX for Malaysia 3. Monitor adoption by country **High-volume APAC?** 1. Consider [Adyen](/docs/payments/processors/adyen) for local acquiring 2. Add country-specific methods 3. Implement smart payment method routing --- ## See Also - [Regional Payment Methods](/docs/payments/payment-methods/regional) - Overview - [Going Global](/docs/payments/going-global) - International expansion strategy - [Stripe](/docs/payments/processors/stripe) - Easiest APAC implementation for SMBs - [Adyen](/docs/payments/processors/adyen) - Enterprise APAC processing - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Currency conversion - [Checkout Conversion](/docs/payments/checkout-conversion) - Payment method optimization --- ## European Payment Methods Source: https://paymentsandrisk.com/docs/payments/payment-methods/regional/europe # European Payment Methods :::info[TL;DR] - iDEAL (Netherlands) and Bancontact (Belgium) dominate their markets. A cards-only checkout there loses 40-60% of the conversions you'd otherwise get - SEPA Direct Debit is the ACH equivalent for Europe: lower cost than cards, 8-week refund window for consumers, 5-day processing time - SCA (Strong Customer Authentication) is required for most card-not-present transactions in the EEA . If your checkout doesn't support 3DS, EU issuers will decline you - Klarna (BNPL) has 118M+ global active users and converts well for high-ticket retail; add it when EU revenue justifies the 2-6% merchant discount rate ::: Cards have low adoption in some EU markets. In the Netherlands, 60% of online shoppers use iDEAL (bank transfer), not cards. If you're selling to Europe and only accepting cards, you're losing 20-60% of potential sales. ## When to Add European Payment Methods **Add EU payment methods when:** - 10%+ of your customers are in EU - You're seeing cart abandonment from specific EU countries - Your processor is Stripe, Shopify Payments, or Adyen - You've already localized pricing (EUR), shipping, and language **Skip EU methods when:** - Under 5% EU customers - You're on Square or US-only processor - You haven't set up EUR pricing yet - Your product doesn't ship to EU --- ## Processor Support for EU Methods | Method | Stripe | Shopify Payments | Square | Adyen | PayPal | |--------|--------|------------------|--------|-------|--------| | **iDEAL** | โœ… | โœ… | โŒ | โœ… | โŒ | | **Bancontact** | โœ… | โœ… | โŒ | โœ… | โŒ | | **SEPA Direct Debit** | โœ… | โœ… | โŒ | โœ… | โŒ | | **Klarna** | โœ… | โœ… | โŒ | โœ… | โŒ | | **~~Giropay~~** | Discontinued June 2024 | | | | | | **SOFORT** | โœ… | โœ… | โŒ | โœ… | โŒ | **Bottom line**: If you're on Stripe or Shopify Payments, all major EU methods are available. If you're on Square, you're limited to cards. --- ## iDEAL (Netherlands) ### What It Is iDEAL is **online bank transfers** for Dutch customers: - Customer selects their bank during checkout - Redirected to bank's online banking - Authorizes payment directly from bank account - Instant confirmation to merchant **Not a card. Not a wallet. Direct bank-to-merchant transfer.** ### Why It Matters **Netherlands payment preferences**: - iDEAL: 55-65% of online transactions - Cards: 25-30% of online transactions - Other: 5-20% **If you don't offer iDEAL in Netherlands, you're losing half your potential customers.** ### Implementation (Stripe) **Effort**: 4-8 hours **Steps**: 1. Enable iDEAL in Stripe dashboard (Settings โ†’ Payment methods) 2. Add iDEAL to checkout (Stripe Elements auto-detects Dutch customers) 3. Test with Stripe test bank accounts 4. Handle redirects (customer leaves your site, returns after payment) 5. Go live **Stripe fee**: โ‚ฌ0.29 flat fee per transaction ### Pricing Comparison **โ‚ฌ100 transaction in Netherlands**: - iDEAL: โ‚ฌ0.29 (0.29% effective) - Card: โ‚ฌ3.20 (3.2% effective) - **iDEAL saves: โ‚ฌ2.91 per transaction** **At โ‚ฌ10K/month Netherlands sales**: - 60% choose iDEAL: โ‚ฌ6K ร— 0.29% = โ‚ฌ17 in fees - 40% choose cards: โ‚ฌ4K ร— 3.2% = โ‚ฌ128 in fees - **Total: โ‚ฌ145 vs โ‚ฌ320 all-cards** **iDEAL is cheaper than cards**, not more expensive. ### Gotchas 1. **Customer redirects**: Flow is: your site โ†’ bank โ†’ your site. Some customers abandon during redirect. 2. **No refunds to iDEAL**: Refunds go back to original bank account, but it's a separate transaction. 3. **Not instant**: Payment is instant, but settlement is T+2-3 (similar to cards). 4. **Dutch customers only**: Don't show iDEAL to non-Dutch customers (Stripe handles this automatically). --- ## Bancontact (Belgium) ### What It Is Bancontact is Belgium's **national debit card scheme**: - Also works as online bank transfer - 15M+ cards in circulation (Belgium population: 11M) - Accepted by 99% of Belgian merchants **Ubiquitous in Belgium.** Not offering it = lost sales. ### Why It Matters **Belgium payment preferences**: - Bancontact: 40-50% of online transactions - Cards: 35-45% of online transactions - Other: 5-20% ### Implementation (Stripe) **Effort**: 4-8 hours (same as iDEAL) **Steps**: 1. Enable Bancontact in Stripe dashboard 2. Add to checkout (auto-detects Belgian customers) 3. Test 4. Go live **Stripe fee**: โ‚ฌ0.29 flat fee per transaction (same as iDEAL) ### Pricing Comparison **Same pricing as iDEAL**: โ‚ฌ0.29 flat fee, much cheaper than cards. --- ## SEPA Direct Debit (EU-Wide) ### What It Is SEPA Direct Debit is **recurring bank debits** across EU: - Customer provides IBAN (EU bank account number) - You initiate debits for subscriptions/invoices - Covers 36 countries in SEPA zone **Best for**: Subscription businesses selling to EU. ### Why It Matters **Subscription businesses in EU**: - SEPA Direct Debit: 30-40% preferred for recurring - Cards: 50-60% preferred - Other: 10% **Lower fees** than card-on-file for recurring billing. ### Implementation (Stripe) **Effort**: 1-2 days **Steps**: 1. Enable SEPA Direct Debit in Stripe 2. Collect IBAN + mandate at signup 3. Handle mandate confirmations 4. Initiate debits via Stripe API 5. Handle failed debits (SEPA return codes) **Stripe fee**: 0.8% (capped at โ‚ฌ5) ### Pricing Comparison **โ‚ฌ50/month subscription, 100 EU customers**: - Cards: โ‚ฌ50 ร— 100 ร— 2.9% = โ‚ฌ145/month - SEPA: โ‚ฌ50 ร— 100 ร— 0.8% = โ‚ฌ40/month - **SEPA saves: โ‚ฌ105/month (โ‚ฌ1,260/year)** **At scale, SEPA is dramatically cheaper** for recurring billing. ### Gotchas 1. **Chargeback windows are long**: Customers can dispute up to 8 weeks (13 months if unauthorized). 2. **Mandate management**: You must store signed mandates (Stripe handles this). 3. **Failed debits**: NSF returns happen 2-3 days after debit. Build retry logic. 4. **Not instant**: Debits take 3-5 business days to settle. --- ## Klarna (EU + US) ### What It Is Klarna is **buy now, pay later (BNPL)**: - Customer splits payment into 4 installments - Klarna pays you upfront - Klarna handles collections and credit risk **Available in**: EU, US, Australia ### Why It Matters **Klarna increases conversion** by removing payment friction: - Average order value: +20-30% (customers buy more) - Conversion rate: +10-25% (more complete checkouts) - Popular with under-35 demographics ### Implementation (Stripe) **Effort**: 4-8 hours **Steps**: 1. Enable Klarna in Stripe dashboard 2. Add Klarna to checkout 3. Test payment flow 4. Go live **Stripe fee**: 3.3% + $0.30 (US) / 3.3% + โ‚ฌ0.30 (EU) ### Pricing Comparison **Klarna is more expensive than cards**: - Klarna: 3.3% + $0.30 - Cards: 2.9% + $0.30 - **Extra: 0.4% (~$0.40 per $100)** **Trade-off**: Higher AOV and conversion often justify the extra 0.4%. ### Gotchas 1. **Higher fees**: Klarna takes a bigger cut than cards. 2. **Customer qualification**: Not all customers qualify (Klarna does credit check). 3. **Refunds are complex**: Partial refunds with installments are messy. 4. **Klarna keeps the customer relationship**: Customers remember Klarna, not your brand. --- ## Giropay (Germany) - Discontinued :::warning[Discontinued] Giropay was discontinued on June 30, 2024. It's gone for new and existing transactions alike. Use **SEPA Direct Debit**, **PayPal**, or **Klarna** for German customers instead. ::: --- ## SOFORT (EU, Being Deprecated) ### What It Is SOFORT was an instant bank transfer across EU: - Being deprecated by Klarna (who owns it) - Being replaced by Klarna's bank transfer option **Status**: Still works but don't implement new. Use SEPA Direct Debit or iDEAL instead. --- ## Implementation Priority for EU **If you have EU customers, add in this order:** ### 1. Multi-Currency Pricing (EUR) **Before any payment methods**, support EUR pricing. **Effort**: 2-4 hours **Impact**: 10-20% conversion lift ### 2. Country-Specific Top Method | Country | Add First | Expected Adoption | |---------|-----------|-------------------| | **Netherlands** | iDEAL | 55-65% | | **Belgium** | Bancontact | 40-50% | | **Germany** | SEPA Direct Debit | 20-30% | | **Nordic** | Klarna | 30-40% | | **France** | Cards work | 60-70% | | **UK** | Cards work | 70-80% | ### 3. EU-Wide Methods Once you're established in EU: - SEPA Direct Debit (for subscriptions) - Klarna (for BNPL across EU) --- ## Test to Run **EU payment method audit (3 weeks):** **Week 1: Customer analysis** 1. Pull EU sales by country 2. Calculate: Netherlands + Belgium + Germany = ___% of revenue 3. If over 10%, continue. If under 5%, skip EU methods. **Week 2: Method selection** 4. Netherlands over 5%? Add iDEAL 5. Belgium over 5%? Add Bancontact 6. Germany over 5%? Add SEPA Direct Debit 7. Subscriptions? Definitely add SEPA **Week 3: Implementation** 8. Enable methods in Stripe (1 hour) 9. Add to checkout (4-8 hours dev time) 10. Test with Stripe test accounts 11. Go live and monitor adoption **Success criteria**: 30%+ of EU customers use regional methods within 30 days of launch. --- ## Scale Callout **Under $50K/month, under 10% EU:** - Skip EU methods - Cards work fine - Optimize US market first **$50K-$250K/month, 10-20% EU:** - Add iDEAL if Netherlands is top EU country - Add Bancontact if Belgium is top - Skip SEPA unless subscriptions **$250K-$1M/month, 20%+ EU:** - Add iDEAL + Bancontact + SEPA - Consider Klarna for AOV boost - Monitor adoption by country **Over $1M/month, 30%+ EU:** - Full EU payment method suite - Local acquiring for better rates (consider Adyen) - Optimize method routing by country --- ## Where This Breaks 1. **Redirect abandonment**: iDEAL and Bancontact hand off to the bank, and 5-15% of customers don't come back. Mobile is worse. 2. **SEPA chargebacks are long**: 8-week dispute window (vs 120 days for cards), but customers can claim unauthorized up to 13 months. 3. **Klarna increases returns**: BNPL makes buying easier, so it also makes returning easier. That's a pricing input, not a surprise. 4. **Language matters**: German customers expect a German checkout. The bank redirect is already in their language, so it's your site that stands out. 5. **Compliance varies by method**: SEPA requires mandate management. Klarna requires credit disclosure. Research per-method requirements. --- ## Next Steps **Ready to implement EU methods?** 1. Enable methods in [Stripe dashboard](https://dashboard.stripe.com/settings/payment_methods) 2. Add to checkout (see Stripe docs for code) 3. Test with Stripe test bank accounts **Want to optimize EU further?** 1. Add Klarna for AOV boost 2. Implement dynamic payment method ordering (show iDEAL first to Dutch customers) 3. Monitor method adoption by country **High-volume EU business?** 1. Consider [Adyen](/docs/payments/processors/adyen) for local acquiring 2. Implement Smart Payment Routing 3. Add more EU methods (Przelewy24, eps, Multibanco) --- ## See Also - [Regional Payment Methods](/docs/payments/payment-methods/regional) - Overview - [Going Global](/docs/payments/going-global) - International expansion - [Stripe](/docs/payments/processors/stripe) - Easiest implementation - [Adyen](/docs/payments/processors/adyen) - Enterprise EU processing - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Multi-currency - [Checkout Conversion](/docs/payments/checkout-conversion) - Method optimization --- ## Latin America Payment Methods Source: https://paymentsandrisk.com/docs/payments/payment-methods/regional/latin-america # Latin America Payment Methods :::info[TL;DR] - Brazil's Pix (instant bank transfer) processed 63.4 billion transactions in 2024 and is now more common than cards for many online purchases; if you're selling to Brazil, Pix is essential - OXXO (Mexico) and Boleto (Brazil) are cash-based methods with 1-3 day settlement delay; they're slow but essential for the large unbanked population - Local processors (dLocal, EBANX, Mercado Pago) handle tax compliance and local payment methods for LATAM without requiring you to establish local entities - Add LATAM payment methods when 10%+ of your customers come from Brazil or Mexico; cross-border card acceptance covers the rest adequately ::: Latin America has low credit card penetration and high cash preference. In Brazil, 50-70% of online shoppers use Pix (instant bank transfers), and in Mexico 30-40% pay cash at an OXXO convenience store. Cards alone lose you half the market. ## When to Add LATAM Payment Methods **Add LATAM methods when:** - 10%+ of customers are from Brazil or Mexico - Cart abandonment is high in LATAM countries - You're using Stripe, Adyen, or dLocal - You can handle 3-5 day settlement delays (cash-based methods) **Skip LATAM methods when:** - Under 5% LATAM customers - You're on Square or US-only processor - You can't ship to LATAM or have no local pricing - Your product is under $20 (cash methods have high fees) Between 5% and 10%, wait. Each method is 4-8 hours to integrate and a permanent line in your reconciliation. --- ## Processor Support for LATAM Methods | Method | Stripe | Shopify Payments | Square | Adyen | dLocal | |--------|--------|------------------|--------|-------|--------| | **Pix (Brazil)** | โœ… | โœ… | โŒ | โœ… | โœ… | | **Boleto (Brazil)** | โœ… | โœ… | โŒ | โœ… | โœ… | | **OXXO (Mexico)** | โœ… | โœ… | โŒ | โœ… | โœ… | | **Mercado Pago** | โŒ | โŒ | โŒ | โœ… | โœ… | **Bottom line**: Stripe and Shopify Payments cover the big three (Pix, Boleto, OXXO), which is what most merchants need. For Mercado Pago, use Adyen or dLocal. --- ## Pix (Brazil) ### What It Is Pix is Brazil's **instant payment system** launched in 2020: - QR code or account key - Instant transfer (under 10 seconds) - 24/7 availability - Works from any Brazilian bank account **Adoption**: 70%+ of Brazilian adults use Pix, which makes it the default way Brazilians pay online, not an alternative you add later. ### Why It Matters **Brazil payment preferences (2025)**: - Pix: 50-70% of online transactions - Cards: 25-35% - Boleto: 10-15% (declining) **If you're selling to Brazil and don't offer Pix**, you're missing half your potential customers. ### Implementation (Stripe) **Effort**: 4-8 hours **Steps**: 1. Enable Pix in Stripe dashboard 2. Add Pix to checkout 3. Generate QR code for customer 4. Customer scans with their banking app 5. Instant payment confirmation 6. Fulfill order **Stripe fee**: 1.4% + R$0.45 ### Pricing Comparison **R$100 transaction in Brazil**: - Pix: 1.4% + R$0.45 = R$1.85 (1.85% effective) - Card: 2.9% + R$2 = R$4.90 (4.9% effective) - **Pix saves: R$3.05 per transaction** **Pix is significantly cheaper than cards** for Brazilian transactions, and R$3.05 per R$100 moves unit economics. Put it first in the checkout. ### Gotchas 1. **Instant payment, delayed settlement**: Customer pays instantly, but you receive funds in T+1-3. 2. **QR code expiration**: Pix QR codes expire in 15-60 minutes. Build refresh logic. 3. **Refunds are separate**: Pix refunds are new transactions (not reversals). 4. **Brazil-only**: Only works for Brazilian bank accounts. None of these are reasons to skip Pix. --- ## Boleto (Brazil) ### What It Is Boleto is Brazil's **cash voucher payment system**: - Customer gets barcode at checkout - Pays cash at bank, lottery kiosk, or online banking - Payment confirmation in 1-3 days **Used by**: Brazilians without credit cards or who prefer cash. ### Why It Matters **Boleto was the primary method** before Pix, and it's been declining ever since: - 2020: 25-30% of transactions - 2025: 10-15% of transactions **Don't skip Boleto** if you're adding Pix, because 10-15% of Brazilian transactions still run on it. ### Implementation (Stripe) **Effort**: 4-8 hours **Steps**: 1. Enable Boleto in Stripe 2. Add to checkout 3. Generate Boleto voucher 4. Customer pays at bank/kiosk 5. Confirmation received (1-3 days) 6. Fulfill order **Stripe fee**: 2.95% + R$2 ### Pricing Comparison **R$100 transaction**: - Boleto: R$4.95 (4.95% effective) - Card: R$4.90 (4.9% effective) - **Similar cost to cards** Boleto costs what a card costs. The case for it is reach, not savings. ### Gotchas 1. **Payment delay**: 1-3 days for customer to pay. Hold fulfillment until confirmed. 2. **Expiration**: Boletos expire in 3-30 days. Customer may forget to pay. 3. **Non-payment rate**: 10-25% of Boletos are never paid (abandoned). 4. **Can't refund**: Boleto is cash. Refunds require issuing new Boleto or bank transfer. 5. **Being replaced by Pix**: Boleto usage declining. Still relevant but prioritize Pix. --- ## OXXO (Mexico) ### What It Is OXXO is **cash payment at convenience stores** in Mexico: - Customer gets voucher at checkout - Pays cash at any OXXO store (20,000+ locations) - Confirmation in 1-3 days **Used by**: 40% of Mexicans are unbanked or underbanked, and OXXO is what gives them access to e-commerce. ### Why It Matters **Mexico payment preferences**: - Cards: 40-50% - OXXO: 30-40% - Other: 10-20% **Without OXXO, you're missing 30-40% of Mexican market.** ### Implementation (Stripe) **Effort**: 4-8 hours **Steps**: 1. Enable OXXO in Stripe 2. Add to checkout 3. Generate OXXO voucher with barcode 4. Customer pays at OXXO store 5. Confirmation received (1-3 days) 6. Fulfill order **Stripe fee**: 1.85% + MX$11 ### Pricing Comparison **MX$500 transaction (~$25 USD)**: - OXXO: 1.85% + MX$11 = MX$20.25 (4.05% effective) - Card: 2.9% + MX$6 = MX$20.50 (4.1% effective) - **OXXO is slightly cheaper** **On small transactions, OXXO's flat fee hurts**, so it earns its place above MX$300 ($15 USD) and loses to cards below that. ### Gotchas 1. **Payment delay**: Customer must physically go to OXXO. 1-3 days is normal. 2. **Non-payment rate**: 15-30% of vouchers are never paid (customers change their mind). 3. **Cash-only**: Can't refund to OXXO. Must issue bank transfer or new voucher. 4. **Mexico-only**: Only works in Mexico. 5. **Expiration**: Vouchers expire in 3-7 days typically. Treat the voucher as an invoice, not a sale. --- ## Implementation Priority for LATAM **If you have LATAM customers, add in this order:** ### Tier 1: Must-Have | Country | Method | Priority | |---------|--------|----------| | **Brazil** | Pix | P0 - Dominant method | | **Mexico** | OXXO | P0 - 30-40% adoption | ### Tier 2: Should-Have | Country | Method | Priority | |---------|--------|----------| | **Brazil** | Boleto | P1 - Declining but still 10-15% | | **Argentina** | Mercado Pago | P1 - If material ARG volume | ### Tier 3: Nice-to-Have | Country | Method | Priority | |---------|--------|----------| | **Colombia** | PSE | P2 - If expanding to Colombia | | **Chile** | Servipag | P2 - If expanding to Chile | | **Peru** | PagoEfectivo | P2 - If expanding to Peru | **Focus on Brazil and Mexico first.** They're 60%+ of LATAM e-commerce market, and the Tier 3 methods only matter once you're actually expanding into those countries. --- ## Cash Method Operational Considerations ### Payment Delays Cash methods (Boleto, OXXO) have settlement delays: | Method | Customer Pays | You Receive Funds | Fulfillment Timing | |--------|---------------|-------------------|-------------------| | **Pix** | Instant | T+1-3 | Can ship immediately | | **Boleto** | 1-3 days | T+3-5 after payment | Wait for confirmation | | **OXXO** | 1-3 days | T+3-5 after payment | Wait for confirmation | **Risk**: Fulfill before payment and the customer never pays, which on OXXO is 20-30% of vouchers. **Best practice**: Wait for payment confirmation before shipping. ### Non-Payment Rates Customers generate vouchers but never pay: | Method | Typical Non-Payment Rate | |--------|-------------------------| | **Pix** | 5-10% (abandoned QR codes) | | **Boleto** | 15-25% (never paid) | | **OXXO** | 20-30% (never paid) | **Factor this into forecasting**: 100 OXXO vouchers = 70-80 actual payments, so a plan built on vouchers issued runs 20-30% hot. ### Refund Complexity | Method | Refund Process | Timeline | |--------|----------------|----------| | **Pix** | Separate Pix transfer | 1-2 days | | **Boleto** | Cannot refund; issue bank transfer | 5-10 days | | **OXXO** | Cannot refund; issue bank transfer | 5-10 days | **You can't refund cash methods the same way as cards.** Build the separate refund workflow before launch, not after the first refund request. --- ## Test to Run **LATAM payment method ROI calculator:** **Week 1: Geography analysis** 1. Calculate % of revenue from: - Brazil: ____% - Mexico: ____% - Other LATAM: ____% **Week 2: Method selection** 2. Brazil over 10%? Add Pix + Boleto 3. Mexico over 10%? Add OXXO 4. Estimate adoption: - Brazil: 60% will use Pix, 10% Boleto - Mexico: 35% will use OXXO **Week 3: ROI calculation** 5. Example: $50K/month Brazil sales - Expected Pix adoption: 60% = $30K - Conversion lift from offering Pix: 40% - Additional revenue: $30K ร— 40% = $12K/month 6. Implementation cost: 8-16 hours 7. Payback: Immediate **Success criteria**: If potential monthly revenue lift > $3K and LATAM is 10%+ of sales, add regional methods. Below either line, skip it. --- ## Scale Callout **Under $50K/month, under 10% LATAM:** - Skip LATAM methods - Cards + PayPal work fine - Focus on US market **$50K-$250K/month, 10-20% LATAM:** - Add Pix for Brazil - Add OXXO for Mexico - Skip Boleto unless Brazil is 20%+ **$250K-$1M/month, 20%+ LATAM:** - Full method suite (Pix, Boleto, OXXO) - Consider local pricing in BRL/MXN - Monitor non-payment rates **Over $1M/month, 30%+ LATAM:** - Consider dLocal or Adyen for local acquiring - Add country-specific methods (Mercado Pago, PSE, etc.) - Optimize for regional fraud patterns --- ## Where This Breaks 1. **Fraud on cash methods**: Pre-payment fraud is different. Customers can generate fake vouchers, you ship, payment never arrives. 2. **Currency volatility**: BRL and MXN are volatile, and whether you price in local currency or in USD, both have trade-offs. 3. **Tax complexity**: Brazil has complex tax rules (ICMS, PIS, COFINS). Research them before launching, or let a local processor like dLocal or EBANX carry the compliance for you. 4. **Shipping costs**: LATAM shipping is expensive and slow. Factor this into unit economics. 5. **Customer support in Portuguese/Spanish**: Boleto and OXXO customers expect local-language support. --- ## Next Steps **Ready to launch in LATAM?** 1. Set up Pix and Boleto for Brazil (Stripe dashboard) 2. Set up OXXO for Mexico 3. Test payment flows with Stripe test accounts 4. Monitor non-payment rates closely **Want to optimize LATAM?** 1. Add local currency pricing (BRL, MXN) 2. Implement payment method ordering by customer location 3. Build cash method non-payment tracking **High-volume LATAM?** 1. Consider [dLocal](https://dlocal.com) for local acquiring 2. Add country-specific methods 3. Implement fraud rules for cash method abuse --- ## See Also - [Regional Payment Methods](/docs/payments/payment-methods/regional) - Overview - [Going Global](/docs/payments/going-global) - International expansion - [Stripe](/docs/payments/processors/stripe) - Easiest LATAM implementation - [Adyen](/docs/payments/processors/adyen) - Enterprise LATAM processing - [Processor Comparison](/docs/payments/processor-comparison) - dLocal, Mercado Pago rates - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Multi-currency considerations --- ## Payment Processor Comparison for SMBs Source: https://paymentsandrisk.com/docs/payments/processor-comparison # Payment Processor Comparison for SMBs :::info[TL;DR] - Every figure carries a **source tier**. VENDOR is from the vendor's own page. REPORTED is from a named third party. NOT PUBLISHED means the vendor doesn't publish it, and the page says what to ask for instead. [How the tiers work](/docs/payments/reference/cost-model-assumptions#how-we-tier-every-figure) - **A blank cell here has to earn its place.** Five that look unpublished aren't: Stripe and Shopify US rates, Clover's full vertical rate card, Toast's two processing percentages, Lightspeed's 2.6% + 10c. Every one of them is published and merely easy to miss. A blank cell is a dead end for a merchant building a budget. - **You can't rank interchange-plus against flat rate without assuming a card mix.** Ours is published in full at [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). Pass-through of **1.03% + $0.178 card-present** and **1.50% + $0.172 online**. Every verdict below depends on it. If your mix differs, the answers move. - **Across 24 scenarios (2 channels x 3 ticket sizes x 4 volumes), Helcim wins 20, PayPal Zettle wins 3, Stax wins 1, and Square wins none.** The Zettle wins are all small-ticket card-present. The Stax win is a single online cell. - **The volume threshold is a myth. The ticket threshold is real.** Helcim and Square both charge $0/month, so there's no volume gate. Ticket size decides card-present. Helcim's published markup beats Square's flat rate above roughly a **$9 ticket**. Below it, Square. On premium and commercial cards, Square at any ticket. - **Stax's volume bands are annual, not monthly.** $99/mo covers up to $150,000 a *year*. A shop doing $20K/month is the $139 tier. - **What genuinely stays unpublished:** Checkout.com, Global Payments and Nuvei (nothing at all, right down to their sitemaps), Adyen's actual rates (it labels its own indicative), Lightspeed's online rate, and the chargeback fee at Clover, Worldpay and Adyen. Toast and Shopify both turned out to publish one, at $15. - Dispute costs differ more than card rates do. The whole published US span is **$0 to $30**. Square charges nothing. Helcim charges $0 if you win. PayPal's $15 dispute fee and $20 chargeback fee cover different channels. They never stack. ::: **Key Fact:** On this site's [published card mix](/docs/payments/reference/cost-model-assumptions), **[Helcim](/docs/payments/processors/helcim) is the cheapest option in 20 of the 24 scenarios modelled below.** Those cover card-present and online, at $15/$50/$150 and $25/$75/$200 tickets, at $5K/$20K/$100K/$500K a month. [PayPal Zettle](/docs/payments/processors/paypal) wins the other three card-present cells, all at a $15 ticket up to $100,000 a month. Its 9 cent fixed fee is the lowest published here. [Stax](/docs/payments/processors/stax) wins one online cell, at a $25 ticket and $20,000 a month. **[Square](/docs/payments/processors/square) wins none of them on price.** It does win outright on card mixes heavy in premium or commercial credit, and on card-present tickets below about $9. ## Start Here: What Actually Wins Read this before the tables. Every verdict comes from the published rates further down plus the published interchange assumption. The arithmetic is shown, so you can redo it with your own numbers. **No verdict here comes without its conditions.** An unqualified "X is cheapest" isn't a claim that can be true. Channel, ticket size, monthly volume and card mix all move the answer. Sometimes they reverse it. | If you're | The cheapest published option | On what condition | |---|---|---| | **Card-present, ordinary consumer card mix, ticket above ~$9** | [Helcim](/docs/payments/processors/helcim) | IC + 0.40% + 8c with no monthly fee beats 2.6% + 15c above a **$9.23** ticket. No volume gate, because neither charges a monthly fee | | **Card-present, ticket below ~$9** | [Square](/docs/payments/processors/square) against Helcim, [PayPal Zettle](/docs/payments/processors/paypal) against both | Small tickets reward a small fixed fee. Zettle's 2.29% + 9c is lower than every Square plan at every ticket; Helcim only overtakes Zettle above a **$19.53** ticket in the entry band | | **Card-present, heavy premium/commercial card mix** | [Square](/docs/payments/processors/square) | Flat rate caps your downside when interchange itself is 2.1-2.3%. Helcim's all-in on a Signature Preferred card is 2.64%, above Square's 2.60%. See [the card-mix maths](#the-card-mix-test-not-the-volume-test) | | **Card-present above roughly $58K-$70K/month** | [Stax](/docs/payments/processors/stax), probably | 0% markup + 8c overtakes Helcim there, but only at Stax's published **$199 floor**. Above $250,000/year Stax publishes no ceiling, so this is the earliest possible crossover, not a promise | | **Online, ticket above ~$15, up to ~$22K-$36K/month** | [Helcim](/docs/payments/processors/helcim) | Entry band is IC + 0.50% + 25c. It beats Square Free online above a **$9.38** ticket, Braintree above **$14.83**, and both PayPal online products at every ticket. One exception: at a $25 ticket, Stax's published $99 and $139 tiers open two earlier windows, roughly **$11,000-$12,500** and **$15,400-$20,833** a month. See [the sawtooth](#stax-the-bands-are-annual) | | **Online, ticket below ~$15** | [Braintree](/docs/payments/processors/braintree) | The 29c fixed fee is the lowest of the ranked online options, and small orders are decided by the fixed fee. On a $10 order it's $0.58 against Helcim's $0.62 | | **Online above roughly $22K-$36K/month** | [Stax](/docs/payments/processors/stax), probably | Crossover rises with ticket size: about $22.1K at a $25 ticket, $31.4K at $75, $36.2K at $200. Same $199-floor caveat. At a $25 ticket only, Stax also wins two fully published windows below that, at **$11,000-$12,500** and **$15,400-$20,833** a month | | **Online, developer-led, want a flat rate** | [Braintree](/docs/payments/processors/braintree) | 2.89% + $0.29, verified in USD. Stripe's US rates aren't verified, so the two can't be ranked, but they're 1.25 cents apart on a $25 order using Stripe's Canadian figure | | **Online, want PayPal and Venmo natively** | [Braintree](/docs/payments/processors/braintree) | Same ballpark as Stripe on price, and PayPal/Venmo are first-class rather than bolted on | | **On Shopify** | [Shopify Payments](/docs/payments/processors/shopify-payments) | Not because the rate is good, and the US rate isn't verified, but because Shopify charges a third-party gateway fee on every order if you use anything else | | **Restaurant or hardware-heavy retail** | [Clover](/docs/payments/processors/clover) Direct on rate | 2.3% + 10c restaurant, published, is the lowest card-present rate of the three POS platforms. Toast Traditional is 2.49% and Lightspeed retail 2.6% + 10c. Your reseller, contract term and hardware terms move all of this more than the rate does. Use the [question list](#the-vendors-that-publish-nothing) | | **Canadian** | [Moneris](/docs/payments/processors/moneris) or [Square](/docs/payments/processors/square) | Moneris publishes CAD rates openly. Watch the CA$80 authorization chargeback handling fee | Four things decide every verdict above, and comparison content gets all four wrong routinely: 1. **The interchange assumption. Plenty of comparison content assumes 1.80% + 10c card-present.** That's not a blend of anything. It's roughly the rate for one card type, a consumer rewards credit card. It overstates card-present pass-through by 79 basis points, and all of that lands on the interchange-plus side of every comparison. The [corrected blend and its full derivation are published](/docs/payments/reference/cost-model-assumptions). 2. **There's no "flat rate under $10K/month, interchange-plus over $10K/month" rule.** It assumes a monthly fee Helcim doesn't charge. Volume is the wrong variable. Ticket size is the right one. 3. **Two different Stax crossovers get confused.** One is where Stax passes *flat-rate* pricing. The other, much higher, is where Stax becomes cheapest *overall*. Helcim is usually still cheaper at the first. Both are below. 4. **Braintree isn't cheaper than Stripe above a $61 ticket.** That breakeven needs 2.59% + $0.49. Braintree's own page says 2.89% + $0.29, verified 2026-08-02. There's no breakeven to compute, and Stripe's US rate isn't verified anyway. --- ## Side-by-Side Pricing **How to read this table** - **Flat-rate** providers quote one all-in rate and keep the difference against interchange. - **Interchange-plus** providers pass interchange through and add a published markup. - Every figure came from the vendor's own page on the date shown. Nothing here is sourced from a blog, a comparison site, or a competitor. | Provider | Model | Card-present | Online | Keyed / invoice | Monthly | Source, verified 2026-08-02 | |---|---|---|---|---|---|---| | **[Square](/docs/payments/processors/square)** | Flat | 2.6% + 15c (Free); 2.5% + 15c (Plus); 2.4% + 15c (Premium) | 3.3% + 30c (Free); 2.9% + 30c (Plus, Premium) | Keyed / card on file 3.5% + 15c. ACH via Invoices 1%, $1 min, $10 cap (Plus/Premium) | None on Free ("no monthly subscription costs"). Plus $49 and Premium $149, both **per location** | [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees) | | **[Stripe](/docs/payments/processors/stripe)** | Flat | Terminal **2.7% + $0.05** | **2.9% + $0.30** domestic | +0.5% manually entered; **+1.5% international cards; +1% currency conversion** (both inverted versus Canada); ACH 0.8% capped $5 | None. "Stripe does not charge setup fees, monthly fees, or any other hidden fees" | [stripe.com/pricing](https://stripe.com/pricing), read from a US connection | | **[Braintree](/docs/payments/processors/braintree)** (PayPal) | Flat | Not separately published | 2.89% + $0.29 cards and digital wallets | Not separately published. Non-USD +1%; cards issued outside the US +1% | Not published | [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | | **[PayPal](/docs/payments/processors/paypal)** | Flat | 2.29% + $0.09 (Zettle in person) | 3.49% + $0.49 PayPal Checkout; 2.99% + $0.49 standard card payments | Keyed 3.49% + $0.09. Invoicing 3.49% + $0.49 via Checkout or 2.99% + $0.49 via card. ACH 1% capped $10. International +1.50% | None for standard commercial accounts | [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) | | **[Shopify Payments](/docs/payments/processors/shopify-payments)** | Flat | US: Basic **2.6% + 10c**; Grow 2.5% + 10c; Advanced 2.4% + 10c; Plus "most competitive rates" | US: Basic **2.9% + 30c**; Grow 2.7% + 30c; Advanced 2.5% + 30c | Not published separately | US: $39 / $105 / $399 monthly, or $29 / $79 / $299 annually. Plus from $2,300. Plus a third-party gateway fee of 2% / 1% / 0.6% / 0.2% by plan if you don't use Shopify Payments | [shopify.com/pricing](https://www.shopify.com/pricing), read from a US connection | | **[Helcim](/docs/payments/processors/helcim)** | Interchange-plus | IC + 0.40% + 8c ($0-50K/mo), stepping to IC + 0.15% + 6c ($1M-5M/mo) | IC + 0.50% + 25c ($0-50K/mo), stepping to IC + 0.15% + 15c ($1M-5M/mo) | Keyed billed at the online rate. ACH/EFT-PAD 0.5% + 25c capped $6. Interac 9c, 12c tap | $0. No setup, PCI, cancellation or statement fees | [helcim.com/pricing](https://www.helcim.com/pricing/) | | **[Stax](/docs/payments/processors/stax)** | Subscription + interchange | IC + 0% markup + 8c | IC + 0% markup + 15c | Billed as card-not-present, IC + 15c | $99/mo up to **$150,000 per year**; $139/mo for **$150,000-$250,000 per year**; $199+/mo above **$250,000 per year** | [staxpayments.com/pricing](https://staxpayments.com/pricing/) | | **[Moneris](/docs/payments/processors/moneris)** (Canada, CAD) | Flat | CA$: 2.65% + $0.10 credit; Interac Debit $0.12 | CA$: 2.85% + $0.30 credit; Interac Debit $1.00 | Billed card-not-present, 2.85% + $0.30 CAD | No monthly subscription stated for Flat Rate. Minimum merchant discount rate CA$5. Moneris Go software fee CA$5. Paper statement CA$2 | [moneris.com/en/pricing](https://www.moneris.com/en/pricing) | | **[Adyen](/docs/payments/processors/adyen)** | Interchange++ | Not published. Interchange++ plus $0.13 processing fee, indicative card markup 0.60% | Not published. Same model | Not published. Alipay $0.13 + 3%; SEPA Direct Debit $0.13 + EUR 0.27 | "We do not have monthly fees, set-up fees, integration fees or closure fees. We do have a minimum invoice depending on industry or business model." No amount attached | [adyen.com/pricing](https://www.adyen.com/pricing) | | **[Checkout.com](/docs/payments/processors/checkout-com)** | Flat or Interchange++ | Not published | Not published | Not published | Not published. States no setup fees and no account maintenance fees | [checkout.com/pricing](https://www.checkout.com/pricing) | | **[Clover](/docs/payments/processors/clover)** (Fiserv) | Flat, but reseller-set in practice | Direct: **2.3% + 10c** restaurant and QSR; **2.6% + 10c** retail and services entry plans | Direct: **3.5% + 10c** | **3.5% + 10c**, same as online | $0 Starter, $29.95 Essentials, $84.95-$129.85 Growth. Rapid Deposit 1.75% | [clover.com/pricing](https://www.clover.com/pricing) | | **[Toast](/docs/payments/processors/toast)** | Flat, two plans | **2.49%** Traditional, **3.09%** Pay-as-you-Go. Fixed cents *reported* at 15c, not published by Toast | *3.50% + 15c, reported by NerdWallet only.* Toast publishes no CNP rate | Not published | $0 Starter Kit, $69 Point of Sale restaurant, $90 retail. Payroll +$9 per employee | [pos.toasttab.com/shop/starter-kits](https://pos.toasttab.com/shop/starter-kits) and [/pricing](https://pos.toasttab.com/pricing) | | **[Lightspeed](/docs/payments/processors/lightspeed)** | Subscription + processing | **2.6% + 10c** retail (X-Series). No rate published for the restaurant product | **Not published** on any page | **Not published** | Retail $89 / $149 / $289. Restaurant $69 / $189 / $399. KDS $30 per screen | [lightspeedhq.com/pos/retail/pricing](https://www.lightspeedhq.com/pos/retail/pricing/) | *Italicised* figures in that table are REPORTED by a named third party rather than published by the vendor. Everything unmarked is VENDOR. :::warning[Five rates that are published, but hard to find] Each of these looks unpublished to anyone checking quickly. All five sit on the vendor's own site, verified 2026-08-02. 1. **Stripe's US card and Terminal rates.** stripe.com resolves country by request IP, not by URL path, so /us/pricing and /en-us/pricing serve Canada too. Read from a US connection: 2.9% + $0.30 online, 2.7% + $0.05 Terminal. **Two fees are inverted between the countries.** International cards are +1.5% US against +0.8% Canada. Currency conversion is +1% US against +2% Canada. 2. **Shopify Payments' US plan rates.** There's no /us/ path. The bare URL served to a US IP is the US card. And the "no per-transaction cents in person" claim is **Canada only**. The US charges 10 cents. 3. **Clover.** A full rate card, vertical by vertical, at [clover.com/pricing](https://www.clover.com/pricing). 4. **Toast.** The rates live on the shop pages. The pricing page says "Simple, flat rate" and gives no figure at all. 5. **Lightspeed.** The real rate is 2.6% + 10c. The bare "1.5%" that turns up is an artefact, and the string "1.5" appears nowhere on the pricing page. **Still not published:** Lightspeed's online rate, and its restaurant processing rate. ::: --- ## The Card-Mix Test, Not the Volume Test {/* #the-card-mix-test-not-the-volume-test */} The usual advice: flat rate until you hit some monthly volume, then switch to interchange-plus. That's true only when the interchange-plus provider charges a monthly fee you have to earn back. Helcim charges $0 a month. Square charges $0 a month on the Free plan. No fee to earn back, no threshold to cross. The comparison is per transaction. It turns on two things. What cards your customers hand you, and how big your average sale is. The arithmetic. Take a ticket of size **A**, interchange of **i%** plus **f** cents, and network assessments of 0.14% + 2c: ``` Square (Free, card-present) = 0.026 x A + $0.15 Helcim (card-present, entry) = (i + 0.14% + 0.40%) x A + (f + $0.02 + $0.08) Square costs more when (0.0206 - i) x A > (f - $0.05) ``` :::warning[The network fee belongs on the interchange-plus side] The 0.14% + 2c network assessment sits inside Helcim's line above, and it has to. Leave it out and you flatter interchange-plus, moving every breakeven down. Assessments are real. An interchange-plus merchant pays them visibly on top. A flat-rate merchant pays them invisibly inside the headline rate. Dropping them from one side is the easiest way to rig this comparison. The 0.14% figure itself is **unverified**. Neither Visa nor Mastercard publishes assessments anywhere. So this site takes the conservative end of what's plausible, the end that makes interchange-plus look worse. Moving it between 0.10% and 0.25% changes none of the verdicts on this page. ::: These use the Visa card-present rates behind [this site's cost model](/docs/payments/reference/cost-model-assumptions). All read from Visa's published schedule of 18 April 2026 and checked against Mastercard's of 17 April 2026: | Card the customer hands you | Interchange | Helcim all-in | Helcim beats Square above a ticket of | |---|---|---|---| | Regulated debit (large-bank) | 0.05% + $0.22 | 0.59% + $0.32 | **$8.46** | | Exempt debit (small-bank) | 0.80% + $0.15 | 1.34% + $0.25 | **$7.94** | | Exempt prepaid | 1.15% + $0.15 | 1.69% + $0.25 | **$10.99** | | Consumer credit, no rewards | 1.51% + $0.10 | 2.05% + $0.20 | **$9.09** | | Standard rewards credit | 1.65% + $0.10 | 2.19% + $0.20 | **$12.20** | | Premium rewards (Signature Preferred) | 2.10% + $0.10 | 2.64% + $0.20 | **Never. Square is cheaper** | | Top consumer tier (Visa Infinite, MC World Elite) | 2.30% + $0.10 | 2.84% + $0.20 | **Never. Square is cheaper** | | Commercial / business | 2.26% + $0.10 | 2.80% + $0.20 | **Never. Square is cheaper** | Three rows say "never" for one reason. Helcim's all-in percentage already exceeds Square's 2.6% before ticket size enters it. Its fixed component is higher too. There's no crossover to find. On this site's blended mix the crossover lands at **$9.23**. So a hair salon at a $45 ticket is cheaper on Helcim on essentially every sale. So is a restaurant at $60, on an ordinary consumer mix. That holds at any volume, because neither processor charges a monthly fee to amortise. A coffee shop at a $6 ticket is a different answer. Small tickets are exactly where the flat fixed fee wins, and that's the case people get wrong most often. For a B2B counter where half the cards are commercial, Square's flat rate is genuinely the better deal. A flat rate caps your exposure when interchange itself runs 2.3%. **Worked example, $50 regulated-debit sale in person:** - Square Free: 2.6% x $50 + $0.15 = **$1.45** - Helcim entry tier: interchange (0.05% x $50 = $0.025, plus $0.22) + assessments (0.14% x $50 = $0.07, plus $0.02) + markup (0.40% x $50 = $0.20, plus $0.08) = **$0.62** About 42% of the cost. The same sale on a commercial card flips it. Interchange $1.23, plus $0.09 of assessments, plus $0.28 of markup = **$1.60** on Helcim against **$1.45** on Square. Those interchange figures are Visa's published US rates, not vendor rates. Your real mix will differ. Pull one month of statements. Find your actual blended interchange and your actual average ticket. Put both in the formula. Those two numbers settle it. Nothing else does. :::note[What Square is actually selling you] None of this says Square is a bad buy. Square bundles a full POS, hardware and a payments account into one thing that works out of the box. Helcim sells terminals and invoicing, not a Square-style POS. If you pick Square, be clear about what you're buying. You're buying the POS. The processing is the price of it, not a bargain. ::: --- ## The 24 Scenarios {/* #the-24-scenarios */} Two channels, three ticket sizes, four monthly volumes. Every cell comes from the published rates in the table above plus [the published pass-through assumption](/docs/payments/reference/cost-model-assumptions). Subscriptions are amortised over the volume. **The formulas, so you can rebuild any cell:** ``` flat rate = rate x V + fixed x N interchange-plus = (pass-through% + markup%) x V + (pass-through cents + markup cents) x N + monthly subscription where V = monthly volume and N = V / average ticket ``` One structural detail that's easy to miss. **Helcim's bands key off MONTHLY volume. Stax's key off ANNUAL volume.** A merchant doing $20,000 a month sits in Helcim's $0-50K band and Stax's $150K-250K-a-year band at once. Mixing those up is worth about a factor of twelve. ### Card-present | Ticket | Volume | Cheapest | Cost | Effective | Runner-up | Gap | Stax at its floor | |---|---|---|---|---|---|---|---| | $15 | $5,000 | **PayPal Zettle** | $144.50 | 2.89% | Helcim $157.50 | $13.00 | $236.50 on the $99 tier | | $15 | $20,000 | **PayPal Zettle** | $578.00 | 2.89% | Helcim $630.00 | $52.00 | $689.00 on the $139 tier | | $15 | $100,000 | **PayPal Zettle** | $2,890.00 | 2.89% | Helcim $2,933.33 | $43.33 | $2,949.00, unranked | | $15 | $500,000 | **Helcim** | $14,083.33 | 2.82% | Zettle $14,450.00 | $366.67 | $13,949.00, unranked, would win by $134 | | $50 | $5,000 | **Helcim** | $97.30 | 1.95% | Zettle $123.50 | $26.20 | $176.30 on the $99 tier | | $50 | $20,000 | **Helcim** | $389.20 | 1.95% | Stax $448.20 | $59.00 | $448.20 on the $139 tier | | $50 | $100,000 | **Helcim** | $1,776.00 | 1.78% | Zettle $2,470.00 | $694.00 | $1,745.00, unranked, would win by $31 | | $50 | $500,000 | **Helcim** | $8,530.00 | 1.71% | Zettle $12,350.00 | $3,820.00 | $7,929.00, unranked, would win by $601 | | $150 | $5,000 | **Helcim** | $80.10 | 1.60% | Zettle $117.50 | $37.40 | $159.10 on the $99 tier | | $150 | $20,000 | **Helcim** | $320.40 | 1.60% | Stax $379.40 | $59.00 | $379.40 on the $139 tier | | $150 | $100,000 | **Helcim** | $1,445.33 | 1.45% | Zettle $2,350.00 | $904.67 | $1,401.00, unranked, would win by $44 | | $150 | $500,000 | **Helcim** | $6,943.33 | 1.39% | Zettle $11,750.00 | $4,806.67 | $6,209.00, unranked, would win by $734 | Square Free wins nothing here. It places third of four in the three $5,000-a-month cells. That's only because Stax's subscription hasn't been amortised at that volume. In the other nine cells it's last. Square's rates haven't moved. The pass-through assumption above is what puts it there. ### Online | Ticket | Volume | Cheapest | Cost | Effective | Runner-up | Gap | Stax at its floor | |---|---|---|---|---|---|---|---| | $25 | $5,000 | **Helcim** | $184.40 | 3.69% | Braintree $202.50 | $18.10 | $238.40 on the $99 tier | | $25 | $20,000 | **Stax** | $696.60 | 3.48% | Helcim $737.60 | $41.00 | $139 tier, genuinely ranked | | $25 | $100,000 | **Helcim** | $3,338.00 | 3.34% | Braintree $4,050.00 | $712.00 | $2,987.00, unranked, would win by $351 | | $25 | $500,000 | **Helcim** | $15,190.00 | 3.04% | Braintree $20,250.00 | $5,060.00 | $14,139.00, unranked, would win by $1,051 | | $75 | $5,000 | **Helcim** | $128.13 | 2.56% | Braintree $163.83 | $35.70 | $195.47 on the $99 tier | | $75 | $20,000 | **Helcim** | $512.53 | 2.56% | Stax $524.87 | **$12.33** | $524.87 on the $139 tier | | $75 | $100,000 | **Helcim** | $2,346.00 | 2.35% | Braintree $3,276.67 | $930.67 | $2,128.33, unranked, would win by $218 | | $75 | $500,000 | **Helcim** | $10,896.67 | 2.18% | Braintree $16,383.33 | $5,486.67 | $9,845.67, unranked, would win by $1,051 | | $200 | $5,000 | **Helcim** | $110.55 | 2.21% | Braintree $151.75 | $41.20 | $182.05 on the $99 tier | | $200 | $20,000 | **Helcim** | $442.20 | 2.21% | Stax $471.20 | $29.00 | $471.20 on the $139 tier | | $200 | $100,000 | **Helcim** | $2,036.00 | 2.04% | Braintree $3,035.00 | $999.00 | $1,860.00, unranked, would win by $176 | | $200 | $500,000 | **Helcim** | $9,555.00 | 1.91% | Braintree $15,175.00 | $5,620.00 | $8,504.00, unranked, would win by $1,051 | The $75 / $20,000 cell is the closest in the whole matrix, **$12.33 apart**. It flips to Stax at about $31,400 a month. Don't treat it as a clear win either way. Price both. :::warning[What the "Stax at its floor" column means, and doesn't] Above $250,000 a year, about $20,833 a month, Stax publishes its subscription as **"$199+"**. No stated ceiling. Every figure in that column uses $199. That's the best case Stax could possibly offer, not a quote. Stax would win **eleven** of these cells at that floor, and it wins one more at a published tier. Twelve cells sit above $250,000 a year and are therefore unranked. The only one of those Stax would *not* win is a $15 card-present ticket at $100,000 a month. There PayPal Zettle's $2,890.00 still beats Stax's $2,949.00. That's a strong reason to get a Stax quote at $100K a month and above. It isn't a reason to believe the number before you have it in writing. ::: **Who isn't in these 24 cells, and why.** The matrix was computed before this round of rate verification. It covers Helcim, PayPal Zettle, Stax, Square Free and Braintree. It hasn't been recomputed. So it doesn't yet include the rates confirmed since: [Stripe](/docs/payments/processors/stripe) at 2.9% + 30c online and 2.7% + 5c Terminal, [Shopify Payments](/docs/payments/processors/shopify-payments) at 2.9% + 30c online and 2.6% + 10c in person, [Clover](/docs/payments/processors/clover) direct at 2.3% or 2.6% + 10c, [Toast](/docs/payments/processors/toast) at 2.49% or 3.09%, [Lightspeed](/docs/payments/processors/lightspeed) at 2.6% + 10c, and Square Plus and Premium at $49 and $149 per location. Where those would land, on the same pass-through assumption. **Clover Direct's 2.3% + 10c is the second-cheapest flat card-present rate verified on this site.** PayPal Zettle's 2.29% + 9c is lower on both components, so it's cheaper at every ticket. Shopify Basic and Lightspeed at 2.6% + 10c both sit five cents under Square Free at the same percentage. Stripe Terminal at 2.7% + 5c crosses Square Free at a $100 ticket. None of them displaces Helcim above a $9.23 ticket on an ordinary card mix. They're all flat rates, and the flat-rate-versus-interchange-plus argument doesn't turn on a tenth of a point. **Still genuinely unrankable:** [Checkout.com](/docs/payments/processors/checkout-com), Global Payments and Nuvei (nothing published, verified), [Adyen](/docs/payments/processors/adyen) (labels its own rates indicative and requires an unpublished minimum invoice), [Moneris](/docs/payments/processors/moneris) (CAD), Lightspeed online (not published), and Stax above $250,000 a year ("$199+"). ### The crossovers, with the arithmetic Every one of these comes from setting two cost formulas equal and solving for the ticket. They're the boundaries where a verdict above flips. | Comparison | Helcim band | Crossover ticket | Above it | |---|---|---|---| | Helcim vs Square Free, card-present | entry ($0-50K/mo) | **$9.23** | Helcim | | Helcim vs Square Free, card-present | $100-500K/mo | $7.42 | Helcim | | Helcim vs Square Free, card-present | $500K-1M/mo | $6.42 | Helcim | | Helcim vs PayPal Zettle, card-present | entry | **$19.53** | Helcim | | Helcim vs PayPal Zettle, card-present | $100-500K/mo | $15.64 | Helcim | | Helcim vs PayPal Zettle, card-present | $500K-1M/mo | $13.96 | Helcim | | Helcim vs Square Free, online | entry | **$9.38** | Helcim | | Helcim vs Square Free, online | $500K-1M/mo | $1.42 | Helcim | | Helcim vs Braintree, online | entry | **$14.83** | Helcim | | Helcim vs Braintree, online | $500K-1M/mo | $2.81 | Helcim | | Helcim vs either PayPal online product | any band | **None exists** | Helcim always. PayPal's 49c fixed fee is above Helcim's and its rate is higher too | | PayPal Zettle vs any Square plan, card-present | not applicable | **None exists** | Zettle always. Lower rate *and* lower fixed fee | | Braintree vs Stripe, online | not applicable | **None exists** | 1.25 cents apart on a $25 order, and Stripe's US rate is unverified anyway | Worked example for the first row, so the method is visible: ``` Square Free = 0.026 x A + $0.15 Helcim entry = (1.03% + 0.40%) x A + ($0.178 + $0.08) = 0.0143 x A + $0.258 0.026A + 0.15 = 0.0143A + 0.258 0.0117A = 0.108 A = $9.23 ``` :::note[Adyen against Helcim splits by channel] Card-present, Adyen's indicative 0.60% + $0.13 markup is higher than Helcim's in every band. Its all-in 1.63% + $0.308 is worse than Helcim's entry 1.43% + $0.258 on both components. Online it reverses. The two cross at exactly a **$120.00** ticket, and below that Adyen's indicative markup is genuinely lower. Adyen still carries no verdict here. It labels those rates indicative and requires a minimum monthly invoice it doesn't publish. ::: --- ## Stax: The Bands Are Annual {/* #stax-the-bands-are-annual */} Stax charges a monthly subscription. It passes interchange through with **no percentage markup**, just 8c per card-present transaction or 15c online. The subscription is priced by annual volume: | Subscription | Covers processing volume of | |---|---| | $99/month | Up to $150,000 **per year** (about $12,500/month) | | $139/month | $150,000 to $250,000 **per year** (about $12,500-$20,800/month) | | $199+/month | Above $250,000 **per year** | Stax's page states that "subscription prices are determined by processing volume and do not include cents per transaction." Source: [staxpayments.com/pricing](https://staxpayments.com/pricing/), verified 2026-08-02. Read as monthly, those bands make Stax look about twelve times more expensive than it is. :::warning[Two different Stax crossovers, and they get confused] There's a volume at which Stax beats **flat rate**. There's a much higher one at which Stax beats **Helcim**. Publish the first and describe it as the second, and you point merchants at Stax at roughly a fifth of the volume where Stax is actually the cheapest thing available. - Stax overtakes Square Free at about **$7,300/month** card-present on a $50 ticket, and about $5,600-$5,800/month online. Those numbers are correct. They mean Stax beats the flat rates early. - Stax overtakes **Helcim** card-present at roughly **$58,000-$70,000/month**, depending on ticket. Online it's roughly **$22,100-$36,200/month** at its $199 floor. Those are the numbers that matter if you want the cheapest option, not merely a cheaper one than Square. Stax gets there earlier in one place: a $25 online ticket. There its published $99 and $139 tiers win from about **$11,000-$12,500** and **$15,400-$20,833** a month. ::: **Stax against Helcim, card-present.** Both charge 8c per transaction in the entry band. So at first the only difference is Helcim's 0.40% markup against Stax's subscription: ``` 0.40% x V = $199 -> V = $49,750/month ``` But Helcim's band improves at exactly $50,000 a month, to 0.35% + **7c**. Now Helcim's cent charge is a penny lower than Stax's. That step reclaims the lead almost immediately. So the durable crossover is higher, and it depends on ticket size: | Average card-present ticket | Stax overtakes Helcim at about | |---|---| | $15 | $70,000/month | | $50 | $60,000/month | | $100 | $58,500/month | | $150 | $58,000/month | Note the direction. Card-present, the crossover **falls** as tickets get bigger. Helcim's 7c advantage per transaction is worth less when there are fewer transactions. **Online**, Stax saves Helcim's 0.50% markup plus 10c per transaction, and the direction reverses: | Average online ticket | Stax overtakes Helcim at about this monthly volume, on the $199 floor | |---|---| | $25 | $22,100/month | | $75 | $31,400/month | | $200 | $36,200/month | Here the crossover **rises** with ticket size. Stax's cheaper cent charge is doing the work, and bigger tickets mean fewer transactions to apply it to. A large-ticket ecommerce merchant needs far more volume before Stax makes sense than a small-ticket one does. **The $199 floor isn't the whole story. At a $25 ticket it's the wrong number to plan on.** Stax's cheaper tiers produce earlier crossovers. Whether you reach one depends on whether the crossover volume falls inside the tier that prices it. Solve at each subscription: | Online ticket | $99 tier, ends at $12,500/mo | $139 tier, $12,500-$20,833/mo | $199 floor, above $20,833/mo | |---|---|---|---| | **$25** | **$11,000/month**, inside the tier, so it's real | **$15,400/month**, inside the tier, so it's real | $22,100/month | | $75 | $15,600, past the tier ceiling, never reached | $21,900, past the tier ceiling, never reached | $31,400/month | | $200 | $18,000, past the tier ceiling, never reached | $25,300, past the tier ceiling, never reached | $36,200/month | So a $25-ticket ecommerce merchant gets a **sawtooth**, not a single threshold. Stax is cheaper from about $11,000 to $12,500 a month. At $12,500 the annual volume crosses $150,000. The subscription steps to $139 and Helcim retakes the lead until about $15,400. Stax is cheaper again from $15,400 to $20,833. There the subscription steps to "$199+" and Helcim leads again until about $22,100. Above that, Stax stays ahead at its floor. Crossing a Stax tier boundary can push your bill up while your volume goes up. Near a boundary, model both. Don't read a threshold off a table. At $75 and $200 tickets there's no sawtooth, because neither cheaper tier lasts long enough to reach its own crossover. **Every "$199 floor" figure above uses exactly $199.** Above $250,000 a year Stax publishes "$199+" with no ceiling. So those are the earliest volumes at which Stax could overtake Helcim, not the volumes at which it will. The $99 and $139 figures are different in kind. Those subscriptions are published numbers with a stated ceiling. So the $11,000 and $15,400 crossovers at a $25 ticket are rankable. Ask Stax what the "+" means at your volume, in writing, before you rely on anything above $250,000 a year. --- ## Dispute Economics: Where Processors Really Differ Card rates across the flat-rate providers land within half a point of each other. Dispute fees don't. If you run a business that gets disputes, this table matters more than the rate table. | Provider | What one dispute costs | Refunded if you win? | Source, verified 2026-08-02 | |---|---|---|---| | **Helcim** | $0 if resolved in your favour, $15 if lost | Yes, by design. The only win-is-free policy verified here | [helcim.com/pricing](https://www.helcim.com/pricing/) | | **Square** | **$0.** "There are no fees for dispute management services for chargebacks" | Nothing to refund. Square's Payment Terms separately reserve the right to recover "the amount of any Chargeback and any associated Fees, fines, or penalties listed in the Fee Schedule", which covers network fines rather than a dispute fee | [squareup.com/help](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough) | | **Authorize.net** | **$0.00** on card chargebacks. $25.00 on eCheck.Net | Nothing to refund on cards. Gateway fee only, so the merchant account behind it bills its own | [authorize.net/pricing](https://www.authorize.net/en-us/sign-up/pricing.html) | | **Shopify Payments** | $15.00 in the US | **Yes.** "If you win the chargeback, then the fee is returned to you." Shopify attributes the fee to your bank, not to Shopify | [help.shopify.com](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process) | | **Toast** | $15.00 per chargeback notification | **No.** "Charged regardless of whether you dispute the chargeback, and regardless of whether you win or lose" | [support.toasttab.com](https://support.toasttab.com/en/article/Chargeback-FAQ) | | **Stripe** | $15 to receive the dispute, plus $15 to counter it | The $15 received fee is **never** returned. The countered fee comes back only on an outright win. On a **partial** win neither is returned, so fighting and partly winning costs you $30 | [support.stripe.com](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) | | **Braintree** | $15.00 | Not stated to be refunded | [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | | **PayPal, standard** | $15.00 dispute fee, on PayPal-account and Guest Checkout transactions | **Yes.** Not charged for disputes "Decided in your favor by PayPal or your issuer" | [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) | | **PayPal, high volume** | $30.00, once your dispute ratio hits 1.5% with more than 100 sales in the prior three full calendar months | **No.** The win exemption isn't in this tier's list | [PayPal User Agreement](https://www.paypal.com/us/legalhub/paypal/useragreement-full) | | **PayPal, chargeback fee** | $20.00, on card transactions that went through neither a PayPal account nor Guest Checkout | **No.** Charged "regardless of whether the buyer is successful" | [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) | | **Moneris** | CA$25.00, plus a CA$80.00 "Authorization Chargeback Handling" fee | Not stated | [moneris.com/en/pricing](https://www.moneris.com/en/pricing) | | **Stax** | Optional chargeback protection add-on at $25 per chargeback | Not applicable | [staxpayments.com/pricing](https://staxpayments.com/pricing/) | | **Lightspeed** | **$15**. Its own wording is "a single $15 fee and we will fight tooth and nail to dispute the claim on your behalf", which implies no separate representment charge | Not stated. Confirm in writing | [lightspeedhq.com/payments](https://www.lightspeedhq.com/payments/) | | **Clover** | **Not published at any tier.** Not on the pricing page, the six vertical pages, the FAQ, or in third-party coverage | Unknown | [clover.com/pricing](https://www.clover.com/pricing) | | **Worldpay, Global Payments, Adyen, Checkout.com** | **Not published.** Global Payments says only that "your processor charges you a fee for each chargeback you receive" | Unknown. Ask before you sign | [Global Payments help](https://help.globalpaymentsintegrated.com/1/getting-started/terminology-and-transactions/chargebacks/) | | **Nuvei** | **Per contract.** "The current published fees for each chargeback as listed on Schedule A of the Merchant Application" | Unknown | [Nuvei merchant agreement](https://document.nuvei.com/tos/us/Wells-TOS-MBA-20200206.pdf) | **The whole published US span is $0 to $30.** Nothing on this table reaches $35, let alone the $100 that circulates everywhere. That $100 traces to one undated, unsourced sentence in [Adyen's own marketing article](https://www.adyen.com/knowledge-hub/understanding-chargebacks). Adyen's actual pricing page publishes no dispute fee at all. Three things worth acting on: **Refund-on-win is where processors really differ.** Square charges nothing at all. Helcim charges $0 on a win. Shopify returns the fee. PayPal's standard tier doesn't charge it on a case decided in your favour. Stripe and Toast charge it either way. On a book where you win most disputes, that's a bigger spread than the card rate. **PayPal's two fees don't stack.** The $15 covers PayPal-account and Guest Checkout transactions. The $20 covers card transactions that went through neither. Adding them to $35 is the common error. No PayPal merchant pays $35 on one dispute. **PayPal's 1.5% line is the expensive part.** Above it the fee doubles to $30 and the win exemption disappears. A dispute you win goes from costing $0 to costing $30. That's in the User Agreement. It's the single largest dispute-cost cliff in this table. --- ## Instant Payout Fees Paying to get your money early is one of the most expensive things an SMB does routinely. And the rates moved. | Provider | Instant payout fee | Notes | Source, verified 2026-08-02 | |---|---|---|---| | **Square** | **1.95%** per transfer | Square's help centre: funds move "24 hours a day, 7 days a week, for a 1.95% fee per transfer". No minimum stated | [squareup.com/help](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options) | | **Stripe** | **1.5%** for US, AU, NZ, AE. 1% for CA, EU, UK, SG, NO, HK, MY | Minimum $0.50, maximum $9,999 per payout | [docs.stripe.com/payouts/instant-payouts](https://docs.stripe.com/payouts/instant-payouts) | | **PayPal** | Instant Transfer to bank **1.50%**, $0.50 minimum. Standard Payout 2% capped at $1.00 | Two different products. The cap is the thing to notice: Standard Payout never exceeds $1.00, Instant Transfer keeps scaling | [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) | | **Clover** | **1.75%** per transfer, branded Rapid Deposit | Cheapest published instant payout here | [clover.com/pricing](https://www.clover.com/pricing) | | Braintree, Helcim, Stax, Shopify, Adyen, Toast, Lightspeed, Moneris, Checkout.com | Not published | Ask | See table above | Two figures worth checking against anything else you've read. Square's instant transfer is 1.95%, not 1.5%. And Stripe's US rate is 1.5%, not 1%. The 1% figure is Stripe's **Canadian** rate, mislabelled as US. At $50,000 a month of instant transfers, Square's 1.95% is $975 and Stripe's US 1.5% is $750. Standard payouts cost nothing. --- ## The Vendors That Publish Less Than They Could {/* #the-vendors-that-publish-nothing */} Three of these five publish more than they get credit for. Below is what each one actually publishes, and what to negotiate toward on the parts it doesn't. ### Clover (Fiserv) **What it publishes:** a full vertical-by-vertical rate card. 2.3% + 10c card-present for restaurants and quick service, 2.6% + 10c on entry retail and services plans, 3.5% + 10c keyed and online across every vertical. Software $0 to $129.85. Hardware both outright and on a 36-month subscription. Rapid Deposit at 1.75%. **Where the rates are:** [clover.com/pricing](https://www.clover.com/pricing), and on each of the six vertical pricing pages. **What's structurally true:** the reseller sets your actual rate. **Clover says so on its own pricing page.** "Contract terms and any termination fees can vary based on your service provider, whether Clover Direct or among our trusted partners including Citi, PNC, Wells Fargo." **Ask for, in writing:** who the merchant of record is, Clover Direct or a bank or ISO. Your effective rate on a real month of statements. Confirmation of 3.5% + 10c keyed, since anything above it is markup. The chargeback fee in dollars, the one figure Clover publishes nowhere. The contract term, the auto-renewal, and the **30 days' notice** Clover requires to stop it. Whether hardware is subscribed or bought, and whether you own it at term end. **What to push toward:** Clover's own published direct rates, and an outright hardware purchase. On Clover's published figures the 36-month subscription premium runs **$227 to $3,622** depending on bundle. Its FAQ confirms you don't own the device at the end. ### Toast **What it publishes:** two processing percentages, on its shop pages rather than its pricing page. **2.49% on Traditional and 3.09% on Pay-as-you-Go.** Plans at $0 Starter Kit, $69 Point of Sale restaurant, $90 retail. Its FY2025 10-K adds a 12-to-36 month contract range. It also gives enough data to compute a 2.58% blended gross take on $195.1bn of volume. **Why it looks unpublished:** pos.toasttab.com/pricing says "Simple, flat rate" and then gives no number. The percentages sit on the shop pages instead. **The trap:** Toast publishes only the percentage. The **"+ $0.15" that every comparison attaches is reported, not published**, by NerdWallet and two content sites. Never quote the two as one vendor rate. **Ask for, in writing:** the fixed cents component. The card-not-present rate, which Toast publishes nowhere. Whether the rate can rise during the term, with a written cap. The term, pushing for 12 months since Toast's own filing says 12 is the bottom of its range. The chargeback fee. Hardware price and financing. And whether payments are contractually locked to Toast. **What to push toward:** the plan choice is arithmetic, not judgement. The 0.60 point gap breaks even at about **$11,500/month** ignoring hardware or **$25,300/month** including it. Below that, Pay-as-you-Go, and you own the hardware from day one. Above it, Traditional. And sanity-check any quote against Toast's own 2.58% blended take. Above 3.09% you're above the sticker price of its most expensive published plan. ### Lightspeed **What it publishes:** **2.6% + 10c card-present** for retail (X-Series), a **$15 chargeback fee**, and plan prices for both product lines. Its Q1 FY2027 filing implies a blended take of about 1.90% of processed volume. **Why the "1.5%" figure is wrong:** the string "1.5" appears nowhere on Lightspeed's pricing page. It's an artefact that propagated through comparison content. **What genuinely isn't published:** the online, keyed and card-not-present rates, on either product line, and the processing rate for the restaurant product at all. The restaurant absence is real. It was verified by pattern-searching the rendered page, not assumed. **Ask for:** the online rate, first and hardest. A card-present rate below 2.6% + 10c. Confirmation that $15 is the whole dispute cost with no representment fee. The contract term, billing frequency and ETF. Hardware cost, which matters because Lightspeed says existing terminals can't be reused, "as these have not been injected with the certified firmware". **What to push toward:** below list. Lightspeed's own blended 1.90% take sits well under its 2.6% + 10c US list price. Its payments page lists "Negotiate a competitive rate" as a bullet. The gap is partly European mix and partly larger merchants negotiating. The second one tells you it's available. ### Adyen Adyen publishes **no SMB rate card and no annual volume floor**. It does publish a model. Interchange++ with a **$0.13 processing fee** per transaction and an indicative card markup of 0.60%. Plus this line: "We do not have monthly fees, set-up fees, integration fees or closure fees. We do have a minimum invoice depending on industry or business model." No amount is attached to that minimum. Adyen also caveats its own table: "The fees outlined above are indicative; please get in touch to discuss pricing options." Ignore any Adyen rate table or "$10M/year minimum" you find elsewhere. A minimum *invoice* isn't a volume floor, and Adyen attaches no number to it publicly. **The number Adyen does publish, and it reframes the negotiation:** its own annual report puts the **FY2025 take rate at 17.0 basis points**, up from 15.5 bps in 2024, on EUR 2,364.2M of net revenue over EUR 1,394.3bn of processed volume. H1 2025 was 16.8 bps. Against an indicative 60 bps card markup, **Adyen earns about 28% of its own list price on average.** That's company-wide net revenue over volume, including POS hardware, issuing and FX. So it isn't a rate you can demand. It does tell you 0.60% is an opening position. REPORTED: [Merchant Maverick](https://www.merchantmaverick.com/reviews/adyen-review/), a review site that discloses referral commissions from Adyen, last updated 2024-12-10, puts the minimum invoice at **$120/month or 1,000 transactions/month**. Single-source and roughly 18 months stale. The same source's Amex figure is demonstrably wrong against Adyen's live page. Verify it. **What to push toward:** a markup well under 0.60% at real volume. A minimum invoice you clear in an ordinary month. A volume step-down schedule written into the contract. A written rate review at 12 months. Adyen's published $0 early termination fee is unusual for this tier and worth protecting. ### Checkout.com Offers both a flat-rate and an Interchange++ model, priced "based on your business profile and risk category, nothing else". No numbers published anywhere. **This absence is real, and it's worth distinguishing from the three on this page that aren't.** Checkout.com's pricing page carries no percentage or currency value anywhere in it, hidden or otherwise. Its **full 1,552-URL sitemap** contains only /pricing and two cost-optimization pages, with no fee schedule, rate card or regional pricing page. Third-party coverage is empty too. There is genuinely nothing to find. **Ask for:** which risk category you're in, what its boundaries are, and what moves you across one. Both quotes, flat-rate and Interchange++, modelled against your last 12 months. A sample settlement file showing interchange, scheme fees and markup as three separate lines **before** you sign. **What to push toward:** Interchange++ with an itemised settlement file, a defined risk category with a written path to reprice, and no minimum commitment in year one. Attack the category before the rate. If your chargeback rate, refund rate and MCC sit near a boundary, that's worth more than basis points. ### Global Payments and Nuvei Neither publishes a rate anywhere on its own site, sitemap included. **Global Payments** REPORTED fees, all from Merchant Maverick (review site, discloses referral commissions from Global Payments, updated 2024-11-19): a **$299/year account maintenance fee**, a **$125/month PCI non-compliance fee**, a three-year initial term with automatic one-year renewals, and an ETF of $100 to $500. Single-source, affiliate-compensated and roughly 20 months stale. The PCI fee is the one to interrogate. **It's avoidable.** It's charged when you fail to complete your self-assessment questionnaire, not when you process. A merchant paying it loses $1,500 a year for a form. Ask what triggers it, the deadline, and the submission method, in writing. Then calendar it with a 30-day warning. **Nuvei** publishes nothing and no longer files. It delisted in November 2024. The only anchor left is DERIVED from its final Q2 2024 filing. That's $345.5M of revenue on $61.7bn of volume, or **56.0 basis points blended**. It isn't comparable to Adyen's 17.0 bps. Adyen reports "net revenue" under a specific definition and calls the ratio a take rate. Nuvei reports "revenue", and the word "interchange" appears nowhere in its release. Nuvei's mix also skews to high-risk, high-margin verticals. A low-risk retail merchant should expect nothing like 56 bps. **Ask Nuvei for** the reserve terms above everything else. Rolling, fixed or capped, at what percentage, held how long, and what releases it. A 5-10% rolling reserve held 180 days is a working capital event, not a fee. It's absent from every public source. --- ## Built-In Fraud Tools | Provider | What's included | What costs extra | |---|---|---| | **Stripe** | Radar Lite is included with Stripe Payments at no extra charge | Radar Standard, Plus and Pro are monthly subscriptions with an included screen allowance, or pay-as-you-go from $0.05 per screened transaction. US list: businesses **$10 / $14 / $20** a month; platforms and marketplaces **$20 / $44 / $70** | | **Square** | Automatic ML fraud detection, CVV/AVS checks, velocity checks, card-testing protection | No custom rules engine offered | | **Shopify Payments** | Fraud Analysis indicators per order; Shopify Protect chargeback coverage on eligible Shop Pay orders | Not published | | **Helcim** | Basic AVS/CVV checks | No custom rules engine offered | | **Braintree** | Basic CVV/AVS and duplicate detection | Advanced fraud scoring is an add-on; price not published | | **PayPal** | Seller Protection on eligible transactions; Fraud Management Filters (AVS, CVV, country and amount blocks) | Internal ML scoring isn't merchant-configurable | Source for Radar: [stripe.com/radar](https://stripe.com/radar) and [stripe.com/radar/pricing](https://stripe.com/radar/pricing), verified 2026-08-02. :::warning["Radar for Fraud Teams" no longer exists] The name "Radar for Fraud Teams" appears nowhere on Stripe's Radar page, pricing page or docs as of 2 August 2026. The current tiers are Lite, Standard, Plus and Pro. Any table quoting "$0.02/txn" for Radar for Fraud Teams is pricing something you can't buy. ::: --- ## Understanding Payment Channels Accepting payments usually means supporting three channels plus the software that runs them: - **CP (card-present)**: tap, insert or swipe in person. Lowest fraud, usually the lowest cost. - **CNP (card-not-present)**: online checkout, invoices, payment links. - **Keyed / virtual terminal**: you type the card number. Highest risk, usually the highest cost. - **POS**: your in-person register software and hardware, often bundled with processing. The keyed penalty is real and published. Square charges 2.6% + 15c in person and 3.5% + 15c keyed, a 0.9 point difference on identical money. Stripe adds 0.5% for manual entry. Restrict keyed entry to genuine need. :::tip[For In-Depth Profiles] - [Stripe](/docs/payments/processors/stripe) - Online, SaaS, developers - [Square](/docs/payments/processors/square) - Retail, card-present, non-technical - [Shopify Payments](/docs/payments/processors/shopify-payments) - Shopify stores - [Helcim](/docs/payments/processors/helcim) - Interchange-plus transparency - [Stax](/docs/payments/processors/stax) - Subscription pricing, high-volume savings - [Clover](/docs/payments/processors/clover) - POS hardware, restaurants and retail - [Toast](/docs/payments/processors/toast) - Restaurant-specific POS and processing - [Lightspeed](/docs/payments/processors/lightspeed) - Complex retail, advanced inventory - [Braintree](/docs/payments/processors/braintree) - Cards plus PayPal and Venmo - [PayPal](/docs/payments/processors/paypal) - Brand recognition, trust - [Moneris](/docs/payments/processors/moneris) - Canada's largest processor - [Checkout.com](/docs/payments/processors/checkout-com) - Mid-market global, developer-friendly - [Adyen](/docs/payments/processors/adyen) - Enterprise, global **Or see [Processors Overview](/docs/payments/processors) for the decision framework.** ::: --- ## Small Tickets: The Fixed Fee Is the Whole Story On a $100 sale, a 30c fixed fee is 0.3%. On a $20 sale it's 1.5%. Here's what the published online rates actually cost on a $20 order, sorted cheapest first: | Provider and product | Published online rate | Cost on a $20 order | Effective rate | |---|---|---|---| | Stax (interchange + 15c) | IC + 15c, plus subscription | $0.62 **plus subscription** | 3.11% plus subscription | | Helcim (entry band) | IC + 0.50% + 25c | **$0.82** | **4.11%** | | Braintree | 2.89% + $0.29 | $0.87 | 4.34% | | Square Plus / Premium | 2.9% + 30c | $0.88 | 4.40% | | Stripe (domestic) | 2.9% + 30c | $0.88 | 4.40% | | Square Free | 3.3% + 30c | $0.96 | 4.80% | | PayPal standard card payments | 2.99% + $0.49 | $1.09 | 5.44% | | PayPal Checkout | 3.49% + $0.49 | $1.19 | 5.94% | The interchange-plus rows use this site's [online pass-through assumption](/docs/payments/reference/cost-model-assumptions) of 1.50% + $0.172. Stax's $0.62 needs the monthly subscription amortised on top. Against Helcim it saves 20 cents an order. At the $99 tier that's **495 orders a month**, or $9,900 of volume, before the subscription is earned back. Two things here that the usual version of this table misses. **Helcim wins a $20 order despite the largest fixed component of any interchange-plus option here.** That's 42.2 cents combined against Stax's 32.2 cents. Its percentage is so much lower that the fixed fee never catches up. Only PayPal's two products carry a larger fixed fee, at 49 cents. PayPal Checkout's 49c is the outlier at the other end. At a $20 ticket the fixed fee alone is 2.45%, before the percentage rate applies. Small average order plus a lot of PayPal Checkout volume is where your margin goes. Card-present is where the fixed fee genuinely shrinks. It's also where the Canada-versus-US correction bites. **Shopify Payments charges no per-transaction cents in person in Canada, and 10 cents in the US.** The zero gets quoted as though it held in every market. It doesn't. The *processor's own* card-present fixed fee, in USD: Stripe Terminal 5c, PayPal Zettle 9c, Helcim 8c, Stax 8c, Clover 10c, Shopify 10c, Lightspeed 10c, Square 15c. That isn't the whole fixed cost on an interchange-plus deal. Interchange itself carries a fixed component of about 15.8 cents card-present. An interchange-plus merchant sees it on the statement. A flat-rate merchant pays it invisibly inside the headline rate. Comparing 8c against 15c as though that were the whole picture is one of the commonest ways these tables mislead. --- ## The "Geography Gap" (US vs. EU) {/* #the-geography-gap-us-vs-eu */} When a US company sees a 1.2% rate quoted for Europe, that applies to local-to-local transactions only. | Factor | United States (domestic) | Europe (EEA domestic) | The US SMB reality | |---|---|---|---| | Interchange cap | None. Consumer credit runs 1.51-2.30% + $0.10 card-present, 1.89-2.60% + $0.10 online | Capped at 0.3% credit / 0.2% debit | US rates fund the cashback culture | | Card mix | Heavy rewards and premium | Mostly basic debit and credit | Premium US cards cost more to process | | Cross-border | Adder applies, see below | Adder applies, see below | A US company selling into the EU pays more | ### Cross-Border Adders, As Published | Provider | Cross-border adder | Currency conversion | Source, verified 2026-08-02 | |---|---|---|---| | **PayPal** | +1.50% international | Not separately published | [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) | | **Braintree** | +1% for cards issued outside the US | +1% for non-USD currency | [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | | **Stripe** | +0.8% for international cards | +2% currency conversion | [stripe.com/pricing](https://stripe.com/pricing), CAD-served | | Square, Shopify Payments, Helcim, Stax | Not published | Not published | Ask | **Worked example on fully verified USD numbers.** $10,000 a month, $20 average ticket, so 500 transactions, all online through Braintree: | Scenario | Rate applied | Percentage cost | Fixed cost | Total | |---|---|---|---|---| | US cards, USD | 2.89% + $0.29 | $289 | $145 | **$434** | | Cards issued outside the US, USD | 3.89% + $0.29 | $389 | $145 | **$534** | | Cards issued outside the US, non-USD | 4.89% + $0.29 | $489 | $145 | **$634** | Selling internationally in local currency costs this merchant an extra $200 a month, or 2% of volume, on published rates alone. That's before FX spread on the settlement itself. If most of your revenue is cross-border, that's the number that justifies local acquiring over the domestic card rate. --- ## Choosing by SMB Profile ### "I just need to take payments fast" [Square](/docs/payments/processors/square) for in-person, [Stripe](/docs/payments/processors/stripe) for online. Both are $0 a month with no contract and both get you taking cards today. Be clear about what that speed costs, because it isn't nothing. At $5,000 a month card-present and a $50 ticket, Square is $145.00 and Helcim is $97.30. That's $47.70 a month, or $572 a year, on $60,000 of annual volume. It's a defensible trade for getting paid this week instead of next. Revisit it once you have three months of real statements. ### "I care about lowering cost as I scale" [Helcim](/docs/payments/processors/helcim) first. The markup schedule is published in full, and there's no monthly fee to earn back. That last part is why there's no "scale" threshold to wait for. Helcim beats Square card-present from a **$9.23 ticket** upward, at $5,000 a month exactly as much as at $500,000 a month. Helcim publishes five real bands up to $5M a month and only goes custom above that. So "call us" starts much later than most merchants assume. Two exceptions worth knowing before you commit. If your card-present ticket is small, [PayPal Zettle](/docs/payments/processors/paypal) beats Helcim below about a $19.53 ticket in the entry band, and below about $13.96 in the $500K-1M band. And if your card mix runs to premium rewards or commercial credit, [Square](/docs/payments/processors/square)'s flat rate caps an exposure. Helcim passes it straight through to you. [Stax](/docs/payments/processors/stax) once you're past roughly **$58,000-$70,000/month card-present**, where the crossover falls as your ticket rises. Or **$22,100-$36,200/month online**, where it rises as your ticket rises. That's where the 0% markup outruns the subscription. Both ranges assume Stax's published $199 floor. Above $250,000 a year that's a floor, not a quote. The exception is a $25 online ticket. There Stax's published $99 and $139 tiers beat Helcim from about $11,000 to $12,500 a month, and again from about $15,400 to $20,833. Those two windows are rankable, because both subscriptions are published numbers with a stated ceiling. ### "I'm on Shopify" Use [Shopify Payments](/docs/payments/processors/shopify-payments). Not because the rate is unbeatable. Because Shopify charges a third-party gateway fee on **every order** if you process elsewhere. That's 2% on Basic, 1% on Grow, 0.6% on Advanced, 0.2% on Plus. That fee is the lock-in, not the card rate. Model it before you consider an outside processor. ### "I need restaurant or heavy retail POS" All three publish a card-present rate. [Clover](/docs/payments/processors/clover) Direct is **2.3% + 10c** for restaurants and **2.6% + 10c** for entry retail. [Toast](/docs/payments/processors/toast) is **2.49%** Traditional or **3.09%** Pay-as-you-Go. [Lightspeed](/docs/payments/processors/lightspeed) is **2.6% + 10c** retail. Get quotes from all three anyway. Put them side by side on effective rate, including hardware and software. **Benchmark each quote against that vendor's own published rate.** Any gap is markup. Then use the [question list above](#the-vendors-that-publish-nothing) for the parts none of them publishes. Chargeback fees at Clover and Toast, the online rate at Lightspeed, hardware pricing at Toast. Ask specifically about hardware subscriptions and payments lock-in. That's where these deals get expensive. Clover's own published figures show a 36-month hardware subscription premium of $227 to $3,622, with no ownership at the end. A Toast contract typically prevents switching processors without replacing the POS. ### "I want cards plus PayPal and Venmo in one integration" [Braintree](/docs/payments/processors/braintree). Its 2.89% + $0.29 sits 1.25 cents from Stripe's Canadian figure on a $25 order. Stripe's US rate isn't verified, so there's no cost argument either way. PayPal and Venmo are native rather than bolted on. That's a real difference. Venmo is 3.49% + $0.49. ACH is 0.75% capped at $5, or 1.5% + $0.10 same-day, with a $5 fee on returned or disputed ACH. ### "I'm a Canadian business" [Moneris](/docs/payments/processors/moneris) publishes CAD rates openly. Most Canadian acquirers don't. Budget for the CA$80 authorization chargeback handling fee. It's unusual and easy to miss. Square and Stripe both operate in Canada and suit most Canadian SMBs. ### "I need global acquiring with good APIs" [Checkout.com](/docs/payments/processors/checkout-com) and [Adyen](/docs/payments/processors/adyen) are both quote-only. Neither publishes an SMB rate, and neither publishes a volume floor. Ask both for the pricing model, scheme fee treatment, and any minimum monthly invoice before you spend engineering time. --- ## Other Processors Worth Getting a Quote From None of these publishes a rate we could verify against its own pricing page on 2026-08-02, so this is a list of names only. A stale rate in a comparison table is worse than no rate. It looks checkable and isn't. Use these as a shortlist to request quotes from, then price them yourself with the [3-bid method](/docs/payments/buying-payments/selection#the-3-bid-method). **North America:** Chase Payment Solutions, QuickBooks Payments, Wave, Dharma Merchant Services, National Processing, PaymentCloud, ProPay, Payline Data, Authorize.net (gateway only), BluePay, Worldpay (FIS), Fiserv, Global Payments, Nuvei, Elavon, Shift4, CardConnect, Merchant One, Flagship Merchant Services, Fortis, Paya, Payment Depot, Handpoint, Bank of America Merchant Services, TSYS, SpotOn, NCR Voyix, Gravity Payments. **Europe and UK:** Mollie, SumUp, Tyl by NatWest, Viva.com, Worldpay, Zettle, Payrexx, Nexi, Monei, Epos Now. **Africa:** Paystack, Flutterwave, Yoco, DPO Group, Peach Payments, Interswitch, Remita, M-Pesa, Ozow, Fawry. **Asia-Pacific:** Eway, Airwallex, Razorpay, Tyro, Omise, Xendit, 2C2P, GMO Payment Gateway, HitPay, Till Payments. **Latin America:** dLocal, Mercado Pago, PagSeguro, Conekta, Kushki, EBANX, Stone, Clip, Bold, Niubiz. Expect installments (cuotas) and cash vouchers to be first-class payment methods rather than add-ons. Ask each one for the same five numbers. Effective rate on your actual mix. Per-transaction fixed fee. Monthly and minimum fees. Chargeback fee. Contract term with the early termination clause. --- ## Next Steps **Ready to choose a processor?** 1. [Buying Payments](/docs/payments/buying-payments) - Decision framework for processor selection 2. [Processor Management](/docs/operations/processor-management) - Managing processor relationships 3. [Reading Statements](/docs/operations/reading-statements) - Finding your real blended interchange **Want to understand costs better?** 1. [Interchange Optimization](/docs/payments/interchange-optimization) - Reduce interchange costs 2. [Processor Fees Guide](/docs/payments/processor-fees-guide) - Hidden fee breakdown 3. [Total Cost Model](/docs/payments/total-cost-model) - What payments really cost all-in --- ## Related Pages - [Buying Payments](/docs/payments/buying-payments) - How to evaluate and negotiate - [Payment Methods](/docs/payments/payment-methods) - Cards, ACH, wallets, BNPL - [Going Global](/docs/payments/going-global) - International processing considerations - [Interchange Reference](/docs/payments/reference/interchange) - Interchange rate tables - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - The interchange blend every verdict on this page runs on {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is the cheapest payment processor for small businesses?","acceptedAnswer":{"@type":"Answer","text":"It depends on channel, average ticket and card mix, and any answer given without those conditions is wrong. Comparing an interchange-plus processor against a flat-rate one requires assuming what interchange costs; this site assumes pass-through of 1.03% + $0.178 card-present and 1.50% + $0.172 online, derived from Visa's published US schedule of 18 April 2026 weighted by Federal Reserve transaction counts, and publishes the full derivation. On that assumption, across 24 scenarios covering two channels, three ticket sizes and four monthly volumes, Helcim is cheapest in 20, PayPal Zettle in 3 and Stax in 1. Helcim (interchange + 0.40% + 8 cents at the entry tier, $0 monthly fee) beats Square's flat 2.6% + 15 cents card-present above a $9.23 ticket, at any volume, because neither charges a monthly fee. Below that ticket Square is cheaper than Helcim, and PayPal Zettle at 2.29% + 9 cents is cheaper than every Square plan at every ticket size. Square's flat rate also wins outright when your card mix is heavy in premium rewards or commercial credit, where interchange itself runs 2.1 to 2.3 percent. Stax (interchange + 0% markup + 8 cents on a subscription priced by annual volume) overtakes Helcim card-present at roughly $58,000 to $70,000 a month depending on ticket, and online at roughly $22,100 to $36,200 a month, but only at its published $199 floor, which is a floor and not a quote above $250,000 a year. At a $25 online ticket there are two earlier windows on Stax's published $99 and $139 tiers, from about $11,000 to $12,500 a month and again from about $15,400 to $20,833, with Helcim cheaper in the gap between them. All rates verified against each vendor's own pricing page on 2 August 2026."}},{"@type":"Question","name":"Stripe vs Braintree: which is cheaper?","acceptedAnswer":{"@type":"Answer","text":"Neither, in any way that matters domestically. Braintree publishes 2.89% + $0.29 for cards and digital wallets and Stripe publishes 2.9% + $0.30, both in USD, both read from a US connection. The gap is 0.01% plus one cent, which is 1.25 cents on a $25 order and about six cents on a $500 order, so there is no breakeven ticket size to calculate. Internationally there is a real difference: Braintree adds 1% for cards issued outside the US where Stripe adds 1.5%, and that half a percentage point is fifty times the domestic gap. Otherwise choose on features: Braintree gives you native PayPal and Venmo acceptance, and Stripe gives you a broader product surface and documentation. Both charge a $15 chargeback fee, though Stripe charges a further $15 to counter a dispute and returns neither fee on a partial win."}},{"@type":"Question","name":"What is interchange-plus pricing?","acceptedAnswer":{"@type":"Answer","text":"Interchange-plus pricing passes the actual interchange fee set by the card networks directly through to the merchant, and adds a published markup from the processor. Flat-rate pricing charges one blended rate and lets the processor keep the difference. Neither can be ranked against the other without assuming a card mix, because interchange is a cost the interchange-plus processor does not control. Interchange-plus is cheaper whenever your real interchange plus network assessments plus the markup is below the flat rate, which for most SMBs taking consumer debit and credit is most of the time above a small ticket. When comparing, make sure network assessments are counted on the interchange-plus side, since a flat-rate merchant pays them invisibly inside the headline rate. Helcim publishes five interchange-plus bands from interchange + 0.40% + 8 cents in person down to interchange + 0.15% + 6 cents, keyed to monthly volume, and only quotes custom pricing above $5 million a month. Stax passes interchange through with no percentage markup at all, charging 8 cents per card-present transaction plus a monthly subscription priced by annual volume."}},{"@type":"Question","name":"Which processors do not publish their rates?","acceptedAnswer":{"@type":"Answer","text":"As of 2 August 2026, Checkout.com, Global Payments and Nuvei publish no processing rate at all: Checkout.com's pricing page and all 1,552 URLs in its sitemap contain no percentage or currency figure, and Global Payments' US payments page contains no pricing figure either. Nuvei delisted in November 2024 and no longer files, so the only public anchor is a derived 56 basis point blended rate from its final Q2 2024 filing. Adyen publishes a model rather than a rate: Interchange++ plus a $0.13 processing fee with an indicative 0.60% card markup, which it labels indicative, plus a minimum invoice with no amount attached, and it has no $10 million annual volume floor. Adyen does publish its own company-wide take rate of 17.0 basis points for FY2025, which shows the indicative markup is an opening position. Several vendors widely reported as publishing nothing do publish rates: Clover publishes 2.3% + 10c card-present for restaurants, 2.6% + 10c for entry retail and 3.5% + 10c keyed; Toast publishes 2.49% on Traditional pricing and 3.09% on Pay-as-you-Go, on its shop pages rather than its pricing page, though the widely quoted 15 cent fixed component is reported by third parties rather than published by Toast; Lightspeed publishes 2.6% + 10c card-present and a $15 chargeback fee; and Stripe and Shopify Payments both resolve country by request IP, so their US rates are readable only from a US connection. Chargeback fees remain unpublished at Clover, Toast, Shopify Payments, Adyen and Checkout.com. For any quote-only vendor, ask for the effective rate on your actual mix, the chargeback fee, the contract term and early termination fee, and whether hardware is subscribed or purchased."}},{"@type":"Question","name":"Which payment processor has the lowest chargeback fee?","acceptedAnswer":{"@type":"Answer","text":"Helcim, which charges $0 for a dispute resolved in your favour and $15 if you lose. That is the only win-is-free policy verified here. Stripe charges $15 to receive a dispute, never refunded, plus $15 to counter it, refunded only on an outright win and not on a partial win, so fighting and partially winning costs $30. Braintree charges $15. Shopify Payments charges $15 in the US and returns it if you win. Toast charges $15 win or lose. PayPal charges a $15 dispute fee on PayPal-account and Guest Checkout transactions, waived when the case is decided in your favor, or a $20 chargeback fee on card transactions that went through neither; the two are alternatives and never both apply to one dispute, and the dispute fee doubles to $30 with no win exemption once your dispute ratio reaches 1.5% with more than 100 sales in the prior three months. Moneris charges CA$25 plus a CA$80 authorization chargeback handling fee. Square charges $0 and states so outright: there are no fees for dispute management services for chargebacks. Authorize.net publishes $0.00 for card chargebacks and $25.00 for eCheck.Net, but that is the gateway fee only. The full published US range is $0 to $30; no US processor publishes a dispute fee above $30. Lightspeed publishes $15 and describes it as a single fee covering the defence, with no separate representment charge, which would place it between Helcim and Stripe. Clover, Toast, Shopify Payments, Adyen and Checkout.com publish no dispute fee at any tier. Clover and Toast are the notable ones, because both publish full processing rate cards and still show no dispute line. All verified against vendor pricing pages on 2 August 2026."}}]})} --- ## Processor Fees Guide Source: https://paymentsandrisk.com/docs/payments/processor-fees-guide # Processor Fees Guide :::info[TL;DR] - Your effective rate is total fees divided by total volume. It's the only number worth tracking. Everything else is a piece of it - A monthly PCI *compliance* fee runs $15-50. A PCI *non-compliance* penalty runs $50-150. Both are usually removable - Monthly minimums and statement fees are negotiable at most traditional processors. Audit them yearly - The exit clause is the priciest hidden term. Flat early termination runs $200-500. Liquidated damages can hit five figures - Junk fees add $20-100/month. PCI, statement and settlement funding fees are the common ones. Ask for itemized removal when you negotiate ::: You're almost certainly paying two or three fees that buy you nothing. Finding them takes twenty minutes with one statement and a calculator. The fix is usually a phone call, not a switch. :::info[If You're on Stripe, Square, or Shopify Payments] These are payment facilitators (PayFacs). The pricing is fixed and published. You can't negotiate individual rates until you're processing $1M+/month. At that point, call their enterprise sales team. **What you CAN do:** - Check you're on the right plan. Stripe's volume discounts start around $1M/year - Make sure you're not paying for features you don't use - Compare your effective rate to the published rate. If yours is higher, something incidental is dragging it up. Usually PCI non-compliance or chargeback fees The negotiation and contract sections below are for traditional processors with custom pricing. On a PayFac under $1M/month, skip them. ::: ## Why Processors Can Get Away With This The sales model creates the problem. Reps earn commission on the spread. That's the gap between what they quote you and what they actually pay in [interchange](/docs/payments/interchange-optimization). The wider the gap, the more they make. So they're motivated to: 1. Quote you a low "qualified" rate that few transactions actually hit 2. Bury extra fees in the contract you won't read 3. Use pricing models that obscure the true cost On the [issuer](/docs/fraud/issuer-perspective) side, we see the interchange that actually moves through the network. Compare that to what merchants tell me they pay. The markup is often shocking. Say a merchant runs an effective rate of 3.2%. The card mix should cost 1.9% in interchange. That's 1.3% of pure margin handed to the processor. --- ## Fees That Shouldn't Exist Some fees are real cost recovery. Others are pure profit in an official-sounding costume. ### PCI Compliance/Non-Compliance Fees [PCI DSS](/docs/compliance/pci-dss) compliance is a real requirement. The fee usually isn't. If you use their approved terminal or gateway, you're probably already compliant. The compliance fee is a monthly charge for nothing. The non-compliance fee is worse. It runs $50-150/month, against $15-50 for the plain compliance fee. It's a penalty for skipping a questionnaire. And the questionnaire certifies what's already true. **Ask your processor:** "What specific PCI services does this fee cover?" If they can't answer concretely, it's a junk fee. ### Statement Fees You pay $10-25/month for a record of the charges you're already paying. Think about that. They're charging you to see what they charge you. ### Monthly Minimums Fall short on processing fees in a month and you pay a penalty. That's fair on a dormant account. But some contracts set the minimum high enough to punish a slow month. Seasonal businesses get hit hardest. ### The Double-Dip: Auth Fees Plus Transaction Fees This one makes me angry. Some processors charge you at authorization AND again at settlement. They show up as separate line items. An "authorization fee" and a "transaction fee." Two names, one transaction. You're paying twice for one trip down the same pipes. If your statement shows both, ask why. There's no technical reason for it. ### Settlement Funding Fees This one's newer. Processors have started charging a percentage to move your money into your bank account. A fee for giving you your own money. There's no cost basis for it. [Settlement](/docs/payments/settlement) runs automatically, on rails that already exist. ### Early Termination and Liquidated Damages Standard early termination fees run $200-500. Annoying, but understandable. **Liquidated damages clauses are predatory.** They total what the processor would have earned over the rest of the term. Then they bill you that. On a 3-year contract with 2 years left, that's tens of thousands of dollars. **Read your contract.** If you see "liquidated damages," negotiate it out before signing. --- ## How to Read Your Statement Like a Fraud Analyst Read your statement the way you'd read a suspicious transaction. ### Calculate Your Effective Rate Every Month ``` Total fees charged / Total volume processed = Effective rate ``` On interchange-plus, two numbers matter. Above **2.5% card-present retail**, something's probably wrong. Above **3.0% for e-commerce**, same. Aggregator pricing is a different animal. Stripe is 2.9% + $0.30. Square runs 2.6-3.3% by plan. PayPal is 3.49% + $0.49. There, a 3.0-3.5% effective rate is normal, and it moves with your average ticket. That's the price of simple pricing. It's the model you chose, not a problem to fix. ### Look for Rate Creep Compare this month's effective rate to last month's. Small increases go in quietly, hoping you won't notice. A 0.1% bump on $100K monthly volume is $100/month. That's $1,200 a year. ### Identify Every Line Item Make a list of every fee on your statement. For each one, ask: - What service does this pay for? - Is this a pass-through cost (interchange, assessments) or processor markup? - Did this fee exist when I signed up? ### Watch for New Fees Appearing Fees get added mid-contract. They arrive buried in statement messages or mailed notices. Any fee that wasn't in your original agreement is negotiable. Call and say so. ### Question Vague Descriptions "Miscellaneous fee," "service charge," "regulatory fee," "network access fee." These generic names often hide pure markup. Demand specifics. --- ## Questions to Ask Before Signing Ask these on the call, not by email. Write down the answers: 1. **"Show me the math on a $100 Visa Signature card-not-present transaction."** (Forces the real numbers into the open.) 2. **"Which fees can change during the term, and when?"** (Get this in writing.) 3. **"If interchange rates go down, will my rates go down too?"** (Most processors pocket the difference.) 4. **"What will my effective rate be, not my qualified rate?"** (Qualified rates are meaningless if nothing qualifies.) 5. **"Can I see a sample statement from a similar merchant?"** (See what fees actually appear.) 6. **"What's the process if I find an error on my statement?"** (Tests whether they have real support.) 7. **"Who owns the merchant account if I want to switch processors?"** (Some processors make portability difficult.) --- ## Finding Honest Processors They exist. Look for: - **Interchange-plus pricing with full disclosure**: You see exact interchange, exact assessments, exact markup. No mystery. - **Month-to-month contracts**: A processor confident in its service doesn't need a lock-in. - **No PCI fees, no statement fees**: These are pure junk. Good processors don't charge them. - **Transparent rate schedules**: Published pricing you can verify. - **Willingness to explain every line item**: Ask about one. If they get defensive, walk away. The industry is getting more transparent, slowly. Newer processors compete on service instead of obfuscation. But slowly means you still have to protect yourself. --- ## Red Flags in Processor Contracts | Red Flag | Why It's Bad | |----------|--------------| | "Qualified," "Mid-qualified," "Non-qualified" tiers | Obscures true cost; most transactions downgrade | | Liquidated damages clause | Could cost thousands to exit | | Auto-renewal with rate increase | Locks you in at worse terms | | PCI non-compliance fee | Usually a junk fee | | Both auth fees AND transaction fees | You're paying twice | | Vague fee descriptions | Hiding markup | | Long-term contract (3+ years) | Reduces your negotiating leverage | --- ## Annual Fee Audit Checklist Run this audit every year, or when switching processors: - [ ] Calculate monthly effective rate for past 12 months - [ ] Identify rate trends (increasing, stable, decreasing) - [ ] List every fee line item and its purpose - [ ] Flag any fees added mid-contract - [ ] Calculate what you'd pay at interchange-plus pricing - [ ] Get 2-3 competitive quotes - [ ] Review contract termination terms before negotiating --- ## Next Steps **Auditing current fees?** 1. [Calculate effective rate](#calculate-your-effective-rate-every-month) - Total fees / volume 2. [Identify junk fees](#fees-that-shouldnt-exist) - PCI, statement, settlement 3. [Run annual audit checklist](#annual-fee-audit-checklist) - 12-month review **Evaluating new processors?** 1. [Ask the right questions](#questions-to-ask-before-signing) - Force transparency 2. [Watch for red flags](#red-flags-in-processor-contracts) - Tiered pricing, liquidated damages 3. [Find honest processors](#finding-honest-processors) - Interchange-plus, no junk fees **Reading statements like an analyst?** 1. [Look for rate creep](#look-for-rate-creep) - Month-over-month comparison 2. [Identify every line item](#identify-every-line-item) - Pass-through vs markup 3. [Question vague descriptions](#question-vague-descriptions) - Demand specifics --- ## See Also - [Understanding Payment Processing Fees](/docs/learning-pathways/getting-started-with-payments/understanding-fees) - The Guide's plain-English version, if fees are new to you - [Buying Payments](/docs/payments/buying-payments) - Choosing the right processor - [Interchange Optimization](/docs/payments/interchange-optimization) - Reducing interchange costs - [Settlement & Reconciliation](/docs/payments/settlement) - Understanding money flow - [Reading Statements](/docs/operations/reading-statements) - Statement interpretation guide - [Processor Management](/docs/operations/processor-management) - Managing processor relationships --- ## Adyen Source: https://paymentsandrisk.com/docs/payments/processors/adyen # Adyen :::info[TL;DR] - **Adyen doesn't publish SMB rates.** There's no rate card. What it publishes is a model: Interchange++ plus $0.13 a transaction, with an indicative card markup of 0.60% - **No volume floor either.** There's no $10 million a year minimum on Adyen's pricing page. That number was invented. It's gone from this page - Adyen says it charges no monthly, set-up, integration or closure fee. But it does have "a minimum invoice depending on industry or business model," with no amount attached. Get that number in writing before you integrate - **The markup comparison splits by channel.** Card-present, Adyen's indicative 0.60% + $0.13 is higher than every published [Helcim](/docs/payments/processors/helcim) band. Higher percentage, higher cents. It costs more at every ticket size. **Online it depends on your ticket.** Adyen's 13 cents undercuts Helcim's 25. So Adyen comes in lower than Helcim's entry online band below a **$120** ticket, higher above it - Adyen's case is local acquiring across many markets. That saving lands in the interchange line, not the markup line - **Adyen publishes its own take rate. It's the most useful number available.** 17.0 basis points for FY2025, up from 15.5 bps in 2024, in its own annual report. Set that against an indicative 60 bps card markup. **Adyen earns about 28% of its own list price on average.** So 0.60% is an opening position, not a rate - The minimum invoice is REPORTED at $120 a month or 1,000 transactions a month. One affiliate-compensated source says so, and it gets Adyen's Amex rate demonstrably wrong. Treat it as a hypothesis, not a figure - Asked about Adyen: expect Interchange++ plus $0.13. Ask for the minimum monthly invoice. Don't assume the rate beats a transparent domestic processor ::: If you're weighing Adyen, you've already found there's no price to look up. Below is what Adyen does publish. Plus what its own annual report says about the rate its average customer pays. Adyen's case is one platform with local acquiring in many countries. It isn't a cheaper domestic rate. :::note[Rate verification] Everything on this page about Adyen's pricing was read from [adyen.com/pricing](https://www.adyen.com/pricing) on **2 August 2026**. Adyen caveats its own table: "The fees outlined above are indicative; please get in touch to discuss pricing options." Treat every number here as a starting point for a conversation, not a rate card. ::: ## When to Use Adyen **Adyen is worth a conversation if:** - You sell in many countries and want local acquiring rather than cross-border processing - You want one platform across online, in-store, and mobile with unified reporting - You have a development team and months of runway for an integration - Your auth rates are being hurt by cross-border routing **Skip Adyen if:** - You want a published price you can check before talking to anyone - You're single-market. A domestic interchange-plus processor will be cheaper and simpler - You don't have developers - You need to be live in weeks --- ## What Adyen Actually Publishes ### The Pricing Model ``` Total = Interchange + Scheme Fees + Adyen's Processing Fee + Adyen's Payment Method Markup ``` | Component | What Adyen publishes | |-----------|---------------------| | **Processing fee** | **$0.13 per transaction** | | **Indicative card markup** | **0.60%** | | **Interchange** | Passed through. Set by the networks | | **Scheme fees** | Passed through. Set by the networks | Source: [adyen.com/pricing](https://www.adyen.com/pricing), verified 2 August 2026. ### Published Payment Method Prices VENDOR Every transaction carries the $0.13 processing fee. What sits on top of it varies enormously by method: | Method | Published price | |--------|-----------------| | **Visa, Mastercard, Maestro** | $0.13 + Interchange++ + 0.60% | | **Amex Global** | $0.13 + 3.95% | | **Alipay** | $0.13 + 3% | | **Klarna, US and Canada** | $0.13 + 4.29% + $0.30 | | **SEPA Direct Debit** | $0.13 + EUR 0.27 | | **PayPal** | $0.13 + your direct PayPal contract + a management service fee | Source: [adyen.com/pricing](https://www.adyen.com/pricing), verified 2 August 2026. Look at the shape of that list before the numbers. Alipay is percentage-heavy. SEPA Direct Debit is effectively flat. Klarna carries a high percentage and a fixed fee. **Your effective rate depends entirely on your method mix.** Get the full method-by-method schedule from sales before you model anything. ### Fees and Minimums | Item | Status | Tier | |------|-----------------|------| | **Monthly fee** | None | VENDOR | | **Set-up fee** | None | VENDOR | | **Integration fee** | None | VENDOR | | **Closure fee** | None. A published $0 early termination fee is genuinely unusual in this tier of the market and is worth protecting in the contract | VENDOR | | **Minimum invoice** | Exists. Adyen: "We do have a minimum invoice depending on industry or business model." Adyen attaches no amount to it | VENDOR | | **Minimum invoice, amount** | **$120 a month or 1,000 transactions a month** | REPORTED | | **Annual volume floor** | No minimum volume requirement appears anywhere on Adyen's pricing page | VENDOR | | **Take rate, company-wide** | **17.0 bps FY2025**, 15.5 bps 2024, 16.8 bps H1 2025 | VENDOR | | **Dispute or chargeback fee** | Not published on the pricing page, not in the annual report, and no credible third party publishes one | NOT PUBLISHED | | **Instant payout** | Not published | NOT PUBLISHED | | **FX spread** | Not published | NOT PUBLISHED | :::warning[The $120 minimum invoice is a single weak source, and we're saying so] The only figure available comes from [Merchant Maverick](https://www.merchantmaverick.com/reviews/adyen-review/), last updated 2024-12-10. That site **discloses it earns referral commissions from Adyen**. It reports "$120/month or 1,000 transactions/month". Two reasons to treat that as a hypothesis. It's roughly 20 months stale. And **the same source's Amex rate, $0.13 + 3.3% + $0.10, is demonstrably wrong.** Adyen's live page says $0.13 + 3.95%. A source that gets one checkable number wrong doesn't earn trust on an uncheckable one. It's here anyway, tagged. For a small merchant deciding whether to start a sales conversation, $120 a month and $12,000 a month are very different answers. Verify it in writing before you act on it. ::: ### Adyen's Own Take Rate VENDOR This number reframes the whole negotiation. It's in Adyen's own reporting, not anyone's estimate. | Period | Net revenue | Processed volume | Take rate | |---|---|---|---| | **FY2025** | EUR 2,364.2M (+18%) | EUR 1,394.3bn (+8%) | **17.0 bps** | | FY2024 | - | - | 15.5 bps | | **H1 2025** | EUR 1,093.5M | EUR 649.0bn | **16.8 bps** | | H2 2024 | - | - | 16.2 bps | | H1 2024 | - | - | 14.7 bps | FY2025 EBITDA was EUR 1,245.7M on a 53% margin. POS volume was EUR 310.9bn, 22% of the total. Arithmetic check on the published inputs: EUR 1,093.5M / EUR 649.0bn = 16.85 bps, and EUR 2,364.2M / EUR 1,394.3bn = 16.96 bps. Both reconcile. :::note[What the take rate is, and what it isn't] **It's company-wide net revenue over processed volume.** It includes POS hardware, issuing, platform fees and FX. That isn't one merchant's card markup. You can't walk into a negotiation demanding 17 basis points. **What it does tell you** is the direction and scale of the gap. Adyen's indicative card markup is 60 basis points. Its blended realized take across its whole book is 17. Whatever the mix effects, a merchant paying the full 0.60% pays multiples of Adyen's average customer. Say that in a pricing conversation. It's from Adyen's own annual report, not an inference. ::: :::warning[Numbers attached to Adyen that Adyen doesn't publish] A tiered rate table: 1.8-2.2% at $10M-$50M a year, 1.2-1.8% at $50M-$250M, and so on. A "$10M/year minimum." A setup fee of $0 to $50,000. A monthly platform fee of $0 to $10,000. A roughly EUR 25 dispute fee. Per-authorization fees of $0.01 to $0.05. **None of it appears on Adyen's pricing page.** Two specific corrections matter most: 1. **There's no $10 million a year minimum.** Adyen publishes no volume floor at all. Nothing on its site says it'll reject you below $10M a year. 2. **A minimum invoice isn't a volume floor.** Adyen does say it has a minimum invoice depending on industry and business model. It attaches no number to it publicly. Those are different things. Conflating them produces a made-up threshold. ::: --- ## The Comparison Nobody Runs: Adyen's Indicative Markup vs Published Alternatives Adyen's indicative card markup is 0.60% + $0.13. Compare that number. Interchange and scheme fees pass through the same for everyone. You can't rank a percentage against a fixed fee without a ticket size. Adyen's shape is unusual: a **higher percentage than Helcim in every band, and a lower fixed fee than Helcim charges online**. So the answer flips at a ticket size. And it flips in a different place in each band. | Processor | Published markup over interchange | Basis | |-----------|-----------------------------------|-------| | **Adyen** | 0.60% + $0.13 (indicative, negotiable) | [adyen.com/pricing](https://www.adyen.com/pricing) | | **[Helcim](/docs/payments/processors/helcim)**, $0-50K/month online | 0.50% + $0.25 | [helcim.com/pricing](https://www.helcim.com/pricing/) | | **Helcim**, $100K-$500K/month online | 0.35% + $0.20 | Same | | **Helcim**, $1M-$5M/month online | 0.15% + $0.15 | Same | | **Helcim**, $0-50K/month card-present | 0.40% + $0.08 | Same | | **Helcim**, $1M-$5M/month card-present | 0.15% + $0.06 | Same | | **[Stax](/docs/payments/processors/stax)** | **0% + $0.15** online, **0% + $0.08** card-present, plus a monthly subscription | [staxpayments.com/pricing](https://staxpayments.com/pricing/) | All verified 2 August 2026. ### Card-present: Adyen's indicative markup is higher, at every ticket Card-present, Helcim charges 8 cents at the bottom band and 6 cents at the top. Both sit under Adyen's 13 cents. Its percentage is under Adyen's 0.60% in every band too. Adyen loses on both components, so no ticket size rescues it. Markup cost per transaction: | Ticket | Adyen indicative | Helcim entry band | Helcim $1M-$5M band | |---|---|---|---| | **$15** | $0.22 | **$0.14** | **$0.08** | | **$50** | $0.43 | **$0.28** | **$0.14** | | **$150** | $1.03 | **$0.68** | **$0.29** | ### Online: it depends on your average ticket Online, Helcim's fixed fee runs 25 cents down to 15 cents. All of that sits above Adyen's 13 cents. So Adyen's indicative markup wins at small tickets and loses at large ones. The crossover falls in a different place in each band. | Ticket | Adyen indicative | Helcim entry band | Helcim $100K-$500K | Helcim $1M-$5M | |---|---|---|---|---| | **$25** | **$0.28** | $0.38 | $0.29 | **$0.19** | | **$75** | $0.58 | $0.63 | **$0.46** | **$0.26** | | **$200** | $1.33 | **$1.25** | **$0.90** | **$0.45** | **Where each crossover falls:** | Helcim online band | Adyen's indicative markup is lower below a ticket of | |---|---| | $0-50K/month, 0.50% + $0.25 | **$120.00** | | $50K-100K/month, 0.45% + $0.20 | **$46.67** | | $100K-500K/month, 0.35% + $0.20 | **$28.00** | | $500K-1M/month, 0.25% + $0.15 | **$5.71** | | $1M-5M/month, 0.15% + $0.15 | **$4.44** | Read the pattern. The more volume you do, the less Adyen's low fixed fee rescues its high percentage. Helcim's percentage keeps falling. Adyen's doesn't. ### And Stax isn't automatically cheaper either Stax charges no percentage. That sounds decisive and isn't. The subscription is a fixed cost you have to spread over your transactions. Take the top of Stax's published range, $20,833 a month on the $139 tier. Markup per transaction is about **$0.32** at a $25 online ticket, **$0.65** at $75 and **$1.49** at $200. Adyen's indicative figures are $0.28, $0.58 and $1.33. So on published numbers Adyen comes in **lower** in all three. Card-present it's mixed. Stax is lower at $15 and $50, Adyen at $150. Stax only clearly undercuts Adyen once the subscription spreads across far more volume. That happens above $250,000 a year. Which is exactly where Stax stops publishing what the subscription costs. **The conclusion, stated narrowly.** Adyen's indicative markup is higher than Helcim's card-present at every ticket. Online it's higher above a ticket that runs from about $4.44 to $120, depending on the band. Against Stax it's lower in most cells we can check. That's a narrower claim than "highest of the group," and it's the one the arithmetic supports. None of that makes Adyen a bad choice. It means **Adyen's argument isn't price in a single market.** Adyen's argument is: - Local acquiring in many countries. It moves an international transaction from cross-border interchange to domestic. That saving lands in the interchange line, not the markup line. It can dwarf a markup gap of a fifth of a point - One integration and one reconciliation across online, in-store, and mobile - Routing and optimization that lifts auth rates US-only and card-present? A transparent domestic processor wins on published numbers at every ticket size. Make Adyen prove otherwise with a quote. US-only online with a small average ticket? The markup comparison is close on the indicative figure. The minimum invoice Adyen won't publish is what decides it. Selling in fifteen countries through a US acquirer? The local-acquiring saving is worth more than any of this. Adyen's case is strong. --- ## What Adyen Does Well ### 1. Local Acquiring Across Many Markets This is the actual product. When a customer in a market pays a merchant through an acquirer in that market, interchange is domestic. Route the same transaction cross-border and it costs materially more. Adyen holds acquiring licenses in many markets and routes accordingly. For a real multi-market business, this is where the money is. No amount of markup shopping with a domestic processor replicates it. ### 2. Unified Commerce Online, in-store and mobile on one platform. One set of reporting, one reconciliation. Run separate processors per channel today and the operational saving is real. It rarely shows up in a rate comparison. ### 3. Enterprise Reliability Multi-region redundancy, real-time failover, and an uptime posture built for businesses where an outage is measured in lost revenue per minute. ### 4. Revenue Optimization Smart routing, network tokenization, local scheme optimization, retry logic. These lift authorization rates. An auth rate point usually beats a markup basis point. --- ## What Adyen Does Poorly ### 1. You Can't Price It Without a Salesperson Adyen publishes a model and a handful of payment-method prices. It doesn't publish card rates, dispute fees, or the minimum invoice. You can't build a business case from public information. That's a real cost when you're comparing options. ### 2. The Minimum Invoice Is Undisclosed Adyen confirms a minimum invoice exists. It won't publish the number. For a smaller merchant that's the most important line in the contract. It sets your floor cost whatever your volume. **Ask for it in writing, in dollars, before any integration work starts.** ### 3. Complex Setup Adyen isn't plug-and-play. Expect a real integration project with experienced developers, a certification process for card-present, and admin portal training. Stripe is days. No dollar range for that integration is published anywhere. Get it scoped by whoever would build it. ### 4. Rigid Contracts Multi-year commitments, volume minimums, early termination clauses, auto-renewal. All common at this tier. None of the specifics are published. Read the contract, not an article. --- ## Pricing Comparison (Adyen vs Alternatives) | Processor | What you can look up before a sales call | Setup | Min volume | |-----------|------------------------------------------|-------|------------| | **Adyen** | Model only: IC++ plus $0.13, indicative 0.60% markup | Months | Not published | | **[Checkout.com](/docs/payments/processors/checkout-com)** | Nothing. Quote-only | Weeks | Not published | | **[Stripe](/docs/payments/processors/stripe)** | Full flat-rate card. No volume schedule published | Days | Not published | | **[Helcim](/docs/payments/processors/helcim)** | Full markup schedule across five volume bands | Days | None | | **[Stax](/docs/payments/processors/stax)** | Full subscription and per-transaction schedule | Days | Not published | | **[Square](/docs/payments/processors/square)** | Full rate card | 15 minutes | None. Custom pricing invited above $250K/year | All verified 2 August 2026 from each vendor's own pricing page. **Verdict:** Adyen and Checkout.com are the two on this list you can't evaluate without talking to sales. That's a real cost of considering them. Weigh it against the local-acquiring benefit instead of ignoring it. --- ## Who Adyen Is Best For ### Perfect Fit | Business Type | Why Adyen Wins | |---------------|-----------------| | **Global marketplaces** | Split payments plus local acquiring across many seller markets | | **Multi-country e-commerce** | Domestic interchange instead of cross-border, in each market | | **Omnichannel retail** | Online and physical stores on one platform | | **Travel and hospitality** | Complex auth flows, multi-currency, global reach | | **Gaming and streaming** | Global audience, many alternative payment methods | **Common trait:** genuine multi-market operations with a technical team. Not "large" on its own. A large single-market merchant is usually better served by a transparent domestic processor. ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **US-only card-present, any size** | [Helcim](/docs/payments/processors/helcim). Published rates, lower markup at every ticket, no sales cycle | | **US-only online, ticket above about $120** | Helcim. Above that ticket its entry band beats Adyen's indicative markup, and its higher bands beat it from a far lower ticket | | **US-only online, small ticket** | Still probably Helcim or [Stax](/docs/payments/processors/stax), but on markup alone Adyen's indicative figure is competitive here. The deciding number is the undisclosed minimum invoice, so get it first | | **SMBs** | [Stripe](/docs/payments/processors/stripe) or [Square](/docs/payments/processors/square) | | **Anyone who needs a price today** | Anything on this site with a published rate card | | **Non-technical** | Square, PayPal | --- ## Common Gotchas ### 1. The Minimum Invoice Adyen has no monthly fee. It does have a minimum invoice. If your volume is modest, that minimum **is** your price. And it's the number Adyen doesn't publish. Ask two things, not one. **"What is the minimum monthly invoice in dollars? And does the $0.13 processing fee count toward it?"** The second one decides whether a merchant doing 800 transactions a month clears the minimum on processing fees alone. Or pays a shortfall on top. The one reported figure is $120 a month or 1,000 transactions a month. It comes from a single affiliate-compensated source, roughly 20 months stale, that gets Adyen's Amex rate wrong. Get your own number. ### 2. "Indicative" Cuts Both Ways Adyen's own words: "The fees outlined above are indicative; please get in touch to discuss pricing options." The 0.60% card markup isn't a rate you're entitled to. It's an illustration. Nor is it **a rate you should accept.** Adyen's own annual report puts its blended take at 17 basis points, against that 60 basis point illustration. Indicative means the number moves down as well as up. Adyen's own reporting says which direction its average customer ends up in. **What to push toward:** a markup well under 0.60% at real volume, a minimum invoice you clear in an ordinary month, a volume step-down schedule written into the contract rather than promised verbally, and a written rate review at 12 months. ### 3. Payment Method Pricing Varies Widely Alipay is $0.13 + 3%. SEPA Direct Debit is $0.13 + EUR 0.27. Klarna in the US and Canada is $0.13 + 4.29% + $0.30. Amex Global is $0.13 + 3.95%. One is percentage-heavy, one is effectively flat, one is both. Your effective rate depends entirely on your method mix. Get the full method-by-method schedule from sales before you model anything. Note the Amex line. 3.95% is Adyen's own published figure. The affiliate-compensated source circulating a lower 3.3% + $0.10 is wrong against the live page. ### 4. Does the $0.13 Apply to Declines? Adyen publishes a $0.13 per-transaction processing fee. Does it cover declined attempts, retries and fraud-screening auths? The pricing page doesn't say. Per-attempt billing is common at this tier, and it surprises merchants coming off flat-rate. **Ask explicitly.** Get the answer in the contract. ### 5. Multi-Currency Adds Operational Cost Settlement currency affects fees. Cross-currency conversion carries a markup. Reporting is per-currency. Budget finance team time, not just developer time. --- ## Test to Run **Adyen evaluation, without a rate card:** **Question 1: Is your problem actually cross-border?** - What share of your volume is processed cross-border today? ____% - What is your auth rate on that volume against your domestic auth rate? ____ - Under about 20% on the first question? Adyen's core advantage barely applies. Compare domestic processors instead **Question 2: What does the minimum invoice cost you?** - Ask Adyen for the minimum monthly invoice in dollars, in writing - Divide it by your monthly volume. That gives your floor rate before a single basis point of processing - If that number alone is worse than [Helcim's published band](https://www.helcim.com/pricing/) for your volume, stop here **Question 3: What is the full method-by-method schedule?** - Ask for every payment method you'd use, with the percentage and the fixed component - Model your actual method mix. Don't model on the 0.60% indicative card markup alone **Question 4: Technical readiness** - Developers available for a multi-month integration: ___ - Is card-present certification in scope, and what is its timeline? **Question 5: The comparison that decides it** - Build the same model for Adyen and for one transparent domestic processor - Include the local-acquiring interchange saving on your international volume. That's Adyen's real number and it belongs in the model - Include the minimum invoice **Success criteria:** you can state in dollars what Adyen saves you against a published-rate alternative. And the saving comes from local acquiring, not from a markup you were guessing at. --- ## Scale Callout No published volume threshold makes Adyen available or cheaper. So this section is organized by what you're solving. **Single market, any volume:** - Card-present, Adyen's indicative markup is higher than every published Helcim band at every ticket size. That comparison is settled - Online, work out your average ticket first. Above about $120 Adyen loses to Helcim's entry band. Above about $28 it loses to the $100K-$500K band. Below those, on the indicative figure alone, Adyen wins - Against Stax, Adyen is lower in most cells we can check. Stax's subscription only amortises above the volume where Stax stops publishing its price - Ask Adyen to beat a published quote, and price the minimum invoice into it. If they can't, the decision is made - Don't assume enterprise pricing means cheap pricing **Two to five markets:** - Local acquiring starts to matter but may not cover the integration cost - Model the cross-border interchange saving specifically. It's the only line where Adyen structurally wins **Many markets, meaningful international volume:** - This is Adyen's case, and it's a strong one - The saving lives in interchange, not in markup. Build the model that way **Omnichannel across markets:** - Unified reporting and one reconciliation is worth real money. It never shows up in a rate comparison - Quantify the finance team hours as part of the business case --- ## Where This Breaks 1. **You can't compare what isn't published.** Adyen publishes a model and a few method prices. Every comparison on this page against a published-rate processor puts a firm number next to an indicative one. 2. **The minimum invoice is the hidden floor.** No monthly fee sounds great until you see it. It's the number Adyen won't publish. For smaller merchants it's the whole price. 3. **Markup isn't where Adyen wins, card-present.** A salesperson pitching Adyen on rate for in-person volume? Ask them to show it on the published numbers. Those numbers don't support it at any ticket size. Online is a real argument at small tickets. Name your average ticket and your volume band before you compare anything. 4. **Volume commitments are real.** Multi-year contracts with minimums are standard at this tier. Commit only to what you're confident about. 5. **Switching costs are large.** Once integrated, moving off Adyen is a months-long project. Build that into the decision, not into the regret. --- ## The Adyen Sales Process Adyen is quote-only, so the process is the product experience. What to expect: **Discovery:** volume, geography, growth, payment methods. You provide financials and payment data. **Proposal:** rates per payment method and per region, plus the minimum invoice. Get all of it in writing. **Negotiation:** bring competing quotes, including published-rate processors. A published Helcim or Stax schedule is a legitimate anchor even if Adyen serves a different market. **Implementation:** technical integration, certification for card-present if applicable, testing. **Go-live:** gradual rollout by region or percentage. Plan for a long cycle. That timeline is itself a cost. You could be live on a published-rate processor in a week. So be sure the local-acquiring benefit is real before you start. --- ## Next Steps **Considering Adyen?** 1. Run the [evaluation above](#test-to-run), starting with the cross-border question 2. Ask for the minimum monthly invoice in dollars, **and whether the $0.13 counts toward it**, before anything else 3. Get the full method-by-method fee schedule, not the indicative card markup 4. Ask for the **volume step-down schedule written into the contract**, not promised verbally 5. Ask for **written confirmation that interchange and scheme fees pass through at cost**, plus a sample settlement file showing all three components separated, before you sign 6. Ask whether the $0.13 processing fee applies to declined attempts 7. Ask what a chargeback costs, per scheme and per payment method. It isn't published at any tier 8. Ask what the FX spread is **What to push toward:** a markup well under 0.60% at real volume, a minimum invoice you clear in an ordinary month, and a written rate review at 12 months. Adyen's published $0 early termination fee is unusual for this tier and worth keeping in the contract. **Currently on a flat-rate processor and curious?** 1. Calculate what share of your volume is cross-border. If it's small, compare [Helcim](/docs/payments/processors/helcim) and [Stax](/docs/payments/processors/stax) instead. Both publish rates and neither needs a sales cycle 2. If it's large, model the local-acquiring interchange saving. That number is what justifies Adyen **Already on Adyen?** 1. Pull your effective rate by market and by payment method 2. Check your actual markup against the 0.60% indicative figure. If you're above it, you have a conversation to have 3. Confirm whether you're being billed per authorization attempt or per successful transaction 4. Check the minimum invoice against what you actually spend. If you're always above it, it's not costing you. If you're near it, it's your real price --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [adyen.com/pricing](https://www.adyen.com/pricing) | The $0.13 processing fee, the 0.60% indicative card markup, every payment-method price, the fee and minimum-invoice statements, and the "indicative" caveat | Vendor page | Accessed 2026-08-02 | | [Adyen Annual Report 2025](https://investors.adyen.com/financials/2025) | FY2025 take rate of 17.0 bps, net revenue, processed volume, EBITDA and POS share | Vendor financial reporting | FY2025 | | [Adyen H1 2025 Shareholder Letter](https://investors.adyen.com/financials/h1-2025) | H1 2025 take rate of 16.8 bps and the H2/H1 2024 comparatives | Vendor financial reporting | Dated 2025-08-14 | | [Merchant Maverick, Adyen review](https://www.merchantmaverick.com/reviews/adyen-review/) | The reported $120/month or 1,000 transactions/month minimum invoice, and the $0 setup, monthly and early-termination confirmation. **Discloses referral commissions from Adyen.** Its Amex figure conflicts with Adyen's live page | Review site | Updated 2024-12-10 | --- ## See Also - [Helcim](/docs/payments/processors/helcim) - Publishes a full markup schedule, lower than Adyen's indicative markup card-present at every ticket, and online above the crossover for your band - [Stax](/docs/payments/processors/stax) - No percentage markup, but a subscription that has to be earned back - [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions) - The interchange assumption behind every crossover on this page - [Checkout.com](/docs/payments/processors/checkout-com) - The other quote-only global option - [Stripe](/docs/payments/processors/stripe) - Easier and faster for single-market businesses - [Square](/docs/payments/processors/square) - SMB card-present - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison - [Buying Payments](/docs/payments/buying-payments) - Selection framework - [Going Global](/docs/payments/going-global) - International expansion and local acquiring - [Auth Optimization](/docs/payments/auth-optimization) - Where routing gains come from --- ## Braintree Source: https://paymentsandrisk.com/docs/payments/processors/braintree # Braintree :::info[TL;DR] - Braintree's card rate is **2.89% + $0.29**, published on PayPal's own enterprise fee page and verified 2 August 2026 - Stripe's US card rate is confirmed at **2.9% + $0.30**, one hundredth of a point and one cent away from Braintree - **There's no real price difference between Braintree and Stripe domestically.** The gap is two cents on a $100 order, six cents on a $500 order. Any page that picks between them on cost is picking noise - **On international volume there is one.** Braintree adds +1% for cards issued outside the US. Stripe adds **+1.5%**. That half-point is fifty times the domestic gap, and it's the only cost difference here worth a decision - Choose on features. Braintree for native PayPal and Venmo in one integration. Stripe for the broader product surface and better docs - Braintree charges $15 per dispute, not stated to be refunded on a win - braintreepayments.com now redirects to paypal.com. Braintree is sold as part of PayPal's enterprise offering, not as a standalone brand ::: Braintree is PayPal's developer-focused payment platform. It gives you a modern API with built-in PayPal and Venmo checkout. Best for businesses that want multiple payment methods without multiple integrations. :::note[Rate verification] Every Braintree fee on this page was read from PayPal's own fee page on **2 August 2026**: [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees). That page carries its own stamp of "Last Updated: May 7, 2026." braintreepayments.com now 301-redirects to paypal.com. Braintree pricing lives on PayPal's site. That's where the numbers below come from. ::: ## When to Use Braintree **You should use Braintree if:** - You want cards, PayPal, and Venmo in one integration - You have developers on your team - You're targeting a customer base where Venmo matters - You want the full Venmo checkout experience, which PayPal Checkout alone doesn't give you **Skip Braintree if:** - You don't have developers ([Stripe](/docs/payments/processors/stripe) or [Square](/docs/payments/processors/square) are easier) - You're primarily card-present (Square is better) - You don't need PayPal or Venmo. In that case Stripe is the same price with more product around it --- ## Pricing Breakdown ### Published Rates | Transaction Type | Rate | |------------------|------| | **Cards and digital wallets** | **2.89% + $0.29** | | **Venmo** | 3.49% + $0.49 | | **ACH Direct Debit** | 0.75%, capped at $5.00 | | **Same-day ACH** | 1.5% + $0.10 | | **ACH returned or disputed** | $5.00 | | **Non-USD currency** | +1% | | **Cards issued outside the US** | +1% | | **Disputes** | $15.00, not stated to be refunded on a win | Source: [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees), verified 2 August 2026. :::warning[The 2.59% + $0.49 figure is wrong, and it inverts every Braintree comparison] Braintree's card rate is **2.89% + $0.29**. If you find 2.59% + $0.49 anywhere, it's wrong, and it doesn't just shift the comparison - it reverses the shape of it. A lower percentage with a higher fixed fee produces a breakeven. Under those wrong numbers Braintree looks cheaper above roughly a $61 ticket and dearer below it, so any comparison built on them hands you a threshold to optimise around. Under the real numbers **both** components are lower than Stripe's. Braintree is marginally cheaper at every ticket size, and no breakeven exists at all. So there's no breakeven to recompute. The honest answer is that the domestic difference is too small to decide anything. ::: ### What Is Not Published | Fee | Status | |-----|--------| | **Card-present rate** | Not separately published. The card rate above covers cards and digital wallets | | **Keyed-in rate** | Not separately published | | **Monthly fee** | Not published | | **Setup fee** | Not published | | **Instant payout** | Not published | | **Volume threshold or discount schedule** | Not published | | **PayPal-wallet rate through Braintree** | Not separately broken out on the fee page | Five figures get quoted for Braintree that aren't on PayPal's Braintree fee page. $0 monthly, $0 setup, $0.05 per transaction for advanced fraud tools, $0.10 per card for account updater, and a $250K/month negotiation threshold with a 0.1 to 0.4% discount. **Ask Braintree sales, in writing:** whether there's any monthly minimum. What a Venmo or PayPal-wallet transaction really costs against a card. What the fraud tooling costs. And whether the $15 dispute fee is ever refunded. --- ## Braintree vs Stripe on Price: The Whole Answer Braintree 2.89% + $0.29. Stripe 2.9% + $0.30. | Order value | Braintree | Stripe | Braintree saves | |-------------|-----------|--------|-----------------| | $20 | $0.868 | $0.880 | $0.012 | | $50 | $1.735 | $1.750 | $0.015 | | $100 | $3.180 | $3.200 | $0.020 | | $500 | $14.740 | $14.800 | $0.060 | **At $100,000 a month with a $100 average ticket, Braintree costs $3,180 and Stripe costs $3,200. Twenty dollars.** That's 0.02% of volume. Less than one dispute fee. Smaller than the month-to-month variance in your card mix. Choosing a processor on that gap isn't cost optimisation. It's noise. **That verdict is domestic only, and the international picture is genuinely different.** | Surcharge | Braintree | Stripe | |---|---|---| | Cards issued outside the US | +1% | **+1.5%** | | Currency conversion | +1% | +1% | Half a percentage point on international cards is **fifty times** the domestic gap this whole section just called noise. On a book that's 30% international, that's $150 a month on $100,000 of volume, against the $20 the domestic comparison argues over. If you sell across borders, this is the number to decide on, not the third decimal place of the domestic rate. **The recommendation:** choosing between Stripe and Braintree, ignore price. Decide on what you need. Native PayPal and Venmo in one integration is Braintree. The broader product surface, better docs and deeper subscription tooling is Stripe. --- ## What Braintree Does Well ### 1. Multiple Payment Methods, One Integration Braintree includes in one SDK: - Credit and debit cards - PayPal - Venmo - Apple Pay and Google Pay - ACH Integrate once instead of Stripe plus a PayPal button plus Venmo. That's real engineering time saved. At these rates it's the actual argument for Braintree. ### 2. Developer Experience Braintree's API is clearly better than PayPal's legacy one. Modern SDKs, reliable webhooks, sensible error messages. It's still narrower than Stripe's. But that gap is much smaller than the one between Braintree and PayPal classic. ### 3. Full Venmo Checkout Venmo can appear as an option inside PayPal Checkout. The full Venmo checkout runs through Braintree. If Venmo matters to your customers, that's the reason to pick Braintree. It isn't a price reason. Note the rate. Venmo is 3.49% + $0.49, not the 2.89% + $0.29 card rate. That's 0.60% plus 20 cents more than a card. On a $60 order, about 56 cents. Venmo is worth it only if offering it adds sales. Shifting them off a cheaper method doesn't count. ### 4. ACH at 0.75% Capped at $5 Braintree's ACH is genuinely cheap for large tickets. A $5,000 ACH payment costs $5.00, against $144.79 on cards. For B2B invoicing this is the single biggest cost lever on the page. --- ## What Braintree Does Poorly ### 1. Venmo and Wallet Rates Are Higher Than Cards Venmo at 3.49% + $0.49 is 0.60% + $0.20 more than a card. Shift a real chunk of checkout from cards to Venmo and your blended rate goes up. Model your method mix before assuming the card rate is what you'll pay. ### 2. Less Is Published Than With Stripe Stripe publishes a monthly fee of $0, explicitly. Braintree's fee page doesn't address monthly fees, setup fees, instant payouts or volume discounts at all. That isn't evidence of hidden fees. It does mean the answers come from a salesperson, not a web page. ### 3. Still PayPal Braintree has PayPal's risk posture. Account holds happen, though less often than with PayPal direct. Support is better than PayPal's and thinner than Stripe's. ### 4. Smaller Product Surface Than Stripe Braintree's subscription billing exists but is less mature. There's no equivalent to Stripe's revenue recognition tooling, tax product, or breadth of marketplace integrations. --- ## Who Braintree Is Best For ### Perfect Fit | Business Type | Why Braintree Wins | |---------------|---------------------| | **Multi-method checkout** | Cards, PayPal, Venmo, Apple Pay, Google Pay in one SDK | | **Venmo-relevant audiences** | Full Venmo checkout, which PayPal Checkout alone doesn't provide | | **B2B with large invoices** | ACH at 0.75% capped at $5 | | **Developer-led teams already on PayPal** | Much better API than PayPal classic | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Card-only** | Stripe. Same price, more product | | **Card-present retail** | [Square](/docs/payments/processors/square) | | **Non-technical** | Square or PayPal | | **Cost-optimising at volume** | [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax). Both publish rates well below 2.89% all-in above roughly $50K a month | --- ## Common Gotchas ### 1. The Fixed Fee Is 29 Cents, Not 49 The 49 cent figure belongs to Venmo and PayPal Checkout, not to Braintree card processing. Model Braintree at $0.49 a card transaction and you overstate your cost by 20 cents each. At 5,000 transactions a month that's $1,000 of imaginary cost. ### 2. Venmo Is US-Only Venmo only works for US customers. If most of yours are international, the Venmo argument disappears. You're left choosing between two processors that cost the same. ### 3. Two Separate +1% Surcharges Can Stack Cards issued outside the US add 1%. Non-USD currency adds 1%. A EUR-denominated payment on a European-issued card is 2.89% + 2% + $0.29, which is 4.89% + $0.29. That's PayPal-Checkout territory. Braintree's advertised card rate is a domestic-USD rate. ### 4. Subscription Billing Is Less Mature Proration is manual, there's no usage-based billing, and dunning logic is simpler. For complex subscription businesses, Stripe Billing is better. ### 5. The Dispute Fee Is Not Stated to Be Refundable $15 per dispute. Nothing on the fee page says it comes back if you win. Compare [Helcim](/docs/payments/processors/helcim), which charges $0 when the case resolves in your favour. And [Square](/docs/payments/processors/square), which publishes a flat $0. --- ## Test to Run **Braintree vs Stripe decision. It shouldn't be a cost exercise.** **Step 1: Kill the cost question in five minutes** 1. Take your monthly card volume and transaction count 2. Braintree: `(volume x 0.0289) + (count x 0.29)` 3. Stripe: `(volume x 0.029) + (count x 0.30)` 4. The difference will be roughly 0.02% of volume. Write it down and then stop treating cost as the deciding factor **Step 2: Price the method mix, which is where the real money is** 5. Estimate what share of checkout would move to Venmo if you offered it: ____% 6. Venmo costs 0.60% + $0.20 more than a card. Multiply 7. Estimate what share of your volume could move to ACH: ____% 8. ACH saves you roughly 2.14% capped at $5 per transaction. Multiply 9. For most B2B merchants, step 7 dwarfs everything else on this page **Step 3: Price the integration** 10. One Braintree integration against Stripe plus a separate PayPal integration 11. Multiply the hours saved by your developer rate. This number is usually larger than the annual processing difference **Success criteria:** you chose on payment methods and engineering time, not on 0.02%. --- ## Scale Callout **Any volume, Braintree vs Stripe:** - The cost difference stays at roughly 0.02% of volume at every scale. It never becomes a reason to switch - Decide on methods and engineering, then stop **Above roughly $50K/month:** - The real cost question isn't Braintree against Stripe, it's flat-rate against interchange-plus - [Helcim](/docs/payments/processors/helcim) publishes IC + 0.45% + $0.20 online in the $50K-$100K band. On a typical card mix that lands well under 2.89% - [Stax](/docs/payments/processors/stax) charges no percentage markup at all above its subscription - If you need Venmo, you pay the flat-rate premium for it. That's a legitimate trade. Price it so you know what Venmo costs you **Above $250K/month:** - Braintree publishes no volume threshold or discount schedule. Ask anyway, with a competing quote - Get any offer as interchange-plus so you can audit it --- ## Where This Breaks 1. **Braintree and Stripe cost the same.** If you came here to find the cheaper one, the question has no useful answer. Decide on features. 2. **Method mix moves your rate more than processor choice does.** Venmo at 3.49% + $0.49 against cards at 2.89% + $0.29 is a bigger swing than anything between processors. 3. **International stacks.** Two separate 1% surcharges can apply to the same transaction. 4. **Little is published.** No monthly fee, no volume schedule, no instant payout terms. You have to ask. 5. **Both are flat-rate.** Above roughly $50K a month the money is in moving to interchange-plus. Not in choosing between two flat-rate processors that differ by two cents. --- ## Braintree vs Stripe: Summary | Factor | Braintree | Stripe | |--------|-----------|--------| | **Card rate** | 2.89% + $0.29 | 2.9% + $0.30 | | **Cost difference** | About 0.02% of volume | About 0.02% of volume | | **PayPal and Venmo** | Native, one integration | Separate integration | | **Venmo rate** | 3.49% + $0.49 | Not offered | | **ACH** | 0.75% capped at $5 | Published separately by Stripe | | **Disputes** | $15, refund not stated | $15 received (never returned) + $15 countered | | **API quality** | Good | Excellent | | **Subscription billing** | Basic | Advanced | | **Documentation** | Good | Excellent | | **Monthly fee** | Not published | $0, stated explicitly | **Choose Braintree if** you need native PayPal or Venmo, or you're moving significant volume to ACH. **Choose Stripe if** you're card-focused, need advanced subscription features, or value the documentation. **Don't choose either on price.** They're the same price. --- ## Next Steps **Considering Braintree?** 1. Read the [Braintree documentation](https://developer.paypal.com/braintree/docs) to gauge complexity 2. Confirm current rates yourself at [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees) 3. Ask sales for the monthly minimum, the PayPal-wallet rate, and the fraud tooling cost. None of the three is published 4. Estimate Venmo uptake, and price it at 3.49% + $0.49 **Already on Braintree?** 1. Check your method split: cards, PayPal, Venmo, ACH 2. Move whatever you can to ACH. At 0.75% capped at $5 it's the cheapest thing on your rate card 3. Don't switch to Stripe for pricing. There's nothing there **Switching from Braintree?** 1. Switch for features or support, not for two cents 2. If cost is the driver, look at [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax), not Stripe 3. Evaluate whether losing full Venmo checkout hurts conversion --- ## See Also - [Stripe](/docs/payments/processors/stripe) - Same price, different product - [PayPal](/docs/payments/processors/paypal) - Parent company - [Helcim](/docs/payments/processors/helcim) - Where the actual savings are above $50K/month - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison - [Buying Payments](/docs/payments/buying-payments) - Selection framework - [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - PayPal, Venmo, Apple Pay - [Checkout Conversion](/docs/payments/checkout-conversion) - Payment method optimization --- ## Checkout.com Source: https://paymentsandrisk.com/docs/payments/processors/checkout-com # Checkout.com :::info[TL;DR] - **Checkout.com publishes no pricing.** No rates, no tiers, no monthly minimum, no volume threshold. The pricing page is a contact form - It offers **a flat-rate model and an Interchange++ model**. It prices on "your business profile and risk category, nothing else." Its words, not ours - The page does say **no setup fees, no account maintenance fees, no surprise fees**. That's the entire published fee disclosure - Checkout.com does **not** publish a minimum volume requirement. A $5M-a-year figure gets quoted for it anyway, and it's invented - Strengths: global acquiring, a modern API comparable to Stripe's, payment optimisation. Weaknesses: no card-present offering. And you can't evaluate it without a sales cycle ::: Checkout.com is a London-headquartered processor serving scale-ups and enterprises. It sits between Stripe's breadth and Adyen's enterprise depth. Enterprise-grade infrastructure, with a developer experience closer to Stripe's. :::caution[Checkout.com really does publish nothing, and that's rarer than it looks] Most processors that look quote-only turn out to publish something. Checkout.com genuinely doesn't. No percentage, no currency amount, no fee schedule, anywhere on its site or in third-party review coverage. Stop looking and go straight to [what to ask for](#what-to-ask-for-in-writing). **What Checkout.com does publish.** Two pricing models, "fully flat-rate" and "Interchange++". The basis: "We price based on your business profile and risk category, nothing else." A description of Interchange++ as "Transparent card association, processor, and interchange fees." And this: "We provide free payment processing for registered charities in the countries in which we currently operate." Numbers get attached to Checkout.com anyway. Baseline rates of 0.95% + $0.20 for European cards and 2.90% + $0.20 for non-European. Estimated effective rates of 1.2 to 1.8% domestic EU and 2.0 to 2.8% domestic US. A per-transaction markup range of $0.10 to $0.25. A percentage markup range of 0.10 to 0.30%. A monthly minimum of $0 to $500. A $5 million a year volume expectation. **None of that appears anywhere on Checkout.com's site.** Use [what to ask for](#what-to-ask-for-in-writing) instead. Company identity is checkable even when pricing isn't. The UK operating entity is **CHECKOUT LTD**, company number **08037323**. Incorporated 19 April 2012, registered at Wenlock Works, Shepherdess Walk, London. Source: Companies House, a regulatory register. ::: ## When to Use Checkout.com **You should consider Checkout.com if:** - You sell internationally and want local acquiring in multiple markets. - You have developers who value a modern, well-documented API. - You need strong payment optimisation: network tokens, intelligent retry, account updater. - You're big enough that a bespoke commercial conversation is worth the time. - You're in fintech, digital goods, travel, or marketplace verticals. **Skip Checkout.com if:** - You need a published price. [Stripe](/docs/payments/processors/stripe), [Square](/docs/payments/processors/square), [Helcim](/docs/payments/processors/helcim), and [Stax](/docs/payments/processors/stax) all publish theirs. - You need card-present or POS. Checkout.com is an online processor. - You want plug-and-play. Production onboarding runs through sales. - You're a single-country SMB. The global features aren't worth the sales cycle. --- ## What Checkout.com Actually Publishes ### Two Pricing Models | Model | How it works | |-------|-------------| | **Flat rate** | A single blended rate covering interchange, scheme fees, and Checkout.com's margin | | **Interchange++** | `Interchange + Scheme Fees + Checkout.com's markup`, itemised | Checkout.com sets pricing "based on your business profile and risk category, nothing else." Source: [checkout.com/pricing](https://www.checkout.com/pricing), verified 2 August 2026. **Which to choose:** Interchange++, if you can get it. Under a blended rate, a price increase has no visible source. Interchange, scheme fees, your processor's margin, all one number. You can't audit it. You can't renegotiate it intelligently either. Under Interchange++ the markup is a separate line. It's the only line that's actually yours to negotiate. ### Fees | Item | Status | Tier | |------|--------|------| | **Setup fee** | None | VENDOR | | **Account maintenance fee** | None | VENDOR | | **"Surprise fees"** | None, per the page's own wording | VENDOR | | **Charity processing** | Free in the countries where Checkout.com operates | VENDOR | | **Processing rates** | Nothing published, anywhere on the site | NOT PUBLISHED | | **Card-present rates** | None. Checkout.com is an online processor with no POS product | NOT PUBLISHED | | **Chargeback fee** | Not published. Ask | NOT PUBLISHED | | **Refund fee** | Not published. Ask | NOT PUBLISHED | | **Cross-border fee and FX spread** | Not published. Ask | NOT PUBLISHED | | **Monthly minimum** | Not published. Assume one exists and ask | NOT PUBLISHED | | **Instant payout** | Not published. Ask | NOT PUBLISHED | | **Volume floor** | Not published. Ask | NOT PUBLISHED | Source: [checkout.com/pricing](https://www.checkout.com/pricing), verified 2 August 2026. --- ## What to Ask For, In Writing Nothing is published. So the sales conversation is your only source. What you extract from it is the whole evaluation. Checkout.com's own framing hands you the lever. ### 0. Attack the Category Before the Rate Checkout.com prices on **"your business profile and risk category, nothing else."** That sentence tells you where the money is. Ask: **"Which risk category am I in, what are the boundaries, and what evidence moves me to a better one?"** Your chargeback rate, refund rate and MCC sit near a category boundary. Moving across it is worth far more than haggling basis points inside it. And unlike a rate, you can change a category. You do it by fixing your own operation. ### 1. Which Pricing Model Applies to You Ask: **"Am I being quoted flat rate or Interchange++, and can I have both quotes, modelled against my last 12 months of actual volume and mix?"** Get both. **Flat rate looks better on a spreadsheet.** It costs more if you take a lot of regulated US debit. Under a blended rate you stop benefiting from cheap interchange. Competitive on a premium-card-heavy book means poor value on a debit-heavy one. And the reverse. ### 2. Scheme Fee Treatment Under Interchange++ Ask: **"Under Interchange++, are scheme fees passed through at cost? Show me a sample settlement file with interchange, scheme fees and your markup as three separate lines, before I sign."** This question separates real Interchange++ from Interchange++ in name only. The second plus is scheme fees. Bundled or marked up rather than passed through at cost? Then you're on a blended rate wearing a different label. The pre-signature demand is the important part. **The entire value of ++ pricing is the itemisation. A vendor that sells transparency but won't demonstrate it before you sign has answered you.** ### 3. The Monthly Minimum Ask: **"Is there a monthly minimum, and what is it in my settlement currency?"** Not published. For a business with variable volume, this is the floor cost. It matters more than the headline rate. ### 4. The Chargeback Fee Ask: **"What does a chargeback cost, and is it refunded if I win?"** Not published. Vendors that do publish charge this, all verified 2 August 2026: | Processor | Cost of a chargeback | |-----------|---------------------| | [Helcim](/docs/payments/processors/helcim) | $0 if you win, $15 if you lose | | [Square](/docs/payments/processors/square) | **$0**, stated outright | | [Braintree](/docs/payments/processors/braintree) | $15 | | [Stripe](/docs/payments/processors/stripe) | $15 to receive, plus $15 to counter | | [PayPal](/docs/payments/processors/paypal) | $15 on wallet disputes ($0 if you win), $20 on card chargebacks, $30 above a 1.5% ratio | | [Moneris](/docs/payments/processors/moneris) | CA$25, plus CA$80 authorization chargeback handling | ### 5. Volume Commitments and What Happens If You Miss Them Ask: **"Is there a minimum volume commitment, and what happens if I fall short? A penalty, or a rate adjustment?"** ### 6. Local Acquiring in Your Specific Markets Ask: **"In which of my markets do you acquire locally, and in which do you route cross-border?"** This is where the money is for an international merchant. It varies by market. A general coverage claim doesn't tell you about your top three. ### 7. What to Push Toward The questions above get you information. This is the position to aim at: - **Interchange++ with an itemised settlement file**, not a blended rate. - **A defined risk category, with a written path to reprice** as your metrics improve. - **No minimum commitment in year one**, while your volume is unproven. - The chargeback fee, refund fee, cross-border fee and FX spread, all named in dollars. None of the four is public. --- ## What Checkout.com Does Well ### 1. Developer Experience A modern REST API with comprehensive documentation. SDKs for the major languages. Hosted payment pages and embeddable components. Webhooks with retry logic, a sandbox, idempotency keys. Against Adyen: Adyen's API is functional but steeper to learn. Checkout.com is closer to Stripe in developer friendliness. If your team has built on Stripe before, that shortens the integration. ### 2. Global Acquiring Checkout.com acquires directly in many markets, not just as a gateway. That matters. A customer pays a merchant through an acquirer in the same market. Interchange is domestic, which is cheaper. Route the same transaction cross-border and it costs more. Get the specific market list, not a headline count. Your markets are the only ones that matter. ### 3. Payment Optimisation Network tokens, intelligent retry on declines, account updater for expired cards, adaptive routing, decline recovery. Improvements here show up as authorisation rate. An authorisation point is usually worth more than a markup basis point. ### 4. Fraud and Risk Tools Machine-learning fraud scoring with customisable rules. Full 3DS2 support with smart exemptions. A risk rules engine and velocity monitoring. --- ## What Checkout.com Does Poorly ### 1. Nothing Is Published Not the rates, not the minimum, not the chargeback fee, not a volume expectation. You can't build a business case from public information. You can't run a comparison or sanity-check a quote either. That's a real cost of evaluation. Count it as one. ### 2. No Card-Present Checkout.com is online-focused with no proprietary POS hardware. If you need omnichannel, [Stripe](/docs/payments/processors/stripe) or [Adyen](/docs/payments/processors/adyen) is a better fit. ### 3. Not Built for SMBs Limited self-serve. Test accounts are available but production onboarding runs through sales. Integration requires developers. Support tiers favour larger merchants. That's a description of how the product is sold, not a published minimum. Checkout.com states no volume requirement anywhere. Smaller and curious? Ask, rather than assuming you're excluded. ### 4. Pricing Varies With Your Negotiation Everything is bespoke, so two similar merchants can pay materially different rates. Bring competing quotes. A published [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax) schedule is a legitimate anchor. Different market segment, sure. But a markup is a markup. ### 5. Smaller Ecosystem Fewer pre-built platform integrations than Stripe or Adyen. A smaller partner ecosystem too. Marketplace payout tooling is less mature than Stripe Connect. --- ## Checkout.com vs Stripe vs Adyen | Factor | Checkout.com | [Stripe](/docs/payments/processors/stripe) | [Adyen](/docs/payments/processors/adyen) | |--------|-------------|--------|-------| | **Published pricing** | **None** | Full flat-rate card. No volume schedule | Model only: IC++ plus $0.13, indicative 0.60% markup | | **Pricing models offered** | Flat rate or IC++ | Flat rate published, IC+ by negotiation | IC++ | | **Monthly minimum** | Not published | $0, stated explicitly | No monthly fee, but a minimum invoice with no published amount | | **Chargeback fee** | Not published | $15 + $15 | Not published | | **API quality** | Excellent | Excellent | Good, more complex | | **Self-serve signup** | No | Yes | No | | **Card-present** | None | Stripe Terminal | Strong | | **Setup time** | Weeks | Days | Months | | **Volume floor** | Not published | Not published | Not published | All verified 2 August 2026 from each vendor's own pricing page. **Bottom line:** - **Stripe** is the only one you can price today. That makes it the default and the benchmark. - **Checkout.com** earns consideration when you need global acquiring with Stripe-quality developer tooling. And when you'll run a sales process to find out what it costs. - **Adyen** goes deeper on global reach and adds card-present. The cost is a longer integration. **A note on all three:** none publishes a volume floor. The $5M a year quoted for Checkout.com and the $10M a year quoted for Adyen are both invented. Curious and smaller than you think you should be? Then ask. --- ## Who Checkout.com Is Best For ### Perfect Fit | Business Type | Why Checkout.com Wins | |---------------|---------------------| | **Fintech and digital wallets** | High volume, global, API-first | | **Travel and hospitality** | Multi-currency, local acquiring cuts cross-border cost | | **Digital goods and gaming** | High volume, strong fraud tooling | | **Marketplaces** | Split payments and multi-party flows | | **Subscription businesses at scale** | Network tokens, account updater, and retry logic protect renewals | ### Poor Fit | Business Type | Better Alternative | |---------------|-------------------| | **Anyone who needs a price today** | [Stripe](/docs/payments/processors/stripe), [Helcim](/docs/payments/processors/helcim), or [Stax](/docs/payments/processors/stax) | | **Brick-and-mortar retail** | [Square](/docs/payments/processors/square) or [Clover](/docs/payments/processors/clover) | | **Shopify store** | [Shopify Payments](/docs/payments/processors/shopify-payments) | | **Restaurant** | [Toast](/docs/payments/processors/toast) or Square | | **Deepest global reach with in-store** | [Adyen](/docs/payments/processors/adyen) | --- ## Common Gotchas ### 1. "Interchange++" That Isn't The second plus is scheme fees. Bundled or marked up rather than passed through at cost? Then you're on a blended rate with a better name. Ask for a sample statement with scheme fees itemised. Before you sign. ### 2. The Monthly Minimum Not published. For a variable-volume business it's the number that sets your floor. Ask for it in your settlement currency. ### 3. Integration Timeline Even with a good API, a real integration takes weeks. 3DS, fraud rules and webhook handlers all need building and testing. Budget developer time for ongoing maintenance too. ### 4. Settlement Currency You can settle in multiple currencies, which reduces FX risk. Each settlement currency may need its own bank account. Conversion fees apply when you settle in a different currency than the transaction. Ask what the conversion margin is. It isn't published. ### 5. Support Tiers Dedicated account management for larger merchants, standard support for smaller ones. Clarify your tier in the contract. Same for the response-time SLA. Don't assume either. --- ## Test to Run **Checkout.com evaluation, without a rate card:** **Step 1: Establish your benchmark first** 1. Before any sales call, model your cost on a processor with published rates. Use [Stripe's](/docs/payments/processors/stripe) flat rate for online. Or [Helcim's](/docs/payments/processors/helcim) published markup schedule, if you'd consider interchange-plus 2. That number is your benchmark. Without it you've nothing to judge a quote against **Step 2: Get both quotes** 3. Request the flat-rate quote and the Interchange++ quote 4. Model both against your real card mix, not a generic one 5. The Interchange++ markup should be quoted as a percentage plus a per-transaction figure. Ask again until you get that **Step 3: Close the unpublished gaps** 6. Monthly minimum, in your settlement currency 7. Chargeback fee, and whether it's refunded on a win 8. Volume commitment and what happens if you miss it 9. Scheme fee treatment, with a sample statement 10. Which of your specific markets get local acquiring **Step 4: Price the thing Checkout.com actually sells** 11. What share of your volume is cross-border today? ____% 12. What would local acquiring do to interchange on that volume? 13. What would the optimisation tooling do to your authorisation rate? A single point of auth rate is worth a lot on a large book. Usually more than the entire markup difference **Step 5: Decide** 14. Does the quote beat your published benchmark? By more than a weeks-long integration costs? And an ongoing relationship with a quote-only vendor? **Success criteria:** a written quote in both models. You know the minimum and the chargeback fee. And you can state in dollars what Checkout.com saves. Against a processor whose price you could have looked up. --- ## Where This Breaks 1. **Nothing is published, so nothing can be benchmarked externally.** You have to build your own comparison before you start the conversation. 2. **No stated volume floor, but the product gets sold like there's one.** Don't assume you're too small. Ask. 3. **Flat rate versus Interchange++ can flip the answer.** The same merchant gets a good deal in one model. And a poor one in the other. Get both. 4. **No card-present.** If you need omnichannel, this isn't the product. 5. **Your rate depends on your negotiation.** Bring competing quotes, including published ones. --- ## Next Steps **Considering Checkout.com?** 1. Build your published-rate benchmark first, before the sales call 2. Request both pricing models in writing 3. Ask the [questions above](#what-to-ask-for-in-writing), especially about scheme fee treatment and the monthly minimum 4. Ask which of your specific markets get local acquiring 5. Compare to [Stripe](/docs/payments/processors/stripe) on API quality and to [Adyen](/docs/payments/processors/adyen) on global reach **Already on Checkout.com?** 1. Calculate your effective rate: total fees divided by total volume 2. On a blended rate? Ask to move to Interchange++. Then you can see where increases come from 3. Review authorisation rates. Are network tokens and intelligent retry actually enabled? 4. Audit your fraud rules. Blocking good transactions costs more than fraud does for most merchants 5. Renegotiate as volume grows. Your leverage is the only thing that changes a bespoke price --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [checkout.com/pricing](https://www.checkout.com/pricing) | The two pricing models, the risk-category basis, the fee statements and the charity policy. No figures of any kind | Vendor page | Accessed 2026-08-02 | | [checkout.com/sitemap.xml](https://www.checkout.com/sitemap.xml) | Confirmation that no fee schedule or regional pricing page exists. All 1,552 URLs scanned | Vendor sitemap | Accessed 2026-08-02 | | [Companies House](https://find-and-update.company-information.service.gov.uk/search?q=checkout+ltd) | UK operating entity: CHECKOUT LTD, company number 08037323 | Regulatory register | Accessed 2026-08-02 | | [TrustRadius Checkout.com pricing page](https://www.trustradius.com/products/checkout-com/pricing) | Checked and found to contain no Checkout.com figures | Review aggregator | Accessed 2026-08-02 | --- ## See Also - [Stripe](/docs/payments/processors/stripe) - Publishes its rates, which makes it the benchmark - [Adyen](/docs/payments/processors/adyen) - The other quote-only global option, with card-present - [Helcim](/docs/payments/processors/helcim) - Publishes a full interchange-plus markup schedule - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table - [Auth Optimization](/docs/payments/auth-optimization) - Where optimisation gains come from - [3D Secure](/docs/fraud/prevention/3ds) - Authentication setup - [Going Global](/docs/payments/going-global) - International processing and local acquiring --- ## Clover Source: https://paymentsandrisk.com/docs/payments/processors/clover # Clover :::info[TL;DR] - **Clover does publish a full rate card**, vertical by vertical, at [clover.com/pricing](https://www.clover.com/pricing). Plenty of comparison content says it doesn't. - Card-present is **2.3% + 10c** for restaurants and quick service. Entry retail and services plans are **2.6% + 10c**, dropping to 2.3% + 10c on the higher tiers. Keyed and online is **3.5% + 10c** across every vertical and every plan. All VENDOR. - **Your actual rate is still reseller-dependent, and Clover says so on its own pricing page.** Treat the published direct rates as your anchor. Anything above them is reseller markup. - Software plans run **$0 to $129.85 a month**. Hardware is published two ways per bundle: outright, or on a 36-month subscription. The subscription premium runs **$227 to $3,622** depending on bundle. Clover's own FAQ confirms you don't own the hardware at term end. - **The chargeback fee is the one number Clover genuinely doesn't publish**, at any tier. Ask for it in dollars. Ask whether it's refunded on a win. ::: Clover is the POS you see in restaurants, retail shops and service businesses across the US. The hardware and app ecosystem are genuinely strong. Clover publishes its direct rates. What varies is who sells it to you, and what they add on top. :::caution[The rate card isn't the price. Your reseller is] Clover publishes direct rates. What you actually pay depends on who sold Clover to you, and Clover says so itself: *"Contract terms and any termination fees can vary based on your service provider, whether Clover Direct or among our trusted partners including Citi, PNC, Wells Fargo."* So treat the published rates as an anchor, not a quote. Anything above them is your reseller's markup, and you can name the gap in the conversation. All figures below were read on **2 August 2026**. Full [source list at the bottom of this page](#sources). ::: --- ## Clover's Published Rates ### Card-present, by vertical VENDOR | Vertical | Basic / Starter | Standard | Advanced | |---|---|---|---| | **Full-service restaurant** | 2.3% + 10c | 2.3% + 10c | 2.3% + 10c | | **Quick-service restaurant** | 2.3% + 10c | 2.3% + 10c | 2.3% + 10c | | **Retail** | **2.6% + 10c** | 2.3% + 10c | 2.3% + 10c | | **Personal services** | **2.6% + 10c** | 2.3% + 10c | 2.3% + 10c | | **Home and field services** | - | 2.5% + 10c | 2.3% + 10c | Clover's own headline on [clover.com/pricing](https://www.clover.com/pricing) is "Pay as little as 2.3% + 10c per transaction," which the vertical tables bear out. ### Keyed and online VENDOR **3.5% + 10c**, uniformly, across every vertical and every plan. The published card has no cheaper card-not-present tier to negotiate toward. That makes 3.5% + 10c a hard ceiling to hold a reseller to. ### Software plans VENDOR | Plan | Monthly | |---|---| | **Starter** | $0 | | **Essentials** | $29.95 | | **Services Growth** | $84.95 | | **Retail Growth** | $84.95 to $104.90 | | **Restaurant Growth** | $89.95 to $129.85 | ### Hardware, and the subscription premium VENDOR figures, DERIVED arithmetic Clover publishes hardware two ways for each bundle: an outright price, or a 36-month subscription. Three published examples: | Bundle | Subscription | Outright | Software on top | |---|---|---|---| | **Retail Basic** | $16/mo x 36 = $576 | $349 | - | | **QSR Starter** | $135/mo x 36 = $4,860 | $849 | $89.95/mo | | **Full-service Advanced** | $354/mo x 36 = $12,744 | $4,447 | $129.85/mo | Do the arithmetic on Clover's own published prices. **The 36-month subscription premium runs from $227 to $3,622, depending on the bundle.** And Clover's FAQ confirms you **don't** own the hardware at term end. That's the lease trap, quantified, from the vendor's own numbers. On the QSR Starter bundle you'd pay $4,860 over three years. The same hardware costs $849 outright. And you still wouldn't own it. ### Other published fees | Item | Figure | Tier | |---|---|---| | **Rapid Deposit (instant payout)** | 1.75% per transfer | VENDOR | | **Contract term on hardware promotions** | "Requires a 3-year contract". Auto-renews at the same monthly charge unless you give **30 days' notice** | VENDOR | | **Dynamic currency conversion margin** | 3.5% contracted margin | REPORTED | | **Early termination fee, reseller plans** | roughly **$295 to $595** | REPORTED | | **PCI fee, reseller plans** | about **$9.95/month** | REPORTED | | **Chargeback fee** | Not published at any tier | NOT PUBLISHED | The two reported reseller figures come from [SMB Compare](https://smbcompare.com/providers/payment-providers/clover), a comparison and review site, updated July 2026. They describe reseller plans, not Clover Direct. That's exactly the distinction that matters here. :::note[There's no Clover take rate to compute, and that itself is the finding] **Fiserv no longer discloses any Clover payment volume or revenue figure** in its FY2025 Form 10-K. "Annualized payment volume", "Clover revenue" and "Clover volume" all return nothing in the filing. Adyen's and Toast's filings each give you enough to derive a take rate; Fiserv's doesn't. So any Clover take rate you see quoted didn't come from the filing. The same 10-K discloses pending securities litigation, *In re Fiserv, Inc. Securities Litigation*, No. 1:25-cv-06094. It alleges that statements about Clover growth were misleading. That's a pending allegation, not a finding. It's noted here only as disclosure context. ::: ## When to Use Clover **You should use Clover if:** - You need professional POS hardware, not a phone reader. - You run a restaurant, retail shop, or service business with a counter. - You want a full POS ecosystem with employee and inventory management. - You need multiple terminals or locations. - You want a wide selection of third-party POS apps. **Skip Clover if:** - You're primarily online. 3.5% + 10c keyed is expensive, and [Stripe](/docs/payments/processors/stripe) at 2.9% + 30c or [Shopify Payments](/docs/payments/processors/shopify-payments) is better. - You want a price that doesn't depend on which bank or ISO sold it to you. - You don't need dedicated hardware. - You want to avoid multi-year commitments. Clover's hardware promotions state a three-year requirement. --- ## What to Ask For, In Writing Clover's published direct rates are your anchor, not your quote. How good your deal is depends on how far your reseller drifts from them. Get every one of these answered in writing, from the reseller, before any hardware ships. ### 0. Who Is Actually Selling You This Ask: **"Am I contracting with Clover Direct, or with a bank or ISO? Who is the merchant of record?"** It goes first because it decides whether the published rates above apply to you at all. Clover's own pricing page names Citi, PNC and Wells Fargo as partner channels. A community bank, a national ISO and clover.com can produce three very different deals on identical hardware. ### 1. The Effective Rate, Not the Qualified Rate Ask: **"What is my effective rate, including all markups, assessments, and monthly fees, on my actual card mix?"** ISOs advertise a "qualified" rate that applies only to basic debit. Most transactions land in mid-qualified or non-qualified buckets, which cost far more. The number that matters is total fees divided by total volume. A reseller who won't quote it in those terms is telling you something. Better still, ask for interchange-plus rather than tiered. Ask for the markup as a percentage and a per-transaction figure. That's the only structure you can audit later. ### 2. Monthly Software Cost, Per Device Ask: **"What is the monthly software plan cost, and is it charged per device or per account?"** Clover charges monthly software fees on top of processing. With multiple terminals, per-device billing multiplies. Get the plan name, the price, and the multiplier. ### 3. The Chargeback Fee NOT PUBLISHED Ask: **"What does a chargeback cost, and is it refunded if I win?"** This is the one Clover figure that genuinely isn't published anywhere. It's absent from clover.com/pricing, all six vertical pricing pages, Clover's FAQ and third-party review coverage alike. No Clover-direct per-dispute fee appears at any tier. For reference, from vendors that do publish: | Processor | Cost of a chargeback | |-----------|---------------------| | [Helcim](/docs/payments/processors/helcim) | $0 if you win, $15 if you lose | | [Square](/docs/payments/processors/square) | **$0**, stated outright | | [Braintree](/docs/payments/processors/braintree) | $15 | | [Stripe](/docs/payments/processors/stripe) | $15 to receive, plus $15 to counter | | [PayPal](/docs/payments/processors/paypal) | $15 on wallet disputes ($0 if you win), $20 on card chargebacks, $30 above a 1.5% ratio | | [Lightspeed](/docs/payments/processors/lightspeed) | $15, stated as a single fee covering the defence | All verified 2 August 2026. If your Clover quote comes back materially above $15, that's a negotiating point. ### 4. Contract Term and Early Termination Fee Ask: **"What is the contract length, what is the early termination fee as a dollar figure or formula, and what notice do I have to give to stop it auto-renewing?"** Clover's own hardware promotion footnote states three things. A **three-year contract** is required. Hardware subscriptions are quoted on 36-month terms. And they **auto-renew at the same monthly charge unless you give 30 days' notice**. That notice window is the trap, not the renewal. Calendar it the day you sign. Clover doesn't publish the ETF. It's REPORTED at roughly **$295 to $595 on reseller plans** by SMB Compare, a comparison site updated July 2026. Get your own number in writing. That range describes reseller plans generally, not your contract. ### 5. Is the Hardware Subscribed or Bought? Ask: **"Am I buying this hardware or subscribing to it? What is the total amount payable over the term, and do I own it at the end?"** **You can now check the answer against Clover's own published prices.** That's new on this page, and it's the most useful thing on it. Clover publishes both an outright price and a 36-month subscription price for each bundle. On its own figures the subscription premium runs **$227 to $3,622** depending on bundle. And **Clover's FAQ confirms you don't own the hardware at term end**. On the QSR Starter bundle, $135 a month for 36 months is $4,860. Clover will sell you the same hardware outright for $849. Get the total payable over the full term as one dollar figure. Compare it to Clover's own published outright price for the same bundle. If a reseller's subscription total is above Clover's, you now know by exactly how much. ### 6. Every Monthly Line Item Ask: **"List every recurring charge on my statement, by name and amount."** Charges to watch for. Resellers add all of these. None are inherent to Clover: - PCI compliance or PCI non-compliance fees. - Monthly minimums. - Statement fees. - Annual fees. - Gateway or batch fees. --- ## What Clover Does Well ### 1. Hardware Quality and Range Clover's hardware is purpose-built and professional grade. The range is wider than any other SMB POS. A mobile reader, a handheld terminal for tableside and delivery, a counter terminal, full registers with and without a customer-facing screen, and self-service kiosks. All of them run the same software platform. Against Square, Clover's hardware is more durable and more feature-rich for busy retail and restaurant environments. Square's is simpler and much cheaper to abandon. ### 2. App Market Clover's app marketplace is substantial. Accounting integrations, loyalty, online ordering, employee scheduling, gift cards, industry-specific tools. You can shape Clover to a business type without custom development. ### 3. Fiserv Infrastructure Clover is backed by Fiserv, one of the largest payment processors in the US. The settlement and uptime infrastructure is bank-grade. That's the genuine upside of the distribution model that also creates the pricing problem. ### 4. Employee and Inventory Management Employee clock-in and permissions. Inventory tracking with low-stock alerts. Per-employee sales reporting and role-based access. All built into the platform on the mid-tier plans and above. --- ## What Clover Does Poorly ### 1. The Published Price Is Not Necessarily Your Price Clover publishes rates, software plans and hardware prices. What it can't publish is what your reseller will charge. Clover says so itself. So the rate card tells you what a good deal looks like. It doesn't tell you whether you're getting one. That beats nothing published. It's still worse than a processor whose published rate is the rate you pay. The chargeback fee is the one line missing entirely, at every tier. ### 2. Reseller Risk Independent agents set their own rates, fees and contract terms. Some add PCI fees, annual fees, monthly minimums and early termination fees that have nothing to do with Clover. Merchants sign multi-year contracts without realising it. Hardware gets leased at a large multiple of its purchase price. This isn't a hypothetical. It's the most common complaint about Clover, and it follows directly from how Clover is sold. ### 3. Hardware Lock-In Clover hardware only works with Clover processing. Switch, and the hardware is worthless. That's by design. It's also why the hardware question and the contract question are the same question. Compare Square, where the readers are cheap enough that walking away costs almost nothing. ### 4. Monthly Software Fees Clover charges monthly software fees where Square's base plan charges none. With multiple terminals, those fees multiply. At low volume they can make Clover dearer overall, even if the rate you negotiated is lower. --- ## Clover vs Square: The Honest Comparison Both sides of this table are now VENDOR figures, which is what makes it worth reading. | Factor | Clover (direct) | [Square](/docs/payments/processors/square) | |--------|--------|--------| | **Card-present rate** | **2.3% + 10c** restaurant and QSR, **2.6% + 10c** retail and services entry plans | 2.6% + $0.15 Free, 2.5% + $0.15 Plus, 2.4% + $0.15 Premium | | **Online / keyed rate** | **3.5% + 10c** on every plan | 3.3% + $0.30 Free online, 3.5% + $0.15 keyed | | **Monthly software** | $0 Starter to $129.85 Growth | $0 Free, $49 Plus, $149 Premium, **per location** | | **Chargeback fee** | **Not published at any tier** | No per-dispute fee published | | **Instant payout** | Rapid Deposit 1.75% | Instant Transfer 1.95% | | **Free hardware** | No | Yes, a basic reader | | **Hardware quality** | Professional grade | Consumer grade | | **Hardware range** | Widest in SMB POS | Narrower | | **Hardware lock-in** | Yes, and expensive to abandon. You don't own subscribed hardware at term end | Minimal | | **Contract risk** | Three years on hardware promotions, auto-renewing, 30 days' notice to stop it | None. Month to month | | **Is the published price your price?** | Only if you buy Clover Direct | Yes | | **Best for** | Established retail and restaurants that need the hardware | Getting started fast, and anyone who wants the published price to be the price | Square figures verified 2 August 2026 at [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees) and [squareup.com/us/en/pricing](https://squareup.com/us/en/pricing). **Bottom line, now that both cards are readable.** On rate alone, **Clover Direct beats Square card-present for a restaurant.** 2.3% + 10c against 2.6% + 15c is cheaper on both components. There's no crossover ticket to find. Entry-plan retail is closer. 2.6% + 10c against 2.6% + 15c is five cents a transaction in Clover's favour, on the same percentage. Square still wins on everything around the rate. No contract. Cheap hardware you own. A plan price that doesn't depend on who sold it to you. No three-year auto-renewal to diarise. Clover's card-present advantage is real, but a $29.95 or $89.95 software plan eats it fast. So does a hardware subscription you don't own at the end. **How to make the comparison concrete.** Get your Clover quote in writing. Calculate its total monthly cost, including software and amortised hardware. Compare that to Square's published rates on your own volume. Then compare the Clover quote to **Clover's own published direct rates**. That's the comparison this page couldn't offer before. If your reseller quotes materially above 2.3% or 2.6% + 10c card-present, or above 3.5% + 10c keyed, the gap is markup rather than cost. --- ## Who Clover Is Best For ### Perfect Fit | Business Type | Why Clover Wins | |---------------|-----------------| | **Restaurants** | Tableside ordering, split checks, kitchen workflows | | **Established retail** | Hardware built for a busy counter | | **Multi-location** | Centralised management, per-location reporting | | **Service businesses with a counter** | Appointment and payment in one system | | **Businesses needing kiosks** | Self-service ordering for quick-service and cafes | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Online-only** | [Stripe](/docs/payments/processors/stripe) or [Shopify Payments](/docs/payments/processors/shopify-payments) | | **Mobile or field service** | [Square](/docs/payments/processors/square). Free reader, no monthly fee | | **Low volume** | Square. No monthly fee, and no three-year hardware commitment | | **Developer-led** | Stripe | | **Want the lowest verifiable cost** | [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax). Both publish full rate schedules that are also the rate you pay | --- ## Common Gotchas ### 1. The Hardware Subscription, Quantified You no longer have to take this on trust. Clover publishes both prices for each bundle, and the arithmetic on its own figures is: | Bundle | 36-month subscription total | Outright | Premium | |---|---|---|---| | Retail Basic | $576 | $349 | **+$227** | | QSR Starter | $4,860 | $849 | **+$4,011** | | Full-service Advanced | $12,744 | $4,447 | **+$8,297** | And Clover's FAQ confirms you don't own the hardware at the end. Across the published bundles the premium runs roughly $227 to $3,622 on comparable configurations, and further on the largest ones. **Always ask for the total payable over the full term as a single number.** Then compare it to Clover's own published outright price. If your reseller won't quote a purchase price at all, you now have one to quote back at them. ### 2. Rate Bait-and-Switch An advertised "qualified rate" applies only to basic debit. Most of your transactions land in pricier buckets. Ask for the effective rate on your actual card mix. Better, ask for interchange-plus, so the markup is visible and auditable. ### 3. Hidden Monthly Fees PCI fees, monthly minimums, statement fees, and annual fees are all reseller additions. Ask for every recurring line item by name and amount, in writing, before signing. ### 4. Clover Direct Pricing Does Exist, and It's Your Anchor There is a Clover Direct price card, and it's the anchor for any reseller quote. **Use it.** Take three published numbers. The direct rate for your vertical. The software plan price. The outright hardware price. Put a reseller quote next to all three. Any gap is markup. Markup is negotiable in a way interchange isn't. Then still get two or three competing reseller quotes. The published card doesn't tell you which reseller will honour it. ### 5. The Keyed Rate Is the Expensive One 3.5% + 10c on keyed and online is a full 1.2 points above Clover's restaurant card-present rate. Take phone orders? Invoice customers? Run a delivery operation that keys cards? Model that channel separately. On $20,000 a month of keyed volume the gap against card-present is $240 a month. It's also the number most worth holding a reseller to. 3.5% + 10c is Clover's own published rate, so anything above it is pure markup. --- ## Test to Run **Clover quote evaluation, before committing:** **Step 1: Collect the inputs** 1. Estimate your monthly transaction count and monthly volume. 2. Split by card-present and card-not-present. 3. Pull your current statement if you've one, and note your blended interchange. **Step 2: Get real quotes** 4. Request written quotes from at least two Clover resellers. Insist on interchange-plus, not tiered. 5. For each quote, capture seven things. The markup. The per-transaction fee. The monthly software cost, and whether it's per device. The chargeback fee. The contract term. The early termination fee. And whether hardware is leased or bought. 6. If a reseller won't put all of that in writing, drop them. **Step 3: Build the true monthly cost** ``` Processing: (volume x blended interchange) + (volume x markup) + (count x per-txn fee) Software: plan cost x number of devices Hardware: purchase price / 36, or the lease payment Other recurring: PCI + statement + minimum + annual/12 Total monthly: _______ ``` **Step 4: Benchmark against three published cards, including Clover's own** ``` Clover Direct, restaurant: (volume x 2.3%) + (count x $0.10) + software plan + hardware/36 Clover Direct, retail entry:(volume x 2.6%) + (count x $0.10) + software plan + hardware/36 Square Free, card-present: (volume x 2.6%) + (count x $0.15) + $0 software + $0 hardware Helcim, first band, CP: (volume x blended interchange) + (volume x 0.40%) + (count x $0.08) ``` The first two lines are new and they're the important ones. If your reseller quote loses to Clover's own published direct rate, you're paying for the reseller, not for Clover. **Step 5: Decide** 7. Does the best Clover quote beat both benchmarks by enough to justify the contract term and the locked hardware? 8. If it's close, take the one you can cancel. **Success criteria:** you chose Clover with a written quote you understood, or you chose something else with a published price. Either is a good outcome. Signing without step 2 isn't. --- ## Where This Breaks 1. **The reseller, not Clover, sets your cost.** Two merchants with identical hardware and volume can pay very different rates. Clover's own pricing page says so. The published card is a benchmark, not a guarantee. 2. **Hardware lock-in makes a bad contract expensive to escape.** The hardware is worthless off Clover, so a bad deal compounds. 3. **Subscribed hardware is where the money goes.** The processing rate gets negotiated. The hardware subscription gets signed without scrutiny. On Clover's own published figures it's frequently the larger number. And you don't own the device at the end. 4. **The chargeback fee is genuinely unknown.** Not published by Clover, not quoted by any credible third party. For a dispute-prone business that's a material gap, and you have to close it with your reseller. 5. **No Clover take rate can be derived.** Fiserv's FY2025 10-K discloses no Clover volume or revenue figure. So there's no filing-based sanity check on Clover's economics. Toast, Adyen and Lightspeed all give you one. --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [clover.com/pricing](https://www.clover.com/pricing) plus the restaurant, quick-service, retail, personal-services, home-and-field-services and professional-services pricing pages | Card-present and keyed rates by vertical, software plans, hardware prices both ways, contract footnotes, Rapid Deposit, the reseller-dependence statement | Vendor pages | Accessed 2026-08-02 | | [SMB Compare, Clover](https://smbcompare.com/providers/payment-providers/clover) | Reseller early termination fee range and reseller PCI fee only | Comparison and review site | Updated July 2026 | | [NerdWallet](https://www.nerdwallet.com/business/software/reviews/toast-pos) | Cross-check on the rate card. Reported 2.3% + 10c restaurant, 2.5% + 10c retail/services and 3.5% + 10c online-keyed, slightly stale against the live page but directionally confirming | Personal finance publisher that earns partner referral revenue | 2026-01-13 | | [Fiserv FY2025 Form 10-K](https://www.sec.gov/Archives/edgar/data/798354/000079835426000009/fi-20251231.htm) | Confirmation that no Clover volume or revenue figure is disclosed, so no take rate can be derived. Also the pending securities litigation noted above | Regulatory filing | Filed 2026 | --- ## Next Steps **Considering Clover?** 1. Work through [what to ask for](#what-to-ask-for-in-writing) and get every answer in writing. 2. Collect at least two competing reseller quotes. 3. Benchmark against [Square's published rates](/docs/payments/processors/square), which cost nothing to look up. 4. Check the hardware question last and hardest. Buy, don't lease. **Already on Clover through a reseller?** 1. Calculate your effective rate: total fees divided by total volume, over three months. 2. Compare it to Square's and Helcim's published rates on the same volume. 3. Read your statement line by line and identify every recurring fee. 4. Find your contract end date and calendar it, along with the notice period. 5. If you're overpaying, use a competing written quote as leverage. Renewal is when you've the most. --- ## See Also - [Square](/docs/payments/processors/square) - Main SMB POS competitor, with fully published pricing - [Toast](/docs/payments/processors/toast) - Restaurant-specific, also quote-only - [Helcim](/docs/payments/processors/helcim) - Published interchange-plus, useful as a benchmark - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Choosing hardware - [Processor Fees Guide](/docs/payments/processor-fees-guide) - Spotting hidden fees --- ## Helcim Source: https://paymentsandrisk.com/docs/payments/processors/helcim # Helcim :::info[TL;DR] - Helcim publishes **five volume bands plus a custom band**, not three. They key off **monthly** volume. They run openly to $5 million a month before anything turns negotiable - Card-present markup runs from interchange + 0.40% + 8 cents down to interchange + 0.15% + 6 cents. Online runs from interchange + 0.50% + 25 cents down to interchange + 0.15% + 15 cents - On [this site's published pass-through assumption](/docs/payments/reference/cost-model-assumptions), **Helcim is cheapest in 20 of the 24 scenarios modelled.** Two channels, three ticket sizes, four monthly volumes. The margin is wide, not narrow. At a $50 card-present ticket on $20,000 a month it's $389.20 against Square Free's $580.00 - **It loses four cells, and they matter.** [PayPal Zettle](/docs/payments/processors/paypal) wins all three $15 card-present cells below $500,000 a month. [Stax](/docs/payments/processors/stax) wins one online cell, at a $25 ticket and $20,000 a month - On an ordinary card mix, Helcim beats Square's flat 2.6% + 15c above a **$9.23** card-present ticket, at any volume. Neither charges a monthly fee. Below that ticket Square is cheaper. Below **$19.53**, PayPal Zettle beats both. On premium rewards and commercial cards Square wins at every ticket - **Helcim charges $0 for a chargeback resolved in your favour and $15 if you lose.** That's the only win-is-free dispute policy among the processors verified for this site - No monthly fee, no setup fee, no PCI fee, no cancellation fee, no statement fee, and no volume floor - Stax overtakes Helcim card-present at roughly **$58,000 to $70,300 a month**, depending on ticket. Online, at roughly **$22,100 to $36,200**, at Stax's published $199 floor ::: Helcim is an interchange-plus processor that shows you exactly what you're paying. As your volume grows the markup drops automatically. No renegotiation. Best for merchants who want transparency and no monthly subscription. :::note[Rate verification and the cost assumption] Every Helcim fee on this page was read from [helcim.com/pricing](https://www.helcim.com/pricing/) on **2 August 2026**. You can't compare interchange-plus against flat-rate without assuming what interchange costs. This page uses one assumption and only one. Pass-through of **1.03% + $0.178 card-present** and **1.50% + $0.172 online**. The derivation, its sources and its unverified inputs are published at [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). If your card mix differs, every number below moves. That page tells you by how much. This page deliberately doesn't link to Helcim's savings calculator. A vendor's calculator is a sales tool. Helcim publishes enough real numbers that you can do the arithmetic yourself. The worked examples below show all of it. ::: :::warning[The interchange assumption moves this page more than Helcim's own rates do] Plenty of comparison content assumes blended interchange of 1.80% + $0.10 card-present and 1.94% + $0.10 online. That first figure isn't a blend of anything. It's roughly the rate for one card type, a consumer rewards credit card, and it overstates card-present pass-through by 79 basis points. On $20,000 of volume that's about $159 a month of phantom cost, all of it charged to the interchange-plus side. Name the direction plainly. It makes Helcim look **worse** than it is. On the assumption this page actually uses, the reference card-present comparison against Square is a saving of **$190.80** a month. The 1.80% assumption puts it near $10. ::: ## When to Use Helcim **You should use Helcim if:** - Your average card-present ticket is above about **$9.23** on an ordinary consumer card mix. Helcim beats Square's flat rate from that ticket up, at **any volume**. Neither charges a monthly fee, so there's no threshold to reach first - Your average online ticket is above about **$9.38** (against Square's free plan) or **$14.83** (against Braintree) - You want to see interchange, network fees, and markup separately - You want volume discounts that apply automatically with no renegotiation - Your volume is seasonal or uneven, so a monthly subscription would hurt in slow months - You have real dispute volume. The $0-if-you-win policy is worth money **Skip Helcim if:** - Your average card-present ticket is under about **$19.53**. PayPal Zettle's 2.29% + 9 cents is cheaper there, all the way up to $500,000 a month. Above that volume Helcim's crossover falls to $13.96 - Your card-present ticket is under about **$9.23** and you don't want a second account. Square's flat 2.6% + 15c wins below that point - Your card mix is heavy in **premium rewards or commercial credit**. Interchange alone runs 2.10% to 2.26% card-present on those. Helcim's all-in passes Square's flat 2.6% before ticket size even enters it. A flat rate caps your exposure, and that's a real benefit - You want the simplest possible statement - You need the best developer tooling ([Stripe](/docs/payments/processors/stripe) is better) - You're primarily card-present retail and want a full POS ([Square](/docs/payments/processors/square) is better) - You're consistently above roughly **$58,000 to $70,300 a month card-present**, or **$22,100 to $36,200 online**. Cost is your only criterion and dispute fees don't matter. [Stax](/docs/payments/processors/stax) is cheaper past those points, at its published $199 floor --- ## Pricing Breakdown ### How Interchange-Plus Works **You pay:** `Interchange + Network Assessments + Helcim's Markup` Interchange and network assessments are the same pass-through for every processor. Only the markup differs. So when you compare two interchange-plus processors, the markup table below is the whole comparison. Comparing interchange-plus against **flat rate** is a different exercise. There you have to model the pass-through too. Count the network assessments on the interchange-plus side when you do. Leaving them out is the easiest way to rig the comparison in interchange-plus's favour. This site did exactly that in an earlier version. ### The Full Published Schedule Helcim publishes five bands plus a custom band. All bands are **monthly** credit card volume. | Monthly volume | Card-present markup | Online / keyed markup | |----------------|---------------------|-----------------------| | **$0 - $50K** | IC + 0.40% + $0.08 | IC + 0.50% + $0.25 | | **$50K - $100K** | IC + 0.35% + $0.07 | IC + 0.45% + $0.20 | | **$100K - $500K** | IC + 0.25% + $0.07 | IC + 0.35% + $0.20 | | **$500K - $1M** | IC + 0.20% + $0.06 | IC + 0.25% + $0.15 | | **$1M - $5M** | IC + 0.15% + $0.06 | IC + 0.15% + $0.15 | | **Over $5M** | Custom | Custom | Source: [helcim.com/pricing](https://www.helcim.com/pricing/), verified 2 August 2026. Adding this site's pass-through assumption gives the all-in rate you'd actually pay on an ordinary card mix: | Monthly volume | All-in, card-present | All-in, online | |---|---|---| | **$0 - $50K** | 1.43% + $0.258 | 2.00% + $0.422 | | **$50K - $100K** | 1.38% + $0.248 | 1.95% + $0.372 | | **$100K - $500K** | 1.28% + $0.248 | 1.85% + $0.372 | | **$500K - $1M** | 1.23% + $0.238 | 1.75% + $0.322 | | **$1M - $5M** | 1.18% + $0.238 | 1.65% + $0.322 | Those are the formulas every worked example below runs on. Substitute your own pass-through and they'll all move. :::warning[Three things about these bands that get published wrong] 1. **There are five published bands, not three.** The three-band version that circulates ($0-50K, $50K-$250K, $250K-$1M) is wrong. The real bands are $0-50K, $50K-100K, $100K-500K, $500K-1M, and $1M-5M. 2. **"Over $1M = Negotiated" is wrong.** Helcim publishes the $1M-$5M band openly at 0.15% + 6 cents card-present. Negotiation starts at $5 million a month, not $1 million. Do $2 million a month and someone will tell you your Helcim rate is negotiable. They're describing a band Helcim already publishes. 3. **The bands are monthly.** Helcim labels them "monthly credit card volume." [Stax](/docs/payments/processors/stax) publishes bands that look similar and are **annual**. Check the period before you compare the tables. Miss it and you're out by a factor of twelve. ::: ### Other Rates | Item | Rate | |------|------| | **Keyed-in** | Billed at the online rate for your band | | **ACH / EFT-PAD** | 0.5% + $0.25, capped at $6.00 | | **Canadian Interac** | $0.09, or $0.12 for tap | | **Chargeback resolved in your favour** | **$0.00** | | **Chargeback lost** | $15.00 | | **Monthly fee** | $0 | | **Setup fee** | $0 | | **PCI compliance fee** | $0 | | **Cancellation fee** | $0 | | **Statement fee** | $0 | | **Volume floor** | None | | **Instant deposit** | **Not published.** No instant deposit fee appears on Helcim's pricing page. Any "1%, $1 minimum" figure you find is unsourced. Ask before you rely on it | Source: [helcim.com/pricing](https://www.helcim.com/pricing/), verified 2 August 2026. ### The Dispute Policy Is the Underrated Part | Processor | Cost of a dispute you win | Cost of a dispute you lose | |-----------|---------------------------|----------------------------| | **Helcim** | **$0** | $15 | | **[Square](/docs/payments/processors/square)** | **$0** | **$0** | | **[Braintree](/docs/payments/processors/braintree)** | $15 | $15 | | **[Stripe](/docs/payments/processors/stripe)** | $15 outright win, **$30 partial win** | $30 | | **[PayPal](/docs/payments/processors/paypal)** | **$0** on a wallet dispute, $20 on a card chargeback | $15 wallet, $20 card, $30 either way above a 1.5% ratio | | **[Moneris](/docs/payments/processors/moneris)** | CA$25, plus CA$80 authorization chargeback handling | Same | All verified 2 August 2026 from each vendor's own pricing page. Helcim isn't alone at $0 any more. Square charges nothing on disputes at all. PayPal's standard tier charges nothing on a case decided in your favour. What Helcim still has is a $0 win plus published interchange-plus. Square doesn't offer that, and PayPal withdraws it the moment your dispute ratio hits 1.5%. Run 30 disputes a month and win 60%, and that's 18 free defences on Helcim. Braintree charges $270. Stripe charges $270 to $540, depending on how many are partial wins. Over a year that's $3,200 to $6,500. It's a real line item that never shows up in a rate comparison. --- ## What You Actually Pay: Worked Examples Every figure in this section runs on the published rates above, plus pass-through of 1.03% + $0.178 card-present and 1.50% + $0.172 online. Nothing is estimated. Nothing is rounded up. ### One $100 Transaction, Entry Band | Component | Card-present | Online | |-----------|--------------|--------| | Interchange (blended, Visa schedule of 18 April 2026, weighted by Federal Reserve transaction counts) | $1.05 (0.89% + $0.158) | $1.51 (1.36% + $0.152) | | Network assessments (**unverified**: 0.14% + $0.02) | $0.16 | $0.16 | | **Pass-through subtotal** | **$1.21** (1.03% + $0.178) | **$1.67** (1.50% + $0.172) | | Helcim markup, $0-50K band | $0.48 (0.40% + $0.08) | $0.75 (0.50% + $0.25) | | **Total** | **$1.69 (1.69%)** | **$2.42 (2.42%)** | The assessment line is flagged because it deserves to be. Neither Visa nor Mastercard publishes network assessments on any page this site could read. So 0.14% + $0.02 sits at the conservative end of what's plausible. That's the end that makes interchange-plus look **worse**. Moving it between 0.10% and 0.25% changes none of the verdicts here. Run a single card type's interchange as though it were a blend and the same table reads $2.52 card-present and $2.79 online. That's the size of the error. ### The Same $100 Against Competitors Whose US Rates Are Verified | Channel | Helcim, entry band | Competitor | Helcim saves | |---------|-------------------|-----------|--------------| | **Card-present** | $1.69 | Square Free, 2.6% + $0.15 = **$2.75** | **$1.06** | | **Card-present** | $1.69 | Stripe Terminal, 2.7% + $0.05 = **$2.75** | **$1.06** | | **Card-present** | $1.69 | PayPal Zettle, 2.29% + $0.09 = **$2.38** | **$0.69** | | **Online** | $2.42 | Braintree, 2.89% + $0.29 = **$3.18** | **$0.76** | | **Online** | $2.42 | Stripe, 2.9% + $0.30 = **$3.20** | **$0.78** | | **Online** | $2.42 | Square Free, 3.3% + $0.30 = **$3.60** | **$1.18** | At **$40,000 a month with a $100 average ticket** (400 transactions), those per-transaction gaps annualise into real money: | Channel | Helcim | Competitor | Helcim saves | |---|---|---|---| | Card-present | $675.20 (1.69%) | Square Free $1,100.00 (2.75%) | **$424.80/month, $5,098/year** | | Card-present | $675.20 (1.69%) | Stripe Terminal $1,100.00 (2.75%) | **$424.80/month, $5,098/year** | | Card-present | $675.20 (1.69%) | PayPal Zettle $952.00 (2.38%) | **$276.80/month, $3,322/year** | | Online | $968.80 (2.42%) | Braintree $1,272.00 (3.18%) | **$303.20/month, $3,638/year** | | Online | $968.80 (2.42%) | Stripe $1,280.00 (3.20%) | **$311.20/month, $3,734/year** | | Online | $968.80 (2.42%) | Square Free $1,440.00 (3.60%) | **$471.20/month, $5,654/year** | Anyone calling that "not life-changing" is running the 1.80% assumption, which puts the same volume near $92 a month card-present and $164 online. At a $100 ticket the real gap runs $277 to $471 a month. That matters at $40,000 a month. :::note[Stripe Terminal and Square land on the same number here. Don't read it as a tie] Stripe Terminal (2.7% + 5c) and Square Free card-present (2.6% + 15c) both come to exactly **$2.75** on a $100 sale, which is why those two rows are identical. That's an artefact of this ticket size, not a draw. Stripe's fixed component is ten cents lower and its percentage is a tenth of a point higher, so the two cross at $100 and diverge either side of it. **Stripe is cheaper below a $100 ticket, Square is cheaper above it.** At a $20 ticket Stripe is 2.95% against Square's 3.35%. At $500 it's 2.71% against 2.63%. Run it at your own average ticket rather than borrowing this one. ::: ### Different Card Types, Same $100, Same Band Interchange isn't one number. This table is the part flat-rate hides from you. It's also where Helcim loses. All rates are Visa's published US schedule of 18 April 2026, cross-checked against Mastercard's of 17 April 2026. Add 0.14% + $0.02 of assessments and the entry-band markup. | Card the customer hands you | Card-present interchange | Helcim all-in, in person | Online interchange | Helcim all-in, online | |---|---|---|---|---| | **Regulated debit** (large-bank) | 0.05% + $0.22 | **$0.91** (0.91%) | 0.05% + $0.22 | **$1.18** (1.18%) | | **Exempt debit** (small-bank) | 0.80% + $0.15 | **$1.59** (1.59%) | 1.65% + $0.15 | **$2.71** (2.71%) | | **Exempt prepaid** | 1.15% + $0.15 | **$1.94** (1.94%) | 1.75% + $0.20 | **$2.86** (2.86%) | | **Consumer credit, no rewards** | 1.51% + $0.10 | **$2.25** (2.25%) | 1.89% + $0.10 | **$2.90** (2.90%) | | **Standard rewards credit** | 1.65% + $0.10 | **$2.39** (2.39%) | 2.05% + $0.10 | **$3.06** (3.06%) | | **Premium rewards** (Signature Preferred) | 2.10% + $0.10 | **$2.84** (2.84%) | 2.50% + $0.10 | **$3.51** (3.51%) | | **Top consumer tier** (Visa Infinite, MC World Elite) | 2.30% + $0.10 | **$3.04** (3.04%) | 2.60% + $0.10 | **$3.61** (3.61%) | | **Commercial / business** | 2.26% + $0.10 | **$3.00** (3.00%) | 2.79% + $0.10 | **$3.80** (3.80%) | | **This site's blended mix** | 0.89% + $0.158 | **$1.69** (1.69%) | 1.36% + $0.152 | **$2.42** (2.42%) | Read the last three credit rows next to Square Free's $2.75 card-present. On a **premium rewards** card Helcim costs $2.84 and Square costs $2.75. On a **Visa Infinite or Mastercard World Elite** it's $3.04 against $2.75. On a **commercial** card, $3.00 against $2.75. No ticket size rescues Helcim on those three. Its all-in percentage already exceeds Square's before the fixed fee counts. If half your counter is business cards, the flat rate is genuinely the better deal. On regulated debit the same comparison is $0.91 against $2.75. That's the spread interchange-plus exists to expose. The old version of this table used "Rewards credit 1.95% + $0.10" and "Premium card 2.40% + $0.10." Those match neither Visa's card-present schedule nor its online one. It didn't distinguish the channels at all. ### Monthly Cost by Volume, Online at a $100 Ticket | Monthly volume | Band | Pass-through | Helcim markup | Total | Effective | |----------------|------|----------------------|---------------|-------|-----------| | **$75,000** (750 txns) | $50K-$100K, 0.45% + $0.20 | $1,254.00 | $487.50 | **$1,741.50** | 2.32% | | **$300,000** (3,000 txns) | $100K-$500K, 0.35% + $0.20 | $5,016.00 | $1,650.00 | **$6,666.00** | 2.22% | | **$1,500,000** (15,000 txns) | $1M-$5M, 0.15% + $0.15 | $25,080.00 | $4,500.00 | **$29,580.00** | 1.97% | The old figures here were $2,017.50, $7,770.00 and $35,100.00, at effective rates of 2.69%, 2.59% and 2.34%. They ran on a 1.94% + $0.10 online assumption that appeared nowhere else on the site. The page claimed it was "the same assumption used on the processor comparison page." It wasn't. There's one assumption now, and it's [published in full](/docs/payments/reference/cost-model-assumptions). Against the two online flat rates verified in USD: | Monthly volume | Helcim | Braintree (2.89% + $0.29) | Square Free (3.3% + $0.30) | |----------------|--------|--------|--------------| | $75,000 | $1,741.50 (2.32%) | $2,385.00 (3.18%), Helcim saves **$643.50** | $2,700.00 (3.60%), Helcim saves **$958.50** | | $300,000 | $6,666.00 (2.22%) | $9,540.00 (3.18%), Helcim saves **$2,874.00** | $10,800.00 (3.60%), Helcim saves **$4,134.00** | | $1,500,000 | $29,580.00 (1.97%) | $47,700.00 (3.18%), Helcim saves **$18,120.00** | $54,000.00 (3.60%), Helcim saves **$24,420.00** | Helcim's advantage grows with volume because the markup falls while a flat rate doesn't. ### Where Helcim Loses: $15 Card-Present This is the honest counterweight to everything above. It holds across a very wide volume range. At a $15 card-present ticket, PayPal Zettle's 9-cent fixed fee beats Helcim's combined 25.8 cents at every volume below $500,000 a month. | Monthly volume | Helcim | PayPal Zettle | Winner | |---|---|---|---| | $5,000 | $157.50 (3.15%) | **$144.50 (2.89%)** | Zettle by $13.00 | | $20,000 | $630.00 (3.15%) | **$578.00 (2.89%)** | Zettle by $52.00 | | $100,000 | $2,933.33 (2.93%) | **$2,890.00 (2.89%)** | Zettle by $43.33 | | $500,000 | **$14,083.33 (2.82%)** | $14,450.00 (2.89%) | Helcim by $366.67 | The flip happens at exactly $500,000 a month. Helcim enters its $500K-$1M band and its crossover ticket drops from $19.53 to $13.96. Below that volume, at a $15 ticket, Zettle is the answer. Helcim isn't. --- ## Helcim vs Stax: The Comparison That Actually Decides It Both are transparent. Both pass interchange through. They lose to each other at different volumes. This is the comparison most merchants should run. It isn't the one most articles run. | | Helcim | Stax | |---|--------|------| | **Monthly fee** | $0 | $99 to $199+, set by **annual** volume | | **Percentage markup** | 0.15% to 0.50% depending on **monthly** band | **0%** | | **Per transaction, card-present** | $0.08 entry, dropping to **$0.07 above $50,000/month** and $0.06 above $500,000 | $0.08 flat | | **Per transaction, online** | $0.15 to $0.25 | $0.15 | | **Chargeback you win** | **$0** | Not published. Optional protection add-on at $25 per chargeback | | **Slow month** | You pay nothing extra | You pay the subscription regardless | | **Volume floor** | None | Not published | Both verified 2 August 2026 from [helcim.com/pricing](https://www.helcim.com/pricing/) and [staxpayments.com/pricing](https://staxpayments.com/pricing/). Interchange is identical for both, so it cancels out entirely. Everything below compares **markup and fees only**. That's why these crossovers don't depend on the pass-through assumption at all. ### Card-Present: The Crossover Is $58,000 to $70,300, Not $50,000 The $50,000 figure comes from setting Helcim's 0.40% markup equal to Stax's $199 and stopping there. The number breaks and so does the reasoning. In Helcim's entry band the cents genuinely cancel. The first crossing is easy to compute: ``` 0.40% x V = $199 -> V = $49,750/month ``` But Helcim's band improves at exactly $50,000 a month, to 0.35% + **7 cents**. Its cent charge is now a penny **below** Stax's, not equal to it. That step reclaims the lead almost immediately. So the durable crossover sits higher. And it depends on ticket size. The 7-cent advantage is worth more when there are more transactions: ``` Helcim ($50K-$100K band) = 0.0035 x V + $0.07 x (V / A) Stax (at the $199 floor) = $0.08 x (V / A) + $199 0.0035V - 0.01V/A = 199 V = 199 / (0.0035 - 0.01/A) ``` | Average card-present ticket | Stax overtakes Helcim at about | |---|---| | $15 | **$70,235/month** | | $50 | **$60,303/month** | | $100 | **$58,529/month** | | $150 | **$57,961/month** | Note the direction. Card-present, the crossover **falls** as tickets get bigger. Helcim's 7-cent advantage is worth less when there are fewer transactions to apply it to. There's one narrow exception, worth knowing if you're sitting on it. Between about $49,750 and $50,000 a month, Stax at its $199 floor edges ahead. Then Helcim's band step takes the lead straight back. That's a $250-wide window. It's a sawtooth artefact, not a reason to switch. ### Online: The Crossover Depends on Ticket and on Which Stax Tier You're In A single "$50 ticket, roughly $20,000 a month, below that Helcim and above it Stax" doesn't hold. It's false between $20,834 and $28,429. There Stax's subscription steps to $199 and Helcim retakes the lead. ``` Helcim entry online = 0.005 x V + $0.25 x (V / A) Stax = $0.15 x (V / A) + subscription ``` At a **$50 ticket** that reduces to `0.007 x V = subscription`: | Stax subscription | Solves to | Valid at that tier? | Result | |---|---|---|---| | $99 (up to $150K/yr) | $14,143/month | **No.** That's $169,714/year, past the tier | No $99 window exists at this ticket | | $139 ($150K-$250K/yr) | $19,857/month | Yes ($238,286/year) | Stax wins from **$19,857 to $20,833** | | $199+ (above $250K/yr) | $28,429/month | Yes | Helcim retakes $20,834-$28,428; **Stax wins durably above $28,429** | At other tickets, at Stax's $199 floor: | Average online ticket | Stax overtakes Helcim at about | |---|---| | $25 | **$22,111/month** | | $50 | **$28,429/month** | | $75 | **$31,421/month** | | $100 | **$33,167/month** | | $200 | **$36,182/month** | Here the crossover **rises** with ticket size. That's the opposite of the card-present pattern. Stax's cheaper cent charge is doing the work. Bigger tickets mean fewer transactions to apply it to. At a **$25 ticket** the lower Stax tiers open earlier windows, and they sawtooth. Stax wins from $11,000 to $12,500. Helcim retakes it to $15,444. Stax wins to $20,833. Helcim retakes it to $22,111. Stax wins above that. Crossing a Stax tier boundary can make your bill go **up** while your volume goes up. [Stax's own page](/docs/payments/processors/stax) documents the sawtooth in full. ### Worked Check at $75,000 a Month Online 1,500 transactions at $50. Pass-through is $1,383.00 for both and cancels out, so only the markup column decides it: | | Markup and fees paid | Total including pass-through | Effective | |---|---|---|---| | **Helcim** ($50K-$100K online, 0.45% + $0.20) | $337.50 + $300.00 = **$637.50** | $2,020.50 | 2.69% | | **Stax** ($900K/year, $199+ subscription, 0% + $0.15) | $199.00 + $225.00 = **$424.00** | $1,807.00 | 2.41% | Stax is $213.50 a month cheaper at that volume and ticket. That's expected. $75,000 is well past the $28,429 crossover for a $50 online ticket. ### So Which Should You Pick? - **Card-present, under about $58,000 a month:** Helcim, at any ticket above $9.23. Under $19.53, look at PayPal Zettle before either of them - **Card-present, above roughly $58,000 to $70,300 a month** (it depends on ticket, so use the table): get a Stax quote. Don't assume the $199 floor is your price - **Online at a $25 ticket:** the sawtooth matters. Price both between $11,000 and $22,000 a month - **Online at a $50 ticket, under $19,857 a month:** Helcim - **Online at a $100 ticket, under about $33,167 a month:** Helcim - **Above the crossover with real dispute volume:** Helcim can still win. Stax publishes no base chargeback fee and sells protection at $25 a chargeback. Helcim charges $0 when you win. Price your own dispute book before deciding - **Seasonal or unpredictable volume:** Helcim. A subscription you pay in a dead month is a pure loss One caveat on all of it. Stax publishes "$199+" for $250,000 a year and up. The plus sign is unbounded. Every Stax figure above uses $199. So these are the **earliest** volumes at which Stax could overtake Helcim. Not the volumes at which it will. Get the actual number in writing first. --- ## What Helcim Does Well ### 1. Pricing Transparency Helcim shows interchange, network assessments and its own markup separately on every transaction. You can see when premium cards cost you more. Then you can decide whether to do anything about it. ### 2. Automatic Volume Discounts Your markup drops when you cross a band. No renegotiation, no contract amendment, no sales call. Go from $75,000 to $150,000 a month online and you move from 0.45% + $0.20 to 0.35% + $0.20. That's $150 a month on the new volume. ### 3. No Junk Fees No PCI compliance fee, no statement fee, no batch fee, no annual fee, no minimum monthly fee, no cancellation fee. Helcim states all of these as zero on its pricing page. ### 4. $0 Chargebacks When You Win Covered above. Worth restating. It's the most merchant-friendly policy verified for this site. It's why a dispute-heavy business might pick Helcim over a marginally cheaper competitor. ### 5. Month-to-Month No long-term commitment, no early termination fee, no volume commitment. --- ## What Helcim Does Poorly ### 1. Interchange-Plus Takes Learning Your effective rate varies month to month with your card mix. Predicting next month's processing cost is harder than with flat-rate. Budget a couple of weeks to get comfortable reading the statement. ### 2. Not Plug-and-Play Pre-built plugins are straightforward, but custom API work is less capable than Stripe's. Terminal configuration takes setup. Days, not minutes. ### 3. Smaller Ecosystem Fewer integrations than Stripe, less hardware range than Square, and no full POS suite. Helcim is a payments processor rather than a business operating system. ### 4. It Loses on Small Card-Present Tickets At a $15 ticket in person, PayPal Zettle is cheaper at every volume below $500,000 a month. Square is cheaper below a $9.23 ticket. Helcim's combined fixed component in the entry band is 25.8 cents. That's the largest of any interchange-plus option this site ranks. Small tickets are where a low fixed fee wins, and Helcim doesn't have one. ### 5. Stax Is Cheaper Above the Crossover Worth being direct about, since this page is on a site that sells nothing. Helcim's percentage markup keeps scaling with volume. Stax's doesn't, because there isn't one. Above roughly $58,000 to $70,300 a month card-present, or $22,100 to $36,200 online, Stax wins on cost at its published floor. Helcim's answer is the dispute policy and the absence of a subscription, not the markup. ### 6. Smaller Company Helcim is smaller than Stripe, Square, and PayPal. If that becomes a problem, it becomes a migration. --- ## Pricing Comparison Tables ### $20,000/Month Card-Present, $50 Ticket 400 transactions. This is the reference cell. It's the one that most exposes the old error on this page. | Processor | Model | Monthly | Effective | |-----------|-------|---------|-----------| | **Helcim** | IC + 0.40% + $0.08 | **$389.20** | **1.95%** | | **Stax** | $139 subscription ($240K/year), 0% + $0.08 | $448.20 | 2.24% | | **PayPal Zettle** | 2.29% + $0.09 | $494.00 | 2.47% | | **Square (Free)** | 2.6% + $0.15 | $580.00 | 2.90% | **Savings against Square Free: $190.80 a month, or $2,290 a year.** Under the old 1.80% + $0.10 assumption this read as roughly $10 a month. That would reasonably have changed nobody's mind. ### $75,000/Month Online, $100 Ticket 750 transactions. | Processor | Model | Monthly | Effective | |-----------|-------|---------|-----------| | **Stax** (unranked) | $199+ subscription, 0% + $0.15 | $1,565.50 | 2.09% | | **Helcim** | IC + 0.45% + $0.20 | **$1,741.50** | **2.32%** | | **Braintree** | 2.89% + $0.29 | $2,385.00 | 3.18% | | **PayPal standard card** | 2.99% + $0.49 | $2,610.00 | 3.48% | | **Square (Free)** | 3.3% + $0.30 | $2,700.00 | 3.60% | | **PayPal Checkout** | 3.49% + $0.49 | $2,985.00 | 3.98% | **Savings against Braintree: $643.50 a month, or $7,722 a year. Against Square's free plan: $958.50 a month, or $11,502 a year.** Stax is shown first because it's genuinely cheaper here. It's marked unranked because $900,000 a year puts it in the "$199+" tier with no published ceiling. Square Plus and Premium publish lower card rates but not their plan prices, so they can't be ranked either. ### $300,000/Month Online, $100 Ticket 3,000 transactions. | Processor | Model | Monthly | Effective | |-----------|-------|---------|-----------| | **Stax** (unranked) | $199+ subscription, 0% + $0.15 | $5,665.00 | 1.89% | | **Helcim** | IC + 0.35% + $0.20 | **$6,666.00** | **2.22%** | | **Braintree** | 2.89% + $0.29 | $9,540.00 | 3.18% | | **Square (Free)** | 3.3% + $0.30 | $10,800.00 | 3.60% | | **PayPal Checkout** | 3.49% + $0.49 | $11,940.00 | 3.98% | Stax's markup here is a $199 subscription plus 3,000 transactions at 15 cents. That's $649, against Helcim's $1,650. Pass-through is identical for both at $5,016.00. **Stax is $1,001 a month cheaper at $300,000 online**, if the $199 tier holds at $3.6 million a year. It publishes that tier as "$199+". Get the actual number in writing before switching. All rates verified from each vendor's own pricing page on 2 August 2026, with Stripe's US card and Terminal rates read from a US connection on 4 August 2026. --- ## Who Helcim Is Best For ### Perfect Fit | Business Type | Why Helcim Wins | |---------------|-----------------| | **Card-present above about a $9.23 ticket** | Cheaper than Square's flat rate on an ordinary card mix, at any volume, with no subscription to earn back first | | **Debit-heavy retail** | The strongest case on the page. Regulated debit costs $0.91 on a $100 sale against Square's $2.75. Flat-rate keeps that saving | | **Seasonal businesses** | No monthly fee means a dead month costs nothing | | **Dispute-heavy merchants** | $0 when you win is unmatched among the processors verified here | | **B2B with Level 2 and 3 data** | Level 2 and 3 support can lower commercial-card interchange. Worth checking carefully, because at **standard** commercial rates Helcim's 3.00% all-in on a $100 sale is worse than Square's $2.75. The saving only exists if your data actually qualifies | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Card-present under about a $19.53 ticket** | [PayPal Zettle](/docs/payments/processors/paypal) at 2.29% + 9c, up to $500,000 a month | | **Card-present under about a $9.23 ticket, one account only** | [Square](/docs/payments/processors/square) | | **Card mix heavy in premium rewards or commercial credit** | [Square](/docs/payments/processors/square). A flat rate caps your exposure when interchange itself runs 2.1% to 2.3% | | **Above roughly $58,000-$70,300/month card-present, or $22,100-$36,200 online, cost-only** | [Stax](/docs/payments/processors/stax), at its published $199 floor. Get the quote first | | **Want simple, predictable pricing** | Flat-rate | | **Need best developer tools** | [Stripe](/docs/payments/processors/stripe) | | **Primarily card-present retail wanting a full POS** | [Square](/docs/payments/processors/square) | --- ## Common Gotchas ### 1. Premium Card Shock Interchange-plus shows you the true cost of premium rewards cards. Some months are dearer because your customers used more of them. This isn't Helcim doing anything to you. You always paid it. Flat-rate just hid it inside an average. ### 2. Statement Complexity Helcim statements itemise interchange categories. There can be a lot of lines. Focus on the effective rate summary rather than trying to read every category. ### 3. Not Cheaper on Every Single Transaction On a premium rewards card, Helcim's entry band is 2.84% on a $100 sale in person against Square Free's 2.75%. On a commercial card it's 3.00% against 2.75%. Helcim wins on the blend, not on every line. If nearly all your customers carry premium rewards or business cards, you may not save at all. ### 4. The Bands Are Monthly, and Stax's Are Annual This trips people up constantly. Helcim's $100K-$500K band is $100,000 to $500,000 **per month**. Stax's $150,000 to $250,000 band is **per year**. Compare the tables without checking the period and you're wrong by a factor of twelve. ### 5. Instant Deposit Is Not Published Helcim's pricing page doesn't state an instant deposit fee. If same-day access to funds matters, ask for the rate in writing. Don't assume it's cheap. --- ## Test to Run **Interchange-plus savings calculation, using published numbers only:** **Week 1: Get your real inputs** 1. Pull your last three statements. Record total volume, total transaction count, and total fees 2. Calculate your current effective rate: `total fees / total volume` 3. Calculate your average ticket: `total volume / transaction count`. This is the variable that decides the answer, not your volume 4. Ask your current processor for the interchange breakdown. If they won't provide it, that answer is itself informative **Week 2: Build the Helcim number** 5. Find your monthly volume band in the [published schedule above](#the-full-published-schedule) 6. Helcim cost = `(pass-through % x volume)` + `(pass-through cents x count)` + `(band % x volume)` + `(band cents x count)` 7. If you don't know your own pass-through, use this site's figures as a placeholder. **1.03% + $0.178 card-present** or **1.50% + $0.172 online**. Mark the answer an estimate. Read [how those were derived](/docs/payments/reference/cost-model-assumptions) before you rely on them 8. Compare to your current effective rate **Week 3: Build the Stax number too** 9. Stax cost = `(pass-through x volume)` + `(count x $0.15 online or $0.08 card-present)` + `subscription` 10. Stax's subscription is set by **annual** volume: $99 up to $150,000 a year, $139 for $150,000 to $250,000, $199+ above that. Multiply your monthly volume by twelve before you pick a tier 11. Whichever of Helcim or Stax is lower, that's your real alternative to flat-rate **Week 4: Price your disputes** 12. Count disputes in the last twelve months, split into won and lost 13. On Helcim: `lost x $15`. On most competitors: `total x $15 or more` 14. Add this to the comparison. For a dispute-heavy business it can reverse the ranking **Success criteria:** a number for flat-rate, Helcim and Stax, built from published rates and your own statement. And you know which one wins at your ticket size and volume, not which one an article recommended. --- ## Scale Callout **Under $30K/month:** - The savings are already real at this size, and bigger than most comparisons show. At $20,000 a month card-present on a $50 ticket, Helcim is $389.20 against Square Free's $580.00. That's $190.80 a month, or $2,290 a year - Even at $5,000 a month on the same ticket it's $97.30 against $145.00, a gap of $47.70 a month or $572 a year - Helcim costs nothing to hold, so there's no downside to it being your processor while you grow - Stax's subscription wouldn't pay for itself card-present at these volumes. Online at a $25 ticket, Stax's $99 tier does beat Helcim from about $11,000 a month. Check that one **$30K-$50K/month:** - Online at a $100 average ticket, expect about **$227 a month against Braintree and $353 against Square's free plan at $30,000**, rising to **$429 and $639 at $50,000** - Card-present at a $50 ticket, $25,000 a month saves **$238.50** against Square Free and $50,000 a month saves **$512.00** - Stax still isn't in it card-present at these volumes, and online it depends entirely on your ticket **$50K-$500K/month:** - Helcim keeps improving automatically as you cross bands. At $100,000 a month card-present on a $50 ticket it's $1,776.00 against Square Free's $2,900.00 - Run the Stax comparison. Card-present, above roughly $58,000 to $70,300 a month depending on ticket. Online, above roughly $22,100 to $36,200 at Stax's $199 floor - If you run real dispute volume, Helcim's $0-on-win can close that gap **$500K-$5M/month:** - Helcim publishes bands the whole way. Nothing is negotiable and nothing needs to be - At $1,000,000 a month card-present on a $75 ticket, the $1M-$5M band lands at 1.18% + 23.8c all-in. That's **$14,973 a month at a 1.50% effective rate**, against Square Free's $28,000 and 2.80%. A gap of about **$13,027 a month, or $156,300 a year** - At $1M-$5M the markup is 0.15% + 6 cents card-present. That's lower on both components than [Adyen's own indicative markup](/docs/payments/processors/adyen) of 0.60% + $0.13. Adyen still carries no cost verdict here. It labels those rates indicative and requires a minimum monthly invoice it doesn't publish. Online, Adyen's indicative markup is actually **lower** than Helcim's entry band below a $120.00 ticket - Stax is still likely cheaper on pure markup. Get a written quote, since the $199 tier is published as "$199+" **Over $5M/month:** - This is where Helcim's pricing genuinely becomes custom - Bring the published $1M-$5M band as your anchor and negotiate down from it --- ## Where This Breaks 1. **Card mix decides the size of the win, and can erase it.** A book that's mostly premium rewards and commercial cards saves nothing and may pay more. A debit-heavy book saves far more than the examples here. The [card-type table above](#different-card-types-same-100-same-band) is the one to check first. 2. **The pass-through is an assumption, and one input in it is unverified.** Network assessments of 0.14% + $0.02 come from no published schedule. They're carried at the conservative end. Everything else is sourced, and the [derivation is published](/docs/payments/reference/cost-model-assumptions). 3. **Small card-present tickets go the other way.** Below $19.53, PayPal Zettle wins up to $500,000 a month. Below $9.23, Square wins. This page's headline result doesn't apply there. 4. **Stax is cheaper above the crossover.** Card-present that's roughly $58,000 to $70,300 a month, online roughly $22,100 to $36,200, both at a $199 floor that Stax publishes as "$199+" with no ceiling. Stated plainly because it's true. 5. **Variable costs are harder to budget.** Your rate moves monthly. Flat-rate is worse but more predictable. 6. **It requires engagement.** You have to read the statement. If you want set-and-forget, flat-rate is easier. You'll pay for the convenience. 7. **Smaller company risk.** Helcim is smaller than the household names. That's a migration risk, not a pricing risk. --- ## Next Steps **Considering Helcim?** 1. Read the [published band schedule](https://www.helcim.com/pricing/) yourself and find your band. It's keyed to monthly volume 2. Work out your average ticket before anything else. It decides this more than your volume does 3. Run the [calculation above](#test-to-run) with your own statement. Don't use anyone's calculator, including Helcim's 4. Run the same calculation for [Stax](/docs/payments/processors/stax). At most volumes one of the two clearly wins 5. Request a sample statement so you know what you'll be reading every month **Currently on flat-rate?** 1. Calculate your current effective rate 2. Model Helcim with your card mix, not with an average 3. Add your dispute costs to both sides. On Stripe a partial win costs $30 and on Helcim a win costs $0 **Already on interchange-plus elsewhere?** 1. Compare markup to markup. Pass-through is identical, so the markup table is the whole comparison 2. Helcim's schedule is published. That makes it a useful anchor for renegotiating with your current provider, even if you never switch 3. Only switch for a difference that survives your switching costs --- ## See Also - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - The pass-through every number on this page runs on, with its sources and its unverified inputs - [Processor Comparison](/docs/payments/processor-comparison) - All 24 scenarios and every crossover, with the arithmetic - [Stax](/docs/payments/processors/stax) - No percentage markup, cheaper above the crossover - [PayPal](/docs/payments/processors/paypal) - Zettle wins the small card-present tickets - [Square](/docs/payments/processors/square) - Flat-rate alternative with a full POS, and cheaper on premium and commercial cards - [Adyen](/docs/payments/processors/adyen) - Enterprise, indicative rates only, and no cost verdict here - [Buying Payments](/docs/payments/buying-payments) - Interchange-plus vs flat-rate - [Interchange Reference](/docs/payments/reference/interchange) - Understanding interchange - [Reading Statements](/docs/operations/reading-statements) - Decoding interchange-plus statements --- ## Lightspeed Source: https://paymentsandrisk.com/docs/payments/processors/lightspeed # Lightspeed :::info[TL;DR] - Lightspeed is a POS and e-commerce platform for retailers and restaurants that need deep inventory. Matrix variants, purchase orders, vendor management, serialised tracking. Square and Clover can't match it. - **The card-present rate is 2.6% + 10c** VENDOR, shown identically on all three retail plans, US region, USD. The bare "1.5%" that turns up for Lightspeed isn't a Lightspeed figure. It appears nowhere on the pricing page. - **Chargeback fee is $15** VENDOR. Lightspeed's wording implies that's the whole dispute cost, with no separate representment fee. Set that against Stripe's $15 plus $15. - **Software plans are published for both product lines.** Retail $89 / $149 / $289, restaurant $69 / $189 / $399. - **The online, keyed and card-not-present rates are genuinely** NOT PUBLISHED. So is the restaurant processing rate. Those are the gaps to close in writing before signing. - Lightspeed's own filing shows a blended take of about 1.90% of processed volume. The US list price is 2.6% + 10c. So there's headroom below list, and Lightspeed invites negotiation on its own payments page. ::: Lightspeed sits between Square and enterprise retail systems, on both complexity and capability. Square is simpler and cheaper. Inventory depth is the reason to pick Lightspeed. Its card-present rate is published. Its online rate isn't. :::caution[The "1.5%" attached to Lightspeed was never a Lightspeed figure] **The string "1.5" appears nowhere on Lightspeed's pricing page.** Not a partial rate. Not a promotional rate. Not one component of a rate. Don't reproduce it, not even as a thing to be sceptical of. The real rate is **2.6% + 10c**, from [lightspeedhq.com/pos/retail/pricing/](https://www.lightspeedhq.com/pos/retail/pricing/), US region, USD, on **2 August 2026**. It sits alongside Square and Clover. And it clears interchange comfortably, which a 1.5% card-present rate couldn't. That's the tell. **One genuine absence.** The restaurant pricing page publishes plan prices and no processing rate. That's a product-line difference, not a page hiding something. Full [source list at the bottom of this page](#sources). ::: ## When to Use Lightspeed **You should use Lightspeed if:** - You run a retail store with complex inventory: apparel with sizes and colours, sporting goods, home decor. - You need purchase orders, vendor management, and reorder points inside the POS. - You operate multiple retail locations and need centralised inventory. - You want integrated e-commerce synced with in-store stock. - You've outgrown Square's inventory management. **Skip Lightspeed if:** - You're a simple operation under about 100 SKUs. [Square](/docs/payments/processors/square) is cheaper and easier. - You're online-first. [Shopify](/docs/payments/processors/shopify-payments) is better for pure e-commerce. - You just need payment processing without a POS. [Stripe](/docs/payments/processors/stripe) or [Helcim](/docs/payments/processors/helcim) is simpler and both publish their rates. - You sell online. Lightspeed publishes no online, keyed or card-not-present rate at all, so you can't cost that half of the business before committing. - You run a restaurant and want the deepest food-service features. [Toast](/docs/payments/processors/toast) is more specialised. --- ## Pricing Breakdown ### Processing Rates VENDOR | Item | Figure | |------|--------| | **Card-present, retail (X-Series)** | **2.6% + 10c**, shown identically on Basic, Core and Plus | | **Chargeback fee** | **$15**, stated twice on the payments page | | **Rate consistency** | Lightspeed's own wording: "the rate is always the same no matter what card your customer chooses to pay with" | Source: [lightspeedhq.com/pos/retail/pricing/](https://www.lightspeedhq.com/pos/retail/pricing/) and [lightspeedhq.com/payments/](https://www.lightspeedhq.com/payments/), US region, USD, accessed 2 August 2026. On the chargeback fee, Lightspeed's exact words are worth quoting. The phrasing carries information. *"The only thing you can expect is a $15 chargeback fee"* and *"You will be charged a single $15 fee and we will fight tooth and nail to dispute the claim on your behalf."* **"A single $15 fee" implies no separate representment or defence charge.** Set against [Stripe's](/docs/payments/processors/stripe) $15 to receive plus $15 to counter, that's a real difference on a dispute-prone book. It comes from a marketing FAQ rather than a fee schedule, so confirm it in writing. ### Software Plans VENDOR **Retail (X-Series):** | Plan | Monthly | Typical use | |------|---------|-------------| | **Basic** | **$89** | POS, basic inventory, basic reporting. Includes 1 register | | **Core** | **$149** | Advanced inventory, e-commerce, accounting integration. Includes 1 register | | **Plus** | **$289** | Advanced reporting, loyalty, omnichannel. Includes 1 register | Lightspeed's own note on that page: "these prices reflect Lightspeed Retail (X-Series). Prices can vary and additional service fees may apply." **Restaurant:** | Plan | Monthly | |------|---------| | **Starter** | **$69** | | **Essential** | **$189** | | **Premium** | **$399** | | **Enterprise** | Custom | | **Kitchen Display System** | **$30 per screen per month** | Annualised, retail runs $1,068, $1,788 and $3,468 a year in software, before you process a single dollar. Square's Free plan is $0 a year for the equivalent basic function. So Lightspeed's software cost is the entry fee for inventory depth. No matrix inventory, no purchase orders, no serialised tracking? Then you're paying for capability you won't use. ### What's Still NOT PUBLISHED | Item | Status | |------|--------| | **Online / card-not-present rate** | Absent from the retail, restaurant, payments and general pricing pages alike. **The biggest gap for any merchant selling online** | | **Keyed-in rate** | Same. Not published | | **Restaurant processing rate** | Published for retail, absent from the restaurant pricing page. A genuine product-line difference | | **Instant payout** | Not published | | **Third-party processor surcharge** | Lightspeed steers merchants to Lightspeed Payments, but no amount is published. A "$400 a month" figure gets quoted for it. It verifies nowhere and shouldn't be reused | | **Contract length and early termination fee** | Not published anywhere | | **Hardware prices** | Not published | | **Volume floor** | Not published | ### What to Ask For, In Writing Lightspeed **invites** negotiation on its own payments page, listing "Negotiate a competitive rate" as a bullet. Treat 2.6% + 10c as an anchor and work down. 1. **"What are the online, keyed and card-not-present rates, with the per-transaction fee?"** Published nowhere. It's the single biggest gap if you sell online. 2. **"Can you do better than 2.6% + 10c card-present?"** Lightspeed's own Q1 FY2027 filing shows a blended take of about 1.90% of processed volume. There's demonstrable headroom below list. See [the take rate note below](#the-take-rate-gap). 3. **"Is the $15 chargeback fee the only dispute cost, with no separate representment or defence fee?"**. 4. **"What is the contract term, the billing frequency, and the early termination fee?"** None of the three is published. A monthly-quoted plan usually implies an annual-versus-monthly billing choice, and Lightspeed doesn't disclose one. 5. **"What does the hardware cost, and is it bought or financed?"** This matters more than usual. Lightspeed states existing terminals can't be reused, "as these have not been injected with the certified firmware". 6. **"What is the processing rate for the restaurant product specifically?"** It's published for retail and not for restaurants. 7. **"If I use a third-party processor instead of Lightspeed Payments, what does that cost me per month or per transaction?"**. Get all seven in writing. Then run the [comparison below](#test-to-run). ### The Take-Rate Gap Is Your Leverage {/* #the-take-rate-gap */} From Lightspeed Commerce's **Q1 FY2027 earnings release, Form 6-K filed 2026-07-30**, quarter ended 30 June 2026, reported in USD under IFRS VENDOR: | Input | Q1 FY2027 | |---|---| | Gross transaction volume | $25.7 billion | | Gross payment volume | $11.3 billion (44% of GTV) | | Transaction-based revenue | $214.5 million | | Subscription revenue | $95.4 million | | Customer locations | about 146,000 | DERIVED: transaction revenue over GPV is a blended gross take of about **1.90%**. That's well below the 2.6% + 10c US list price. The gap is informative rather than contradictory. Three reasons it's lower. Transaction-based revenue includes merchant cash advances and third-party processor referral revenue. Lightspeed's volume is heavily European, where interchange caps make rates structurally far lower. And larger merchants negotiate. **What it tells you:** 2.6% + 10c is a list price, not a floor. Lightspeed's average customer pays less. Ask what the rate is at your volume. --- ## What Lightspeed Does Well ### 1. Advanced Inventory Management This is the product, and no other SMB POS matches it: - **Matrix inventory:** products tracked across multiple variants, size and colour and material, in one view. - **Purchase orders:** create POs, track receiving, manage vendor relationships. - **Serialised inventory:** individual serial numbers for electronics, luxury goods, firearms. - **Reorder points:** automatic low-stock alerts and suggested quantities. - **Multi-location inventory:** real-time stock across stores with inter-store transfers. - **Built-in catalogues:** pre-loaded SKU databases for certain verticals. Square's inventory is quantities per item and low-stock alerts. No matrix, no purchase orders, no serial tracking. Managing a size run across four colours in three stores? That gap is the whole decision, and the software fee is worth it. ### 2. Omnichannel Commerce Inventory syncs between the online store and physical locations in real time. Buy online and pick up in store, unified customer profiles, one product catalogue across channels. Against Shopify. Shopify's e-commerce is stronger online, with more themes and a bigger app ecosystem. Lightspeed's in-store POS and inventory are deeper. If more than half your revenue is in-store, Lightspeed is the stronger platform. ### 3. Reporting Sell-through by product and category, inventory turnover, margin by product, vendor, or category, employee performance, customer lifetime value, and multi-location comparison. Built for retail operators rather than for generic sales summaries. ### 4. Vertical Depth Specialised features for bike shops, sporting goods, apparel, home decor and furniture, and golf. Built-in catalogues, work orders, special orders, and variant handling shaped to those trades. --- ## What Lightspeed Does Poorly ### 1. You Cannot Price the Online Side Card-present is published at 2.6% + 10c. **Online, keyed and card-not-present are published nowhere.** Neither is the restaurant processing rate. For an omnichannel retailer, that's half the cost behind a sales call. And omnichannel retailers are exactly who Lightspeed sells to. Shopify, Square, Stripe, Clover and Helcim all publish an online rate. ### 2. Expensive Software Floor $89 to $289 a month, before processing, before hardware, before iPads. If your operation is simple, you're paying for inventory depth you don't need. ### 3. Complexity Setup takes days rather than minutes, especially with complex inventory. Staff training is more involved than Square. For a coffee shop or a single-product store it's overkill. ### 4. Steering to Lightspeed Payments Lightspeed pushes merchants to its own processing. Is that enforced with a surcharge? How much? Neither could be verified, which is itself a reason to get it in writing. A penalty for using an outside processor removes your ability to shop rates. [Shopify's gateway fee](/docs/payments/processors/shopify-payments) does the same thing. ### 5. E-Commerce Is the Weak Spot Fewer themes, a smaller app ecosystem, less SEO flexibility, and weaker marketing tooling than Shopify. If online is your primary channel, Shopify wins. --- ## Lightspeed vs Square vs Shopify All three now publish US card-present rates. | Factor | Lightspeed | [Square](/docs/payments/processors/square) | [Shopify POS](/docs/payments/processors/shopify-payments) | |--------|-----------|--------|-------------| | **Card-present rate** | **2.6% + 10c** (retail) | 2.6% + $0.15 Free, 2.5% + $0.15 Plus, 2.4% + $0.15 Premium | **2.6% + 10c** Basic, 2.5% + 10c Grow, 2.4% + 10c Advanced | | **Online rate** | **Not published** | 3.3% + $0.30 Free, 2.9% + $0.30 Plus and Premium | 2.9% + 30c Basic, 2.7% + 30c Grow, 2.5% + 30c Advanced | | **Chargeback fee** | **$15**, stated as a single fee | No per-dispute fee published | **Not published** | | **Monthly software** | **$89 to $289** retail, $69 to $399 restaurant | $0 Free, $49 Plus, $149 Premium, per location | $39 to $399, or $29 to $299 billed annually | | **Inventory depth** | Advanced: matrix, POs, serial | Basic | Moderate | | **E-commerce** | Included, moderate | Square Online, basic | The strongest of the three | | **Multi-location** | Strong | Good | Good | | **Can you price it fully?** | No. Card-present only | Yes | Yes | | **Best for** | Complex retail, 100+ SKUs | Simple retail and services | Online-first with retail attached | All figures US, USD, verified 2 August 2026 at [lightspeedhq.com/pos/retail/pricing](https://www.lightspeedhq.com/pos/retail/pricing/), [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees) and [shopify.com/pricing](https://www.shopify.com/pricing). **Bottom line, now that the card-present rates line up:** - **Lightspeed and Shopify Basic charge exactly the same card-present rate**, 2.6% + 10c. So on in-person cost, that choice isn't a rate decision. It's a software decision. Lightspeed's $89 against Shopify Basic's $39 monthly is the real difference. Inventory depth is what you're buying with it. - **Square is five cents a transaction more expensive** at the same percentage on the Free plan. On 2,000 transactions a month that's $100. - **Lightspeed still wins on inventory depth, and only on inventory depth.** Buy it for matrix variants, purchase orders and serialised tracking. The card-present rate is now competitive rather than unknowable. That's a genuine improvement. It still isn't a reason to choose Lightspeed. - **Shopify POS wins when online is your primary channel.** It also publishes an online rate where Lightspeed doesn't. --- ## Who Lightspeed Is Best For ### Perfect Fit | Business Type | Why Lightspeed Wins | |---------------|---------------------| | **Apparel retailers** | Matrix inventory, purchase orders, sell-through reporting | | **Bike and sporting goods shops** | Built-in catalogues, work orders, variant tracking | | **Multi-location retail** | Centralised inventory, inter-store transfers, location comparison | | **Home decor and furniture** | Special orders, custom pricing, delivery management | | **Serialised goods** | Electronics, luxury, firearms. Few SMB systems do this properly | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Simple retail under 100 SKUs** | [Square](/docs/payments/processors/square) | | **Online-first e-commerce** | [Shopify Payments](/docs/payments/processors/shopify-payments) | | **Coffee shops and cafes** | Square. Simpler and cheaper | | **Restaurant-only** | [Toast](/docs/payments/processors/toast) | | **Anyone optimising processing cost** | [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax). Both publish full schedules | --- ## Common Gotchas ### 1. The Rate You'll See Quoted Is Retail Only 2.6% + 10c is the **retail (X-Series) card-present** rate. It isn't stated for the restaurant product. And neither product line has a published online rate. If a salesperson quotes 2.6% + 10c for a restaurant or for online volume, get it in writing. Lightspeed doesn't publish it there. ### 2. Annual Versus Monthly Billing Published software plan prices commonly assume annual billing. Whether Lightspeed's $89, $149 and $289 do isn't stated. Ask. It changes both your cash flow and your commitment. The page's own caveat is "prices can vary and additional service fees may apply". That's doing a lot of work. ### 3. iPad Requirement, and Terminals You Cannot Reuse Lightspeed retail POS runs on iPads, which you buy separately, along with cases and stands. Budget for it as part of hardware, not as an afterthought. More importantly, Lightspeed states that **existing card terminals can't be reused**, "as these have not been injected with the certified firmware". So switching to Lightspeed Payments means new terminals, whatever you already own. And Lightspeed publishes no hardware prices. Get that quote before you commit to the software. ### 4. Feature Gating E-commerce, loyalty and advanced reporting sit on higher tiers. Work out which features you need before choosing a plan. The gap between Basic and Plus is $200 a month, or $2,400 a year. ### 5. Migration Complexity Product variants need mapping, customer data needs CSV formatting, and historical sales don't always transfer. Budget one to two weeks for a proper inventory migration, and more if your variant structure is messy. --- ## Test to Run **Lightspeed evaluation, with the processing gap closed:** **Step 1: Confirm you need the inventory depth** 1. Do you have matrix variants, purchase orders, or serialised stock? If none of the three, Square is cheaper and simpler. You can stop here. 2. Count your SKUs. Under about 100, the case for Lightspeed is weak. **Step 2: Get the numbers Lightspeed doesn't publish** 3. Ask for all seven items in the [written questions above](#what-to-ask-for-in-writing). 4. If you can't get the online rate, you don't have a quote. The card-present rate is published. The online one isn't. **Step 3: Build total monthly cost** ``` Software: $89, $149, or $289 Processing: (volume x effective rate) + (count x per-txn fee) Hardware: (iPads + terminals + accessories) / 36 Total monthly: _______ ``` **Step 4: Benchmark against a published alternative** ``` Square Free, card-present: (volume x 2.6%) + (count x $0.15) + $0 software Square Plus, card-present: (volume x 2.5%) + (count x $0.15) + subscription ``` **Step 5: Price the inventory features** 5. The difference between the two totals is what you're paying for matrix inventory, purchase orders and serialised tracking. 6. Say that difference is $250 a month. Do the inventory features save you $250 a month of staff time and stockouts? For an apparel retailer with a real size run, they usually do. For a gift shop, they usually don't. **Success criteria.** You have a written effective rate. You know your total monthly cost. And you can name the specific inventory features that justify the gap over Square. --- ## Where This Breaks 1. **You can't price the online side at all.** Card-present is published. Online, keyed and card-not-present aren't, on either product line. For an omnichannel retailer that's half the cost behind a sales call. 2. **The restaurant product publishes no rate.** That's a real product-line difference, not a page that's withholding one. 3. **Processor steering may remove your leverage.** If there's a penalty for using an outside processor, your rate is fixed for as long as you're on the platform. The amount isn't published. 4. **The software floor is high.** $1,068 to $3,468 a year retail, before anything else. That only makes sense with the inventory complexity to match. 5. **The $15 chargeback fee comes from a marketing FAQ, not a fee schedule.** The "a single $15 fee" wording implies no separate representment charge. That would be genuinely good. Confirm it in writing rather than assuming. 6. **It's a retail system first.** For restaurants, Toast is more specialised and publishes a rate. For online, Shopify is stronger and publishes a rate. --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [lightspeedhq.com/pos/retail/pricing/](https://www.lightspeedhq.com/pos/retail/pricing/) | The 2.6% + 10c card-present rate and the retail plan prices, US region, USD | Vendor page | Accessed 2026-08-02 | | [lightspeedhq.com/pos/restaurant/pricing/](https://www.lightspeedhq.com/pos/restaurant/pricing/) | Restaurant plan prices and the KDS add-on. Publishes no processing rate, confirmed by pattern-searching the rendered page | Vendor page | Accessed 2026-08-02 | | [lightspeedhq.com/payments/](https://www.lightspeedhq.com/payments/) | The $15 chargeback fee, the rate-consistency statement, the "negotiate a competitive rate" invitation, and the terminal firmware note | Vendor page | Accessed 2026-08-02 | | [Lightspeed Commerce Q1 FY2027 earnings release, Form 6-K](https://www.sec.gov/Archives/edgar/data/1823306/000182330626000037/earningsreleasefy27q1.htm) | GTV, GPV, transaction and subscription revenue and location count, behind the derived 1.90% blended take rate. Quarter ended 30 June 2026, USD under IFRS | Regulatory filing | Filed 2026-07-30 | --- ## Next Steps **Considering Lightspeed?** 1. Confirm you actually need matrix inventory, purchase orders, or serialised tracking. That's the entire reason to pay the premium. 2. Get all seven [written answers](#what-to-ask-for-in-writing), especially the online rate and the restaurant rate. 3. Run the [total cost comparison](#test-to-run) against Square's published rates. 4. Request a demo. Ask them to demonstrate your specific inventory structure, not a generic one. **Already on Lightspeed?** 1. Calculate your effective rate: total processing fees divided by total volume, over three months. It's the only reliable way to learn what you're paying. 2. Compare it to Square's and [Helcim's](/docs/payments/processors/helcim) published rates on the same volume. 3. Review your plan tier. Are you using the features that justify the step up? 4. Check your card-present rate against the published 2.6% + 10c, and against Lightspeed's own blended 1.90% take. If you're above list, that's a conversation. 5. Confirm the $15 chargeback fee is the whole dispute cost, in writing. --- ## See Also - [Square](/docs/payments/processors/square) - Simpler and cheaper, with fully published pricing - [Shopify Payments](/docs/payments/processors/shopify-payments) - Better for online-first retail - [Clover](/docs/payments/processors/clover) - Alternative POS ecosystem, also quote-only - [Helcim](/docs/payments/processors/helcim) - Published interchange-plus, useful as a processing benchmark - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table --- ## Moneris Source: https://paymentsandrisk.com/docs/payments/processors/moneris # Moneris :::info[TL;DR] - Moneris is a Canadian acquirer owned jointly by RBC and BMO. **Every figure here is in Canadian dollars.** Convert before you compare to a US rate. - Flat-rate credit is **2.65% + $0.10 CAD in person** and **2.85% + $0.30 CAD online**. - **In-store Interac Debit is $0.12 CAD flat. Online it's $1.00 CAD flat.** Those two point in opposite directions. In store, Interac beats credit on almost any basket. Online it only wins above about $25. - Dispute costs are the highest verified for this site. That's **$25.00 CAD per chargeback, plus a separate $80.00 CAD authorization chargeback handling fee**. - Moneris publishes no interchange-plus markup, no volume floor and no instant payout rate. ::: Moneris is Canada's domestic default. Deep bank integration, strong card-present, Canadian-headquartered with local support. :::note[Rate verification, and a URL trap] Every Moneris fee here was read from [moneris.com/en/pricing](https://www.moneris.com/en/pricing) and [moneris.com](https://www.moneris.com/) on **2 August 2026**. All figures are Canadian dollars. **Two of the obvious paths are broken:** moneris.com/en/plans-and-pricing and moneris.com/en/plans-pricing both error out. Only **/en/pricing** works. If you go looking for Moneris hardware and plan prices and come up empty, that's why. Contract terms and the Simplified Pricing markup really aren't published. See [what to ask for](#5-interchange-plus-has-no-published-benchmark). ::: ## When to Use Moneris **You should use Moneris if:** - You're a Canadian business and you want a domestic acquirer. - You do real in-store Interac Debit volume. At $0.12 flat it beats credit on nearly every basket. - You need bilingual POS and support. Quebec operations require it. - You bank with RBC or BMO. - You run multiple Canadian locations and need fleet terminal management. **Skip Moneris if:** - You're mostly online. [Stripe](/docs/payments/processors/stripe) has better developer tooling and publishes Canadian rates openly. - Your online volume is small-ticket and Interac-heavy. $1.00 per online Interac transaction is brutal under $25. - You have real dispute volume. The $25 plus $80 structure is the most expensive verified for this site. - You want interchange-plus with a published markup. Moneris doesn't publish one. --- ## Pricing Breakdown ### Flat-Rate Processing | Transaction Type | Rate | |------------------|------| | **Card-present credit** | **2.65% + $0.10 CAD** | | **Card-not-present credit (online)** | **2.85% + $0.30 CAD** | | **Keyed-in** | Billed as card not present: 2.85% + $0.30 CAD | | **Interac Debit, in store** | **$0.12 CAD flat** | | **Interac Debit, online** | **$1.00 CAD flat** | | **Foreign card surcharge** | **+0.80%**, incremental to 1.00% based on assessment fees | Source: [moneris.com/en/pricing](https://www.moneris.com/en/pricing), verified 2 August 2026. All figures CAD, all VENDOR. ### Monthly, Hardware and Account Fees VENDOR | Item | Amount | |------|--------| | **Monthly subscription on Flat Rate** | None stated | | **Moneris Go terminal** | **$34.95 CAD/month** | | **Moneris Online** | From **$19 CAD/month** | | **Minimum merchant discount rate** | **$5.00 CAD** | | **Moneris Go software fee** | **$5.00 CAD** | | **Paper statement** | **$2.00 CAD** | | **Aged close batch** | **$2.50 CAD** | | **Dial communications** | **$0.08 CAD** | Sources: [moneris.com/en/pricing](https://www.moneris.com/en/pricing) and [moneris.com](https://www.moneris.com/), verified 2 August 2026. Plan fees of $29.95 and $34.95 a month, plus terminal rentals of $20 to $50, get quoted for Moneris in comparison content. Only one of those appears on Moneris's own pages: **$34.95 is the published Moneris Go terminal price.** Treat the rest as unconfirmed until they're in your written agreement. Fraud tooling is stated as bundled at no extra cost: **Kount, 3DS and tokenization**. That's unusual at this price. Confirm it in your agreement. ### Disputes: The Most Expensive Verified for This Site | Fee | Amount | |-----|--------| | **Chargeback** | **$25.00 CAD** | | **Authorization Chargeback Handling** | **$80.00 CAD** | Source: [moneris.com/en/pricing](https://www.moneris.com/en/pricing), verified 2 August 2026. :::danger[The $80 authorization chargeback handling fee is unusual] No other processor verified for this site publishes anything like it. Ask Moneris exactly when it applies. On the face of it, one mishandled authorization costs $105 CAD in fees on top of the disputed amount. Where that sits against the rest of the market, all verified 2 August 2026: | Processor | Published cost of a chargeback | |-----------|-------------------------------| | [Helcim](/docs/payments/processors/helcim) | **$0 if you win**, $15 if you lose | | [Square](/docs/payments/processors/square) | **$0**, stated outright | | [Braintree](/docs/payments/processors/braintree) | $15 | | [Stripe](/docs/payments/processors/stripe) | $15 to receive, plus $15 to counter | | [PayPal](/docs/payments/processors/paypal) | $15 on wallet disputes ($0 if you win), $20 on card chargebacks, $30 above a 1.5% ratio | | **Moneris** | **CA$25, plus CA$80 authorization chargeback handling** | In a dispute-prone category in Canada, this table should decide it. Preventing a dispute on Moneris is worth several times what it's worth on most US processors. ::: ### What Moneris Does Not Publish | Item | Status | |------|--------| | **Simplified Pricing (interchange-plus) markup** | NOT PUBLISHED. The page separates interchange, network assessment and a transaction fee, and attaches **no numbers to any of them**. It states only that rates vary by card type and monthly volume. A 0.20 to 0.40% + $0.05 to $0.10 markup gets quoted for it, and verifies nowhere | | **Interac rate under Simplified Pricing** | NOT PUBLISHED | | **Instant payout / same-day funding** | NOT PUBLISHED | | **Volume floor** | NOT PUBLISHED | | **Terminal purchase price** | NOT PUBLISHED. The Moneris Go **rental** is published at $34.95 CAD/month; an outright purchase price is not | | **Contract length and early termination fee** | NOT PUBLISHED. Ask, and get it in writing | | **Chargeback fee under Simplified Pricing** | NOT PUBLISHED. The published CA$25 applies to the flat-rate product and may be negotiable on a custom agreement | --- ## The Interac Numbers Point in Opposite Directions This is the most useful thing on the page. Most Moneris comparisons get it wrong. They treat Interac as uniformly cheap. **In store, Interac Debit is $0.12 flat.** Credit is 2.65% + $0.10. Setting them equal: `0.0265V + 0.10 = 0.12`, so `V = $0.75`. **In store, Interac beats credit on any basket above 75 cents.** In practice, on everything. | In-store basket | Interac Debit | Credit (2.65% + $0.10) | Interac saves | |-----------------|---------------|------------------------|---------------| | $10 | $0.12 | $0.37 | $0.25 | | $25 | $0.12 | $0.76 | $0.64 | | $50 | $0.12 | $1.43 | $1.31 | | $100 | $0.12 | $2.75 | $2.63 | | $200 | $0.12 | $5.40 | $5.28 | **Online, Interac Debit is $1.00 flat.** Credit is 2.85% + $0.30. Setting them equal: `0.0285V + 0.30 = 1.00`, so `V = $24.56`. **Online, Interac only beats credit above about a $25 order.** Below that it costs more. On small tickets it costs a lot more. | Online order | Interac Debit | Credit (2.85% + $0.30) | Interac position | |--------------|---------------|------------------------|------------------| | $10 | $1.00 | $0.59 | **$0.41 worse.** Interac is 10% of the order | | $20 | $1.00 | $0.87 | **$0.13 worse** | | $25 | $1.00 | $1.01 | Break even | | $50 | $1.00 | $1.73 | $0.73 better | | $100 | $1.00 | $3.15 | $2.15 better | **What to do with this:** - **In store:** push Interac. Every basket saves money, and big baskets save a lot. If your terminal prompts default to credit, change them. - **Online with a low average order:** Interac is a cost, not a saving. A $12 order paying $1.00 flat is an 8.3% effective rate. That's worse than any card rate on this site. - **Online with a high average order:** Interac is excellent. A $200 order costs $1.00 instead of $6.00. Work out your own crossover on your own average order first. --- ## What Moneris Does Well ### 1. In-Store Interac $0.12 flat is excellent. It's the core reason a Canadian retailer picks Moneris. Canadian debit routes through Interac at a flat per-transaction fee, not a percentage network. That's a structural advantage Canadian merchants have and US merchants don't. ### 2. Canadian Banking Integration Moneris is a joint venture of RBC and BMO. That buys direct integration with two of the Big Five. Canadian-dollar settlement, no FX conversion, one relationship for banking and processing. ### 3. Multi-Location Fleet Management Centralized terminal management, remote firmware updates, one terminal experience across locations. Genuinely strong for chains. ### 4. Canadian Compliance and Support PIPEDA compliance, bilingual support, PCI-compliant terminals, Canadian data residency. In Quebec the bilingual requirement isn't optional. Moneris handles it properly. --- ## What Moneris Does Poorly ### 1. Dispute Costs Covered above. $25 plus a separate $80 handling fee is the most expensive dispute structure verified for this site, in any currency. ### 2. Online Interac Pricing $1.00 online against $0.12 in store is a factor of more than eight. Same payment method. On low-ticket e-commerce it turns Interac from your cheapest option into your most expensive. ### 3. E-Commerce and Developer Experience The API docs are less developer-friendly than Stripe's. Pre-built integrations are less polished. Nothing here matches Stripe Elements or Checkout. The online experience feels dated. ### 4. Pricing Transparency Beyond Flat Rate The flat-rate card is published and clear. The interchange-plus markup isn't published at all. So an IC+ quote arrives with no public benchmark. Bring [Helcim's published schedule](https://www.helcim.com/pricing/) as an anchor. Different market, but a markup is a markup. ### 5. Canada Only No global acquiring. If you expand beyond Canada, you need a second processor. --- ## Moneris vs Stripe vs Square, for Canadian Businesses | Factor | Moneris | [Stripe](/docs/payments/processors/stripe) Canada | [Square](/docs/payments/processors/square) Canada | |--------|---------|--------|--------| | **Card-present credit** | 2.65% + $0.10 CAD | Terminal 2.7% + CA$0.05 | **2.5% flat, no fixed fee** | | **Online** | 2.85% + $0.30 CAD | 2.9% + CA$0.30 | 2.8% + CA$0.30 | | **Interac in store** | **$0.12 flat** | Not published separately | 0.75% + 7c | | **Interac online** | $1.00 flat | Not published separately | 2.8% + CA$0.30, via Apple Pay or Google Pay | | **Chargeback** | CA$25 plus CA$80 handling | $15 to receive, $15 to counter | **$0.** Square covers the fee on disputes it fights | | **Monthly** | $5.00 CAD software fee, $5.00 CAD minimum discount rate | $0 | $0 | | **Instant payout** | Not published | 1% for Canada | 1.5% | | **Contract** | Not published. Ask | Month to month | Month to month | | **E-commerce and API** | Basic | The strongest of the three | Limited | | **French support** | Full bilingual | Limited | Limited | | **Best for** | High in-store volume, Interac-heavy, multi-location | Online and developer-led | Simple retail and quick start | Moneris and Stripe figures verified 2 August 2026 from [moneris.com/en/pricing](https://www.moneris.com/en/pricing) and [stripe.com/pricing](https://stripe.com/pricing) as served in Canada. Square's from [squareup.com/ca/en/payments/our-fees](https://squareup.com/ca/en/payments/our-fees), 4 August 2026. **Two rows in that table decide it, and they pull in opposite directions.** **Square is cheaper on credit card-present at every ticket size.** 2.5% flat with no fixed component beats Moneris's 2.65% + $0.10 and Stripe's 2.7% + CA$0.05 on any amount at all, and the gap widens as the ticket falls. On a $30 sale Square takes 75c, Stripe 86c and Moneris 89.5c. **Moneris wins Interac on anything above a $6.67 ticket**, and Interac is the whole reason to consider Moneris. $0.12 flat against Square's 0.75% + 7c crosses at $6.67 and never comes back. On a $50 debit sale that's 12 cents against 44.5. If a real share of your in-store volume runs on Interac, that one row outweighs the credit rate on its own. So the Canadian answer isn't a processor, it's a ratio: **work out what share of your in-store volume is Interac before you choose.** Debit-heavy goes Moneris, credit-heavy goes Square, and nothing else in the table moves the needle as much. **Bottom line for a Canadian merchant:** - **In-store and Interac-heavy:** Moneris. Nothing else here matches $0.12 flat, and it beats the small credit-rate gap. - **Online, low average order:** Stripe. Moneris's online credit rate is a touch cheaper. Stripe's tooling is far ahead, and you dodge the $1.00 Interac trap. - **Online, high average order, Interac-heavy:** Moneris. A $200 order at $1.00 flat is hard to beat. - **Dispute-prone in any channel:** not Moneris. CA$25 plus CA$80 is the deciding number. --- ## Who Moneris Is Best For ### Perfect Fit | Business Type | Why Moneris Wins | |---------------|-----------------| | **High-volume Canadian retail** | In-store Interac at $0.12 flat, multi-location fleet management | | **Grocery and convenience** | Debit-heavy baskets are exactly where the $0.12 rate pays | | **RBC or BMO business customers** | Integrated banking and processing | | **Multi-location chains** | Centralized terminal management | | **Quebec businesses** | Full bilingual POS and support | ### Poor Fit | Business Type | Better Alternative | |---------------|-------------------| | **Online-only Canadian business** | [Stripe](/docs/payments/processors/stripe) | | **Low-ticket e-commerce** | Stripe. Online Interac at $1.00 is punitive below $25 | | **Dispute-prone merchants** | Anything else. CA$25 plus CA$80 is the worst here | | **Shopify store** | [Shopify Payments](/docs/payments/processors/shopify-payments) | | **Expanding beyond Canada** | Stripe or [Adyen](/docs/payments/processors/adyen) | --- ## Common Gotchas ### 1. Online Interac Is Not In-Store Interac The two rates differ by more than a factor of eight. Offer Interac Online with a small average order and you're paying more for debit than credit. Check your average against the $24.56 crossover. ### 2. The $80 Authorization Chargeback Handling Fee Ask exactly what triggers it. Understand it before you sign, not on a statement. ### 3. Terminal Leasing Terminal leases here run for years. They're often non-cancellable. They can total several times the purchase price. Moneris doesn't publish terminal pricing. Ask for the outright purchase price and the total payable under any lease as two separate numbers. Then compare them. ### 4. Contract Terms Are Not Published Contract length, early termination fees and auto-renewal aren't on the pricing page. Ask for all three in writing. Calendar your renewal date and notice period the day you sign. ### 5. Interchange-Plus Has No Published Benchmark {/* #5-interchange-plus-has-no-published-benchmark */} Moneris Simplified Pricing separates interchange, network assessment and a transaction fee. Then it attaches no number to any of them. So a quote arrives with no public benchmark. **Ask for, in writing:** 1. The per-transaction markup **in basis points AND cents**, stated separately from interchange and from assessments 2. Whether the markup varies by card type or only by monthly volume 3. The volume bands, and the rate at each one 4. The chargeback fee under Simplified Pricing, since the published CA$25 covers flat rate only **What to push toward:** a markup well below the roughly **1.0 to 1.2 points** that flat rate implies over typical Canadian interchange. That spread is the whole reason to leave flat rate. If the quote doesn't clear a good part of it, stay where you are. **The disqualifying answer:** a refusal to state the markup separately from interchange. That quote isn't interchange-plus in any useful sense, so don't compare it as though it were. ### 6. Rate Creep Rates can change on notice. Review statements quarterly. Track your effective rate month over month: total fees divided by total volume. --- ## Test to Run **Moneris cost audit, for a Canadian merchant:** **Week 1: split your volume properly** 1. In-store credit volume and transaction count 2. In-store Interac volume and transaction count 3. Online credit volume and transaction count 4. Online Interac volume and transaction count 5. Most merchants never separate the last two. That's where the surprises are **Week 2: find your Interac crossovers** 6. In store, Interac wins above $0.75. Confirm your terminal isn't defaulting customers to credit 7. Online, calculate your average order value. Above $24.56 Interac wins, below it credit does 8. If you're below the crossover and offering Interac Online, quantify what it's costing you: `(online Interac count x $1.00) - (online Interac volume x 2.85% + count x $0.30)` **Week 3: price the disputes** 9. Count chargebacks over the last twelve months 10. Multiply by CA$25, then check how many also attracted the CA$80 handling fee 11. Compare that total to what the same disputes would cost on a processor charging $15 or nothing. It's often the largest single line in the comparison **Week 4: check the contract** 12. Find your contract end date, notice period, and early termination fee 13. Doing real volume? Ask for interchange-plus, and get the markup as a percentage plus cents so you can audit it **Success criteria:** you know your four-way volume split, your Interac Online exposure and your annual dispute cost. Your renewal date is in a calendar. --- ## Where This Breaks 1. **Online Interac at $1.00 punishes small baskets.** The headline "Interac is cheap" story is only true in store. 2. **Dispute costs are the highest here.** CA$25 plus CA$80 changes the economics of any dispute-prone business. 3. **Interchange-plus is unpublished.** You'll be quoted a markup with no public benchmark. Bring an external one. 4. **Canada only.** Expansion means a second processor and a second integration. 5. **Currency confusion.** Every number here is CAD. Put them beside US rates without converting and you get a wrong answer. It's the most common mistake in Canadian processor comparisons. --- ## Next Steps **Considering Moneris?** 1. Get a direct quote rather than a reseller quote 2. Split your projected volume four ways: in-store credit, in-store Interac, online credit, online Interac. That split decides whether Moneris is cheap or expensive for you 3. Ask what triggers the CA$80 authorization chargeback handling fee 4. Ask for the contract term, the early termination fee, and terminal purchase prices in writing 5. Compare against [Stripe's Canadian rates](https://stripe.com/pricing), which are published and easy to model **Already on Moneris?** 1. Calculate your effective rate: total fees divided by total volume 2. Check your online Interac exposure against the $24.56 crossover 3. If you're above about CA$25,000 a month, ask for interchange-plus and insist on an auditable markup 4. Review your contract for auto-renewal dates 5. Confirm your in-store terminals aren't steering customers to credit --- ## See Also - [Stripe](/docs/payments/processors/stripe) - Canadian rates are published, and better for online-first - [Square](/docs/payments/processors/square) - Cheaper on credit card-present (2.5% flat, no fixed fee) and $0 on disputes, but much worse on Interac - [Helcim](/docs/payments/processors/helcim) - Publishes Canadian Interac rates and a full markup schedule, useful as a benchmark - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table including Canadian options - [Card Payments](/docs/payments/payment-methods/cards) - Card types and interchange - [Debit Routing](/docs/payments/reference/debit-routing) - US debit routing, for contrast with Interac --- ## PayPal Source: https://paymentsandrisk.com/docs/payments/processors/paypal # PayPal :::info[TL;DR] - PayPal publishes **two online rates** and most comparisons quote only the expensive one. PayPal Checkout is 3.49% + $0.49. Standard card payments are **2.99% + $0.49**. That second one sits close to the rest of the market. - PayPal's card-present rate through Zettle, 2.29% + $0.09, is the **lowest published flat card-present rate verified for this site**. That's the opposite of PayPal's reputation. - **At a small ticket, Zettle is the cheapest card-present option this site can rank.** Its 9-cent fixed fee beats [Helcim's](/docs/payments/processors/helcim) interchange-plus below a **$19.53** ticket in Helcim's entry band. Below **$13.96** in its $500K-$1M band. Above those tickets Helcim wins. Neither claim means anything without the ticket size attached. - PayPal publishes a **$15 dispute fee and a $20 chargeback fee. They don't stack.** The $15 covers PayPal-account and Guest Checkout transactions. The $20 covers card transactions that went through neither. Nobody pays $35 on one dispute. - **The real cliff is the High Volume Dispute Fee.** Cross a 1.5% dispute ratio with more than 100 sales in the prior three months and the $15 becomes **$30**. Worse, the win exemption disappears. Under the line, a dispute you win costs $0. Over it, a dispute you win costs $30. - ACH at 1% capped at $10 is genuinely cheap for large tickets. - Run PayPal as a second method alongside a primary processor, not as your only one. The freeze risk is the reason, not the rate. ::: PayPal is the most recognized payment brand in the world. Customers trust it, and setup is easy. The pricing is better than the reputation. The dispute pricing is worse. :::note[Rate verification] Every PayPal fee on this page was read from [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) on **2 August 2026**. Hardware prices for Zettle readers weren't part of that pass. Neither was PayPal Payments Pro pricing. Where this page needs one of those, it says so. ::: ## When to Use PayPal **You should use PayPal if:** - Your customers ask for it by name. - You want a second checkout method alongside cards. - You sell internationally and want a recognized brand at checkout. - You take payments in person under about a $19.53 average ticket. Zettle at 2.29% + $0.09 is the cheapest option this site can rank there. - You take payments in person and want one predictable rate, with no interchange statement to read. - You take large ACH payments. 1% capped at $10 is cheap. **Skip PayPal as your only processor if:** - You can't survive a funds hold. That's the real risk, not the rate. - Your dispute ratio is anywhere near 1.5%. Cross it and the High Volume Dispute Fee makes PayPal the most expensive US structure verified here. - You need a good API. [Stripe](/docs/payments/processors/stripe) and [Braintree](/docs/payments/processors/braintree) are both much better. --- ## Pricing Breakdown ### Online | Product | Rate | |---------|------| | **PayPal Checkout** | 3.49% + $0.49 | | **Standard card payments** | **2.99% + $0.49** | | **Invoicing via PayPal Checkout** | 3.49% + $0.49 | | **Invoicing via card** | 2.99% + $0.49 | | **International** | **+1.50%** on top of the base rate | Source: [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees), verified 2 August 2026. :::tip[PayPal has two online rates, and most comparisons only show the expensive one] A customer paying through the PayPal wallet costs you 3.49% + $0.49. A customer paying by card through PayPal's standard card processing costs you **2.99% + $0.49**. On a $100 order that's $3.98 against $3.48. Fifty cents. On $100,000 a month at a $100 ticket it's $3,980 against $3,480, or **$500 a month**. Any table showing PayPal as a single 3.49% line overstates its card cost by half a point. What drives your blended rate is the share of customers picking the wallet over a card. You can measure that. ::: ### In Person and Keyed | Transaction Type | Rate | |------------------|------| | **Card-present (PayPal Zettle)** | **2.29% + $0.09** | | **Keyed-in** | 3.49% + $0.09 | Source: [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees), verified 2 August 2026. That's the lowest published **flat** card-present rate verified for this site. Here's a $100 in-person sale on the blended card mix and interchange assumption from [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions). | Processor | Pricing model | Card-present fee on $100 | |-----------|---------------|--------------------------| | [Helcim](/docs/payments/processors/helcim), $100K-$500K band | Interchange-plus | **$1.53** on the blended mix | | [Helcim](/docs/payments/processors/helcim), first band | Interchange-plus | **$1.69** on the blended mix | | **PayPal Zettle** | Flat | **$2.38** | | Square Premium | Flat | $2.55, though Square doesn't publish the Premium plan price | | [Square](/docs/payments/processors/square) Free | Flat | $2.75 | | [Stripe](/docs/payments/processors/stripe) Terminal | Flat | $2.75 | Sources: [paypal.com](https://www.paypal.com/us/business/paypal-business-fees), [squareup.com](https://squareup.com/us/en/payments/our-fees), [helcim.com/pricing](https://www.helcim.com/pricing/), verified 2 August 2026; [stripe.com/pricing](https://stripe.com/pricing) read from a US connection 4 August 2026. Stripe Terminal and Square Free tie at $2.75 here, but only because the ticket is $100. Stripe's fixed component is ten cents lower and its rate a tenth of a point higher, so the two cross at exactly this ticket and separate either side of it. :::warning["Lowest flat rate" is not the same as "cheapest," and the deciding number is your average ticket] Zettle wins the flat-rate comparison. Whether it wins the whole comparison depends on two things: your ticket size and your card mix. **Ticket size.** Zettle's 9-cent fixed fee is the lowest published here. At a small ticket the fixed fee is most of the cost. On the blended mix, **Zettle beats Helcim's entry band below a $19.53 ticket**. Below $15.64 once Helcim reaches its $100K-$500K band. Below $13.96 in the $500K-$1M band. Above those, Helcim wins and the gap widens with the ticket. At a $15 ticket on $20,000 a month, Zettle costs $578.00 against Helcim's $630.00. At a $50 ticket on the same volume it's $494.00 against $389.20, the other way round. **Card mix.** Flat rate means 2.29% whether the customer taps a rewards Visa or a regulated debit card. Interchange-plus passes the real interchange through. Regulated US debit interchange is capped near 0.05% + $0.21. On a $100 in-person sale, [Helcim's](/docs/payments/processors/helcim) entry band costs about **$0.91 on regulated debit**, $1.59 on exempt debit, $2.39 on a standard rewards credit card and about **$2.84 on a premium rewards card**. Zettle is $2.38 on all of them. Debit-heavy mix, ticket over about $14 to $20? Interchange-plus beats Zettle, and it isn't close. Even on debit alone the ticket matters. Zettle still wins below about $13.53. Premium-rewards-heavy mix? Zettle's flat rate is the safer bet. Pull your last statement. Find your debit share and your average ticket, then decide from those rather than a headline rate. [Stax](/docs/payments/processors/stax) is the other interchange-plus option, at interchange + 0% + $0.08 plus a monthly subscription. It charges the same 8 cents as Helcim's entry band and adds a subscription. So it doesn't beat Helcim card-present at any volume where its price is published. [Shopify Payments](/docs/payments/processors/shopify-payments) charges **no per-transaction cents** in person. That's a structural advantage at very small tickets. Its US rate isn't published in USD, so this site can't tell you where its crossover falls. It isn't ranked in the table above. ::: PayPal's reputation is "the expensive one." On published card-present flat rates it isn't. At a small ticket it's the cheapest option this site can rank. What it lacks against Square is the POS ecosystem, not the rate. ### Bank Transfers and Payouts | Item | Rate | |------|------| | **ACH** | 1%, capped at $10.00 | | **Instant Transfer to bank** | 1.50%, $0.50 minimum | | **Standard Payout** | 2%, capped at $1.00 | Source: [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees), verified 2 August 2026. ACH capped at $10 means a $10,000 payment costs $10, not $349 through PayPal Checkout. For B2B invoicing that's the biggest cost lever PayPal offers. Most merchants never use it. ### Disputes: Three Fees, and Only One Applies at a Time | Fee | Amount | When it applies | Charged if you win? | |-----|--------|-----------------|---------------------| | **Standard Dispute Fee** | $15.00 | Transactions through a PayPal account or Guest Checkout | **No.** Not charged when the case is "Decided in your favor by PayPal or your issuer" | | **High Volume Dispute Fee** | $30.00 | Same transactions, once your dispute ratio hits 1.5% with more than 100 sales in the prior three full calendar months | **Yes.** The win exemption isn't in this tier's list | | **Chargeback Fee** | $20.00 | Card transactions that went through neither a PayPal account nor Guest Checkout | **Yes.** Charged "regardless of whether the buyer is successful" | Sources: [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees), which states "Last Updated: July 15, 2026", and the [PayPal User Agreement](https://www.paypal.com/us/legalhub/paypal/useragreement-full). Both read 2 August 2026. :::warning[The $35 figure is wrong, and it's the most common PayPal fee error in circulation] The dispute fee and the chargeback fee attach to different channels. They're alternatives, not a stack. One dispute costs $15, $20 or $30. Never $35. Anywhere you see "$15 + $20 = $35", someone has added two fees that can't both apply to the same dispute. ::: :::danger[The High Volume tier is the part nobody writes about] Crossing 1.5% doesn't just double the money. It removes an exemption. At a 0.9% dispute ratio you pay **$0** on every dispute you win. At 1.5% you pay **$30** on every dispute, wins included. So crossing PayPal's line doesn't cost you $15 a dispute. If you win most of your cases, it's the difference between free and $30 a case. It's in PayPal's User Agreement. It's the most expensive thing on this page. ::: Against the rest of the market: | Processor | Published cost of a chargeback | |-----------|-------------------------------| | **[Square](/docs/payments/processors/square)** | **$0.** "There are no fees for dispute management services for chargebacks" | | **[Helcim](/docs/payments/processors/helcim)** | **$0 if you win**, $15 if you lose | | **[Braintree](/docs/payments/processors/braintree)** | $15 | | **PayPal standard** | $15, and $0 if you win | | **PayPal card transactions** | $20, win or lose | | **[Stripe](/docs/payments/processors/stripe)** | $15 to receive, plus $15 to counter, returned only on an outright win | | **PayPal high volume** | $30, win or lose | | **[Moneris](/docs/payments/processors/moneris)** | CA$25, plus a CA$80 authorization chargeback handling fee | Read that table properly. PayPal's standard tier is mid-pack on dispute cost. Below the 1.5% line it beats Stripe on a dispute you win. Above it, PayPal is the most expensive published US structure there is. Your ratio decides which PayPal you get. At 20 chargebacks a month on card transactions, PayPal's $20 fee is $400. On Helcim, winning 60% of them costs $120. That's a $3,360 a year gap. On the high volume tier the same 20 disputes cost $600 a month, or $7,200 a year, whatever your win rate. ### Monthly Fees and Volume Pricing | Item | Status | |------|--------| | **Monthly fee, standard commercial account** | **None** | | **Volume threshold or discount schedule** | **Not published** | | **PayPal Payments Pro pricing** | Not on the business fee page | | **Micropayments pricing** | Not on the business fee page | | **Currency conversion rate** | Not on the business fee page | Four figures get quoted for PayPal that don't appear on its business fee page. Volume discounts starting at $30 million a year. Micropayments at 4.99% + $0.09, or at 5% + $0.05. Currency conversion at 3 to 4%. If micropayments or currency conversion matter to your model, get the numbers from PayPal directly. --- ## What PayPal Does Well ### 1. Consumer Trust Customers feel safer buying from an unfamiliar merchant when PayPal is at checkout. That effect is real. It's the whole reason to pay the wallet rate instead of the card rate. Whether it's worth 50 cents on a $100 order is measurable. The [test below](#test-to-run) shows how. ### 2. One-Click Checkout Saved addresses, saved payment methods, no card entry. This matters most on mobile, where card entry is where checkouts die. ### 3. The Lowest Published Flat Card-Present Rate, and the Best Small-Ticket Answer Covered above. Taking payments in person, no POS ecosystem needed, one predictable rate? Zettle at 2.29% + $0.09 beats every other flat rate verified here, at every ticket size. It also beats [Helcim's](/docs/payments/processors/helcim) interchange-plus below about a **$19.53** ticket. That makes it the cheapest card-present option this site can rank for coffee shops, bakeries, bars and market stalls. Anyone living under a $20 average sale. Above that ticket Helcim wins, and [Stax](/docs/payments/processors/stax) doesn't beat Helcim card-present at any volume where its subscription price is published. ### 4. Cheap ACH 1% capped at $10. For anyone invoicing four and five figure amounts, moving customers to ACH is worth more than any processor switch. ### 5. Global Recognition PayPal is recognized in most markets you'd want to sell into. That makes it a good secondary method for international customers, even when your primary processor handles the cards. --- ## What PayPal Does Poorly ### 1. Dispute Fees Covered above. It's the strongest argument against PayPal as a primary processor in any category with real dispute volume. ### 2. Account Holds and Freezes PayPal freezes accounts and holds funds. Common triggers: a sudden volume spike, high-ticket sales, a new account growing fast, customer complaints, and categories PayPal considers risky. The process runs like this. Account frozen without warning. An email saying it's under review. Funds held. A limited appeal path. This is PayPal's most common complaint by a wide margin, and it's why this page puts PayPal second rather than first. ### 3. Customer Support Long phone waits, slow email, scripted responses, no clear escalation path. Plan to solve problems yourself. ### 4. Clunky API PayPal's API is dated next to Stripe's. Docs are poor, error messages are inconsistent, webhook handling takes work. Want PayPal acceptance with a decent developer experience? Use [Braintree](/docs/payments/processors/braintree). It's PayPal-owned, it covers PayPal and Venmo, and its card rate is 2.89% + $0.29. --- ## Pricing Comparison (PayPal vs Competitors) | Processor | Online | Card-present | International | Disputes | |-----------|--------|--------------|---------------|----------| | **PayPal** | 3.49% + $0.49 wallet, **2.99% + $0.49 card** | **2.29% + $0.09** | +1.50% | $15 wallet disputes ($0 if you win), $20 card chargebacks, $30 above a 1.5% ratio | | **[Stripe](/docs/payments/processors/stripe)** | 2.9% + $0.30 | Terminal 2.7% + $0.05 | +1.5% | $15 + $15, neither returned on a partial win | | **[Square](/docs/payments/processors/square)** | 3.3% + $0.30 Free, 2.9% + $0.30 Plus | 2.6% + $0.15 Free | Not published | **$0** | | **[Braintree](/docs/payments/processors/braintree)** | 2.89% + $0.29 | Not separately published | +1% non-USD, +1% non-US card | $15 | | **[Helcim](/docs/payments/processors/helcim)** | IC + 0.50% + $0.25 first band | IC + 0.40% + $0.08 first band | Not published | **$0 on a win**, $15 on a loss | All verified 2 August 2026 from each vendor's own pricing page, with Stripe's US figures read from a US connection on 4 August 2026. **Verdict:** PayPal Checkout is the most expensive online rate here at every ticket size. The standard card rate is mid-pack. Zettle is the cheapest **flat** card-present rate here. It's also the cheapest card-present option of any kind below about a $19.53 ticket. Above that, Helcim's interchange-plus takes over. Dispute pricing is mid-pack below a 1.5% ratio and the most expensive published US structure above it. "PayPal is expensive" is too blunt to be useful. Your product, your average ticket and your dispute ratio decide the answer. --- ## Who PayPal Is Best For ### Perfect Fit | Business Type | Why PayPal Wins | |---------------|-----------------| | **New e-commerce stores** | Brand trust converts for unknown merchants | | **In-person sellers with an average ticket under about $19.53** | Zettle at 2.29% + $0.09 is the cheapest card-present option this site can rank at that ticket, flat-rate or not. Cafes, bars, bakeries, market stalls | | **In-person sellers who want a flat rate and no interchange statement** | Zettle is the lowest flat card-present rate here at any ticket. Above about $19.53 you're paying a premium for the predictability, so put a number on it | | **B2B invoicing** | ACH at 1% capped at $10 | | **International sellers** | Recognized nearly everywhere as a second method | | **Secondary checkout option** | The intended use, alongside a primary processor | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Dispute-heavy categories** | [Helcim](/docs/payments/processors/helcim) or [Square](/docs/payments/processors/square) | | **Only processor for a business with no cash buffer** | Anything. Hold risk is the issue, not the rate | | **Subscription SaaS** | [Stripe](/docs/payments/processors/stripe) | | **Developer-led** | Stripe or [Braintree](/docs/payments/processors/braintree) | | **Wallet-heavy checkout at scale** | Braintree. Same PayPal acceptance, 2.89% + $0.29 on the cards | --- ## Common Gotchas ### 1. The Fixed Fee Hurts Small Tickets PayPal's 49 cent fixed fee is the largest of any processor here. **On a $10 online transaction:** | | Fee | Effective rate | |---|-----|----------------| | [Braintree](/docs/payments/processors/braintree) | $0.58 | 5.8% | | [Stripe](/docs/payments/processors/stripe) | $0.59 | 5.9% | | [Helcim](/docs/payments/processors/helcim), entry band | $0.62 | 6.2% | | [Square](/docs/payments/processors/square) Free, online | $0.63 | 6.3% | | PayPal standard card | $0.79 | 7.9% | | PayPal Checkout | $0.84 | 8.4% | Helcim's figure uses the pass-through assumption of 1.50% + $0.172 plus its entry-band markup. Look how close the top four are: a penny separates Braintree, Stripe and Helcim. At a $10 ticket the fixed fee does nearly all the work, which is also why Helcim's advantage disappears below about a $9.38 online ticket. At 1,000 transactions a month, PayPal Checkout costs $261 a month more than Braintree on $10 tickets, and $210 more than Square Free. If your average order is under about $15, PayPal Checkout is the wrong default. ### 2. The Wallet Costs More Than the Card 3.49% + $0.49 for the wallet, 2.99% + $0.49 for a card. Same customer, same order, 50 cents apart on $100. Measure your wallet share. That one ratio moves your PayPal blended rate more than anything else you control. ### 3. International Fees Stack Base 3.49% plus 1.50% international is 4.99% + $0.49. On a $100 international order through the wallet, that's $5.48. Currency conversion may apply on top, and PayPal doesn't publish that rate on its business fee page. Don't use PayPal as your primary international processor. ### 4. Funds Holds If PayPal freezes your account, funds are held and the appeal path is limited. Keep your PayPal balance minimal and transfer to your bank frequently. Never run PayPal as your only processor if a hold would stop payroll. ### 5. Venmo Needs Braintree for the Full Experience Venmo shows up as an option inside PayPal Checkout. The full Venmo checkout runs through [Braintree](/docs/payments/processors/braintree), at 3.49% + $0.49. --- ## Test to Run **Is PayPal earning its fee? (if you already offer it):** **Week 1: split the two rates** 1. In your PayPal reporting, separate wallet transactions from standard card transactions 2. Calculate the blended rate you're actually paying. If most of your PayPal volume is wallet, you're paying 3.49% + $0.49 and probably assumed 2.99% 3. Calculate what the same volume would cost on your primary processor **Week 2: measure the conversion lift** 4. Compare conversion on PayPal checkout against card checkout 5. The break-even conversion lift is roughly `(PayPal rate - your primary rate) / your margin`. At a 50% margin and a 0.6 point rate difference, PayPal needs to lift conversion by about 1.2% to pay for itself **Week 3: price the disputes** 6. Count PayPal disputes and chargebacks separately over the last twelve months 7. Multiply by $15 and $20 respectively 8. Add it to the PayPal side of the comparison. This line is frequently larger than the rate difference **Week 4: find the ACH volume** 9. Identify any invoices over about $400. At that point ACH at 1% capped at $10 beats cards 10. Move them. This is usually the biggest single saving available on the page **Success criteria:** you know your wallet-versus-card split. You know whether the conversion lift covers the rate gap. Every invoice big enough for ACH is going through ACH. --- ## Scale Callout **Under $50K/month:** - PayPal as a secondary method usually pays for itself in conversion. - Watch the 49 cent fixed fee if your average order is small. **$50K-$250K/month:** - Split your reporting between the wallet rate and the card rate first. - A/B test PayPal on and off for a month. If conversion is flat, the wallet premium is pure cost. - Move large invoices to ACH. **Over $250K/month:** - Route cards through a cheaper processor and keep PayPal for actual wallet payments. That's what the two-rate structure implies. - If wallet share is high, [Braintree](/docs/payments/processors/braintree) gives you the same PayPal acceptance at 2.89% + $0.29 on cards. - Dispute fees at this volume become their own budget line. **Over $1M/month:** - PayPal publishes no volume threshold and no discount schedule. Ask anyway. - Never single-processor at this scale. A hold is an extinction event. --- ## Where This Breaks 1. **Account freeze kills your business.** If PayPal is your only processor and they freeze you, you can't take payments. Always have a second processor onboarded. 2. **The dispute ratio cliff.** Under 1.5% you pay $15, or $0 on a case you win. Over 1.5% you pay $30 on every dispute, wins included. Nothing else on this page moves as much money as that one line. 3. **No published negotiation path.** PayPal publishes no volume threshold and no discount schedule. Below whatever their internal bar is, the rate card is the rate card. 4. **Restricted business list is aggressive.** PayPal rejects faster than most. Check the [acceptable use policy](https://www.paypal.com/us/webapps/mpp/ua/acceptableuse-full) before you build. 5. **"PayPal is expensive" is too simple.** Zettle is the cheapest flat card-present rate on this site, and the cheapest card-present option of any kind below about a $19.53 ticket. Standard card processing is mid-pack. The expensive parts are the wallet rate, the 49-cent fixed fee on small online tickets, and the disputes. --- ## The PayPal Strategy **For most businesses:** 1. **Primary processor:** whichever of [Helcim](/docs/payments/processors/helcim), [Square](/docs/payments/processors/square), [Braintree](/docs/payments/processors/braintree), [Stripe](/docs/payments/processors/stripe), or [Stax](/docs/payments/processors/stax) fits your channel, ticket size and volume 2. **Secondary option:** PayPal checkout, for customers who want it 3. **Route deliberately:** cards through your primary processor, wallet payments through PayPal, large invoices through ACH 4. **In person:** under about a $19.53 average ticket with no POS need, Zettle at 2.29% + $0.09 is the cheapest option this site can rank. Above that ticket, price Helcim That gets you lower fees on most transactions, whatever conversion lift PayPal delivers, and a backup when one processor breaks. **Don't use PayPal as your only processor.** The hold risk is the reason, and it hasn't changed. --- ## Next Steps **Considering PayPal?** 1. Add it as a second method, not as your primary processor 2. Confirm current rates yourself at [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) 3. If you're taking in-person payments, work out your average ticket first. Under about $19.53, Zettle wins on rate against everything here. Above it, price [Helcim](/docs/payments/processors/helcim) on your actual card mix, and price [Square](/docs/payments/processors/square) on POS features rather than on rate 4. Review [Buying Payments](/docs/payments/buying-payments/) for the multi-processor approach **Already on PayPal?** 1. Run the [test above](#test-to-run), starting with the wallet-versus-card split 2. Move large invoices to ACH 3. Count your dispute fees. They're probably bigger than you think **Switching from PayPal?** 1. Read [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) 2. Keep PayPal as a checkout option even after you move primary processing 3. If wallet share is high, look at [Braintree](/docs/payments/processors/braintree) rather than dropping PayPal acceptance entirely --- ## See Also - [Braintree](/docs/payments/processors/braintree) - PayPal-owned, PayPal and Venmo acceptance, 2.89% + $0.29 on cards - [Stripe](/docs/payments/processors/stripe) - Better as a primary online processor - [Square](/docs/payments/processors/square) - Better card-present ecosystem - [Helcim](/docs/payments/processors/helcim) - Best dispute economics verified for this site, and cheaper than Zettle card-present above about a $19.53 ticket - [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions) - The interchange assumption behind every crossover on this page - [Adyen](/docs/payments/processors/adyen) - Enterprise and global - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table - [Buying Payments](/docs/payments/buying-payments) - Multi-processor strategy - [Checkout Conversion](/docs/payments/checkout-conversion) - Measuring PayPal's conversion lift - [Going Global](/docs/payments/going-global) - International payment methods --- ## Shopify Payments Source: https://paymentsandrisk.com/docs/payments/processors/shopify-payments # Shopify Payments :::info[TL;DR] - If you're on Shopify, use Shopify Payments. Shopify charges a **third-party gateway fee on every order** if you don't. That's 2% on Basic, 1% on Grow, 0.6% on Advanced, 0.2% on Plus. That fee is the real lock-in, not the processing rate. - **The US rates are confirmed** VENDOR. Online **2.9% / 2.7% / 2.5% + 30c** by plan. In person **2.6% / 2.5% / 2.4% + 10c**. Plans **$39 / $105 / $399** monthly, or **$29 / $79 / $299** billed annually. - **The "no cents in person" claim is Canada-only**, and it gets stated as universal. The US in-person rate carries a **10 cent** fixed component. The Canadian one carries zero. On an $8 ticket that's 1.25 points of effective rate. The two markets aren't interchangeable. - US online rates also run **0.1 points above Canadian at every tier**. That isn't a currency conversion. It's a different price. - **The chargeback fee is $15 in the US, and Shopify returns it if you win.** That's on the help centre rather than the pricing page. Instant payout and keyed-in rates are still NOT PUBLISHED. ::: If you're on Shopify, Shopify Payments is almost always the right answer. The integration is built in. And the third-party gateway fee makes anything else uneconomical. :::caution[There's no US pricing path, and one "universal" Shopify claim is Canada-only] **The US card is the bare [shopify.com/pricing](https://www.shopify.com/pricing) opened from a US connection.** There's no /us/ path to request, and its 404 doesn't mean Shopify is hiding anything. Shopify resolves country by connection, so from anywhere else you get that country's card instead. The US figures below were read on **2 August 2026** from a US connection. **One claim you'll see stated as structural is Canada-only.** "The in-person rate carries no fixed per-transaction cent charge on any plan" is true in Canada and false in the US, where it carries **10 cents**. On an $8 coffee that's 1.25 points of effective rate, which is not a rounding difference. Any single table covering both countries is wrong for one of them. For reference, the Canadian card is: plans CA$49 / CA$132 / CA$517 monthly or CA$37 / CA$99 / CA$389 annually, Plus from CA$3,400; online 2.8% / 2.6% / 2.4% + 30c; in person 2.6% / 2.5% / 2.4% + **CA$0.00**. **What genuinely is identical in both countries** is the third-party gateway fee: 2% / 1% / 0.6% / 0.2% by plan. That's the lock-in, and it travels. ::: ## When to Use Shopify Payments **You should use Shopify Payments if:** - You're on Shopify. This is the default and the gateway fee makes it close to mandatory. - You want unified reporting across sales and payments. - You're selling in multiple countries through Shopify. - You take in-person payments with Shopify POS. At zero cents in Canada and 10 in the US, its fixed fee undercuts Square's 15. That's a real advantage at low ticket sizes. **Skip Shopify Payments if:** - You're not on Shopify. It only works with Shopify. - You're in a high-risk industry. Shopify is conservative. - Shopify Payments isn't available in your country. That's the main legitimate reason to eat the gateway fee. --- ## Pricing Breakdown ### US Rates by Plan VENDOR | Shopify Plan | Monthly billing | Annual billing | Online rate | In-person rate | Third-party gateway fee | |--------------|-----------------|----------------|-------------|----------------|-------------------------| | **Basic** | $39 | **$29** | 2.9% + 30c | **2.6% + 10c** | 2% | | **Grow** | $105 | **$79** | 2.7% + 30c | **2.5% + 10c** | 1% | | **Advanced** | $399 | **$299** | 2.5% + 30c | **2.4% + 10c** | 0.6% | | **Plus** | From $2,300 | - | "Most competitive rates" | "Most competitive rates" | 0.2% | All figures US dollars. Source: [shopify.com/pricing](https://www.shopify.com/pricing), verified 2 August 2026 via a US connection. Shopify doesn't publish a number for Plus rates. "Most competitive rates" is the entire disclosure. So Plus pricing is a negotiation, and you should treat it as one. REPORTED: [Merchant Maverick](https://www.merchantmaverick.com/reviews/shopify-payments-review/), a review site that discloses referral partnerships, last updated 2024-12-23, adds that Plus is **$2,300/month on a three-year term or $2,500/month on a one-year term**. Its plan prices match Shopify's own exactly. That's a point in its favour on the Plus figure. ### The In-Person Cents: 10 in the US, Zero in Canada This is the correction that matters most on this page. | Ticket size | Shopify US, Basic (2.6% + 10c) | Shopify Canada, Basic (2.6% + 0c) | [Square](/docs/payments/processors/square) Free (2.6% + 15c) | |-------------|-------------------------------|------------------------------------------|---| | $5 | $0.23 (4.60%) | $0.13 (2.60%) | $0.28 (5.60%) | | $10 | $0.36 (3.60%) | $0.26 (2.60%) | $0.41 (4.10%) | | $25 | $0.75 (3.00%) | $0.65 (2.60%) | $0.80 (3.20%) | | $100 | $2.70 (2.70%) | $2.60 (2.60%) | $2.75 (2.75%) | Shopify still beats Square in every row, but by **5 cents a transaction in the US** rather than 15. Take a coffee shop doing 200 transactions a day at $6. That's about **$300 a month** of saved fixed fees against Square. Apply Canadian pricing to that US merchant and the same shop reads as roughly $900. The structural claim that survives. **Shopify's in-person fixed fee still undercuts Square's in both markets.** The claim that doesn't: that it's zero. In the US it isn't, and Stripe Terminal's 5 cents and PayPal Zettle's 9 both sit below it. ### What Shopify Publishes, and Where | Item | Status | Source | |------|--------|---| | **Chargeback fee** | VENDOR. **$15.00 in the US**, and "if you win the chargeback, then the fee is returned to you". Shopify attributes the fee to your bank rather than to itself | [help.shopify.com](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process). Not on the pricing page | | **Instant payout fee** | NOT PUBLISHED | The US and Canadian pricing pages and the help centre | | **Keyed-in rate** | NOT PUBLISHED | Not published separately from the online rate | | **Currency conversion rate** | NOT PUBLISHED | Not on the pricing page | | **Volume floor** | Not published, and no negotiation path below Plus | Pricing page | | **Plus plan rates** | NOT PUBLISHED. "Most competitive rates" is the whole disclosure | Pricing page | | **POS hardware prices** | Not part of this verification pass | - | Three more figures get quoted for Shopify and don't verify anywhere. A 1.5% instant payout fee, a 1.5% currency conversion fee, and a $5 a month Starter plan at 5%. The $15 chargeback fee holds up, and it sits on the help centre rather than the pricing page, which is why a pricing-page-only check missed it. **Ask Shopify support, in writing.** What do instant payouts cost? What is the keyed-in rate? Neither is on the pricing page, and both are load-bearing for a real cost model. Keep the reply. --- ## The Third-Party Gateway Fee Is the Real Story This is the fee that decides everything. It's also the one part of Shopify pricing that's unambiguous in every market. If you use any processor other than Shopify Payments, Shopify charges an additional percentage of **every order**, on top of whatever your processor charges: | Plan | Third-party gateway fee | |------|-------------------------| | **Basic** | 2% | | **Grow** | 1% | | **Advanced** | 0.6% | | **Plus** | 0.2% | Source: [shopify.com/pricing](https://www.shopify.com/pricing), verified 2 August 2026. **Worked example on Basic, using the US rates:** | | Rate | On $100,000/month, 1,000 orders | |---|------|-----------------------------------| | **Shopify Payments** | 2.9% + 30c | $3,200 | | **An outside processor at 2.9% + 30c, plus the 2% gateway fee** | 4.9% + 30c | $5,200 | | **Extra cost of going outside** | | **$2,000/month** | That's $24,000 a year to use a different processor, for reasons that have nothing to do with the processor's rate. The gateway fee isn't a processing fee. It's a platform fee. It exists to stop "which processor?" being a question at all. Note the scale of it against the plan prices. On Basic, the 2% gateway fee on a single $2,000 day exceeds the entire monthly cost of moving up to Grow. **The honest read.** Shopify Payments' rates are competitive, but they aren't what keeps you there. The gateway fee is. Factor it into any decision about staying on Shopify at all. It ties your payments cost to a platform decision rather than a payments one. --- ## Should You Upgrade Your Plan? Higher plans have lower rates and higher monthly fees. The breakeven is straightforward. **Breakeven volume = (monthly fee difference) / (rate difference)** Using the US figures, on **annual billing**: | Upgrade | Extra monthly cost | Online rate saving | Online breakeven | In-person rate saving | In-person breakeven | |---------|-------------------|--------------------|------------------|----------------------|---------------------| | **Basic to Grow** | $50 | 0.2% | **$25,000/month** | 0.1% | **$50,000/month** | | **Grow to Advanced** | $220 | 0.2% | **$110,000/month** | 0.1% | **$220,000/month** | | **Advanced to Plus** | From $2,001 | Not published | Cannot be calculated | Not published | Cannot be calculated | On **monthly billing** the breakevens rise, because the plan gap widens. Basic to Grow is $66 extra, so $33,000 online and $66,000 in person. Grow to Advanced is $294 extra, so $147,000 online and $294,000 in person. All figures US dollars, calculated from [shopify.com/pricing](https://www.shopify.com/pricing), verified 2 August 2026. Three things worth noticing: 1. **Online upgrades pay off at half the volume in-person ones do**, because the online rate drops twice as fast per tier. If you're mostly in-person, you need roughly double the volume to justify the same upgrade. 2. **Annual billing lowers every breakeven** by shrinking the plan gap. If you're near a boundary, switching to annual billing may upgrade you for free. 3. **You can't evaluate the Advanced to Plus upgrade from published information.** Shopify doesn't state Plus rates. If a Plus salesperson says the plan pays for itself, ask for the rate in writing and run this calculation yourself. The reported Plus price is $2,300 a month on three years, or $2,500 on one. So the term is itself a $2,400-a-year decision. **To run this for Canada or any other market.** Read your own plan prices and rates from [shopify.com/pricing](https://www.shopify.com/pricing) in your region, then use the same formula. The method is portable even though the numbers aren't. --- ## What Shopify Payments Does Well ### 1. Zero-Friction Integration Enable it in settings. No separate signup, no API keys, no webhook configuration. Instant activation in supported countries. ### 2. Unified Dashboard Sales, payments, payouts, chargeback management, fraud analysis, and customers in one admin. You never leave Shopify. That's worth real operational time. ### 3. A Low In-Person Fixed Fee Covered above. In Canada, Shopify's in-person fixed component is **zero**, the lowest of any flat rate verified for this site. In the US it's 10 cents, which is mid-pack. Stripe Terminal charges 5 cents, PayPal Zettle 9, Clover 10, Square 15. For a retail business with a low average ticket, the fixed fee is most of the cost, so it's worth knowing where you sit on that list. Just don't carry the Canadian "zero cents" claim into a US model. It's 10 cents here. ### 4. Multi-Currency Checkout Local currency pricing and unified reporting across currencies for international stores. --- ## What Shopify Payments Does Poorly ### 1. Platform Lock-In You can only use Shopify Payments on Shopify. Leaving Shopify means migrating your store and your processor at the same time. And the gateway fee means you can't decouple them in advance by moving payments first. ### 2. The Dispute Fee Isn't on the Pricing Page Shopify's pricing page publishes no chargeback fee. Its help centre does. **$15.00 in the US, returned if you win.** Shopify attributes the fee to your bank rather than to itself. The policy is good. You just have to go looking for it. Compare [Helcim](/docs/payments/processors/helcim), which publishes $0 for a chargeback you win and $15 for one you lose, and [Stripe](/docs/payments/processors/stripe), which publishes $15 plus $15 and returns neither on a partial win. ### 3. Basic Fraud Tools Shopify's fraud detection is rules-based and simple. No advanced ML screening, no device fingerprinting, limited customisation. Dedicated fraud tools are better for high-fraud merchants. ### 4. Conservative Risk Tolerance Volume spikes and high-ticket sales trigger holds and delays. Launch a successful campaign and expect a review. ### 5. No Published Negotiation Path Below Plus Rates are what they are until Plus, and Plus rates aren't published either. There's no volume threshold at which Shopify says it'll talk to you. --- ## Who Shopify Payments Is Best For ### Perfect Fit | Business Type | Why Shopify Payments Wins | |---------------|---------------------------| | **Shopify stores** | Built in, and the gateway fee makes anything else expensive | | **Low-ticket retail on Shopify POS** | 10 cents in person in the US, zero in Canada. Well under Square's 15 | | **Omnichannel** | Shopify POS and online unified | | **International sellers** | Multi-currency support | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Not on Shopify** | You can't use it | | **High-fraud merchants** | [Stripe](/docs/payments/processors/stripe) has better fraud tooling | | **Dispute-heavy merchants** | [Helcim](/docs/payments/processors/helcim). $0 when you win, $15 when you lose, and it's on the pricing page | | **Custom payment flows** | Stripe | | **Cost-optimising at high volume** | [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax), but only if leaving Shopify is on the table | --- ## Common Gotchas ### 1. The Gateway Fee Applies to Every Order Not to failed orders. Not to a sample. To every order processed outside Shopify Payments. On Basic that's 2% of your gross, forever. There's almost never a good reason to accept it. The one legitimate reason is that Shopify Payments doesn't operate in your country. ### 2. Plan Tier Inertia Merchants stay on Basic well past the point where Grow is cheaper. On the US annual-billing figures, an online store past **$25,000 a month** is losing money by staying on Basic. Run the [breakeven above](#should-you-upgrade-your-plan) once a quarter. ### 3. In-Person and Online Upgrade at Different Speeds The online rate improves 0.2 points per tier and the in-person rate improves 0.1. A mostly-in-person business needs roughly twice the volume to justify the same upgrade. Split your volume by channel before running the calculation. ### 4. The Chargeback Fee Lives in the Help Centre Shopify publishes $15 in the US, refunded if you win, on its help centre rather than its pricing page. Its threshold behaviour is still undisclosed. Nothing says what ratio triggers a review or a hold. Monitor your ratio against the published card network programs, not against a number from an article. See [Chargeback Prevention](/docs/chargebacks/prevention). ### 5. Account Holds on Spikes A large volume spike triggers a hold while Shopify reviews. Email support before a big launch. --- ## Test to Run **Shopify plan and payments audit:** **Week 1: get your own rates** 1. Open [shopify.com/pricing](https://www.shopify.com/pricing) from your own market and write down your plan's online rate, in-person rate, monthly fee, and gateway fee. 2. Pull your last three months of payment fees from Shopify analytics. 3. Calculate your effective rate: `total fees / total volume`. 4. Split volume by channel: online and in-person. **Week 2: check your plan** 5. Breakeven for the next tier up = `(monthly fee difference) / (rate difference)`. 6. Run it separately for online and in-person, because the rate savings differ. 7. If your channel volume is above the breakeven, upgrade. **Week 3: check for outside processors** 8. Are you running any third-party gateway? Multiply that volume by your plan's gateway fee. 9. Unless Shopify Payments is unavailable in your country, move it. **Week 4: close the unknowns** 10. Email Shopify support and ask, in writing, for the instant payout fee and the keyed-in rate. Confirm the $15 chargeback fee for your market while you're there. 11. Add the answers to your model. Keep the email. **Success criteria.** You're on the right plan for your channel mix. No volume is going through a third-party gateway. And you know what a chargeback costs you. --- ## Scale Callout Volumes below are US dollars on annual billing. Recalculate with your own market's numbers and your own billing frequency. **Under $25,000/month online:** - Basic is correct. - Focus on conversion rather than fees. **$25,000-$110,000/month online:** - Grow pays for itself. Upgrade. - Check your in-person split. In-person doesn't justify the upgrade until roughly $50,000 a month. **Above $110,000/month online:** - Advanced pays for itself. - Also start asking what leaving Shopify would cost. The gateway fee is large in absolute terms now, and it's what ties your payments cost to your platform choice. **Approaching Plus:** - Plus rates are not published. Get them in writing and run the breakeven yourself. - Ask about the term. Plus is reported at $2,300/month on three years against $2,500/month on one, so a shorter term costs $2,400 a year and buys you the ability to leave. - At this volume, model what [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax) would cost on a non-Shopify platform. That comparison is the real decision. And it's a platform decision, not a payments one. --- ## Where This Breaks 1. **Rates are country-specific in ways that look like currency conversion and aren't.** US in-person carries 10 cents where Canada carries zero, and US online runs 0.1 points higher at every tier. Read your own market's page, opened from your own market. 2. **Platform lock-in is the actual cost.** The gateway fee means your payments decision and your platform decision are the same decision. 3. **The dispute fee isn't on the pricing page.** It's $15 in the US, refunded on a win, and it lives in the help centre. What Shopify publishes nowhere is the ratio at which a rising dispute rate triggers a review or a hold. For a dispute-prone category, that's the gap to close with support. 4. **Plus is a black box on rate.** The plan price is published, from $2,300 a month. The rates are "most competitive rates", which isn't a number. You can't evaluate the upgrade from public information. 5. **High volume gets expensive with no negotiation path below Plus.** Rates are fixed and Shopify publishes no threshold at which they'd discuss it. --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [shopify.com/pricing](https://www.shopify.com/pricing) | All US plan prices, online and in-person rates, and the third-party gateway fee. The working US path is the bare URL served to a US IP; shopify.com/us/pricing does not resolve | Vendor page, retrieved via a US-located connection | Accessed 2026-08-02 | | [help.shopify.com, chargeback process](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process) | The $15.00 US chargeback fee and the statement that it's returned if you win the chargeback | Vendor help centre | Accessed 2026-08-02 | | [Merchant Maverick, Shopify Payments review](https://www.merchantmaverick.com/reviews/shopify-payments-review/) | Independent confirmation of every plan price, plus the reported Plus term pricing of $2,300/month on three years or $2,500/month on one. **Discloses referral partnerships** | Review site | Updated 2024-12-23 | --- ## Next Steps **On Shopify already?** 1. Enable Shopify Payments in Settings then Payments. 2. Run the [audit above](#test-to-run). 3. Disable any third-party gateway. You're paying your plan's gateway fee on every order. **Choosing between Shopify and other platforms?** 1. Compare Shopify plus Shopify Payments against your alternative platform plus a processor of your choice. 2. Include the gateway fee in the Shopify column, because it's part of the platform cost. 3. For most SMBs, Shopify plus Shopify Payments is simpler and the simplicity is worth something. **High volume on Shopify?** 1. Get Plus rates in writing and run the breakeven yourself. 2. Model [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax) on a non-Shopify platform so you know what the platform is costing you in payments terms. 3. Migration is expensive. Do the arithmetic before the emotion. --- ## See Also - [Stripe](/docs/payments/processors/stripe) - Alternative if leaving Shopify - [Square](/docs/payments/processors/square) - Alternative for retail, though it charges 15 cents in person where Shopify charges 10 in the US - [Helcim](/docs/payments/processors/helcim) - Lower cost off-platform, with published rates - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table - [Buying Payments](/docs/payments/buying-payments) - Processor selection framework - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing Shopify checkout - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes --- ## Square Source: https://paymentsandrisk.com/docs/payments/processors/square # Square :::info[TL;DR] - Square is the fastest setup and the deepest all-in-one POS bundle here. That's a product claim, not a price claim. The two get confused constantly - Card-present is 2.6% + 15 cents on the Free plan, 2.5% + 15 cents on Plus, 2.4% + 15 cents on Premium. Online is 3.3% + 30 cents on Free and 2.9% + 30 cents on Plus and Premium - **On price, Square Free wins none of the 24 scenarios this site models.** [Helcim](/docs/payments/processors/helcim) beats it card-present above roughly a $9 ticket. [PayPal Zettle](/docs/payments/processors/paypal) beats it at every ticket - Where Square genuinely beats interchange-plus: card-present under about $9 against Helcim. Also any ticket, if your card mix runs heavy in premium rewards or commercial credit. Real conditions, not consolation prizes. Zettle still wins on rate in both - Keyed and card-on-file are 3.5% + 15 cents. Train staff to tap or dip instead of keying. It's the fastest cost cut available on Square - **Plan prices confirmed: Plus $49 a month, Premium $149, both PER LOCATION.** That last phrase is load-bearing, and most comparison tables drop it. Three sites on Plus is $147 a month, not $49 - **Through the Payments API a Free-plan merchant pays 2.9% + 30c online. Same as Premium.** The 3.3% + 30c Free rate covers Square Online and invoices, not the API. Plus and Premium buy a lower card-present rate and software, not a lower API rate - **Square charges $0 on disputes and states it outright**: "There are no fees for dispute management services for chargebacks." That's the best published dispute economics of any US processor here. Its Payment Terms still reserve the right to recover network fines. Those are a separate thing ::: Square is the easiest payment processor to set up. If you want POS and payments as one product, it's the most complete thing on this list. Plug in a reader, start accepting cards in 15 minutes. What it isn't is cheapest. Not at any ticket size or volume this site models, on an ordinary consumer card mix. Every comparison below is quantified, and every one runs on [this site's published interchange assumption](/docs/payments/reference/cost-model-assumptions). Check the arithmetic instead of trusting it. :::note[Rate verification, and why the plan prices are hard to fetch] Every Square fee on this page was read directly from Square's own pages on **2 August 2026**: - Processing rates: [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees) and [Square Help article 5068](https://squareup.com/help/us/en/article/5068-square-pricing-and-fees) - Plan prices: [squareup.com/us/en/pricing](https://squareup.com/us/en/pricing) - Instant Transfer: [Square Help article 3807](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options) Square Plus is **$49 a month per location**, Premium **$149 a month per location**. Both come with a free 30-day trial and no contract. Two independent confirmations: Square's own pricing page, and [Merchant Maverick](https://www.merchantmaverick.com/reviews/square-review/) (a review site that discloses referral partnerships, updated 2025-10-29), which reproduces both figures **including the per-location qualifier**. Watch the per-location wording. Two locations on Plus is $98 a month, not $49, and comparison tables routinely drop that qualifier. Hardware prices aren't covered here. Check [Square's shop](https://squareup.com/us/en/hardware) for current figures. ::: ## When to Use Square **You should use Square if:** - You want an all-in-one POS bundle: inventory, employees, reporting, hardware. And you'll pay for it in the processing rate - You need to start accepting payments today - You don't have a developer on your team - Your card-present average ticket is under about $9. Below that, Square's 15 cent fixed fee beats Helcim's combined cents - Your card mix is heavy in premium rewards or commercial credit, where a flat rate caps your downside. See [the card-mix test](/docs/payments/processor-comparison#the-card-mix-test-not-the-volume-test) **Skip Square if:** - You're primarily online. Square Free's 3.3% + 30 cents is the highest online rate ranked here - You need custom integration or API control - Your card-present ticket is above about $9 and you're comparing on cost. [Helcim](/docs/payments/processors/helcim) is cheaper from there up, at every volume. No monthly fee to earn back - You're comparing pure card-present rate and don't need Square's POS depth. PayPal Zettle at 2.29% + 9 cents is lower than every Square plan, at every ticket - You want interchange-plus visibility into what you actually pay ([Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax)) --- ## Pricing Breakdown ### Standard Pricing | Transaction Type | Free plan | Plus plan | Premium plan | |------------------|-----------|-----------|--------------| | **Monthly subscription** | **$0** | **$49 per location** | **$149 per location** | | **Card-present (swiped/dipped/tapped)** | 2.6% + $0.15 | 2.5% + $0.15 | 2.4% + $0.15 | | **Online, Square Online and invoices** | 3.3% + $0.30 | 2.9% + $0.30 | 2.9% + $0.30 | | **Online, via the Payments API** | **2.9% + $0.30** | 2.9% + $0.30 | 2.9% + $0.30 | | **Keyed-in / card on file** | 3.5% + $0.15 | 3.5% + $0.15 | 3.5% + $0.15 | | **Afterpay** | 6% + $0.30 | 6% + $0.30 | 6% + $0.30 | | **ACH via Square Invoices** | 1%, $1 minimum | 1%, $1 minimum, $10 cap | 1%, $1 minimum, $10 cap | Source: [squareup.com/us/en/pricing](https://squareup.com/us/en/pricing), [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees) and [Square Help article 5068](https://squareup.com/help/us/en/article/5068-square-pricing-and-fees), all verified 2 August 2026. All VENDOR. :::warning["Per location" is the phrase most tables drop] $49 and $149 are **per location per month**, not per account. A three-site retailer on Plus pays **$147 a month**. On Premium, **$447**. Every breakeven has to be run per site. Compare Square Plus against a processor with account-level pricing and you're comparing two different things. ::: :::tip[The Payments API rate is the one nobody mentions] The 3.3% + 30c Free-plan online rate applies to **Square Online and invoices**. Through the **Payments API it is 2.9% + 30c on every plan, including Free.** So a developer-led merchant on Free pays the same online rate as a Premium merchant. **Plus and Premium buy you a lower card-present rate and software features, not a lower API rate.** If your online volume runs through the API, don't upgrade for the online rate. There's nothing to gain. ::: :::warning[The fixed fee is 15 cents, not 10] Square's card-present fixed component is **15 cents**, not the 10 cents in a lot of comparison content. On a $10 coffee that's 2.6% + $0.10, or 3.6% effective, against 2.6% + $0.15, or 4.1%. At a low average ticket that 5 cents matters more than the percentage. ::: ### Other Fees | Fee | Amount | Notes | |-----|--------|-------| | **Monthly subscription (Free plan)** | $0 | Square states the Free plan has "no monthly subscription costs" | | **Instant Transfer** | **1.95% per transfer** | No minimum stated. Funds move 24/7 | | **Dispute / chargeback fee** | **$0** | "There are no fees for dispute management services for chargebacks" | | **Custom pricing threshold** | Over **$250,000 per year** | Square: "If you process over $250,000 per year, talk to our team about custom pricing" | Source: [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees) and [Square Help article 3807](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options), verified 2 August 2026. :::warning[Instant Transfer is 1.95%, not 1.5% or 1.75%] Square's help centre states funds move "24 hours a day, 7 days a week, for a 1.95% fee per transfer." A widely circulated correction puts it at 1.75%. Both 1.5% and 1.75% are wrong. On a $10,000 instant transfer that's $195, not $150. ::: ### Square Charges $0 on Disputes, and Says So **Square's dispute fee is zero.** Not "unpublished". Zero. Square states it on two of its own pages: > "There are no fees for dispute management services for chargebacks - we cover the fee for every dispute that we work together to challenge." > [Square Support](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough), read 2 August 2026 > "No, Square doesn't charge any additional fees for disputes. Most other payment processors charge a nonrefundable fee ranging from $10 to $25." > [Square, The Bottom Line](https://squareup.com/us/en/the-bottom-line/managing-your-finances/what-is-a-chargeback-what-makes-it-happen), read 2 August 2026 Square publishes the zero. It just isn't on the pricing page, which is where anyone would look first. Against [Stripe](/docs/payments/processors/stripe) at $15 + $15 and [PayPal](/docs/payments/processors/paypal) at $15 or $20, that's the best published dispute economics of any US processor here. Only the Authorize.net gateway ties it. **The one caveat, and it's real.** A published policy isn't a contractual zero. Square's Payment Terms still reserve the right to recover "the amount of any Chargeback and any associated Fees, fines, or penalties listed in the Fee Schedule." Network fines and monitoring program fees are a different thing from a dispute fee. Square doesn't say it eats those. If your ratio is anywhere near a monitoring threshold, ask. ### Plan Upgrades: Do the Maths Yourself Now that the plan prices are confirmed, the breakevens are arithmetic. **All of them are per location.** | Upgrade | Extra cost per location | Rate saving | Breakeven volume, per location | |---|---|---|---| | **Card-present, Free to Plus** | $49/mo | 0.1% | **$49,000/month** | | **Online (Square Online / invoices), Free to Plus** | $49/mo | 0.4% | **$12,250/month** | | **Card-present, Plus to Premium** | $100/mo | 0.1% | **$100,000/month** | | **Online, Plus to Premium** | $100/mo | **0%** | **Never** | | **Online via the Payments API, any upgrade** | any | **0%** | **Never** | Three lines are the ones people miss. 1. **Online, Plus to Premium saves nothing.** The online rate is identical on both plans. Premium only helps card-present volume and whatever multi-location features you need. 2. **Online via the Payments API saves nothing on any upgrade.** It's 2.9% + 30c on Free too. 3. **The card-present upgrade needs $49,000 a month per location** to pay for itself on rate alone. For most single-site merchants that's a software purchase, not a payments one. Decide it as one. ### Hardware Square sells readers, terminals, registers and stands. **Hardware prices weren't part of the 2 August 2026 fee verification.** Square also runs promotions constantly. Check [squareup.com/us/en/hardware](https://squareup.com/us/en/hardware) rather than trusting a number in an article. One thing holds whatever the price list says. Square hardware is cheap enough to walk away from. Switch processors and you abandon tens or low hundreds of dollars. Leaving [Clover](/docs/payments/processors/clover) or [Toast](/docs/payments/processors/toast) costs you $800 to $1,800. --- ## What Square Does Well ### 1. Setup Speed You can start accepting payments in under 15 minutes: 1. Download Square POS 2. Enter business info 3. Plug in reader 4. Take your first payment No underwriting delay for most businesses. Instant approval up to certain limits. ### 2. Hardware Ecosystem Square's hardware just works: - Plug-and-play, no configuration - Bluetooth connectivity - Long battery life - Reliable chip and tap readers Hard to beat if you're not technical. No IT person needed. ### 3. All-in-One POS Features Square POS includes, on the Free plan: - Inventory management - Employee management with permissions - Tips and gratuity handling - Customer directory - Sales reports - Receipt customization This is software other POS providers charge a monthly fee for. ### 4. Customer-Facing Features - Square Loyalty - Square Marketing - Square Online - Square Appointments Best for businesses that want all their tools in one ecosystem. ### 5. A Published $0 Dispute Fee Square doesn't just leave the dispute line off its rate card. It says the fee is zero, in its own words, on two of its own pages. That puts it level with the Authorize.net gateway and ahead of every other processor ranked here. Square's own comparison is worth quoting, because it's a vendor undercutting its own category. "Most other payment processors charge a nonrefundable fee ranging from $10 to $25." That's roughly right. The whole published US span is $0 to $30. Adyen, Checkout.com, Clover, Worldpay, Global Payments and Nuvei publish no dispute fee at all. That's a different thing from publishing a zero. [Shopify Payments](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process) publishes $15 and returns it on a win. [Toast](https://support.toasttab.com/en/article/Chargeback-FAQ) publishes $15, charged win or lose, on its support site. [Lightspeed](/docs/payments/processors/lightspeed) publishes **$15**, described as a single fee covering the defence. [Helcim](/docs/payments/processors/helcim) is the only processor here with a merchant-friendly policy in writing. $0 when the case resolves in your favour, $15 when it doesn't. An explicit zero-on-a-win beats an unwritten one. You can hold someone to it. --- ## What Square Does Poorly ### 1. The Card-Present Rate, Once You Model It Properly Comparing a flat rate against interchange-plus means assuming what interchange costs, and the assumption decides the answer. Take 1.80% + 10 cents card-present, which a lot of comparison content does. That figure isn't a blend of anything. It's roughly the rate for one card type, a consumer rewards credit card, and it charges about 79 basis points of phantom cost to the interchange-plus side. The [assumption this page uses](/docs/payments/reference/cost-model-assumptions) is 1.03% + 17.8 cents of card-present pass-through. It comes from Visa's published schedule, weighted by the Federal Reserve's transaction counts. Run 1.80% instead and the Square-to-Helcim gap reads about a twentieth of its real size. **Card-present, $50 average ticket, $20,000 a month, which is 400 transactions:** | | Rate | Monthly cost | Effective | |---|---|---|---| | **Helcim** (entry band, $0/month) | IC + 0.40% + $0.08 | **$389.20** | 1.95% | | **Stax** ($139 tier at $240K/year) | IC + $0.08 + subscription | $448.20 | 2.24% | | **PayPal Zettle** | 2.29% + $0.09 | $494.00 | 2.47% | | **Square Free** | 2.6% + $0.15 | $580.00 | 2.90% | Helcim's arithmetic in full: pass-through is 1.03% x $20,000 = $206.00 plus $0.178 x 400 = $71.20, so $277.20. Markup is 0.40% x $20,000 = $80.00 plus $0.08 x 400 = $32.00, so $112.00. Total $389.20. Square costs **$190.80 a month more**, or $2,290 a year. Under the old assumption that gap read as roughly $10. That would reasonably have changed nobody's mind. This one should change some. Two honest limits on that. It reverses below about a $9.23 card-present ticket, where Square's 15 cents beats Helcim's combined 25.8 cents. It also reverses at any ticket if your card mix is heavy in premium rewards or commercial credit. Helcim's 2.64% all-in on a Signature Preferred card is above Square's flat 2.6%. ### 2. No Rate Negotiation Below $250K/Year Square's published pricing is take-it-or-leave-it until you clear $250,000 a year. Above that, Square's own fee page invites you to "talk to our team about custom pricing." Below it, the rate card is the rate card. That threshold is annual, not monthly. A shop doing $21,000 a month is already past it. Go ask. ### 3. Aggressive Account Holds Square holds accounts frequently: - Sudden volume spike triggers a hold - New account with rapid growth triggers a review - High-ticket transactions cause delays The hold email comes without warning. Funds freeze while Square reviews. Its risk models are conservative and they protect Square first. If your cash flow is tight, this is the biggest risk of running Square alone. ### 4. Limited API Control Square's API exists but is narrower than Stripe's: - Fewer webhooks - Less flexible subscription logic - Harder to build custom integrations If you need custom code, Stripe is better. If you're using Square POS as shipped, this doesn't matter. ### 5. Keyed and Card-on-File Pricing 3.5% + 15 cents applies to manual entry and to saved cards. For a subscription business that stores cards, that's Square's worst rate on every charge. See the worked example below. --- ## Pricing Comparison (Square vs Competitors) | Processor | Card-present | Online | Keyed | Per-dispute cost | |-----------|--------------|--------|-------|------------------| | **Square** (Free) | 2.6% + $0.15 | 3.3% + $0.30, or 2.9% + $0.30 via the Payments API | 3.5% + $0.15 | **$0** | | **[Stripe](/docs/payments/processors/stripe)** | Terminal **2.7% + $0.05** | **2.9% + $0.30** | +0.5% on top of online, so 3.4% + $0.30 | $15 received (never returned) + $15 countered | | **[PayPal](/docs/payments/processors/paypal)** | 2.29% + $0.09 (Zettle) | 3.49% + $0.49 Checkout, 2.99% + $0.49 standard card | 3.49% + $0.09 | $15 wallet ($0 if you win), $20 card, $30 above a 1.5% ratio | | **[Braintree](/docs/payments/processors/braintree)** | Not separately published | 2.89% + $0.29 | Not separately published | $15 | | **[Helcim](/docs/payments/processors/helcim)** | IC + 0.40% + $0.08 (first band) | IC + 0.50% + $0.25 (first band) | Billed as online | **$0 if you win**, $15 if you lose | | **[Clover](/docs/payments/processors/clover)** | Not published | Not published | Not published | Not published | Stripe's US figures are now confirmed from a US connection. The widely repeated "Stripe Terminal 2.6% + $0.10" matches no Stripe geography. Don't use it. **Square against Stripe, card-present, resolved:** 2.6% + 15c against 2.7% + 5c crosses at exactly a **$100 ticket**. Stripe is cheaper below it, Square above it, by cents either way. On the dispute line the gap is far larger, and it runs Square's way. Square charges $0. Stripe charges $15 that never comes back. **Verdict, stated with its conditions:** - **Against the other flat rates card-present:** Square Free loses to PayPal Zettle at every ticket size. Zettle's rate is lower, 2.29% against 2.6%. So is its fixed fee, 9 cents against 15. No crossover exists in either direction. That holds against Plus and Premium too. What Square buys you for the difference is a real POS, which Zettle isn't. - **Against interchange-plus card-present:** Square Free loses to Helcim above roughly a $9.23 ticket, at any volume. Neither charges a monthly fee, so there's no threshold to wait for. Below that ticket Square wins. - **Online:** Square Free at 3.3% + 30 cents is the highest published online rate of any processor ranked here. On a $20 order it's 4.80%, against 4.11% for Helcim's entry online band. - **Keyed:** 3.5% + 15 cents is the highest keyed **percentage** published in USD here. The fixed component saves it at small tickets. PayPal's keyed rate of 3.49% + 9 cents is lower on both, so it wins at every ticket. Braintree's card rate is cheaper above about $22.95, Helcim's above about $18.13. Stripe's US keyed rate is 3.4% + 30 cents. Lower percentage, double the fixed fee, so the two cross at **$150**. Square cheaper below it, Stripe above. - **Disputes:** Square wins outright. It charges $0 and says so. Stripe charges $15 that never comes back. PayPal charges $15 on wallet traffic or $20 on card traffic. Helcim's $0-on-a-win is the only policy that matches, and Helcim still charges $15 when you lose. Put it together. On a dispute-heavy card-present book, Square's total cost can beat Zettle's despite the worse rate. At $20,000 a month and a $50 ticket, Zettle saves $86 a month on rate. PayPal's $20 card chargeback fee erases that at four or five disputes a month. Above a 1.5% dispute ratio, under three. That's the comparison worth running, not the rate alone. --- ## Who Square Is Best For ### Perfect Fit Every row here is a **product** reason. Only the last two are cost reasons, and both carry conditions. | Business Type | Why Square Fits | |---------------|-----------------| | **Retail stores** | Deepest POS, inventory and hardware ecosystem on this list | | **Restaurants and cafes** | Tips, kitchen printing, tableside ordering | | **Service businesses** | Square Appointments, invoicing | | **Mobile sellers** | Farmers markets, pop-ups, events | | **Non-technical owners** | No developer needed | | **Dispute-heavy categories** | **$0 per dispute, published**, against $30 on Stripe and $20 to $30 on PayPal | | **Card-present under a ~$9 ticket** | The 15 cent fixed fee beats Helcim's combined 25.8 cents. PayPal Zettle is lower still on rate, but has no comparable POS | | **Premium or commercial-heavy card mix** | A flat rate caps your exposure when interchange itself runs 2.1% to 2.5%. See the [card-mix test](/docs/payments/processor-comparison#the-card-mix-test-not-the-volume-test) | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Any online volume** | [Helcim](/docs/payments/processors/helcim) online, or [Braintree](/docs/payments/processors/braintree) if you want a flat rate. Square Free's 3.3% + 30c is the highest ranked online rate here | | **Card-present above a ~$9 ticket, ordinary card mix** | [Helcim](/docs/payments/processors/helcim), at any volume. There's no monthly fee to earn back, so no threshold to wait for | | **Pure card-present rate shopping, small ticket** | [PayPal Zettle](/docs/payments/processors/paypal) at 2.29% + 9c, lower than every Square plan at every ticket. Price PayPal's $20 card chargeback fee against Square's $0 | | **Card-on-file subscriptions** | [Helcim](/docs/payments/processors/helcim) above about an $18 ticket, or [Braintree](/docs/payments/processors/braintree) above about $23. Square charges 3.5% + $0.15 on saved cards | | **Custom integrations** | Stripe | | **Card-present above roughly $58,000-$70,000/month** | [Stax](/docs/payments/processors/stax) may overtake Helcim there, but its price above $250,000/year is published only as a floor, so get the real number before you plan on it | --- ## Common Gotchas ### 1. The Keyed-In Trap Manually keying a card costs 3.5% + $0.15 against 2.6% + $0.15 for a tap or dip. **On a $100 transaction:** - Tapped: $2.75 - Keyed: $3.65 - Difference: $0.90 At 100 keyed transactions a month that's $90, or $1,080 a year. For a habit, not a product. **What to do:** train staff to use the reader. Only key in when the customer genuinely has no physical card. ### 2. Instant Transfer Costs 1.95% | Amount transferred | Instant Transfer fee | |--------------------|----------------------| | $1,000 | $19.50 | | $10,000 | $195.00 | | $100,000 | $1,950.00 | Source: [Square Help article 3807](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options), verified 2 August 2026. Wait for the standard transfer unless it's a real cash emergency. Instant Transfer as a habit costs more than most merchants' whole dispute exposure. ### 3. Card-on-File Rates Hurt Subscriptions Saved cards bill at 3.5% + $0.15, not 2.6% + $0.15. **Worked example: $50/month subscription, 100 customers** | | Per charge | Monthly total | |---|-----------|---------------| | **Square card on file** (3.5% + $0.15) | $1.90 | $190.00 | | **[Stripe](/docs/payments/processors/stripe)** (2.9% + $0.30, no keyed surcharge on a stored card charged via API) | $1.75 | $175.00 | | **[Braintree](/docs/payments/processors/braintree)** (2.89% + $0.29) | $1.74 | $173.50 | | **[Helcim](/docs/payments/processors/helcim)** (keyed billed as online, entry band) | $1.42 | $142.20 | Helcim's per-charge figure is the online pass-through of 1.50% + $0.172 plus the entry-band markup of 0.50% + 25 cents. That's 2.00% + 42.2 cents on a $50 charge. The gap against Braintree is real but smaller than usually reported. Braintree's 29 cent fixed fee eats most of Square's percentage disadvantage at this ticket. The two cross at about a **$22.95** charge. Below that Square is cheaper. Above it, Braintree. Against Helcim the crossover is about **$18.13**. At a $200 charge Square costs $7.15 against Braintree's $6.07 and Helcim's $4.42. Run it at your own charge amount before you move a subscription book. A $12/month membership and a $200/month retainer give opposite answers. ### 4. High-Ticket Transaction Delays Large transactions often trigger a delay while Square checks for fraud. It's automatic and you can't opt out. If you sell high-ticket items regularly, warn customers that deposit timing can slip. ### 5. Chargeback Ratio Thresholds Square doesn't publish a chargeback ratio threshold of its own. The binding constraints are the network monitoring programs, and those are published. See [Chargeback Prevention](/docs/chargebacks/prevention) and the thresholds in [Benchmarks](/docs/reference/benchmarks). --- ## Test to Run **Square fee audit (if you're already on Square):** **Week 1:** 1. Pull your last 3 months of Square reports 2. Calculate effective rate: `total fees / total volume` 3. Break down by transaction type: card-present vs keyed vs online **Week 2:** 4. Count keyed transactions against tapped or dipped 5. Calculate the cost of keying: `(keyed volume x 0.9%) + (keyed count x $0)`. The gap is 0.9 points. The fixed fee is 15 cents either way, so the whole penalty is percentage 6. That number is money lost to convenience **Week 3:** 7. Check your transfer history. Are you using Instant Transfer? 8. Multiply instant-transferred volume by 1.95% 9. Switch to standard transfers for anything not urgent **Week 4:** 10. If your trailing annual volume is over $250,000, email Square and ask for custom pricing. Their own fee page invites this **Success criteria:** keyed under 5% of transactions. Instant Transfer under 10% of volume. And a card-present effective rate that matches Square's published rate at your ticket. The target is `2.6% + ($0.15 / your average ticket)`. That's 2.90% at a $50 ticket, 3.60% at $15, 2.70% at $150. Anything above it is keyed volume, online volume or Instant Transfer leaking into the blend. --- ## Scale Callout Volume is the wrong first question. Square Free and Helcim both charge $0 a month. There's no subscription to earn back, so no volume threshold to cross. **Ticket size decides card-present.** Volume only changes the size of a gap that already exists. These callouts run by volume anyway, because that's how people think. **Under $250K/year (about $21K/month):** - No negotiation is available from Square, so don't waste time asking - Square is easy. It isn't cheap here. At a $50 ticket and $20,000 a month, Helcim is $389.20 against Square's $580.00. That's $190.80 a month, with no volume gate on it - If your ticket is genuinely under about $9, Square wins on cost. This is the one band where "Square is fine" is a costing statement, not a convenience one - Focus on cutting keyed transactions and Instant Transfer use **Over $250K/year:** - Square's own fee page invites a custom pricing conversation at this threshold. Take it, and ask for interchange-plus rather than a few points off the flat rate - Price [Helcim](/docs/payments/processors/helcim) at the same time. It publishes its full markup schedule, so you can model the switch exactly rather than guessing **$500K/month card-present:** Assume a $50 average ticket, so 10,000 transactions, and this site's [published card-present pass-through](/docs/payments/reference/cost-model-assumptions) of 1.03% + $0.178. Your card mix will differ, so redo this with your own statement. | | Rate | Monthly cost | Effective | |---|------|--------------|-----------| | **Helcim** ($500K-$1M band) | IC + 0.20% + $0.06 | **$8,530** | 1.71% | | **PayPal Zettle** | 2.29% + $0.09 | $12,350 | 2.47% | | **Square Premium** | 2.4% + $0.15 + $149/location | **$13,649** at one location | 2.73% | | **Square Free** | 2.6% + $0.15 | $14,500 | 2.90% | Sources: [Square pricing](https://squareup.com/us/en/pricing) and fee page, [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) and [helcim.com/pricing](https://www.helcim.com/pricing/), all verified 2 August 2026. Premium's row is computable off the confirmed plan price. At $500,000 a month through **one** location, Premium beats Free by $851 a month. Across five locations the subscription is $745, not $149, and the advantage shrinks to $255. At this volume Helcim is **$5,970 a month cheaper than Square Free**, or $71,640 a year. Smaller figures for that gap, $3,600 a month and $43,000 a year among them, come from a card-present interchange assumption closer to a single premium card than to a blend. If you stay on Square above $500K a month, stay because the POS is worth $71,000 a year to you. That's a defensible reason. Assuming the rates are close is not. [Stax](/docs/payments/processors/stax) computes to $7,929 here at its published $199 floor. That would beat Helcim by $601. It carries no verdict. At $6M a year Stax's price is published as "$199+" with no ceiling, and the real number is whatever their sales team quotes. Get it in writing and redo the row. **Over $1M/month:** - Square's published card-present rate doesn't improve past Premium - Helcim publishes IC + 0.15% + 6 cents card-present in the $1M-$5M band. No negotiation needed - [Stax](/docs/payments/processors/stax) charges no percentage markup, only a subscription plus 8 cents card-present. The subscription at this volume isn't published - Keep Square only if the POS, not the processing, is what you're buying --- ## Where This Breaks 1. **Account holds without warning.** Square freezes accounts aggressively. If your cash flow is tight, a hold can kill your business. Always have a second processor onboarded. Even if you never route volume to it. 2. **No negotiation below $250K/year.** Below that threshold you pay rack rate. That's expensive at every volume, not just the middle, because the cheaper alternatives charge no monthly fee either. The old advice to "wait until you're big enough to switch" assumed interchange-plus came with a subscription. 3. **Card-on-file costs 3.5% + $0.15.** Model Square carefully if you bill saved cards. Don't assume the card-present rate applies. 4. **The $0 dispute fee is a policy, not a contract term.** Square states it plainly on its support site. Its Payment Terms separately reserve the right to recover chargeback-related fees, fines and penalties. Network fines from a monitoring program aren't covered by that $0. If your ratio is climbing, ask what gets passed through. 5. **High-risk rejection.** Anything in a grey area (supplements, adult, weapons) gets rejected or terminated quickly. 6. **Every cost verdict here assumes a card mix.** Square against any interchange-plus processor is unrankable without one. This page uses [the site's published blend](/docs/payments/reference/cost-model-assumptions). Run a B2B counter where most cards are commercial? Or had a rewards promotion skew your mix? Pull one month of statements and redo the comparison. The method survives. Only the answer moves. --- ## Next Steps **Considering Square?** 1. Download Square POS and test it. The app is free 2. Check your average ticket first. It decides the cost answer more than your volume does. Below about $9.23 card-present Square beats Helcim. Above it, Helcim beats Square at every volume 3. If you're online-first, compare [Helcim](/docs/payments/processors/helcim), [Stripe](/docs/payments/processors/stripe) and [Braintree](/docs/payments/processors/braintree), all verified in USD. Square Free's 3.3% + 30c is the highest of the four. Via Square's Payments API it drops to 2.9% + 30c, matching Stripe exactly 4. Review [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) **Already on Square?** 1. Run the [fee audit above](#test-to-run) 2. Reduce keyed transactions 3. Stop using Instant Transfer as a habit. It's 1.95% 4. If you're past $250,000 a year, ask for custom pricing **Switching from Square?** 1. Read [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) 2. For lower cost with published rates, look at [Helcim](/docs/payments/processors/helcim) above a ~$9 card-present ticket, or [Stax](/docs/payments/processors/stax) above roughly $58,000-$70,000/month card-present 3. Factor in POS migration. Square POS data doesn't export cleanly. That cost is the honest counterweight to the rate saving --- ## See Also - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - The interchange blend every comparison on this page runs on - [Stripe](/docs/payments/processors/stripe) - Competitor comparison for online and developer-led. Card-present crosses at a $100 ticket, keyed at $150 - [Helcim](/docs/payments/processors/helcim) - Lowest published interchange-plus markup with no monthly fee. Cheapest card-present above a ~$9 ticket on this site's card mix - [PayPal](/docs/payments/processors/paypal) - Zettle is the lowest published flat card-present rate here. Its dispute fees are $15 on wallet traffic, $20 on card traffic, and $30 once your dispute ratio passes 1.5% - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table and the 24-scenario matrix - [Buying Payments](/docs/payments/buying-payments) - Choosing a processor framework - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Hardware selection - [Terminal Security](/docs/fraud/terminal-security) - Securing your Square hardware - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes --- ## Stax (formerly Fattmerchant) Source: https://paymentsandrisk.com/docs/payments/processors/stax # Stax (formerly Fattmerchant) :::info[TL;DR] - **Stax's volume bands are annual, not monthly.** $99 a month covers up to $150,000 **per year**. $139 covers $150,000 to $250,000 per year. $199+ covers $250,000 a year and up. A shop doing $20,000 a month is $240,000 a year. That's the $139 tier, not a custom quote. - Stax charges **no percentage markup at all**. You pay interchange, plus 8 cents card-present or 15 cents online, plus the monthly subscription. - **Stax passes flat rate early and passes [Helcim](/docs/payments/processors/helcim) late.** Those are two different numbers. At a $50 average ticket, Stax beats Square's Free plan from about $7,300 a month card-present and about $5,600 online. Helcim takes far longer. Card-present it never happens at a volume where Stax still publishes its price. - **Above $250,000 a year, Stax's subscription is published only as "$199+".** There's no ceiling on it. This site won't rank a processor on a price with a plus sign in it. So every verdict below stops at $250,000 a year. - The subscription is the catch. You pay it in a dead month. That makes Stax a poor fit for seasonal businesses. - Stax doesn't publish a base chargeback fee. It sells optional chargeback protection at $25 per chargeback. Compare Helcim, which charges $0 when you win. ::: Stax charges a monthly subscription. Then it passes interchange through at cost with zero percentage markup. That model wins in a narrow band. The conditions matter more than the headline. :::note[Rate verification] Every Stax fee on this page was read from [staxpayments.com/pricing](https://staxpayments.com/pricing/) on **2 August 2026**. Every comparison uses the interchange assumption published at [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions). That's **1.03% + $0.178 card-present** and **1.50% + $0.172 online**, pass-through including an assumed 0.14% + $0.02 in network assessments. The assumption is load-bearing here. Stax pays interchange visibly and a flat-rate processor pays it invisibly. Change the assumption and these crossovers move. ::: ## When to Use Stax **Stax is worth pricing if:** - You're online with a low average ticket, roughly $25, and doing $11,000 to $20,800 a month. That's the narrow window where Stax is genuinely the cheapest option this site can rank. - Your annual volume is under $250,000. Then the subscription you'd pay is a published number rather than "$199+". - You want to shop the whole market, not just leave flat rate. Stax passes Square's Free plan from about $5,600 a month online and $7,300 card-present at a $50 ticket. It passes PayPal Zettle card-present from about $10,700 at the same ticket. At a $15 card-present ticket, no volume gets Stax past Zettle with a published subscription price. - Your volume is steady enough that a fixed subscription is an advantage, not a risk. - You want invoicing, a virtual terminal and analytics bundled. **Skip Stax if:** - You're card-present. Helcim's markup is lower at every volume where Stax publishes a price. Helcim charges the same 8 cents and no subscription in its entry band. - Your volume is below the flat-rate breakeven, or seasonal, or unpredictable. - You have real dispute volume and want a processor that doesn't charge you for winning. - You need advanced developer tooling. - You're primarily card-present retail and want a full POS. [Square](/docs/payments/processors/square) or [Clover](/docs/payments/processors/clover) is better. --- ## Pricing Breakdown ### Subscription Tiers | Annual processing volume | Monthly subscription | |--------------------------|---------------------| | **Up to $150,000 per year** | $99 | | **$150,000 - $250,000 per year** | $139 | | **$250,000 per year and above** | $199+ | Stax's own wording: "Subscription prices are determined by processing volume and do not include cents per transaction." Source: [staxpayments.com/pricing](https://staxpayments.com/pricing/), verified 2 August 2026. :::warning[These bands are ANNUAL, and reading them as monthly overstates Stax twelvefold] Present annual bands as monthly and you overstate Stax's cost roughly twelvefold. A merchant doing $20,000 a month looks like a $240,000-a-month enterprise account needing custom pricing. They're a $240,000-a-year business, sitting squarely in the **$139 tier**. That one mistake points people away from a processor they should at least have priced. Read anywhere that Stax's $99 plan is for "$8K to $50K a month"? Same error. $99 covers up to $150,000 **a year**. That's about $12,500 a month. Now the contrast. [Helcim's](/docs/payments/processors/helcim) bands are labelled "monthly credit card volume" and really are monthly. Compare the two tables without checking the period and you get this wrong. Correcting it doesn't make Stax the cheapest option. It makes Stax worth pricing. ::: ### Per-Transaction Fees | Transaction Type | Cost | |------------------|------| | **Card-present** | Interchange + **0% markup** + $0.08 | | **Online / card-not-present** | Interchange + **0% markup** + $0.15 | | **Keyed-in** | Billed as card-not-present: interchange + $0.15 | Source: [staxpayments.com/pricing](https://staxpayments.com/pricing/), verified 2 August 2026. The zero is the point. Every other processor on this site takes a percentage of every transaction on top of interchange. Stax doesn't. That's why its cost curve flattens as volume grows. The subscription is what you pay for that. It's also why the model needs volume before it works. ### Disputes | Item | What Stax publishes | |------|---------------------| | **Base chargeback fee** | **Not published** | | **Chargeback protection add-on** | Optional, **$25 per chargeback** | Stax's pricing page sells optional chargeback protection at $25 per chargeback. It never says what a chargeback costs without the add-on. **Ask, in writing.** What does a chargeback cost on the base plan? Is the fee refunded on a win? What exactly does the $25 protection cover? For comparison, [Helcim](/docs/payments/processors/helcim) publishes $0 for a chargeback resolved in your favour and $15 if you lose. ### What Is Not Published | Item | Status | |------|--------| | **Base chargeback fee** | Not published | | **Instant payout / next-day funding** | Not published | | **ACH rate** | Not published on the pricing page. The 0.5% + $0.25 capped at $6 that gets attached to Stax is [Helcim's](/docs/payments/processors/helcim) published ACH rate, not Stax's | | **Volume floor** | Not published | | **What "$199+" becomes at high volume** | Not published. The plus sign is unbounded, and it starts at $250,000 a year, which is a volume plenty of ordinary SMBs pass | | **Hardware prices** | Not part of this verification pass | | **Contract length and termination terms** | Not published | :::danger[The "$199+" band is where this page stops giving verdicts] $250,000 a year is $20,833 a month. Above that, Stax's published price carries a plus sign. A plus sign isn't a price. Every crossover below that falls above the line is computed at the $199 floor. Floors are the friendliest possible assumption for Stax. Treat them as **the earliest point at which Stax could win**, not as a claim that it does. Above $250,000 a year, get your actual subscription in writing before you model anything. ::: --- ## Two Different Breakevens, and They Get Confused Stax has to clear two separate hurdles. The first gets reported as though it were the second. 1. **The flat-rate breakeven.** The volume at which Stax beats [Square](/docs/payments/processors/square), [PayPal](/docs/payments/processors/paypal), or [Braintree](/docs/payments/processors/braintree). This is low, around $5,600 to $12,000 a month. 2. **The Helcim breakeven.** The volume at which Stax becomes the cheapest option this site can rank. Much higher. Card-present, it sits above the point where Stax stops publishing a price. Print the first number as though it answered the second question and you've sent someone to the wrong processor. Between the two, [Helcim](/docs/payments/processors/helcim) is cheaper than Stax. ### Breakeven 1: Stax against flat rate Stax pays interchange visibly. A flat-rate processor buries it in the headline rate. So the comparison needs the pass-through assumption. That's 1.03% + $0.178 card-present and 1.50% + $0.172 online. **Against Square's Free plan, card-present, at a $50 average ticket:** ``` Stax = 99 + (0.0103 x volume) + (0.178 + 0.08) x transactions Square = (0.026 x volume) + (0.15 x transactions) ``` At a $50 ticket, transactions = volume / 50, so: ``` Stax = 99 + 0.0103 x volume + 0.00516 x volume = 99 + 0.01546 x volume Square = 0.026 x volume + 0.003 x volume = 0.029 x volume ``` They meet at **volume = $99 / 0.01354 = about $7,300 a month**. Annualised that's $88,000. Inside the $99 tier, so the tier holds at the crossover. **Against Square's Free plan, online, at a $50 average ticket:** ``` Stax = 99 + 0.0150 x volume + 0.00644 x volume = 99 + 0.02144 x volume Square = 0.033 x volume + 0.006 x volume = 0.039 x volume ``` They meet at **about $5,600 a month**, or $68,000 a year. Also inside the $99 tier. | Flat-rate comparison, $50 ticket | Stax passes it at | |---|---| | Square Free, online (3.3% + $0.30) | about **$5,600/month** | | Stripe, online (2.9% + $0.30) | about **$7,300/month** | | Braintree, online (2.89% + $0.29) | about **$7,500/month** | | Square Free, card-present (2.6% + $0.15) | about **$7,300/month** | | Stripe Terminal, card-present (2.7% + $0.05) | about **$7,900/month** | | PayPal Zettle, card-present (2.29% + $0.09) | about **$10,700/month** | All on the $99 tier, all consistent with that tier at the crossover volume. **Ticket size moves these, and not in the direction you'd guess.** Stax's total fixed charge per transaction is higher than Square's in both channels. It's 25.8 cents against 15 cents card-present, 32.2 cents against 30 cents online. A bigger ticket means fewer transactions. That helps Stax. So the flat-rate breakeven **falls** as your ticket rises. Card-present against Square Free it's about $11,600 a month at a $15 ticket, $7,300 at $50, and $6,600 at $150. ### Breakeven 2: Stax against Helcim This is the one that decides anything. [Helcim](/docs/payments/processors/helcim) charges no monthly fee, and it's cheaper than every flat rate this site ranks above roughly a $9 ticket. Interchange is identical on both sides, so only the markup matters. **Card-present, Helcim's entry band charges 0.40% + $0.08. Stax charges 0% + $0.08 plus a subscription.** The 8 cents is identical. So the whole comparison is Helcim's 0.40% against Stax's subscription. Stax wins when: ``` subscription < 0.0040 x volume ``` At $99 that needs **$24,750 a month, or $297,000 a year**. That isn't the $99 tier. At $139 it needs $34,750 a month, or $417,000 a year. Not the $139 tier either. The first internally consistent answer is the $199 floor at about $49,750 a month. That's $597,000 a year, deep inside the unpublished "$199+" band. **So card-present, no volume gets Stax past Helcim while Stax's subscription price is still published.** That verdict holds at a $15 ticket, a $50 ticket and a $150 ticket. The 8 cents cancels at every ticket size. Helcim's band step at $50,000 a month makes this worse still for Stax. Just below $50,000 the two sit within about a dollar of each other at the $199 floor. Just above it Helcim drops to 0.35% + 7 cents and pulls away again. The next crossover is about **$60,300 a month** at a $50 ticket. It's $70,200 at a $15 ticket and $58,000 at a $150 ticket, all at the $199 floor. **Online the answer changes, because the cent charges differ.** Stax charges 15 cents. Helcim's entry online band charges 25 cents plus 0.50%. Stax's 10-cent advantage per transaction is real. At a small ticket there are enough transactions to pay for the subscription. | Online, ticket | Where Stax overtakes Helcim | Tier | Rankable? | |---|---|---|---| | **$25** | about **$11,000/month** | $99 | **Yes** | | **$25**, second window | about **$15,400/month** | $139 | **Yes** | | **$50** | about **$19,900/month** | $139 | **Yes**, barely | | **$100** | about $33,200/month | $199 floor | No | | **$200** | about $36,200/month | $199 floor | No | The $25 row has two entries because the answer sawtooths. Stax leads from about $11,000 to $12,500 a month. Then the subscription steps to $139 and Helcim retakes the lead until about $15,400. Then Stax leads again until $20,833 a month, where the price stops being published. That's not a rounding artefact. It's what a subscription tier does to a cost curve. It's also the best argument for running your own numbers instead of trusting a threshold. **Stax is the cheapest option this site can rank in exactly one situation.** Online, small ticket, roughly $11,000 to $20,800 a month. There's a gap in the middle where the subscription steps to $139 and Helcim briefly retakes the lead. Everywhere else this site can rank, Helcim is cheaper or Stax's price isn't published. --- ## Worked Examples All three at rankable volumes, all with the interchange assumption stated at the top of the page. Interchange is a real line on the Stax and Helcim side. It's bundled inside the flat rate on the others. So it has to be in the model. ### $5,000/Month Online, $25 Average Ticket (200 transactions) That's $60,000 a year, so the **$99 tier**. Pass-through is $109.40 for everybody. 1.50% of $5,000 is $75.00. Add $0.172 x 200, which is $34.40. | | Total | Effective | |---|---|---| | **[Helcim](/docs/payments/processors/helcim)**, entry band | **$184.40** | 3.69% | | [Braintree](/docs/payments/processors/braintree) | $202.50 | 4.05% | | [Square](/docs/payments/processors/square) Free | $225.00 | 4.50% | | **Stax** ($99 tier) | **$238.40** | 4.77% | | [PayPal](/docs/payments/processors/paypal) standard card | $247.50 | 4.95% | **Stax is fourth of five here.** Below the flat-rate breakeven the subscription is a real cost with nothing to offset it. A $25 ticket makes it worse. $99 spread over 200 transactions is 50 cents a sale. ### $20,000/Month Online, $25 Average Ticket (800 transactions) That's $240,000 a year, so the **$139 tier**. Pass-through is $437.60. | | Total | Effective | |---|---|---| | **Stax** ($139 tier) | **$696.60** | 3.48% | | [Helcim](/docs/payments/processors/helcim), entry band | $737.60 | 3.69% | | [Braintree](/docs/payments/processors/braintree) | $810.00 | 4.05% | | [Square](/docs/payments/processors/square) Free | $900.00 | 4.50% | | [PayPal](/docs/payments/processors/paypal) standard card | $990.00 | 4.95% | **Stax wins by $41 a month against Helcim**, and by $113 against Braintree. This is the cell Stax is built for. Enough transactions for the 10-cent online advantage to matter, and a subscription that's still published. Move the ticket to $50 and the margin nearly vanishes. Stax lands at $199.00 of markup against Helcim's $200.00. One dollar. Move it to $100 and Helcim wins outright. ### $20,000/Month Card-Present, $50 Average Ticket (400 transactions) That's $240,000 a year, so the **$139 tier**. Pass-through is $277.20. | | Total | Effective | |---|---|---| | **[Helcim](/docs/payments/processors/helcim)**, entry band | **$389.20** | 1.95% | | **Stax** ($139 tier) | **$448.20** | 2.24% | | [PayPal](/docs/payments/processors/paypal) Zettle | $494.00 | 2.47% | | [Square](/docs/payments/processors/square) Free | $580.00 | 2.90% | **Stax beats both flat rates by $46 and $132. It still loses to Helcim by $59.** That's the shape of the card-present answer at every volume this site can rank. Stax's problem here isn't that it's expensive. It's that Helcim charges the same 8 cents with no subscription. Stax starts $139 behind with no percentage advantage to claw it back. Interchange is an assumption in all three tables. It's also the largest single line in the Stax and Helcim columns. Replace it with your own blended rate from your last statement before you decide anything. A debit-heavy book is cheaper across the board. A premium-card book is dearer. Neither changes the ranking, because interchange is identical on both interchange-plus rows. --- ## Stax vs Helcim: The Comparison That Decides It Both pass interchange through. Both are transparent. This is the comparison most merchants should run. For most of them it comes out in Helcim's favour. | | Stax | Helcim | |---|------|--------| | **Monthly fee** | $99 to $199+, by **annual** volume | $0 | | **Percentage markup** | **0%** | 0.40% down to 0.15% card-present, 0.50% down to 0.15% online, by **monthly** volume band | | **Card-present per transaction** | $0.08 | $0.08 down to $0.06 | | **Online per transaction** | $0.15 | $0.25 down to $0.15 | | **Chargeback you win** | Not published. $25 protection add-on available | **$0** | | **Slow month** | You still pay the subscription | You pay nothing | | **Price published above your volume?** | Only to $250,000 a year | Yes, to $5 million a month | Both verified 2 August 2026 from [staxpayments.com/pricing](https://staxpayments.com/pricing/) and [helcim.com/pricing](https://www.helcim.com/pricing/). **Where Helcim wins:** - Card-present, at every volume where Stax publishes a price. The 8 cents is identical and Helcim adds no subscription. - Online at a $100 or $200 ticket, at every rankable volume. - Online at a $50 ticket below about $19,900 a month. - Any month where your volume drops. Helcim charges nothing in a dead month. - Any business with real dispute volume. Helcim publishes $0 for a chargeback you win. Stax publishes no base fee at all. **Where Stax wins:** - Online at a small ticket, roughly $25, between about $11,000 and $12,500 a month. And again between about $15,400 and $20,800 a month. - Online at a $50 ticket, between about $19,900 and $20,800 a month. - Possibly above $250,000 a year in several more places, on the "$199+" floor. Nobody can check that without a written quote. **Pick Stax when** you're online with a small ticket. Your volume is steady, it sits in that window, and you've got the subscription price in writing. **Pick Helcim when** you're card-present. Or your ticket is large. Or your volume moves. Or you'd rather not have a monthly bill at all. --- ## What Stax Does Well ### 1. Zero Percentage Markup There isn't a percentage. That's genuinely unusual, and it's the whole product. Take $20,000 a month online at a $25 ticket, on the $139 tier. Stax's entire markup is $139 plus $120 in per-transaction fees. That's $259, or 1.30% of volume. Helcim's markup in the same cell is $300. The catch: the model only pays once the subscription spreads over enough transactions. And above $250,000 a year, Stax stops publishing what the subscription is. The zero percentage is real. The price you pay for it isn't always public. ### 2. Predictable Monthly Cost Your subscription is fixed. Your per-transaction fee is fixed. Only interchange varies. Budgeting is easier than with any percentage-based model. That's a real operational benefit, and it never shows up in a rate table. ### 3. Built-in Business Tools The subscription includes invoicing with payment links, a virtual terminal for phone orders, a customer vault for repeat billing, and a reporting dashboard. Other processors charge separately for some of these. If you'd otherwise buy an invoicing tool, price that saving into the comparison. It can be worth more than the $59 a month separating Stax from Helcim in the card-present example above. ### 4. Human Support Phone support during business hours and US-based staff, against the email-first model at Stripe and Square. --- ## What Stax Does Poorly ### 1. The 8 Cents Card-Present Is Not an Advantage Helcim's entry band charges the same 8 cents card-present. It adds no subscription. That one fact is why Stax can't win a card-present comparison at any volume where its price is published. Retail or restaurant, this is the finding that matters. ### 2. You Pay in Slow Months The subscription doesn't pause. A seasonal business with four dead months pays $400 to $800 for nothing. Helcim's $0 monthly fee exists precisely for this case. ### 3. Dispute Pricing Is Not Published Stax publishes a $25 chargeback protection add-on. It doesn't publish what a chargeback costs without it. Close that gap with a written answer before you sign. Especially if you're in a dispute-prone category. ### 4. "$199+" Starts at a Volume Ordinary SMBs Reach The top published tier is "$199+ for $250,000 a year and above." That's $20,833 a month. It covers a $300,000-a-year business and a $30-million-a-year business alike. Stax doesn't say what the plus becomes. Every processor on this site is unrankable somewhere. Stax goes unrankable at a volume a successful small shop passes in its second year. ### 5. Limited Developer Tools and a Smaller Ecosystem Stax's API isn't in Stripe's league. There are fewer e-commerce plugins and third-party integrations than Stripe or Square offer. Custom integration takes more effort. --- ## Who Stax Is Best For ### Good Fit | Business Type | The condition attached | |---------------|------------------------| | **Low-ticket e-commerce** | Roughly a $25 average order at $11,000 to $20,800 a month. This is the one cell where Stax is the cheapest option this site can rank | | **Professional services and B2B invoicing** | High-ticket invoices, low transaction count. A flat 15 cents on a $2,000 invoice is nothing. Price Helcim too: at large tickets its 0.50% online markup is what you're comparing against, not its cents | | **Merchants who want invoicing and a virtual terminal bundled** | Worth real money if you'd otherwise buy those separately. Put a number on it | | **Businesses that value a fixed, predictable bill** | Legitimate reason to pay a little more. Just know that you might be | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Card-present retail, any volume** | [Helcim](/docs/payments/processors/helcim). Same 8 cents, no subscription | | **Under the flat-rate breakeven** | [Square](/docs/payments/processors/square) or [PayPal Zettle](/docs/payments/processors/paypal). No monthly fee | | **Seasonal** | Helcim. No monthly fee, same transparency | | **Dispute-heavy** | Helcim. $0 when you win, and it's published | | **Above $250,000 a year without a written quote** | Anything with a published price, until Stax gives you a number | | **Retail needing a full POS** | Square or [Clover](/docs/payments/processors/clover) | --- ## Common Gotchas ### 1. Annual Bands, Not Monthly Said three times on this page. It's the error that made Stax look twelve times more expensive than it is. Take your **annual** volume into the tier table, not your monthly volume. ### 2. Correcting That Error Does Not Make Stax Cheapest This is the second half of the same gotcha. Fixing the annual-versus-monthly mistake moves Stax from "far too expensive" to "worth pricing." It doesn't move it to "cheapest." Helcim charges no subscription and matches Stax's card-present cents exactly. ### 3. Contract Length Stax's contract terms aren't published. Ask directly. "Can I cancel any time with no early termination fee?" Get the answer in writing. ### 4. Interchange Is Still Your Biggest Line Stax adds no percentage, so interchange is essentially your whole percentage cost. Your card mix matters more here than with a flat rate. A flat rate absorbs the variance. Stax passes it straight through. A premium-rewards-heavy book costs more than a debit-heavy one, and Stax can't cushion that. See [how this site models card mix](/docs/payments/reference/cost-model-assumptions), then check yours. ### 5. The Chargeback Add-On Is Not Insurance $25 per chargeback for protection is a price, not a guarantee. Ask which liability transfers. Ask which reason codes are covered. Ask what the exclusions are. Then decide whether it counts as coverage. --- ## Test to Run **Stax savings calculation, before switching:** 1. Get your current processor statement. Record total volume, total transaction count, total fees. 2. Calculate your current effective rate: `total fees / total volume`. 3. Find your tier using **annual** volume. Multiply monthly volume by 12, then look it up. If the answer is "$199+", stop. Get the real number in writing before going further. 4. Estimate Stax: `subscription + (transactions x $0.15 online or $0.08 card-present) + (volume x your blended interchange)`. 5. Don't know your blended interchange? Use the assumption on this site: **1.50% + $0.172 online** or **1.03% + $0.178 card-present**, both including assumed network assessments. Mark the answer as an estimate and see [where those numbers come from](/docs/payments/reference/cost-model-assumptions). 6. Run [Helcim](/docs/payments/processors/helcim) with the same inputs. This is the comparison that decides it, not the flat-rate one. Card-present, expect Helcim to win. Online at a small ticket in the $11,000 to $20,800 range, expect it to be close. 7. Add your dispute costs. Stax doesn't publish a base fee, so get one before you finish the model. 8. Compare. Is Stax at least $50 a month cheaper after everything, including against Helcim? **Success criteria.** Stax saves you $600 a year or more against **Helcim**, not against a flat rate. Your volume is steady enough that you'll still be above the breakeven in your worst month. And your subscription price is a number, not a number with a plus sign. --- ## Next Steps **Considering Stax?** 1. Run the calculation above with your own numbers, using **annual** volume for the tier. 2. Confirm your subscription price in writing, especially if you're anywhere near $250,000 a year. 3. Ask what a chargeback costs on the base plan. 4. Compare with [Helcim](/docs/payments/processors/helcim) before you compare with anything flat-rate. That's the comparison Stax has to win. **Already on Stax?** 1. Check you're on the right tier for your **annual** volume. Merchants get moved up and rarely get moved back down. 2. If you're card-present, price Helcim. The 8 cents is identical and there's no subscription to earn back. 3. Review your card mix. Stax adds no percentage, so interchange is your whole percentage cost. 4. Compare your effective rate to [benchmarks](/docs/reference/benchmarks). --- ## See Also - [Helcim](/docs/payments/processors/helcim) - The processor Stax has to beat, with no monthly fee and $0 chargebacks when you win - [How We Compare Processor Costs](/docs/payments/reference/cost-model-assumptions) - The interchange assumption behind every crossover on this page - [Square](/docs/payments/processors/square) - Flat-rate alternative with a full POS - [PayPal](/docs/payments/processors/paypal) - Zettle is the lowest published flat card-present rate here - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table - [Understanding Fees](/docs/learning-pathways/getting-started-with-payments/understanding-fees) - How interchange works - [Interchange Reference](/docs/payments/reference/interchange) - Interchange rate tables --- ## Stripe Source: https://paymentsandrisk.com/docs/payments/processors/stripe # Stripe :::info[TL;DR] - Stripe is the best choice for developer-led companies and online businesses. Best API, most integrations, fastest time to market. - Stripe's dispute economics are worse than people think. The $15 received fee **never** comes back. The $15 countered fee comes back only on an outright win. Win partially and you're out $30 anyway. - US instant payouts are **1.5%**, not 1%. The 1% is Canada, the EU, the UK, Singapore, Norway, Hong Kong and Malaysia. - Stripe publishes no volume threshold and no discount schedule. Anyone quoting "0.1 to 0.3% off above $1M a month" is guessing. - **The US rates are confirmed.** Online **2.9% + 30c**, Terminal **2.7% + 5c**, keyed **+0.5%**, all VENDOR. - **Two Stripe fees are inverted between the US and Canada.** Copy the Canadian card into a US table and you get both backwards. International cards add **1.5% in the US**, 0.8% in Canada. Currency conversion adds **1% in the US**, 2% in Canada. - **Stripe against Square card-present resolves at a $100 ticket.** Stripe is cheaper below it, Square above it, on rate alone. - Square charges **$0** per dispute and says so outright. Stripe charges $15 that never comes back, then another $15 to counter. On any book with real dispute volume, that gap beats the cents a rate table argues over. - Stripe charges no setup fee and no monthly fee on standard pricing. ::: Stripe is the default for developer-led companies and online businesses. Best API, most integrations, fastest launch. It isn't always the cheapest, and it isn't the easiest. :::caution[Check the currency before you trust a Stripe rate you found online] Stripe serves pricing by your connection's country, and there's no US-specific URL to ask for. Request `/us/pricing` or `/en-us/pricing` from outside the US and Stripe redirects you to your own country's card anyway. So a Stripe rate quoted in a blog post or a comparison table may be the Canadian, UK or EU figure with the dollar sign swapped, and whoever published it may not have noticed. Two things follow. Confirm the currency on any Stripe number you didn't read yourself. And treat **"Stripe Terminal 2.6% + $0.10" as wrong wherever you find it** - it matches no Stripe geography at all. The US is 2.7% + 5c, Canada is 2.7% + CA$0.05. Figures on this page were read from a US connection on **4 August 2026**: [stripe.com/pricing](https://stripe.com/pricing), [stripe.com/radar/pricing](https://stripe.com/radar/pricing), [docs.stripe.com/payouts/instant-payouts](https://docs.stripe.com/payouts/instant-payouts), [support.stripe.com dispute pricing](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes). ::: :::danger[Two Stripe fees are inverted between the US and Canada] This is the finding worth carrying away. It's why a currency-swapped Canadian rate card is worse than useless: | Fee | United States | Canada | |---|---|---| | **International cards** | **+1.5%** | +0.8% | | **Currency conversion** | **+1%** | +2% | Both are backwards. Read Stripe's Canadian page, swap the dollar sign, and you get the international surcharge at nearly half what it should be. The conversion fee at double. Online (2.9% + 30c), Terminal (2.7% + 5c), keyed (+0.5%) and dispute pricing ($15 + $15) are structurally identical across the two countries. That's exactly why the two that differ are easy to miss. Two more differ. Instant Payouts: 1.5% with a **50 cent minimum** in the US, 1% with a CA$0.60 minimum in Canada. Bank debit: ACH at 0.8% capped at $5.00 in the US, PAD at 1% + CA$0.40 capped at CA$5.00 in Canada. ::: ## When to Use Stripe **You should use Stripe if:** - You have a developer, or can hire one. - You're building a custom checkout. - You need subscription billing with complex logic. - You're selling globally, or plan to. - You want to own your payment infrastructure long-term. **Skip Stripe if:** - You need plug-and-play with no coding. - You're mostly card-present retail. [Square](/docs/payments/processors/square) has better hardware and a deeper POS. On rate Stripe is a shade cheaper below a $100 ticket and a shade worse above it. That decides nothing. - You dispute a lot of transactions. The fee structure punishes fighting, as below. - You're cost-optimising. [Helcim](/docs/payments/processors/helcim) and [Stax](/docs/payments/processors/stax) publish full schedules you can model against your own statement, no sales call. Helcim charges no monthly fee, so there's no volume you have to reach first. --- ## Pricing Breakdown ### Card Processing All figures below are US, in USD, and all are VENDOR. | Transaction Type | Rate | |------------------|------| | **Card-not-present (online, mobile, recurring)** | **2.9% + $0.30** | | **Card-present (Stripe Terminal)** | **2.7% + $0.05** | | **Manually entered cards** | **+0.5%** (Stripe's wording: "+ 0.5% for manually entered cards") | | **International cards** | **+1.5%** (Stripe's wording: "+ 1.5% for international cards") | | **Currency conversion** | **+1%** (Stripe's wording: "+ 1% if currency conversion is required") | | **ACH Direct Debit** | **0.8%, capped at $5.00** | Source: [stripe.com/pricing](https://stripe.com/pricing), accessed 2 August 2026 via a US-located connection. Cross-check REPORTED: [Merchant Maverick's Stripe review](https://www.merchantmaverick.com/reviews/stripe-review/) reports online 2.9% + $0.30, Terminal 2.7% + $0.05, international 1.5%, conversion 1%, Instant Payouts 1.5% with a $0.50 minimum, and a $15 chargeback fee. **Every figure matches**, from a source published 20 months earlier. It states keyed as "3.4% + $0.30". Same thing said differently: 2.9% + 0.5% = 3.4%. Merchant Maverick publishes a stated rating methodology and **discloses referral commissions from processors including Stripe**. Last updated 2024-11-18. ### Disputes This is the part worth reading twice. | Fee | Amount | Returned? | |-----|--------|-----------| | **Dispute received fee** | $15.00 | **Never.** Charged the moment a dispute arrives, win or lose | | **Dispute countered fee** | $15.00 | Returned **only on an outright win**. New as of 17 June 2025 | Source: [support.stripe.com - June 2025 pricing updates for disputes](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) and [docs.stripe.com/disputes/how-disputes-work](https://docs.stripe.com/disputes/how-disputes-work), verified 2 August 2026. :::danger[A partial win costs you $30] Stripe's own wording on a partial win: "The $15 fees to receive the dispute and to counter the dispute will not be returned." So the outcomes are: | Outcome | Fees you keep paying | |---------|----------------------| | You don't fight it | $15 | | You fight and win outright | $15 | | You fight and win partially | **$30** | | You fight and lose | **$30** | Fighting a dispute on Stripe is a bet where a partial win pays like a loss. That changes the small-dispute arithmetic. On a $40 transaction, a partial or failed defence costs $30 in fees on top of the $40 already gone. [Helcim](/docs/payments/processors/helcim) charges $0 when the case goes your way. ::: ### Payouts | Fee | Amount | |-----|--------| | **Standard payout** | $0 | | **Instant payout, US / AU / NZ / AE** | **1.5%** | | **Instant payout, CA / EU / UK / SG / NO / HK / MY** | 1% | | **Instant payout minimum** | 0.50 USD | | **Instant payout maximum** | 9,999 USD per payout | Source: [docs.stripe.com/payouts/instant-payouts](https://docs.stripe.com/payouts/instant-payouts), verified 2 August 2026. **The 50 cent minimum is the detail nobody mentions.** It binds on any payout under **$33.33**. Below that, 1.5% comes to less than 50 cents. Instant-pay $20 a few times a day and you're paying 2.5% or worse. :::warning[US instant payouts are 1.5%, and 1% is the Canadian number] Plenty of content quotes 1% as Stripe's instant payout fee. That's the rate for Canada, the EU, the UK, Singapore, Norway, Hong Kong and Malaysia. **A US merchant pays 1.5%.** Half again as much. There's a cap people miss too. The maximum instant payout is 9,999 USD. A $100,000 day can't be one instant payout. It's at least eleven, at 1.5% each. $1,500 in fees. ::: ### Volume Pricing **Stripe publishes no volume threshold, no discount schedule, no negotiation floor.** Nothing on the pricing page says when custom pricing opens up, or what it saves. Figures like "custom pricing starts near $1M a month at 0.1 to 0.3% off, with real discounts above $5M" trace back to nothing verifiable. Don't plan around them. **What to actually do:** email Stripe sales. Send trailing twelve months of volume, your average ticket, your card mix and a competing quote. Ask for interchange-plus, not a percentage off the flat rate. Interchange-plus is the only structure you can audit. Then hold their answer against [Helcim's published schedule](https://www.helcim.com/pricing/), which needs no negotiation at all. ### Other Fees | Fee | Amount | Notes | |-----|--------|-------| | **Setup fee** | $0 | Stripe: "Stripe does not charge setup fees, monthly fees, or any other hidden fees" | | **Monthly fee** | $0 | Same source | | **Stripe Billing** | From **0.7%** of Billing volume | Pay-as-you-go tier, no recurring fee. Counts Billing transactions processed on and off Stripe, excludes one-off invoices | | **Account updater** | Not published | It appears on no Stripe pricing page. Ask Stripe directly rather than assuming it's bundled | ### Stripe Radar Radar's product line has changed. The old naming is out of date. Stripe prices Radar two ways, and which column you're in matters more than which tier you pick: | Tier | For your business | Platforms and marketplaces | |------|------|------| | **Radar Lite** | Included with Stripe Payments | Included | | **Radar Standard** | From **$10/mo** | From **$20/mo** | | **Radar Plus** | From **$14/mo** | From **$44/mo** | | **Radar Pro** | From **$20/mo** | From **$70/mo** | Each paid tier is a fixed monthly fee covering a set allowance of screens per transaction, per active account and per customer. Past the allowance you go pay-as-you-go, which starts at **$0.05 per screened transaction**. You can also take pay-as-you-go on its own if your volume is low or unpredictable. Look at what the platform column does. Standard doubles, Plus triples, Pro is three and a half times the business price. If you're running a marketplace, Radar is a materially bigger line item than the single-merchant pricing suggests, and the gap widens as you move up the tiers. Budget from the right column. :::warning["Radar for Fraud Teams at $0.02 per transaction" no longer exists] That name appears nowhere on Stripe's Radar page, pricing page or docs as of 4 August 2026. Radar sells as Lite, Standard, Plus and Pro, and nothing else. Any comparison table still quoting $0.02 a screened transaction is pricing a dead SKU. ::: --- ## What Stripe Does Well ### 1. Developer Experience Stripe's API is the industry reference point: - Documentation with live examples - SDKs for every major language - Webhook reliability - Transparent error messages Got a technical team? You'll ship faster here than anywhere else. ### 2. Subscription Billing Stripe Billing handles the complex subscription logic. Proration, metered billing, usage-based pricing, dunning, a self-service customer portal, trial management. Best for SaaS, subscription boxes, membership sites, usage-based businesses. ### 3. International Expansion Local payment methods, multi-currency pricing, tax calculation, SCA/PSD2 compliance. Best for companies selling globally, or planning to. ### 4. Ecosystem Integration Stripe plugs into the major e-commerce platforms, the major accounting tools and the no-code builders. If a tool takes payments, it probably supports Stripe first. --- ## What Stripe Does Poorly ### 1. Dispute Economics Covered above. It belongs here too. Stripe charges you to receive a dispute, then charges again to fight it. Only the second fee comes back, and only on an unambiguous win. **Stripe's $30 to fight and partly win is the joint-worst published US outcome here.** Only [PayPal](/docs/payments/processors/paypal)'s $30 High Volume Dispute Fee matches it. PayPal's ordinary tier is cheaper than Stripe's, not worse: $15 on wallet traffic, $0 on a case decided your way. ([Moneris](/docs/payments/processors/moneris) charges CA$25 plus a CA$80 authorization chargeback handling fee. It's a Canadian acquirer quoting CAD, so that's not like-for-like.) Before you buy the add-on: **Stripe Smart Disputes costs 30% of the disputed amount for each dispute it wins** ([stripe.com/pricing](https://stripe.com/pricing), read 2026-08-04). On a $300 order that's $90. Six times the dispute fee it's helping you avoid. In a category with a real dispute rate, price this in. Take twenty disputes a month, all countered. Half win outright, half go partial or lose. That's $450 a month. $300 in received fees that never come back, plus $300 in counter fees, less $150 returned on the ten outright wins. And that's before the lost transactions themselves. ### 2. Customer Support Stripe support is email and documentation. Phone exists, but it's slow to reach. The docs are genuinely excellent and answer most questions. During an incident, though, this hurts. ### 3. Account Holds and Reserves Stripe is aggressive about risk. New accounts, sudden volume spikes and high-risk categories all attract reserves and holds. Go from $10K a month to $100K in one month and you'll get a review. Tell Stripe before a big launch. Send the documentation before they ask. ### 4. Card-Present Stripe Terminal works. It's thinner than Square for retail. Fewer hardware options, less mature POS features. On rate, 2.7% + 5c against Square Free's 2.6% + 15c crosses at a **$100 ticket**. Stripe is cheaper below, Square above, by cents either way. [Full arithmetic below](#card-present-stripe-against-square-is-unsettled). Mostly brick-and-mortar? The POS and hardware gap decides it long before a few cents a transaction does. Optimising for cost? Neither of these is your answer. On this site's card mix, [Helcim](/docs/payments/processors/helcim) beats Square card-present above roughly a $9 ticket, at any volume. Stripe Terminal at 2.7% + 5c doesn't change that. ### 5. Surprise Terminations Stripe can terminate with almost no warning. Restricted categories, terms violations. They don't negotiate much, and the funds get held. --- ## Pricing Comparison (Stripe vs Competitors) | Processor | Online | Card-present | Per-dispute cost | Monthly | |-----------|--------|--------------|------------------|---------| | **Stripe** | **2.9% + $0.30** | Terminal **2.7% + $0.05** | $15 + $15, neither returned on a partial win | $0 | | **[Square](/docs/payments/processors/square)** | 3.3% + $0.30 (Free), 2.9% + $0.30 (Plus and Premium) | 2.6% + $0.15 (Free), 2.5% + $0.15 (Plus), 2.4% + $0.15 (Premium) | **$0** | $0 Free, $49 Plus, $149 Premium, **per location** | | **[Braintree](/docs/payments/processors/braintree)** | 2.89% + $0.29 | Not separately published | $15 | Not published | | **[PayPal](/docs/payments/processors/paypal)** | 3.49% + $0.49 Checkout, 2.99% + $0.49 standard card | 2.29% + $0.09 (Zettle) | $15 wallet ($0 if you win), $20 card, $30 above a 1.5% ratio | $0 standard | | **[Helcim](/docs/payments/processors/helcim)** | IC + 0.50% + $0.25 (entry band of five published) | IC + 0.40% + $0.08 (entry band of five published) | **$0 if you win**, $15 if you lose | $0 | | **[Adyen](/docs/payments/processors/adyen)** | Not published. IC++ plus $0.13 | Not published. IC++ plus $0.13 | Not published | No monthly fee, but a minimum invoice with no published amount | All figures verified 2 August 2026 from each vendor's own pricing page, all in USD. **Verdict, stated with its conditions:** - **Stripe against Braintree:** one hundredth of a point and one cent apart. That's 1.25 cents on a $25 order, about six cents on a $500 one. No breakeven ticket to compute, no cost argument either way. Choose on features. Braintree gives you native PayPal and Venmo. Stripe gives you a broader product surface. - **Stripe against Square, card-present:** Stripe is cheaper below a **$100** ticket, Square above it, by cents either way. [Full arithmetic below](#card-present-stripe-against-square-is-unsettled). - **Disputes:** Square is cheapest of the flat rates that publish a full card. It charges no per-dispute fee at all. Stripe's $15 received fee never comes back. **That gap is worth far more than the rate comparison above it.** At a $50 card-present ticket, Stripe's rate edge takes 300 transactions to pay for one Stripe dispute fee. - **Cost against interchange-plus:** Stripe loses at every volume on an ordinary card mix. Helcim publishes a full schedule with no monthly fee. So the usual "wait until you're big enough to switch" advice was never right. See the [scale callouts](#scale-callout) for the dollars. ### Card-Present: Stripe Against Square Settles at a $100 Ticket {/* #card-present-stripe-against-square-is-unsettled */} With the US Terminal fixed fee confirmed at 5 cents, this resolves. Square's Free plan is 2.6% + 15c in person. Stripe Terminal is **2.7% + 5c**. A higher percentage against a lower fixed fee crosses at exactly one ticket size: ``` Square Free = 0.026 x A + $0.15 Stripe Terminal = 0.027 x A + $0.05 0.026A + 0.15 = 0.027A + 0.05 0.001A = 0.10 A = $100.00 ``` **Stripe Terminal is cheaper below a $100 ticket. Square Free is cheaper above it.** | Ticket | Stripe Terminal | Square Free | Cheaper | |---|---|---|---| | $10 | $0.32 | $0.41 | **Stripe** by 9c | | $25 | $0.73 | $0.80 | **Stripe** by 7c | | $50 | $1.40 | $1.45 | **Stripe** by 5c | | $100 | $2.75 | $2.75 | Identical | | $200 | $5.45 | $5.35 | **Square** by 10c | Look how small the gap is at every row. Cents per transaction across the whole practical range. A real answer, not an exciting one. Three conditions on it. **Square's paid plans move the crossover.** Plus is 2.5% + 15c at $49 a month. Premium is 2.4% + 15c at $149. Both beat Stripe on percentage, and both carry a subscription to earn back. **Square's plan prices are per location.** A three-site merchant on Plus pays $147 a month, not $49. **This whole comparison is between two flat rates.** If you're optimising cost rather than picking between these two, [Helcim](/docs/payments/processors/helcim) beats Square card-present above roughly a $9.23 ticket on [this site's card mix](/docs/payments/reference/cost-model-assumptions), at any volume. Neither Stripe nor Square is in that conversation. **The dispute line still swamps all of this.** Square charges $0 per dispute. Stripe charges $15 the moment one arrives and never returns it. At a $50 ticket, Stripe's 5 cent rate edge takes **300 transactions** to earn back a single Stripe dispute fee. On any card-present book with real dispute volume, the rate table is arguing over the wrong number. --- ## Who Stripe Is Best For ### Perfect Fit | Business Type | Why Stripe Wins | |---------------|-----------------| | **SaaS companies** | Best subscription billing, developer-friendly | | **Marketplaces** | Stripe Connect for split payments | | **High-growth startups** | Scales without a re-platform | | **Global businesses** | Multi-currency, local payment methods | | **Custom checkouts** | Flexible API, Stripe Elements | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Retail stores** | Square, for the hardware and POS. On rate the two are within cents, crossing at a $100 ticket | | **Non-technical founders** | Square or PayPal | | **High-dispute categories** | Square (no published dispute fee) or Helcim ($0 on a win) | | **Cost-sensitive at any volume** | Helcim or Stax. Both publish full schedules, so you can model them against your own interchange without a sales call. Helcim charges no monthly fee, so there's no threshold to reach first | --- ## Common Gotchas ### 1. The "It Just Works" Myth Stripe needs development work. Budget for integration, maintenance and testing. It's developer-friendly, not non-technical-founder-friendly. ### 2. Fighting a Dispute Can Cost More Than Ignoring It Covered in the pricing section. It's the most missed thing about Stripe. "Under about $50, countering is a net loss" is only true at some win rates. The actual rule is short. Countering costs an extra $15, returned only on an outright win. Win outright and you also recover the transaction, worth **T**. So countering pays off when: ``` p x (T + $15) > $15 -> p > $15 / (T + $15) ``` **p** is your outright-win rate, not your overall success rate. Partial wins count as losses here. Stripe returns nothing on them. | Transaction | Counter only if your outright-win rate is above | |---|---| | $25 | 38% | | $40 | 27% | | $50 | 23% | | $100 | 13% | | $200 | 7% | | $500 | 3% | Pull your last fifty countered disputes. Count how many were outright wins, not partial ones. That's your **p**. Most merchants have never separated the two. That's exactly why the fee structure works. ### 3. International Card Fees Are Nearly Double What the Canadian Page Says The **US** surcharge for cards issued abroad is **+1.5%**. The Canadian one is +0.8%. On the US figure: - 10% international customers adds about **0.15%** to your effective rate - 50% international customers adds about **0.75%** Add the US currency conversion fee of +1% where it applies. A US merchant selling to a European customer, in euros, on a European-issued card, pays 2.9% + 1.5% + 1% = **5.4% + $0.30**. The trap: "international" means the **card was issued** outside the US. Not that you sold abroad. A US-only store pays it on every tourist and every expat. The +0.8% you'll see quoted is the Canadian number, read off the Canadian page. A US merchant pays +1.5%. ### 4. Instant Payout Costs At 1.5% for US accounts: | Amount | Fee | Payouts needed (9,999 cap) | |--------|-----|----------------------------| | $5,000 | $75 | 1 | | $10,000 | $150 | 2 | | $100,000 | $1,500 | 11 | Wait for the standard payout unless you've a cash emergency. --- ## Test to Run **Stripe cost and dispute audit, if you're already on Stripe:** **Week 1:** 1. Pull your last 3 months of Stripe fees 2. Work out your effective rate: `total fees / total volume` 3. Split it. Processing, disputes, instant payouts, Billing, Radar. Most people are surprised how little of it is processing **Week 2:** 4. Count disputes in the period. Multiply by $15 for the received fee 5. Count how many you countered. Of those, how many won outright? Every other outcome cost a second $15 6. Total your dispute fees. Price the same book on [Helcim](/docs/payments/processors/helcim): $0 per win, $15 per loss **Week 3:** 7. Check instant payout usage. Multiply by 1.5% 8. Review payment retry logic if you've subscriptions. Smart Retries lives under Billing then Settings **Week 4:** 9. Effective rate above 3.0%? Model [Helcim](/docs/payments/processors/helcim) and [Stax](/docs/payments/processors/stax) off their published schedules. Neither needs a sales call **Success criteria:** you know your effective rate to the basis point. You know what disputes really cost. And you're not paying 1.5% for money you didn't need today. --- ## Scale Callout Interchange-plus doesn't "start to win" around $50K a month, and the reason is structural. That rule assumes the interchange-plus provider charges a monthly fee you have to earn back. Helcim charges $0 a month. No fee to earn back means no threshold. The saving exists at every volume. Volume changes its size, not whether it's there. The figures below use [Braintree](/docs/payments/processors/braintree) at 2.89% + $0.29. Stripe's confirmed US online rate is one hundredth of a point and one cent away. So **read every row as Stripe's numbers too**, within about a cent a transaction. **Online, $75 average ticket, on [this site's card mix](/docs/payments/reference/cost-model-assumptions):** | Monthly volume | Helcim | Flat rate (Braintree) | Saving | |---|---|---|---| | $20,000 | $512.53 (2.56%) | $655.33 (3.28%) | $142.80/mo, $1,714/yr | | $100,000 | $2,346.00 (2.35%) | $3,276.67 (3.28%) | $930.67/mo, $11,168/yr | | $500,000 | $10,896.67 (2.18%) | $16,383.33 (3.28%) | $5,486.67/mo, $65,840/yr | **Under $50K/month:** - The saving is real but small, and a migration costs engineering time. $1,714 a year against a week of developer work is a genuine judgement call - Focus on integration quality, dispute prevention, and staying off instant payouts. Those beat the rate at this volume **$50K-$250K/month:** - The saving is four figures a month at a $75 ticket. [Helcim's published schedule](https://www.helcim.com/pricing/) is the easiest to model, since it needs no quote - Track your effective rate monthly - Ask Stripe for interchange-plus. They may say no, but the answer is free **Over $250K/month:** - Stripe publishes no threshold, so there's no "you qualify now" moment to wait for. Just ask, with a competing quote in hand - Take any offer as interchange-plus, not a discount off the flat rate. A discount off a blended rate can't be audited - Consider a second processor for redundancy as well as leverage **Over $1M/month:** - Compare Helcim's published $1M-$5M band. IC + 0.15% + 15c online, and no negotiation - [Stax](/docs/payments/processors/stax) charges no percentage markup at all. But above $250,000 a year its subscription is published only as "$199+", with no ceiling. Get the real number before you model it - Multi-market? [Adyen](/docs/payments/processors/adyen) and [Checkout.com](/docs/payments/processors/checkout-com) are worth a quote, though neither publishes rates --- ## Where This Breaks 1. **Restricted businesses.** CBD, adult, gambling and anything adjacent gets rejected or terminated with little warning. Check the [restricted businesses list](https://stripe.com/legal/restricted-businesses) before you build. 2. **No phone for emergencies.** Account held and you need money today? Email support won't solve it in time. 3. **Dispute-heavy businesses.** The $15 + $15 structure with no refund on a partial win makes Stripe an expensive place to run a high-dispute book. 4. **Card-present cost decides nothing.** Stripe wins below a $100 ticket, Square above, by cents. Square's hardware and POS are better at any ticket. Stripe Terminal's real case is one integration across both channels. That reason needs no rate behind it. 5. **The regional inversion bites anyone using a stale source.** International cards and currency conversion are inverted between the US and Canada. A table quoting +0.8% international for a US merchant is quoting Canada. Same for +2% conversion. Check which country a Stripe rate came from before you use it. That includes this page. 6. **Radar's US tier prices are still unread.** The Canadian tiers are the only ones that resolved. That's the one gap left on this page. --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [stripe.com/pricing](https://stripe.com/pricing) | All US card rates, the keyed, international and conversion surcharges, ACH, and the no-setup-fee statement | Vendor page, retrieved via a US-located connection | Accessed 2026-08-02 | | [docs.stripe.com/payouts/instant-payouts](https://docs.stripe.com/payouts/instant-payouts) | Instant payout rates by region, the $0.50 minimum and the $9,999 cap | Vendor documentation | Accessed 2026-08-02 | | [support.stripe.com, June 2025 dispute pricing update](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) | The $15 received and $15 countered fees, and the partial-win wording | Vendor support article | Accessed 2026-08-02 | | [Merchant Maverick, Stripe review](https://www.merchantmaverick.com/reviews/stripe-review/) | Independent corroboration of every US figure above. **Discloses referral commissions from processors including Stripe** | Review site with a stated rating methodology | Updated 2024-11-18 | --- ## Next Steps **Considering Stripe?** 1. Read [Stripe's documentation](https://stripe.com/docs) to gauge integration complexity 2. Confirm the rates yourself at [stripe.com/pricing](https://stripe.com/pricing), **opened from a connection in your own country**. Stripe resolves country by IP, not by URL path, so there's no US path you can request from abroad 3. Compare to [Square](/docs/payments/processors/square) if you're card-present 4. Read [Buying Payments](/docs/payments/buying-payments/) for the selection framework **Already on Stripe?** 1. Run the [audit above](#test-to-run), especially the dispute section 2. Check [Auth Optimization](/docs/payments/auth-optimization) to improve approval rates 3. Set up [Chargeback Alerts](/docs/chargebacks/prevention/alerts). On Stripe's fee structure, preventing a dispute beats winning one **Switching from Stripe?** 1. Read [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) 2. For lower published cost, look at [Helcim](/docs/payments/processors/helcim) or [Stax](/docs/payments/processors/stax) 3. Don't switch for pricing alone unless you've modelled it with your own statement --- ## See Also - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - The interchange blend behind every comparison here, and the confidence tiers - [Square](/docs/payments/processors/square) - Card-present competitor. Better POS; the rates cross at a $100 ticket - [Helcim](/docs/payments/processors/helcim) - Lowest published interchange-plus markup, no monthly fee, $0 disputes when you win - [Braintree](/docs/payments/processors/braintree) - Within a cent of Stripe's US online rate. Choose on features, not price - [PayPal](/docs/payments/processors/paypal) - Competitor comparison for brand recognition - [Adyen](/docs/payments/processors/adyen) - Enterprise and global, quote-only - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table and the 24-scenario matrix - [Buying Payments](/docs/payments/buying-payments) - The framework for choosing a processor - [Subscription Billing](/docs/payments/subscriptions-recurring) - Stripe's core strength - [Going Global](/docs/payments/going-global) - International expansion with Stripe --- ## Toast Source: https://paymentsandrisk.com/docs/payments/processors/toast # Toast :::info[TL;DR] - Toast is purpose-built for restaurants and genuinely good at it. It's not a general-purpose processor. - **Toast does publish processing rates**, on pages nobody thinks to check. VENDOR: **2.49%** Traditional, **3.09%** Pay-as-you-Go, both on Toast's own shop pages. Software plans are $0, $69 and $90 a month. - **Toast publishes only the percentage.** The "+ $0.15 per transaction" everyone attaches to it is REPORTED by NerdWallet and two content sites. Toast never published it. Don't quote the two as one vendor rate. - **The plan choice is arithmetic, not judgement.** The published 0.60 point gap breaks even near **$11,500 a month** of card volume with hardware ignored. Near **$25,300** with hardware in. - **The payments lock-in is still the critical term.** Toast's own 10-K gives the contract range: 12 to 36 months. Push for 12. - A chargeback costs **$15**, win or lose, and Toast publishes that. The ETF amount is NOT PUBLISHED at any tier. ::: Toast is the dominant restaurant POS and payment platform in the US. The software, hardware and workflows are built around how restaurants actually run. For a full-service restaurant that's worth a lot. You can price the payments half before you ever talk to a salesperson. :::caution[Toast's percentages aren't on its pricing page] [pos.toasttab.com/pricing](https://pos.toasttab.com/pricing) says "Simple, flat rate" and then gives no number at all. That's why plenty of write-ups report that Toast publishes nothing. The rates sit on the **shop pages** instead, [pos.toasttab.com/shop/starter-kits](https://pos.toasttab.com/shop/starter-kits) and [/shop/pricing-plan](https://pos.toasttab.com/shop/pricing-plan). Toast's own words: > "Pay-as-you-Go pricing. A 3.09% card processing fee covers all costs, except for shipping and taxes. And it's not a lease; you own the hardware from day one." > "Traditional pricing... This option includes a 2.49% card processing fee." Both are restated in the same pages' FAQ. All figures below were read on **2 August 2026**. Full [source list at the bottom of this page](#sources). ::: --- ## Toast's Published Pricing ### Processing rates | Plan | What Toast publishes | The fixed component | Combined | |---|---|---|---| | **Traditional** | **2.49%** VENDOR | + $0.15 REPORTED | 2.49% + $0.15 | | **Pay-as-you-Go** | **3.09%** VENDOR | + $0.15 REPORTED | 3.09% + $0.15 | | **Card-not-present** | Nothing published | 3.50% + $0.15 REPORTED | 3.50% + $0.15 | :::warning[Read the tiers on that table carefully] **2.49% and 3.09% are Toast's own figures. The "+ $0.15" isn't.** It comes from NerdWallet (2026-01-13, a personal finance publisher that earns partner referral revenue), Restaurantify (2026-06-24, an SEO content site with no stated methodology) and CheckThat (2026-03-30, an aggregator, same). Three sources agreeing is worth something. Three sources copying each other is worth less. Write it as two things, and ask for it as two things. **Toast publishes 2.49%. The fixed component is reported at $0.15.** Card-not-present is worse. That one traces to NerdWallet alone, and Toast publishes nothing. Take online or phone orders? Get that number in writing first. The wider reported range for Pay-as-you-Go is **3.09% to 3.69% + $0.15**. The low end is Toast's own figure. The high end isn't. ::: ### Software plans VENDOR Read from [pos.toasttab.com/pricing](https://pos.toasttab.com/pricing), a page stamped "last updated July 8, 2026". | Plan | Monthly | |---|---| | **Starter Kit** | $0 (1 location, up to 2 terminals) | | **Point of Sale**, restaurant | $69 | | **Point of Sale**, retail | $90 | | **Point of Sale + Payroll** | $69 + $9 per employee per month (against a struck-through $90) | | **Build Your Own** | Custom | Two footnotes on that page do real work. The published plan pricing covers **"new customers and single locations only"**. And **"Pricing includes first hardware terminal subscription. Additional charges apply for subsequent devices."** ### Hardware and contract | Item | Figure | Tier | |---|---|---| | **Hardware prices** | Not published. Quote or configurator only. "0% interest financing is available by application and subject to approval" | VENDOR statement, no numbers | | **Contract term** | "Our contracts with customers are generally for a term ranging from 12 to 36 months" | VENDOR, FY2025 10-K | | **Contract term, merchant-facing** | Two-year requirement on starter kits, plus early termination fees. Merchant Maverick reports two to three years | REPORTED | | **Mid-contract rate increases** | Merchant Maverick reports processing fees can increase over a contract's life | REPORTED | | **Early termination fee amount** | Not published at any tier | NOT PUBLISHED | | **Chargeback fee** | $15 per chargeback notification, charged win or lose | VENDOR, Toast support site | Merchant Maverick discloses that it earns referral fees. So treat the mid-contract increase as **a question to ask, not an established fact**. It's also the most-reported Toast complaint. Ask it in exactly those words. Toast's merchant agreement isn't openly readable. You'll get it during onboarding, not before. --- ## The Sanity Check Toast's Own Filing Gives You Toast is publicly traded. That means a figure exists that no salesperson controls. From Toast's **FY2025 Form 10-K, filed 2026-02-18** VENDOR: | Input | FY2025 | |---|---| | Gross payment volume | $195.1 billion | | Financial technology solutions revenue | $5,037 million | | Cost of that revenue | $3,891 million | | Locations | about 164,000 | DERIVED arithmetic on those published figures: | Measure | FY2025 | FY2024 | |---|---|---| | Gross take on GPV | **2.58%** | 2.55% | | Processing cost | 1.99% | - | | **Net take** | **0.59%** | 0.55% | :::note[What that 2.58% is, and what it isn't] It's an **upper bound on the blended card rate**, not the rate itself. Financial technology solutions revenue includes items beyond card processing. And it's a blend across roughly 164,000 restaurants. It says nothing about yours. What it's good for: **sanity-checking a quote.** Toast's whole book averages a 2.58% gross take. A quote materially above **3.09%** puts you over the sticker price of Toast's dearest published plan. And well over what Toast earns on average. That's a conversation you can have with a number in your hand. ::: --- ## Which Plan? The Breakeven Is Arithmetic This is the most useful thing the published rates unlock. The published gap between Pay-as-you-Go (3.09%) and Traditional (2.49%) is **0.60% of card volume**. Traditional adds $69 a month of software plus hardware upfront. Pay-as-you-Go includes hardware you own from day one. ``` Breakeven, ignoring hardware: $69 / 0.006 = about $11,500/month in card volume Breakeven, including hardware at an illustrative $2,000 over 24 months ($83/mo): ($69 + $83) / 0.006 = about $25,300/month in card volume ``` **Below roughly $25,300 a month, Pay-as-you-Go wins. Above it, Traditional does.** Toast's own page agrees in words, describing Traditional as "for those who expect to process higher volumes." Put your own hardware quote in place of the $2,000. That figure is illustrative, because Toast publishes no hardware prices. It's also the input that moves the answer most. --- ## When to Use Toast **You should use Toast if:** - You run a restaurant, cafe, bar, bakery, food truck or catering business. - You want online ordering, delivery management and POS on one platform. - You need kitchen display screens and ticket routing. - You want payroll, scheduling and tip management built in. - You're ready to negotiate a bundled contract properly. **Skip Toast if:** - You're not in food service. Toast doesn't serve retail or general services. - You're small enough that the bundled monthly cost won't justify itself. - You want month to month. Toast's own filing says 12 to 36 months. - You take real online or phone volume. Toast publishes no card-not-present rate, and the reported one is 3.50% + $0.15. - You want portable hardware. Toast hardware is locked to Toast processing. --- ## What to Ask For, In Writing The percentages are published now. Everything around them still isn't. That's where a Toast deal is won or lost. Get all of these answered in writing before you sign. ### 1. The Blended Effective Rate Ask: **"On my actual volume and card mix, what is my total monthly cost divided by my monthly volume?"** Not the card-present rate. Not the online rate. The blended number, every fee included. Toast's bundling lets them move components around to make any single one look good. Ask for it modelled at your real volume, not a generic example. Then ask what happens if your volume drops 20%. **Sanity-check the answer against 2.58%.** That's Toast's own blended gross take across 164,000 locations, from the FY2025 10-K. Anything materially above 3.09% is over the sticker price of Toast's dearest published plan. ### 1a. The Fixed Cents Component Ask: **"What is the per-transaction fixed fee in cents, in writing?"** Toast publishes 2.49% and 3.09%. It publishes **no fixed component at all**. Every comparison table adds $0.15. That figure comes from third parties, not from Toast. On a $25 average check, 15 cents is 0.6 points of effective rate. That's the entire gap between the two published plans. ### 1b. The Card-Not-Present Rate Ask: **"What is my rate on online orders, phone orders and anything keyed?"** Toast publishes nothing here. The reported figure is 3.50% + $0.15, from NerdWallet alone. Online ordering a real share of your volume? This is the most important unpublished number in your deal. ### 2. Are Payments Contractually Locked to Toast? Ask: **"Can I run Toast POS with a different payment processor? If not, what would I have to do to change processors?"** **This is the most important question on the page.** A Toast contract usually blocks a processor switch unless you replace the POS. So your payments pricing isn't renegotiable in the normal way. Can't move payments without ripping out the terminals? Then the rate you sign is your rate for the life of the hardware. Get the answer in writing. If payments are locked, price the contract as if you can never renegotiate. Functionally you can't. ### 3. Hardware Cost, and Is It Financed? Ask: **"What is the outright purchase price of every device, what is the financed total over the term, and do I own the hardware at the end?"** "Free hardware" trades upfront cost for a higher processing rate or a longer commitment. That can be a fine trade. You just can't judge it without both numbers. Test it this way. Ask for two quotes, one buying hardware outright and one on the free-hardware offer. Compare total cost over the full term at your projected volume. If the salesperson won't produce both, you've learned which one favours you. ### 4. Software Cost, Per Terminal Ask: **"What is the monthly software cost, is it per terminal or per location, and which modules are included versus add-on?"** Online ordering, payroll, loyalty, marketing and scheduling are usually separate line items. Get the list with prices. Then work out which ones you'd actually use. ### 5. Termination Terms, and the Rate Freeze Ask: **"What is the contract length, what is the early termination fee, how is it calculated, and does the contract auto-renew?"** **Push for 12 months.** Toast's FY2025 10-K says contracts run "generally for a term ranging from 12 to 36 months". So Toast demonstrably does 12. A salesperson calling 36 standard is quoting the top of Toast's own range. Then ask the one that follows from the most common Toast complaint. **"Can my processing rate change during the term, and under what conditions? I want a written cap or a fixed-rate commitment."** Merchant Maverick reports that processing fees can rise over a contract's life. It also discloses that it earns referral fees. Treat that as a question, not a fact, and get the answer into the contract. Ask what notice period applies. Calendar it the day you sign. ### 6. The Chargeback Fee VENDOR Ask: **"What does a chargeback cost, and is it refunded if I win?"** Toast's support site answers the first half: **$15 per chargeback notification**, "charged regardless of whether you dispute the chargeback, and regardless of whether you win or lose" ([Toast](https://support.toasttab.com/en/article/Chargeback-FAQ), read 2026-08-02). So the second half is no. Toast also warns that the networks "may charge up to $500" for contesting a dispute they treat as near-indisputable. That means Visa 10.1 and 10.2, Mastercard 4870 and 4871. For reference, from vendors that publish, all verified 2 August 2026: | Processor | Cost of a chargeback | |-----------|---------------------| | [Helcim](/docs/payments/processors/helcim) | $0 if you win, $15 if you lose | | **Toast** | **$15, charged win or lose** | | [Square](/docs/payments/processors/square) | **$0**, stated outright | | [Braintree](/docs/payments/processors/braintree) | $15 | | [Stripe](/docs/payments/processors/stripe) | $15 to receive, plus $15 to counter | | [PayPal](/docs/payments/processors/paypal) | $15 on wallet disputes ($0 if you win), $20 on card chargebacks, $30 above a 1.5% ratio | --- ## What Toast Does Well ### 1. Restaurant-Specific Everything Toast was built from the ground up for food service: - **Table management** with section assignments and waitlist - **Menu management** with modifiers, combos and time-based pricing - **Kitchen display screens** that route tickets to the right station - **Tip management** with pooling, credit card tip tracking and reporting - **Split checks** by seat, by item, or by custom amount No general-purpose POS matches this depth. For a full-service restaurant the operational value is real. It just won't show up in a rate comparison. ### 2. Online Ordering Built In Toast Online Ordering plugs straight into the POS. Orders hit the kitchen display, the menu syncs itself, delivery runs in the same system. Toast doesn't charge the 15 to 30% commission the third-party delivery marketplaces take. On real takeaway volume, that dwarfs every processing number on this page. One boundary. List on third-party delivery apps and route those orders through Toast, and you still pay those platforms. Toast centralises the orders. It doesn't remove the commission. ### 3. Payroll and Team Management Scheduling, clock-in from the terminal, payroll with tip calculations, break and overtime compliance, onboarding. These are paid add-ons, not included. Get the prices. ### 4. Restaurant Reporting Sales by daypart, menu item performance, food cost tracking, labour cost as a percentage of sales, server performance, product mix. Built around the metrics a restaurant operator actually manages to. --- ## What Toast Does Poorly ### 1. Half the Price Is Published, and It's the Easier Half Toast publishes two percentages and three plan prices. No fixed per-transaction fee. No card-not-present rate. No hardware price, no early termination fee. So you can start the conversation with real numbers. You still can't finish it without a quote. The chargeback fee is the exception. Toast's support site states **$15 per chargeback notification**, "charged regardless of whether you dispute the chargeback, and regardless of whether you win or lose" ([Toast](https://support.toasttab.com/en/article/Chargeback-FAQ), read 2026-08-02). The percentages are also where a salesperson has least room to move. The unpublished lines are where two restaurants' deals actually differ. Hardware, modules, term. ### 2. Payments Lock-In Toast hardware only works with Toast processing. Leave and the terminals are e-waste. Stay and you can't move payments to a cheaper processor without replacing the POS. Same structural problem as [Clover](/docs/payments/processors/clover), with dearer hardware. It's why the contract terms matter more than the rate. ### 3. Contract Commitment Toast contracts carry a term, an early termination fee and usually auto-renewal. The specifics aren't published and vary by deal. Read yours. Don't trust a number from an article, this one included. ### 4. Not for Non-Restaurants No retail features, no general service business features, no e-commerce beyond food ordering. If your business changes shape, you're changing processors and POS at the same time. --- ## Toast vs Square vs Clover: Restaurant Comparison All three publish card-present rates now. That makes this table worth reading. | Factor | Toast | [Square](/docs/payments/processors/square) for Restaurants | [Clover](/docs/payments/processors/clover) direct | |--------|-------|----------------------|--------| | **Card-present rate** | **2.49%** Traditional, **3.09%** Pay-as-you-Go V. Fixed component reported at 15c R | 2.6% + $0.15 Free, 2.5% + $0.15 Plus, 2.4% + $0.15 Premium | **2.3% + 10c** restaurant and QSR | | **Online / keyed rate** | 3.50% + 15c R, NerdWallet only. Toast publishes none | 3.3% + $0.30 Free, 2.9% + $0.30 Plus and Premium | **3.5% + 10c** | | **Monthly software** | **$0** Starter Kit, **$69** POS restaurant | $0 Free, $49 Plus, $149 Premium, per location | $0 Starter to $129.85 Restaurant Growth | | **Chargeback fee** | **$15**, win or lose | No per-dispute fee published | **Not published** | | **Is the published rate your rate?** | Yes for the percentage, unknown for the cents | Yes | Only via Clover Direct | | **Online ordering** | Built in, commission-free | Square Online, basic | Via third-party apps | | **Kitchen display** | Native | Third-party | Third-party | | **Tableside ordering** | Toast handheld | Square Terminal | Clover Flex | | **Payroll** | Built in, $9 per employee/mo | Square Payroll, add-on | Third-party | | **Contract** | 12 to 36 months per Toast's own 10-K | Month to month | 3 years on hardware promotions, auto-renewing | | **Hardware lock-in** | Yes, and expensive | Minimal. Cheap readers | Yes | | **Best for** | Full-service restaurants | Cafes, small restaurants, food trucks | Restaurants that also do retail | Square figures verified 2 August 2026 at [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees) and [squareup.com/us/en/pricing](https://squareup.com/us/en/pricing). Clover figures from [clover.com/pricing](https://www.clover.com/pricing). **Bottom line, on published card-present rates:** - **Clover Direct is the cheapest of the three on rate**, at 2.3% + 10c for a restaurant. Cheaper than Toast Traditional on the percentage. Cheaper than Square on both components. - **Toast Traditional at 2.49% is second.** It beats Square's Free plan on both components, once you accept the reported 15 cents. Toast Pay-as-you-Go at 3.09% is the dearest card-present rate of the three. That's the price of free hardware. - **Square is the most expensive on rate and the cheapest to leave.** No contract, cheap hardware, published plan prices, and no notice window to diarise. The rate isn't the whole decision. For a full-service restaurant it usually isn't even the main one. Toast earns its premium when the restaurant software actually gets used. Kitchen displays, tableside, commission-free online ordering, tip pooling. Use half of it and you're paying for a platform to run a simpler operation. **How to make this concrete:** get the Toast quote. Compute its total monthly cost. Compare it to Square's and Clover Direct's published rates on your own volume. Neither costs anything to model. If Toast doesn't beat them by enough to justify the term and the payments lock-in, the answer is one of the other two. --- ## Who Toast Is Best For ### Perfect Fit | Business Type | Why Toast Wins | |---------------|---------------| | **Full-service restaurants** | Table management, kitchen displays, and tableside are built for exactly this | | **Multi-location restaurants** | Centralised management, menu syncing across locations | | **Fast-casual with real takeaway volume** | Commission-free online ordering can save more than any processing difference | | **Bars and breweries** | Tab management, pre-auth, tip workflows | | **Catering** | Event ordering, invoicing, large-party management | ### Poor Fit | Business Type | Better Alternative | |---------------|--------------------| | **Retail** | [Square](/docs/payments/processors/square) or [Clover](/docs/payments/processors/clover) | | **Online-only food** | [Stripe](/docs/payments/processors/stripe) plus an ordering platform | | **Simple cafes** | Square. Cheaper, no contract, published rates | | **Solo food trucks** | Square. Free reader, no monthly fee | | **Anyone who needs a price today** | Square, [Helcim](/docs/payments/processors/helcim), or [Stax](/docs/payments/processors/stax) | --- ## Common Gotchas ### 1. The Free Hardware Offer, Now With the Actual Number "$0 upfront" hardware gets paid for somewhere. On Toast's published card, it's paid for with **0.60 points of processing rate**: 3.09% on Pay-as-you-Go against 2.49% on Traditional. Good trade below roughly **$25,300 a month** in card volume. Bad one above it. That uses $69 of software plus an illustrative $2,000 of hardware over 24 months. Toast's own page says as much, describing Traditional as "for those who expect to process higher volumes." Pay-as-you-Go has one genuine advantage, and Toast states it plainly. *"it's not a lease; you own the hardware from day one."* That's the opposite of Clover's subscription model, where you own nothing at term end. **Ask for both quotes side by side. Put your own hardware price into the breakeven above.** Hardware moves the answer most. It's also the line Toast doesn't publish. ### 2. Payments Are Not Renegotiable You can't move payments without replacing the POS. So the rate you sign is fixed for the life of the hardware. Negotiate it like you'll never get another chance. You may not. ### 3. Third-Party Delivery Commissions Still Apply Toast Online Ordering is commission-free. Orders arriving from DoorDash, Uber Eats or Grubhub still carry those platforms' commissions. Toast centralises them into your POS. Useful. The commission is still theirs. ### 4. Add-Ons Accumulate Payroll, marketing, loyalty and scheduling are usually separate charges. Get the full list with prices. Decide what you'd use before you sign for all of it. --- ## Test to Run **Toast quote evaluation, before committing:** **Step 1: Collect your own numbers** 1. Monthly card volume and monthly transaction count 2. Split by dine-in, takeaway and online 3. Current processing cost, if you have one **Step 2: Get the quote, complete** 4. Request a written quote covering: blended effective rate at your volume, software cost per terminal with modules itemised, hardware purchase price and financed total, contract length, early termination fee and how it's calculated, confirmation that the chargeback fee is the published $15, and whether payments are locked to Toast 5. Request the free-hardware version and the buy-outright version as separate quotes **Step 3: Build total monthly cost** ``` Processing: (volume x blended rate) + (count x per-txn fee) Software: plan cost x terminals + add-on modules Hardware: purchase price / contract months, or the financed payment Total monthly: _______ Total over term: total monthly x contract months ``` **Step 4: Benchmark against something published** ``` Square Free, card-present: (volume x 2.6%) + (count x $0.15) + $0 software Square Plus, card-present: (volume x 2.5%) + (count x $0.15) + subscription ``` **Step 5: Price the software you'd actually use** 6. List the Toast features you'd genuinely use weekly: kitchen displays, tableside, online ordering, tip pooling, payroll 7. The gap between the Toast total and the Square total is what you're paying for that list. Worth it? **Step 6: Price the exit** 8. What does leaving cost in year two? Early termination fee plus stranded hardware 9. That number is the real cost of being wrong **Success criteria:** you know Toast's total cost over the full term. You know what Square would cost. And you can name the restaurant features that justify the difference. --- ## Where This Breaks 1. **The fixed cents component is reported, not published.** Every breakeven here uses percentages Toast publishes. Add the reported 15 cents and you're mixing tiers. That's fine as long as you know you're doing it. On a $25 check, 15 cents is 0.6 points. That's the entire gap between Toast's two plans. 2. **Bundling hides where the money goes.** Hardware, software and payments move between line items. Only the total is trustworthy. Hardware is the line Toast doesn't publish. 3. **Payments lock-in removes your future leverage.** Normally a bad processing rate gets renegotiated at renewal. Here it may not move at all. Toast is a payment facilitator and the payments are tied to the POS. 4. **Stranded hardware makes leaving expensive**, on Traditional. On Pay-as-you-Go you own the hardware from day one. That's Toast's own wording and a real difference. 5. **The 2.58% blended take rate is a blend.** It's an upper bound across 164,000 restaurants. Useful for catching a bad quote, useless for predicting a good one. 6. **The ETF amount is genuinely unknown.** Toast publishes no early termination fee, no credible third party quotes one, and the merchant agreement that would settle it isn't openly readable. Ask for it in writing before you sign. --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [pos.toasttab.com/shop/starter-kits](https://pos.toasttab.com/shop/starter-kits) and [/shop/pricing-plan](https://pos.toasttab.com/shop/pricing-plan) | The 3.09% and 2.49% processing rates, restated in the same pages' FAQ, plus the "you own the hardware from day one" statement | Vendor pages | Accessed 2026-08-02 | | [pos.toasttab.com/pricing](https://pos.toasttab.com/pricing) | Software plan prices and the single-location and first-terminal footnotes. Page stamped "last updated July 8, 2026" | Vendor page. The processing percentages are on the shop pages, not here | Accessed 2026-08-02 | | [Toast Chargeback FAQ](https://support.toasttab.com/en/article/Chargeback-FAQ) | The $15 per chargeback notification fee, charged win or lose, and the up-to-$500 network warning | Vendor support site | Accessed 2026-08-02 | | [Toast FY2025 Form 10-K](https://www.sec.gov/Archives/edgar/data/1650164/000165016426000057/tost-20251231.htm) | GPV, fintech revenue and cost, location count, and the 12-to-36 month contract range | Regulatory filing | Filed 2026-02-18 | | [NerdWallet, Toast POS review](https://www.nerdwallet.com/business/software/reviews/toast-pos) | The reported $0.15 fixed component, the 3.50% card-not-present rate, and the two-year starter kit term | Personal finance publisher that earns partner referral revenue | 2026-01-13 | | [Merchant Maverick, Toast POS review](https://www.merchantmaverick.com/reviews/toast-pos-review/) | Reported two-to-three year contracts and mid-contract rate increases | Review site; discloses that it earns referral fees | Updated 2026 | | [Restaurantify](https://restaurantify.com/toast-pos-pricing-explained/) and [CheckThat](https://checkthat.ai/brands/toast/pricing) | Corroboration of the $0.15 fixed component only | SEO content site and aggregator, neither with a stated methodology | 2026-06-24 and 2026-03-30 | --- ## Next Steps **Considering Toast?** 1. Work through [what to ask for](#what-to-ask-for-in-writing) and get every answer in writing 2. Ask whether payments are contractually locked. That one answer shapes everything else 3. Get both hardware quotes, free and outright, and compare over the full term 4. Benchmark against [Square's published rates](/docs/payments/processors/square) 5. Ask about the early termination fee before you sign, not after **Already on Toast?** 1. Work out your effective rate: total fees divided by total volume, across three months 2. Compare it to your contract. Do they match? 3. Audit your add-on charges. Paying for modules nobody uses? 4. Find your renewal date and your notice period. Calendar both 5. Renewal is your only real leverage. Prepare months ahead with a competing quote in hand --- ## See Also - [Square](/docs/payments/processors/square) - The published-price benchmark, and the better fit for simpler restaurants - [Clover](/docs/payments/processors/clover) - Multi-purpose POS with the same quote-only problem - [Helcim](/docs/payments/processors/helcim) - Published interchange-plus, useful for modelling what processing alone should cost - [Processor Comparison](/docs/payments/processor-comparison) - Full comparison table - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Choosing hardware --- ## Authorization Windows Reference Source: https://paymentsandrisk.com/docs/payments/reference/auth-windows # Authorization Windows Reference :::info[TL;DR] - Visa gives you 10 calendar days card-not-present and 5 card-present. Mastercard gives 7 for a final authorization and 30 for a flagged preauthorization. Amex gives 7. Every number here is calendar days. - Only Visa splits by channel. It goes the way most people don't expect: CNP gets the longer window, not the shorter one. Mastercard and Amex don't split at all. - Incremental authorizations extend your protection on Mastercard. On Visa they do nothing. The only route to 30 days on Visa is the right indicator on the original authorization, plus an eligible MCC. - Capture against an expired authorization and you're exposed. Mastercard treats the approved amount as zero, so you get an authorization chargeback, not a soft one. ::: An authorization window is how long you've got to capture after approval. Miss it and you have to re-authorize. That might fail. Three networks, three different structures. Visa splits by channel. Mastercard splits by authorization type. Amex doesn't split at all. Read the section for the network you're on, not the one next to it. :::note[Count in calendar days, always] Every figure on this page is calendar days, not business days. Visa and Mastercard count from the authorization approval date, not the transaction date. Weekends and holidays sit inside the window. Nothing here counts business days, so the usual off-by-two trap doesn't apply. ::: --- ## Visa Authorization Windows Visa used to run two clocks. How long the authorization stayed valid, and when you had to clear by. On 13 April 2024 it merged them into one authorization-to-clearing timeframe. So "how long is my auth good for" and "when do I have to clear by" are now the same question. | Transaction Type | Window | Notes | |------|--------|-------| | Card-not-present, cardholder-initiated | 10 calendar days | Most e-commerce | | Card-present | 5 calendar days | In-store, terminal | | Merchant-initiated | 5 calendar days | Recurring, installment, advance payment, unscheduled credential-on-file. Effective 13 April 2024 | | CNP with the extended authorization indicator | 30 calendar days | Not [MCC](/docs/reference/mcc-codes)-restricted | | Cruise, lodging, vehicle rental with the estimated authorization indicator | 30 calendar days | MCC-restricted | | Other rental MCCs with the estimated authorization indicator | 10 calendar days | See the list below | | Automated Fuel Dispenser preauthorization | 2 hours | Completion message or reversal | *Source: Visa Core Rules and Visa Product and Service Rules, 18 October 2025, section 5.7.3.5, Table 5-11.* Visa is the only network with a different card-present number. Watch the direction. Card-not-present gets 10 days, card-present gets 5. That's the opposite of what most merchants assume. Fuel is hours, not days. An AFD preauthorization needs a completion message or a reversal. Within 2 hours of the approval response. ### Extended Windows (Special Categories) The long windows need an indicator in the authorization message. Two different indicators, two different rules: - **Extended authorization indicator**, card-not-present: 30 calendar days, no MCC restriction - **Estimated authorization indicator** plus an eligible MCC: 30 calendar days for cruise lines, lodging and vehicle rental Not all rentals are equal. These [merchant categories](/docs/reference/mcc-codes) get **10 calendar days** with the estimated authorization indicator, not 30: - Aircraft rental - Bicycle and e-scooter rental - Boat rental - Clothing and costume rental - DVD and video rental - Equipment and tool rental - Furniture rental - Motor home rental - Motorcycle rental - Trailer parks and campgrounds :::warning[Being a hotel isn't enough] The 30-day window depends on the indicator being in the message. Not on what business you're in. If your [processor](/docs/operations/processor-management) isn't sending the flag, you've got 10 days on Visa and 7 on Mastercard. Your MCC doesn't matter. That's the most common way a merchant thinks they have 30 days and actually has 7. ::: ### Incremental Authorization Does Nothing on Visa Visa says it flatly: "An Incremental Authorization Request does not extend the processing timeframes." No exceptions listed. The clock runs from the original approval. Nothing you send afterward moves it. Mastercard says the opposite, below. So a 21-day car rental is protected on Mastercard, as long as the operator keeps sending incremental preauths. The identical rental on a Visa card is unprotected from day 6. Unless the original authorization carried the estimated authorization indicator, and you're in an eligible MCC. Nobody selling hotel or rental software will tell you this. The whole point of the feature is that it sounds network-agnostic. The tactic and the indicator are different things. Only the indicator works on Visa. ### Country Overrides Visa's Table 5-12 carries country-specific overrides. India, Japan, Malaysia, Nepal and Argentina. We're not printing those numbers, because we haven't verified the pairings to our own standard. Process in those markets? Get the current table from your acquirer. --- ## Mastercard Authorization Windows Mastercard splits by authorization type, not by channel. There's no card-present versus card-not-present table here. Mastercard doesn't write one. A final authorization gets 7 calendar days, at a terminal or in a browser. Mastercard also still runs two clocks. A presentment deadline, and a separate message reason code 4808 chargeback protection period. They carry identical numbers today, which is why they get conflated. They're different rules. They can diverge. | Authorization Type | Window | |------------------|--------| | Preauthorization (flagged as such) | 30 calendar days | | Final authorization | 7 calendar days | | Final authorization, India domestic | 4 calendar days | | Deferred authorization (offline chip-approved) | 7 calendar days | | Undefined authorization | 7 calendar days | | Refund transactions | 5 calendar days | *Source: Mastercard Transaction Processing Rules, 9 December 2025, sections 2.5.1, 2.6, 2.7 and 2.8. The clock starts on the authorization approval date, not the transaction date. India's 4 days took effect 3 April 2024. The 5-day refund protection period took effect 12 April 2024. Costa Rica final authorizations get 30 calendar days for presentment.* :::tip[Important Distinction] Mastercard separates a "preauthorization," flagged as such, from a regular "final authorization." The preauth gets the longer window. Make sure your [processor](/docs/operations/processor-management) is sending the right indicator. ::: ### Incremental Authorization Does Work on Mastercard Section 2.9 exists for exactly this. Submit an additional preauthorization request for the same transaction. That extends the 4808 protection period on an approved preauthorization. A zero-amount one extends the clock without changing the authorized amount. A non-zero one extends the clock and raises the amount. That's the opposite of Visa. Visa ignores incremental requests entirely. ### An Expired Mastercard Auth Is No Auth Section 2.8: the approved amount of any authorization with an expired 4808 protection period "is deemed to be zero." Capture on day 8 against a 7-day final authorization. Mastercard treats you as having never authorized. That's why the chargeback is [4808 Authorization-related](/docs/reference/reason-codes/mastercard/authorization), not something softer. ### Europe Contactless Europe intraregional contactless carries one more rule. Clearing within 2 calendar days of the transaction date. --- ## American Express Authorization Windows One number, no channel split. | Type | Window | |------|--------| | Standard transactions | 7 calendar days | | Lodging, cruise lines, vehicle rentals on estimated charge amounts | Valid for the life of the stay or rental agreement | *Source: American Express Merchant Reference Guide - U.S., section 5.4 "Authorization Time Limit." Amex measures all of its timeframes in calendar days.* An authorization approval is valid for 7 days. That same 7 days is the submission window. The travel exception isn't a fixed number of days. The authorization holds for the length of the stay or the rental agreement. Expresspay at transit access terminals is handled separately. --- ## Discover: Nobody Can Tell You Discover doesn't publish a current edition of its Merchant Operating Regulations. The last public full edition is Release 11.1, from 2011. It set 30 calendar days of authorization validity and 10 days to submit sales data. Those figures are more than a decade old. Processors enforce much shorter windows in practice. A widely repeated "90 days" figure traces only to third-party aggregators, not to Discover. Three incompatible numbers, and no current primary source. So we're not printing one. Get your Discover window from your acquirer in writing. --- ## Wallets Are Not Card Networks PayPal, and wallets generally, set their own authorization windows. Those aren't network rules. They don't belong in the tables above. **PayPal's numbers aren't stated here, because the public sources disagree with each other.** Circulating figures run from a 3-day honor period with roughly 29 days of validity, to a 10-day hold that auto-extends once. Check PayPal's current developer documentation, or read the value your API returns. Don't plan capacity against a number you found on a reference page. Including this one. --- ## Chargeback Protection Periods These windows drive your [chargeback defense](/docs/chargebacks/representment). ### Mastercard Chargeback Protection This is the message reason code 4808 protection period. It's a separate rule from the presentment deadline above. Same numbers today. Different rule. | Authorization Type | Protection Period | |-------------------|-------------------| | Preauthorizations | 30 calendar days | | Final authorizations | 7 calendar days (4 days India domestic, effective 3 April 2024) | | Deferred authorizations | 7 calendar days | | Undefined authorizations | 7 calendar days | | Refund transactions | 5 calendar days (effective 12 April 2024) | *Source: Mastercard Transaction Processing Rules, 9 December 2025, section 2.8.* **"Statused" accounts.** The issuer flags an account negatively: closed, fraud investigation, severely delinquent, lost or stolen. If you captured after the protection period expired, the issuer can [charge back](/docs/chargebacks) the transaction. :::warning[Critical Rule] Captured **within** the protection period? You're generally safe, even if the account gets statused afterward. Captured **late**? You're exposed to [reason code](/docs/reference/reason-codes) disputes. ::: ### Visa Late Presentment [Visa Dispute Condition 11.3](/docs/reference/reason-codes/visa/11-3-no-authorization) covers: - Valid authorization required but not obtained - Valid authorization obtained but transaction not processed within required timeframe This has a 75-day dispute window from transaction processing date. Visa retired [Condition 12.1 Late Presentment](/docs/reference/reason-codes/visa/12-1-late-presentment) on 12 April 2024 and folded it into 11.3. Reading anything that treats late presentment as its own dispute condition? It predates the change. ### Amex Authorization Disputes American Express allows chargebacks when: - Authorization was declined, reversed, or partially reversed but merchant submitted anyway - Initial authorization is more than 7 days before clearing date (unless qualified for estimated charges) - Merchant failed to follow authorization requirements --- ## What Happens If You Miss the Window 1. The hold on customer's funds releases 2. You can't capture against that authorization 3. You must request a new authorization 4. New auth might be declined (insufficient funds, card lost, etc.) 5. **If you capture anyway against expired auth, you're exposed to chargebacks** --- ## Quick Reference Table All calendar days, counted from the authorization approval date. | Network | Transaction Type | Window | |---------|-----------------|--------| | Visa | Card-not-present, cardholder-initiated | 10 calendar days | | Visa | Card-present | 5 calendar days | | Visa | Merchant-initiated (any channel) | 5 calendar days | | Visa | CNP with extended authorization indicator | 30 calendar days | | Visa | Cruise, lodging, vehicle rental with estimated authorization indicator | 30 calendar days | | Visa | Other rental MCCs with estimated authorization indicator | 10 calendar days | | Visa | Automated Fuel Dispenser preauthorization | 2 hours | | Mastercard | Final authorization (any channel) | 7 calendar days | | Mastercard | Preauthorization | 30 calendar days | | Mastercard | Deferred authorization (offline chip) | 7 calendar days | | Mastercard | Undefined authorization | 7 calendar days | | Mastercard | Final authorization, India domestic | 4 calendar days | | Mastercard | Refunds | 5 calendar days | | Amex | Standard (any channel) | 7 calendar days | | Amex | Lodging, rental, cruise on estimated charges | Life of the stay or rental agreement | | Discover | Any | Not published; get it from your acquirer | *Sources: Visa Core Rules 18 October 2025 section 5.7.3.5 Table 5-11; Mastercard Transaction Processing Rules 9 December 2025 sections 2.5.1 to 2.9; American Express Merchant Reference Guide - U.S. section 5.4.* Your processor may enforce a shorter window than any of these. Stripe caps Visa at 4 days and 18 hours where Visa allows 5. It caps card-present Mastercard, Amex and Discover at 2 days where the networks allow 7. That's a clearing buffer, not a network rule. Need day 6 on a card-present Mastercard? You're asking your processor to change a setting, not asking the network for an exception. --- ## Next Steps **Checking auth windows?** 1. [Use quick reference table](#quick-reference-table) - All networks at a glance 2. [Check Visa specifics](#visa-authorization-windows) - 10 days CNP, 5 card-present, 30 with the indicator 3. [Check Mastercard specifics](#mastercard-authorization-windows) - 7 days final, 30 days preauth **Avoiding late capture issues?** 1. [Know what happens if you miss](#what-happens-if-you-miss-the-window) - Re-auth required 2. [Understand chargeback exposure](#chargeback-protection-periods) - Late = liability 3. [Track auth dates](#visa-late-presentment) - Capture within window **Qualifying for extended windows?** 1. [Check extended categories](#extended-windows-special-categories) - Hotels, rentals, cruise 2. [Use correct indicators](#visa-authorization-windows) - Must flag in request 3. [Verify preauth flags](#mastercard-authorization-windows) - Preauth vs final --- ## See Also - [Authorization and Capture](/docs/payments/auth-and-capture) - Core concepts - [Capture Operations](/docs/payments/reference/capture-operations) - Holds, voids, partial captures - [Decline Codes](/docs/reference/decline-codes) - When captures fail - [Chargeback Reason Codes](/docs/reference/reason-codes) - Dispute categories --- ## Authorization Basics Source: https://paymentsandrisk.com/docs/payments/reference/authorization-basics # Authorization Basics (Operator Field Manual) :::info[TL;DR] - Authorization is permission to charge, not the charge itself. Capture inside the auth window or the funds release back to the cardholder. That's a lost sale, not a delay - [Issuers](/docs/payments/payment-ecosystem) approve or decline based on fraud score, available credit, and velocity rules - you don't see the reason on a hard decline, only the response code - Partial approvals (issuer approves less than the requested amount) are real: your integration must handle them or risk chargebacks and compliance issues - Increment authorizations (hotel, rental car) let you add to an existing auth without starting over. If your amount moves, that's what you want ::: Every [card transaction](/docs/payments/payment-methods/cards) starts with authorization. Get it wrong and you lose the sale or you eat the chargeback. What follows is the request/response cycle, what the codes mean, and the edge cases you'll hit. It's the foundation for everything else. _Last verified: Dec 2025. Response codes and rules evolve; confirm with your processor._ ## What Matters (5 bullets) - **Authorization is permission, not payment.** Auth reserves funds; settlement moves money. - **Always authorize before capture.** Processing without auth = automatic chargeback liability. - **Response codes tell you why it failed.** Soft vs hard declines need different handling. - **Authorizations expire.** Protection periods vary by transaction type; clear within window. - **Match auth amount to capture amount.** Tolerance limits exist, but exceeding them creates disputes. --- ## How Authorization Works ### The Authorization Flow ```mermaid sequenceDiagram participant C as Customer participant M as Merchant participant A as Acquirer participant N as Card Network participant I as Issuer C->>M: Enters card details M->>A: Auth request A->>N: Routes request N->>I: Routes to issuer Note over I: Checks: funds, fraud,velocity, account status I->>N: Response (approve/decline) N->>A: Routes response A->>M: Auth response M->>C: Transaction result ``` **Time elapsed:** 1-3 seconds typically ### What's in an Auth Request | Field | Purpose | |-------|---------| | Card number (PAN) | Identifies account | | Expiration | Validates card currency | | CVV | Proves card possession (CNP) | | Amount | Funds to reserve | | Currency | Which currency | | MCC | Merchant category | | AVS data | Address verification | | 3DS data | Authentication results | ### What's in an Auth Response | Field | Meaning | |-------|---------| | Response code | Approve, decline, or refer | | Authorization code | Approval reference (if approved) | | AVS result | Address match result | | CVV result | CVV match result | | Network transaction ID | For tracking | --- ## Authorization vs Capture vs Settlement | Stage | What Happens | When | |-------|--------------|------| | **Authorization** | Issuer reserves funds | At checkout | | **Capture** | Merchant claims the auth | At fulfillment | | **Settlement** | Money moves | Batch processing (daily) | ### Pre-Authorization vs Final Authorization | Type | Use Case | Protection Period | |------|----------|-------------------| | **Pre-auth** | Estimate before final (hotels, car rental) | 30 calendar days (Mastercard), but only if the message is flagged as a preauthorization | | **Final auth** | Exact amount known | 7 calendar days (Mastercard, Amex) | | **Incremental auth** | Adding to existing (hospitality) | Extends the clock on Mastercard, extends nothing on Visa | Visa has its own 30-day route and it works differently. It needs the estimated authorization indicator plus an eligible MCC (cruise, lodging or vehicle rental) on the original authorization. Sending incremental requests afterward doesn't do anything. If you didn't flag it on the original auth, you don't have the 30 days. --- ## Response Codes ### Common Approval Codes | Code | Meaning | |------|---------| | 00 | Approved | | 10 | Partial approval (debit) | | 85 | No reason to decline (card verification) | ### Soft Declines (Retry May Work) | Code | Meaning | Action | |------|---------|--------| | 05 | Do not honor | Retry later or different card | | 51 | Insufficient funds | Retry later | | 61 | Exceeds withdrawal limit | Retry smaller amount | | 65 | Exceeds frequency limit | Retry later | | N7 | CVV mismatch | Ask customer to re-enter | ### Hard Declines (Don't Retry) | Code | Meaning | Action | |------|---------|--------| | 04 | Pick up card | Do not process | | 07 | Pick up card (fraud) | Do not process | | 14 | Invalid card number | Check entry | | 41 | Lost card | Do not process | | 43 | Stolen card | Do not process | | 54 | Expired card | Request valid card | | 57 | Transaction not permitted | Different payment needed | ### Referrals | Code | Meaning | Action | |------|---------|--------| | 01 | Refer to issuer | Voice authorization available | | 02 | Refer to issuer (special) | Voice authorization available | --- ## Authorization Protection Periods Authorizations expire. Clear transactions within the protection window or risk chargebacks. Every figure below is calendar days, counted from the authorization approval date. ### Visa Since 13 April 2024 Visa runs one clock. Authorization validity and the clearing deadline are the same number. | Transaction Type | Protection Period | |------------------|-------------------| | Card-not-present, cardholder-initiated | 10 calendar days | | Card-present | 5 calendar days | | Merchant-initiated (any channel) | 5 calendar days | | Hotels, car rental, cruise lines with the estimated authorization indicator | 30 calendar days | ### Mastercard Mastercard splits by authorization type, not by channel. | Transaction Type | Protection Period | |------------------|-------------------| | Final authorization | 7 calendar days | | Pre-authorization | 30 calendar days | | Final authorization, India domestic | 4 calendar days | | Refunds | 5 calendar days | ### Amex Seven calendar days, any channel. Lodging, cruise and vehicle rental on estimated charge amounts stay valid for the life of the stay or rental agreement, so those don't expire on you. *Sources: Visa Core Rules 18 October 2025, section 5.7.3.5, Table 5-11; Mastercard Transaction Processing Rules 9 December 2025, sections 2.5.1 to 2.8; American Express Merchant Reference Guide - U.S., section 5.4. Full detail in [Authorization Windows Reference](/docs/payments/reference/auth-windows).* ### Best Practice - Capture as close to auth as possible - Set alerts before protection expires - Re-authorize if you'll exceed the window --- ## Amount Tolerance The capture amount can differ from auth amount within limits. ### Visa Tolerances | Transaction Type | Tolerance | |------------------|-----------| | Standard retail | 0% | | US restaurants | 20% (for tips) | | Hotels | 15% | | Car rental | 15% | ### Mastercard Tolerances | Transaction Type | Tolerance | |------------------|-----------| | Chip + PIN | 0% | | Contactless | 0% | | US card-present | 30% | | US CNP (restaurants) | 30% | | Other card-present | 20% | ### Currency Conversion 10% tolerance for FX rate differences between auth and clearing. --- ## Common Authorization Issues ### No Authorization Obtained **Problem:** Transaction processed without auth **Result:** Automatic chargeback liability (11.3, 4808) **Prevention:** Always require online auth; no offline processing ### Declined But Processed **Problem:** Auth declined, transaction still processed **Result:** Automatic chargeback liability (11.2) **Prevention:** Never override declines; no "force" without real approval ### Authorization Expired **Problem:** Too long between auth and capture **Result:** Chargeback (Visa 11.3 - authorization no longer valid) **Prevention:** Track auth dates; capture within window ### Amount Exceeded Tolerance **Problem:** Captured more than allowed variance **Result:** Chargeback for overage **Prevention:** Know tolerance by transaction type; re-auth if needed --- ## Voice Authorization When to use voice authorization: 1. System timeout with customer present 2. Referral response (01, 02) 3. POS failure with customer waiting ### Voice Auth Process 1. Call acquirer's voice auth center 2. Provide card details verbally 3. Receive approval code 4. Enter approval code in terminal 5. Document the call ### Voice Auth Risks - Fraudsters can obtain voice auths on stolen cards - No CVV/AVS protection - Higher scrutiny in disputes - Document everything --- ## Authorization Best Practices ### Always Do 1. **Get real-time authorization** - Never process without auth 2. **Match amounts** - Auth and capture should align 3. **Capture promptly** - Don't let auths expire 4. **Handle declines gracefully** - Good UX for soft declines 5. **Log everything** - Auth code, timestamp, response ### Never Do 1. **Force transactions** - Don't override declines 2. **Process offline** - Unless absolutely necessary with proper procedures 3. **Exceed tolerances** - Re-auth if amount increases 4. **Ignore response codes** - Each code means something 5. **Delay capture** - Risk expiration and chargebacks --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Basic auth handling; never override declines; capture same-day | | **$100k-$1M/mo** | Track auth expiration; implement retry logic for soft declines; monitor response code distribution | | **Over $1M/mo** | Issuer-level auth analysis; optimize retry timing; network tokenization for recurring | --- ## Where This Breaks - **Offline terminals** - No real-time auth check; creates liability - **Staff override culture** - "Just run it through" = chargebacks - **Long fulfillment** - Auth expires before shipping - **Manual processes** - Voice auth without documentation - **Amount changes** - Final differs from estimate without re-auth --- ## Next Steps **Understanding authorization?** 1. [Learn the flow](#how-authorization-works) - Request to response 2. [Know auth vs capture vs settlement](#authorization-vs-capture-vs-settlement) - Each stage 3. [Understand protection periods](#authorization-protection-periods) - 5 to 30 calendar days by type **Handling declines?** 1. [Check soft vs hard](#response-codes) - Retry vs don't retry 2. [Use appropriate retry logic](#soft-declines-retry-may-work) - When to try again 3. [Handle referrals](#referrals) - Voice auth when needed **Avoiding authorization issues?** 1. [Follow best practices](#authorization-best-practices) - Always do, never do 2. [Know common issues](#common-authorization-issues) - Expired, exceeded, declined 3. [Capture within tolerance](#amount-tolerance) - Know the limits --- ## Related - [Auth Optimization](/docs/payments/auth-optimization) - [Decline Codes](/docs/reference/decline-codes) - [Settlement & Reconciliation](/docs/payments/settlement) - [Processor Reporting Checklist](/docs/reference/processor-reporting-checklist) --- ## B2B and Commercial Card Processing Source: https://paymentsandrisk.com/docs/payments/reference/b2b-commercial # B2B and Commercial Card Processing :::info[TL;DR] - **The number is 0.75 points**, on a small-business credit card, and it's published. Mastercard's Data Rate I is 2.65% + $0.10 and Data Rate II is 1.90% + $0.10. Visa's Business Product 1 and Product 2 carry the identical pair - That 0.75 holds at every card tier. 2.80 to 2.05, 2.85 to 2.10, 2.95 to 2.20, 3.00 to 2.25. Same gap each time - **A corporate or purchasing card is a different card and a different number.** Visa moves those from Commercial Card Not Present at 2.70% to Commercial Product 3 at 1.75%, so 0.95 points - **A commercial prepaid card saves you nothing.** Mastercard prices Data Rate I and Data Rate II at 2.65% each. It's the same rate for more work - Level 2/3 needs API integration or a processor that fills the fields for you. Hosted checkout usually can't ::: Submit the right data on a commercial card and the interchange drops. On a small-business credit card that's **0.75 percentage points**, and both networks publish it. Five different figures circulate for this: 0.3-0.5%, 0.5-0.8%, 0.2-0.3%, 0.3-0.8% and 0.3-1.0%. They come from vendor pages, not a rate card. What's below comes from the schedules themselves. If you sell to businesses or government, this page is money. ## What Are Commercial Cards? Commercial cards are payment cards issued to businesses, not consumers. They include: | Card Type | Issued To | Typical Use | |-----------|-----------|-------------| | **Corporate cards** | Employees | Travel, expenses | | **Purchasing cards (P-cards)** | Procurement teams | Supplies, equipment | | **Fleet cards** | Drivers | Fuel, vehicle expenses | | **Business cards** | Small business owners | Business expenses | ### Why Commercial Cards Matter - **Higher base interchange:** 2.5-2.9% vs 1.6-2.1% for consumer - **Qualification opportunity:** Level 2 drops a small business credit card from 2.65% to 1.90%, a published 0.75 points - **B2B concentration:** If you sell B2B, 30-60% may be commercial cards --- ## Level 2 and Level 3 Data The networks built data levels so B2B transactions could carry more detail. More data means lower interchange. There's no more to it than that. ### Level 1 (Standard) Basic transaction data everyone submits: - Card number - Expiration date - Transaction amount - Merchant name - MCC **Result:** Highest interchange rate ### Level 2 (Enhanced) Level 1 plus: - **Tax amount** - **Customer code / PO number** - **Merchant postal code** **Result: 0.75 points lower** on a small business credit card. Mastercard Data Rate I to Data Rate II, 2.65% to 1.90%. Visa Business Product 1 to Product 2, the same pair. ### Level 3 (Full Detail) Level 2 plus line-item detail: - **Item descriptions** - **Product codes** (commodity codes) - **Quantities** - **Unit prices** - **Freight/shipping amounts** - **Duty amounts** - **Destination postal code** **Result: 0.80 to 0.95 points lower than Level 1**, and only on a corporate or purchasing card. Neither network publishes a Level 3 rate for small business credit, so on those cards Level 2 is as far as it goes. There isn't another rung. --- ## Savings Calculation ### What the schedules actually say Small business credit, at the Core / Tier I card level: | Data level | Mastercard | Visa | Gap vs Level 1 | |---|---|---|---| | Level 1 | Data Rate I, 2.65% + $0.10 | Business Product 1, 2.65% + $0.10 | - | | Level 2 | Data Rate II, 1.90% + $0.10 | Business Product 2, 1.90% + $0.10 | **0.75 points** | | No qualifying data | Standard, 2.95% + $0.10 | Business Non-Qualified, 3.15% + $0.20 | You're paying more than Level 1 | Neither network publishes a Level 3 rate for small business credit. If you're chasing Level 3 it lives on the corporate and purchasing side, and you'll need the cardholder to be carrying one: | Card type | Level 1 rate | Best data rate | Gap | |---|---|---|---| | Visa Corporate / Purchasing | Commercial Card Not Present, 2.70% + $0.10 | Commercial Product 3, 1.75% + $0.10 | 0.95 points | | Mastercard Large Market Credit | Data Rate I, 2.70% + $0.10 | Data Rate III, 1.90% + $0.10 | 0.80 points | | Mastercard Commercial Debit | Data Rate I, 2.65% + $0.10 | Data Rate II, 2.10% + $0.10 | 0.55 points. No Level 3 rate exists | | Mastercard Commercial Prepaid | Data Rate I, 2.65% + $0.10 | Data Rate II, 2.65% + $0.10 | **Zero** | Sources: Visa, _Visa U.S.A. Interchange Reimbursement Fees_, 18 April 2026, sections E and G. Mastercard, _U.S. Region Interchange Programs and Rates_, commercial tables. Visa's 2026 schedule is the current one. The Mastercard commercial tables are read off the last edition retrievable in full, so treat the exact Mastercard cents as indicative and the structure as solid. ### Example: $500 commercial card transaction | Level | Interchange | Fee | Saving vs Level 1 | |-------|-------------|-----|---------------| | Level 1 | 2.65% + $0.10 | $13.35 | - | | Level 2 | 1.90% + $0.10 | $9.60 | $3.75 | That's a small business credit card, the common case. On a corporate or purchasing card with full Level 3, the same $500 goes from $13.60 to $8.85. ### Annual savings | Scenario | Calculation | Annual saving | |----------|-------------|----------------| | $500k B2B volume | $500k x 40% commercial x 0.75% | $1,500 | | $2M B2B volume | $2M x 40% commercial x 0.75% | $6,000 | | $10M B2B volume | $10M x 40% commercial x 0.75% | $30,000 | One rate, not a rising one. The old version of this table used 0.5%, then 0.6%, then 0.7% as volume grew. Neither schedule works that way. The gap is 0.75 points at every card tier, so it's your volume that scales, not the discount. **Check your card mix before you budget any of this.** The 40% commercial share above is an illustration, not your number. Pull a month of transactions and count how many were actually commercial cards. If they're mostly consumer credit, Level 2 does nothing for you at all. --- ## Network-Specific Requirements ### Visa Commercial | Data Level | Requirements | Rate Category | |------------|--------------|---------------| | **Level 2** | Tax, customer code | Commercial Level II | | **Level 3** | Full line item | Commercial Level III | Visa requires: - Tax indicator and amount - Customer code (up to 17 chars) - Line items for Level 3 ### Mastercard Commercial | Data Level | Requirements | Rate Category | |------------|--------------|---------------| | **Level 2** | Tax, customer code | Data Rate II | | **Level 3** | Full line item | Data Rate III | Mastercard requires: - Tax amount and indicator - PO number - Line item detail for Level 3 ### American Express Amex has less standardized Level 2/3 support: - Enhanced data options vary - Contact Amex directly for B2B optimization - OptBlue program may have different requirements --- ## Required Data Fields ### Level 2 Fields | Field | Description | Example | |-------|-------------|---------| | **Tax amount** | Total tax charged | $42.50 | | **Tax indicator** | Tax status | Taxable, Exempt, etc. | | **Customer code** | PO or reference number | PO-12345 | | **Merchant postal code** | Your zip code | 94105 | ### Level 3 Fields (Per Line Item) | Field | Description | Example | |-------|-------------|---------| | **Product code** | Commodity or SKU | 5111-00-000-0000 | | **Description** | Item description | Office Supplies | | **Quantity** | Number of units | 10 | | **Unit of measure** | EA, BOX, CS, etc. | EA | | **Unit price** | Price per unit | $5.00 | | **Extended amount** | Line total | $50.00 | | **Discount amount** | Line discount | $0.00 | ### Additional Level 3 Fields | Field | Description | |-------|-------------| | **Ship-from postal code** | Origin zip | | **Ship-to postal code** | Destination zip | | **Freight amount** | Shipping cost | | **Duty amount** | Import duties | | **Order date** | When ordered | --- ## Implementation Guide ### Step 1: Assess Opportunity Calculate your potential savings: ``` 1. Pull 90 days of card transactions 2. Identify commercial cards (BIN lookup or processor report) 3. Calculate commercial card % of total volume 4. Estimate savings: Commercial volume ร— 0.5% ``` If savings < $1,000/year, may not be worth implementation effort. ### Step 2: Check Processor Support Questions for your processor: 1. "Do you support Level 2/3 processing?" 2. "What fields do you require?" 3. "How do I submit Level 2/3 data?" 4. "Is there additional cost for Level 2/3?" Most modern processors support Level 2/3. Implementation varies. ### Step 3: Map Your Data | Required Field | Your System Field | Notes | |----------------|-------------------|-------| | Tax amount | `order.tax` | | | Customer code | `order.po_number` | May need to capture | | Product code | `item.sku` | Map to commodity codes | | Description | `item.name` | Truncate to 35 chars | | Quantity | `item.quantity` | | | Unit price | `item.unit_price` | | ### Step 4: Implement **Option A: Processor handles it** - Submit required fields to processor - Processor formats for networks **Option B: Gateway/integration handles it** - Configure gateway for Level 2/3 - Pass data through API **Option C: Third-party Level 3 service** - Specialized services optimize submission - May be worth it for high volume ### Step 5: Verify and Monitor After implementation: - Check interchange reports for qualification - Look for "Level II" or "Level III" categories - Compare before/after effective rates - Monitor for downgrades --- ## Common Implementation Challenges ### Challenge: Missing Tax Data **Problem:** Your system doesn't capture tax separately **Solution:** Calculate tax from total, or implement tax capture ### Challenge: Missing PO Numbers **Problem:** Customers don't provide PO numbers **Solution:** Add optional PO field at checkout, use order number as fallback ### Challenge: Product Code Mapping **Problem:** Your SKUs don't map to commodity codes **Solution:** Use generic commodity codes, or implement mapping table ### Challenge: Line Item Limitations **Problem:** Complex orders with many line items **Solution:** Most processors limit line items (99-999). Summarize if needed. --- ## Large Ticket Programs For very large transactions ($8,000+), networks offer special programs: ### Visa Large Ticket | Tier | Transaction Size | Rate | |------|------------------|------| | Tier 1 | $8,000-$25,000 | ~1.5% + flat | | Tier 2 | $25,000-$100,000 | ~1.25% + flat | | Tier 3 | $100,000+ | ~1.0% + flat | ### Mastercard Large Ticket Similar tiered structure for high-value transactions. ### Qualification Requirements - Must be commercial card - Level 2/3 data required - Transaction must be single purchase (not aggregated) - MCC restrictions may apply --- ## Government and GSA Government purchasing cards have specific programs: ### GSA SmartPay - Federal government purchasing program - Specific interchange categories - Requires Level 3 data - Registration may be required ### State/Local Government - Often use P-cards - Level 2/3 qualification similar to commercial - May have specific reporting requirements --- ## Operational Considerations ### Invoice Reconciliation B2B customers often need: - Detailed invoices matching card transactions - PO number on statements - Line item detail for AP matching ### Returns and Credits - Level 2/3 data should accompany credits - Partial returns need line item adjustment - Credit qualification depends on original transaction level ### Reporting Track: - % of transactions qualifying for Level 2/3 - Downgrade reasons - Savings achieved vs. baseline --- ## Scale Callout | B2B Volume | Approach | |------------|----------| | **Under $100k/mo** | Level 2 only if easy. Manual effort not worth it. | | **$100k-$500k/mo** | Implement Level 2. Consider Level 3 if system supports. | | **$500k-$2M/mo** | Full Level 3 implementation. Measure qualification rates. | | **Over $2M/mo** | Optimize qualification rates. Consider specialized Level 3 service. | --- ## Where This Breaks 1. **Consumer-heavy business.** If 90% of your cards are consumer credit, Level 2/3 won't help much. Focus on commercial card percentage. 2. **Implementation cost exceeds savings.** $5,000 development project for $1,000/year savings = bad ROI. Assess before building. 3. **Data quality issues.** Garbage data doesn't qualify. Clean data is prerequisite. --- ## Next Steps **Assessing opportunity?** 1. [Understand commercial cards](#what-are-commercial-cards) - Corporate, purchasing, fleet 2. [Calculate potential savings](#savings-calculation) - Volume ร— 0.5% 3. [Follow assessment steps](#step-1-assess-opportunity) - Pull 90 days data **Implementing Level 2/3?** 1. [Know required fields](#required-data-fields) - Tax, PO, line items 2. [Check processor support](#step-2-check-processor-support) - Ask key questions 3. [Map your data](#step-3-map-your-data) - System fields to requirements **Solving common challenges?** 1. [Handle missing tax data](#challenge-missing-tax-data) - Calculate or capture 2. [Handle missing PO numbers](#challenge-missing-po-numbers) - Add field or use order # 3. [Map product codes](#challenge-product-code-mapping) - Generic codes or mapping table --- ## Related Pages - [What interchange is and what it costs](/docs/payments/reference/interchange) - Understanding interchange - [Invoicing](/docs/payments/invoicing) - B2B payment workflows - [Buying Payments](/docs/payments/buying-payments) - Processor selection for B2B --- ## BNPL Economics Source: https://paymentsandrisk.com/docs/payments/reference/bnpl-economics # BNPL Economics :::info[TL;DR] - BNPL providers pay you upfront and collect from customers over time; you pay roughly 3-8% of the transaction as the cost of that service, against a published card rate of 2.89% + $0.29 on Braintree or 2.6% + 15c in person on Square. **No BNPL provider publishes a merchant rate**, so the 3-8% is directional and everything is negotiated - The ROI case for BNPL is cart size lift (30-50% higher AOV) and conversion lift on high-ticket items; run the math on your specific AOV and margins before adding it - BNPL disputes go through the BNPL provider, not card networks - you get paid regardless of whether the customer pays Klarna/Affirm/Afterpay, but the provider may claw back funds if you don't fulfill - Don't add BNPL to low-AOV products (under $50); the conversion lift doesn't justify the higher merchant discount rate ::: Buy Now Pay Later (BNPL) shifts credit risk from you to the BNPL provider. You get paid upfront. They collect from the customer over time. That service has a cost. BNPL makes sense for some businesses, not others. The math matters. ## How BNPL Works ### The Basic Model 1. Customer selects BNPL at checkout 2. BNPL provider approves customer in real-time 3. You receive payment (minus BNPL fee) within 1-3 days 4. Customer pays BNPL provider in installments (4 payments, 6 months, etc.) 5. BNPL provider bears the credit risk ### Who's Who | Provider | Model | Typical Terms | |----------|-------|---------------| | **Klarna** | Pay in 4, financing | 4 payments / 6-36 months | | **Affirm** | Financing | 3-36 months, interest varies | | **Afterpay** | Pay in 4 | 4 biweekly payments | | **PayPal Pay Later** | Pay in 4, Pay Monthly | 4 payments / 6-24 months | | **Shop Pay Installments** | Pay in 4, financing | 4 payments / up to 12 months | ### Payment Flows **Pay in 4 (Short-term):** ``` Purchase: $100 Customer pays: $25 now, then $25 every 2 weeks You receive: $100 minus fee (~$4-6) Timeline: 6 weeks total ``` **Financing (Long-term):** ``` Purchase: $500 Customer pays: ~$45/month for 12 months You receive: $500 minus fee (~$25-40) Timeline: 12 months ``` --- ## What BNPL Costs You ### Fee Structure | Fee Type | Typical Range | Notes | |----------|---------------|-------| | **Pay in 4** | 4-6% | Interest-free to customer | | **Financing (0% APR)** | 5-8% | You subsidize the interest | | **Financing (interest-bearing)** | 3-6% | Customer pays interest | :::warning[No BNPL provider publishes its merchant rate] The ranges above are directional, gathered from merchant reports rather than from any provider's published rate card. None of the major BNPL providers publishes a merchant discount rate, so treat these as a starting point for a negotiation and nothing more. **Ask for:** the merchant discount rate for your vertical and average ticket, whether it differs by product (Pay in 4 versus longer financing), who bears fraud and dispute liability, and the refund and chargeback mechanics when a customer has only made two of four payments. The card rates below, by contrast, are published and verified against the vendor's own page on 2026-08-02. ::: ### Fee Calculation Example Card side uses Braintree's published 2.89% + $0.29 ([source](https://www.paypal.com/us/enterprise/paypal-braintree-fees)). BNPL side assumes a 5.5% Pay in 4 rate, which is a placeholder because no provider publishes one. | Scenario | Card (published) | BNPL Pay in 4 (assumed 5.5%) | Difference | |----------|------------------|------------------------------|------------| | $100 sale | $3.18 fee | $5.50 fee | +$2.32 | | $500 sale | $14.74 fee | $27.50 fee | +$12.76 | | You receive | $96.82 / $485.26 | $94.50 / $472.50 | Less | On a $500 order the gap is about 2.6 points. Whether that's worth it depends entirely on whether BNPL actually lifts your conversion or just changes how existing buyers pay, which is the measurement problem the rest of this page is about. ### Hidden Costs | Cost | Description | |------|-------------| | **Integration** | Development time for checkout integration | | **Reconciliation** | Separate BNPL payouts to track | | **Chargebacks** | BNPL has its own dispute process | | **Returns** | More complex with installment plans | --- ## When BNPL Makes Sense ### Good Fit | Factor | Why BNPL Works | |--------|----------------| | **High AOV ($100-$1,000)** | Installments meaningful, fee % acceptable | | **Impulse purchases** | Removes price objection | | **Younger demographic** | Gen Z/Millennial preference | | **Fashion/electronics** | Discretionary, aspirational | | **Low margin sensitivity** | Can absorb 5%+ fees | ### Bad Fit | Factor | Why BNPL Doesn't Work | |--------|----------------------| | **Low AOV (under $50)** | Fee % too high relative to margin | | **B2B transactions** | Not designed for business buyers | | **Subscription billing** | One-time purchase model | | **Thin margins** | Can't absorb extra 2-5% | | **Commodity products** | Customers won't pay premium | ### Decision Framework ``` Should you add BNPL? 1. Is your AOV > $75? NO โ†’ Probably not worth it YES โ†’ Continue 2. Is your margin > 30%? NO โ†’ Fee impact may be too high YES โ†’ Continue 3. Is your customer demographic under 45? NO โ†’ Lower BNPL adoption YES โ†’ Continue 4. Are competitors offering BNPL? YES โ†’ Consider parity NO โ†’ May not be expected 5. Can you absorb 5%+ fees? YES โ†’ Test it NO โ†’ Skip or pass cost to customer ``` --- ## The Conversion Lift Question BNPL providers claim 20-30% conversion lifts. Reality is more nuanced. ### What Providers Claim - "20-30% higher conversion" - "Higher AOV" - "New customer acquisition" ### What Data Shows | Study Source | Finding | |--------------|---------| | Provider case studies | 20-30% lift (cherry-picked) | | Independent studies | 5-15% lift typical | | Merchant reports | Highly variable | ### How to Measure Lift Don't trust provider claims. Measure yourself: 1. **Baseline:** Conversion rate before BNPL 2. **Enable BNPL:** Run for 4-8 weeks 3. **Measure:** New conversion rate 4. **Control for seasonality:** Compare to same period last year 5. **Calculate true lift:** After accounting for BNPL fee impact **True ROI calculation:** ``` Revenue Lift = (New Conversion - Old Conversion) ร— Traffic ร— AOV Cost = BNPL Transactions ร— BNPL Fee Rate Net Benefit = Revenue Lift - Cost ``` ### The Cannibalization Problem Some BNPL transactions would have happened anyway with cards. You're paying extra for transactions you'd have gotten at lower cost. **Question to ask:** "What % of BNPL users would have completed purchase without it?" --- ## Provider Economics Understanding how BNPL providers make money helps you negotiate. ### Revenue Sources | Source | How It Works | |--------|--------------| | **Merchant fees** | 4-8% per transaction (your cost) | | **Consumer interest** | 0-30% APR on longer terms | | **Late fees** | $5-25 per missed payment | | **Bank partnerships** | Revenue from financing programs | ### Provider Profitability Most BNPL providers have struggled with profitability: - High customer acquisition costs - Credit losses on defaulting customers - Competition drives merchant fees down - Regulatory scrutiny increasing **Implication:** Negotiate. Providers need merchant volume. --- ## Negotiating BNPL Rates ### Leverage Points | Factor | Your Leverage | |--------|---------------| | **High volume** | More transactions = better rates | | **Low returns** | Less risk for provider | | **High approval rates** | Your customers are creditworthy | | **Exclusive offering** | Single provider gets all volume | | **Marketing commitment** | Promote their brand | ### What to Negotiate | Term | Negotiable? | Starting Point | |------|-------------|----------------| | **Fee %** | Yes | Ask for 0.5-1% reduction | | **Settlement timing** | Sometimes | Faster = better | | **Marketing support** | Yes | Co-op funds, promotion | | **Integration support** | Yes | Development assistance | | **Chargeback handling** | Sometimes | Provider absorbs more | ### Sample Negotiation Script > "We're evaluating BNPL providers. Our current volume is $X/month with Y% average ticket. We expect Z% of transactions to use BNPL. What's your best rate for this volume, and how does it improve as we scale?" --- ## Chargebacks and Disputes BNPL disputes work differently than card chargebacks. ### BNPL Dispute Process | Stage | What Happens | |-------|--------------| | **Customer complaint** | To BNPL provider | | **Provider decision** | Provider makes initial call | | **Merchant notification** | You're informed | | **Evidence submission** | Similar to card disputes | | **Resolution** | Provider decides | ### Key Differences from Cards | Factor | Cards | BNPL | |--------|-------|------| | **Dispute window** | 120 days | Varies (often shorter) | | **Ratio impact** | Visa/MC ratios | Separate BNPL ratio | | **Fee structure** | Chargeback fee | Varies by provider | | **Network rules** | Strict | Provider-specific | ### BNPL Fraud Risk | Risk | Notes | |------|-------| | **Friendly fraud** | Customer disputes after receiving goods | | **Identity fraud** | Fraudster uses stolen identity | | **Return fraud** | Return goods, keep installment | **Your exposure:** Usually limited. Provider takes credit risk. But disputes still cost time. --- ## Returns and Refunds Returns with BNPL are more complex than card refunds. ### How BNPL Returns Work | Scenario | Process | |----------|---------| | **Full return before payment complete** | Provider cancels remaining payments, refunds paid amount | | **Partial return** | Provider adjusts payment schedule | | **Return after all payments** | Standard refund to customer | ### Operational Complexity | Challenge | Impact | |-----------|--------| | **Timing mismatch** | Return processed before/during installments | | **Partial returns** | Complicated payment adjustments | | **Reconciliation** | Matching refunds to original BNPL transactions | | **Customer confusion** | "Why am I still being charged?" | ### Best Practices - Train support staff on BNPL refund process - Set clear return policy for BNPL purchases - Process refunds quickly to minimize customer confusion - Track BNPL refund rates separately --- ## Regulatory Considerations BNPL is under increasing regulatory scrutiny. ### Current Landscape | Jurisdiction | Status | |--------------|--------| | **US (Federal)** | CFPB issued Reg Z interpretive rule in 2024, revoked in 2025; no specific rules currently in effect | | **US (States)** | Some states treating as credit | | **UK** | FCA regulation coming | | **Australia** | ASIC oversight, new regulations | | **EU** | Consumer Credit Directive updates | ### What This Means for Merchants - **Disclosure requirements** may increase - **Marketing restrictions** possible - **Compliance burden** could shift partly to merchants - **Fee caps** possible (like interchange caps) ### Risk Mitigation - Don't make BNPL the only option - Ensure clear disclosure of BNPL terms - Monitor regulatory developments - Have contingency if provider exits market --- ## Integration Considerations ### Implementation Options | Approach | Complexity | Control | |----------|------------|---------| | **Shopify/platform native** | Low | Low | | **Hosted widget** | Medium | Medium | | **API integration** | High | High | ### What to Evaluate | Factor | Questions | |--------|-----------| | **Checkout flow** | Does it add friction? | | **Mobile experience** | How does it look on mobile? | | **Approval rates** | What % of customers get approved? | | **Settlement timing** | When do you receive funds? | | **Reporting** | Can you reconcile easily? | --- ## Scale Callout | Volume | BNPL Approach | |--------|---------------| | **Under $100k/mo** | Skip BNPL unless competitors require it. Fee impact too high. | | **$100k-$500k/mo** | Test one provider. Measure lift carefully. | | **$500k-$2M/mo** | Negotiate rates. Consider multiple providers. | | **Over $2M/mo** | Custom integration. Negotiate aggressively. Measure by SKU/category. | --- ## Where This Breaks 1. **Assuming conversion lift is free.** The extra 2-5% fee eats into any conversion benefit. Measure net ROI, not gross lift. 2. **Low-AOV businesses.** $30 average ticket with 5% BNPL fee = $1.50 extra cost. If margin is $5, that's 30% of profit gone. 3. **Returns-heavy categories.** Fashion with 20% return rate + BNPL complexity = operational nightmare. --- ## Next Steps **Evaluating BNPL for your business?** 1. [Choosing Payment Methods](/docs/payments/payment-methods/choosing-methods) - Decision framework for when BNPL makes sense 2. [Checkout Conversion](/docs/payments/checkout-conversion) - Measure your baseline before adding BNPL **Implementing BNPL?** 1. [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Compare BNPL with wallet options 2. [Alternative Methods](/docs/payments/payment-methods/alternative-methods) - Full APM implementation guide 3. [Payments Metrics](/docs/payments/metrics) - Track BNPL performance **Managing BNPL disputes?** 1. [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention strategies for all payment types 2. [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Understanding first-party fraud patterns 3. [Refund Policy Design](/docs/chargebacks/refund-policy) - Optimizing return policies ## Related Pages - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing checkout - [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Other payment methods - [What interchange is and what it costs](/docs/payments/reference/interchange) - Understanding payment costs --- ## Capture Operations Source: https://paymentsandrisk.com/docs/payments/reference/capture-operations # Capture Operations :::info[TL;DR] - Void before settlement (before capture) costs nothing; refund after settlement loses interchange fees you can't recover - void early for cancellations when possible - Partial capture is allowed when you can't fulfill the full order (e.g., split shipment); capture only what you've shipped to avoid disputed charges on undelivered items - Re-authorization is required when an auth window expires before you can capture; the card may have been cancelled or funds may have been moved - Multi-capture (capturing a single auth in multiple transactions) requires processor support and specific network rules compliance - confirm before implementing ::: Capture operations are the post-authorization actions that determine when money moves and what it costs you: holds, partial captures, voids, refunds, and re-authorizations. Voiding an uncaptured transaction costs $0, while refunding after settlement costs interchange twice. On 100 refunds/month at $100 average, that difference is $350/month. --- ## Pre-Authorization Holds Pre-auth holds are temporary reservations on a cardholder's credit line. They're not charges, but they affect available credit. ### How Holds Work ```mermaid flowchart TD A[Merchant requests auth\nfor estimated amount] --> B[Issuer places hold] B --> C[Available credit decreases] C --> D{Merchant captures?} D -->|Yes| E[Hold converts to charge] D -->|No - Void| F[Hold releases fast] D -->|No - Expiry| G[Hold releases when auth expires] ``` ### Hold Duration by Card Type | Card Type | Typical Hold Duration | |-----------|----------------------| | **Credit cards** | 7-30 days (network dependent) | | **Debit cards** | 2-10 days (bank dependent) | | **Prepaid cards** | Often longer, varies wildly | :::warning[Debit Card Holds] Debit holds tie up **actual cash**, not credit. A $200 hotel hold on a debit card with $250 balance leaves the customer with $50 available. This creates support calls and customer frustration. Consider [requiring credit cards](/docs/payments/payment-methods/cards) for high-hold industries. ::: ### Hold Release Scenarios | Scenario | What Happens | |----------|--------------| | **Capture matches hold** | Hold converts to charge immediately | | **Capture less than hold** | Excess releases (timing varies) | | **Capture more than hold** | Second auth or over-tolerance capture | | **No capture (void)** | Hold releases faster if merchant voids | | **No capture (expiry)** | Hold releases when [auth expires](/docs/payments/reference/auth-windows) | ### Best Practices for Holds - **Authorize only what you'll capture.** Over-authorizing creates customer complaints. - **Void unused authorizations.** Don't let them expire naturally. - **Warn customers about hold amounts.** Especially for hotels, rentals, and gas stations. - **Use credit-only for high-hold industries.** Consider not accepting debit for car rentals. --- ## Partial Captures Sometimes you capture less than the authorized amount. This happens with split shipments, partial fulfillment, or order modifications. ### Partial Capture Scenarios | Scenario | Example | |----------|---------| | **Split shipment** | Customer orders 3 items; 2 ship now, 1 backorders | | **Partial availability** | Ordered 10 widgets, only 7 in stock | | **Order modification** | Customer removes item before shipment | | **Partial service** | Hotel guest checks out early | ### How Partial Capture Works ```mermaid flowchart TD A[Original auth: $100] --> B[First capture: $40\nItems in stock] B --> C[Second capture: $30\nBackordered item ships] C --> D[Remaining $30\nReleased to cardholder] ``` ### Network Rules for Multi-Capture | Network | Multi-Capture Support | |---------|----------------------| | **Visa** | Yes, with multi-clearing flag | | **Mastercard** | Yes, with final indicator on last capture | | **Amex** | Yes, limited scenarios | ### Operational Considerations - **Track capture totals.** Don't exceed original auth amount. - **Use proper flags.** Indicate partial vs. final capture correctly. - **Communicate to customers.** Explain why they see multiple charges. - **Reconciliation complexity.** One order = multiple capture events in [settlement](/docs/payments/settlement). --- ## Void vs. Refund Decision Void and refund both return money to the customer, but they're different operations with different costs. ### The Difference | Aspect | Void | Refund | |--------|------|--------| | **When possible** | Before capture/settlement | After capture/settlement | | **Interchange cost** | Little to none | You pay [interchange](/docs/payments/interchange-optimization) again | | **Customer timing** | Hold releases in 1-3 days | Funds return in 3-10 days | | **[Chargeback](/docs/chargebacks) ratio** | Doesn't count | Doesn't count (but chargebacks do) | | **Accounting** | Transaction disappears | Two transactions (charge + credit) | ### Decision Flow ```mermaid flowchart TD A[Customer wants\nmoney back] --> B{Has transaction\nsettled?} B -->|No| C[VOID] B -->|Yes| D[REFUND required] C --> E[Cancel authorization\nHold releases\nNo interchange cost] D --> F[Issue credit to card\nPay interchange again\n3-10 days to customer] ``` ### When Void is Not an Option - Transaction already in [settlement](/docs/payments/settlement) batch - Settlement batch already sent to [processor](/docs/operations/processor-management) - Funds already moved - Processor doesn't support void after certain time ### Cost Impact | $100 transaction | Void | Refund | |------------------|------|--------| | Original interchange (~2%) | $2 | $2 | | Return interchange | $0 | $2 (paid again) | | **Net cost to you** | **$2** | **$4** | **Rule:** Void when you can. Refund when you must. --- ## Re-Authorization Authorizations expire. If you haven't captured when the clock runs out, you need a new authorization. ### Why This Matters - Expired auths can't be captured - Re-auth might fail (card maxed, closed, or stolen) - Capturing against expired auth = [chargeback](/docs/chargebacks) risk ### Proactive Re-Authorization If you know you'll miss the [auth window](/docs/payments/reference/auth-windows): 1. **Re-authorize before expiry.** Get fresh approval while old auth still valid. 2. **Void the old auth.** Release the hold. 3. **Track the new auth.** Update your order records. ### Re-Auth Failure Handling | Failure Reason | Action | |----------------|--------| | **Insufficient funds** | Contact customer for alternative payment | | **Card expired** | Request updated card | | **Card lost/stolen** | Contact customer for new payment | | **Generic decline** | Contact customer or cancel order | See [decline codes](/docs/reference/decline-codes) for specific handling. ### When to Re-Auth | Scenario | Re-Auth Timing | |----------|----------------| | **Pre-order with 30-day ship date** | Re-auth 2-3 days before shipping | | **Custom/made-to-order** | Re-auth when production complete | | **Backorder extended** | Re-auth every 7 days. That's the shortest of the three networks, not the rule: Visa CNP allows 10 calendar days, Mastercard and Amex allow 7 | | **[Subscription](/docs/payments/subscriptions-recurring) trial ending** | Re-auth at trial end | ### Communication Templates **Email when re-auth fails:** > "We were unable to process your payment for order #1234. Your card on file was declined. Please update your payment method within 48 hours to avoid order cancellation." **Email when re-auth succeeds:** > "Good news! Your order #1234 is ready to ship. Your card has been charged $X." --- ## Partial Authorizations A partial authorization is when the issuer approves only part of the requested amount. ### How Partial Auth Works 1. Merchant requests $100 authorization 2. Issuer responds: "Approved for $70" (cardholder has $70 available) 3. Merchant must decide: accept $70 or decline transaction entirely ### When Partial Auth Occurs | Card Type | Partial Auth Common? | |-----------|---------------------| | **Prepaid/gift cards** | Very common | | **Debit cards** | Common | | **Credit cards** | Rare | ### Handling Options | Option | When to Use | |--------|-------------| | **Accept partial, request second payment** | Customer can pay remainder another way | | **Decline entire transaction** | Single-payment only (e.g., gas pumps) | | **Split tender automatically** | POS supports multiple [payment methods](/docs/payments/payment-methods) | ### Implementation Considerations | Consideration | Details | |---------------|---------| | **POS/system support** | Must handle partial auth response | | **Customer communication** | Explain why partial occurred | | **Second payment flow** | Have fallback payment method ready | | **[Refund](/docs/chargebacks/refund-policy) complexity** | Two payments = two potential refunds | ### Best Practices - **Enable partial auth for prepaid-heavy merchants.** Gift cards are often used with other payment. - **Decline partial for automated/unattended.** Gas pumps, vending can't request second payment. - **Train staff on split tender.** They need to know how to complete the transaction. :::tip[Prepaid/Gift Card Rule] If you sell gift cards or have significant prepaid traffic, enable partial authorization. Otherwise, customers with $40 on a gift card can't buy a $50 item. ::: --- ## Next Steps **Managing holds?** 1. [Understand hold duration](#hold-duration-by-card-type) - Credit vs debit vs prepaid 2. [Follow hold best practices](#best-practices-for-holds) - Authorize what you'll capture 3. [Warn customers about debit](#pre-authorization-holds) - Real cash tied up **Doing void vs refund?** 1. [Know the cost difference](#cost-impact) - Void saves interchange 2. [Follow decision flow](#decision-flow) - When void is possible 3. [Track voiding opportunity](#when-void-is-not-an-option) - Before settlement **Handling re-authorization?** 1. [Know when to re-auth](#when-to-re-auth) - Pre-orders, backorders 2. [Handle failures gracefully](#re-auth-failure-handling) - Customer communication 3. [Capture within window](/docs/payments/reference/auth-windows) - Network-specific timing --- ## See Also - [Authorization and Capture](/docs/payments/auth-and-capture) - Core concepts - [Authorization Windows](/docs/payments/reference/auth-windows) - Network-specific timing - [Settlement & Reconciliation](/docs/payments/settlement) - Where money flows - [Decline Codes](/docs/reference/decline-codes) - Understanding failures - [Interchange Optimization](/docs/payments/interchange-optimization) - Fee management --- ## How We Compare Processor Costs Source: https://paymentsandrisk.com/docs/payments/reference/cost-model-assumptions # How We Compare Processor Costs :::info[TL;DR] - You can't rank an interchange-plus processor against a flat-rate one without assuming what interchange costs. Helcim and Stax against Square and PayPal, say. Every comparison makes that assumption. Almost none of them print the number. - Ours is **0.89% + $0.158 card-present** and **1.36% + $0.152 online**. Derived below from Visa's published US schedule and Federal Reserve payment data. - We add an assumed **0.14% + $0.02** for card network assessments. Nobody publishes those. It's flagged unverified everywhere it's used. - **Three dials in this model aren't verified, and we name all three.** The 0.14% + $0.02 assessment. The split of rewards credit into standard and premium. The shift in debit share between in-person and online. Sensitivity for each is below. None of them flips a verdict here. - **Both networks' schedules are here, and they agree.** Visa and Mastercard land on the same number at every bound that matters. 2.30% + $0.10 premium consumer credit card-present, 2.60% + $0.10 online, 3.15% + $0.10 non-qualified. - **1.80% + $0.10 card-present is not a blend**, though it's widely used as one. It's roughly a single card type, a consumer rewards credit card. Using the real blend instead changes several conclusions. - If you disagree with a weight, change it and rerun. That's why the arithmetic is here. - **Every pricing figure here also carries a source tier**, so you can tell at a glance whether it's from the vendor, from a named third party, or simply not published. [The tier system is below](#how-we-tier-every-figure). ::: Every processor comparison assumes a number for interchange. This page publishes ours, and the arithmetic behind it. ## Why this page exists An interchange-plus processor quotes a margin over a cost it doesn't control. A flat-rate processor quotes one number with that cost already inside. Say which is cheaper and you've decided what the underlying interchange is. Every "cheapest payment processor" article you've read made that decision silently. Make it differently on different pages and you get comparisons that contradict each other while every individual rate in them is correct. This page fixes the assumption in one place. Every cost comparison here runs off it. Think a weight is wrong for your business? The arithmetic is below. Redo it. --- ## How we tier every figure {/* #how-we-tier-every-figure */} Every price on this site carries one of four labels. The label tells you how much weight the number can hold. It's printed next to the number, not buried in a methodology note nobody reads. | Tier | What it means | What sits alongside it | |---|---|---| | VENDOR | From the vendor's own published page | The exact URL and the access date | | REPORTED | From a credible third party | The source name, the URL, its publication or update date, and **what kind of source it is**: reseller, review site, industry publication, merchant survey, regulatory filing or earnings call | | DERIVED | Calculated from figures somebody else published | The inputs, the operation, and a note that the company never published the result itself | | NOT PUBLISHED | The vendor doesn't publish it | What to ask the vendor for instead | ### Why bother A blank cell isn't neutrality. It's a dead end for a merchant building a budget. And it quietly rewards the vendors that publish least. A pricing page that says nothing shouldn't come out of a comparison looking cleaner than one that publishes a rate you can argue with. The opposite failure is worse, and it's the common one. Print a reseller's number in the same typeface as the vendor's own, and the reader can't tell them apart. **The fix isn't to publish less. It's to publish more and label it.** No other vendor comparison separates what it verified from what it repeated. That separation is the point of this system. ### The source quality order we use Best first: 1. The vendor's own published page 2. A regulatory filing or an earnings call 3. An established industry publication 4. A review site with a stated methodology 5. A reseller quoting a rate it sells 6. An undated blog **We never cite a source that sells the thing without saying so.** Several figures here come from review sites that disclose referral commissions from the vendor they're reviewing. That disclosure gets repeated next to the number every time. Not once, in a footer. Where sources disagree, we publish the range and name both ends. "Reported at 2.6% to 2.9% by X and Y as of June 2026" beats a bare number with no provenance. More useful, more honest. ### Two rules that follow from this **A REPORTED figure is never dressed up as the vendor's own.** Toast is the sharpest example here. Toast publishes 2.49% and 3.09% on its own shop pages. The "+ $0.15 per transaction" that every comparison table bolts on comes from NerdWallet and two SEO content sites. So we write it as two things. Toast publishes 2.49%. The fixed component is reported at $0.15. **A DERIVED figure is labelled as calculated, not as a disclosure.** Riskified's revenue over its GMV works out to 0.237%. But Riskified never published a take rate. It says only that revenue is "directionally correlated" with GMV. Adyen is the reverse case. It publishes its own take rate of 17.0 basis points in its annual report, so that one is VENDOR. ### Five rates that get reported as unpublished and aren't If a comparison table leaves one of these blank, it's wrong. Here's where each one lives: - **Clover**: a full rate card, vertical by vertical, at [clover.com/pricing](https://www.clover.com/pricing) - **Toast**: on its shop pages, not its pricing page - **Square**: plan prices at [squareup.com/us/en/pricing](https://squareup.com/us/en/pricing), card rates on its fees page - **Worldpay**: an indicative UK card at [go.worldpay.com/pricing](https://go.worldpay.com/pricing) - **Lightspeed**: 2.6% + 10c. The "1.5%" that circulates appears nowhere on its site **A blank cell here has to earn its place.** Only Checkout.com and Global Payments publish nothing at all, and the Details panel on each says what to ask for instead. --- ## The short version | | Card present | Online | |---|---|---| | Assumed interchange | **0.89% + $0.158** | **1.36% + $0.152** | | Assumed network assessments (unverified) | 0.14% + $0.02 | 0.14% + $0.02 | | **Total pass-through cost** | **1.03% + $0.178** | **1.50% + $0.172** | Those are blends. One card isn't a blend. The published spread runs from **0.05% + $0.21** on regulated debit to **3.15% + $0.10** on a non-qualified transaction, and the [full card-type table is on the interchange page](/docs/payments/reference/interchange#by-card-type). Got a lopsided mix? A B2B counter on commercial cards, a bar on mostly debit? Use your band, not ours. What that means in practice: | Channel | Ticket | Interchange only | Full pass-through | Effective rate | |---|---|---|---|---| | Card present | $15 | $0.29 | $0.33 | 2.22% | | Card present | $50 | $0.60 | $0.69 | 1.39% | | Card present | $150 | $1.49 | $1.72 | 1.15% | | Online | $25 | $0.49 | $0.55 | 2.19% | | Online | $75 | $1.17 | $1.30 | 1.73% | | Online | $200 | $2.87 | $3.17 | 1.59% | The effective-rate column runs off the full pass-through. That's the figure every comparison here uses. The interchange-only column sits beside it, so you can see how much of the total is the unverified network assessment. Two cents plus 14 basis points, everywhere. Notice how much the effective rate moves with ticket size. That's why a bare "X is the cheapest processor" tells you nothing. Ranking at a $15 ticket and ranking at a $150 ticket are different questions with different answers. --- ## Where the rates come from Every interchange figure comes from **Visa USA Interchange Reimbursement Fees, 18 April 2026**. Visa publishes it openly. Verified 2 August 2026. ### Card-present rates used | Card type | Visa fee program | Rate | |---|---|---| | Consumer debit, regulated | Regulated Visa Check Card | 0.05% + $0.22 | | Consumer debit, exempt | CPS/Retail, Debit | 0.80% + $0.15 | | Consumer prepaid, exempt | CPS/Retail, Prepaid | 1.15% + $0.15 | | Consumer credit, no rewards | Product 2, All Other Products | 1.51% + $0.10 | | Consumer credit, standard rewards | Product 2, Traditional Rewards and Visa Signature | 1.65% + $0.10 | | Consumer credit, premium rewards | Product 2, Signature Preferred | 2.10% + $0.10 | | Commercial and business | Commercial Card Present 2.50%, Business Product 2 around 2.10% | 2.26% + $0.10 | ### Online rates used | Card type | Visa fee program | Rate | |---|---|---| | Consumer debit, regulated | Regulated Visa Check Card | 0.05% + $0.22 | | Consumer debit, exempt | CPS/e-Commerce Basic, Debit | 1.65% + $0.15 | | Consumer prepaid, exempt | CPS/e-Commerce Basic, Prepaid | 1.75% + $0.20 | | Consumer credit, no rewards | Product 1, All Other Products | 1.89% + $0.10 | | Consumer credit, standard rewards | Product 1, Traditional Rewards and Visa Signature | 2.05% + $0.10 | | Consumer credit, premium rewards | Product 1, Signature Preferred | 2.50% + $0.10 | | Commercial and business | Commercial Card Not Present 2.70%, Business Product 1 around 2.85% | 2.79% + $0.10 | **Correction, 2 August 2026.** The premium rewards row used to read 2.47% online and to name both Signature Preferred and Infinite. Neither was right. Visa publishes Signature Preferred Product 1 at 2.50% + $0.10. And 2.47% sits below both tiers, so it wasn't a blend of them either. The row now uses Signature Preferred alone, at the published rate. Visa's top consumer tier, Infinite Spend Qualified, is higher still. **2.30% + $0.10 card-present, 2.60% + $0.10 online.** Mastercard's World Elite lands on the same two numbers. We keep the premium bucket on Signature Preferred anyway. Infinite volume is small enough that folding it in moves the blend by less than a basis point. And we'd rather publish a tier you can look up than a weighted average you can't check. The correction moved the online blend from 1.359% to 1.362%. That still rounds to the 1.36% published everywhere on this site. The regulated debit rate is a federal cap, not a network choice. Regulation II sets it at "$0.21 plus 0.05 percent multiplied by the value of the transaction, plus a $0.01 fraud-prevention adjustment". It binds every network identically. That matters below. :::note[Mastercard's schedule agrees with Visa's, and it's harder to get hold of] The blend above is built on Visa's tables. Mastercard's say the same thing. Mastercard's schedule looks blocked and isn't. The live host turns away automated readers on both `mastercard.com` and `mastercard.us`, which is why it gets described as unpublished. The April 2026 edition sits in the Internet Archive and comes back cleanly: ``` http://web.archive.org/web/20260616151957id_/https://www.mastercard.com/content/dam/mccom/us/business/documents/merchant-rates-2026-2027-april2026.pdf ``` That's "Mastercard 2026-2027 U.S. Region Interchange Programs and Rates", effective 17 April 2026, snapshotted 16 June 2026, 286KB. Retrieved and extracted 2 August 2026. What it shows next to Visa: | Bound | Visa, 18 April 2026 | Mastercard, 17 April 2026 | |---|---|---| | Regulated debit | 0.05% + $0.21 | 0.05% + $0.21 | | Premium consumer credit, card present | 2.30% + $0.10 (Infinite Spend Qualified) | 2.30% + $0.10 (World Elite Merit III Base) | | Premium consumer credit, online | 2.60% + $0.10 (Infinite) | 2.60% + $0.10 (World Elite Full UCAF) | | Non-qualified | 3.15% + $0.10 | 3.15% + $0.10 | | Highest rate published anywhere in the document | 3.15% + $0.10 | 3.30% + $0.10 (small business Standard, Level 5) | Two independently published schedules landing on the same three numbers is about as good as corroboration gets. Nothing to average, nothing to hedge between. The debit floor matches because Regulation II sets it federally, not because either network chose it. Note the last row. **Neither document contains a 3.5% rate anywhere**, at any point at or above 3.00%. The "up to 3.5%" that circulates in fee articles is a processor's keyed-entry price. Clover 3.5% + 10c, Square 3.5% + 15c. Somebody copied it into an interchange table. **One input is older than the rest.** The Federal Reserve Payments Study transaction counts behind the 63/37 debit-credit split carry over from the earlier pass. They weren't re-verified against the source document this session. Everything else on this page was read fresh on 2 August 2026. ::: --- ## The card mix ### Why we weight by transaction count, not by dollars For a merchant with average ticket A, the cost of a transaction is the share-weighted sum of (rate x A + fixed fee) across card types, where the shares are shares of **transactions**. Weighting by dollar value is the wrong operation. It's also a common error. It over-weights credit cards, which carry bigger tickets. And it mishandles the fixed cent component entirely, because a $0.22 debit fee is charged per transaction, not per dollar. Blend by value and you overstate interchange every time. ### The transaction shares From the **Federal Reserve Payments Study, CY2024**, released July 2026: | Card type | Transactions (billions) | Value ($ trillions) | Average ticket | |---|---|---|---| | General-purpose credit | 64.3 | 6.17 | $96 | | Non-prepaid debit | 99.3 | 4.34 | $44 | | General-purpose prepaid | 11.8 | 0.43 | $36 | That's **63% debit and prepaid, 37% credit** by transaction count. The Fed says the same thing independently. Debit was 64 percent of all card payments in 2024 by number. We exclude private-label credit and EBT cards. Store cards and benefit cards don't carry general-purpose network interchange at an ordinary merchant. Two more splits, both from primary sources: - Within debit, the Fed's 2024 Regulation II data gives **60.7% regulated and 39.3% exempt** by transaction count. Regulated means the issuer holds over $10 billion in assets. That's most large banks. - Within credit, the CFPB's December 2025 report to Congress says it plainly: "Overall, **92 percent** of general purpose card spending was accounted for by rewards cards in 2023 and 2024." That last figure surprises people. It's why casual estimates of interchange run low. Nearly all US credit card spending is on a rewards card. ### The blend, card present | Bucket | Share of transactions | Rate | Contribution | |---|---|---|---| | Regulated consumer debit | 38% | 0.05% + $0.22 | 0.0190% + $0.0836 | | Exempt consumer debit and prepaid | 25% | 0.84% + $0.15 | 0.2100% + $0.0375 | | Consumer credit, no rewards | 3% | 1.51% + $0.10 | 0.0453% + $0.0030 | | Consumer credit, standard rewards | 24% | 1.65% + $0.10 | 0.3960% + $0.0240 | | Consumer credit, premium rewards | 7% | 2.10% + $0.10 | 0.1470% + $0.0070 | | Commercial and business | 3% | 2.26% + $0.10 | 0.0678% + $0.0030 | | **Total** | **100%** | | **0.885% + $0.158** | ### The blend, online | Bucket | Share of transactions | Rate | Contribution | |---|---|---|---| | Regulated consumer debit | 33% | 0.05% + $0.22 | 0.0165% + $0.0726 | | Exempt consumer debit and prepaid | 22% | 1.66% + $0.155 | 0.3652% + $0.0341 | | Consumer credit, no rewards | 3% | 1.89% + $0.10 | 0.0567% + $0.0030 | | Consumer credit, standard rewards | 30% | 2.05% + $0.10 | 0.6150% + $0.0300 | | Consumer credit, premium rewards | 9% | 2.50% + $0.10 | 0.2250% + $0.0090 | | Commercial and business | 3% | 2.79% + $0.10 | 0.0837% + $0.0030 | | **Total** | **100%** | | **1.362% + $0.152** | The online profile moves debit from 63% to 55% of transactions. Card-not-present volume skews toward credit. The Payments Study publishes no channel split, so that shift is a judgement call rather than a sourced figure. It's the third of our three unverified dials. And the softest one that actually moves an answer. --- ## Does it check out? The debit half can be tested against an independent measurement the model never saw. The Fed reports actual 2024 debit interchange. Regulated issuers averaged **$0.23** per transaction. Exempt issuers **$0.51**. All debit **$0.34**, on an average ticket of $46.32. Running the Visa rates we use at that same ticket: | | Our model | Fed observed | Gap | |---|---|---|---| | Regulated | $0.243 | $0.23 | 1.3 cents | | Exempt | $0.521 | $0.51 | 1.1 cents | | Blended | $0.352 | $0.34 | 1.2 cents | Within about a penny on the largest component of the blend. The small overshoot is expected. Not every issuer certifies for that $0.01 fraud-prevention adjustment. This is the check that convinced us 0.89% was right and 1.80% was wrong. The old figure made debit a rounding error in a small merchant's mix. The Fed's own data says otherwise. --- ## The parts we're least sure about Three inputs are unverified. We name all three here rather than bury them. Each one carries a sensitivity test, so you can see what would have to be true for a verdict to move. No verdict on this site rests on any of them. **Network assessments: 0.14% + $0.02, unverified.** Card networks charge assessments and per-authorization fees on top of interchange. Neither Visa nor Mastercard publishes them on any public page we could read. They matter here for one reason. An interchange-plus merchant pays them visibly, on top. A flat-rate merchant pays them invisibly, inside the headline rate. Leave them out and you flatter interchange-plus. Helcim's pricing page confirms the pass-through happens, "we pass exactly what banks and payment networks charge you", without attaching a number. Stax never mentions network fees. This site uses 0.14%, the high end of plausible, so the answer isn't flattered. Move this dial between 0.10% and 0.25% and no conclusion on this site changes. **The standard-versus-premium rewards split, unverified.** We assume 24% of rewards spending sits on Signature Preferred or Infinite tier cards. That's anchored on the CFPB's finding that 16% of general-purpose accounts carry an annual fee, adjusted up because those cardholders spend more. Move it between 10% and 40% and the card-present blend shifts 4 basis points. Nothing turns on it. **The online debit share, unverified.** Explained above. We move debit from 63% of transactions in person to 55% online, and the Payments Study publishes no channel split to check it against. This is the softest input that actually matters. Test the debit share across a 50% to 75% range and the card-present blend swings between 1.065% and 0.721%. Helcim still beats Square Free by $160 to $220 a month in the reference cell, at either end. **And one thing we left out on purpose.** Visa runs a Small Merchant Fee Program with genuinely lower credit rates. It covers merchants under $280,000 a year in Visa consumer credit sales, on pages 12 and 13 of the schedule. A qualifying merchant pays 1.29% + $0.10 card-present on a non-rewards credit card, against 1.51% + $0.10. We don't bake it into the blend. It applies only to Visa and only to consumer credit, so the realised benefit is roughly 4 basis points card-present. It's real and it's worth knowing about. Leaving it out keeps our published number the conservative one. --- ## What this changed Correcting the assumption moved conclusions, not just decimals. On a $50 card-present ticket, the old assumption overstated pass-through cost by 79 basis points. On $20,000 a month that's $159 wrongly charged to the interchange-plus side of every comparison. Worked example, card present, $50 ticket, $20,000 a month, which is 400 transactions: - Pass-through: 1.03% x $20,000 = $206.00, plus $0.178 x 400 = $71.20, so $277.20 - Helcim entry band markup: 0.40% x $20,000 = $80.00, plus $0.08 x 400 = $32.00, so $112.00 - **Helcim total: $389.20**, an effective rate of 1.95% - **Square Free: 2.6% x $20,000 + $0.15 x 400 = $580.00**, or 2.90% Helcim saves $190.80 a month. The old assumption put the same saving near $10. That's close enough to nothing that it would have changed nobody's mind. That was the error. The other conclusions that moved: - **Helcim wins more scenarios on the corrected blend**, and by much wider margins. - **Helcim isn't cheapest "at any volume."** At a $15 card-present ticket it loses to PayPal Zettle at every volume up to $500,000 a month. Zettle's $0.09 fixed fee is the lowest published here, and small tickets reward a small fixed fee. Zettle leads by $13.00 a month at $5,000, $52.00 at $20,000 and $43.33 at $100,000. It flips at $500,000 a month. Helcim enters its $500K-1M band at 0.20% + 6c and its crossover ticket drops to $13.96. - **Stax's crossover numbers were mislabelled.** What we published was the point where Stax passes flat-rate pricing. We presented it as the point where Stax becomes cheapest overall. Helcim is usually still cheaper there. See [Processor Comparison](/docs/payments/processor-comparison) for the full scenario tables and the verdict for each combination of channel, ticket size and volume. --- ## What isn't ranked here A model that ranks everything is guessing about something. These processors stay out of the cost verdicts on this site, with the reason stated each time. The list is short, because most processors that look quote-only do publish something. What remains: | Processor | Why it's still excluded from a cost verdict | |---|---| | **Checkout.com** | Quote-only, right down to its 1,552-URL sitemap and third-party review coverage. No figure of any kind exists | | **Global Payments** | No rate published anywhere on its site. Its own scale disclosure is "trillions in payments volume", which is not a number you can divide by | | **Nuvei** | No rate published, and it stopped filing in November 2024, so the derived 56 bps blended rate from its final Q2 2024 filing is the last public anchor and is not comparable to anyone else's take rate | | **Adyen** | Adyen labels its own published rates indicative, and requires a minimum monthly invoice whose amount it doesn't publish | | **Worldpay** | Publishes an indicative UK card in GBP. No US rate card exists, and the page doesn't state whether interchange and scheme fees pass through at cost | | **Moneris** | Canadian acquirer, all figures in CAD | | **Stax above $250,000 a year** | Subscription becomes "$199+" with no published ceiling | | **Lightspeed, online only** | Card-present is published at 2.6% + 10c. No online, keyed or card-not-present rate is published anywhere, so only the card-present side can be ranked | | **Clover, through a reseller** | Clover-direct rates are published and rankable. A reseller quote is not, and Clover says so itself: contract terms and fees "can vary based on your service provider" | Now rankable, having previously been on this list: | Processor | What closed the gap | |---|---| | **Stripe** | US rates confirmed from a US connection: 2.9% + 30c online, Terminal 2.7% + 5c | | **Shopify Payments** | US rates confirmed: 2.9% / 2.7% / 2.5% + 30c online, 2.6% / 2.5% / 2.4% + 10c in person, plans $39 / $105 / $399 monthly | | **Square Plus and Premium** | $49 and $149 a month, **per location**. Two locations on Plus is $98, not $49 | | **Toast** | 2.49% Traditional and 3.09% Pay-as-you-Go published on Toast's own shop pages. The + $0.15 fixed component is reported, not published, and is labelled that way everywhere it appears | | **Clover, direct** | 2.3% + 10c restaurant, 2.6% + 10c retail entry plans, 3.5% + 10c keyed and online | | **Lightspeed, card-present** | 2.6% + 10c, US region, USD | For the ones still excluded, the useful output isn't a number we invented. It's the reported range where one exists. Plus what to ask for and what to push toward, which sits on each processor's page. --- ## Reviewing and reproducing this The blend is six multiplications and two additions per profile. Every rate is in the tables above. Every weight is stated. If your business genuinely differs, change the weights and rerun. A B2B supplier taking mostly commercial cards. A bar with a $12 average ticket and almost all debit. The method survives. Only the answer moves. **Sources, all accessed 2 August 2026:** - Visa USA Interchange Reimbursement Fees, effective 18 April 2026, `usa.visa.com`. 877KB PDF, downloadable directly - Mastercard 2026-2027 U.S. Region Interchange Programs and Rates, effective 17 April 2026, `mastercard.com`. Internet Archive snapshot of 16 June 2026, 286KB PDF - Federal Reserve, Regulation II average debit interchange fee data (2024), page last updated 19 December 2025, `federalreserve.gov`. Covered issuers $0.23 on a $48.95 average ticket, exempt issuers $0.51 on $42.27, all issuers $0.34 on $46.32 - Federal Reserve Payments Study, CY2015-24 top-line data, released July 2026, `federalreserve.gov` - Consumer Financial Protection Bureau, The Consumer Credit Card Market Report to Congress, December 2025, `consumerfinance.gov` - Helcim pricing, `helcim.com/pricing` - Stax pricing, `staxpayments.com/pricing` **Review schedule:** both networks republish in April and October. So the model gets re-derived within a month of each release. Next check is **October 2026**. It also gets re-derived the moment the Federal Reserve changes the Regulation II debit cap. That's the single largest input in the blend. The Fed's debit figures are 2024 actuals and update annually. --- ## Related - [What interchange is and what it costs](/docs/payments/reference/interchange) what interchange is and what moves it - [Processor Comparison](/docs/payments/processor-comparison) the scenario tables built on this model - [Total Cost Model](/docs/payments/total-cost-model) the cost components beyond interchange - [Debit Routing](/docs/payments/reference/debit-routing) why the debit share of your mix is worth managing --- ## Debit Routing and Durbin Source: https://paymentsandrisk.com/docs/payments/reference/debit-routing # Debit Routing and Durbin :::info[TL;DR] - The Durbin Amendment capped debit interchange at $0.21 + 0.05% for regulated banks (over $10B assets). That's dramatically cheaper than signature debit at large banks - You must route debit transactions over at least two unaffiliated networks. Route card-present to the cheaper PIN network and you're saving 0.5-1.5% per debit transaction - Small bank debit cards (under $10B assets) are unregulated and cost 0.8-1.0% + $0.15. They aren't much cheaper than a small credit card - Card-not-present debit routing reform (effective July 2023) extended routing choice to online transactions. Ask whether your processor supports least-cost routing online, because plenty don't. Note: an August 2025 court ruling challenged Reg II but was stayed pending appeal, so the cap remains in effect ::: The Durbin Amendment capped interchange on regulated debit cards and required multiple routing options. If you know how to use it, that's 1-2% back on every debit transaction, and most merchants don't. Most merchants don't optimize debit routing. They should. :::note[US-Specific Regulation] The Durbin Amendment and PIN debit routing described on this page apply to **US merchants and US-issued debit cards**. It doesn't travel. In Canada, in-store debit transactions can route through the [Interac network](/docs/payments/payment-methods/cards#canadian-debit-interac) at flat per-transaction fees (~$0.05-0.10). EU debit interchange is capped at 0.2% by the EU Interchange Fee Regulation. See [Card Payments](/docs/payments/payment-methods/cards) for international debit differences. ::: ## What Is the Durbin Amendment? The Durbin Amendment (2010, part of Dodd-Frank) did two things: 1. **Capped interchange** on debit cards from large banks 2. **Required multiple routing options** for debit transactions ### Regulated vs. Unregulated Debit | Category | Definition | Interchange | |----------|------------|-------------| | **Regulated** | Debit from banks with $10B+ assets | Capped at 0.05% + $0.21 | | **Unregulated** | Debit from smaller banks/credit unions | Market rates (~0.8% + $0.15) | **Regulated issuers:** Chase, Bank of America, Wells Fargo, Citi, etc. **Unregulated issuers:** Local banks, credit unions, community banks ### Why This Matters On a $100 regulated debit transaction: - **Regulated rate:** $0.26 (0.05% + $0.21) - **Typical credit rate:** $1.80-2.50 That's $1.50+ savings per transaction on regulated debit. --- ## Debit Networks Explained Every debit card can route through multiple networks. Your choice of network affects cost. ### Network Types | Network Type | Examples | Typical Cost | |--------------|----------|--------------| | **Signature debit** | Visa, Mastercard | Higher | | **PIN debit** | STAR, NYCE, Pulse, Accel | Lower | ### How Cards Have Multiple Networks Every debit card has: - **Primary network:** Visa or Mastercard logo on front - **Secondary network(s):** PIN network logo on back (often STAR, Pulse, NYCE) The Durbin Amendment requires at least two unaffiliated networks per card. ### Routing Decision When a debit card is processed: ```mermaid flowchart LR A[Transaction Starts] --> B{PIN entered?} B -->|Yes| C[Route via PIN networkSTAR, Pulse, NYCE] B -->|No| D[Route via signatureVisa, Mastercard] style A fill:#3b82f6,color:#fff style C fill:#10b981,color:#fff style D fill:#f59e0b,color:#fff ``` **Key insight:** You can often choose which network handles the transaction. --- ## Least-Cost Routing Least-cost routing (LCR) automatically selects the cheapest network for each debit transaction. ### How LCR Works 1. Transaction arrives 2. System identifies available networks on the card 3. System compares interchange + network fees for each 4. Routes to cheapest option ### LCR Savings | Scenario | Without LCR | With LCR | Savings | |----------|-------------|----------|---------| | $100 regulated debit | $0.75 (signature) | $0.30 (PIN) | $0.45 | | $50 regulated debit | $0.40 (signature) | $0.26 (PIN) | $0.14 | On high debit volume, this adds up quickly. ### LCR Requirements To enable LCR: 1. **Processor support:** Not all processors offer LCR 2. **Terminal/gateway capability:** Must support multiple networks 3. **PIN-less debit support:** Routes without requiring PIN entry 4. **Merchant opt-in:** Must be enabled on your account ### PIN-Less Debit Modern LCR doesn't require PIN entry. "PIN-less debit" routes through PIN networks without customer PIN: - Customer taps or swipes - Transaction routes through STAR/Pulse/etc. - No PIN prompt - Lower interchange than signature **Ask your processor:** "Do you support PIN-less debit routing?" --- ## Network Comparison ### Major PIN Debit Networks | Network | Owner | Coverage | Notes | |---------|-------|----------|-------| | **STAR** | Fiserv | Broad | Largest PIN network | | **Pulse** | Discover | Broad | Growing | | **NYCE** | FIS | Regional (Northeast) | Strong in certain regions | | **Accel** | Fiserv | Broad | Part of STAR network | | **Maestro** | Mastercard | Limited US | Stronger internationally | ### Network Economics | Factor | Signature (Visa/MC) | PIN Networks | |--------|---------------------|--------------| | Interchange | Higher | Lower | | Network fees | Higher | Lower | | Processing cost | Lower | May be higher | | Fraud liability | Varies | Merchant typically | ### Total Cost Comparison For a $100 regulated debit transaction: | Component | Signature | PIN Network | |-----------|-----------|-------------| | Interchange | $0.26 | $0.22 | | Network fee | $0.10 | $0.05 | | Switch fee | $0.02 | $0.03 | | **Total** | **$0.38** | **$0.30** | Savings: $0.08 per transaction, or $800 per 10,000 transactions. --- ## Implementation Guide ### Step 1: Assess Your Debit Volume Pull your transaction mix: - What % is debit vs. credit? - What % of debit is regulated vs. unregulated? - What's your average debit transaction size? **Rule of thumb:** If debit is 30%+ of volume, routing optimization matters. ### Step 2: Check Processor Capabilities Ask your processor: 1. "Do you support least-cost routing?" 2. "Do you support PIN-less debit?" 3. "Which PIN networks can you route to?" 4. "What's the additional cost for LCR?" ### Step 3: Enable and Configure If processor supports LCR: 1. Request LCR enablement 2. Configure routing preferences 3. Set fallback rules ### Step 4: Monitor and Optimize Track monthly: - Debit routing breakdown (which networks) - Average cost per debit transaction - Any routing failures --- ## Common Routing Scenarios ### Scenario 1: Retail Store (Card-Present) | Factor | Setting | |--------|---------| | PIN debit available | Yes (terminal has PIN pad) | | Best approach | Prompt for PIN, route to cheapest PIN network | | Expected savings | $0.05-0.20 per transaction | ### Scenario 2: E-Commerce (Card-Not-Present) | Factor | Setting | |--------|---------| | PIN debit available | No (no PIN entry online) | | Best approach | PIN-less debit routing if supported | | Expected savings | $0.05-0.15 per transaction | | Limitation | Not all cards/networks support PIN-less CNP | ### Scenario 3: Recurring Billing | Factor | Setting | |--------|---------| | PIN debit available | No | | Best approach | Use card-on-file, signature network | | Expected savings | Limited for recurring | | Note | PIN networks have restrictions on recurring | --- ## Regulated Debit Identification How to know if a card is regulated: ### BIN-Based Identification Some BINs identify regulated debit: - Processor can flag at authorization - BIN tables indicate issuer size ### Practical Approach You can't always know in advance. Best practice: 1. Enable LCR on all debit 2. Let routing logic optimize per-transaction 3. Monitor results --- ## Challenges and Limitations ### Not All Transactions Route | Limitation | Why | |------------|-----| | **Card doesn't support** | Some cards only have one network | | **Network doesn't support transaction type** | Recurring, CNP restrictions | | **Amount limits** | Some networks have min/max amounts | | **International cards** | May not have US PIN networks | ### Fraud and Chargeback Considerations | Factor | Signature | PIN | |--------|-----------|-----| | **Chargeback rights** | Full | Limited | | **Fraud liability** | Issuer (often) | Merchant (often) | | **Dispute process** | Standard | Network-specific | **Trade-off:** Lower cost may mean higher fraud liability. Measure actual losses. ### Customer Experience PIN entry adds friction: - Slower checkout - Some customers forget PIN - Potential abandonment **Balance:** Savings vs. customer experience. Test and measure. --- ## Regulatory Updates ### Recent Changes - **July 2023:** Federal Reserve extended Durbin routing requirements to CNP transactions (effective date) - **August 2025:** Fifth Circuit Court of Appeals vacated portions of Reg II in a legal challenge; the ruling was stayed pending appeal, so nothing's changed yet and the interchange cap and routing requirements stay in effect during litigation - **Ongoing:** Fed reviews interchange caps periodically ### What to Watch - Interchange cap adjustments - Network routing rule changes - New network entrants --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $50k/mo** | Don't worry about routing. Use flat-rate processor. | | **$50k-$250k/mo** | Ask processor about LCR. May not be worth complexity yet. | | **$250k-$1M/mo** | Enable LCR if available. Monitor monthly. | | **Over $1M/mo** | Full routing optimization. Consider PIN-debit prompting. Measure fraud tradeoff. | --- ## Where This Breaks 1. **Fraud shifts to you.** PIN debit often has lower fraud protections. If you're in a high-fraud category, the savings may not offset losses. 2. **Customer friction.** Forcing PIN entry annoys customers. Measure abandonment before mandating PIN. 3. **Recurring billing complications.** PIN networks have restrictions on recurring. Don't break your subscription billing to save a few cents. --- ## Next Steps **Getting started with debit routing?** 1. [Understand Durbin](#what-is-the-durbin-amendment) - Regulated vs unregulated 2. [Learn network options](#debit-networks-explained) - Signature vs PIN 3. [Assess your volume](#step-1-assess-your-debit-volume) - Is 30%+ debit? **Enabling least-cost routing?** 1. [Check processor support](#lcr-requirements) - Not all offer it 2. [Enable PIN-less debit](#pin-less-debit) - Routes without PIN entry 3. [Monitor results](#step-4-monitor-and-optimize) - Track savings **Weighing trade-offs?** 1. [Know fraud liability shift](#fraud-and-chargeback-considerations) - PIN may shift to you 2. [Consider customer friction](#customer-experience) - PIN entry adds steps 3. [Check scenario fit](#common-routing-scenarios) - Retail vs e-commerce vs recurring --- ## Related Pages - [What interchange is and what it costs](/docs/payments/reference/interchange) - Full interchange guide - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Terminal configuration --- ## E2EE vs P2PE Source: https://paymentsandrisk.com/docs/payments/reference/e2ee-vs-p2pe # E2EE vs P2PE :::info[TL;DR] - Both encrypt card data at the terminal, but only PCI-validated P2PE automatically qualifies you for SAQ P2PE (the simplest PCI assessment available for card-present merchants) - E2EE is a vendor claim; P2PE is a PCI SSC certification - ask your terminal vendor which one they have, not which one they say they have - P2PE-validated solutions reduce your annual PCI assessment from hundreds of questions (SAQ D) to ~33 (SAQ P2PE-HW) - the hardware premium often pays for itself in reduced compliance costs - If you're using Square, Stripe Terminal, or most modern integrated solutions, you likely already have E2EE; ask your assessor whether they'll accept it for PCI scope reduction ::: Both encrypt card data at the terminal. Only one is validated by the PCI SSC and automatically reduces your PCI scope. If you're buying terminals, this distinction can save you thousands in compliance costs. ## The Core Difference | | E2EE | P2PE | |---|------|------| | **Full name** | End-to-End Encryption | Point-to-Point Encryption | | **What it does** | Encrypts card data at terminal | Encrypts card data at terminal | | **Who validates it** | Vendor claims | PCI SSC validates | | **PCI scope reduction** | Maybe, assessor decides | Guaranteed (SAQ P2PE) | | **Device options** | Many | Fewer (must be validated) | | **Cost** | Lower | Higher | **The key:** P2PE is E2EE that's been formally validated by the PCI Security Standards Council. The encryption works the same way, but P2PE comes with proof. --- ## How the Encryption Works Both E2EE and P2PE encrypt card data the moment it enters the terminal: ```mermaid flowchart LR subgraph Terminal["Terminal"] A[Card inserted] --> B[Data encryptedimmediately] end subgraph Transit["In Transit"] B --> C[Encrypted blob] end subgraph Processor["Processor"] C --> D[Decryptionat processor] end style B fill:#22c55e,color:#fff style C fill:#3b82f6,color:#fff ``` **What you never see:** The unencrypted card number. It goes straight from the chip to encrypted ciphertext. Your POS system, your network, your servers never touch raw card data. --- ## PCI Scope Impact This is where P2PE pays for itself. ### Without P2PE (Standard PCI Assessment) Everything that touches or could touch card data is in scope: - Terminals - Network between terminal and server - POS system - Back-office systems with transaction data - Any connected systems **Result:** SAQ D (or full ROC for Level 1), 300+ requirements ### With Validated P2PE Only the P2PE terminal is in scope: - P2PE terminal (validated, managed by solution provider) - That's it **Result:** SAQ P2PE-HW, ~33 requirements ### Scope Comparison | Element | Without P2PE | With P2PE | |---------|--------------|-----------| | Terminals | In scope | Managed by provider | | Network | In scope | Out of scope | | POS software | In scope | Out of scope | | Back-office | In scope | Out of scope | | Vulnerability scans | Required | Reduced | | Penetration tests | Required | May not be required | | SAQ type | D (329 questions) | P2PE-HW (~33 questions) | --- ## What Makes P2PE "Validated" For a solution to be PCI-validated P2PE, it must meet requirements across the entire chain: | Component | Requirement | |-----------|-------------| | **Terminals** | PCI PTS POI validated devices | | **Encryption** | DUKPT or equivalent key management | | **Key injection** | Secure key injection facility (KIF) | | **Decryption** | Hardware Security Module (HSM) at processor | | **Chain of custody** | Documented from manufacture to deployment | | **Provider** | Listed on PCI SSC website | **Check the list:** [PCI SSC Validated P2PE Solutions](https://www.pcisecuritystandards.org/assessors_and_solutions/point_to_point_encryption_solutions) --- ## E2EE: The Unvalidated Option E2EE does the same encryption but without formal validation. ### When E2EE Is Fine | Scenario | Why E2EE Works | |----------|----------------| | **Small merchant, simple setup** | Compliance burden already low | | **Using PayFac (Stripe Terminal, Square)** | PayFac handles most compliance | | **SAQ B or B-IP already** | Limited scope anyway | | **Budget constraints** | P2PE premium not justified | ### When E2EE Is Risky | Scenario | Why You Need P2PE | |----------|-------------------| | **Level 1 merchant** | ROC complexity makes P2PE savings huge | | **Complex network** | Segmentation requirements are hard | | **Multiple locations** | Scope reduction multiplies | | **Regulated industry** | Auditors want validated solutions | --- ## Cost Comparison ### Terminal Costs | Type | Typical Price Range | |------|---------------------| | Basic E2EE terminal | $200-400 | | P2PE validated terminal | $400-800 | | Premium P2PE terminal | $600-1,200 | ### Total Cost of Ownership The terminal premium is often offset by compliance savings: | Cost Element | E2EE | P2PE | |--------------|------|------| | Terminal | $300 | $600 | | Annual PCI assessment | $5,000-20,000 | $1,000-3,000 | | Vulnerability scans | $1,000-3,000/yr | Reduced/none | | Penetration tests | $5,000-15,000/yr | May not apply | | Network segmentation | $2,000-10,000 | Not required | | Staff time | 40-100 hrs/yr | 5-15 hrs/yr | **Break-even:** For most merchants with more than a few terminals, P2PE pays for itself in year one. --- ## Implementation Considerations ### Choosing a P2PE Solution Questions to ask: ``` โ–ก Is the solution on the PCI SSC validated list? โ–ก What terminals are included? โ–ก What's the monthly/annual fee? โ–ก Who manages key injection? โ–ก What's the support model? โ–ก What's the contract term? โ–ก Can I use the terminals if I switch processors? ``` ### Migration from E2EE to P2PE | Step | Consideration | |------|---------------| | **1. Evaluate solutions** | Match to your processor | | **2. Terminal swap** | May need new devices | | **3. Key injection** | Provider handles | | **4. Testing** | Validate transactions work | | **5. Re-assess PCI** | File SAQ P2PE | ### Common Gotchas | Issue | Impact | |-------|--------| | **Mixed environments** | One non-P2PE terminal = full scope | | **Manual key entry** | Keyed transactions may not be covered | | **Solution provider change** | May need terminal swap | | **Terminal tampering** | Breaks P2PE chain | --- ## P2PE Limitations P2PE doesn't cover everything: | Not Covered by P2PE | Why | |---------------------|-----| | **E-commerce** | No terminal involved | | **Keyed transactions** | Manual entry bypasses terminal | | **Stored card data** | P2PE is transit encryption | | **Phone orders** | No terminal | | **Chargebacks/disputes** | Different process | **Mixed environment:** If you have both terminal and e-commerce, you need P2PE for terminals AND separate controls for e-commerce. --- ## Decision Framework ```mermaid flowchart TD A[Do you takecard-present payments?] -->|No| B[P2PE not applicable] A -->|Yes| C{What's yourPCI level?} C -->|Level 1| D[P2PE stronglyrecommended] C -->|Level 2-4| E{Complex networkor many locations?} E -->|Yes| D E -->|No| F{Budget forpremium terminals?} F -->|Yes| D F -->|No| G[E2EE acceptable] style D fill:#22c55e,color:#fff style G fill:#3b82f6,color:#fff ``` ### Quick Decision | Your Situation | Recommendation | |----------------|----------------| | **Single location, simple setup, PayFac** | E2EE is fine | | **Multiple locations** | Consider P2PE | | **Level 1 or 2 merchant** | P2PE recommended | | **Regulated industry (healthcare, finance)** | P2PE recommended | | **Complex network** | P2PE recommended | | **Tight budget, low volume** | E2EE acceptable | --- ## Test to Run **P2PE ROI calculation:** ``` Current annual PCI costs: Assessment/SAQ: $________ Vulnerability scans: $________ Penetration test: $________ Network segmentation: $________ Staff time (hrs ร— rate): $________ Total: $________ P2PE costs: Terminal premium: $________ (one-time) Annual P2PE fee: $________ SAQ P2PE assessment: $________ Total year 1: $________ Total year 2+: $________ Savings: $________ per year after year 1 ``` --- ## Scale Callout | Business Size | Recommendation | |---------------|----------------| | **Single location, under $100k/mo** | E2EE through PayFac is fine | | **2-5 locations** | Evaluate P2PE, likely worth it | | **5+ locations** | P2PE almost certainly saves money | | **Level 1 merchant** | P2PE strongly recommended | | **Franchise** | P2PE simplifies franchisee compliance | --- ## Where This Breaks 1. **Mixed environments.** If any terminal isn't P2PE, your entire card-present environment is in full scope. All or nothing. 2. **Keyed entry.** If staff manually key card numbers (phone orders, terminal issues), those transactions aren't covered by P2PE. 3. **Solution provider lock-in.** P2PE terminals are often tied to specific providers. Switching may require new hardware. 4. **Tampering.** If a P2PE terminal is tampered with, the validation is void. Physical security still matters. --- ## Next Steps **Evaluating P2PE?** 1. Check PCI SSC validated list โ†’ Is your processor's solution listed? 2. Calculate ROI โ†’ Use the template above 3. Ask your processor โ†’ What P2PE options do they support? **Already have terminals?** 1. Check what you have โ†’ E2EE or P2PE? 2. Evaluate migration โ†’ Cost to switch vs. compliance savings 3. Consider at refresh โ†’ Next terminal purchase **Implementing P2PE?** 1. Choose validated solution โ†’ From PCI SSC list 2. Plan deployment โ†’ Terminal swap, training 3. Update PCI assessment โ†’ File SAQ P2PE --- ## See Also - [Terminal Security](/docs/fraud/terminal-security) - Physical and network security - [PCI DSS Compliance](/docs/compliance/pci-dss) - Full PCI requirements - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Choosing terminals - [Card-Present Fraud](/docs/fraud/card-present-fraud) - CP fraud patterns - [Terminal Operations](/docs/operations/terminal-operations) - Day-to-day management --- ## payments/reference/fx-and-settlement.md Source: https://paymentsandrisk.com/docs/payments/reference/fx-and-settlement # FX and Settlement (Operator Field Manual) :::info[TL;DR] - FX markup of 50-150 basis points over mid-market is usually the biggest fee you can't see. Nobody publishes their spread, so ask for it in basis points and don't accept "competitive" as an answer - The published cross-border adders aren't small either. Braintree charges +1% for a card issued outside the US and another +1% for non-USD, Stripe charges +0.8% plus a **2%** currency conversion fee, and PayPal charges +1.50%. Verified 2026-08-02 - Local acquiring beats cross-border on auth rate and on cost once a country passes 10-15% of your volume. Below that, cross-border is fine and you shouldn't bother - DCC lets a customer pay in their home currency at a rate you didn't set and they won't like. It raises disputes - RTP and FedNow are irrevocable. Once it's sent, it's gone, so treat them like cash ::: You took an international order, the money landed, and the deposit came in smaller than your spreadsheet said it would. That gap is almost always FX, and it's almost always invisible, because the spread never shows up as a line item on a statement. The published half of this is knowable in an afternoon. The unpublished half comes down to one question you can ask your processor today, and the numbers below tell you whether the answer you get is reasonable. _Published cross-border and conversion fees below were verified against each vendor's own pricing page on 2026-08-02. Rate cards vary by the country your account is contracted in, so check the page your own processor serves you. FX spread isn't published by anyone and has to be asked for._ ## What Matters - FX markup is usually the biggest silent fee. Ask for the spread against mid-market, in basis points. - Local acquiring beats cross-border on auth and cost once the volume justifies the setup work. - DCC is a bad deal for your customer and it lands in your dispute rate. - Settlement currency and timing drive cash flow. Reserves and holds move more money than basis points do. - RTP and FedNow can't be reversed. Treat them like cash. ## What Cross-Border Actually Costs, As Published These are the adders the processors publish themselves. They sit on top of your normal card rate. | Provider | Cross-border adder | Currency conversion | Source, verified 2026-08-02 | |---|---|---|---| | **PayPal** | +1.50% international | Not separately published | [paypal.com](https://www.paypal.com/us/business/paypal-business-fees) | | **Braintree** | +1% for cards issued outside the US | +1% for non-USD currency | [paypal.com](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | | **Stripe** | +0.8% for international cards | **+2%** currency conversion | [stripe.com/pricing](https://stripe.com/pricing), CAD-served | | **Adyen** | Not published. Interchange++ plus a $0.13 processing fee, so scheme cross-border fees pass through at cost | Not published | [adyen.com/pricing](https://www.adyen.com/pricing) | | Square, Shopify Payments, Helcim, Stax, Checkout.com | Not published | Not published | Ask | Stripe's figures above came off the Canadian rate card. Stripe serves a different page depending on where your account sits, so pull up your own country's pricing before you plug these into a model. The stacking is what catches people. A US merchant on Braintree taking a euro-denominated payment from a European card pays **+2% on top of 2.89% + $0.29**, an effective 4.89% before FX spread. On the Stripe numbers above, an international card converted to your settlement currency is +0.8% and +2%, an effective 5.7% on a 2.9% base. **FX spread is a separate, unpublished cost.** Nobody publishes what they take over mid-market. Directionally it runs 50 to 150 basis points, but that's a planning placeholder, not a verified figure. Ask for it in basis points and get the answer in writing. ## Local vs Cross-Border - Local acquiring gets you better auth rates and a lower spread, but you'll need a local entity and local banking to do it. - Cross-border is faster to launch. You're paying for that speed in cost and in declined orders. - The rule of thumb: once a country is more than 10-15% of volume, go look at local acquiring seriously. - Do the arithmetic before you decide. At Braintree's published +2% for a non-USD international card, a country worth $100K a month is costing you $2,000 a month in adders alone, and that's usually enough to pay for the work. ## RTP/FedNow Irrevocability Warning - A bank push payment can't be clawed back. There's no dispute process to fall back on. - That makes them a magnet for social engineering: business email compromise, invoice redirection, "our bank details have changed." - Use them with counterparties you know, and verify any new bank details out of band. Call a number you already had, not the one in the email. ## Multi-Currency Cash Flow Ops - Decide where conversion happens: at capture, at payout, or at your bank. Pick one deliberately, because the default is whatever your processor does. - Holding balances in a currency is good if you spend in that currency and bad if you always convert later anyway. - Multi-currency payouts complicate your books. Align settlement currency with your ledger currency or your reconciliation will never close cleanly. - See also: [Payout Strategy](/docs/operations/payout-strategy). ## DCC (Dynamic Currency Conversion) - The customer almost always gets a worse rate than their own bank would give them, and some of them notice. Expect complaints and expect a few disputes. - Offer local currency by default. If a customer insists on DCC, let them opt in, but don't push it. ## Ask Your Processor - "What's our FX spread against mid-market, in basis points?" - "Do you charge a cross-border fee and an FX markup together?" - "Can we settle in local currency? What are the payout timings and fees?" - "Can we turn DCC off by default?" - "Do you support local acquiring in [target countries]?" If you get "competitive" or "market rate" back, that's a no. Ask again in writing. ## Where This Breaks - You ignore FX until margins shrink, then spend a quarter working out where the money went. - You run all EU volume as US cross-border. That's an auth-rate loss and an extra fee, at the same time. - You accept RTP or FedNow from someone you don't know, and the loss is permanent. - You go multi-currency without telling your accountant, and nothing reconciles. ## Next Steps **Reducing FX costs?** 1. [Ask for spread in bps](#ask-your-processor) - Not "competitive" 2. [Evaluate local acquiring](#local-vs-cross-border) - If country >10-15% volume 3. [Understand DCC risks](#dcc-dynamic-currency-conversion) - Usually bad for customers **Managing multi-currency cash flow?** 1. [Decide conversion timing](#multi-currency-cash-flow-ops) - At capture, payout, or bank 2. [Align with accounting](#multi-currency-cash-flow-ops) - Settlement currency = ledger 3. [Review payout strategy](/docs/operations/payout-strategy) - Multi-currency details **Handling RTP/FedNow?** 1. [Know irrevocability risk](#rtpfednow-irrevocability-warning) - Can't claw back 2. [Use only with trusted parties](#rtpfednow-irrevocability-warning) - High BEC risk 3. [Verify new bank details](#rtpfednow-irrevocability-warning) - Out-of-band confirmation --- ## Related - [International Payments](/docs/payments/payment-methods/international) - Country-specific methods - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Settlement & Reconciliation](/docs/payments/settlement) - Funding flows - [Payout Strategy](/docs/operations/payout-strategy) - Cash flow optimization - [Going Global](/docs/payments/going-global) - International expansion guide - [Interchange](/docs/payments/reference/interchange) - Fee structures - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - ACH alternatives - [Real-Time Payments](/docs/payments/payment-methods/real-time-payments) - RTP/FedNow - [Reading Statements](/docs/operations/reading-statements) - Fee analysis - [Processor Management](/docs/operations/processor-management) - Acquirer relationships --- ## Gateway Basics Source: https://paymentsandrisk.com/docs/payments/reference/gateway-basics # Gateway Basics :::info[TL;DR] - A gateway connects your website to a processor. It handles data transmission and tokenization, but it doesn't move money - that's the acquirer's job - Most modern processors (Stripe, Square, Shopify Payments) bundle gateway + processing; standalone gateways (Authorize.net, NMI) are only needed when you want to route to multiple processors - Using a hosted gateway (iframe/redirect) takes card data off your server and dramatically reduces PCI scope - this is the right choice for most businesses - Gateway fees ($0.05-$0.30 per transaction) are separate from processing fees when using standalone gateways; bundle solutions hide both in a single rate ::: A gateway connects your website to a processor. It doesn't move money. If your "processor" has a JavaScript snippet you embed on checkout, that's the gateway part. ## Gateway vs. Processor vs. Acquirer These three get confused constantly, and the difference decides who you call when something breaks. ```mermaid flowchart LR subgraph Your["Your Website"] C[Checkout Form] end subgraph GW["Gateway"] G[Secure datatransmission] end subgraph Proc["Processor"] P[Transactionrouting] end subgraph Acq["Acquirer"] A[Merchantaccount] end C -->|Card data| G G -->|Auth request| P P -->|Settlement| A style G fill:#3b82f6,color:#fff style P fill:#8b5cf6,color:#fff style A fill:#22c55e,color:#fff ``` | Component | What It Does | Handles Money? | |-----------|--------------|----------------| | **Gateway** | Securely transmits payment data to processor | No | | **Processor** | Routes transactions, communicates with networks | No (facilitates) | | **Acquirer** | Holds your merchant account, settles funds | Yes | ### Analogy - **Gateway** = The secure mailroom that receives packages and sends them to the right office - **Processor** = The logistics company that routes packages between locations - **Acquirer** = The bank that actually holds and deposits your money --- ## What Gateways Actually Do ### Core Functions | Function | What It Means | |----------|---------------| | **Secure data capture** | Collects card numbers without touching your servers (PCI scope reduction) | | **Encryption** | Encrypts card data for transmission | | **Tokenization** | Replaces card numbers with tokens for storage | | **API interface** | Provides developer-friendly APIs for integration | | **Transaction routing** | Sends transactions to the right processor | ### Common Features | Feature | What It Does | |---------|--------------| | **Hosted checkout** | Pre-built checkout pages you redirect to | | **Embedded forms** | JavaScript forms that run on your site | | **Mobile SDKs** | Native iOS/Android payment integration | | **Webhooks** | Notifications when transactions complete | | **Dashboard** | Transaction reporting and management | | **Fraud tools** | Basic fraud screening (rules, velocity) | --- ## When You Need a Separate Gateway ### You Don't Need a Separate Gateway When: **You use a PayFac like Stripe, Square, or PayPal** These combine gateway + processor + acquirer into one service: - Stripe = Gateway + Processor + Acquirer relationship - Square = Gateway + Processor + Acquirer relationship - PayPal = Gateway + Processor + Acquirer relationship You sign up, integrate their JavaScript, and you're processing. One contract, one dashboard. ### You Need a Separate Gateway When: | Scenario | Why | |----------|-----| | **Multi-processor strategy** | Gateway routes to different processors for failover or optimization | | **Existing acquirer relationship** | You have a merchant account but need modern APIs | | **Processor doesn't have good APIs** | Legacy processor with outdated integration | | **Custom integration needs** | Specific features not available from PayFacs | | **International routing** | Need to route to local acquirers in different countries | --- ## Gateway-Only vs. Full-Stack | Type | What You Get | Examples | |------|--------------|----------| | **Gateway-only** | Just the secure transmission layer. You need a separate processor/acquirer. | Authorize.net, NMI, PayPal Payflow | | **Full-stack** | Gateway + Processor + Acquirer bundled. All-in-one. | Stripe, Square, Adyen, Braintree | ### Trade-offs | Factor | Gateway-Only | Full-Stack | |--------|--------------|------------| | **Complexity** | Higher (multiple vendors) | Lower (one vendor) | | **Flexibility** | Higher (choose processor) | Lower (locked in) | | **Pricing** | Potentially lower (negotiate each layer) | Fixed or bundled | | **Support** | Multiple contacts | Single contact | | **Switching** | Can switch processor, keep gateway | Switching is all-or-nothing | --- ## Common Gateway Configurations ### Configuration 1: All-in-One (Most Common) ``` You โ†’ Stripe (Gateway + Processor + Acquirer relationship) ``` **Best for:** Most SMBs. Simple, fast to start, good enough pricing. ### Configuration 2: Gateway + Processor ``` You โ†’ Authorize.net (Gateway) โ†’ First Data (Processor/Acquirer) ``` **Best for:** Existing processor relationship with outdated APIs. ### Configuration 3: Multi-Processor Through Gateway ``` You โ†’ Spreedly (Gateway) โ†’ Processor A (primary) โ†’ Processor B (failover) โ†’ Processor C (international) ``` **Best for:** High-volume merchants needing redundancy or routing optimization. ### Configuration 4: Payment Orchestration ``` You โ†’ Primer/Spreedly โ†’ Multiple processors + payment methods โ†’ Routing rules โ†’ Failover โ†’ Analytics ``` **Best for:** Complex needs, multiple markets, high volume. --- ## Popular Gateways Compared ### Full-Stack (Gateway + Processor) All rates below verified against each vendor's own pricing page on 2026-08-02. | Gateway | Best For | Published rate | Notes | |---------|----------|----------------|-------| | **Stripe** | Most online businesses | **2.9% + 30c** domestic; Terminal 2.7% + 5c card-present | Best APIs, good global coverage. Adds +1.5% on international cards, higher than Braintree's +1% | | **Square** | Retail + online hybrid | **2.6% + 15c** card-present (Free plan); 3.3% + 30c online (Free), 2.9% + 30c (Plus and Premium) | Strong POS, simpler than Stripe. The fixed component is 15c, not the 10c widely quoted | | **Braintree** | PayPal integration | **2.89% + $0.29** cards and digital wallets | Owned by PayPal, good for marketplaces. Same price as Stripe within a penny | | **Adyen** | Enterprise, global | Not published. Interchange++ plus a $0.13 processing fee | No monthly fee, but an unquantified "minimum invoice". No $10M volume floor exists | | **[Checkout.com](/docs/payments/processors/checkout-com)** | Mid-market to enterprise | Not published. Flat-rate or Interchange++, quote only | Strong in Europe | ### Gateway-Only | Gateway | Best For | Notes | |---------|----------|-------| | **Authorize.net** | Legacy integration | Widely supported, older technology | | **NMI** | ISOs and resellers | White-label friendly | | **PayPal Payflow** | PayPal + other processors | Connects to various processors | ### Payment Orchestration | Platform | Best For | Notes | |----------|----------|-------| | **Spreedly** | Multi-processor routing | Vault + routing + analytics | | **Primer** | Modern orchestration | Visual workflow builder | | **Payrails** | Global optimization | Routing optimization focus | --- ## Gateway Fees What gateways charge varies by model: ### Full-Stack Pricing Typically bundled. Published US figures, verified 2026-08-02: - **Per-transaction:** [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees) 2.89% + $0.29; [Square](https://squareup.com/us/en/payments/our-fees) 3.3% + 30c online on the Free plan, 2.6% + 15c in person; [PayPal Checkout](https://www.paypal.com/us/business/paypal-business-fees) 3.49% + $0.49 - **Cross-border:** Braintree +1% for cards issued outside the US and a further +1% for non-USD; PayPal +1.50% international; [Stripe](https://stripe.com/pricing) +0.8% international cards and +2% currency conversion - **Monthly fee:** $0 on Braintree (not published), Square Free and Stripe. Stripe states it "does not charge setup fees, monthly fees, or any other hidden fees" ### Gateway-Only Pricing Separate from processor fees. Authorize.net, NMI and PayPal Payflow don't publish comparable rate cards this site could verify on 2026-08-02. Treat the ranges below as planning placeholders, and get a written quote: - **Per-transaction:** typically $0.05-$0.15 - **Monthly fee:** typically $10-$50 - **Setup fee:** $0-$200 **Total cost = Gateway fee + Processor fee + Interchange** --- ## Integration Considerations ### PCI Scope Reduction Gateways reduce your PCI compliance burden by handling card data: | Integration Type | Card Data Touches Your Server? | PCI Level | |------------------|--------------------------------|-----------| | **Redirect to hosted page** | No | SAQ A (simplest) | | **Embedded iframe** | No | SAQ A-EP | | **JavaScript tokenization** | No | SAQ A-EP | | **Direct API (cards)** | Yes | SAQ D (hardest) | **Recommendation:** Use embedded forms or hosted pages, unless you've got a specific reason to handle cards directly. ### API Quality Matters Gateway API quality varies dramatically: | Factor | Good Gateway | Poor Gateway | |--------|--------------|--------------| | **Documentation** | Clear, complete, examples | Sparse, outdated | | **SDKs** | Multiple languages, maintained | Limited, stale | | **Sandbox** | Full-featured test environment | Limited or broken | | **Webhooks** | Reliable, retries, logging | Unreliable, no retries | | **Error messages** | Specific, tells you what to fix | Generic, unhelpful | ### Switching Gateways What breaks when you switch: | Element | Impact | |---------|--------| | **Tokens** | Old tokens don't work with new gateway | | **Saved cards** | Must re-collect or migrate | | **Integration code** | Needs rewriting | | **Webhooks** | Different format/structure | | **Reporting** | Different dashboard/exports | **Mitigation:** Some orchestration layers (Spreedly) can vault tokens and abstract gateway changes. --- ## Test to Run **Gateway evaluation checklist:** ``` โ–ก Do they support your current processor (if keeping it)? โ–ก API documentation quality - can a dev understand it? โ–ก Sandbox available and functional? โ–ก What's their uptime SLA? โ–ก Webhook reliability and retry logic? โ–ก What happens to tokens if you switch away? โ–ก Support quality (test with pre-sales question) โ–ก Pricing for your volume and average ticket? ``` --- ## Scale Callout | Volume | Recommendation | |--------|----------------| | **Under $100k/mo** | Full-stack (Stripe, Square). Don't overcomplicate. | | **$100k-$500k/mo** | Still fine with full-stack. Evaluate if specific needs arise. | | **$500k-$2M/mo** | Consider if multi-processor or custom routing would help. | | **Over $2M/mo** | Evaluate orchestration. Multi-processor redundancy matters. | --- ## Where This Breaks 1. **Token portability.** Tokens from one gateway don't work at another. Switching means re-collecting cards or complex migration. 2. **Feature assumptions.** Not every gateway supports every feature, and the gaps aren't obvious until you hit one. Check partial captures, auth holds, 3DS2 and network tokens. 3. **International support.** "Global coverage" varies. Check specific countries and payment methods you need. 4. **Downtime cascades.** If your full-stack provider goes down, you can't process. Multi-processor setups need orchestration to failover. --- ## Next Steps **Just starting out?** Pick a full-stack provider and integrate their embedded form. See [Buying Payments](/docs/payments/buying-payments). Don't overthink it, because you can switch later. **Evaluating gateways?** Write down the features, countries and payment methods you actually need. Then test the sandbox before you commit to anything. Check the pricing at your volume too, since it varies a lot. **Already have one?** Map your stack against the [Payment Ecosystem](/docs/payments/payment-ecosystem). If your volume or your markets have changed, orchestration may now be worth it. --- ## See Also - [Payment Ecosystem](/docs/payments/payment-ecosystem) - How all the pieces fit - [Provider Types](/docs/payments/reference/provider-types) - Gateway vs ISO vs PayFac - [Buying Payments](/docs/payments/buying-payments) - Choosing a processor - [Processor Comparison](/docs/payments/processor-comparison) - Comparing options - [PCI DSS Compliance](/docs/compliance/pci-dss) - PCI scope and gateways - [Authorization & Capture](/docs/payments/auth-and-capture) - Transaction mechanics - [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) - Switching playbook --- ## The Biggest Fee on Every Card Sale (Interchange) Source: https://paymentsandrisk.com/docs/payments/reference/interchange # The Biggest Fee on Every Card Sale (Interchange) :::info[TL;DR] - **What you actually pay, blended:** about **0.89% + $0.158 card-present** and **1.36% + $0.152 online** on a typical US card mix. That's the site's own derived blend, and [the arithmetic is published](/docs/payments/reference/cost-model-assumptions) - **What one card costs:** anywhere from **0.05% + $0.21** on regulated debit to **3.15% + $0.10** on a non-qualified penalty rate. Two different questions, two different numbers - **No US merchant's blend starts at 1.5%.** Debit is 63% of US card transactions by count. Most of it's federally capped at about 24 cents on a $46 sale. Any page quoting "1.5% to 3.5%" is quoting the credit sub-range and dropping most of your transactions - You can't negotiate interchange directly, but you can influence which rate applies: card type, data quality (Level 2/3), authorization method, and settlement timing all affect your rate - A rewards or commercial card costs 1 to 3 points more than a regulated debit card on the same sale. On a $50 sale that's about $0.24 versus about $1.60. Your customer picks which one you get - Interchange downgrades are the most common source of overpayment. That's when you're charged a higher rate than you expected. Look for "non-qualified" or "downgraded" line items on your statement ::: Interchange is the fee your bank pays the cardholder's bank every time someone pays you by card. It's the largest component of card processing costs. Card networks set it, and [acquirers pay it to issuers](/docs/payments/payment-ecosystem). It gets passed through to you on your bill. You can't negotiate interchange directly, but you can influence which rates apply. Know how interchange works and you'll spot where you're overpaying. You'll also see what you actually control. ## What Is Interchange? Interchange is a fee your bank pays the cardholder's bank. That's the acquirer paying the issuer, on every card transaction. It compensates issuers for: - **Float:** Issuer pays merchant before collecting from cardholder - **Credit risk:** Cardholder might not pay their bill - **Fraud risk:** Unauthorized transactions - **Rewards programs:** Cash back, miles, points - **Operating costs:** Card issuance, customer service, fraud monitoring ### Who Sets Interchange? Card networks (Visa, Mastercard, etc.) publish interchange schedules. Individual issuers don't negotiate rates. The network sets categories based on: - Card type (debit, credit, rewards, commercial) - Merchant category (MCC) - Transaction type (card-present vs card-not-present) - Data quality (AVS, CVV, Level 2/3) - Processing method (chip, swipe, keyed) ### Your Total Processing Cost ``` Total Cost = Interchange + Assessments + Processor Markup ``` | Component | Typical cost | Who Sets It | Negotiable? | |-----------|-----------|-------------|-------------| | **Interchange** | 0.89% + $0.158 in person, 1.36% + $0.152 online (blended) | Networks | No | | **Assessments** | Not published. Assumed 0.14% + $0.02 | Networks | No | | **Processor markup** | 0.1-0.5%+ | Processor | Yes | That interchange row is a blend covering a normal US card mix, not any one card's rate. It's built off Visa's US schedule of 18 April 2026 and Mastercard's of 17 April 2026, with Federal Reserve transaction counts setting the weights. Change a weight in [the full derivation](/docs/payments/reference/cost-model-assumptions) and rerun it. **Interchange is the biggest single line, but it isn't 90% of your bill.** Take a $50 card-present ticket on interchange-plus pricing and it's about 62% of what you pay: $0.60 interchange, $0.09 assessments, $0.28 markup. On flat-rate pricing the share is lower because your processor keeps more of the spread. Optimize here first anyway, since it's the biggest line. --- ## Interchange Rate Categories ### By Card Type This is the spread that "interchange is 1.5% to 3.5%" was reaching for, and the real one is much wider than that. US domestic only, Visa and Mastercard only. | Card Type | Card-present | Online | Why | |-----------|--------------|--------|-----| | **Regulated debit** | 0.05% + $0.21 | 0.05% + $0.21 | A federal cap, not a network price. Identical on both networks | | **Exempt debit** | 0.70-0.80% + $0.15 | 1.65% + $0.15 | Issuers under $10 billion in assets aren't capped | | **Credit, no rewards** | 1.51% + $0.10 | 1.89% + $0.10 | The floor for consumer credit | | **Credit, rewards** | 1.65-2.10% + $0.10 | 2.05-2.50% + $0.10 | Rewards get funded out of interchange | | **Credit, premium** | 2.30% + $0.10 | 2.60% + $0.10 | Visa Infinite and Mastercard World Elite. Both networks publish the same number | | **Small business** | around 2.10% + $0.10 | 2.79% + $0.10 | Visa Business Product 2 and its Mastercard equivalents | | **Commercial, corporate, purchasing** | 2.50-3.00% + $0.10 | 2.50-3.00% + $0.10 | The B2B band. Level 2/3 data is worth real money here | | **Non-qualified** | 3.15% + $0.10 | 3.15% + $0.10 | A penalty for failing qualification. Not a price to budget for | **Sources:** Visa USA Interchange Reimbursement Fees, effective 18 April 2026. Read straight off `usa.visa.com`. Mastercard 2026-2027 U.S. Region Interchange Programs and Rates, effective 17 April 2026, from the Internet Archive. Both verified 2 August 2026. Each network republishes in April and October, so check again after October 2026. Four caveats. - **The regulated debit line is $0.21, plus a penny.** Regulation II sets it at $0.21 + 0.05% of the sale. Add a $0.01 fraud-prevention adjustment for issuers that certify. Not every issuer does. That's why you'll see $0.21 and $0.22 quoted for the same thing. - **Small-business cards aren't commercial cards.** Visa's small-business Product 2 tier sits around 2.10% card-present. That's well below the corporate and purchasing band. Don't budget one at the other's rate. - **3.15% is a punishment, not a price.** It's what you pay when a transaction fails qualification. Treating it as the top of a normal range is how "up to 3.5%" gets into circulation. - **There's no International row here, and the 1.80-2.40% you'll find elsewhere isn't sourced from these schedules.** US domestic tables don't cover cross-border interchange at all. That lives in Visa's separate interregional guide, so any cross-border figure quoted alongside domestic ones has come from somewhere else. :::note[Where "3.5% interchange" comes from] 3.5% appears nowhere in either network's published US schedule. Above 3.00%, Visa tops out at 3.15% + $0.10 and Mastercard at 3.30% + $0.10, on small business Standard at Level 5. Nothing either network publishes reaches 3.5%. 3.5% is a *processor's* keyed-entry price. Clover publishes 3.5% + 10c keyed and Square publishes 3.5% + 15c keyed, so somebody copied a merchant discount rate into an interchange table and it spread from there. It's a fast test for whether a fee-comparison page did any primary research. ::: ### Which number is yours Card type is the dominant variable. Most fee articles hide it. Find yourself here: | If your volume is mostly | Read this as your interchange | Because | |---|---|---| | **Debit, retail, small tickets** | Well under 1% | Regulated debit is 24 cents on a $46 sale, whatever the percentage says | | **Consumer credit, in person** | 1.51% to 2.30% + $0.10 | This is the range "1.5% to 2.5%" was actually describing | | **Consumer credit, online** | 1.89% to 2.60% + $0.10 | Online runs 0.4 to 0.5 points above card-present on the same card | | **B2B, commercial and purchasing cards** | 2.50% to 3.00% + $0.10 | And Level 2/3 data is worth real money to you. [See below](#level-2-and-level-3-processing) | | **A normal mix of all of it** | 0.89% + $0.158 in person, 1.36% + $0.152 online | That's the blend, and it's the number most SMBs should budget on | The same $50 sale costs about $0.24 on regulated debit and about $1.60 on a commercial card, so a debit-heavy coffee shop doesn't pay what a B2B supplier pays. No single number describes both. ### By Transaction Type | Transaction Type | Rate Impact | Why | |------------------|-------------|-----| | **Card-present (chip)** | Lowest | Most secure | | **Card-present (contactless)** | Low | Secure, fast | | **Card-present (swipe)** | Medium | Less secure than chip | | **Card-not-present** | Highest | Highest fraud risk | | **Keyed/manual** | Highest | No card verification | ### By Merchant Category (MCC) | Category | Typical Rate | Why | |----------|--------------|-----| | **Grocery** | Lower | Thin margins, high volume | | **Gas stations** | Lower | Competitive market | | **Utilities** | Lower | Essential services | | **Retail** | Medium | Standard risk | | **Restaurants** | Medium | Standard risk | | **E-commerce** | Higher | Higher fraud | | **High-risk MCCs** | Highest | Elevated fraud/chargebacks | --- ## Interchange Qualification Transactions "qualify" for different interchange tiers based on how they're processed, and missing the requirements means higher rates. This is the cheapest money on the page. AVS, CVV and a same-day batch cost you nothing, and they close three of the five downgrade causes below. ### Qualification Levels | Level | Rate | Requirements | |-------|------|--------------| | **Qualified** | Lowest | All requirements met | | **Mid-qualified** | Medium | Most requirements met | | **Non-qualified** | Highest | Requirements not met | ### What Causes Downgrades | Issue | Downgrade Impact | Fix | |-------|------------------|-----| | **Missing AVS data** | +0.3-0.5% | Always submit address | | **Missing CVV** | +0.2-0.4% | Always collect CVV | | **Late settlement** | +0.3-0.5% | Batch same day | | **Wrong transaction type** | Varies | Use correct codes | | **Missing Level 2/3 data** | +0.75% on commercial cards | Submit enhanced data | ### Qualification Checklist For every transaction: - [ ] Submit billing address for AVS - [ ] Submit CVV for CNP transactions - [ ] Batch within 24 hours of authorization - [ ] Use correct transaction type indicators - [ ] Include tax amount (for Level 2) --- ## Level 2 and Level 3 Processing Enhanced data levels reduce interchange on B2B transactions. ### Level 2 Data Required fields: - Tax amount - Customer code/PO number - Merchant postal code **Savings: 0.75 points** on a small business credit card. Mastercard prices Data Rate I at 2.65% + $0.10 and Data Rate II at 1.90% + $0.10. Visa's Business Product 1 and 2 match it exactly. The gap holds at every card tier. [Full tables](/docs/payments/reference/b2b-commercial#what-the-schedules-actually-say) ### Level 3 Data All Level 2 plus: - Line item details (description, quantity, unit cost) - Product codes - Freight/shipping amounts - Duty amounts **Savings: 0.80 to 0.95 points vs Level 1**, on corporate and purchasing cards only. Visa moves those from 2.70% to 1.75%. Small business credit has no Level 3 rate at either network ### Who Benefits from Level 2/3? | Business Type | Level 2/3 Value | |---------------|-----------------| | **B2B sellers** | High (commercial cards common) | | **Government vendors** | High (purchasing cards) | | **Wholesalers** | High | | **Consumer retail** | Low (few commercial cards) | | **Consumer e-commerce** | Low | ### Implementation Most processors support Level 2/3 data. Check: 1. Does your processor accept Level 2/3? 2. Can your POS/gateway transmit the fields? 3. What % of your transactions are commercial cards? **ROI calculation:** ``` Annual B2B volume ร— Commercial card % ร— 0.5% savings = Annual savings Example: $1M ร— 40% ร— 0.5% = $2,000/year ``` --- ## Interchange Optimization Strategies ### 1. Encourage Debit Regulated debit costs 0.05% + $0.21. Consumer credit runs 1.51% to 2.30% + $0.10 in person, and 1.89% to 2.60% + $0.10 online. | $100 card-present sale | Rate | Interchange | Versus regulated debit | |------------------|------|-------------|------------------------| | Regulated debit | 0.05% + $0.21 | $0.26 | - | | Exempt debit | 0.80% + $0.15 | $0.95 | +$0.69 | | Rewards credit | 1.65% + $0.10 | $1.75 | +$1.49 | | Premium credit | 2.30% + $0.10 | $2.40 | +$2.14 | **Tactics:** - PIN debit option at checkout - Debit-first button order - Cash discount programs ### 2. Reduce Card-Not-Present Rates CNP transactions pay higher interchange, so convert to card-present wherever the business allows it: | Channel | Rate Premium | |---------|--------------| | Card-present chip | Baseline | | Card-not-present | +0.3-0.5% | | Keyed entry | +0.5-1.0% | **Tactics:** - In-store pickup with card-present payment - Mobile POS for service businesses - Payment terminals for recurring (where compliant) ### 3. Qualify All Transactions Ensure no unnecessary downgrades: - Always submit AVS/CVV - Batch daily (not weekly) - Use correct MCC - Include tax amounts ### 4. Implement Level 2/3 for B2B If more than 20% of volume is commercial cards: - Enable Level 2 data (low effort) - Consider Level 3 for large B2B volume ### 5. Review Card Mix Understand your card mix: | Card Type | % of transactions (example) | Card-present rate | |-----------|-------------|--------------| | Regulated debit | 25% | 0.05% + $0.21 | | Exempt debit | 15% | 0.80% + $0.15 | | Credit, no rewards | 5% | 1.51% + $0.10 | | Rewards credit | 40% | 1.65% + $0.10 | | Premium credit | 10% | 2.30% + $0.10 | | Commercial | 5% | 2.50% + $0.10 | Weight by transaction count, not by dollars. Weighting by dollar value over-weights credit, which carries bigger tickets, and it mishandles the fixed cent component, because a $0.21 debit fee is charged per transaction, not per dollar. **A rewards-heavy or commercial-heavy mix costs you more, and you mostly can't shift it.** Your customer picks the card, so budget on the mix you actually have rather than the one you'd prefer. --- ## Interchange-Plus Pricing ### What It Is Processor passes through exact interchange + adds fixed markup. ``` Your cost = Interchange (varies by card) + Markup (fixed) Example, card-present blend: 0.89% + $0.158 interchange + 0.40% + $0.08 markup = 1.29% + $0.238 ``` ### Why It's Better | Pricing Model | Transparency | Best For | |---------------|--------------|----------| | **Interchange-plus** | Full | Most merchants | | **Tiered/bundled** | Low | Processor (not you) | | **Flat rate** | Simple | Very small volume | Interchange-plus is what makes the markup visible, and a visible markup is the only kind you can negotiate. At very small volume the simplicity of a flat rate is worth the spread. Tiered isn't a third option. It's the one to walk away from. ### What to Ask Your Processor 1. "Can you show me exact interchange on my statement?" 2. "What is your markup over interchange?" 3. "Are there any other fees beyond interchange + markup?" --- ## Reading Your Interchange Statement ### What to Look For | Line Item | What It Means | |-----------|---------------| | **VS CPS RETAIL DEBIT** | Visa card-present retail debit rate | | **VS CPS E-COMMERCE** | Visa card-not-present rate | | **MC MERIT III** | Mastercard high-qualification rate | | **EIRF** | Electronic interchange reimbursement fee (downgraded) | | **Standard** | Non-qualified rate (worst) | ### Red Flags - High percentage of "Standard" or "EIRF" transactions - Downgrades you can't explain - Interchange categories you don't recognize ### Monthly Interchange Audit 1. Pull interchange breakdown from processor 2. Calculate average rate by card type 3. Identify highest-cost categories 4. Check for unexpected downgrades 5. Calculate effective rate (total fees / total volume) --- ## Network-Specific Notes ### Visa - Publishes rates semi-annually (April, October) - CPS (Custom Payment Service) rates for qualified transactions - EIRF (Electronic Interchange Reimbursement Fee) for downgrades ### Mastercard - Publishes rates semi-annually - Merit rates for qualified transactions - Standard rates for non-qualified ### American Express - Different model (often direct acquiring) - Rates not publicly published - OptBlue program for third-party acquiring - Generally higher than Visa/MC ### Discover - Similar structure to Visa/MC - Smaller market share - Competitive rates to gain acceptance --- ## Interchange by Country The interchange rates on this page are US rates. Interchange varies significantly by country and region. ### Key Differences | Region | Consumer Credit Cap | Consumer Debit Cap | Who Sets It | |--------|--------------------|--------------------|-------------| | **United States** | No cap. Published 1.51-3.15% + $0.10 by card type; typical blend under 1.5% | Durbin: 0.05% + $0.21 (regulated banks) | Card networks (Visa, MC) | | **Canada** | No cap (market rates: ~1.4-2.0%) | Interac in-store: ~$0.05-0.10 flat; Visa/MC debit: market rates | Card networks + Interac | | **European Union** | Capped at 0.30% | Capped at 0.20% | EU Interchange Fee Regulation (2015) | | **United Kingdom** | Capped at 0.30% (domestic) | Capped at 0.20% (domestic) | Retained EU law (PSR enforces) | | **Australia** | Capped at 0.50% (weighted avg) | Varies | Reserve Bank of Australia | ### Why This Matters - **EU merchants pay much less interchange** than US merchants. A US merchant pays 1.65% on a consumer rewards credit card. In the EU the same card type is 0.30%. - **Canadian merchants** get Interac debit at flat per-transaction fees in store. Credit card interchange is close to US levels. Visa Debit and Mastercard Debit in Canada follow market rates. Those are similar to US rates. - **Cross-border transactions** ignore domestic caps. A US merchant selling to an EU customer pays US interchange. Or worse, cross-border rates. - Seen "1.2% processing" advertised by a global processor? Check whether that's a domestic EU rate. It won't apply to US transactions. More on international costs: [Processor Comparison](/docs/payments/processor-comparison#the-geography-gap-us-vs-eu) and [Going Global](/docs/payments/going-global). --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Use flat-rate processor. Don't overthink interchange. | | **$100k-$500k/mo** | Switch to interchange-plus. Review monthly. | | **$500k-$2M/mo** | Optimize qualification. Consider Level 2. Negotiate markup. | | **Over $2M/mo** | Full interchange analysis. Level 2/3. Payment consultant may help. | --- ## Where This Breaks 1. **Chasing debit when customers want credit.** Forcing debit can hurt conversion, and a lost sale costs far more than the $1.49 you'd have saved on a $100 rewards-card ticket. Nudge, don't block. 2. **Over-optimizing small volume.** Spending 10 hours to save $50/month isn't worth it. Focus effort where volume justifies it. 3. **Processor games.** Some processors quote low interchange but add hidden fees elsewhere, so compare total effective rate, not just interchange. --- ## Next Steps **Understanding your interchange?** 1. [Learn rate categories](#interchange-rate-categories) - Card type, transaction type, MCC 2. [Check qualification levels](#interchange-qualification) - What causes downgrades 3. [Run monthly audit](#monthly-interchange-audit) - Pull breakdown, find issues **Reducing costs?** 1. [Follow optimization strategies](#interchange-optimization-strategies) - Five tactics 2. [Implement Level 2/3 for B2B](#level-2-and-level-3-processing) - If 20%+ commercial 3. [Avoid downgrades](#what-causes-downgrades) - AVS, CVV, same-day batch **Getting better pricing?** 1. [Switch to interchange-plus](#interchange-plus-pricing) - Transparency 2. [Know what to ask](#what-to-ask-your-processor) - Three key questions 3. [Review statement](#reading-your-interchange-statement) - Spot red flags --- ## Related Pages - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - Where the blended rate comes from, weight by weight - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Settlement & Reconciliation](/docs/payments/settlement) - Fee waterfall - [B2B Commercial](/docs/payments/reference/b2b-commercial) - Level 2/3 details - [Debit Routing](/docs/payments/reference/debit-routing) - Durbin and routing - [Card Payments](/docs/payments/payment-methods/cards) - Card types and economics - [Reading Statements](/docs/operations/reading-statements) - Understanding your costs - [Processor Management](/docs/operations/processor-management) - Negotiating rates - [Auth Optimization](/docs/payments/auth-optimization) - Improving approvals - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification for qualification - [Benchmarks](/docs/reference/benchmarks) - Industry rate comparisons --- ## Payment Provider Types Source: https://paymentsandrisk.com/docs/payments/reference/provider-types # Payment Provider Types :::info[TL;DR] - PayFac (Stripe, Square) makes you a sub-merchant on their master account. Fastest onboarding, no underwriting. They can also freeze your funds with little notice - A direct merchant account is your own relationship with an acquiring bank. Slower setup, real underwriting. More control, and better recourse when something breaks - ISO and acquirer get confused constantly. An ISO resells merchant services and owns no settlement. An acquirer owns the bank relationship and the risk - Merchant of Record services like Paddle take tax remittance, compliance and chargebacks off your plate. For digital goods sold internationally, the 5-6% is often worth it ::: Gateway, processor, ISO, PayFac, acquirer, PSP, MoR. Vendors swap these terms around to sound sophisticated, and they use them wrong. Here's what each one means and which ones matter to you. :::info[CP vs CNP] Most provider types work for both card-present and card-not-present. CP needs terminal hardware, bundled or separate. CNP is software only. Merchant of Record is CNP only. ::: ## The Short Version | If You're... | You Probably Need | Examples | |--------------|-------------------|----------| | **Starting out, under $100K/mo** | PayFac (aggregator) | Stripe, Square, PayPal | | **Growing, $100K-$1M/mo** | PayFac OR ISO + processor | Stripe, or ISO referral to direct processor | | **Established, $1M+/mo** | Direct processor relationship | Adyen, Worldpay, direct to acquirer | | **Selling globally, want tax handled** | Merchant of Record | Paddle, FastSpring, Gumroad | | **High-risk or complex** | Specialist ISO | Industry-specific ISOs | --- ## The Players Explained ### Payment Gateway Software that securely moves payment data from your checkout to a processor. **What it does:** - Encrypts card data - Routes transactions to the processor - Returns approve/decline responses - May provide tokenization **Think of it as:** The secure tunnel between your website and the payment network. **Examples:** Authorize.net, Braintree (gateway function), NMI **Do you need to think about this separately?** No. Modern PayFacs and processors bundle the gateway. You only think about it separately on a legacy stack, or when you need gateway-level customization. --- ### Payment Processor The company that actually runs the transaction with the card networks. **What it does:** - Communicates with Visa, Mastercard, etc. - Routes transactions to the right issuing bank - Handles authorization and settlement - Manages the money flow **Think of it as:** The engine that makes the payment actually happen. **Examples:** Fiserv (First Data), Worldpay, TSYS, Adyen, Stripe (processor function) **Relationship to gateway:** The processor needs a gateway to receive your transactions. Many bring their own. Some don't, and then you bolt on a third party. --- ### Acquiring Bank (Acquirer) The bank that holds your merchant account. It takes in funds from the card networks on your behalf. **What it does:** - Underwrites your merchant account - Takes on risk for your transactions - Receives settlement from card networks - Deposits funds to your bank account **Think of it as:** The bank behind your ability to accept cards. **Examples:** Wells Fargo Merchant Services, Chase Paymentech, Elavon **Relationship to processor:** The acquirer is the financial institution. The processor is the technology. Sometimes one company, sometimes two. You never deal with the acquirer directly. Your processor or ISO handles that. --- ### ISO (Independent Sales Organization) A company that resells payment processing from acquirers and processors. **What it does:** - Sells merchant accounts on behalf of acquirers - Provides customer service and support - May bundle additional services (terminals, software) - Earns a spread on processing fees **Think of it as:** A reseller/broker for payment processing. **Why they exist:** Acquirers and processors don't want to sell to every small business directly. ISOs handle sales, onboarding, and support for smaller merchants. **Examples:** Payment Depot, Dharma Merchant Services, thousands of smaller ISOs **When to use an ISO:** - You want someone to shop rates for you - You need industry-specific expertise - You want local/personal service - You're in a niche that needs specialist underwriting **Watch out for:** Quality varies wildly. Some ISOs are excellent and earn their spread. Others are middlemen who add fees. Always compare the ISO's all-in rate against going direct. --- ### PayFac (Payment Facilitator) / Aggregator A company that processes for many merchants under one master merchant account. **What it does:** - Onboards you instantly (no traditional underwriting) - You're a "sub-merchant" under their account - They handle compliance, risk, and payouts - Flat-rate pricing. Published US examples, verified 2026-08-02: [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees) 2.89% + $0.29 online, [Square](https://squareup.com/us/en/payments/our-fees) 2.6% + 15c in person and 3.3% + 30c online on the Free plan, [PayPal Checkout](https://www.paypal.com/us/business/paypal-business-fees) 3.49% + $0.49 **Think of it as:** A shortcut to accepting payments without your own merchant account. **Examples:** Stripe, Square, PayPal, Shopify Payments **Pros:** - Instant setup (minutes, not weeks) - No underwriting paperwork - Simple pricing - Built-in fraud tools **Cons:** - Higher rates than direct processing - Less control over holds/reserves - Account stability risk (the "PayPal freeze") - Volume caps ($1M-$10M/year before you need to graduate) **The PayFac model:** Stripe doesn't give you a merchant account. They give you access to theirs. You're one of millions of sub-merchants riding Stripe's relationship with its acquirer. That's why setup is instant. It's also why you have less control. --- ### Merchant of Record (MoR) A company that becomes the legal seller of your product. It handles payments, taxes and compliance. **What it does:** - They sell your product (legally) - They collect payment from customers - They handle sales tax, VAT, compliance - They pay you a royalty minus their fees **Think of it as:** Outsourcing your entire commerce operation, not just payments. **Examples:** Paddle, FastSpring, Gumroad, Lemon Squeezy **How it's different from PayFac:** | | PayFac | Merchant of Record | |---|--------|-------------------| | **Who sells?** | You | They do | | **Sales tax/VAT?** | Your problem | Their problem | | **Chargebacks?** | Your problem | Often their problem | | **Customer relationship?** | Direct | Through them | | **Pricing control?** | You set | Some restrictions | **When MoR makes sense:** - Selling internationally (they handle 100+ country tax compliance) - Selling software/digital goods (their specialty) - Small team, don't want back-office complexity - Value simplicity over margin optimization **When MoR doesn't make sense:** - Physical goods with complex fulfillment - High volume where fees hurt margins - You need direct customer billing relationship - You want maximum control over checkout UX **Typical MoR fees:** 5-15% of revenue (much higher than PayFac, but includes more) --- ### PSP (Payment Service Provider) A catch-all for any company providing payment services. Basically meaningless. **In practice, PSP means:** - A PayFac (Stripe, Square) - A full-stack processor (Adyen) - Sometimes an ISO **When someone says "PSP":** Ask them to be specific. Are they a PayFac? Processor? ISO? The term itself tells you nothing. --- ## How They Relate ``` โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ CARD NETWORKS โ”‚ โ”‚ (Visa, Mastercard, etc.) โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ†‘ โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ ACQUIRING BANK โ”‚ โ”‚ (The bank behind the scenes) โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ†‘ โ”‚ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ โ”‚ โ”‚ โ–ผ โ–ผ โ–ผ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ PROCESSOR โ”‚ โ”‚ ISO โ”‚ โ”‚ PAYFAC โ”‚ โ”‚ (Direct) โ”‚ โ”‚ (Reseller) โ”‚ โ”‚(Aggregator) โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ โ”‚ โ”‚ โ–ผ โ–ผ โ–ผ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ GATEWAY โ”‚ โ”‚ GATEWAY โ”‚ โ”‚ (Built-in) โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ โ”‚ โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ โ”‚ โ–ผ โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ” โ”‚ YOU โ”‚ โ”‚ (Merchant) โ”‚ โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜ ``` --- ## Decision Framework ### Just Starting (Under $50K/mo) **Go with a PayFac.** Stripe or Square for most use cases. - Setup is instant - Pricing is predictable - Focus on your product, not payments - You can switch later when you have leverage ### Growing ($50K-$500K/mo) **Stay with PayFac OR evaluate ISO/direct.** Questions to ask: - Is your current effective rate above 2.7%? - Do you have reserve/hold issues with your PayFac? - Do you need features your PayFac doesn't offer? If yes to any, get competitive quotes. If no, stay put. ### Established ($500K+/mo) **You have negotiating power.** Options: 1. **Negotiate with your current PayFac.** Square's fee page invites custom pricing above **$250,000 a year**. That's about $21K a month, so you're long past it. Stripe publishes no threshold at all, so asking costs nothing 2. **ISO referral** - Get quotes through an ISO 3. **Direct processor** - Adyen, Worldpay, direct acquirer relationship 4. **Price a published interchange-plus provider as your floor.** [Helcim](https://www.helcim.com/pricing/) publishes interchange + 0.25% + 7c in person, + 0.35% + 20c online, at $100K-$500K a month. No monthly fee. Nobody can beat a rate you could sign up for online this afternoon? You've learned something At this volume, 2.9% against 2.3% is real money. On $500K a month that's $3,000. Worth the effort. ### Selling Globally with Tax Complexity **Consider Merchant of Record** if: - You sell to many countries - Sales tax/VAT compliance is overwhelming - You'd rather pay 10%+ and have it handled than build tax infrastructure **Don't use MoR** if: - You have tax expertise in-house - Your margins can't handle 10%+ fees - You need full control over customer billing ### High-Risk or Niche Vertical **Find a specialist ISO.** Generic PayFacs will either: - Decline you outright - Approve you then freeze your account later Specialist ISOs know underwriters who work with your category. They cost more but keep you processing. --- ## Common Misconceptions ### "Stripe is my processor" Stripe is a PayFac. They aggregate merchants under their own processor and acquirer relationships. You're a sub-merchant, not a direct merchant. That's fine. Just know you're one layer removed from the actual processor. ### "I need a gateway" You need payment acceptance. Whether that means a separate gateway depends on your setup. Modern PayFacs bundle it. Separate gateways come up on legacy and enterprise stacks. ### "ISOs are middlemen who add cost" Some are. Good ones shop rates, handle underwriting complexity, and give you support a direct processor won't. Bad ones just add markup. Judge them one at a time. ### "MoR means I lose control" You lose some control, because they're the seller. You gain simplicity. No tax compliance, no chargeback fights. It's a trade, not a win or a loss. --- ## Test to Run If you're unsure about your current setup: 1. **Calculate your all-in effective rate** - Total fees / Total volume 2. **List what's included** - Gateway, fraud tools, tax handling, support 3. **Get one competitive quote** - From a different model (PayFac vs ISO vs direct) 4. **Compare total cost and complexity** - Not just rate A 2.5% rate with no support loses to 2.7% with a real account manager. Ask again when something breaks. --- ## Where This Breaks **High-risk MCCs:** PayFacs won't touch you (adult, CBD, firearms, nutraceuticals). You need a specialist ISO who knows underwriters in your category. Expect higher rates and reserves. **Rapid scaling:** PayFacs freeze accounts when volume spikes without warning. Growing 10x in 6 months? Get ahead of it. Tell them, send documentation, or graduate to direct processing before they notice. **International complexity:** "International support" from a US PayFac means cross-border processing (expensive). True international support means local acquiring in each region (cheaper). Know which you're getting. **Token lock-in:** If you store cards with a PayFac and want to leave, ask about token portability before you sign. Some make it easy. Some make it impossible. --- ## Next Steps **Just starting out?** 1. [Sign up with a PayFac](#payfac-payment-facilitator--aggregator) - Stripe or Square, don't overthink it 2. [Understand your fees](/docs/payments/processor-fees-guide) - Know what you're paying 3. [Monitor your holds](/docs/operations/holds-and-reserves) - Watch for reserve surprises **Outgrowing your PayFac?** 1. [Calculate your effective rate](/docs/operations/reading-statements) - Know your true cost 2. [Get competitive quotes](/docs/payments/buying-payments) - Compare ISO and direct options 3. [Check token portability](#where-this-breaks) - Can you leave with your stored cards? **Going international?** 1. [Evaluate MoR vs local acquiring](/docs/payments/going-global) - Tradeoff analysis 2. Check provider coverage in your target markets 3. Understand FX and settlement timing --- ## Related Resources - [Buying Payments](/docs/payments/buying-payments) - How to select and negotiate - [Processor Fees Guide](/docs/payments/processor-fees-guide) - Understanding fee structures - [Interchange](/docs/payments/reference/interchange) - The base cost that applies to all models - [Processor Management](/docs/operations/processor-management) - Ongoing relationship management - [Holds and Reserves](/docs/operations/holds-and-reserves) - How reserves work across provider types - [Going Global](/docs/payments/going-global) - International considerations - [Reading Statements](/docs/operations/reading-statements) - Understanding what you're paying --- ## Saving Cards Without Storing the Number (Tokenization) Source: https://paymentsandrisk.com/docs/payments/reference/tokenization # Saving Cards Without Storing the Number (Tokenization) :::info[TL;DR] - Tokenization replaces the real card number (PAN) with a non-sensitive token, reducing PCI scope and preventing stored card data from being useful to attackers - Network tokens (issued by Visa/Mastercard) update automatically when a card is replaced or reissued, improving recurring billing auth rates by 2-5% vs. stored PANs - Gateway tokens (issued by your processor) aren't portable between processors. Network tokens can be migrated using token service provider APIs - If you're on Stripe or Square, you're already tokenizing - but you may not be using network tokens yet; ask your processor if they support network tokenization ::: Tokenization replaces a customer's real card number with a meaningless stand-in code that only your processor or the card network can turn back into the original. You're already tokenizing and nobody told you. Take cards through Stripe or Square using their hosted fields, and your database never holds a real card number. That's gateway tokenization. It shrinks your PCI scope, and it makes a stolen database much less useful. The second kind, network tokens, is worth 2-5% on your auth rate. So the question isn't whether to tokenize. It's whether you're getting network tokens too, and what happens to your saved cards the day you switch processors. ## What is Tokenization? **Tokenization** replaces the card number (PAN - Primary Account Number) with a randomly-generated token: | Original | Tokenized | |----------|-----------| | **PAN**: 4111 1111 1111 1111 | **Token**: tok_1Abc23Def456Ghi7 | | Sensitive, reusable | Non-sensitive, single-use or limited-use | **The token maps back to the real card number.** That vault belongs to your processor or the card network. ### Why Tokenization Matters **1. PCI Scope Reduction** - You don't store actual card numbers - Reduces PCI DSS compliance requirements - Lowers breach liability **2. Security** - Stolen tokens are useless (can't be used elsewhere) - Data breaches expose tokens, not cards - Limits damage if your database is compromised **3. Higher Auth Rates** (network tokens only) - Network tokens have 2-5% higher approval rates - Issuers trust network tokens more - Fewer false fraud declines --- ## Types of Tokenization ### Gateway/Processor Tokens **What happens**: Your processor (Stripe, Square, etc.) swaps card numbers for tokens **How it works**: 1. Customer enters card on checkout 2. Card data goes directly to processor (via API or hosted form) 3. Processor stores card, returns token to you 4. You store token, not card number 5. For future charges, you send token to processor **Benefits**: - Reduces PCI scope - Easier compliance (SAQ A vs SAQ D) - Your database doesn't have card numbers **Limitations**: - Tokens only work with that processor - Can't port tokens if you switch processors - No auth rate improvement **Who uses it**: All modern processors (Stripe, Square, Braintree, etc.) --- ### Network Tokens **What happens**: Visa, Mastercard, and Amex swap card numbers for network-specific tokens **How it works**: 1. Customer card โ†’ Gateway token โ†’ Processor requests network token 2. Network (Visa/Mastercard) provisions network token 3. Network token used for authorization 4. Issuer recognizes network token as more secure 5. Higher approval rates result **Benefits**: - 2-5% higher auth rates - Automatic card updates when reissued - Better fraud scoring by issuers - Potential liability shift benefits **Limitations**: - Requires processor support (not all support it) - Additional fees with some processors ($0.01-$0.05/transaction) - Migration from gateway tokens requires work **Who supports it**: - Stripe: Yes (automatic for subscriptions) - Shopify Payments: Yes (automatic) - Adyen: Yes - Square: No (doesn't support network tokens) - PayPal: Limited --- ## Gateway Tokens vs Network Tokens | Feature | Gateway Token | Network Token | |---------|---------------|---------------| | **Created by** | Processor (Stripe, etc.) | Network (Visa, Mastercard) | | **Format** | tok_abc123 (processor-specific) | 4111 11XX XXXX 1111 (looks like card) | | **Portability** | Locked to processor | Locked to card network | | **Auth rate improvement** | None | 2-5% higher | | **Card updater** | Separate service | Built-in (auto-updates) | | **PCI scope reduction** | Yes | Yes | | **Cost** | Included | $0-$0.05/transaction | **Best practice**: Use both - Gateway tokens: For PCI scope reduction - Network tokens: For auth rate improvement **Stripe automatically uses network tokens** for recurring payments when beneficial. --- ## How Tokenization Improves Auth Rates ### Why Issuers Trust Network Tokens **Regular card-on-file transaction**: - Issuer sees: Card number, merchant, amount - Issuer thinks: "Is this fraud? Card was stored somewhere." - Issuer declines: 10-15% of card-on-file transactions **Network token transaction**: - Issuer sees: Network token (cryptographically linked to card) - Issuer thinks: "This token was provisioned securely. Lower fraud risk." - Issuer declines: 5-10% of network token transactions **Result**: 2-5% auth rate improvement from token trust signals. ### Real-World Data | Scenario | Regular Card-on-File | Network Token | Improvement | |----------|---------------------|---------------|-------------| | **Subscription renewal** | 87% approval | 91% approval | +4% | | **Repeat customer** | 89% approval | 93% approval | +4% | | **Card updated by issuer** | Decline (old card invalid) | Auto-updated, approved | Major | **At $1M/month recurring revenue**: - 4% improvement = $40K/month recovered - Network token cost: $0-$500/month - **Net benefit: $39.5K/month** --- ## Token Portability (Lock-In Risk) ### Gateway Tokens Are NOT Portable **If you're on Stripe**: - All your saved customer cards are Stripe tokens - Switch to Braintree? Tokens don't work. - You must re-collect card numbers from customers **That's processor lock-in.** Switching means re-collecting cards from every customer you have. **Migration options**: 1. **Email blast**: "Update your card" (10-30% update rate) 2. **Lazy migration**: Collect new cards as customers transact (takes 6-12 months) 3. **Forced migration**: Require card re-entry (high churn risk) ### Network Tokens Are Somewhat Portable **If your new processor supports network tokens**: - Request token migration through networks - Not all processors support this - Complex process, not always successful **Reality**: Treat all tokens as non-portable. Switching processors = painful card migration. --- ## Tokenization and PCI Compliance ### SAQ Reduction | Setup | SAQ Level | Complexity | |-------|-----------|------------| | **Store card numbers** | SAQ D (300+ questions) | Very complex | | **Use gateway tokens** | SAQ A-EP (150 questions) | Moderate | | **Fully outsourced** | SAQ A (22 questions) | Simple | **Tokenization moves you from SAQ D to SAQ A-EP** (much easier). ### What Tokenization Doesn't Solve Tokenization shrinks your scope. It doesn't erase it. You still need: - Secure transmission (HTTPS/TLS) - Vulnerability scanning - Access controls - Logging and monitoring **It's not a PCI magic bullet.** It's just a much smaller job. **See**: [PCI DSS Compliance](/docs/compliance/pci-dss) for full requirements. --- ## Implementation by Processor ### Stripe **Gateway tokens**: Automatic - Customer cards become `pm_` or `card_` tokens - Stored securely by Stripe - You never see full card number **Network tokens**: Automatic for subscriptions - Stripe requests network tokens when beneficial - No action needed - Included in standard pricing **Migration**: Tokens locked to Stripe --- ### Square **Gateway tokens**: Automatic - Customer cards become Square tokens - Stored in Square system - Card-on-file for recurring **Network tokens**: Not supported - Square doesn't offer network tokenization - No auth rate benefit from network tokens - Card updater is separate service **Migration**: Tokens locked to Square --- ### Shopify Payments (Stripe-powered) **Same as Stripe**: - Gateway tokens automatic - Network tokens automatic - Full Stripe tokenization features --- ### Adyen **Both supported**: - Gateway tokens included - Network tokens available - Must be enabled explicitly - May have additional fees --- ## Test to Run **Network token ROI calculator (if available on your processor):** **Week 1: Check eligibility** 1. Are you on Stripe, Shopify, or Adyen? (Yes = network tokens available) 2. Do you have recurring billing or card-on-file? (Yes = network tokens beneficial) 3. What's your current card-on-file auth rate? ____% **Week 2: Estimate impact** 4. Current decline rate: ____% 5. Expected improvement with network tokens: 2-4% 6. Monthly card-on-file volume: $_____ 7. Recovered revenue: volume ร— decline rate ร— 50% recovery = $_____ **Week 3: Implementation** 8. Enable network tokens in processor dashboard (Stripe: automatic for subscriptions) 9. Monitor auth rate improvement 10. Track recovered revenue **Success criteria**: 2-5% auth rate improvement on card-on-file transactions within 30 days. --- ## Scale Callout **Under $100K/month:** - Gateway tokens sufficient (PCI scope reduction) - Network tokens nice-to-have but not critical - If on Stripe, you get network tokens automatically **$100K-$500K/month:** - Network tokens start mattering - 4% improvement = $4K-$20K/month recovered - Worth optimizing **$500K-$1M/month:** - Network tokens are must-have - If your processor doesn't support, consider switching - ROI is clear ($10K-$40K/month) **Over $1M/month:** - Ensure network tokens are enabled - Monitor network token adoption rate - Optimize for maximum network token usage --- ## Where This Breaks 1. **Not all processors support network tokens**: Square doesn't. Many traditional processors don't. If this matters, choose your processor accordingly. 2. **Token migration is painful**: Switching processors means re-collecting cards. Price that in before you switch. 3. **Network tokens can cost extra**: no processor checked on 2026-08-02 lists a network tokenization fee on its published pricing page, in either direction. That means "it's free" and "it's a cent a transaction" are both unverified claims. Ask your processor directly. Get the answer in writing. Then run the ROI on the real number. 4. **Card updater vs network tokens confusion**: These are different features. Network tokens auto-update as a side benefit, but card updater (CAU) is separate. 5. **PCI scope reduction isn't automatic**: You still need proper implementation. Tokenization helps but doesn't eliminate PCI requirements. --- ## Next Steps **Want to use tokenization?** 1. Check if your processor supports it (Stripe, Shopify, Adyen = yes) 2. Verify it's enabled (usually automatic) 3. Ensure you're not storing raw card numbers anywhere **Want network tokens?** 1. Check processor support (Stripe auto-enables for subscriptions) 2. Calculate potential auth rate improvement 3. Monitor impact on recurring billing auth rates **Switching processors?** 1. Plan for token migration (customers will need to re-enter cards) 2. Read [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) 3. Budget 3-6 months for full customer migration --- ## See Also - [PCI DSS Compliance](/docs/compliance/pci-dss) - How tokenization reduces scope - [Auth Optimization](/docs/payments/auth-optimization) - Network tokens for auth rates - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Card-on-file best practices - [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) - Token migration - [Stripe](/docs/payments/processors/stripe) - Best network token support for SMBs - [Gateway Basics](/docs/payments/reference/gateway-basics) - How gateways handle tokenization --- ## Selling Internationally Source: https://paymentsandrisk.com/docs/payments/selling-internationally # Selling Internationally :::info[TL;DR] - Already on Stripe, Shopify Payments, or PayPal? You can accept international cards today, nothing to set up. You'll just pay higher fees on cross-border. - Cross-border adds roughly 1-2% all in. That's an international-card fee (PayPal charges 1.50%) plus a separate currency conversion fee. Local acquiring removes most of it, but you need a local entity and bank account. - Showing prices in local currency lifts conversion. Set your processor to settle in USD, so you carry no FX exposure. - Add local payment methods (iDEAL, Pix, Alipay) only when a country passes 10% of your revenue. Below that, cards handle most international orders. ::: If you're on Stripe, Shopify Payments, or PayPal, you can already accept international cards, and there's nothing to set up. You'll pay roughly $2 more on a $100 order. For your first few, that's the whole story. ## What Happens When a Foreign Card Pays You A customer in another country enters their card. Your processor handles the whole transaction. They pay in their currency or yours, the processor converts it, and you get USD. No new account, no international bank setup, no paperwork. This is called cross-border processing. Your US processor talks to the card network, which talks to the customer's foreign bank. It works exactly like a domestic transaction. There's just a currency conversion in the middle, and slightly higher fees. The customer's bank may charge them a foreign transaction fee, usually 1-3%. That's their bank's fee, not yours. You don't control it and you don't see it. Some premium cards waive it. That's why customers with travel cards buy more freely from US merchants. ## What It Costs International transactions cost more. Here's a typical breakdown on Stripe-like pricing: | Fee Component | Domestic | Cross-Border | Difference | |---------------|----------|--------------|------------| | Processing fee | ~2.9% + $0.30 | ~3.9% + $0.30 | +1.0% | | Currency conversion | None | ~1% | +1.0% | | **Total per $100 sale** | **~$3.20** | **~$5.20** | **+$2.00** | That extra 1-2% is the whole cost on aggregator pricing. It comes in two parts, and processors publish both. PayPal charges 1.50% on international commercial transactions. Stripe charges a separate international-card fee, then adds a conversion fee if it has to convert. Conversion is the part merchants forget, and it's often the bigger half. Interchange-plus doesn't rescue you here. You pay a higher cross-border interchange rate, then the network adds its own cross-border assessment. Different line items, same landing spot. On a $100 order you're paying roughly $2 more. On $5,000 a month in international sales, that's about $100. For most small businesses, it's worth it. You're making sales you wouldn't otherwise have. Don't let the fee talk you out of the order. :::note Exact fees vary by processor. Check their international or cross-border pricing page for your rates. Some bundle the FX markup into one rate. Others break it out. ::: ## Do I Need to Show Local Prices? It depends on your international volume. **Under $10K/month international:** No. USD pricing is fine. International customers are used to USD, and their bank handles the conversion. Don't add complexity you don't need yet. **$10K-$50K/month from one country:** Consider it. Customers convert better when they see their own currency. Your processor can usually do it automatically: Shopify Markets, Stripe multi-currency. The size of the lift is worth a caveat. The 10-30% figures come from the companies selling multi-currency pricing. Nobody neutral has published a number. So treat it as a real effect of unknown size. A/B test it on your biggest country. Believe your own checkout data over anyone's case study. **Over $50K/month from one country:** Show local prices. The conversion lift pays for the setup many times over. :::warning[Avoid Dynamic Currency Conversion (DCC)] DCC offers to charge the customer in their home currency at checkout, with a markup you control. It sounds helpful. It frustrates customers. The rate is typically 3-8% worse than their bank's. Customers who notice feel ripped off. Don't enable it. ::: ## What About Taxes and Duties? Tax compliance for international sales is its own guide. Here's the high-level version: - **VAT (Value Added Tax)** applies in the EU and UK. Sell digital goods to EU consumers and you likely owe it. Revenue level doesn't matter. - **GST (Goods and Services Tax)** applies in Canada, Australia, and others. Thresholds exist. Canada's is $30,000 CAD. - **Customs duties** apply to physical goods crossing borders. Your customer usually pays on delivery. Surprise duties cause complaints and chargebacks. **For small volumes:** your platform may handle this. Shopify collects and remits taxes in many jurisdictions automatically. Check your platform's international tax settings first. **For real volumes:** talk to an accountant who knows international e-commerce, or use a tax service like Avalara or TaxJar. Getting this wrong creates liability. Getting it right is a solved problem. ## Country-Specific Gotchas Top 5 countries US small businesses sell to, and what to watch for: | Country | Cards work? | Watch out for | |---------|-------------|---------------| | Canada | Yes, standard cards work fine | CAD pricing preferred for repeat customers; PAD rules apply if you do recurring billing | | UK | Yes, standard cards work fine | SCA/3DS authentication may trigger on checkout; GBP pricing helps conversion | | EU (Germany, France, etc.) | Cards work, but... | SCA/3DS is required by regulation; local methods like iDEAL (Netherlands) and Bancontact (Belgium) are preferred in some countries | | Australia | Yes, standard cards work fine | GST considerations if you exceed the threshold; AUD pricing helps for repeat buyers | | Mexico | Cards work, but... | Lower card penetration overall; OXXO (cash voucher) and SPEI (bank transfer) preferred for many local buyers | Selling to Canada, the UK, and Australia? You won't notice much difference from domestic. EU countries run slightly lower authorization rates, because of 3DS. You'll see more "soft declines" that retry successfully. ## Scale Callout :::info[Scale Matters] **Under $10K/month international:** Your processor handles everything. Accept the higher fees. Don't optimize yet. **$10K-$50K/month international:** Show local currency pricing if most orders come from 1-2 countries. Check whether you owe VAT/GST. **$50K-$200K/month international:** Consider adding local payment methods for your biggest market, like iDEAL for the Netherlands. Read [Going Global](/docs/payments/going-global) for the full strategy. **Over $200K/month international:** Time to look at local acquiring, meaning you process through a local entity to cut fees and lift auth rates. See the [Launch New Country](/docs/playbooks/launch-new-country) playbook. ::: ## Where This Breaks At some point cross-border processing stops being good enough. Here's how you know you've outgrown it: - **Auth rates below 80% in one country.** Domestic usually approves at 90%+. If a country sits below 80%, the issuers there are declining you harder. - **Customers asking for payment methods you don't offer.** "Do you accept iDEAL?" "Can I pay with Boleto?" That's demand you're not capturing. - **FX costs eating your margin on one corridor.** Say you're doing $100K/month to the UK at 1-2% in FX fees. That's $1,000-$2,000 a month. At that volume, local acquiring pays for itself. - **High chargeback rates from one country.** Cross-border fraud runs higher than domestic. If one country throws off outsized [chargebacks](/docs/chargebacks), you need country-specific fraud rules. Hit any of these? Read [Going Global](/docs/payments/going-global), which covers local acquiring, multi-processor strategy, and regional payment methods. :::tip[Test to Run] Pull your last 30 days of transactions. Segment by country. Calculate the auth rate for each one and compare it to domestic. Any country more than 10 points below is worth a look. You may need 3DS tuning there, or local currency pricing. ::: ## Next Steps [ ](/docs/payments/payment-methods) [ ](/docs/playbooks/launch-new-country) --- ## Settlement Lifecycle Source: https://paymentsandrisk.com/docs/payments/settlement/lifecycle # Settlement Lifecycle :::info[TL;DR] - A card transaction has six phases from capture to bank deposit: batching, submission, clearing, interchange, settlement, and funding - most merchants only see the first and last - [Authorization](/docs/payments/reference/authorization-basics) and capture are separate: auth reserves funds, capture triggers settlement; failing to capture within the auth window (5 to 30 calendar days depending on network and authorization type) causes the auth to expire - Batch cutoff time matters for timing: transactions captured after the cutoff settle one business day later than transactions captured before it - Weekends and bank holidays extend the settlement timeline - a Friday capture that misses the cutoff doesn't fund until Monday or Tuesday at earliest ::: Every card transaction goes through distinct phases. Most people think of "the transaction" as one event, but it's actually a chain of events spread across multiple days. ```mermaid flowchart TD A[Transaction Captured] --> B[Batched by Merchant\nEnd of Day] B --> C[Sent to Processor] C --> D[Clearing through\nCard Network] D --> E[Issuer Debits\nCardholder] D --> F[Network Calculates\nInterchange] E --> G[Funds to Acquirer\nminus Interchange] G --> H[Processor Deposits\nto Merchant] H --> I[Merchant Receives\nNet Amount] style A fill:#e1f5fe,color:#1c1e21 style I fill:#c8e6c9,color:#1c1e21 ``` ## The Six Phases ### Phase 1: Authorization (Milliseconds) The issuer approves the transaction and places a hold on the cardholder's funds. No money moves. This is just a promise. ### Phase 2: Capture (Same Day, Usually) The merchant confirms they want to collect the payment. For most retail transactions, this happens immediately after authorization. For e-commerce, it might happen when the item ships. ### Phase 3: Batching (End of Day) Merchants don't send each transaction individually for settlement. Instead, they bundle all the day's captured transactions into a single "batch" and send it to their payment processor. Think of it like the mail. You don't send each letter individually. You collect them and drop them all at the post office at once. **Batch cutoff times matter.** If your processor's cutoff is 9pm EST: - Transaction captured at 8pm โ†’ goes in tonight's batch โ†’ settles tomorrow - Transaction captured at 10pm โ†’ goes in tomorrow's batch โ†’ settles the day after Miss the cutoff by a minute, and your funding is delayed by a full day. ### Phase 4: Clearing (Overnight) This is the "paperwork" phase. The batch travels through the system: 1. Your processor sends the batch to your acquiring bank 2. The acquirer sends transactions to the card networks (Visa, Mastercard, etc.) 3. The networks route each transaction to the correct issuing bank 4. Issuers verify the captures match their authorization records 5. Interchange fees are calculated for each transaction 6. Everyone reconciles their records Clearing answers the question: "Do we all agree on what happened?" ### Phase 5: Settlement (T+1 to T+2) Now money actually moves: 1. The issuing bank transfers funds to the card network 2. The network transfers funds to the acquiring bank (minus network fees and interchange) 3. The acquirer credits the processor 4. The processor credits you (minus their fees) Settlement answers the question: "Let's move the cash." ### Phase 6: Funding (T+1 to T+3) The net amount (your sales minus all the fees) hits your bank account. This is what you actually receive. **The timeline in practice:** | Day | What Happens | |-----|--------------| | Monday 2pm | Customer pays $100 at your store | | Monday 2pm | Authorization approved, capture submitted | | Monday 9pm | Your terminal batches the day's transactions | | Tuesday 3am | Clearing happens overnight | | Tuesday | Settlement between banks | | Wednesday morning | $97.30 lands in your bank account | That $2.70 difference? Fees. See [Money Flow](./money-flow.md) for the breakdown. --- ## Clearing vs Settlement People use these terms interchangeably. They shouldn't. ### Clearing is Information Exchange During clearing, the banks are exchanging *data*: transaction details, authorization codes, merchant information. They're checking that: - The capture matches the authorization - The amounts are correct - All required data fields are present - No duplicate submissions Think of clearing as the banks comparing notes before exchanging money. "You say you authorized $50 for this card number, we say we captured $50, agreed? Good." If there's a mismatch (maybe the capture amount is higher than the authorization, or the authorization expired) it gets flagged during clearing. The transaction might be rejected, or it might create an exception that needs manual review. **Network-specific clearing requirements:** Per Visa's Core Rules, acquirers must enter all original presentments into interchange in the exact amount of transaction currency authorized by the cardholder. This means you can't capture more than you authorized without proper handling (like tip adjustments with the right indicators). Per Mastercard's Rules, customers using the Interchange System are required to net settle in accordance with Mastercard's settlement standards. **Transaction reversals**: If you detect duplicate or erroneous data, you must reverse it. Visa requires reversals be sent within one business day of detection. ### Settlement is Money Movement Settlement is when funds actually transfer between banks. The card network acts as the central clearinghouse: - Networks calculate what each bank owes or is owed - Banks with net debit positions send money to the network - Banks with net credit positions receive money from the network - This happens via Fed wire or other interbank transfer systems By handling it centrally, each bank only needs one relationship (with the network) rather than thousands of bilateral relationships with every other bank. **Network settlement guarantees:** Per Visa's Core Rules, an issuer must pay the acquirer the amount due for a transaction occurring with the use of a valid card. This is the foundation of the [four-party model](/docs/payments/payment-ecosystem). Per Mastercard's Rules, if a principal or association fails to discharge a settlement obligation, Mastercard will satisfy such settlement obligation. This settlement guarantee protects the system. ### Why This Matters for You **Clearing failures don't cost you money immediately.** If a transaction fails clearing, you'll get an error and can usually resubmit or investigate. No money was lost. **Settlement is harder to undo.** Once funds have settled, reversing the transaction requires a refund (you send money back) or a [chargeback](/docs/chargebacks) (it's taken from you). Both have costs. **Timing differences create reconciliation challenges.** A transaction might clear on Tuesday but not settle until Wednesday. Your processor report shows it Tuesday; your bank shows it Wednesday. If you don't understand this, your books won't balance. --- ## Next Steps - [Money Flow & Fees](./money-flow.md) - See exactly who gets paid what - [Settlement Timing](./timing.md) - Understand cutoffs and delays - [Reconciliation](./reconciliation.md) - Match your books --- ## See Also - [Authorization and Capture](/docs/payments/auth-and-capture) - The transaction flow before settlement - [Chargebacks](/docs/chargebacks) - What happens when settlement gets reversed - [Holds and Reserves](/docs/operations/holds-and-reserves) - When funds get held back --- ## Money Flow & Fees Source: https://paymentsandrisk.com/docs/payments/settlement/money-flow # Money Flow & Fees :::info[TL;DR] - Money flows from cardholder bank to card network to acquirer to you, with each party taking a cut before you see the deposit - Interchange goes to the issuing bank and blends to about 0.89% + $0.158 card-present and 1.36% + $0.152 online; assessment fees go to Visa/Mastercard, and neither network publishes a schedule for them (this site assumes 0.14% + $0.02); your processor keeps the rest of what they charge you - Your processor statement shows gross volume processed and net deposits - the difference is fees; calculate effective rate as total fees รท total volume - Chargebacks reverse the entire money flow: your processor pulls the settled funds back from your account and returns them to the issuer ::: Money doesn't flow directly from cardholder to merchant. It cascades through [multiple parties](/docs/payments/payment-ecosystem), with each taking a cut. ## The Players **Cardholder**: The person who swiped their card. Their bank account or credit line is the ultimate source of funds. **Issuing Bank (Issuer)**: The bank that gave the cardholder their card. Chase, Citi, your local credit union. They take on the risk of extending credit to the cardholder. **Card Network**: Visa, Mastercard, American Express, Discover. They operate the rails that connect issuers and acquirers. They set the rules and take a small fee on every transaction. **Acquiring Bank (Acquirer)**: The bank that has a relationship with the merchant. They take on the risk of the merchant not fulfilling orders or going out of business. **Payment Processor**: Often sits between the merchant and acquirer, handling the technical side of submitting transactions. Sometimes the processor and acquirer are the same company. **Merchant**: You. The business that sold something. ## The Flow for a $100 Purchase Let's trace exactly what happens: **At Authorization:** - Cardholder's available credit/balance reduced by $100 (hold) - No money moves yet **At Settlement:** This is a $100 card-present sale, using the blended interchange from [our cost model](/docs/payments/reference/cost-model-assumptions). | Step | From | To | Amount | Running Total to Merchant | |------|------|-----|--------|---------------------------| | 1 | Issuer | Network | $100.00 | - | | 2 | Network keeps assessment fee | - | -$0.16 | - | | 3 | Network | Acquirer | $99.84 | - | | 4 | Acquirer pays interchange to Issuer | - | -$1.05 | - | | 5 | Acquirer keeps their fee | - | -$0.10 | - | | 6 | Processor keeps their fee | - | -$0.20 | - | | 7 | Net to merchant | - | - | **$98.49** | The $1.05 is 0.89% + $0.158, blended across a normal US card mix from Visa's schedule of 18 April 2026 and Mastercard's of 17 April 2026. **A single card is nowhere near that.** The same $100 sale costs $0.26 on regulated debit and $3.10 on a commercial card. If you take mostly one kind of card, use that kind of card's rate, not the blend. The $0.16 assessment is an assumption, not a published figure. Neither network publishes assessments on any page we can read. We carry 0.14% + $0.02 and label it unverified everywhere it's used. *Acquirer and processor fees here are illustrative. Yours depend on your contract.* *Note: In practice, the network nets interchange between issuers and acquirers in its own settlement run. In many modern PSPs (Stripe, Adyen, Square), the acquirer and processor are the same legal entity.* ## Where Do the Fees Go? ### Interchange (about 60-70% of fees on interchange-plus, roughly half on flat rate) This is the big one, though it's a smaller share than most pages claim. On interchange-plus at a $50 card-present ticket it's about 62% of what you pay. On a flat 2.9% + 30c online, your processor keeps about as much as the issuer does. It goes to the issuing bank as compensation for: - Fronting the money (especially for credit cards, where the issuer pays the merchant before collecting from the cardholder) - Taking on fraud risk - Providing cardholder rewards programs - Funding the cost of issuing cards Per Visa's Core Rules: "Interchange Reimbursement Fees help to make electronic payments possible by enabling Visa to expand Card holding and use." Interchange varies wildly based on: - Card type (debit vs credit vs premium rewards) - Transaction type (card-present vs card-not-present) - Merchant category (grocery stores pay less than jewelry stores) - How the transaction was processed (chip vs swipe vs keyed) See [Interchange](/docs/payments/reference/interchange) for detailed rate tables and [Interchange Optimization](/docs/payments/interchange-optimization) for cost reduction strategies. ### Network/Assessment Fees (~5-10% of total fees) Goes to Visa, Mastercard and the rest for running the network. Everyone quotes 0.13-0.15%. No network publishes it. Visa's own 18 April 2026 fee document lists hundreds of interchange rates and not one assessment. So nobody can source that range. This site assumes 0.14% + $0.02 and says so ([derivation](/docs/payments/reference/cost-model-assumptions)). ### Processor/Acquirer Markup (20-30% on interchange-plus, closer to half on flat rate) This is the negotiable part. Your processor adds their margin on top of interchange and assessments, and that's the number shopping around actually moves. See [Processor Fees Guide](/docs/payments/processor-fees-guide). ## Net Settlement vs Gross Settlement Most merchants receive **net settlement**, where your deposit is the total sales minus all fees minus any [chargebacks](/docs/chargebacks) or refunds from that batch. So your bank deposit isn't your sales total. Sell $10,000 today and you might see $9,720 land. The $280 difference is fees, and possibly chargebacks coming out. Some larger merchants negotiate **gross settlement**, where the full transaction amount is deposited and fees are invoiced separately (usually monthly). It's easier for accounting, but you'll need the cash on hand when the fee invoice lands. ## Why Settlement Gets Complicated ### Interchange Variation [Interchange](/docs/payments/reference/interchange) rates aren't uniform, and the spread is enormous. A $100 purchase costs $0.26 in interchange on a regulated debit card, $1.75 on a rewards credit card, and $3.25 if it downgrades to non-qualified. Same sale, twelve times the cost. ### Chargebacks Complicate Everything [Chargebacks](/docs/chargebacks) are the wild card in settlement. A chargeback can arrive weeks or months after the original transaction settled, and it reverses the funds. | Day | Event | |-----|-------| | Day 1 | Customer purchases $500 item | | Day 3 | You receive $485 (settlement minus fees) | | Day 30 | Customer disputes charge with their bank | | Day 32 | Issuer files chargeback | | Day 33 | $500 is deducted from your next settlement | Notice you're out $500, not $485. You don't get your fees back. And you've probably already spent the $485. ### Multi-Currency Settlement International transactions add another layer. Exchange rate fluctuations between authorization and settlement can work for or against you. Most processors lock the rate at authorization, but not all. See [FX and Settlement](/docs/payments/reference/fx-and-settlement) and [Going Global](/docs/payments/going-global). ### Hidden Fees The payment processing industry has a transparency problem. Merchants routinely pay 30-50% more than they should, and they don't realize it until someone audits their statements. See [Reading Statements](/docs/operations/reading-statements) to learn how to spot overcharges. --- ## Next Steps - [Settlement Timing](./timing.md) - When your money arrives - [Reconciliation](./reconciliation.md) - Match your books to your deposits - [Interchange Optimization](/docs/payments/interchange-optimization) - Reduce your fees --- ## See Also - [Interchange](/docs/payments/reference/interchange) - Detailed fee structures - [Processor Fees Guide](/docs/payments/processor-fees-guide) - All the fees explained - [Reading Statements](/docs/operations/reading-statements) - Audit your fees - [The Issuer Perspective](/docs/fraud/issuer-perspective) - Why issuers take interchange --- ## Reconciliation Source: https://paymentsandrisk.com/docs/payments/settlement/reconciliation # Reconciliation :::info[TL;DR] - You match your sales records to your bank deposits. It takes three sources, not two: sales system, processor report, bank statement - T+2 settlement means today's deposit covers transactions from two days ago. Track by settlement date, not transaction date, or you'll be off by one forever - Unexplained gaps are almost always fees, chargebacks, refunds, or batch timing. Categorize the unknowns. Don't adjust them away - Automate before you pass $100K/month. Manual work above that volume breeds errors that compound for months ::: You compare what you think happened against what actually happened. Your sales records against your bank deposits. Sounds simple. Then you try it. ## The Three-Way Match You need three sources, not two: | Source | What It Shows | Where to Get It | |--------|---------------|-----------------| | Your POS/system | Every transaction processed | Your terminal, gateway, or POS software | | Processor settlement report | Transactions settled, fees charged, chargebacks | Processor portal or API | | Bank statement | Actual deposits received | Your bank | All three should match. When they don't, you have a discrepancy to investigate. **Your reconciliation obligation:** Per Mastercard's Rules: "It is the responsibility of each Customer to reconcile the totals and Transactions provided by the Interchange System to its own internal records on a daily basis." This isn't just best practice. It's a network requirement. ## Why They Don't Match ### Timing Differences The most common issue. Your POS shows $10,000 in Monday sales. Your processor report shows $10,000 settled Tuesday. Your bank shows $9,720 deposited Wednesday. All normal. They're looking at different points on the same timeline. ### Fee Deductions Sales were $10,000. Deposit was $9,720. The $280 gap is fees. Miss that and you'll think you're short. See [Reading Statements](/docs/operations/reading-statements) for how to read the deductions. ### Batching Differences You processed 100 transactions Monday. Your processor batched 98 of them Monday night. The other 2 came in after cutoff, so they batched Tuesday night. Your reports now show different counts for "Monday." ### Chargebacks and Refunds A [chargeback](/docs/chargebacks) or refund hits your current settlement. It doesn't get matched back to the original sale. So a $500 chargeback on a two-month-old order lands as a deduction today. ### Reserves and Holdbacks Your processor might hold 10% of every settlement. Sales say $10,000, fees are $280, and you got $8,748. The rest is reserve. See [Holds and Reserves](/docs/operations/holds-and-reserves). ## Common Discrepancies | Discrepancy | Likely Cause | How to Fix | |-------------|--------------|------------| | Transaction in POS, not in settlement | Auth only, never captured; voided; rejected at clearing | Check transaction status in gateway | | Transaction in settlement, not in POS | System not syncing; manual transaction on terminal | Check all transaction sources | | Amount mismatch | Tip adjustment; partial capture; currency conversion | Compare original vs settled amount | | Extra fees | PCI non-compliance fee; chargeback fee; statement fee; instant payout fee | Review fee schedule | | Missing deposit | Batch didn't close; settlement rejected; bank holiday | Check batch status, bank account | | Unexpected deduction | Chargeback; refund; adjustment; reserve | Review processor deductions report | :::note[Three fee lines that surprise people at reconciliation] **Instant payout fees.** Someone on your team taps "get it now". That's 1.95% on Square, 1.5% on Stripe in the US, 1.50% on PayPal Instant Transfer. It comes straight off the deposit. **Double dispute fees.** Stripe charges $15 to receive a dispute and another $15 to counter it. Neither comes back on a partial win. PayPal charges $15 on wallet and Guest Checkout disputes, $20 on card chargebacks. So your ledger needs two fee codes even though only one fires per dispute. Assume a single $15 line and you'll be short on Stripe and wrong on PayPal. **Fees you were told didn't exist.** Helcim publishes $0 for monthly, setup, PCI, cancellation and statement fees. See those lines on your statement? They're not standard. They're negotiable. All figures verified against the vendor's own pricing page on 2026-08-02. See [Processor Comparison](/docs/payments/processor-comparison) for the sourced table. ::: ## Mismatch Troubleshooting Flowchart When your numbers don't match, work through this before panicking: ```mermaid flowchart TD A[Deposit doesn'tmatch sales] --> B{Is the differenceexactly yourfee percentage?} B -->|Yes| C[Normal feededuction] B -->|No| D{Is the differencea round numbermatching a transaction?} D -->|Yes| E{Check processorportal for thatamount} D -->|No| F{Is the depositlower by 5-10%?} E --> G{Chargebackor refund?} G -->|Chargeback| H[Deducted fromtoday's settlement] G -->|Refund| I[Refund processedagainst batch] G -->|Neither| J[Check if transactionmissed batch cutoff] F -->|Yes| K[Likely reserveholdback] F -->|No| L{Multiple daysoff by similaramounts?} L -->|Yes| M[Settlement timingshift - checkbatch cutoff time] L -->|No| N[Pull line-itemsettlement reportand match row by row] style C fill:#22c55e,color:#fff style H fill:#ef4444,color:#fff style I fill:#f59e0b,color:#fff style J fill:#f59e0b,color:#fff style K fill:#ef4444,color:#fff style M fill:#3b82f6,color:#fff style N fill:#8b5cf6,color:#fff ``` **Reading the flowchart:** Green is normal, leave it. Red means something got deducted, so go look. Yellow is a timing issue and usually fixes itself. Blue is a batch shift. Purple means you're digging into line items. Almost every mismatch is one of three things. Fees, which you expected. Chargebacks and refunds, which came out of today's settlement. Or timing, where the money shows up a day late. If none of those explain it, pull the line-item report and match row by row. --- ## Reconciliation Frequency How often should you reconcile? | Business Type | Recommended Frequency | Why | |---------------|----------------------|-----| | High-volume e-commerce (1000+ txns/day) | Daily | Discrepancies compound quickly; fraud detection | | Medium retail (100-1000 txns/day) | Daily or every 2-3 days | Catch issues before they age | | Low-volume (under 100 txns/day) | Weekly | Sufficient for error detection | | All businesses | Monthly (at minimum) | Month-end close, financial reporting | **The 3-day rule**: a discrepancy is 10x easier to chase inside 3 days. After 30, some are gone for good. ## The Reconciliation Process ### Step 1: Export Your Data - Pull settlement report from your processor (by settlement date) - Pull bank statement or transaction export - Export your POS/sales data for the same period ### Step 2: Match Gross Amounts - Total sales from your system - Total settled amount (before fees) from processor - Should match (or difference should be explainable) ### Step 3: Verify Fees - Expected fees based on your rate and volume - Actual fees charged - Variance should be under 1% (some interchange variation is normal) ### Step 4: Match Deposits - Settled amount minus fees = expected deposit - Actual bank deposit - Difference = chargebacks, reserves, or adjustments ### Step 5: Investigate Discrepancies - Document each discrepancy - Research root cause - Resolve or escalate - Track patterns over time ## Automation vs Manual Manual works at a handful of transactions a day. Past that you need software: | Volume | Approach | |--------|----------| | Under 100 transactions/day | Spreadsheet reconciliation feasible | | 100-1000 transactions/day | Semi-automated (import/match tools) | | 1000+ transactions/day | Fully automated reconciliation software | Most processors ship reconciliation reports and an API. Your accounting software probably has an integration already. Third-party tools exist for messy multi-processor setups. ## Settlement Holds and Reserves Not all of your money reaches you right away. Processors and acquirers hold funds to cover their own risk. | Reserve Type | How It Works | Typical Terms | |--------------|--------------|---------------| | Rolling | % held each batch, released after X days | 5-10% for 90-180 days | | Capped | % held until reaching maximum | 10% up to $50K | | Upfront | Lump sum held before processing | $10K-$50K | | Minimum | Floor that must be maintained | $5K-$25K minimum | **See [Holds and Reserves](/docs/operations/holds-and-reserves)** for complete coverage of why funds get held and how to negotiate reserve release. --- ## Next Steps **Just learning reconciliation?** 1. Pull your last week's deposits and match them to sales 2. Ask your processor for fee breakdown documentation 3. Identify your batch cutoff time **Handling discrepancies?** 1. [Understand chargebacks](/docs/chargebacks) โ†’ Disputes cause the biggest gaps 2. Build a fee tracking system โ†’ Catch overcharges 3. Review your processor contract โ†’ Know what you agreed to pay --- ## See Also - [Settlement Lifecycle](./lifecycle.md) - How a transaction goes from capture to deposit - [Money Flow](./money-flow.md) - Where the fees come out and who gets paid - [Reading Statements](/docs/operations/reading-statements) - Interpret your processor statements - [Chargebacks](/docs/chargebacks) - Dispute impact on reconciliation - [Holds and Reserves](/docs/operations/holds-and-reserves) - Reserve mechanics - [Processor Management](/docs/operations/processor-management) - Working with your processor - [Chargeback Metrics](/docs/chargebacks/metrics) - Track dispute impact - [Accounting Integration](/docs/operations/accounting-integration) - Connecting processors to QuickBooks/Xero --- ## Settlement Timing Source: https://paymentsandrisk.com/docs/payments/settlement/timing # Settlement Timing :::info[TL;DR] - Standard credit card settlement is T+2, meaning sale day plus 2 business days. Debit is T+1 to T+2. ACH is T+1 to T+3, depending on same-day or standard. - Batch cutoff times vary by processor, typically 8 PM to midnight ET. Sales after the cutoff push your deposit a business day later. - Instant funding exists and it costs real money. **Square charges 1.95% per transfer, Stripe 1.5% in the US and 1% in Canada and the EU, PayPal 1.50% on Instant Transfer.** All verified against the vendor's own page on 2026-08-02. Two days of float is worth about 0.04% at an 8% cost of capital, so the fee is 25 to 50 times what you're buying. - Reserve funds sit outside the normal settlement timeline. They're released 90-180 days after collection, per your processor agreement. ::: Knowing when the money actually lands is what keeps cash flow from surprising you. ## Standard Timelines by Payment Type | Payment Type | Clearing | Settlement | Funding | |--------------|----------|------------|---------| | Visa/Mastercard Credit | Overnight | T+1 to T+2 | T+2 to T+3 | | Debit (PIN and signature) | Overnight | T+1 | T+1 to T+2 | | American Express | Overnight | T+2 to T+3 | T+3 or later | | Discover | Overnight | T+1 to T+2 | T+2 to T+3 | | ACH/Bank Transfer | T+1 batch | T+1 to T+2 | T+1 to T+3 | | Wire Transfer | Same day | Same day | Same day | *T = Transaction date. All times are business days.* ## Batch Cutoffs Your processor has a daily cutoff. Transactions after it miss that day's batch. It's the most misunderstood part of settlement timing. ### Processing Day Cutoffs | Processor Type | Typical Cutoff | Notes | |----------------|----------------|-------| | Traditional (TSYS, Fiserv) | 9-11pm Eastern | Fixed, rarely flexible | | Modern PSP (Stripe, Square) | Varies by region | Often configurable | | Bank-based | 5-7pm local time | Aligned with banking day | **Always check your own processor's documentation.** Missing the cutoff by a minute pushes funding back a full business day. ### How Cutoff Affects Your Funding | Scenario | Your Sale | Cutoff | Your Batch | Settlement | Deposit | |----------|-----------|--------|------------|------------|---------| | Before cutoff | Mon 4pm | 5pm | Monday | Tuesday | Wednesday | | After cutoff | Mon 6pm | 5pm | Tuesday | Wednesday | Thursday | | Friday late | Fri 8pm | 5pm (Mon) | Monday | Tuesday | Wednesday | | Weekend | Sat 2pm | 5pm (Mon) | Monday | Tuesday | Wednesday | Friday afternoon sales after cutoff don't settle until Tuesday, on Monday's batch. They fund Wednesday. That's 5 days from sale to deposit. ### Setting Optimal Batch Time | Business Type | Recommended Batch Time | |---------------|------------------------| | Retail (closes 9pm) | 10pm (right after close) | | Restaurant (closes 11pm) | Midnight or 1am | | E-commerce (24/7) | Align with processor cutoff | | B2B (business hours) | End of business day | **Auto-batch vs manual batch:** - Auto-batch: set it and forget it. Consistent timing. - Manual batch: flexible, and open to human error. **Recommendation:** use auto-batch. Go manual only if you have a real operational reason. ## Weekend and Holiday Impact Interbank settlement and funding don't move on weekends or bank holidays. So things pile up: - **Friday transactions** batch Friday night, settle Monday, fund Tuesday or Wednesday. - **Saturday and Sunday transactions** batch Monday night, settle Tuesday, fund Wednesday. - **Holiday weekend** with 3 days off: transactions might not fund until Thursday. Do $10,000/day in card sales and a holiday weekend delays $30,000+ of funding. ### Bank Holiday Impact | Holiday | What Happens | |---------|--------------| | Federal Reserve holiday | No interbank settlement | | Banking holiday | Deposits delayed | | Network holiday | Clearing delayed | **Fed holidays (US):** New Year's Day, MLK Day, Presidents Day, Memorial Day, Juneteenth, Independence Day, Labor Day, Columbus Day, Veterans Day, Thanksgiving, Christmas. Each holiday adds a day to your funding timeline. :::info[For Low-Volume Merchants] Under $1K/day, settlement timing is academic. T+1 versus T+2 is one day's float on a small number. Don't pay extra for speed unless you have a real cash flow emergency. Published instant payout fees run 1% to 1.95%, and the table below has them. **When timing actually matters:** when your daily volume sits close to your daily expenses. Deposit $2K/day against $1.5K/day of payroll and rent, and a one-day delay creates real pressure. See [cash flow forecasting](/docs/operations/cash-flow-forecasting) for planning around this. ::: ## Same-Day and Instant Funding Most processors sell accelerated funding now: | Funding Type | Timing | Typical Cost | |--------------|--------|--------------| | Standard | T+2 to T+3 | Included in normal fees | | Next-day | T+1 | Often included, or small fee | | Same-day | Same business day | Varies, not published by most processors | | Instant | Minutes | 1% to 1.95%, see below | ### Published Instant Payout Fees Verified against each vendor's own page on 2026-08-02. | Provider | Instant payout fee | Notes | Source | |---|---|---|---| | **Square** | **1.95% per transfer** | Funds move "24 hours a day, 7 days a week, for a 1.95% fee per transfer". No minimum stated | [squareup.com help centre](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options) | | **Stripe** | **1.5%** for US, AU, NZ, AE. **1%** for CA, EU, UK, SG, NO, HK, MY | Minimum $0.50, maximum $9,999 per payout | [docs.stripe.com](https://docs.stripe.com/payouts/instant-payouts) | | **PayPal** | Instant Transfer to bank **1.50%**, $0.50 minimum. Standard Payout 2% capped at **$1.00** | These are two different products, so check which one applies to you. The cap matters: Standard Payout never exceeds $1.00, while Instant Transfer keeps scaling | [paypal.com](https://www.paypal.com/us/business/paypal-business-fees) | | Braintree, Helcim, Stax, Shopify Payments, Adyen, Moneris, Clover, Toast, Lightspeed, Checkout.com | Not published | Ask before you rely on it | See [processor comparison](/docs/payments/processor-comparison) | Two corrections. **Square's fee is 1.95%, not 1.5%.** That's the highest published instant payout rate on this list. And **Stripe's US rate is 1.5%, not 1%.** The 1% figure is Stripe's Canadian rate, and it had been mislabelled as US across this site. Watch the caps. PayPal's Standard Payout is 2% but stops at $1.00. Instant Transfer is 1.50% with no published cap. On a $1,000 movement, one costs $1.00 and the other costs $15.00. Stripe caps the fee indirectly, by capping the payout itself at $9,999. Square publishes no cap at all, so a $20,000 instant transfer costs $390. ### Same-Day Requirements - Batch before an early cutoff (often 10am-11am) - Be in good standing with the processor - Have a verified bank account with recent deposit history - Meet minimum transaction amounts ### When Instant Funding Makes Sense **Good candidates:** - High-velocity businesses with tight cash flow - Businesses with net-30 or net-60 supplier terms - Event-based businesses (concerts, festivals) - Businesses in cash-flow crunch **When it doesn't make sense:** - On a $100,000 day, Stripe's US fee of 1.5% is $1,500 and Square's 1.95% is $1,950. Is two days early worth that? Two days of float on $100,000 at an 8% cost of capital is about $44. You'd pay 35 to 45 times the value of the money you're accelerating. - Instant funding is emergency cash at emergency prices. Using it every week? The problem is working capital, not settlement timing. ## Push ACH Reconciliation Paying out by push ([ACH credit](/docs/payments/payment-methods/bank-transfers), same-day ACH, [real-time payments](/docs/payments/payment-methods/real-time-payments))? Reconciliation gets harder than card settlement. ### Why Push ACH is Different | Card Settlement | Push ACH | |-----------------|----------| | Processor handles funds flow | You initiate outbound payments | | Fees deducted automatically | Fees may be separate | | One deposit = one batch | Each payout is separate | | Chargebacks handled by processor | Returns come back to you | ### Return Window Reality | Return Type | Timeframe | Common Codes | |-------------|-----------|--------------| | Administrative (R01-R04) | 2 business days | NSF, closed account, invalid account | | Unauthorized (R05, R07, R10) | 2-60 business days | Consumer disputes | | Late returns (R31-R33) | Up to 60 days | Dishonored by recipient | See [ACH Return Codes](/docs/reference/return-codes/ach) for the complete list. ### Push ACH Best Practices 1. **Track every payout uniquely.** Assign an internal ID that maps to the ACH trace number. 2. **Build return matching logic.** When returns arrive, match them to the original payout by trace number. 3. **Hold reserve against returns.** On high-risk payouts, hold funds 3-5 business days before marking "complete." 4. **Reconcile daily.** Payouts initiated versus debited, returns received versus original payouts. 5. **Flag stale unreconciled items.** Any payout over 5 days old without confirmation needs a look. :::warning[ACH Reconciliation Complexity] ACH reconciliation is harder than card reconciliation. Moving from card-only to ACH payouts? Budget 2-3x the operational effort. ::: --- ## Next Steps - [Reconciliation](./reconciliation.md) - Match your books to deposits - [Holds and Reserves](/docs/operations/holds-and-reserves) - Why funds get held - [Payout Strategy](/docs/operations/payout-strategy) - Optimize your funding --- ## See Also - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - ACH timing details - [Real-Time Payments](/docs/payments/payment-methods/real-time-payments) - RTP and FedNow - [Time Frames](/docs/reference/time-frames) - Response deadlines --- ## SMB Banking & Payment Integration Source: https://paymentsandrisk.com/docs/payments/smb-banking-integration # SMB Banking & Payment Integration :::info[TL;DR] - Your bank choice changes when money lands, how reserves work, and how much fraud you're exposed to. It isn't a "where do I park cash" decision. - Settlement speed is the same either way. ACH is ACH. What differs is fraud controls (traditional banks win) and visibility (fintech banks win). - Embedded finance (Stripe Treasury, Square Banking, Shopify Balance) makes cash flow simpler. It also builds lock-in that's expensive to unwind. - Under $50K/month, one account is fine. From $50K up, split settlement money from operating money. - The right setup comes down to your volume, how much float matters, and whether you can live with one point of failure. ::: Your bank doesn't change how fast settlement arrives. It changes how fast you see it, and how hard reconciling gets. And it changes how much stands between an attacker and your operating cash. Most business banking guides talk about APY, fee schedules and sign-up bonuses. That's not this page. This page covers the part nobody talks about. How your bank interacts with your processor. How it moves your settlement timeline and your fraud exposure. Whether you can see where your money is right now. If you take card payments, your bank isn't a savings account. It's infrastructure. --- ## Traditional vs Fintech Banking for Payment Processing Business banking has split into two camps. That split has real consequences for how your payments work. ### Comparison Table | Feature | Traditional (Chase, Wells Fargo, Bank of America) | Fintech (Mercury, Bluevine, Relay) | Hybrid (Brex, Ramp) | |---------|--------------------------------------------------|-----------------------------------|--------------------| | **Settlement deposit speed** | Standard ACH: T+1 to T+2 | Standard ACH: T+1 to T+2 | Standard ACH: T+1 to T+2 | | **Weekend/holiday handling** | No weekend processing; funds queue until Monday | Same - ACH rails are ACH rails | Same | | **Wire receiving** | Same-day, typically by 4 PM ET | Same-day via partner bank | Same-day | | **Wire sending limits** | $50K-$250K daily (varies by relationship) | $25K-$100K daily (varies by plan) | $25K-$100K+ | | **ACH origination** | Yes, full origination capability | Usually yes, but limits vary | Limited or none | | **Fraud controls** | Positive Pay, dual approval, callback verification | MFA, device trust, IP monitoring | MFA, spend controls | | **Processor integration** | Universal - every processor supports major banks | Universal - routing/account numbers work the same | Universal for deposits, some limits on origination | | **Account opening speed** | 3-10 business days (branch or online) | Minutes to hours | Minutes to hours | | **FDIC insurance** | Direct, $250K per depositor | Through partner bank, $250K-$5M (sweep networks) | Through partner bank | | **Relationship lending** | Available based on deposit history | Limited or none | Credit lines based on spend data | | **API access** | Plaid integration; limited native API | Full API access (Mercury, Relay) | Full API access | ### The Part That Actually Matters For plain settlement deposits, bank type makes no difference. Your processor sends an ACH credit, and it lands on the same timeline whether you bank at Chase or Mercury. ACH doesn't care about branding. The differences show up in everything around the deposit: - **How fast you see the pending deposit.** Fintech banks ping you the moment a deposit is initiated. Traditional banks might not show it until the next morning. - **How easily you can reconcile.** API-first banks let you pull transaction data programmatically. Traditional banks give you a CSV or a PDF statement. - **What happens when something goes wrong.** Traditional banks have a fraud department you can call. Fintech banks have support tickets. --- ## How Your Bank Affects Settlement Your processor controls settlement timing, not your bank. Your bank controls the edges, and the edges matter when cash is tight. ### The Standard Timeline ``` Day 0: Customer pays (authorization + capture) Day 1: Processor batches and initiates ACH credit Day 2: ACH network processes the transfer Day 2-3: Funds arrive in your bank account ``` This is the same whether you bank at JPMorgan Chase or Mercury. The ACH network is the bottleneck, not the bank. ### Where Banks Differ on Settlement **Pending transaction visibility.** Some banks flag an incoming ACH credit as "pending" the moment the file arrives. That's often the evening of Day 1. Others show nothing until it posts on Day 2 or 3. Buying inventory against expected deposits? That gap matters. **Weekend and holiday handling.** ACH doesn't run on weekends or federal holidays. A Friday batch settles Tuesday at the earliest. No bank changes that. Fintech dashboards just make it easier to see where the money's sitting. **"Instant" and same-day features.** Stripe, Square and PayPal all sell faster payouts for a fee. Stripe charges 1.5% in the US, Square 1.95%, PayPal 1.50% with a $0.50 minimum, all verified 2026-08-02. They ride same-day ACH or push-to-debit rails. Most banks can receive them. Confirm yours supports same-day ACH credits before you pay for it. **Wire deposits for large settlements.** Some processors settle by wire at high volume and on international payouts, and receipt times vary. Traditional banks usually credit wires by 4 PM ET the same day. Fintech banks credit same day too. Some run to end of business, so ask before you time anything against it. ### The Float Problem At $100K/month in revenue, one extra day of float costs you about $13 a month, assuming a 5% annual return. At $1M/month it's about $130. That math almost never justifies paying 1.5% to 1.95% for instant deposits. A real cash crunch does. **When faster deposits actually matter:** - You're pre-buying inventory and need the cash on hand. - Payroll lands tight against settlement. - You run on net-negative working capital, spending before you collect. **When faster deposits are a waste of money:** - You've got 30+ days of operating cash in the bank. - Your expenses are monthly, not daily. - You're paying 1% for instant access to money you won't spend for two weeks. --- ## Embedded Finance: When Your Processor IS Your Bank Stripe Treasury, Square Banking and Shopify Balance all do the same thing. Your processor holds your money. That isn't just a bank account. It merges processing and banking onto one platform, and pulling them apart later is a project. ### What You Get | Feature | Stripe Treasury | Square Banking | Shopify Balance | |---------|----------------|----------------|-----------------| | **Settlement speed** | Instant to Treasury balance (no ACH delay) | Instant to Square balance | Instant to Shopify balance | | **Debit card** | Yes (Stripe Issuing) | Yes (Square Card) | Yes (Shopify Balance card) | | **Interest/cashback** | Varies | No interest; 2.75% cashback on Square marketing | Cashback on eligible spend | | **ACH out** | Yes, 1-2 business days | Yes, 1-2 business days | Yes, 1-3 business days | | **FDIC insurance** | Yes, through partner banks | Yes, through Sutton Bank | Yes, through partner banks | | **Bill pay** | Limited | Yes | Limited | | **Tax features** | 1099 tracking | 1099 tracking | 1099 tracking | ### What You Gain **Instant settlement at no extra cost.** That's the headline. The money sits in your processor balance right after batch. No T+2 wait for ACH to reach an outside bank. If your cash cycle is tight, that alone can justify it. **Simplified reconciliation.** Processing and banking live on one platform. Deposits aren't mystery ACH credits, they're labeled transactions you can click into. No more matching a $4,723.18 deposit back to individual orders. **Single dashboard.** Revenue, fees, payouts, balance and spend in one view. Less clicking between tabs, fewer spreadsheets. ### What You Lose **Vendor lock-in is the real cost.** Your processor holds your operating cash, so switching processors means moving your bank too. That's a much bigger job than re-pointing your checkout. You have to: - Open a new bank account - Update every vendor payment, payroll link, and auto-pay - Wait for the new processor to start settling to the new account - Wind down the old balance Two to four weeks minimum. You run two banking relationships the whole time. **Concentration risk.** Your processor freezes your account over a chargeback investigation, a risk review, a compliance flag. They've just frozen your bank account too. Keep them separate and a hold only stops new settlement. The cash you already have stays put. **Limited banking features.** Embedded finance accounts aren't full banks. Usually you can't: - Write checks - Get a business loan based on deposit history - Receive incoming wires easily - Set up complex ACH origination (for paying vendors or running payroll directly) **Interest rates are often lower.** Dedicated fintech banks and high-yield business accounts pay 3-5% APY. Embedded finance pays less, or nothing. Check the live rate before you assume. ### The Lock-In Decision Framework | Situation | Recommendation | |-----------|---------------| | Single processor, under $250K/month, cash flow tight | Embedded finance makes sense - instant settlement has real value | | Single processor, over $250K/month, cash flow stable | Keep external bank - lock-in risk outweighs convenience | | Multiple processors | External bank required - you need a neutral landing zone | | Planning to switch processors in next 12 months | External bank - don't stack a banking migration on top of a processor migration | --- ## Fraud Risk Differences Your bank choice doesn't change your card fraud exposure. That's between your processor and your customers. It changes your banking fraud exposure, the kind that empties your operating account. ### Fintech Bank Fraud Risks None of this is a reason to avoid fintech banks. It's a reason to put a hardware key on the login. And to split your accounts. That takes an afternoon. **Account takeover (ATO).** Fintech banks live entirely online. No branch to walk into. No banker who knows your face. Your security is MFA and device trust. Someone takes your email and your MFA method, through a SIM swap or a compromised authenticator app? They've got your money. Traditional banks aren't immune to ATO. They just carry more friction. Callback verification on large wires. In-branch requirements for certain changes. A relationship manager who notices when something looks off. **ACH origination fraud.** Say your fintech bank lets you originate ACH debits. That means pulling money from other accounts. Whoever gets into your account can pull from your other accounts, and your vendors'. Traditional banks put more controls on origination, including positive pay and dual approval. **Business email compromise (BEC).** Digital-only banking makes BEC worse. An attacker owns your email and impersonates you to bank support. The whole exchange happens over chat or email. No voice verification. Nobody has to show up anywhere. It's the fastest-growing fraud vector against SMBs, and fintech-only banking widens it. For how these attacks actually run, see [BEC and Phishing Attacks](/docs/fraud/types/bec-phishing). ### Traditional Bank Fraud Risks **Slower detection.** Traditional banks are slower to tell you something's wrong. Fintech banks push a notification the second money moves. A traditional bank might not surface a fraudulent wire until tomorrow's statement. **Check fraud.** Plenty of B2B businesses still write checks. That exposes the account to check washing and altered checks. A fintech bank that doesn't issue checks kills the vector outright. ### Fraud Control Comparison | Control | Traditional Banks | Fintech Banks | |---------|------------------|---------------| | **MFA** | Yes (often SMS-based) | Yes (app-based, hardware key) | | **Positive Pay (checks)** | Yes | N/A (no checks) | | **ACH blocks/filters** | Yes (most commercial accounts) | Rare | | **Wire callback verification** | Yes (for amounts over threshold) | Rare - usually just MFA | | **Dual approval for payments** | Yes (commercial accounts) | Some (Mercury, Relay) | | **Real-time alerts** | Email (often delayed) | Push notification (instant) | | **IP/device monitoring** | Basic | Advanced | | **Account freeze speed** | Call required, may take hours | Self-service, instant | ### What to Actually Do Four controls, whatever kind of bank you use: 1. **Put a hardware security key (YubiKey) on your bank login.** Not SMS. Not an authenticator app on the phone you carry. A physical key. 2. **Separate your operating account from your settlement account.** Settlement lands in Account A. You move money to Account B for expenses, by hand or on a schedule. If Account A gets taken, your operating cash is still there. 3. **Turn on alerts for every outbound transfer** over $500. 4. **Never approve a payment detail change on email alone.** Call the number you already had on file, not the one in the email. Say: "I've got a request to change your banking details. I'm confirming it with you before I touch anything." For more on protecting the account itself, see [Business Banking Account Takeover](/docs/fraud/types/business-banking-ato). --- ## Cash Flow Visibility The real advantage of fintech banking isn't speed. It's visibility. Seeing your money in real time changes how you run cash. ### API-Based Balance Checking | Bank | API Access | Real-Time Balance | Transaction Webhooks | Accounting Integration | |------|-----------|-------------------|---------------------|----------------------| | **Mercury** | Full REST API | Yes | Yes | QuickBooks, Xero, Netsuite | | **Relay** | API via Plaid | Yes | Limited | QuickBooks, Xero | | **Bluevine** | Limited API | Yes (dashboard) | No | QuickBooks | | **Brex** | Full API | Yes | Yes | QuickBooks, Xero, Netsuite | | **Chase** | Plaid integration | Delayed | No | QuickBooks (via feed) | | **Wells Fargo** | Plaid integration | Delayed | No | QuickBooks (via feed) | **Why this matters for payment processing.** Your processor deposits $12,847.33 on Tuesday and $9,214.67 on Wednesday. You have to match both back to sales. An API-connected bank automates that match, instead of you combing statements by hand. ### Multi-Account Strategies Don't run everything through one account. Here's a setup that works at most volume tiers: **Account 1 - Settlement receiving (fintech bank)**: - All processor deposits land here - Minimal outbound payments - High visibility via API - Easy to monitor for unexpected transactions **Account 2 - Operating expenses (traditional or fintech)**: - Payroll, rent, vendor payments - Scheduled transfers from Account 1 - Keeps operating cash separate from settlement volatility **Account 3 - Reserve/savings (high-yield account)**: - Tax reserves (set aside 25-30% of profit) - Emergency fund (3 months of operating expenses) - Earns interest while sitting idle **Why separate accounts reduce risk:** - A compromised settlement account doesn't drain your operating cash. - A processor hold hits Account 1 and leaves Account 2 alone. - Reconciliation is cleaner when settlement deposits sit on their own. For more on structuring your cash operations, see [Cash Flow Forecasting](/docs/operations/cash-flow-forecasting). ### Accounting Integration Quality There's a wide gap between "supports QuickBooks" and "works with QuickBooks": - **Good integration.** Transactions auto-categorize. Processor deposits match to income. Refunds net correctly. Reconciliation takes 15 minutes a month. - **Bad integration.** Every deposit lands as "uncategorized income." Refunds create duplicate entries. You burn 3 hours a month fixing categories. Native integrations beat third-party data feeds. Mercury to QuickBooks and Brex to Netsuite send cleaner data. More detail, and faster than a traditional bank's feed. --- ## When to Use Which No single right answer works for everyone. There's one for your volume tier. ### Decision Table | Business Profile | Recommended Setup | Why | |-----------------|-------------------|-----| | **Solo operator, under $50K/month** | One fintech account (Mercury or Bluevine) | Simplicity wins; API access is a bonus; one account is fine at this volume | | **E-commerce, $50K-$250K/month** | Fintech for settlement + traditional for operations | Separate settlement from operations; get API visibility on deposits | | **SaaS/subscription, $100K-$500K/month** | Fintech primary + high-yield savings | Predictable revenue makes single-account easier; park excess in savings | | **Multi-processor, $250K+/month** | Traditional bank for settlement + fintech for visibility | Need a neutral settlement account, not tied to any processor | | **Tight cash flow, any volume** | Embedded finance (Stripe Treasury/Square Banking) | Instant settlement without fees is worth the lock-in trade-off | | **High-risk industry** | Traditional bank with strong fraud controls | You need callback verification, positive pay, and a relationship manager who understands your business | | **Planning processor switch** | External bank for settlement | Don't stack a banking migration on top of a processor migration | ### Volume-Based Progression **Under $50K/month:** keep it simple. One account, one bank, one processor. Don't over-engineer this. A Mercury or Bluevine account opens in hours, with good visibility. **$50K-$250K/month:** split into two accounts. Settlement lands in a monitored account with API access. Expenses go out of a separate one. The extra effort is small, and the safety benefit is real. **$250K-$1M/month:** work out whether embedded finance fits your cash cycle. One processor and lumpy cash flow? Instant settlement through Stripe Treasury or Square Banking smooths your weekly position. Running multiple processors, you need an independent bank. **Over $1M/month:** you need a traditional banking relationship. Credit facilities, big wires, transfers that don't trip a fraud hold. All of that comes out of the relationship. Run a fintech account alongside it for API access and monitoring. --- ## Next Steps **Just starting out and choosing a bank?** 1. Open a fintech account (Mercury or Bluevine) for speed and API access. 2. Point your processor at that account. 3. Past $50K/month, open a second account and split settlement from operations. **Already processing and rethinking your setup?** 1. Look at your current settlement timing and how you reconcile. 2. Reconciliation taking more than 30 minutes a month? Your bank integration is the bottleneck. 3. Split into multiple accounts. Connect the settlement bank to your accounting software by API. 4. See [Payout Strategy](/docs/operations/payout-strategy) for when and how to move money. **Evaluating embedded finance (Stripe Treasury, Square Banking)?** 1. Work out what float costs you monthly: monthly revenue / 365 x average settlement days x your cost of capital. 2. Under $200/month, instant settlement isn't worth the lock-in. 3. $200-$500/month, it's a judgment call on how tight your cash is. 4. Over $500/month it's probably worth it. Read the lock-in section first. 5. Review [Processor Management](/docs/operations/processor-management) before you tie your banking to your processor. --- ## Related Pages - [Settlement Timing](/docs/payments/settlement/timing) - How settlement timelines work across payment types - [Payout Strategy](/docs/operations/payout-strategy) - Optimizing deposit frequency and timing - [Reconciliation](/docs/payments/settlement/reconciliation) - Matching processor deposits to your bank account - [BEC and Phishing](/docs/fraud/types/bec-phishing) - The fraud type that hits business bank accounts hardest - [Business Banking ATO](/docs/fraud/types/business-banking-ato) - How attackers take over fintech accounts - [Processor Management](/docs/operations/processor-management) - Managing your processor relationship independently from banking - [Cash Flow Forecasting](/docs/operations/cash-flow-forecasting) - Planning around settlement timing and bank visibility --- ## Subscriptions and Recurring Billing Source: https://paymentsandrisk.com/docs/payments/subscriptions-recurring :::warning[Compliance Requirements] If you bill on a recurring basis, you're bound by network rules for consent, notification and cancellation. See [Recurring Billing Rules](/docs/compliance/subscriptions/recurring-billing) and [Failed Payment Collection](/docs/compliance/subscriptions/failed-payment-collection). ::: # Subscriptions and Recurring Billing :::info[TL;DR] - The difference between 90% and 95% billing success on $100K MRR is $5K/month walking out the door. Dunning and retry logic is revenue you've already earned - Account Updater (Visa and Mastercard card-on-file update service) quietly fixes expired and replaced cards before the next attempt. Turn it on before you build retry logic you don't need - MIT (Merchant-Initiated Transaction) flagging on retries improves approval rates and is required by network rules for subsequent recurring charges after the initial CIT - Send pre-charge notifications 3-5 days before billing. Customers who know it's coming dispute less, and they cancel through you instead of their bank ::: Subscription payments fail differently than one-time payments. The difference between 90% and 95% billing success is 5% of your recurring revenue. On $100k MRR, that's $5k/mo walking out the door. Most subscription businesses accept their decline rate as fixed. It isn't. ```mermaid flowchart TD A[BillingDate] --> B[ChargeAttempt] B --> C{Result?} C -->|Approved| D[SuccessContinue Sub] C -->|Declined| E{DeclineType?} E -->|Hard| F[Card ClosedUpdate Required] E -->|Soft| G[DunningSequence] G --> H[Retry 1Day 3] H --> I{Result?} I -->|Approved| D I -->|Declined| J[Retry 2Day 7] J --> K{Result?} K -->|Approved| D K -->|Declined| L[Final NoticeUpdate Card] L --> M{Updated?} M -->|Yes| B M -->|No| N[CancelSubscription] style D fill:#22c55e,color:#fff style F fill:#ef4444,color:#fff style N fill:#ef4444,color:#fff ``` ## What Matters 1. **Card-on-file consent is non-negotiable.** No consent documentation = [lost disputes](/docs/chargebacks/representment/compelling-evidence). 2. **Account updater (CAU) is free money.** If you're not using it, you're losing 2-4% of billings to expired cards. See [increase auth rates playbook](/docs/playbooks/increase-auth-rates). 3. **Dunning sequence design separates amateurs from pros.** When you retry, how you communicate, and when you stop all affect recovery. 4. **Hard vs. soft decline logic.** Retry the wrong [decline code](/docs/reference/decline-codes) and you burn issuer goodwill. 5. **Cancellation proof wins disputes.** If a customer says they cancelled and you can't prove they didn't, you lose. See [compelling evidence](/docs/chargebacks/representment/compelling-evidence). --- ## Card-on-File Requirements Storing cards for future billing requires explicit consent. This isn't optional. ### What Consent Must Include - Clear disclosure that you're storing the card - Explanation of what you'll charge and when - Cancellation terms - Customer acknowledgment (checkbox, signature, click-through) ### What to Save | Data Point | Why | |------------|-----| | Consent timestamp | Proves when they agreed | | IP address | Links consent to a device | | Consent language version | Shows what they agreed to | | Transaction ID of first charge | Ties consent to billing relationship | ### Issuer View > When we see a dispute on a recurring charge, the first thing we check is whether the merchant can prove consent. A timestamped signup flow with clear billing terms usually wins. A vague "I think they signed up" loses. --- ## Card Account Updater (CAU) CAU automatically updates stored cards when issuers reissue them. Visa calls theirs VAU (Visa Account Updater). Mastercard calls theirs ABU (Automatic Billing Updater). ### What CAU Fixes - Expired cards - Reissued cards (new number, same account) - Changed expiration dates ### What CAU Does Not Fix - Closed accounts - Fraud blocks - Customer-initiated cancellations - Cards the customer doesn't want you to charge ### When to Enable Nearly always. If you bill recurring, enable CAU. The ROI is immediate. ### How to Check If You Have It :::note[Ask Your Dev] "Is Card Account Updater enabled on our merchant account? Are we receiving and applying updates before billing?" ::: Most processors support CAU, but it may not be enabled by default. Some charge per update (typically $0.25-$0.50 per hit). Others include it. ### Measuring CAU Lift Compare involuntary churn before and after enabling: - Pull 3 months of data before CAU - Enable CAU - Pull 3 months after - Calculate the delta in expired-card failures Typical lift: 2-4% reduction in failed recurring billings. --- ## Dunning Sequences Dunning is what happens after a payment fails. Your sequence determines how much revenue you recover. ### Anatomy of a Dunning Sequence | Step | Timing | Action | |------|--------|--------| | 1 | Immediately | Retry payment | | 2 | Day 1 | Email: "Payment failed, update card" | | 3 | Day 3 | Retry payment | | 4 | Day 3 | Email: "Still having trouble" | | 5 | Day 7 | Retry payment | | 6 | Day 7 | Email: "Service at risk" | | 7 | Day 14 | Final retry | | 8 | Day 14 | Email: "Last chance before cancellation" | | 9 | Day 21 | Cancel or pause | ### Retry Timing That Works **Don't retry immediately after failure.** Wait. - **Soft decline (insufficient funds):** Retry in 3-5 days. Paydays matter. - **Issuer unavailable:** Retry in 4-24 hours. - **Card expired without CAU update:** Don't retry. Email for new card. ### Email Timing That Works - **Day 1:** Factual. "Your payment failed. Here's how to update." - **Day 3-7:** Helpful. "Want to keep access? Update here." - **Day 14+:** Urgent but not aggressive. "We'll pause your account in 3 days." ### What Kills Recovery - Too many emails (3-4 total is enough) - Aggressive tone ("PAY NOW OR ELSE") - No clear update link - Retrying hard declines repeatedly --- ## Hard vs. Soft Decline Logic Not all declines are equal. Retry logic should match decline type. ### Soft Declines: Retry-Eligible | Code | Meaning | Retry Strategy | |------|---------|----------------| | Insufficient funds | Account low | Retry in 3-5 days (around payday) | | Issuer unavailable | Technical issue | Retry in 4-24 hours | | Card not activated | New card | Retry in 1-2 days | | Exceeds limit | Over spending limit | Retry in a few days | ### Hard Declines: Do Not Retry | Code | Meaning | Action | |------|---------|--------| | Card stolen/lost | Fraud flag | Stop. Request new card. | | Invalid card number | Card doesn't exist | Stop. Request new card. | | Card expired | CAU should have caught this | Stop. Request new card. | | Do not honor | Issuer says no | Try once more, then stop. | | Restricted card | Blocked category | Stop. Different card needed. | ### Why This Matters Issuers track retry behavior. Hammer declined cards and you'll get worse auth rates on everything, not just the retries. That's a reputation you can't easily undo. :::note[Ask Your Dev] "What's our retry logic for soft declines vs. hard declines? Are we distinguishing between them?" ::: --- ## The Dunning End Game When do you stop trying? ### When to Stop Retrying | Model | Stop After | |-------|------------| | SaaS / digital service | 14-21 days of failure | | Physical subscription (box) | 7-14 days (you have fulfillment costs) | | High-ticket service | 30 days (worth the chase) | ### Cancel vs. Pause | Action | When to Use | |--------|-------------| | **Cancel** | Low LTV customers, free trial churners, abuse patterns | | **Pause (unpaid hold)** | High LTV customers, long tenure, seasonal businesses | Pausing preserves the relationship. Cancelling ends it. Choose based on customer value. ### Grace Period Strategy - **Free trials:** No grace. Card fails = trial ends. - **Paid subscriptions:** 7-14 day grace is standard. - **Enterprise/annual:** 30+ days. These are worth saving. ### After the Last Retry Fails :::note[Ask Your Dev] "What happens after our last retry fails? Does the subscription cancel, pause, or just sit there?" ::: "Sits there" is the wrong answer. Define the end state. --- ## Stop Using $0/$1 Auth to Save Cards :::warning[Legacy Pattern Alert] If you're still using $0 or $1 authorizations to validate cards before saving them, stop. ::: ### The Old Pattern 1. Customer enters card 2. Authorize $0 or $1 to "validate" 3. Void the auth 4. Save the card for future billing ### Why This Fails - **Higher decline rates.** Issuers are suspicious of $0/$1 auth patterns. - **Customer confusion.** "Why is there a $1 charge?" - **Worse issuer acceptance.** You look like a card tester. ### The Modern Approach Use SetupIntent-style flows (Stripe calls it SetupIntent, others have equivalents). - Validates the card without a charge - Designed for card-on-file use cases - Better issuer acceptance - No customer-facing charge :::note[Ask Your Dev] "Are we still using $0/$1 auth to save cards? Can we switch to SetupIntent or equivalent?" ::: --- ## Subscription Fraud Typologies Recurring billing attracts specific fraud patterns. ### Trial Abuse **Pattern:** Sign up for free trial, cancel before charge, repeat with new email/card. **Signals:** - Device fingerprint matches previous trial user - Disposable email domain - Card BIN cycling (same first 6 digits, different cards) - VPN or proxy use **Response:** - Limit trials to one per device fingerprint - Block disposable email domains - Require payment method at trial start (not $0 auth, use SetupIntent) ### Promo Stacking **Pattern:** Abuse referral codes, coupons, or first-month discounts. **Signals:** - Same billing address, different names - Referrer and referee from same IP - Multiple accounts created rapidly **Response:** - Limit referral rewards per payment method - Velocity checks on promo code use - Link detection across accounts ### Credential Sharing/Reselling **Pattern:** One paid account shared among many users, or resold access. **Signals:** - Logins from many IPs/locations simultaneously - Usage patterns that don't match single-user behavior - Account credentials appearing on resale sites **Response:** - Concurrent session limits - Device registration caps - Usage-based lockouts **Related:** [Fraud Prevention](/docs/fraud/prevention) --- ## Subscription Dispute Patterns Recurring billing has unique dispute characteristics. ### Common Dispute Reasons | Reason | Cause | Prevention | |--------|-------|------------| | "I cancelled" | They didn't, or you didn't process it | Clear cancellation flow, confirmation emails | | "I didn't authorize this" | They forgot, or genuine fraud | Pre-renewal reminders, clear descriptors | | "I didn't recognize the charge" | Bad descriptor | Include brand name in descriptor | | "I was charged after cancelling" | Billing/cancellation timing mismatch | Stop billing immediately on cancel | ### Cancellation Proof Basics When a customer disputes saying they cancelled, you need: 1. **Cancellation policy** they agreed to at signup 2. **Usage logs** showing activity after alleged cancellation 3. **Communication history** (did they contact support?) 4. **Account status timeline** (when did they actually cancel?) If you can't prove they didn't cancel, you lose. ### Pre-Renewal Reminders For annual subscriptions, send a reminder 7-14 days before renewal: > "Your subscription renews on [date] for [amount]. If you want to cancel, [click here]." This feels scary but reduces disputes. A customer who cancels is better than a customer who disputes. --- ## Involuntary vs. Voluntary Churn Churn has two causes. Fix the right one. ### Involuntary Churn (Payment Failure) - Card expired - Insufficient funds - Card replaced - Issuer decline **Fix with:** CAU, dunning optimization, retry logic, payment method diversity. ### Voluntary Churn (Customer Choice) - Didn't need the product - Found alternative - Price objection - Bad experience **Fix with:** Product, pricing, onboarding, support. Not payments. ### Measuring the Split Track churn by cause: - What percentage of churned customers had a failed payment as their last event? - What percentage voluntarily cancelled with a working card? If involuntary churn is >30% of total churn, your payments infrastructure is the problem. --- ## Test to Run **4-week CAU and dunning audit:** **Week 1:** Baseline your current metrics. - Involuntary churn rate - Retry success rate by attempt number - CAU hit rate (if enabled) **Week 2-3:** Implement changes. - Enable CAU if not active - Adjust retry timing based on decline codes - Update dunning emails **Week 4:** Measure. - Compare involuntary churn to baseline - Track recovery rate by dunning step **Success criteria:** 10-20% reduction in involuntary churn within 30 days. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k MRR** | Enable CAU, set up basic dunning (3-4 emails), don't overthink it. | | **$100k-$1M MRR** | Optimize retry timing by decline code, A/B test dunning emails, track recovery by step. | | **Over $1M MRR** | Dedicated retention ops, predictive churn models, custom dunning by customer segment and LTV. | --- ## Where This Breaks 1. **Prepaid cards.** No CAU. Can't retry. Just fails. Consider requiring non-prepaid for subscriptions. 2. **Corporate cards with frequent reissuance.** B2B subscriptions on company cards churn hard. Get backup payment methods or invoice them. 3. **Customers who want to cancel but dispute instead.** If disputing is easier than cancelling, that's what they'll do. Make cancelling brain-dead simple. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Involuntary churn rate** | Payment-driven churn | 30% recovery | | **CAU hit rate** | Updater coverage | > 5% of active cards | | **Dunning email open rate** | Message effectiveness | > 40% | | **Recovery by attempt** | Optimal retry count | Most recovery by attempt 2-3 | | **Churn by decline code** | Where to focus | Hard declines should be 60%) - Recovered / Soft declined (target: > 40%) ### CAU Lift Measurement Quantify your Card Account Updater ROI: | Metric | How to Calculate | Benchmark | |--------|------------------|-----------| | **CAU coverage** | Subscribers with updatable cards / Total subscribers | 70-85% | | **Update rate** | CAU updates received / Billing attempts | 2-5% monthly | | **Prevented churn** | (Updates that would have failed) ร— billing success rate | Track monthly | | **CAU ROI** | (Prevented churn ร— LTV) - (Updates ร— cost per update) | Should be > 10x | **Before/after analysis:** 1. Baseline 3 months of expired card failures before CAU 2. Enable CAU for 3 months 3. Compare expired card failure rate 4. Calculate LTV of saved subscribers **Expected lift:** 2-4% reduction in involuntary churn, or 10-20% of expired-card failures prevented. ### Cohort Analysis Track cohorts by: - Signup month - Payment method type - Pricing tier Identify which cohorts have highest involuntary churn and fix those first. --- ## Next Steps **Just starting with subscriptions?** 1. Audit your consent capture โ†’ Do you have documented proof of recurring authorization? 2. Enable Card Account Updater (CAU) โ†’ Free lift to billing success 3. Set up basic dunning โ†’ Email on first failure, retry in 3 days **Improving billing success?** 1. Segment declines by type โ†’ Soft vs. hard, expired vs. insufficient funds 2. Optimize retry timing โ†’ Match to payday cycles for B2C 3. [Review auth optimization](/docs/payments/auth-optimization) โ†’ Decline patterns affect recurring **Fighting subscription chargebacks?** 1. [Check compliance requirements](/docs/compliance/subscriptions) โ†’ Network rules for recurring 2. Improve cancellation flow โ†’ Easy cancellation = fewer disputes 3. Pre-billing notifications โ†’ Remind before charging, not after --- ## Related Pages - [Compliance: Subscription Rules](/docs/compliance/subscriptions) - Network requirements - [Failed Payment Collection](/docs/compliance/subscriptions/failed-payment-collection) - When to stop collecting, charge-off decisions - [Payment Tokenization](/docs/payments/reference/tokenization) - Network tokens for higher auth rates - [Chargeback Prevention](/docs/chargebacks/prevention) - Dispute reduction - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund - [Fraud Prevention](/docs/fraud) - Fraud patterns - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Billing clarity - [Buying Payments](/docs/payments/buying-payments) - Token portability - [Auth Optimization](/docs/payments/auth-optimization) - Decline patterns - [Increase Auth Rates](/docs/playbooks/increase-auth-rates) - Retry optimization - [Decline Codes](/docs/reference/decline-codes) - Soft vs. hard declines - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Proving consent - [Promo Abuse](/docs/fraud/types/promo-abuse) - Trial abuse patterns - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Multi-account detection --- ## Surcharging Compliance Source: https://paymentsandrisk.com/docs/payments/surcharging-compliance :::info[Compliance Rules] For state-by-state legal requirements and network surcharging rules, see [Surcharging Rules](/docs/compliance/network-rules/surcharging). What's here is the business case and the implementation. ::: # Surcharging Compliance :::info[TL;DR] - Surcharges are capped at the lower of your cost of acceptance or 3%. Go over either limit and you're in breach of network rules - You must register with Visa and Mastercard 30 days before surcharging starts. That's a hard requirement, not a courtesy notification - Surcharging is prohibited on debit cards no matter what a vendor tells you. Use BIN-based detection so debit gets exempted automatically - Several states prohibit or restrict surcharging (Connecticut, Maine, Massachusetts, Puerto Rico ban it outright; others cap it, so check current law). A cash discount program gets you similar economics and it's legal everywhere. If you're unsure about your state, build that instead ::: :::info[Do You Need to Surcharge?] Most SMBs don't. Quick decision: - **B2B with average transaction over $500?** Surcharging can save meaningful money. Read on. - **Retail/e-commerce with average transaction under $200?** Don't. The friction costs you more in lost sales than the surcharge saves. A 2-3% cash/ACH discount is legal in all states and it reads better to a customer, because you're giving something instead of taking it. - **Your state prohibits surcharging?** Offer a cash discount instead. Same economics, no compliance risk. - **Under $250K/month?** The administrative overhead of surcharging compliance (notices, caps, card-type restrictions) probably isn't worth it. Just price it in. ::: You're eating the card fee on every sale and you'd rather the customer paid it. That's surcharging. It's a compliance project, not a checkbox in your dashboard. Cap the fee at the lower of your cost of acceptance or 3%. Register with the networks 30 days ahead. Exempt debit by BIN. Disclose at entry, at the POS, and on the receipt. And check that your state allows it at all. Get any one of those wrong and you aren't surcharging, you're just overcharging. *Last verified: December 2024. State laws change. Verify current rules before implementing.* ## What Matters 1. **Surcharge โ‰  convenience fee โ‰  cash discount.** Different rules apply to each. 2. **You can't surcharge debit.** Identify card type at swipe/dip and exempt debit. 3. **State laws vary.** Some states prohibit surcharging entirely. 4. **Register first.** You tell Visa and Mastercard before you start, not after. 5. **Disclosure is mandatory.** Customers must know before they pay. --- ## Surcharge vs. Convenience Fee vs. Cash Discount ### Surcharge A fee you add to credit card transactions to cover your processing costs. | Aspect | Rule | |--------|------| | **Applies to** | Credit cards only (not debit) | | **Maximum** | Cost of acceptance or 3%, whichever is lower | | **Disclosure** | Required at entry, POS, and receipt | | **Network registration** | Required (Visa, Mastercard) | | **Prohibited states** | Yes (see list below) | ### Convenience Fee A flat fee for using a non-standard payment channel, like paying by phone or online when in-person is available. It isn't a surcharge, and the rules that apply to it aren't the same. | Aspect | Rule | |--------|------| | **Applies to** | All payment methods (can include debit) | | **Amount** | Flat fee, not percentage | | **When allowed** | Alternative channel only, not primary | | **Common use** | Government, utilities, tuition | | **Disclosure** | Required before payment | ### Cash Discount A lower price for paying cash, or by any non-card method. | Aspect | Rule | |--------|------| | **Applies to** | Cash, check, ACH payments | | **Amount** | No cap | | **Network rules** | Not regulated as surcharge | | **State laws** | Generally permitted | | **Framing** | Discount from posted price, not fee added | **Key difference:** Cash discount = lower price for cash. Surcharge = higher price for credit. Roughly the same economics. Different law, and customers read them differently too. --- ## Debit Card Prohibition You **can't** surcharge debit cards. That includes: - PIN debit - Signature debit - Prepaid debit cards ### BIN-Based Differentiation So you have to know the card type before you add the fee. | Method | How It Works | |--------|--------------| | **Real-time BIN lookup** | Query card BIN to determine credit vs. debit | | **Terminal prompts** | Customer selects credit or debit | | **Processor support** | Some processors handle this automatically | :::note[Ask Your Dev] "Does our payment system differentiate credit from debit before applying surcharges? How do we ensure debit cards aren't surcharged?" ::: If you can't reliably differentiate, you shouldn't surcharge. --- ## State Law Restrictions As of December 2024, surcharging is prohibited or restricted in: | State | Status | Notes | |-------|--------|-------| | **Connecticut** | Prohibited | No surcharges allowed | | **Maine** | Prohibited | No surcharges allowed (5 M.R.S. 3732) | | **Massachusetts** | Prohibited | No surcharges allowed | | **Puerto Rico** | Prohibited | No surcharges allowed | **Previously prohibited, now allowed:** Colorado, Kansas, New York, California, Texas, Florida, Oklahoma (laws changed or struck down). **Verify current status.** These laws change through legislation and court decisions. Check before you build. ### Multi-State Businesses If you operate in multiple states: - Option 1: No surcharging anywhere (simplest) - Option 2: Surcharge only in permitted states (requires geo-detection) - Option 3: Cash discount everywhere (avoids surcharge rules) --- ## Network Rules ### Visa Requirements 1. **Registration:** Notify Visa 30 days before surcharging 2. **Cap:** Lower of cost of acceptance or 3% 3. **Disclosure:** At store entrance, POS, and receipt 4. **Receipt:** Surcharge must appear as separate line item 5. **Brand-level:** Can't surcharge Visa differently than other brands ### Mastercard Requirements 1. **Registration:** Notify Mastercard 30 days before surcharging 2. **Cap:** Lower of cost of acceptance or 3% (aligned with Visa) 3. **Disclosure:** Clear disclosure before transaction 4. **Receipt:** Separate line item 5. **Consistency:** Same surcharge across credit card brands ### American Express Amex has historically prohibited surcharging, though that's changed in many markets. Check the current Amex rules for your situation, because they aren't the same as Visa's. ### Registration Process Contact your processor to: 1. Declare intent to surcharge 2. Provide surcharge percentage 3. Receive confirmation of network notification Your processor handles the network communication. --- ## Disclosure Requirements ### Point of Entry For brick-and-mortar: - Sign at entrance stating credit card surcharge policy - Sign must be clearly visible before customer commits to purchase ### Point of Sale Before payment: - Verbal disclosure recommended - Signage at register - For e-commerce: disclosure before checkout completion ### Receipt After payment: - Surcharge as separate line item - Clear labeling ("Credit Card Surcharge" or similar) - Surcharge amount clearly stated ### Sample Disclosure Language **Entrance sign:** > "We impose a surcharge on credit card transactions equal to our cost of acceptance, not to exceed 3%. This surcharge is not applied to debit card transactions." **Receipt:** ``` Subtotal: $100.00 Credit Card Fee: $2.90 Total: $102.90 ``` --- ## When Surcharging Makes Sense ### Good Fit - B2B transactions with large ticket sizes (corporate cards) - Industries where surcharging is normalized (government, utilities) - Low-margin businesses where 2-3% fee is material - Customers who have no alternative (captive market) ### Poor Fit - Competitive retail where customers have choices - Customer experience-focused businesses - High-volume, low-ticket transactions (fee seems excessive) - Businesses with significant debit card usage (compliance complexity) ### The Math Before surcharging, calculate: - Current effective rate - Expected customer pushback (lost sales) - Implementation cost (systems, signage, training) - Compliance risk Drive away 5% of customers on a 20% margin and you need serious fee recovery just to break even. --- ## Implementation Checklist ### Before Launch - [ ] Verify state law permits surcharging in all operating locations - [ ] Calculate your cost of acceptance (for cap compliance) - [ ] Notify processor 30+ days in advance - [ ] Confirm processor will handle network registration - [ ] Implement BIN-based debit exemption - [ ] Prepare disclosure signage (entry, POS) - [ ] Update receipt format - [ ] Train staff on policy and disclosure ### At Launch - [ ] Post entrance signage - [ ] Activate surcharge in payment system - [ ] Test with credit and debit to verify debit exemption - [ ] Verify receipt format ### Ongoing - [ ] Monitor customer complaints - [ ] Track surcharge revenue vs. lost sales - [ ] Review state law changes quarterly - [ ] Audit disclosure compliance periodically --- ## Test to Run **4-week surcharging pilot:** **Week 1:** Setup - Calculate cost of acceptance - Implement BIN detection - Prepare disclosures - Train staff **Week 2-3:** Limited rollout - Enable at one location or for B2B segment - Track: customer complaints, lost sales, fee recovery - Monitor compliance (spot-check receipts, signage) **Week 4:** Evaluate - Calculate net benefit (fees recovered - lost sales - complaints) - Decide: expand, modify, or abandon **Success criteria:** Net positive revenue impact and minimal customer friction. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Probably not worth it. Compliance overhead exceeds benefit. Consider cash discount instead. | | **$100k-$1M/mo** | Evaluate for B2B or high-ticket segments only. Implement proper BIN detection. | | **Over $1M/mo** | May be worthwhile. Hire compliance review. Automate BIN detection. Segment by customer type. | --- ## Where This Breaks 1. **Customer backlash in competitive markets.** If customers can buy elsewhere without surcharge, they will. 2. **Compliance failures.** Surcharge a debit card, blow past the cap, or skip a disclosure and you've got legal exposure. 3. **State law changes.** A state you operate in could ban surcharging. Have a rollback plan. --- ## Next Steps **Evaluating surcharging?** 1. [Understand the types](#surcharge-vs-convenience-fee-vs-cash-discount) - Surcharge vs convenience fee vs cash discount 2. [Check state restrictions](#state-law-restrictions) - Prohibited states 3. [Run the math](#the-math) - Fee recovery vs customer loss **Implementing surcharging?** 1. [Handle debit exemption](#debit-card-prohibition) - BIN-based differentiation 2. [Meet network requirements](#network-rules) - 30-day notice, registration 3. [Follow implementation checklist](#implementation-checklist) - Before, at, and after launch **Testing before full rollout?** 1. [Run 4-week pilot](#test-to-run) - Limited location or segment 2. [Prepare disclosures](#disclosure-requirements) - Entry, POS, receipt 3. [Track success criteria](#test-to-run) - Net revenue impact --- ## Related Pages - [Buying Payments](/docs/payments/buying-payments) - Processor fee structures - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Terminal selection - [Invoicing](/docs/payments/invoicing) - B2B payment options - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Cross-border fees - [Cards](/docs/payments/payment-methods/cards) - Card types and fees - [Interchange](/docs/payments/reference/interchange) - Fee breakdown - [Checkout Conversion](/docs/payments/checkout-conversion) - Customer impact - [Reading Statements](/docs/operations/reading-statements) - Fee analysis - [Network Rules](/docs/compliance/network-rules) - Compliance requirements - [Processor Management](/docs/operations/processor-management) - Acquirer relationships --- ## Payment Tool Stack by Volume Tier Source: https://paymentsandrisk.com/docs/payments/tool-stack # Payment Tool Stack by Volume Tier :::info[TL;DR] - Under $250K/month: processor built-ins plus AVS and CVV are all you need. Stripe's Radar Lite, Square's built-in screening. Don't buy a fraud platform yet. - $250K-$1M/month: add dispute alerts. Verifi for Visa and Discover, Ethoca for Mastercard. And compare processors that publish volume bands, rather than waiting for a discount nobody advertises. - Over $1M/month: a fraud platform, chargeback automation and a second processor start to earn their keep. - Sift, Signifyd, Forter and Riskified publish no price and no volume minimum. **Reported contract ranges do exist.** They come from Vendr, a SaaS buying platform that negotiates these deals. Sift's median contract is $150,000/year, over a stated sample of 50 purchases. Sardine's is $95,333. SEON's is $56,900. Attributed, dated and worth having. Not vendor figures. - SEON is the only fraud vendor with a published entry price. $699/month for 2,500 checks, about $0.28 a check. Use it as your anchor when a quote-only vendor finally names a number. - **Riskified gives you the only public percentage-of-GMV benchmark in the guarantee market.** It comes from its own filings. Revenue over GMV works out to 0.237% in Q1 2026. Ask every guarantee vendor to quote as a percentage of GMV, so you can hold it against that. - **Chargeback alert prices are published, just not by the networks.** Chargeblast is $14 per chargeback stopped. Chargeflow is $29 per deflected chargeback. Disputifier is $17 to $27.50 per alert. All three on their Shopify App Store listings. Visa and Mastercard licence into a reseller channel, and the reseller sets retail. That's why the network price is structurally unpublishable. - Buy before the threshold and you waste money. Buy after it and you eat preventable losses. This page has the inflection points. ::: Most SMBs buy tools too early and waste money. Or too late, and eat the damage. This page says what to use at each volume tier, and when to upgrade. The answer turns on two numbers. Your monthly volume and your chargeback ratio. :::note[How the prices on this page are sourced] Every figure carries a **source tier**. VENDOR is from the vendor's own page. REPORTED is from a named third party, with who, when, and what kind of source. DERIVED is calculated from published figures, not a company disclosure. NOT PUBLISHED means the vendor doesn't publish it, and the page says what to ask for instead. [The full system](/docs/payments/reference/cost-model-assumptions#how-we-tier-every-figure). **Vendor-published figures alone would leave most of this table blank.** A blank cell doesn't help anyone build a budget, and it quietly rewards the vendors that publish least. So reported ranges are in. Labelled, sources named, so you can weigh them yourself. The main reported source here is **Vendr**. It's a SaaS buying and negotiation platform that publishes contract medians from deals it has worked on. Two things to hold in mind. **Vendr sells negotiation services**, so its "discounts achievable" figures read as achievable rather than typical. And it discloses a sample size for exactly one vendor. Sift's median is stated as based on 50 purchases. That makes it far more trustworthy than the Signifyd, Forter, SEON and Sardine medians, where no sample size is given at all. Prices move, so treat the verified date as a shelf life rather than a guarantee. ::: ## The Question This Answers **"Should I buy [fraud tool X] at my volume?"** **Wrong answer**: "It depends on your business" **Right answer**: Specific guidance by volume and CB ratio At $50K/month with a 0.4% CB ratio: no, use processor built-ins. At $500K/month with a 0.8% CB ratio: yes, get quotes now. --- ## What's Published and What Isn't Before any tool comparison, know which numbers exist. And which ones are somebody's guess. | Vendor | Publishes a price? | Publishes a volume minimum? | |--------|--------------------|------------------------------| | **Square** | Yes, full rate card | No floor. Publishes an upward threshold only: over $250,000 per year, talk to sales about custom pricing | | **Helcim** | Yes, five volume bands plus a custom band | No floor. Bands run openly to $5M/month | | **Stax** | Yes, three subscription tiers | Not published | | **PayPal / Braintree** | Yes, full rate card | Not published | | **Stripe** | Yes for card rates and disputes | Not published. No discount schedule and no negotiation threshold appear anywhere on Stripe's site | | **Adyen** | No SMB rate card. Interchange++ plus a $0.13 processing fee, which Adyen itself calls indicative. It does publish its own company-wide take rate: 17.0 bps FY2025 | Not published. There is no $10M/year minimum on Adyen's pricing page. Minimum invoice reported at $120/mo or 1,000 txns/mo | | **Clover** | **Yes.** 2.3% + 10c restaurant, 2.6% + 10c entry retail, 3.5% + 10c keyed. Software $0 to $129.85. Chargeback fee not published at any tier | Not published | | **Toast** | **Partly.** 2.49% Traditional and 3.09% Pay-as-you-Go are Toast's own. The + 15c is reported only. Plans $0 to $90 | Not published | | **Lightspeed** | **Yes for card-present**, 2.6% + 10c, plus a $15 chargeback fee. Online rate not published | Not published | | **Checkout.com** | No. Verified: pricing page scanned twice, full 1,552-URL sitemap scanned, third-party coverage checked | Not published | | **SEON** | Yes, $699/month Starter | Not published. Reported median contract $56,900/yr, range $3,900-$1,146,838 | | **Sift** | No. sift.com/pricing 404s | Not published. Reported median contract $150,000/yr, range $29,600-$600,000, **based on a stated 50 purchases** | | **Signifyd** | Model only: a percentage of order total on approved orders, nothing on fraud declines | Not published. Reported median $4,444/yr, range $2,089-$48,889. The median is not credible for an enterprise guarantee contract | | **Forter** | No | Not published. Reported median $8,000/yr, range $6,000-$375,000, which contradicts the same source's own segment description of "mid-six figures or higher" for enterprise | | **Riskified** | No. But its filings give a derived 0.237% of GMV blended take | Not published | | **Sardine** | No. sardine.ai/pricing 404s | Not published. Reported median $95,333/yr, range $15,000-$254,480 | | **Verifi, Ethoca** | No public alert rate card, and the absence is structural rather than accidental | Not published. Resellers publish: Chargeblast $14, Disputifier $17-$27.50, Chargeflow $29 | *Vendor sources: [Square](https://squareup.com/us/en/payments/our-fees), [Helcim](https://www.helcim.com/pricing/), [Stax](https://staxpayments.com/pricing/), [PayPal](https://www.paypal.com/us/business/paypal-business-fees), [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees), [Stripe](https://stripe.com/pricing), [Adyen](https://www.adyen.com/pricing), [Checkout.com](https://www.checkout.com/pricing), [Clover](https://www.clover.com/pricing), [Toast](https://pos.toasttab.com/shop/starter-kits), [Lightspeed](https://www.lightspeedhq.com/pos/retail/pricing/), [SEON](https://seon.io/pricing/), [Signifyd](https://www.signifyd.com/pricing/). Reported contract ranges: [Vendr](https://www.vendr.com/marketplace/sift-science), a SaaS buying and negotiation platform that publishes medians from deals it has worked on and that sells negotiation services. Derived: Riskified Q1 2026 results. All checked 2026-08-02.* Signifyd is the one partial exception among the guarantee vendors. It publishes the shape of the deal without the number. "Signifyd charges a percentage of the order total when an order is approved," varying by product, vertical, order volume and average ticket. And "there is no charge when an order is declined due to fraud." The percentage itself is never stated. **Read the reported medians with care.** Vendr's Signifyd median of $4,444 a year isn't credible as a typical enterprise chargeback-guarantee contract. It almost certainly reflects small self-serve, partial-year or Shopify-tier deals. The top of its range is closer to a real mid-market contract. Its Forter median of $8,000 contradicts its own segment description on the same page, which puts mid-market at "low to mid-five figures" and enterprise at "mid-six figures or higher". **Where a source contradicts itself, believe the segment description over the median.** **What this means for you**: at every tier below, you can budget the processor line from published rates. The fraud platform and guarantee lines can be **bracketed** from reported ranges. You can't budget from them. Until you have a quote in writing you don't have a budget. What you do have now is an order of magnitude to sanity-check it against. --- ## Tool Stack Progression ```mermaid flowchart LR A[Under $50K/moProcessor Only] --> B[$50K-$250K+ Dispute Alerts] B --> C[$250K-$1M+ Fraud Tool] C --> D[Over $1M+ Full Stack] style A fill:#94a3b8,color:#000 style B fill:#60a5fa,color:#fff style C fill:#3b82f6,color:#fff style D fill:#1e40af,color:#fff ``` **Key insight**: add tools when revenue justifies the cost. Not because they're "best practice." --- ## Under $50K/Month: Processor Built-Ins Only ### What to Use | Tool Category | Recommendation | Cost | |---------------|----------------|------| | **Processor** | Square, Free plan | 2.6% + $0.15 in person, 3.3% + $0.30 online, 3.5% + $0.15 keyed or card on file. No monthly subscription | | **Processor alternative** | Stripe | No setup fee, no monthly fee. US card rates not stated here, read them at [stripe.com/pricing](https://stripe.com/pricing) | | **Fraud detection** | Radar Lite on Stripe, or Square's built-in screening | $0. Radar Lite is bundled with Stripe Payments at no extra charge | | **Chargeback management** | Manual, via the processor dashboard | $0 in tooling. Dispute fees are separate: no per-dispute fee appears on any Square pricing page, Stripe charges $15 to receive a dispute | | **Analytics** | Processor dashboard | $0 | | **Refunds** | Manual, via processor | $0 | *Sources: [Square fees](https://squareup.com/us/en/payments/our-fees), [Stripe pricing](https://stripe.com/pricing), [Stripe dispute pricing](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes). Verified 2026-08-02.* **Total monthly tool cost: $0.** Square's Free plan has "no monthly subscription costs". Stripe states it "does not charge setup fees, monthly fees, or any other hidden fees." At this tier your only real payment cost is the processing rate. **One cash-flow trap at this size**: instant payouts are expensive money. Square Instant Transfer is 1.95% per transfer. Stripe's US instant payout is 1.5%, with a $0.50 minimum and a $9,999 cap. Both are a costly way to borrow from yourself. Use them weekly and that's a bigger line item than any tool on this page. ### What NOT to Buy Yet โŒ **Third-party fraud platform** - only one SMB fraud tool here publishes a price. SEON, at $699/month for 2,500 checks. That's more than your total fraud losses at this volume. โŒ **Chargeback alerts** - you won't hit the 75 chargebacks/month RDR threshold anyway. Neither Verifi nor Ethoca publishes a rate, so you'd negotiate blind for something you don't need. โŒ **Dedicated analytics** - processor reports are enough. โŒ **Manual review service** - review the flags yourself. A few minutes a day. ### Why **Math check.** The chargeback counts below assume a low average ticket. Run these on your own transaction count, not this one. - $50K/month at a 0.5% chargeback ratio = 8 chargebacks. - Say an alert service quotes you $300/month. They don't publish, so you'd have to ask. - At roughly 40% deflection, that's about 3 chargebacks avoided. - Call a chargeback $85 all in: fee, lost product, labor. Use your own figure from the [total cost model](/docs/payments/total-cost-model). That's $255 saved. - **Cost $300, saves $255. You're down $45 a month.** **Not worth it yet.** Use free tools until volume justifies paid ones. --- ## $50K-$250K/Month: Add Dispute Alerts ### What to Use | Tool Category | Recommendation | Cost | |---------------|----------------|------| | **Processor** | Square or Stripe | Square Free: 2.6% + $0.15 in person, 3.3% + $0.30 online. Square Plus: 2.5% + $0.15 in person, 2.9% + $0.30 online. Stripe US card rates not stated here | | **Processor alternative** | Helcim, interchange-plus | $50K-$100K/month band: interchange + 0.35% + $0.07 in person, + 0.45% + $0.20 online. $0 monthly fee, no setup, PCI, cancellation or statement fees | | **Fraud detection** | Radar Lite or Square built-in | $0 | | **Dispute alerts** | Verifi (Visa, Discover) plus Ethoca (Mastercard) | Not published by either. Priced by your acquirer or a reseller | | **Chargeback management** | Manual, via dashboard | $0 | | **Analytics** | Processor dashboard | $0 | *Sources: [Square fees](https://squareup.com/us/en/payments/our-fees), [Helcim pricing](https://www.helcim.com/pricing/), [Stripe pricing](https://stripe.com/pricing). Verified 2026-08-02.* **Total monthly tool cost**: whatever your two alert quotes come to. There's no published number to plan against. That's exactly why you get two quotes and compare them to each other, not to a figure you read somewhere. Square publishes one threshold worth knowing here. "If you process over $250,000 per year, talk to our team about custom pricing." At $50K a month you're already six times past that. Ask. Square's Plus and Premium plans carry lower rates too, Premium at 2.4% + $0.15 in person. The monthly cost of those plans isn't stated in the source checked here. Get the plan price before you assume the lower rate pays for itself. ### When to Add Dispute Alerts **Add when you hit**: - 75+ chargebacks a month, the Visa RDR threshold. Or - a 0.65%+ chargeback ratio, which puts monitoring programs in view. **At $150K/month and a 0.6% CB ratio**: - About 23 chargebacks a month. - Alerts deflect roughly 40%, so about 9. - 9 x $85 = $765 saved. - A $350/month quote leaves you **net +$415 a month**. Tool cost is the only variable you control, and it's the one nobody publishes. Make the quote justify itself against your own chargeback count. ### Where to Buy **The networks publish nothing, and that absence is structural.** Neither Visa (Verifi) nor Mastercard (Ethoca) sells a retail per-alert price to most merchants. They licence into a reseller and acquirer channel, and the reseller sets retail. **You aren't negotiating with Visa or Mastercard. You're negotiating the reseller's margin.** That's why resellers publish wildly different prices for substantially the same feed. | Service | Networks | Cost | Tier | How to Buy | |---------|----------|------|---|------------| | **Verifi (CDRN)** | Visa, Discover | Not published by Visa | NOT PUBLISHED | Through a reseller | | **Ethoca** | Mastercard, and it claims all networks | Not published by Mastercard | NOT PUBLISHED | Through a reseller | | **Stripe RDR** | Visa only | Not published. Enrollment sits in the Stripe Dashboard, but the per-resolution cost isn't stated | NOT PUBLISHED | Enable in Stripe dispute settings, then ask what a resolution costs | | **Chargeblast** | Resells Ethoca, CDRN and RDR | **$14 per chargeback stopped.** Alerts plans from $19/mo. Recovery 15% on wins | VENDOR, via its Shopify App Store listing | Direct or Shopify | | **Disputifier** | Ethoca, CDRN, RDR, Order Insight | **$17 to $27.50 per alert.** Recovery 20% of recovered revenue, **capped at $250 per won chargeback**. Fraud and INR prevention $0.05/order | VENDOR, via its Shopify App Store listing | Direct or Shopify | | **Chargeflow** | Verifi and Ethoca | **$29 per deflected chargeback**, and its own page says "Over 50 alerts per month? Get better price". Prevent $0.20 per scanned transaction, first 1,000 free. Recovery 25% | VENDOR | Direct or Shopify | | **Chargebacks911** | Both networks | Not published. Its own explainer says alert cost is "roughly on par with the chargeback fees charged by acquirers per chargeback received", which is a claim by a company that sells alerts | NOT PUBLISHED | Direct | *Sources: no public alert rate card is published by Visa (Verifi) or Mastercard (Ethoca). Reseller prices from the [Chargeblast](https://apps.shopify.com/chargeblast), [Disputifier](https://apps.shopify.com/disputifier) and [Chargeflow](https://apps.shopify.com/chargeflow) Shopify App Store listings, plus [chargeflow.io/pricing](https://www.chargeflow.io/pricing) and [disputifier.com/pricing](https://www.disputifier.com/pricing). Checked 2026-08-02.* :::tip[Two things the published reseller prices tell you] **The spread is the reseller's margin, not the network's price.** $14 at Chargeblast against $29 at Chargeflow, for substantially the same Ethoca and CDRN feed. A 2x difference on identical data. Get two quotes, always. **Watch the recovery cap.** Disputifier caps its 20% success fee at $250 per won chargeback. Chargeflow's 25% is uncapped. On a $2,000 recovery that's $250 against $500. On a $5,000 recovery, $250 against $1,250. For a high-ticket merchant, that gap never shows up in a headline rate comparison. ::: **Ask for these in writing before you sign**: 1. The per-alert or per-resolution fee. And whether it's charged on alerts you'd have refunded anyway. 2. **The de-duplication rule.** One transaction fires both an Ethoca and a CDRN alert. Does it bill once or twice? That decides whether $14 is really $14. Chargeflow is the only provider publishing a stance, a "Zero Duplication Guarantee". A marketing guarantee isn't a contract term until it's in your agreement. 3. Any monthly platform fee, setup fee or minimum. 4. Contract term and early termination terms. 5. **Which of the four programmes the quote covers**: Ethoca, CDRN, RDR, Order Insight. A price covering only Ethoca isn't comparable to one covering all four. 6. Whether a deflected dispute still counts toward your chargeback ratio. That last one decides whether the service protects your monitoring-program standing or only your revenue. One operational detail from Disputifier's own page too. **RDR and Order Insight take 1 to 2 weeks to enable, against 1 to 2 days for Ethoca and CDRN.** RDR has to go through your acquirer. Confirm yours supports it before signing. ### What Still NOT to Buy โŒ Third-party fraud platform - Radar Lite or Square's built-in screening is still enough. โŒ Manual review service - you can still review flagged orders yourself. โŒ Chargeback guarantee - it's priced as a percentage of your approved volume. At this size that percentage buys very little. --- ## $250K-$1M/Month: Add Fraud Tool ### What to Use | Tool Category | Recommendation | Cost | |---------------|----------------|------| | **Processor** | Stripe, or an interchange-plus processor that publishes its bands | Stripe publishes no volume threshold and no discount schedule. Helcim's $100K-$500K/month band is interchange + 0.25% + $0.07 in person, + 0.35% + $0.20 online. The $500K-$1M band is + 0.20% + $0.06 in person, + 0.25% + $0.15 online | | **Processor alternative** | Stax, subscription model | $199+/month for $250,000+ **per year** of volume, plus interchange + 0% markup + $0.08 in person or + $0.15 online | | **Fraud detection** | Sift, Signifyd, Forter, Riskified or SEON | Not published for the first four, on price and on minimum. SEON Starter is $699/month for 2,500 checks | | **Dispute alerts** | Verifi + Ethoca | Not published | | **Chargeback management** | Chargeflow or manual | Not published. Automation vendors here price per response or per win | | **Analytics** | Processor dashboard plus basic BI | Stripe Sigma is usage-based, priced per row queried | *Sources: [Stripe pricing](https://stripe.com/pricing), [Helcim pricing](https://www.helcim.com/pricing/), [Stax pricing](https://staxpayments.com/pricing/), [SEON pricing](https://seon.io/pricing/), [Signifyd pricing](https://www.signifyd.com/pricing/). Verified 2026-08-02.* **Read the Stax tiers carefully**: those bands are annual, not monthly. A shop doing $250K a month is doing $3M a year. That sits in the $250,000+ tier at $199+/month. Stax's own words: "Subscription prices are determined by processing volume and do not include cents per transaction." Read the same table as monthly and Stax looks roughly twelve times dearer. **On negotiating with Stripe**: Stripe publishes no volume threshold, no discount schedule and no negotiated rate band. Custom pricing may well exist. Nobody can tell you what it looks like or when you qualify. Want rates that fall with volume, visible before you call anyone? Helcim publishes five bands openly. **Total monthly tool cost**: one line here has a published price. SEON at $699. Everything else is a quote. ### When to Add Fraud Tool **Add when**: - Your CB ratio runs above 0.7% despite basic prevention. Or - you're processing over $500K a month. Or - you're in a high-risk vertical, like digital goods or supplements. **At $500K/month and a 0.8% CB ratio**: - About 40 chargebacks a month. - Roughly half are fraud, so about 20. - A tool stopping 30% of those prevents about 6. - 6 x $85 = $510 saved. - On a $2,000/month quote, you're paying about $1,490 a month for threshold protection. That can still be the right call if the alternative is a monitoring program. Just be honest about it. It's insurance, not savings. Decide it on that basis. ### Fraud Tool Options | Tool | Best For | Vendor price | Reported contract range | What to ask for | |------|----------|-----------------|--------------------------|-----------------| | **Sift** | General e-commerce | NOT PUBLISHED. sift.com/pricing and /pricing/ both return 404 and no pricing link appears in site navigation | REPORTED median **$150,000/yr**, range $29,600-$600,000. Segments: $40K-$100K small/mid-market (100K-500K events/mo, single module), $100K-$300K mid-to-enterprise (500K-2M events/mo), $300K+ large enterprise. **Based on a stated sample of 50 purchases**, the only sample size Vendr discloses | The billing unit, and **the overage rate in writing before signing**. Reported at 20-50% above base rate, which is the most common unpleasant surprise. Also cap the reported 3-7% annual escalator at CPI or 3% | | **Signifyd** | Chargeback guarantee | Model published, numbers not: a percentage of order total charged when an order is approved, with no charge when an order is declined for fraud. Free to install on Shopify with a 14-day trial | REPORTED median **$4,444/yr**, range $2,089-$48,889. **The median is not credible for an enterprise contract** and no sample size is disclosed | Whether you're buying **fraud-only protection or total chargeback liability shift**. These are wildly different products sold under one name. How friendly-fraud and item-not-received disputes are treated. Whether any part of the fee is at risk against an approval-rate SLA | | **Forter** | Enterprise volume | NOT PUBLISHED. forter.com/pricing/ is a contact-sales form | REPORTED median **$8,000/yr**, range $6,000-$375,000. The same source separately describes mid-market as "low to mid-five figures" and enterprise as "mid-six figures or higher", which contradicts its own median. Model reported as structured around approved transaction volume or GMV | The rate **as a percentage of approved GMV**, so it benchmarks against Riskified's 0.237%. Negotiate the implementation fee, reported at low-to-mid five figures and the most discountable line. Cap the 3-7% escalator | | **Riskified** | Apparel, high-ticket | NOT PUBLISHED as a rate card. But its Q1 2026 results give a DERIVED **0.237% of GMV**: $88.3M revenue on $37.2B GMV. Q1 2025 was 0.241% | Public company, so no reseller range needed | Percentage of approved GMV, guarantee scope, and the exact liability transfer terms. **Use 0.237% as the public floor** when any guarantee vendor quotes you | | **Sardine** | Fintech, banking, crypto | NOT PUBLISHED. sardine.ai/pricing and /pricing/ both 404 | REPORTED median **$95,333/yr**, range $15,000-$254,480. Model: a **minimum monthly commit you draw down from**, plus consumption rates, with overages charged monthly | Annual rather than monthly true-up, and **whether unused commit rolls forward**. Those two terms matter more than the headline commit for any seasonal business, because a drawdown model can charge you twice: unused commit in quiet months and overages at peak | | **SEON** | SMBs willing to write their own rules | VENDOR **$699/month** Starter: 2,500 fraud checks, 10 users, 50 custom rules. Premium is custom priced. No free tier published | REPORTED median $56,900/yr, range $3,900-$1,146,838, with 10-17% discounts reported. The range bottom is close to Starter annualised at $8,388, a reasonable consistency check | **The overage rate above 2,500 checks, in writing.** Nothing anywhere states what happens at check 2,501, and it is the single biggest unpublished risk in the contract. Also whether unused checks roll forward | | **Ravelin** | Marketplaces, delivery | NOT PUBLISHED at every tier. ravelin.com/pricing exists but contains no pricing at all; it describes the product and routes to a demo | None found from any source with a stated methodology | Ask Ravelin to quote **as a percentage of GMV** so it's directly comparable. With no public anchor, benchmark against SEON's $699/mo entry, Sift's reported $40K-$100K small/mid-market band, and Riskified's 0.237% | *Vendor sources: [Sift](https://sift.com/) (pricing 404), [Signifyd](https://www.signifyd.com/pricing/), [Forter](https://www.forter.com/pricing/), [Riskified Q1 2026 results](https://www.stocktitan.net/news/RSKD/), [Sardine](https://www.sardine.ai/) (pricing 404), [SEON](https://seon.io/pricing/), [Ravelin](https://www.ravelin.com/pricing). Reported ranges: [Vendr](https://www.vendr.com/marketplace/sift-science), a SaaS buying and negotiation platform that sells negotiation services. Checked 2026-08-02.* :::warning[The Riskified benchmark is calculated here, not disclosed by Riskified] 0.237% is $88.3M of Q1 2026 revenue divided by $37.2B of GMV. **Riskified has never published a take rate.** It states only that revenue is "directionally correlated with the level of GMV reviewed". Anyone republishing this should confirm it against the 20-F. It's also a blended enterprise average. Mid-sized or higher-risk merchants get quoted well above it. What makes it useful anyway is the trend. Take rate is drifting **down** year on year, 0.241% to 0.237%, while gross margin improves from 49% to 52%. That's a legitimate argument to bring to a renewal. ::: :::tip[Use the one published price as your anchor] SEON's Starter tier works out to about $0.28 per fraud check. When a quote-only vendor finally gives you a number, convert it. Cost per check, or cost per approved order. Then compare. A vendor asking many multiples of $0.28 per decision has to explain the difference. "Better machine learning" isn't an answer you can audit. Note what a guarantee vendor's model does to the comparison, too. Signifyd charges on approved orders, not on checks. So its cost scales with your good volume, not your fraud volume. Those two shapes aren't comparable per transaction. A vendor will happily let you compare them wrongly. ::: **Also worth knowing about this market**: Kount and Midigator are both Equifax now. Equifax bought Midigator in 2022 and folded it into Kount. kount.com itself redirects to Equifax's identity and fraud pages. Any comparison listing Midigator or Kount as standalone vendors is out of date. Accertify is no longer an American Express company either. Its own site says it was carved out, and it names no current owner. ### What Still NOT to Buy โŒ Manual review team - handle it in-house until you're past $1M/month. โŒ Multiple fraud platforms - one is enough. Two overlapping contracts is the most common way to double a bill for nothing. โŒ Revenue analytics platforms - processor reports are still adequate here. --- ## Over $1M/Month: Full Stack ### What to Use | Tool Category | Recommendation | Cost | |---------------|----------------|------| | **Processor** | Stripe, Adyen, Helcim or Checkout.com | Adyen publishes no SMB rate card: Interchange++ plus a $0.13 processing fee, indicative card markup 0.60%, and Adyen labels its own figures indicative. Helcim publishes the $1M-$5M/month band openly at interchange + 0.15% + $0.06 in person, + 0.15% + $0.15 online. Checkout.com quotes only | | **Fraud detection** | Sift, Signifyd, Forter or Riskified | Not published, on price or on minimum | | **Dispute alerts** | Verifi + Ethoca | Not published | | **Chargeback guarantee** | Signifyd or Forter | Not published. Signifyd charges a percentage of approved order value with no charge on fraud declines. The percentage isn't published. Forter publishes no model at all | | **Manual review** | In-house team or outsourced | In-house analyst salary band, roughly $60K-$80K/year. Outsourced review is quoted per seat or per hour | | **Analytics** | Stripe Sigma plus a BI tool | Sigma is usage-based per row. BI platforms are seat-based and quoted | | **Reconciliation** | Accounting integration | Priced by your accounting platform | *Sources: [Adyen pricing](https://www.adyen.com/pricing), [Helcim pricing](https://www.helcim.com/pricing/), [Checkout.com pricing](https://www.checkout.com/pricing), [Signifyd pricing](https://www.signifyd.com/pricing/). Verified 2026-08-02.* **On Adyen specifically**, because the misinformation is widespread. Adyen publishes no SMB rate card and no annual volume floor. There's no $10M/year minimum on its pricing page. What Adyen does say: "we do not have monthly fees, set-up fees, integration fees or closure fees. We do have a minimum invoice depending on industry or business model." No amount attached. And it caveats the whole table with "the fees outlined above are indicative." So expect Interchange++ plus $0.13 per transaction. Get the minimum monthly invoice in writing before you commit engineering time. **Checkout.com** offers a flat-rate model and an Interchange++ one, priced "based on your business profile and risk category, nothing else." No setup or account maintenance fees. Ask which model applies to you. Ask how scheme fees are treated under Interchange++. And ask whether there's a monthly minimum. **Total monthly tool cost**: not a number this page can honestly print. The three biggest lines here are all quote-only. Fraud platform, guarantee, alerts. And the guarantee is a percentage of volume, not a flat fee. Build the budget from four written quotes. Re-quote annually. ### When to Add Each **Manual review team** (at $1M-$2M): - Full-time fraud analyst, roughly $60K-$80K/year in salary. - Reviews flagged orders, tunes rules, owns the tooling. **Chargeback guarantee** (at $2M+ or 0.8%+ CB ratio): - Cost is a percentage of approved order value. Signifyd publishes the model but not the percentage. Forter publishes neither. - Both cover approved fraud orders. - Worth it if your CB ratio is pushing 0.8%. - Price the guarantee against your actual fraud chargeback losses over the last twelve months first. A percentage of *approved* volume gets charged on every good order too. That's why guarantees run expensive at low fraud rates and cheap at high ones. **Analytics platform** (at $3M+): - Looker, Tableau, or custom BI. - Seat-based and negotiated, so get a quote rather than a list price. - Buys you analysis the processor dashboard can't do. ### Multi-Processor Strategy **At $5M+/month, consider**: - Primary: your main gateway, for most volume. - Secondary: Braintree at 2.89% + $0.29. Or PayPal for PayPal-native checkout at 3.49% + $0.49, and 2.99% + $0.49 on standard card payments. - Backup: a second acquirer, for redundancy. **Don't pick a secondary on rate alone.** Braintree at 2.89% + $0.29 and Stripe at 2.9% + $0.30 differ by 0.01% and one cent. That's about a penny on a $50 order and six cents on a $500 one. No breakeven ticket worth calculating. Choose on features. Braintree gives you native PayPal and Venmo. Stripe gives you a broader product surface and better docs. **Where the processors actually differ is dispute economics**, and this gap is far larger than the rate gap: | Processor | Dispute cost | Returned if you win? | |-----------|--------------|----------------------| | **Helcim** | $0 if resolved in your favour, $15 if lost | Yes, you pay nothing on a win | | **Square** | **$0.** "There are no fees for dispute management services for chargebacks" | Nothing to refund. The Payment Terms separately reserve the right to recover network fines, which are not the same thing | | **Braintree** | $15.00 | Not stated to be refunded | | **Stripe** | $15 to receive the dispute, plus $15 to counter it | The received fee is never returned. The countered fee is returned only on an outright win. On a partial win, neither is returned, so fighting and partly winning costs $30 | | **PayPal**, standard | $15 on PayPal-account and Guest Checkout disputes, $20 on card chargebacks. Never both | The $15 isn't charged when the case is decided in your favour. The $20 is charged either way | | **PayPal**, above a 1.5% dispute ratio | $30 | **No.** The win exemption disappears at this tier | | **Moneris** (CAD) | $25.00 CAD, plus an $80.00 CAD authorization chargeback handling fee | Not stated to be refunded | *Sources: [Helcim](https://www.helcim.com/pricing/), [Square](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough), [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees), [Stripe disputes](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes), [PayPal fees](https://www.paypal.com/us/business/paypal-business-fees) and [PayPal User Agreement](https://www.paypal.com/us/legalhub/paypal/useragreement-full), [Moneris](https://www.moneris.com/en/pricing). All read 2026-08-02. Moneris figures are Canadian dollars.* Run 100 disputes a month through that table. On Square it costs $0. On Helcim, winning all 100 costs $0 and losing all 100 costs $1,500. On PayPal it's $1,500 on wallet traffic, $2,000 on card traffic, $3,000 once you're over the 1.5% line. Wins included. On Stripe, fighting all 100 and partially winning costs $3,000, because neither fee comes back on a partial win. That spread beats a one-cent difference in the card rate. Almost no comparison table shows it. **Cost of running two processors**: extra reconciliation, integration and labor. **Benefit**: negotiation leverage and uptime insurance. --- ## Tool ROI Calculator ### When Does a Tool Pay for Itself? **Formula**: a tool saves money if: ``` (Chargebacks prevented x CB true cost) > Tool monthly cost ``` Two of those three inputs are yours to measure. The third is tool cost, and that's a quote for almost every vendor here. So you can't run this from published data alone. Get the quote first. Then run the math. **Example - dispute alerts at $250K/month**: **Without alerts**: - 30 chargebacks a month. - Cost: 30 x $85 = $2,550. **With alerts**, on a $400/month quote: - 12 prevented, at 40% deflection. - 18 chargebacks still land. - CB cost: 18 x $85 = $1,530. - Tool cost: $400. - **Total $1,930 against $2,550. You save $620 a month.** **ROI**: positive at that quote. Buy it. --- **Example - fraud platform at $100K/month**: **Without a fraud platform**: - 15 chargebacks a month, at a 0.6% ratio. About half are fraud. - Cost: 15 x $85 = $1,275. **With SEON Starter at its published $699/month**: - About 8 of your chargebacks are fraud. - A tool stopping 30% of fraud prevents about 2. - 13 chargebacks still land: 13 x $85 = $1,105. - Tool cost: $699. - **Total $1,804 against $1,275. You lose $529 a month.** And that's the cheapest published option. The 2,500-check Starter allowance may not even cover your order count at $100K a month. That pushes you into Premium, at custom pricing. Every quote-only vendor lands higher than $699. **ROI**: negative. Don't buy yet. **Wait until**: - Volume hits $300K+. Or - your CB ratio hits 0.8%+. Or - fraud losses pass $3K a month. --- ## Quick Decision Matrix | Your Volume | Your CB Ratio | Tool Stack Recommendation | |-------------|---------------|---------------------------| | Under $50K | Any | Processor only | | $50K-$100K | Under 0.5% | Processor only | | $50K-$100K | 0.5-0.7% | Processor + dispute alerts | | $100K-$250K | Under 0.6% | Processor + dispute alerts | | $100K-$250K | 0.6-0.8% | Processor + alerts + consider fraud tool | | $250K-$1M | Any | Processor + alerts + fraud tool | | Over $1M | Under 0.6% | Full stack without guarantee | | Over $1M | 0.6-0.9% | Full stack + chargeback guarantee | --- ## Tool Vendor Quick Reference ### Fraud Detection (Choose One) | Vendor | Best For | Published price | Published minimum volume | |--------|----------|-----------------|--------------------------| | **Stripe Radar Lite** | Stripe users | Included with Stripe Payments at no extra charge | None | | **Stripe Radar paid tiers** | Stripe users needing rules and review | VENDOR Monthly subscription with an included screen allowance, or pay-as-you-go from $0.05/screen. Business: **$10 / $14 / $20** a month for Standard / Plus / Pro. Platforms and marketplaces: **$20 / $44 / $70** (US list, 4 Aug 2026) | None | | **SEON** | SMBs writing their own rules | $699/month Starter: 2,500 checks, 10 users, 50 custom rules. Premium custom. No free tier | Not published. Reported median contract $56,900/yr | | **Sift** | General e-commerce | Not published, 404 | Reported median $150,000/yr, range $29,600-$600,000, from a stated sample of 50 | | **Signifyd** | Guarantee model | Model only: percentage of approved order total, no charge on fraud declines | Reported median $4,444/yr. Not credible for enterprise | | **Forter** | Enterprise | Not published | Reported median $8,000/yr, contradicted by the same source's "mid-six figures" enterprise description | | **Riskified** | Apparel, maximize approvals | Not published as a rate. Derived 0.237% of GMV from Q1 2026 results | Not published | | **Sardine** | Banks and fintechs more than merchants | Not published, 404 | Reported median $95,333/yr. Minimum monthly commit with drawdown | | **Ravelin** | Marketplaces, delivery, travel | Not published. The pricing URL exists and carries no pricing | Nothing found from any methodologically stated source | *Vendor sources: [Stripe Radar](https://stripe.com/radar/pricing), [SEON](https://seon.io/pricing/), [Sift](https://sift.com/), [Signifyd](https://www.signifyd.com/pricing/), [Forter](https://www.forter.com/), [Riskified Q1 2026](https://www.stocktitan.net/news/RSKD/), [Sardine](https://www.sardine.ai/), [Ravelin](https://www.ravelin.com/pricing). Reported ranges: [Vendr](https://www.vendr.com/marketplace/sift-science), a SaaS buying platform that sells negotiation services. Verified 2026-08-02.* One note on Radar. "Radar for Fraud Teams" is no longer a product you can buy, so ignore any comparison still quoting it at $0.02 per transaction. The live tiers are Lite, Standard, Plus and Pro, and Lite is free with Stripe Payments. ### Dispute Alerts (Need Both Networks) | Vendor | Networks | Published price | How to Buy | |--------|----------|-----------------|------------| | **Verifi (CDRN)** | Visa + Discover | NOT PUBLISHED. Visa publishes no retail rate | Reseller | | **Ethoca** | Mastercard, claims all networks | NOT PUBLISHED. Mastercard publishes no retail rate | Reseller | | **Stripe RDR** | Visa only | NOT PUBLISHED | Enable in the Stripe Dashboard, then ask what a resolution costs | | **Chargeblast** | Ethoca, CDRN, RDR | **$14 per chargeback stopped**. Alerts from $19/mo. Recovery 15% on wins. Cheapest published deflection price found | Direct or Shopify | | **Disputifier** | Ethoca, CDRN, RDR, Order Insight | **$17-$27.50 per alert**. Recovery 20% capped at **$250 per won chargeback**. Prevention $0.05/order | Direct or Shopify | | **Chargeflow** | Verifi + Ethoca | **$29 per deflected chargeback**. Prevent $0.20/scanned transaction, first 1,000 free. Recovery 25%, uncapped | Direct or Shopify | | **ChargePay** | Representment only | **$19.99 to $99.99/month** flat, unlimited chargebacks, 17% off annually. A structurally different risk allocation from 20-25% of recoveries | Shopify | *Networks publish nothing. Reseller prices from Shopify App Store listings, where Shopify requires developers to declare charges, plus each vendor's own pricing page where it carries figures. Checked 2026-08-02. Chargeblast's numbers are on its Shopify App Store listing rather than [chargeblast.com/pricing](https://www.chargeblast.com/pricing).* **Ask for**: per-alert fee, **the de-duplication rule**, setup fee, monthly minimum, contract term, **which of the four programmes the quote covers**, and whether a deflection keeps the dispute off your chargeback ratio. **Model both structures against your own dispute profile.** A flat monthly fee with unlimited volume is far cheaper for merchants with many small disputes. A percentage of recovery is better with few large ones. And a cap changes the sum again. Disputifier's $250 cap beats Chargeflow's uncapped 25% on any recovery above $1,250. ### Chargeback Guarantee (Optional) | Vendor | Coverage | Published price | When to Use | |--------|----------|-----------------|-------------| | **Signifyd** | Approved fraud orders | Model published, numbers not: a percentage of order total on approved orders, varying by product, vertical, order volume and average ticket. No charge when an order is declined for fraud. Reported median contract $4,444/yr, range to $48,889 | CB ratio above 0.7% | | **Forter** | Approved fraud orders | Not published. Reported median $8,000/yr, range $6,000-$375,000, with the same source describing enterprise as "mid-six figures or higher". Reported multi-year discounts 10-20%, implementation fees low-to-mid five figures | CB ratio above 0.75% | | **Riskified** | Approved fraud orders | Not published as a rate card, but **0.237% of GMV** derived from its own Q1 2026 results is the only public percentage benchmark in this market | CB ratio above 0.7% | *Vendor sources: [Signifyd pricing](https://www.signifyd.com/pricing/), [Forter](https://www.forter.com/pricing/), [Riskified Q1 2026 results](https://www.stocktitan.net/news/RSKD/). Reported ranges: [Vendr](https://www.vendr.com/marketplace/forter), a SaaS buying platform that sells negotiation services and discloses no sample size for these vendors. Verified 2026-08-02.* **Ask every guarantee vendor to quote as a percentage of approved GMV**, not as a monthly fee. Then the three are comparable to each other, and to Riskified's 0.237%. Check the number against your last twelve months of fraud chargebacks. The fee applies to your approved good orders too. Forter's marketing claims of "72% reduction in chargeback rates" and "46% reduction in false declines" carry no published methodology, sample or period. Those are vendor claims. Never present them as verified. ### Analytics (Optional) | Tool | Best For | Published price | When to Use | |------|----------|-----------------|-------------| | **Stripe Sigma** | Stripe users | Usage-based, priced per row queried. Check the current rate on Stripe's Sigma pricing page | $1M+ | | **Looker / Tableau** | Enterprise BI | Seat-based and quoted, no public list price for the tiers merchants buy | $5M+ | | **Google Analytics** | Traffic and conversion | Free standard tier | Any size | *Checked 2026-08-02.* --- ## Detailed Tool Stack by Tier ### Tier 1: Under $50K/Month **Monthly tool budget**: $0-100 | Category | Tool | Cost | Why | |----------|------|------|-----| | **Processor** | Square Free | 2.6% + $0.15 in person, 3.3% + $0.30 online, 3.5% + $0.15 keyed | No monthly fee, so nothing to justify | | **Processor alternative** | Stripe | No monthly or setup fee. US card rates not stated here | Better developer surface if you're building | | **Fraud** | Radar Lite or Square built-in | $0 | Sufficient at this volume | | **Disputes** | Manual | $0 | Too few chargebacks to justify alerts | | **Analytics** | Processor dashboard | $0 | Simple reports are enough | | **Accounting** | QuickBooks plus processor integration | Priced by your accounting plan | Automation is worth it early | *Sources: [Square fees](https://squareup.com/us/en/payments/our-fees), [Stripe pricing](https://stripe.com/pricing). Verified 2026-08-02.* **What you do manually**: - Review fraud flags in the processor dashboard. - Respond to chargebacks yourself, 1 or 2 a month. - Weekly reconciliation, 30 minutes. **Total time**: 2-4 hours a week on payment operations. --- ### Tier 2: $50K-$250K/Month **Monthly tool budget**: your two alert quotes, and nothing else | Category | Tool | Cost | Why | |----------|------|------|-----| | **Processor** | Stripe | No monthly fee. US card rates not stated here, read them at stripe.com/pricing | Best feature set at this tier | | **Processor alternative** | Helcim | $50K-$100K/month: interchange + 0.35% + $0.07 in person, + 0.45% + $0.20 online. $0 monthly | Published bands that fall with volume, no negotiation needed | | **Processor alternative** | Square Plus | 2.5% + $0.15 in person, 2.9% + $0.30 online. Plan monthly cost not stated here | Lower rates than Free if the plan fee clears | | **Fraud** | Radar Lite | $0 | Still sufficient if CB ratio is under 0.6% | | **Dispute alerts** | Verifi + Ethoca | Not published | **MUST ADD** at this tier | | **Analytics** | Processor dashboard | $0 | Or add Stripe Sigma, usage-based | | **Accounting** | QuickBooks integrated | Priced by your accounting plan | Automation is critical now | *Sources: [Stripe pricing](https://stripe.com/pricing), [Helcim pricing](https://www.helcim.com/pricing/), [Square fees](https://squareup.com/us/en/payments/our-fees). Verified 2026-08-02.* **When to add dispute alerts**: 75 chargebacks a month, or a CB ratio above 0.65%. **ROI of dispute alerts**: - $150K a month at 0.6% is about 23 CBs. - Alerts prevent about 9, at 40% deflection. - Savings: 9 x $85 = $765. - A $350/month quote leaves **net +$415**. A $700 quote is a coin flip. That's why you get the quote before you plan the budget. **What you do manually**: - Review fraud flags, 15 minutes a day. - Respond to 5-10 chargebacks a month, about 3 hours. - Weekly reconciliation, 45 minutes. **Total time**: 4-8 hours a week. --- ### Tier 3: $250K-$1M/Month **Monthly tool budget**: one published price (SEON at $699) plus three quotes | Category | Tool | Cost | Why | |----------|------|------|-----| | **Processor** | Stripe | Stripe publishes no volume threshold, no discount schedule and no negotiated rate band | Ask about custom pricing, but don't plan around a discount nobody advertises | | **Processor alternative** | Helcim | $100K-$500K/month: interchange + 0.25% + $0.07 in person, + 0.35% + $0.20 online. $500K-$1M: + 0.20% + $0.06 in person, + 0.25% + $0.15 online | The rate drop is published, so you can model it before you switch | | **Processor alternative** | Stax | $199+/month for $250K+ **per year**, plus interchange + 0% + $0.08 in person or + $0.15 online | Subscription pricing wins as your volume rises | | **Fraud** | Sift, Signifyd, Forter, Riskified or SEON | Not published for the first four. SEON $699/month for 2,500 checks | **MUST ADD** if CB ratio is above 0.6% | | **Dispute alerts** | Verifi + Ethoca | Not published | Must-have at this tier | | **Chargeback mgmt** | Chargeflow or similar (optional) | Not published | Automates dispute responses | | **Analytics** | Stripe Sigma plus exports | Usage-based per row | Deep analysis starts paying off | | **Accounting** | Automated reconciliation | Priced by your accounting platform | Saves 5-10 hrs/month | *Sources: [Stripe pricing](https://stripe.com/pricing), [Helcim pricing](https://www.helcim.com/pricing/), [Stax pricing](https://staxpayments.com/pricing/), [SEON pricing](https://seon.io/pricing/). Verified 2026-08-02.* **When to add a fraud tool**: CB ratio above 0.7%, or volume above $500K. **ROI of a fraud tool**: - $500K a month at 0.8% is 40 CBs. - Half are fraud, so 20 fraud CBs. - The tool prevents about 6, or 30% of the fraud. - Savings: 6 x $85 = $510. - On a $2,000/month quote, that's about $1,490 net cost. - **Net: negative on pure loss avoidance.** You're buying threshold protection. Decide it as an insurance purchase. Don't pretend it pays for itself. **What you do manually**: - Review the tool's fraud flags, 30 minutes a day. - Respond to 15-20 chargebacks a month, 4-6 hours. - Weekly reconciliation, 1 hour. **Total time**: 8-15 hours a week. Consider part-time help. --- ### Tier 4: Over $1M/Month **Monthly tool budget**: built from four written quotes, not from list prices | Category | Tool | Cost | Why | |----------|------|------|-----| | **Processor** | Stripe, Adyen or Helcim | Adyen: no SMB rate card, Interchange++ plus $0.13 processing fee, indicative markup 0.60%, no published volume floor. Helcim $1M-$5M/month: interchange + 0.15% + $0.06 in person, + 0.15% + $0.15 online, custom above $5M | Interchange-plus beats flat rate at this size, and Helcim's band is published where Adyen's isn't | | **Fraud** | Signifyd, Forter, Sift or Riskified | Not published, on price or minimum | Enterprise-grade decisioning | | **Chargeback guarantee** | Signifyd or Forter (optional) | Not published. Percentage of approved order value at Signifyd, model unpublished at Forter | If CB ratio is above 0.7% | | **Dispute alerts** | Verifi + Ethoca | Not published | Must-have | | **Manual review** | Outsourced or in-house | In-house analyst roughly $60K-$80K/year. Outsourced quoted per seat | Dedicated person or team | | **Analytics** | Sigma plus Looker or Tableau | Sigma usage-based, BI seat-based and quoted | Deep analysis | | **Reconciliation** | Automated platform | Priced by platform | Saves 20+ hrs/month | *Sources: [Adyen pricing](https://www.adyen.com/pricing), [Helcim pricing](https://www.helcim.com/pricing/), [Signifyd pricing](https://www.signifyd.com/pricing/), [Forter](https://www.forter.com/). Verified 2026-08-02.* **Staffing at this tier**: - A full-time fraud and payments person, roughly $60K-$80K a year. - Or an outsourced manual review team, quoted per seat or per hour. **What's automated**: - Fraud decisioning. The tool auto-approves low-risk orders. - Dispute responses, via Chargeflow or similar. - Reconciliation, fully. - Reporting, on automated dashboards. **Total time**: 20-40 hours a week. One full-time person, or split across a team. --- ## Special Scenarios ### High-Risk Business (Supplements, High-Ticket, etc.) **Add a fraud tool earlier**: - At $100K a month, if your CB ratio is above 0.8%. - At $250K a month, whatever the ratio. - Consider a chargeback guarantee at $500K+, once you can price it against your real fraud losses. **Why**: a high CB ratio pushes you into VAMP. Prevention is critical. --- ### Subscription/SaaS **Different tool priorities**: | Volume | Add First | Add Second | |--------|-----------|------------| | Under $100K | Stripe Billing | Dispute alerts | | $100K-$500K | Dispute alerts | Dunning optimization | | Over $500K | Fraud tool | Chargeback automation | **Why different**: subscriptions carry lower fraud but different dispute patterns. Mostly recurring-billing disputes, not stolen cards. --- ### Card-Present Retail **Minimal tools needed**: | Volume | Tool Stack | |--------|------------| | Under $250K/mo | Square POS and built-ins only. 2.6% + $0.15 in person on Free, no monthly fee | | $250K-$1M/mo | Square or Helcim, plus dispute alerts. Helcim's $100K-$500K band is interchange + 0.25% + $0.07 in person | | Over $1M/mo | Compare a full POS against interchange-plus. Helcim publishes $1M-$5M at interchange + 0.15% + $0.06 in person. Clover and Toast publish no rates at all | *Sources: [Square fees](https://squareup.com/us/en/payments/our-fees), [Helcim pricing](https://www.helcim.com/pricing/). Verified 2026-08-02.* **Why minimal**: card-present fraud runs far lower than card-not-present. Tool ROI is weaker. **Looking at a bundled POS? The rate isn't the thing to ask about.** None of the three big POS vendors publishes a full set of usable numbers. Each hides its cost somewhere different. | POS | What's published | What to ask for | |-----|------------------|-----------------| | **Clover** | **2.3% + 10c** card-present for restaurants and quick service, **2.6% + 10c** on entry retail and services plans, **3.5% + 10c** keyed and online. Software $0 to $129.85/mo. Hardware published both outright and on a 36-month subscription. Rapid Deposit 1.75%. **No chargeback fee at any tier** | Who the merchant of record is, Clover Direct or a bank or ISO, because Clover says on its own page that terms "vary based on your service provider". Your effective rate on real statements. The chargeback fee. The contract term and the **30 days' notice** required to stop auto-renewal. Whether hardware is subscribed or bought: Clover's own figures show the 36-month subscription premium running **$227 to $3,622**, with no ownership at term end | | **Toast** | **2.49%** Traditional and **3.09%** Pay-as-you-Go, from Toast's own shop pages. Plans $0 Starter Kit, $69 restaurant, $90 retail. **The + 15c fixed component is reported by third parties, not published by Toast** | The fixed cents component. The card-not-present rate, which Toast publishes nowhere and which is reported at 3.50% + 15c. Whether the rate can rise mid-contract, with a written cap. The term, pushing for 12 months since Toast's own 10-K says 12 to 36. The chargeback fee. Whether payments are contractually locked to Toast, which is still the critical term | | **Lightspeed** | **2.6% + 10c** card-present for retail, and a **$15 chargeback fee** described as a single fee covering the defence. Retail plans $89 / $149 / $289, restaurant $69 / $189 / $399, KDS $30 per screen | **The online rate**, published nowhere on either product line, and the restaurant processing rate, also absent. A card-present rate below list: Lightspeed's own filing implies a 1.90% blended take and its payments page lists "negotiate a competitive rate" as a bullet. Hardware cost, because Lightspeed says existing terminals can't be reused | *Sources: [Clover pricing](https://www.clover.com/pricing), [Toast shop pages](https://pos.toasttab.com/shop/starter-kits) and [pricing](https://pos.toasttab.com/pricing), [Lightspeed retail pricing](https://www.lightspeedhq.com/pos/retail/pricing/) and [payments](https://www.lightspeedhq.com/payments/). Verified 2026-08-02.* **The pattern worth noticing:** all three get reported as publishing nothing. All three publish a card-present rate. --- ## Common Tool Mistakes ### Mistake 1: Buying a Fraud Tool Too Early **Symptom**: a $100K/month business paying $699 for SEON Starter, or four figures for a quote-only platform. Meanwhile Radar Lite sits unused and free. **Cost**: $699 a month minimum, against roughly $170 in prevented chargebacks at that volume. **Fix**: fall back to your processor's included screening. Wait until you're past $500K a month or a 0.8% CB ratio. --- ### Mistake 2: No Dispute Alerts at $500K **Symptom**: $500K a month, 40 chargebacks, no alerts running. **Cost**: 16 preventable CBs x $85 = $1,360 a month, gone. **Fix**: get quotes from Verifi and Ethoca. Neither publishes a rate. So the only decision that matters is whether the two quotes together land under $1,360. --- ### Mistake 3: Using Multiple Fraud Tools **Symptom**: Sift and Signifyd both running on the same order flow. **Cost**: two quote-only contracts doing overlapping work. Neither vendor will tell you what the other charges. **Fix**: pick one and cancel the other. Use the cancellation as leverage at the next renewal. --- ### Mistake 4: Chargeback Guarantee Too Early **Symptom**: a $300K/month business quoted 1.5% of approved volume for a guarantee. **Cost**: $4,500 a month, covering maybe $500 in fraud chargebacks. The fee applies to your good approved orders too, not just the fraudulent ones. **Fix**: cancel the guarantee and run a standard fraud tool. Revisit when fraud chargebacks alone pass the quoted percentage of your approved volume. --- ### Mistake 5: No Tools at $1M/Month **Symptom**: $1M a month, 80 chargebacks, manual fraud review. **Cost**: 80 x $85 = $6,800. Plus about 40 hours of labor at $50 an hour. $8,800 a month. **Fix**: a fraud platform plus alerts. If the two quotes together come in under $8,800, you're ahead from month one. Get the quotes before you assume they will. --- ## Test to Run **Considering a new tool? Run the ROI calculator:** **Week 1: Calculate current cost** 1. Chargebacks per month: ______ 2. True cost per CB: $______ (fee + product + labor) 3. Total CB cost: $______/month **Week 2: Get a written quote** 4. Tool monthly cost: $______. You'll have to ask. Most vendors don't publish 5. Tool prevents: ___% of chargebacks. That's a vendor claim, so discount it 6. Chargebacks prevented: (1) x (5) 7. Savings: (6) x (2) **Week 3: Decision** 8. Net benefit: (7) - (4) = $______ 9. Positive? Buy the tool 10. Negative? Wait for volume or CB count to rise **Success criteria**: every tool you buy has positive ROI inside 3-6 months. Calculated against a written quote, not a range you found online. **Already processing? Audit the stack you have:** **Week 1: List current tools** 1. What are you paying for? 2. Monthly cost for each: $______ 3. Total tool spend: $______/month **Week 2: Calculate ROI for each** 4. For each tool, estimate chargebacks prevented 5. Work out savings: CBs prevented x true CB cost 6. Compare to what you're actually billed. Not the list price you remember **Week 3: Decision** 7. Negative ROI? Cancel it 8. Missing tool with positive ROI? Get quotes 9. Right-size the stack for your volume **Success criteria**: every tool you pay for has positive ROI. And no tool you're missing would. --- ## Scale Callout **Starting out (under $10K/month):** - Zero paid tools. - Processor built-ins only. - Manual everything. - Your real cost is the processing rate. Plus instant payout fees if you use them: Square 1.95%, Stripe US 1.5%. **Growing ($50K-$250K):** - Add dispute alerts at $100K, or at a 0.6% CB ratio. - Fraud review is still manual. - Budget from two alert quotes. Neither provider publishes a rate. **Scaled ($500K-$2M):** - Fraud tool required. - Dispute alerts required. - Consider hiring help. - One published SMB fraud price to anchor against: SEON at $699 a month for 2,500 checks. Everything else is a quote. **Enterprise ($5M+):** - Full stack. - Dedicated team. - Custom integrations. - Nobody's list price applies at this size. Helcim publishes bands to $5M a month, then goes custom. Adyen, Checkout.com, Clover and Toast are quote-only throughout. --- ## Where This Breaks 1. **Most of these vendors publish no price, and a reported range is no substitute for a quote.** Vendr discloses a sample size for exactly one vendor, Sift. Its Signifyd and Forter medians contradict its own segment descriptions. Vendr also sells negotiation services, so its "discounts achievable" figures read as achievable rather than typical. Every ROI number here is only as good as the quote you plug into it. The reported ranges tell you whether a quote is in the right order of magnitude. Nothing more. 2. **ROI calculations assume the tool works.** A high false positive rate means you decline good orders. Factor lost sales into the ROI. Ask every vendor for a false positive rate before you sign. 3. **Contract lock-in.** Many tools require annual contracts. Calculate the full-year cost, not the monthly one. And ask about the termination clause before the renewal, not during it. 4. **Integration costs aren't included.** Adding a tool takes dev time, often 10-40 hours. Put that in the payback period. 5. **Effectiveness varies.** 40% chargeback deflection is a rough average. Yours might be 20% or 60%. Monitor actual performance and re-run the math after 90 days. 6. **Volume spikes.** Jump from $100K to $500K in a month and you need tools immediately. There's no time for an ROI analysis. 7. **Prices move and geography matters.** Every figure here was read on 2 August 2026. Stripe and Shopify both resolve country by request IP, not by URL path. So a rate read from outside your market is your market's rate only by coincidence. Two Stripe fees are actually inverted between the US and Canada. Check the vendor's own page from your own country before you commit. 8. **"They don't publish rates" is usually wrong.** Clover, Toast, Square's plan prices, Shopify's and Stripe's US cards and Lightspeed's card-present rate all get reported as unpublished. All six are published. Check the shop pages and the help centre, not just the pricing page, and make sure you're on your own country's version of the site. --- ## Next Steps **Choosing your first tool?** 1. Work out your current CB ratio and count 2. Use the decision matrix above 3. Start with dispute alerts at $100K+, or a 0.6%+ ratio **Optimizing your current stack?** 1. Run an ROI audit on each tool against your actual invoice 2. Cancel anything with negative ROI 3. Get quotes for what you're missing **Growing fast?** 1. Plan tool additions three months ahead 2. Budget for the next tier before you need it 3. Don't wait for a crisis to start procurement --- ## Sources All figures on this page were read from the vendor's own published pricing page and verified on **2 August 2026**. Processors: [Square](https://squareup.com/us/en/payments/our-fees), [Stripe](https://stripe.com/pricing), [Stripe disputes](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes), [Stripe instant payouts](https://docs.stripe.com/payouts/instant-payouts), [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees), [PayPal](https://www.paypal.com/us/business/paypal-business-fees), [Helcim](https://www.helcim.com/pricing/), [Stax](https://staxpayments.com/pricing/), [Adyen](https://www.adyen.com/pricing), [Checkout.com](https://www.checkout.com/pricing), [Moneris](https://www.moneris.com/en/pricing). POS: [Clover](https://www.clover.com/pricing), [Toast](https://pos.toasttab.com/shop/starter-kits), [Lightspeed](https://www.lightspeedhq.com/pos/retail/pricing/). Fraud and disputes, vendor: [Stripe Radar](https://stripe.com/radar/pricing), [SEON](https://seon.io/pricing/), [Sift](https://sift.com/), [Signifyd](https://www.signifyd.com/pricing/), [Forter](https://www.forter.com/pricing/), [Sardine](https://www.sardine.ai/), [Ravelin](https://www.ravelin.com/pricing), [Chargeflow](https://www.chargeflow.io/pricing), [Disputifier](https://www.disputifier.com/pricing), and the [Chargeblast](https://apps.shopify.com/chargeblast), [Disputifier](https://apps.shopify.com/disputifier), [Chargeflow](https://apps.shopify.com/chargeflow) and [ChargePay](https://apps.shopify.com/chargepay) Shopify App Store listings. Fraud and disputes, reported: [Vendr](https://www.vendr.com/marketplace/sift-science), a SaaS buying and negotiation platform. **It sells negotiation services.** And it discloses a sample size for one vendor only, Sift, at 50 purchases. Treat its medians as order-of-magnitude brackets, not prices. Fraud and disputes, derived: [Riskified Q1 2026 results](https://www.stocktitan.net/news/RSKD/), released 2026-05-13. The 0.237% of GMV figure is calculated from Riskified's published revenue and GMV, not a company disclosure. It came via a financial news aggregator republishing the press release. It hasn't been checked against Riskified's own investor filings. Confirm against the 20-F before republishing. **Where a vendor genuinely publishes nothing, this page says what to ask for instead.** And if you see a firm monthly price for Sift, Signifyd, Forter or Riskified presented as a vendor figure, ask the author where it came from. None of the four publishes one. --- ## See Also - [Total Cost Model](/docs/payments/total-cost-model) - Include tools in budget - [Fraud Vendor Selection](/docs/fraud/vendors/selection-guide) - How to evaluate tools - [Fraud Vendor Landscape](/docs/fraud/vendors/landscape) - All vendors compared - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, Verifi details - [Operations Checklist](/docs/operations/checklist) - When to review tool performance - [Business Model Viability](/docs/payments/business-model-viability) - Tool costs in unit economics - [Processor Comparison](/docs/payments/processor-comparison) - Processor built-in tools --- ## Total Payment Cost Model Source: https://paymentsandrisk.com/docs/payments/total-cost-model # Total Payment Cost Model :::info[TL;DR] - All-in payment costs run 4-6% of gross revenue, not the 2.9% headline. Chargebacks, fraud tools, reserves and working capital never show up in that headline. They add up - The biggest hidden cost is chargebacks. Each 1% chargeback rate eats about 4% of gross revenue: reversal, fee, lost product, staff time - Your chargeback fee isn't a fixed $15. Published US fees run **$0 to $30**. Most charge $15. Square and the Authorize.net gateway charge nothing. Helcim, Shopify Payments and PayPal's standard tier give it back when you win. Put your own number in this model - Model payment costs against gross margin, not gross revenue. A 5% payment cost on a 20% margin eats a quarter of the margin - Run this before launch, then again every quarter. Your cost profile shifts as volume and product mix change. Last quarter's numbers won't hold ::: :::note[Where the rates in this model come from] Every processor rate below was read off the vendor's own pricing page on **2 August 2026**, with Stripe's US rates read from a US connection on **4 August 2026**. Each one is linked where it's used. The online examples use Braintree's published US card rate of **2.89% + $0.29** ([source](https://www.paypal.com/us/enterprise/paypal-braintree-fees)). Stripe's 2.9% + $0.30 sits one hundredth of a point and one cent away, so every example here holds for either. Substitute your own processor's published rate. Interchange-plus examples use one blended pass-through assumption: **1.03% + $0.178 card-present** and **1.50% + $0.172 online**. That's interchange of 0.89% + $0.158 and 1.36% + $0.152, plus an assumed 0.14% + $0.02 of network assessments. Neither Visa nor Mastercard publishes that assessment figure. This site carries it as **unverified**. The card mix, sources and arithmetic are at [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). Your own statement beats the assumption every time. ::: Most SMBs budget 3% for "payment processing". Then the real costs land at 4-6%. Processing fees are just the start. Chargebacks, fraud tools, reserves and working capital all cost money. 3% What SMBs budget for processing 4-6% Actual all-in payment costs $21.5K/mo True cost at $500K/month volume This page shows you how to calculate what you're actually paying. ## Why Your Payment Costs Are Higher Than You Think **What SMBs budget**: 3% processing fees **What SMBs actually pay**: 4-6% effective all-in cost **The hidden costs**: - Chargeback fees ($0 to $30 each, depending entirely on your processor) - Lost product on chargebacks - Fraud prevention tools (SEON publishes $699/month for 2,500 checks; almost every other vendor won't publish a price at all) - Chargeback alerts (quoted per merchant, not published) - Labor (responding to disputes, reviewing fraud) - Reserves locked up (10-30% of revenue) - Working capital cost of 2-3 day settlement delay **At $500K/month volume, $75 average order, 0.5% CB ratio, Braintree at 2.89% + $0.29**: - Processing: $16,383 (3.28%) - Chargebacks: $2,805 (33 disputes at $85 all-in each) - Tools: $800 - Labor: $1,000 (20 hours/month at $50/hr) - Working capital: $500 (interest on locked funds) - **Total: $21,488/month (4.30% effective)** ```mermaid %%{init: {'themeVariables': {'xyChart': {'titleColor': '#3b82f6', 'plotColorPalette': '#3b82f6'}}}}%% xychart-beta title "Monthly Cost Breakdown ($500K/mo volume)" x-axis ["Processing", "Chargebacks", "Tools", "Labor", "Working Capital"] y-axis "Cost ($)" 0 --> 18000 bar [16383, 2805, 800, 1000, 500] ``` **That's 43% more than the 3% you budgeted.** ```mermaid %%{init: {'themeVariables': {'pieStrokeColor': '#3b82f6', 'pieOuterStrokeColor': '#3b82f6', 'pieSectionTextColor': '#fff', 'pie1': '#3b82f6', 'pie2': '#ef4444', 'pie3': '#f59e0b', 'pie4': '#8b5cf6', 'pie5': '#6b7280'}}}%% pie title Where Your 4-6% Goes "Processing Fees" : 76 "Chargebacks" : 13 "Tools" : 4 "Labor" : 5 "Working Capital" : 2 ``` --- ## Complete Cost Model Worksheet ### Step 1: Processing Fees (Base Cost) | Your Data | Calculation | |-----------|-------------| | Monthly volume: $______ | A | | Processor rate: ____% + $____ | B | | Average transaction: $______ | C | | Transaction count: ______ | D = A / C | **Processing fees** = (A ร— B%) + (D ร— B$) **Example**: - Volume: $500,000 - Rate: 2.89% + $0.29 (Braintree, [published](https://www.paypal.com/us/enterprise/paypal-braintree-fees), verified 2026-08-02) - Avg transaction: $75 - Count: 6,667 transactions - **Fees: $14,450 + $1,933 = $16,383 (3.28%)** Run it again with your own processor's published rate. Square's Free-plan online rate is 3.3% + 30c. Same volume, same ticket: $16,500 + $2,000 = **$18,500** ([published](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02). Helcim needs more care. It's interchange-plus, and the markup steps down with monthly volume. Interchange + 0.50% + 25c is the **$0-$50K** entry tier. A merchant doing $500,000 a month is two bands past it. Helcim's published online schedule puts $500,000 exactly on the line between the $100K-$500K band and the $500K-$1M band. Model both, then ask Helcim which row it applies at the boundary ([published](https://www.helcim.com/pricing/), verified 2026-08-02): | Helcim online band | Percentage markup on $500,000 | Per-transaction markup on 6,667 | Total markup | |---|---|---|---| | $100K-$500K: +0.35% + 20c | $1,750 | $1,333 | **$3,083** | | $500K-$1M: +0.25% + 15c | $1,250 | $1,000 | **$2,250** | Add pass-through on top of that markup to get the real bill. On the blended online assumption of 1.50% + $0.172, pass-through here is $7,500 + $1,147 = **$8,647**. Processing lands at **$11,730** (2.35%) on the $100K-$500K band. On the $500K-$1M band it's **$10,897** (2.18%). Braintree is $16,383. So the saving is $4,653 to $5,486 a month, and the band question alone is worth $833 of it. Price a $500K merchant at the entry tier and you overstate Helcim's markup by $1,084 to $1,917 a month. That's the most common way this comparison gets run wrong. Your volume picks the band. Your card mix decides whether interchange-plus actually beats a flat rate. Pass-through is roughly three quarters of the interchange-plus bill at this ticket size. See [the card-mix test](/docs/payments/processor-comparison#the-card-mix-test-not-the-volume-test) and [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). --- ### Step 2: Chargeback Costs (Often Underestimated) | Your Data | Calculation | |-----------|-------------| | Chargeback ratio: ____% | E | | Chargeback count: ______ | F = (D ร— E%) | | Chargeback fee: $______ | G (look it up, see table below) | | Product cost per CB: $______ | H (avg product value ร— 0.7) | | Shipping cost per CB: $______ | I | | Labor per CB: $______ | J ($10-30) | **Chargeback cost per incident** = G + H + I + J **Total chargeback cost** = F ร— (G + H + I + J) **G isn't $15 for everyone. It's never $100.** These are the published US fees. Every one was read off the vendor's own page on 2026-08-02: | Processor | Fee per dispute | Refunded if you win? | |-----------|-----------------|----------------------| | [Square](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough) | **$0.** "There are no fees for dispute management services for chargebacks" | Nothing to refund | | [Authorize.net](https://www.authorize.net/en-us/sign-up/pricing.html) | **$0.00** on card chargebacks. $25.00 on eCheck.Net | Nothing to refund on cards | | [Helcim](https://www.helcim.com/pricing/) | **$0** if resolved in your favour, $15 if lost | Yes, by design | | [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | $15.00 | Not stated | | [Shopify Payments](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process) | $15.00 in the US | Yes. "If you win the chargeback, then the fee is returned to you" | | [Stripe](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) | $15 to receive, plus $15 to counter | Received fee never returned. Countered fee returned only on an outright win, not a partial one | | [Toast](https://support.toasttab.com/en/article/Chargeback-FAQ) | $15.00 | No. Charged win or lose | | [PayPal standard](https://www.paypal.com/us/business/paypal-business-fees) | $15.00 dispute fee | Yes. Not charged when the case is decided in your favour | | [PayPal high volume](https://www.paypal.com/us/legalhub/paypal/useragreement-full) | $30.00 dispute fee once your dispute ratio hits 1.5% with 100+ sales in the prior three months | **No.** The win exemption disappears at this tier | | [PayPal chargeback fee](https://www.paypal.com/us/business/paypal-business-fees) | $20.00, on card transactions only | No. Charged "regardless of whether the buyer is successful" | | [Moneris](https://www.moneris.com/en/pricing) | CA$25, plus CA$80 authorization chargeback handling | Not stated | | [Stax](https://staxpayments.com/pricing/) | $25 with the optional chargeback protection add-on | Not applicable | | [Adyen](https://www.adyen.com/pricing) | Not published | Unknown | | [Clover](https://www.clover.com/pricing) | Not published | Unknown | | Worldpay | Not published | Unknown | | [Global Payments](https://help.globalpaymentsintegrated.com/1/getting-started/terminology-and-transactions/chargebacks/) | Not published. Says only that "your processor charges you a fee for each chargeback you receive" | Unknown | | [Nuvei](https://document.nuvei.com/tos/us/Wells-TOS-MBA-20200206.pdf) | Per contract, on Schedule A of your merchant application | Unknown | Two rows need reading carefully. **Authorize.net's $0.00 and Shopify's $15 aren't the whole bill.** Authorize.net is a gateway. The merchant account behind it charges its own chargeback fee. That fee isn't on Authorize.net's schedule. Shopify says the same thing: "your bank charges a processing fee." Zero at the gateway isn't zero at the merchant. **PayPal's two fees are exclusive, not additive.** The $15 (or $30) dispute fee covers transactions through a PayPal account or Guest Checkout. The $20 chargeback fee covers card transactions that went through neither. No PayPal merchant pays $35 on one dispute. :::caution[Where "$100 a chargeback" came from] It isn't on any processor's fee schedule. It traces to one undated, unsourced sentence in [Adyen's own marketing article](https://www.adyen.com/knowledge-hub/understanding-chargebacks): "Every chargeback comes with a fee, typically between $20 and $100 per dispute." Adyen's actual [pricing page](https://www.adyen.com/pricing) publishes no dispute fee at all. Square has every commercial reason to make rivals look expensive. On its own site it [puts the range at "$10 to $25"](https://squareup.com/us/en/the-bottom-line/managing-your-finances/what-is-a-chargeback-what-makes-it-happen). Even that overshoots. The highest published US figure above is $30. Ranges like "$0 to $35" and "$15-100" circulate for this. Both are laundered vendor marketing, and neither survives the fee schedules. ::: :::note[The big numbers are network fees, not processor fees] Nothing in the table goes past $30. Bigger dispute numbers do exist. The networks and the monitoring programs charge those, not your processor: - **Visa arbitration filing fee: USD 600**, charged on top of the disputed amount ([Adyen docs](https://docs.adyen.com/risk-management/chargeback-guidelines/visa-chargebacks), read 2026-08-02) - **Diners and Discover arbitration filing fee: USD 500**, also on top of the disputed amount ([Adyen docs](https://docs.adyen.com/risk-management/chargeback-guidelines/diners-discover-chargebacks), read 2026-08-02) - **Up to $500** from the networks for contesting a dispute they treat as near-indisputable, meaning Visa 10.1 and 10.2 and Mastercard 4870 and 4871 ([Toast](https://support.toasttab.com/en/article/Chargeback-FAQ), read 2026-08-02) - **$8 per CNP dispute** once [VAMP](/docs/chargebacks/monitoring/thresholds) has you - **30% of the disputed amount** on every dispute Stripe's Smart Disputes wins for you ([stripe.com/pricing](https://stripe.com/pricing), read 2026-08-02) Rolling those into a "processor fee" range is exactly how "$15 to $100" got built. Keep them apart and both numbers stay usable. ::: **Example** (Braintree, physical goods): - CB ratio: 0.5% - CB count: 33 chargebacks - Fee: $15 - Product lost: $50 - Shipping: $8 - Labor: $12 (30 min at $25/hr) - **Cost per CB: $85** - **Total: $2,805/month** The same 33 disputes on PayPal cost **$15 each** through a PayPal account or Guest Checkout. Card transactions that went through neither cost **$20 each**. Not $35. The two fees don't stack. Fees run $495 or $660 a month. Total chargeback cost is $2,805 or $2,970. Cross PayPal's high-volume line and the picture changes. Hit a 1.5% dispute ratio with 100+ sales in the prior three months and the fee doubles to $30. The win exemption goes away too. Those 33 disputes then cost $990 a month, every one of them, including the ones you win. On Helcim, if you win two thirds of them, the fee line drops to 11 x $15 = $165 instead of $495. On Square it's $0. --- ### Step 3: Fraud Prevention Tools | Tool Category | Your Cost | When You Need It | |---------------|-----------|------------------| | **Processor built-in** | $0-100 | Under $100K/month: sufficient | | **Dispute alerts** | $200-1,000 | Over $100K/month: must-have | | **Fraud detection** | $500-5,000 | Over $500K or CB >0.7%: needed | | **Manual review** | $1,000-3,000 | Over $1M/month: consider | | **Analytics** | $0-500 | Nice-to-have at any scale | **Your tool costs**: $______ /month :::warning[Almost no fraud vendor publishes a price] Of the fraud platforms checked on 2026-08-02, exactly one publishes real numbers. [SEON](https://seon.io/pricing/) lists Starter at **$699/month for 2,500 fraud checks**, ten users and fifty custom rules. Premium is quote-only. That's about 28 cents a check. It's the only public anchor you have for judging every quote-only vendor. Signifyd publishes its pricing *model* but no numbers. It "charges a percentage of the order total when an order is approved," with "no charge when an order is declined due to fraud" ([source](https://www.signifyd.com/pricing/)). Riskified, Forter, Sardine, Sift, Kount and Accertify publish neither a model nor a rate. Treat every number in the table above as a placeholder until you've got a written quote. ::: **Example** ($500K/month): - Stripe Radar Lite: $0, included with Stripe Payments. Radar Standard, Plus and Pro are paid subscriptions with an included screen allowance ([source](https://stripe.com/radar/pricing)). US tier prices not verified on 2026-08-02 - Dispute alerts (Verifi, Ethoca): $400, quoted. Neither provider publishes alert pricing, so get your own quote - **Total: $400/month** --- ### Step 4: Labor Costs | Task | Hours/Month | Rate | Cost | |------|-------------|------|------| | **Chargeback responses** | CB count ร— 0.5 hrs | $__/hr | $____ | | **Fraud review** | Flagged orders ร— 0.25 hrs | $__/hr | $____ | | **Reconciliation** | 4-8 hrs | $__/hr | $____ | | **Processor management** | 2-4 hrs | $__/hr | $____ | | **Reporting/analysis** | 2-4 hrs | $__/hr | $____ | **Total labor**: $______ /month **Example** ($500K/month, 0.5% CB ratio): - 33 chargebacks ร— 0.5 hrs ร— $50/hr = $825 - 100 fraud reviews ร— 0.25 hrs ร— $50/hr = $1,250 - Reconciliation: 6 hrs ร— $50 = $300 - Management: 3 hrs ร— $50 = $150 - **Total: $2,525/month** --- ### Step 5: Reserves and Working Capital | Reserve Type | Calculation | Your Amount | |--------------|-------------|-------------| | **Rolling reserve** | Volume ร— reserve % | $______ locked | | **Fixed reserve** | Flat amount | $______ locked | | **Working capital cost** | Locked funds ร— interest rate / 12 | $______ /month | **Example**: - $500K/month ร— 10% rolling reserve = $50K locked - Interest cost: $50K ร— 8% annual / 12 = $333/month --- ### Step 6: Settlement Delay Impact | Factor | Calculation | |--------|-------------| | **Average funds in flight** | Daily volume ร— settlement days | | **Working capital need** | Above ร— opportunity cost rate | **Example**: - Daily volume: $16,667 ($500K / 30 days) - Settlement: 2 days - Funds in flight: $33,334 average - Opportunity cost: 8% annual - **Cost: $222/month** (interest on delayed funds) --- ## Your Total Cost Calculation | Cost Component | Amount | % of Volume | |----------------|--------|-------------| | Processing fees | $______ | ___% | | Chargeback costs | $______ | ___% | | Fraud/dispute tools | $______ | ___% | | Labor | $______ | ___% | | Working capital cost | $______ | ___% | | **TOTAL MONTHLY COST** | **$______** | **____%** | | **Reserve locked up** | **$______** | N/A | --- ## Worked Examples by Business Type ### Example 1: $100K/Month E-Commerce (Startup) **Assumptions**: - Volume: $100K/month - AOV: $60, so 1,667 transactions - CB ratio: 0.6%, so 10 disputes - Processor: Braintree at 2.89% + $0.29 ([published](https://www.paypal.com/us/enterprise/paypal-braintree-fees), verified 2026-08-02). Braintree doesn't publish a monthly fee, so ask - No paid fraud tools (under $100K) | Cost Component | Calculation | Amount | |----------------|-------------|--------| | Processing fees | $2,890 + (1,667 ร— $0.29) | $3,373 | | Chargebacks | 10 ร— $85 | $850 | | Tools | Built-in filters only | $0 | | Labor | 10 hrs ร— $50 | $500 | | Working capital | $3.3K locked ร— 8% / 12 | $22 | | **TOTAL** | | **$4,745** | | **Effective rate** | | **4.75%** | **Budget**: $4,800/month + $10K reserve locked Check that chargeback line against your own ratio. At 1,667 transactions, 0.6% is 10 disputes. --- ### Example 2: $500K/Month E-Commerce (Growing) **Assumptions**: - Volume: $500K/month - AOV: $75, so 6,667 transactions - CB ratio: 0.5%, so 33 disputes - Processor: Braintree at 2.89% + $0.29, $15 per dispute - Dispute alerts enabled | Cost Component | Calculation | Amount | |----------------|-------------|--------| | Processing fees | $14,450 + (6,667 ร— $0.29) | $16,383 | | Chargebacks | 33 ร— $85 | $2,805 | | Tools | Built-in fraud filters + alerts | $400 | | Labor | 25 hrs ร— $50 | $1,250 | | Reserve | $50K ร— 8% / 12 | $333 | | Working capital | $33K ร— 8% / 12 | $222 | | **TOTAL** | | **$21,393** | | **Effective rate** | | **4.28%** | **Budget**: $21.4K/month + $50K reserve locked **Same business on PayPal Checkout** (3.49% + $0.49, $15 dispute fee on wallet and Guest Checkout traffic). Processing is $17,450 + $3,267 = $20,717. Chargebacks are 33 ร— $85 = $2,805. Total $25,727, an effective **5.15%**. That's most of a point of revenue for taking the same orders through a different button. Roughly $52,000 a year. The gap is the card rate, not the dispute fee. --- ### Example 3: $1M/Month E-Commerce (Scaled) **Assumptions**: - Volume: $1M/month - AOV: $100, so 10,000 transactions - CB ratio: 0.4%, so 40 disputes - Processor: **assumed** negotiated rate of 2.7% + $0.30. Nobody publishes negotiated pricing. It's a planning assumption, not a verified figure. At this volume you negotiate. Model your own quote - Full tool stack | Cost Component | Calculation | Amount | |----------------|-------------|--------| | Processing fees | $27,000 + (10,000 ร— $0.30) | $30,000 | | Chargebacks | 40 ร— $90 | $3,600 | | Tools | Fraud + alerts + analytics | $3,000 | | Labor | Full-time ops person | $6,000 | | Reserve | $100K ร— 8% / 12 | $667 | | Working capital | $67K ร— 8% / 12 | $445 | | **TOTAL** | | **$43,712** | | **Effective rate** | | **4.37%** | **Budget**: $44K/month + $100K reserve locked + $72K/year salary At this volume, price [Helcim's](https://www.helcim.com/pricing/) published bands too. Exactly $1M a month sits on the boundary between the $500K-$1M online band (interchange + 0.25% + 15c) and the $1M-$5M band (interchange + 0.15% + 15c). Take the more expensive of the two as your base case. Then ask Helcim which row applies. Take the $500K-$1M band and the blended online pass-through of **1.50% + $0.172** ([how that's derived](/docs/payments/reference/cost-model-assumptions)). Pass-through is $15,000 + $1,720 = **$16,720**. Helcim's markup is $2,500 + $1,500 = $4,000. Processing lands at **$20,720**, an effective 2.07%. That's $9,280 a month under the assumed negotiated flat rate, with no monthly fee and $0 on disputes you win. On the $1M-$5M band the markup drops to $1,500 + $1,500 = $3,000. Processing lands at **$19,720**, an effective 1.97%. Hold that loosely, for two reasons. The $30,000 flat rate it's compared against is assumed, not published. And $1,600 of the $16,720 pass-through is network assessments at 0.14% + $0.02. Neither network publishes that figure. This site carries it as unverified. Pull your own statement before you act on the gap. One more thing: Helcim publishes openly up to $5M a month, so nothing here needs a quote. Custom pricing starts above $5M, not above $1M. --- ### Example 4: $250K/Month Card-Present Retail **Assumptions**: - Volume: $250K/month - AOV: $45, so 5,556 transactions - CB ratio: 0.3% (lower for CP), so 17 disputes - Processor: Square Free plan at 2.6% + 15c ([published](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02) - Minimal tools | Cost Component | Calculation | Amount | |----------------|-------------|--------| | Processing fees | $6,500 + (5,556 ร— $0.15) | $7,333 | | Chargebacks | 17 ร— $40 (product + labour only) | $680 | | Tools | Square built-ins | $0 | | Labor | 8 hrs ร— $50 | $400 | | Reserve | $25K ร— 8% / 12 | $167 | | **TOTAL** | | **$8,580** | | **Effective rate** | | **3.43%** | **Budget**: $8,600/month + $25K reserve locked Two things about this example. The fixed fee is 15c, not the 10c a lot of comparison content carries. At this transaction count that's $278 a month. And the chargeback line carries no fee, because Square says outright that it charges none: "There are no fees for dispute management services for chargebacks" ([Square Support](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough), read 2026-08-02). Square's Payment Terms still reserve the right to recover associated fees. So that zero is a published policy, not a contractual guarantee. One more thing about Square. It publishes no volume floor, but it does publish an upward threshold: "If you process over $250,000 per year, talk to our team about custom pricing." This shop does $250,000 a **month**. It's twelve times past that line, and the conversation is overdue. Square also publishes Plus at 2.5% + 15c and Premium at 2.4% + 15c in person. On this volume those come to $7,083 and $6,833, against the Free plan's $7,333. The monthly subscription cost of those plans wasn't part of the 2026-08-02 check. Get it before you call the lower rate a saving. **Same shop on [Helcim](https://www.helcim.com/pricing/)**. The band matters here too. Interchange + 0.40% + 8c is Helcim's $0-$50K entry tier. A shop doing $250,000 a month sits in the published **$100K-$500K card-present band at interchange + 0.25% + 7c** ([published](https://www.helcim.com/pricing/), verified 2026-08-02). | Line | Calculation | Amount | |------|-------------|--------| | Helcim percentage markup | $250,000 ร— 0.25% | $625 | | Helcim per-transaction markup | 5,556 ร— $0.07 | $389 | | **Helcim markup total** | | **$1,014** | | Pass-through at 1.03% + $0.178 | $2,575 + $989 | $3,564 | | **Processing** | | **$4,578** | Against Square's $7,333 that's **$2,755 a month, or about $33,100 a year**, for the same sales. Two caveats. The pass-through line is a blended assumption for a card-present mix, not your statement. And $461 of it is the unverified network assessment component ([method and sources](/docs/payments/reference/cost-model-assumptions)). Helcim's markup is the only part of that table you can trust without a statement, because Helcim publishes it. The gap also turns on ticket size, not just volume. In the $100K-$500K band, Helcim overtakes Square's Free plan above a **$7.42** ticket. In Helcim's entry band the crossover is **$9.23**. A $45 average ticket clears both. A $6 coffee shop lands on the other side. See [the card-mix test](/docs/payments/processor-comparison#the-card-mix-test-not-the-volume-test). --- ## Hidden Costs Breakdown ### The Fee Is the Smallest Part of a Chargeback $15 is the right number for most processors. It's also the cheapest line in the list. | Cost Component | Typical Amount | |----------------|----------------| | Chargeback fee | $0 to $30, see the [verified table above](#step-2-chargeback-costs-often-underestimated) | | Lost product | $30-80 (if physical goods) | | Shipping cost | $5-15 (if applicable) | | Labor to respond | $10-30 (30-60 min) | | Ratio impact | $5-20 (risk of monitoring program) | | **Total per chargeback** | **$50-185** | **For digital goods on Braintree**: $15 fee + $10 labor = $25 minimum **For physical goods on Braintree**: $15 fee + $50 product + $10 shipping + $15 labor = $90 typical **Same physical order on PayPal**: $15 in fees + $50 + $10 + $15 = $90, or $95 if it's a card transaction at $20 **Same physical order on PayPal, high-volume tier**: $30 in fees + $50 + $10 + $15 = $105, and you pay it even when you win **Same physical order on Helcim, dispute won**: $0 in fees + $15 labor = $15, and you keep the sale **Same physical order on Square**: $0 in fees + $50 + $10 + $15 = $75 The Stripe case is worth its own line. Stripe charges $15 to receive a dispute and $15 more to counter it. The received fee never comes back. The countered fee comes back only on an outright win. On a **partial** win you get neither. So fight and partly win, and you're out $30 either way ([source](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes), verified 2026-08-02). Model that before you fight small disputes on Stripe. ### Reserve Working Capital Cost **$50K locked in rolling reserve at 8% cost of capital**: - Annual cost: $50K ร— 8% = $4,000 - Monthly cost: $333 **At 10% rolling reserve**: - $100K/month volume = $10K locked - $500K/month volume = $50K locked - $1M/month volume = $100K locked **That's real money.** It can't buy inventory, payroll or growth. --- ## Budget Planning Template ### Monthly Operating Budget **For a $500K/month business, budget:** | Category | Amount | Notes | |----------|--------|-------| | **Processing fees** | $16,400 | 3.28% effective at 2.89% + $0.29, $75 ticket | | **Chargeback costs** | $2,000-3,500 | Depends on CB ratio and which processor you're on | | **Tools** | $400-1,000 | Dispute alerts minimum | | **Labor** | $1,000-2,500 | Part-time or contract | | **Working capital** | $300-600 | Reserve + settlement | | **TOTAL** | **$20,100-$24,000** | 4.0-4.8% of volume | ### One-Time Setup Costs | Item | Cost | When | |------|------|------| | **Processor integration** | $2,000-10,000 | Initial setup | | **Terminal hardware** | $0-2,000 | If card-present | | **Fraud tool setup** | $500-2,000 | One-time | | **Legal review** | $1,000-5,000 | Contracts, terms | ### Reserve/Locked Capital | Type | Amount | Duration | |------|--------|----------| | **Initial reserve** | $5K-50K | First 90 days | | **Rolling reserve** | 10-30% of volume | Ongoing | | **Chargeback reserve** | Variable | If high ratio | **Total locked**: $______ (plan for this in working capital) --- ## Cost by Business Model ### Subscription SaaS | Monthly Volume | Total Cost | Effective Rate | Reserve | |----------------|------------|----------------|---------| | **$50K** | $2,500-3,000 | 5.0-6.0% | $5K | | **$250K** | $11,000-14,000 | 4.4-5.6% | $25K | | **$1M** | $42,000-50,000 | 4.2-5.0% | $100K | **Higher costs because**: - Card-on-file rates are higher. Square bills stored cards at 3.5% + 15c, the same as keyed entry. A normal online sale is 2.9% + 30c ([source](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02) - More dunning labor - Subscription dispute risk --- ### Physical Goods E-Commerce | Monthly Volume | Total Cost | Effective Rate | Reserve | |----------------|------------|----------------|---------| | **$100K** | $4,500-5,500 | 4.5-5.5% | $10K | | **$500K** | $20,000-24,000 | 4.0-4.8% | $50K | | **$2M** | $82,000-96,000 | 4.1-4.8% | $200K | **Higher costs because**: - Physical chargebacks lose product + shipping - Returns management - More fraud risk (shipping fraud) --- ### Digital Goods / Downloads | Monthly Volume | Total Cost | Effective Rate | Reserve | |----------------|------------|----------------|---------| | **$100K** | $4,000-4,500 | 4.0-4.5% | $10K | | **$500K** | $19,000-22,000 | 3.8-4.4% | $50K | | **$1M** | $38,000-45,000 | 3.8-4.5% | $100K | **Lower costs because**: - No product lost on chargebacks - Lower shipping/logistics - But fraud risk is higher (need tools) --- ### Card-Present Retail | Monthly Volume | Total Cost | Effective Rate | Reserve | |----------------|------------|----------------|---------| | **$100K** | $3,200-3,800 | 3.2-3.8% | $10K | | **$500K** | $15,000-17,000 | 3.0-3.4% | $25K | | **$1M** | $30,000-35,000 | 3.0-3.5% | $50K | **Lower costs because**: - Lower processing fees. Square's Free plan is 2.6% + 15c in person against 3.3% + 30c online. Helcim's card-present markup beats its online markup at every band: 0.40% + 8c against 0.50% + 25c in the entry tier, 0.25% + 7c against 0.35% + 20c at $100K-$500K a month - Much lower chargeback ratio (0.1-0.3%) - Less fraud - Minimal tools needed Card-present is where interchange-plus pays off soonest. The fixed per-transaction cents are lowest there. Shopify Payments charges **no per-transaction cents at all** in person, on any plan. Stax charges 8c. Helcim starts at 8c and steps down to 7c and then 6c as volume rises. Square charges 15c. --- ## Test to Run **Week 1: Gather data** 1. Pull 3 months of processor statements 2. Count chargebacks, calculate average cost (fee + product + shipping) 3. List all tools you pay for (fraud, disputes, analytics) 4. Estimate hours spent on payment ops **Week 2: Calculate** 4. Processing fees: $_______ 5. Chargeback costs: $_______ 6. Tools: $_______ 7. Labor: $_______ (hours ร— rate) 8. Working capital: $_______ 9. **Total**: $_______ **Week 3: Compare** 10. Effective rate: Total / Volume = ____% 11. Compare to 3% baseline 12. Difference = hidden costs **Success criteria**: You've got your true all-in cost. Budget from that, not from a guess. --- ## Scale Callout **Under $100K/month:** - Budget 4.5-5.5% all-in - Processing = 70% of costs - Chargebacks = 20-25% - Tools = minimal - Reserve = $5-15K locked **$100K-$500K/month:** - Budget 4.0-5.0% all-in - Processing = 65-70% of costs - Chargebacks = 15-20% - Tools = 10-15% - Reserve = $25-75K locked **$500K-$1M/month:** - Budget 3.8-4.5% all-in - Processing = 70-75% of costs - Chargebacks = 10-15% - Tools = 8-12% - Labor = dedicated person - Reserve = $75-150K locked **Over $1M/month:** - Budget 3.5-4.5% all-in - Processing = 70-80% of costs - Chargebacks = 8-12% - Tools = 5-10% - Labor = full-time team - Reserve = $150K+ locked --- ## Where This Breaks 1. **High chargeback businesses**: If CB ratio >1%, double the chargeback cost estimates. You'll spend as much on chargebacks as processing fees. 2. **High-risk industries**: Reserves can be 30-50% of volume, not 10%. Working capital needs explode. 3. **Low-margin businesses**: Under a 15% margin, a 4.5% all-in payment cost is half your profit. The business may not be viable. 4. **Seasonal businesses**: Reserves are set on peak volume. You can have $200K locked up nine months of the year while doing $50K a month. 5. **Multi-processor strategies**: Running two processors doubles some costs (reconciliation, tool integrations, labor). --- ## Next Steps **Planning a new business?** 1. Use this worksheet to calculate total payment costs 2. Add to your [business model viability](/docs/payments/business-model-viability) analysis 3. Ensure unit economics work AFTER payment costs **Existing business, surprised by costs?** 1. Calculate your true all-in cost 2. Identify biggest cost component 3. Optimize: - High processing fees โ†’ [Negotiate rates](/docs/payments/buying-payments/contracts) - High chargeback costs โ†’ [Reduce chargebacks](/docs/playbooks/reduce-chargebacks-fast) - High tool costs โ†’ [Audit tool ROI](/docs/payments/tool-stack) **Trying to reduce costs?** 1. [Switch processors](/docs/playbooks/processor-switch-checklist) only if saving 0.5%+ at scale 2. [Reduce chargebacks](/docs/chargebacks/prevention) - bigger ROI than fee negotiation 3. [Optimize auth rates](/docs/payments/auth-optimization) - declining orders is hidden cost --- ## See Also - [Business Model Viability](/docs/payments/business-model-viability) - Is your business model viable with payment costs? - [Processor Fees Guide](/docs/payments/processor-fees-guide) - Understanding fee structures - [Holds and Reserves](/docs/operations/holds-and-reserves) - Cash flow impact - [Chargeback Metrics](/docs/chargebacks/metrics) - True cost of chargebacks - [Tool Stack by Tier](/docs/payments/tool-stack) - What tools to buy when - [Processor Comparison](/docs/payments/processor-comparison) - Finding lowest cost - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - The blended interchange figure behind every comparison here, and how it was derived - [Reading Statements](/docs/operations/reading-statements) - Understanding actual costs --- # Chargebacks ## What Is a Chargeback? A Plain-English Guide for Merchants Source: https://paymentsandrisk.com/docs/chargebacks # What Is a Chargeback? :::info[TL;DR] - A chargeback is your customer going to their bank instead of coming to you. The bank pulls the money out of your account first and asks you about it afterwards - **Find your response deadline before you do anything else.** You get 20-45 days depending on the card network, and missing it means you lose automatically - A $50 chargeback isn't a $50 problem. Add the fee and your time and it's roughly $95 - Three causes, three completely different responses: real fraud, your own mistake, and friendly fraud - Fix your billing descriptor first. Free, takes 10 minutes, and it's the biggest single win most merchants have - One chargeback is normal. A pattern is what costs you your ability to accept cards ::: **A chargeback is when your customer goes to their bank instead of coming to you.** They don't ask you for a refund. They call their bank, or tap a button in the banking app, and say the charge was wrong. **The money's already gone.** Nobody's asking you to approve a refund. You're being told one already happened, and you've got a limited window to argue it back. :::tip[Don't Panic] Every business that takes cards gets chargebacks. One of them doesn't put you at risk, and it doesn't mean you did anything wrong. Two things matter: your deadline this week, and your pattern over the next six months. ::: :::info["Chargeback" or "dispute"? Same thing.] Stripe, Square, and PayPal call these **disputes** in their dashboards. Traditional processors call them **chargebacks**. The card networks say **dispute**. They all mean the same event: your customer's bank reversed a charge and took your money. ::: --- ## What Actually Happens, Step by Step Most explanations skip straight to reason codes and deadlines. Here's the whole sequence in order, in plain language. 1. **Your customer contacts their bank.** They say the charge was unauthorized, the item never showed up, or it arrived wrong. They don't have to contact you first, and most of them don't. 2. **The bank takes the money back.** Your customer usually gets credited right away. That's a provisional credit: temporary and reversible. Your side comes out of your account, or gets held back from your next payout. All of it happens before you've said a word. 3. **You find out.** Stripe emails you and files it under Payments > Disputes. Square puts it in Transactions > Disputes. PayPal buries it in the Resolution Center. Shopify Payments hangs it on the order itself: Orders > the order > Chargebacks. Wherever you're looking, it arrives with two things. A reason code, a short code for what your customer claimed. And a **response deadline**. 4. **You decide: fight it or take the loss.** Fighting it is called representment. You submit evidence that the sale was real and your customer got what they paid for. 5. **Your customer's bank decides.** The issuer reads your evidence. It either reverses the chargeback and you get the money, or upholds it and your customer keeps it. 6. **Either side can escalate.** Pre-arbitration, then arbitration. The card network rules on it and charges both sides for the privilege. It's rarely worth it below a few hundred dollars. Start to finish, 60 to 120 days. It's slow, and your money sits somewhere else for most of it. :::warning[The deadline is the one thing you can't miss] Miss the deadline and you lose automatically, no matter how good your case is. No review, no appeal. Go find your deadline before you read another word. Put it on your calendar, minus 3 days. ::: --- ## What a Chargeback Actually Costs The sale amount is the smallest part of it. | What you lose | Typical amount | |---|---| | **The sale** | Whatever the customer paid | | **The chargeback fee** | $0 to $30, and several processors refund it if you win. Most charge $15. [See the verified table](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated) | | **The product** | Already shipped and gone in most cases | | **Your time** | 30-60 minutes minimum to gather evidence and respond | | **Ratio damage** | Every chargeback counts against you, and enough of them cost you your ability to accept cards at all | A $50 chargeback isn't a $50 problem. It's $50 + a $15 fee + $20 of your time = **roughly $85**, plus the product if you shipped it. Whether the fee sticks depends on who you're with. Helcim charges $0 if you win. Shopify Payments returns it. PayPal's standard tier doesn't charge it on a case decided in your favour. Square charges nothing either way. Stripe, Toast and PayPal's $20 card chargeback fee keep it win or lose. --- ## Why Customers File Them Nearly every chargeback lands in one of three buckets, and they need completely different responses. **1. Real fraud.** Somebody used a stolen card. Your customer really didn't buy anything from you. You're probably losing this one, and that's fine. Your job is stopping the next one, not winning this one. **2. You made a mistake.** Charged twice. Charged the wrong amount. Never got the item, or got something that didn't match the description. They may have tried to reach you and given up. Fix these at the root. They're entirely inside your control. **3. Friendly fraud.** Your customer bought it, received it, and disputed anyway. Sometimes deliberate. More often it's someone who genuinely didn't recognize the charge. Or a family member who used the card. This is the biggest and fastest-growing category. :::tip[The single most common preventable cause] Customers dispute charges they don't recognize. Your billing descriptor is the text on their bank statement. If it's your LLC name instead of your store name, you're generating chargebacks against yourself. It's a 10-minute change in your processor dashboard, and it's the highest-return thing most merchants can do. **Stripe:** Settings > Account Details > Statement descriptor. **Square:** Account & Settings > Business Information > Statement descriptor. **Shopify Payments:** Settings > Payments > Statement descriptor. Can't find it? Call support and say: *"I need my statement descriptor changed to my store name. What's the process, and when does it take effect?"* ::: --- ## The Three Numbers That Matter If you remember nothing else from this page, remember these. | Number | What it is | Where you want to be | |---|---|---| | **Your chargeback ratio** | Chargebacks divided by total transactions, measured monthly | Under 0.5%. At 0.9% processors start paying attention. | | **Your response deadline** | How long you have to submit evidence | 20-45 days depending on the card network. Miss it and you lose automatically. | | **Your win rate** | How often your evidence works | 40-60% is achievable with good evidence. Under 20% means your evidence is weak or you're fighting the wrong cases. | The ratio is the one that can end your business. A single chargeback is a cost of doing business. A **pattern** of them puts you in a network monitoring program with monthly fines. Then it gets your processing shut off. --- ## What To Do Right Now [ ๐Ÿšจ I just got my first one 7-minute guide: find your deadline, decide whether to fight, and what it really costs. ](/docs/chargebacks/your-first-chargeback) [ ๐Ÿ“ˆ My ratio is climbing Above 0.9% is a crisis. This is the emergency response. ](/docs/chargebacks/zero-point-nine-panic) [ ๐Ÿ”ข I need to decode a reason code Look up what the code means and what evidence answers it. ](/docs/reference/reason-codes) :::tip[If you only have 2 hours this week] 1. Pull your last 20 disputes and sort them into the three buckets above: real fraud, your mistake, friendly fraud. 2. Call 2 customers who disputed. Ask what actually happened. 3. Set one rule: fight everything over $100, skip everything under $25. Check after 30 days whether that was right. That's it. Optimization can wait. ::: --- ## Scale Callout Advice built for a $10M business will waste your money at $50K. Find your row. | Volume | Focus | |--------|-------| | **Under $100K/mo** | Your processor's built-in tools are fine. Fix your descriptor, make refunds easy to get, and respond to every dispute. Don't buy a chargeback prevention vendor yet. | | **$100K-$1M/mo** | Alert services (Ethoca, Verifi CDRN) start paying for themselves. They cost roughly $20-40 per alert and save you the fee plus the ratio damage. | | **Over $1M/mo** | You need a real representment process, in-house or outsourced. Alerts stop being optional. | | **Over $10M/mo** | This is somebody's actual job. Look at guaranteed chargeback products for your highest-risk segments, and read those contracts closely. | --- The Thresholds That Can End Your Account Exceed these and you land in a monitoring program with monthly fines. ๐Ÿ’ณ Visa (VAMP) 1.5% + 1,500 combined fraud reports and disputes: Merchant Excessive (2.2% in CEMEA only) 0.5%: Non-compliant. The line you cross first, and an early warning rather than an automatic fee. Whether a per-dispute charge lands here depends on your acquirer's own portfolio status. The VAMP ratio counts TC40 fraud reports plus TC15 chargebacks Replaced VDMP/VFMP in April 2025. 1.5% effective 1 April 2026. [Full details](/docs/chargebacks/reference/network-programs) ๐Ÿ”ด Mastercard (ECM) 1.5% + 100/mo: ECM 3.0% + 300/mo: HECM Uses the prior month's transactions as the denominator Your acquirer holds your merchant account. It can run tighter limits than the networks do, and it'll act on its own first. Email yours and ask: *"What ratio are you measuring me on, what's your internal threshold, and am I in a monitoring program or warning period right now?"* Get it in writing. ## Response Deadlines Miss these and you auto-lose. | Action | Visa | Mastercard | Amex | |--------|------|------------|------| | Representment | 30 days | 45 days | 20 days | | Pre-arbitration | 30 days | 30 days | No such stage | | Arbitration | 45 days | 45 days | No such stage | Amex runs neither stage. Its ladder is representment, then a re-dispute if the cardholder comes back with something new, then Amex decides. You get 20 days, and that's the only clock you have. --- Reason Codes by Network Every chargeback arrives with a reason code. The code tells you what your customer claimed, and it decides what evidence you need. [ ๐Ÿ’ณ Visa Codes 10.4 (fraud), 13.1 (not received), 13.2 (cancelled recurring) ](/docs/reference/reason-codes/visa) [ ๐Ÿ”ด Mastercard Codes 4837 (fraud), 4853 (dispute), 4834 (POI error) ](/docs/reference/reason-codes/mastercard) [ ๐Ÿ”ต Amex Codes F29 (fraud), C08 (goods not received) ](/docs/reference/reason-codes/amex) [ ๐ŸŸ  Discover Codes UA02 (fraud), RG (not received) ](/docs/reference/reason-codes/discover) --- Fighting a Chargeback You can fight back. It's called representment: you submit evidence that the transaction was legitimate and your customer got what they paid for. Whether you win comes down almost entirely to the reason code. - **Fraud (10.4, 4837):** 10-25% without 3DS, 50-70% with 3DS authentication - **Not received (13.1):** 60-80% with tracking and delivery confirmation - **Cancelled recurring (13.2):** 20-40% depending on your cancellation proof - **Digital goods:** 20-35% with proper evidence collection (see CE 3.0) [ ๐Ÿ“‹ Compelling Evidence What actually wins disputes ](/docs/chargebacks/representment/compelling-evidence) [ ๐Ÿ’ป Digital Goods Evidence SaaS, downloads, streaming disputes ](/docs/chargebacks/digital-goods-evidence) [ โš™๏ธ Representment Workflow Step-by-step process ](/docs/operations/representment-workflow) [ โฐ Time Frames Deadlines by network ](/docs/reference/time-frames) ### Should I Fight This One? :::note[Three ways to make this call] This tree decides on **reason code** (what your customer claimed). For the dollar-amount version, see [Refund Strategy](/docs/chargebacks/refund-strategy). For 3DS liability, see [Representment](/docs/chargebacks/representment). ::: ```mermaid flowchart TD A[New Chargeback] --> B{Amount over $50?} B -->|No| C[Accept LossNot worth the effort] B -->|Yes| D{Do you havecompelling evidence?} D -->|No| E{Can you get evidencewithin 24 hours?} E -->|No| C E -->|Yes| F[Gather Evidence] F --> G D -->|Yes| G{Reason code?} G -->|Fraud 10.4/4837| H{3DS authenticated?} H -->|Yes| I[Fight It50-70% win rate] H -->|No| J{Strong device/IP match?} J -->|Yes| K[Fight It15-25% win rate] J -->|No| C G -->|Not Received 13.1| L{Signed delivery proof?} L -->|Yes| I L -->|No| M{Tracking shows delivered?} M -->|Yes| K M -->|No| C G -->|Recurring 13.2| N{Clear cancel policy + logs?} N -->|Yes| K N -->|No| C G -->|Other| O[Review case-by-case] style I fill:#22c55e,color:#fff style K fill:#eab308,color:#000 style C fill:#ef4444,color:#fff ``` For dollar thresholds and worked examples by ticket size, see the [Refund Strategy triage grid](/docs/chargebacks/refund-strategy#refund-vs-fight-grid). --- Preventing Them Prevention beats representment every time. A prevented chargeback saves the fee, the staff time, and the ratio damage all at once. [ ๐Ÿ›ก๏ธ Prevention Overview Strategy and tools ](/docs/chargebacks/prevention) [ ๐Ÿ”” Chargeback Alerts Ethoca, Verifi (RDR/CDRN) ](/docs/chargebacks/prevention/alerts) [ ๐Ÿข Chargeback Vendors Alert services, representment, guarantees ](/docs/chargebacks/vendors) ### Talk To Your Customers Before you optimize anything, call 5 customers who disputed. Ask fact-seeking questions, not opinion-seeking ones: - "What were you trying to do when you made this purchase?" - "What did you expect to see on your statement?" - "What did you do when you first noticed the problem?" - "Walk me through what happened after that." Five conversations will teach you more than five hours of dashboard analysis. You'll find out fast whether you have a representment problem or a root cause problem. --- --- ## Where To Go Next New to all of this [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - the full dispute flow [Consumer Rights (FCBA)](/docs/chargebacks/consumer-rights) - the law behind chargebacks [Reason Codes](/docs/reference/reason-codes) - understand why [Prevention Basics](/docs/chargebacks/prevention) - stop them early Fighting one now [Representment Guide](/docs/chargebacks/representment) - how to respond [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - what wins [Time Frames](/docs/reference/time-frames) - don't miss the deadline Ratio climbing [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - emergency [Reduce Fast](/docs/playbooks/reduce-chargebacks-fast) - 72-hour playbook [Alert Services](/docs/chargebacks/prevention/alerts) - deflection tools :::tip[Want the guided version?] [The Guide, Pathway 2: Handling Your First Chargeback](/docs/learning-pathways/handling-your-first-chargeback/) walks through the whole dispute process in three lessons, about 25 minutes. ::: ## See Also [๐Ÿ›ก๏ธ Fraud Prevention](/docs/fraud/prevention) [๐Ÿ”’ 3D Secure](/docs/fraud/prevention/3ds) [๐Ÿ” Recurring Billing](/docs/compliance/subscriptions/recurring-billing) [๐Ÿ’ฐ Refund Policy](/docs/chargebacks/refund-policy) - [Chargeback Metrics](/docs/chargebacks/metrics) - calculating your ratio - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP and ECM details - [Fraud vs. Friendly Fraud](/docs/chargebacks/fraud-vs-friendly) - the classification that drives your response - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - first-party dispute abuse - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - preventing fraud upstream - [Processor Management](/docs/operations/processor-management) - working with processors - [Decline Codes](/docs/reference/decline-codes) - understanding auth declines - [Holds and Reserves](/docs/operations/holds-and-reserves) - processor reserve impacts {/* FAQ structured data. Uses script children (not dangerouslySetInnerHTML) so it server-renders into the static HTML - see src/theme/DocBreadcrumbs/StructuredData. */} {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is a chargeback?","acceptedAnswer":{"@type":"Answer","text":"A chargeback is when a customer disputes a charge with their bank instead of asking the merchant for a refund. The bank reverses the transaction and pulls the money back out of the merchant's account, usually before the merchant is contacted. The merchant then receives a notice with a reason code and a deadline to submit evidence that the sale was legitimate."}},{"@type":"Question","name":"What is the difference between a chargeback and a dispute?","acceptedAnswer":{"@type":"Answer","text":"They describe the same event. Technically a dispute is the customer's claim and a chargeback is the financial reversal that follows. In practice the words are used interchangeably: Stripe, Square, and PayPal say 'dispute' in their dashboards, traditional processors say 'chargeback', and the card networks say 'dispute'."}},{"@type":"Question","name":"How much does a chargeback cost a merchant?","acceptedAnswer":{"@type":"Answer","text":"Far more than the sale amount. You lose the sale, plus a chargeback fee of $0 to $30 depending on your processor, which some refund if you win, plus the product if it already shipped, plus 30-60 minutes of staff time. Most US processors charge $15; Square and the Authorize.net gateway charge nothing, and $30 is the highest published US figure. A $50 chargeback typically costs around $85 in total. Every chargeback also counts against your chargeback ratio."}},{"@type":"Question","name":"How long do I have to respond to a chargeback?","acceptedAnswer":{"@type":"Answer","text":"Between 20 and 45 days depending on the card network: Amex 20 days, Visa 30 days, Mastercard 45 days for representment. If you miss the deadline you lose automatically, with no review and no appeal. Find your deadline before doing anything else."}},{"@type":"Question","name":"Can you fight a chargeback and win?","acceptedAnswer":{"@type":"Answer","text":"Yes. Fighting a chargeback is called representment, and you submit evidence that the transaction was legitimate. Win rates depend heavily on the reason code: 60-80% for 'goods not received' with delivery confirmation, 50-70% for fraud claims when the transaction was 3DS authenticated, but only 10-25% for fraud claims without 3DS. A 40-60% overall win rate is achievable with strong evidence."}},{"@type":"Question","name":"What chargeback ratio is too high?","acceptedAnswer":{"@type":"Answer","text":"Stay under 0.5% of transactions. At roughly 0.9% processors start paying attention. Visa's VAMP program sets a non-compliant threshold of 0.5% and a merchant excessive threshold of 1.5% with 1,500 combined fraud reports and disputes, effective 1 April 2026; the 2.2% figure applies only to the CEMEA region. Mastercard's ECM threshold is 1.5% plus 100 disputes per month, and HECM is 3% plus 300. Note that Visa does not publish VAMP thresholds publicly, so confirm your numbers with your acquirer."}}]})} --- ## Chargeback Prevention Source: https://paymentsandrisk.com/docs/chargebacks/prevention # Chargeback Prevention :::info[TL;DR] - The cheapest chargeback is the one that never happens - Three layers, in order of preference: prevent, deflect, represent. Work top down - Prevention is fraud controls, a clear billing descriptor and decent service. It's the cheapest layer and most merchants skip it - Deflection (alerts, Order Insight, refunding before the dispute lands) costs money per event but still beats a chargeback - Representment is last. By then you've already paid the fee and taken the ratio hit, win or lose ::: You're here because your ratio's moving or a processor emailed. Either way, start cheap. Fix the billing descriptor and answer refund emails faster. Those cost the least and most merchants skip them. ## The Prevention Hierarchy Three layers. Work them in this order. ```mermaid flowchart LR subgraph PREVENT["1. PREVENT"] P1[FraudControls] P2[ClearBilling] P3[GoodService] end subgraph DEFLECT["2. DEFLECT"] D1[Alerts] D2[OrderInsight] D3[RefundBefore CB] end subgraph REPRESENT["3. REPRESENT"] R1[Evidence] R2[Response] R3[Fight] end PREVENT --> DEFLECT --> REPRESENT style PREVENT fill:#22c55e,color:#fff style DEFLECT fill:#f59e0b,color:#fff style REPRESENT fill:#ef4444,color:#fff ``` | Layer | Cost | Effectiveness | Ratio Impact | |-------|------|---------------|--------------| | **Prevent** | Low | Highest | None | | **Deflect** | Medium ($30-40/alert) | High | Minimal | | **Represent** | High (time + fees) | Variable (30-70%) | Still counts | Each step along that chain costs more and works less. A prevented chargeback costs nothing. A deflected one costs an alert fee and leaves your ratio clean. A represented one costs staff time and still hits your ratio. You might lose it too. **One caveat.** Alerts can stop a fraud chargeback from being filed. They can't erase the fraud report behind it. A Visa TC40 still counts against you under VAMP. So alerts do their best work on non-fraud disputes. On real fraud claims they help less than you'd hope. ## Prevention Categories ### Fraud Prevention Stop the transaction before it clears. - [AVS & CVV verification](/docs/fraud/prevention/avs-cvv) - [3D Secure authentication](/docs/fraud/prevention/3ds) - [Risk scoring](/docs/fraud/prevention/risk-scoring) - [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) - [Velocity rules](/docs/fraud/detection/velocity-rules) There's more by fraud type in the [fraud prevention guide](/docs/fraud/prevention). ### Operational Prevention Kill the errors you're causing yourself. - [Clear billing descriptors](/docs/chargebacks/prevention/descriptors-and-comms) (customers must recognize charges) - Accurate product descriptions - Realistic delivery timelines - Easy-to-find contact information - Proactive shipping notifications ### Customer Service Prevention Settle it before they call their bank. - Easy refund/return processes - Quick response to complaints - Subscription management tools - Clear cancellation policies ## Deflection Tools A customer calls their bank. That's your window. Fix it before the chargeback gets filed: | Tool | Provider | Primary Coverage | Function | |------|----------|------------------|----------| | [RDR](/docs/chargebacks/prevention/visa-rdr) | Verifi/Visa | Visa | Auto-refund based on rules | | [CDRN Alerts](/docs/chargebacks/prevention/verifi-cdrn) | Verifi | Multi-brand (US focus) | Manual refund within 72 hours | | [Ethoca Alerts](/docs/chargebacks/prevention/ethoca-alerts) | Ethoca/Mastercard | Multi-brand (global) | Manual refund within 24-72 hours | | [Order Insight](/docs/chargebacks/prevention/alerts#order-insight) | Verifi/Visa | Visa | Transaction enrichment | | [Consumer Clarity](/docs/chargebacks/prevention/alerts#consumer-clarity) | Ethoca/Mastercard | Mastercard | Transaction enrichment | They're all covered in [chargeback alerts](/docs/chargebacks/prevention/alerts). ## Measuring Prevention ROI Does the spend pay for itself? ``` Prevention ROI = (Chargebacks Prevented ร— Fully-Loaded Chargeback Cost) - Prevention Cost ``` The fully-loaded cost isn't just the sale. It's all of this: - **Transaction amount** (lost revenue) - **Product cost** (COGS - you shipped it, they kept it) - **Chargeback fee** ($0 to $30 depending on processor) - **Operational cost** (staff time to handle it, investigate it, maybe fight it) - **Future ratio risk** (a high ratio buys you monitoring fines, worse rates, or termination) For most merchants that's 2-3x the transaction amount. Then there's the ratio risk. Under Visa's VAMP, you'll pay US$8 per CNP dispute once you're at the merchant excessive level. Mastercard's ECP is a separate program on its own ECM and HECM tiers, and it bills escalating monthly assessments rather than a per-dispute fee. Past either one, accounts get terminated, so price it in. ## Popular in This Section - **[Chargeback Alerts](/docs/chargebacks/prevention/alerts)** - Intercept disputes before they become chargebacks - **[RDR (Rapid Dispute Resolution)](/docs/chargebacks/prevention/visa-rdr)** - Visa's auto-refund system - **[Order Insight](/docs/chargebacks/prevention/alerts#order-insight)** - Transaction enrichment for Visa ## Next Steps **Starting chargeback prevention?** 1. [Set up alerts](/docs/chargebacks/prevention/alerts) - Biggest impact, fastest to deploy 2. [Fix your descriptors](/docs/chargebacks/prevention/descriptors-and-comms) - Stop recognition disputes 3. [Track your metrics](/docs/chargebacks/metrics) - Know your baseline **Already have alerts?** 1. [Review fraud prevention](/docs/fraud/prevention) - Stop fraud at the source 2. [Implement 3DS](/docs/fraud/prevention/3ds) - Liability shift for fraud 3. [Optimize representment](/docs/chargebacks/representment) - Win more fights **Ratio approaching threshold?** 1. [Follow crisis playbook](/docs/playbooks/reduce-chargebacks-fast) - Emergency response 2. [Understand network programs](/docs/chargebacks/reference/network-programs) - Know consequences 3. [Read Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Immediate actions --- ## See Also - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Detailed guide to alert services - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Understanding the full dispute flow - [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - Network program limits - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECP, and what happens when you exceed thresholds - [Representment](/docs/chargebacks/representment) - Fighting chargebacks after they're filed - [Chargeback Vendors](/docs/chargebacks/vendors) - Prevention and representment tools - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund vs. fight - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis playbook - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Card Testing](/docs/fraud/types/card-testing) - Enumeration attacks - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates --- ## Fighting a Chargeback (Representment) Source: https://paymentsandrisk.com/docs/chargebacks/representment # Fighting a Chargeback (Representment) :::info[TL;DR] - **Representment** = Your formal response to a chargeback with evidence - Win rates range from 30-90% depending on reason code and evidence quality - Match your evidence to the specific reason code. Generic responses lose - Response windows are tight: 20-30 days depending on network ::: You've got a chargeback and you're deciding whether to fight. Representment's the fight: the formal response you send back through your processor, with evidence attached, asking for the money to be returned. What you send depends on whether it's [true fraud or friendly fraud](/docs/chargebacks/fraud-vs-friendly). ## Should You Represent? :::note[Three Complementary Decision Axes] This tree's about **3DS and liability shift**. The reason-code call is in [chargebacks overview](/docs/chargebacks). The dollar-amount call is in [refund strategy](/docs/chargebacks/refund-strategy). ::: ```mermaid flowchart TD A[ChargebackReceived] --> B{CheckReason Code} B --> C{Do you haveevidence?} C -->|No| D[Accept Loss] C -->|Yes| E{Transactionamount?} E -->|Under $25| F[Usually SkipCost > Benefit] E -->|$25-$100| G{Strongevidence?} E -->|Over $100| H[Represent] G -->|Yes| H G -->|Weak| I[ConsiderSkipping] H --> J{3DSUsed?} J -->|Yes| K[High Win Rate50-70%] J -->|No| L{Fraud orNon-Fraud?} L -->|Fraud| M[Low Win Rate15-25%] L -->|Non-Fraud| N[Medium Win Rate50-70%] style A fill:#ef4444,color:#fff style D fill:#6b7280,color:#fff style F fill:#6b7280,color:#fff style I fill:#f59e0b,color:#fff style H fill:#22c55e,color:#fff style K fill:#22c55e,color:#fff ``` ## Is This Worth Your Time? :::info[Time vs. Money: A Quick Guide] Your time costs money. If you're a solo founder worth $75/hour, a 30-minute response on a $40 chargeback costs more than the chargeback does. So: - **Under $50:** probably not worth it, unless you've got delivery proof ready to upload in under 5 minutes. - **$50-$150:** worth it if you've got the right evidence for the reason code. Spend 15-20 minutes max. - **$150-$500:** Yes, fight it. Spend up to 30 minutes building your evidence package. - **Over $500:** Always fight. Invest 1 hour in a thorough response. **Exception:** If you see a pattern (same customer, same product, same complaint), fight every dispute to document the pattern - even if individual amounts are small. ::: ## Getting Started ### Before You Represent 1. **Analyze the reason code** - Understand what's being alleged 2. **Check evidence availability** - Do you have what you need? 3. **Calculate win probability** - Is it worth the effort? 4. **Check the deadline** - Can you respond in time? ### Key Resources | Resource | Purpose | |----------|---------| | [What proof each network accepts](./compelling-evidence) | What evidence you need | | [Time Frames](/docs/reference/time-frames) | Response deadlines | | [Representment Workflow](/docs/operations/representment-workflow) | Step-by-step process | ## Evidence Requirements by Code Type ### Fraud Chargebacks Best defenses (in order of strength): 1. 3D Secure authentication data 2. AVS match + delivery to verified address 3. Prior undisputed transactions 4. Customer correspondence See: [Mastercard 4837](/docs/reference/reason-codes/mastercard/fraud) | [Visa 10.4](/docs/reference/reason-codes/visa/10-4-fraud-cnp) ### Non-Receipt Chargebacks Required evidence: - Tracking number with carrier - Delivery confirmation - Signature (recommended for high-value) - Address verification See: [Visa 13.1](/docs/reference/reason-codes/visa/13-1-not-received) ### Cancelled Recurring Required evidence: - Original consent documentation - Cancellation policy terms - Proof of no cancellation request OR - Transaction before cancellation date See: [Visa 13.2](/docs/reference/reason-codes/visa/13-2-cancelled-recurring) ## Win Rate Expectations | Chargeback Type | With Good Evidence | Without Evidence | |-----------------|-------------------|------------------| | Fraud (with 3DS/CE 3.0) | 50-70% | - | | Fraud (without 3DS) | 15-30% | Under 15% | | Non-receipt (with tracking) | 60-80% | Under 20% | | Quality disputes | 15-30% | Under 15% | | Cancelled recurring | 20-40% | Under 20% | ## Common Reasons for Losing | Reason | Prevention | |--------|------------| | Missed deadline | Calendar + alerts | | Insufficient evidence | Evidence checklist | | Wrong evidence for code | Match evidence to reason code | | Poor documentation | Quality standards | | Invalid chargeback not challenged | Review requirements | ## Network-Specific Guidance ### Mastercard Second Presentment - Use proper message text in DE 72 - Include `COMP EVID` for compelling evidence - Include `AUTH MMDDYY/NNNNNN SL 1` for authenticated ### Visa Representment - Response within 30 days - Include all transaction identifiers - Reference CE 3.0 when qualifying ### Amex Response - Shorter window (20 days) - Use Amex portal - Follow inquiry process if applicable --- ## How Representment Actually Works Knowing what happens on the other end makes your cases better. ### The Message Flow ``` You (Merchant) โ†’ Your Processor โ†’ Acquirer โ†’ Card Network โ†’ Issuer โ†“ Issuer Reviews โ†“ Decision flows back the same path ``` ### What Happens at the Issuer 1. **Analyst receives your response** (they handle dozens daily) 2. **Quick scan of summary page** (10-30 seconds) 3. **Check against reason code requirements** (checklist-based) 4. **Decision: Accept your response or reject** ### Why Cases Get Rejected | Rejection Reason | Frequency | Fix | |------------------|-----------|-----| | Missing required evidence | 40% | Evidence checklist by reason code | | Evidence doesn't address reason code | 25% | Match evidence to specific claim | | Unclear or unorganized response | 20% | Structured format, clear summary | | Deadlines missed | 10% | Automated alerts | | Response too long to review | 5% | Keep under 15 pages | ### What Analysts Actually Check | Reason Code Type | Analyst Checklist | |------------------|-------------------| | **Fraud (10.4, 4837)** | 3DS data? Device/IP match? Prior transactions? | | **Not received (13.1)** | Tracking number? Delivery confirmation? Signature? | | **Cancelled recurring (13.2)** | Original consent? Cancellation policy? No cancel request? | | **Not as described (13.3)** | Product description at sale? Images? Return policy? | --- ## Amex and Discover Quirks Amex and Discover don't work like Visa and Mastercard. ### American Express | Aspect | Amex Difference | |--------|-----------------| | **Timeline** | Shorter: 20 days to respond | | **Inquiry process** | Common: Inquiries before chargebacks | | **Portal** | Separate Amex merchant portal | | **Reason codes** | Different code format (F29, C08, etc.) | | **Arbitration** | Different process, Amex decides | **Amex-specific tips:** - Respond to inquiries immediately (often prevents chargeback) - Use Amex's specific evidence format - Note: Amex disputes don't count toward Visa/MC ratios ### Discover | Aspect | Discover Difference | |--------|---------------------| | **Timeline** | 20 days typically | | **Volume** | Lower (fewer Discover cards) | | **Reason codes** | Different format (UA02, RG, etc.) | | **Process** | Similar to Visa/MC but less standardized | **Discover-specific tips:** - Same evidence quality as Visa/MC works - Lower volume means less practice, so don't neglect these - Some processors bundle Discover with Visa/MC workflow --- ## Portal Reality: Working with Processor Interfaces Your processor's portal is where representment actually happens. Most of them are miserable. ### Common Portal Problems | Problem | Reality | |---------|---------| | **Clunky upload** | File size limits, format restrictions | | **Poor status tracking** | "Pending" doesn't tell you anything | | **Slow notifications** | Email delays of hours or days | | **Limited search** | Hard to find historical cases | | **No bulk operations** | One case at a time | ### Working Around Portal Limitations | Limitation | Workaround | |------------|------------| | File size limits | Compress images, split documents | | Format restrictions | Pre-convert to accepted formats | | Poor tracking | External tracking spreadsheet | | Slow notifications | Check portal daily, don't wait for email | | No bulk | Request API access if high volume | ### What to Ask Your Processor :::note[Ask Your Processor] "What file formats and sizes does your portal accept? Can I get API access for representment? How quickly are status updates reflected?" ::: ### High-Volume Considerations If you're doing 100+ disputes a month: - Request direct API access - Consider a representment vendor - Build internal tracking systems - Don't rely on portal notifications --- ## Popular in This Section - **[What proof each network accepts](./compelling-evidence)** - What evidence you need to win - **[Time Frames](/docs/reference/time-frames)** - Response deadlines by network - **[Representment Workflow](/docs/operations/representment-workflow)** - Step-by-step process ## Next Steps 1. Read the [What proof each network accepts](./compelling-evidence) 2. Review [Time Frames](/docs/reference/time-frames) 3. Follow the [Representment Workflow](/docs/operations/representment-workflow) 4. Study reason codes for your most common chargebacks ## Related Topics - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevent before you fight - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Intercept before filing - [Chargeback Metrics](/docs/chargebacks/metrics) - Track your win rates - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Fighting first-party abuse - [Third-Party Fraud](/docs/fraud/types/third-party) - Fighting true fraud cases - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift for fraud cases - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM impact - [Chargeback Vendors](/docs/chargebacks/vendors) - Representment services - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund vs. fight - [Winning Evidence](/docs/chargebacks/winning-evidence) - What wins disputes - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Evidence collection --- ## Consumer Chargeback Rights Source: https://paymentsandrisk.com/docs/chargebacks/consumer-rights # Consumer Chargeback Rights :::info[TL;DR] - Cardholders have a legal right to dispute charges under the Fair Credit Billing Act (FCBA) - you cannot stop them from filing - The 60-day dispute window runs from the billing statement, not the transaction date - "Not as described" and "not received" disputes are the most common winnable categories; fraud disputes from stolen cards are nearly impossible to win without 3DS - Knowing which disputes are legally mandated vs. network policy determines your response strategy ::: Your customers have legal rights to dispute charges. Understanding these rights helps you know what you're fighting against and why some disputes are unwinnable from the start. :::info[CP vs CNP] Consumer rights apply to card-present and card-not-present alike, but CNP merchants carry more exposure. Without a signature or a chip read, you've got less proof the cardholder authorized anything. ::: ## The Fair Credit Billing Act (FCBA) The FCBA is a 1974 US federal law that gives credit card holders the right to dispute billing errors. That's why chargebacks exist at all. The networks built their dispute processes on top of it. **Consumer liability cap:** Under the FCBA, consumers are liable for a maximum of $50 in unauthorized credit card charges (15 U.S.C. 1643). In practice most issuers waive even the $50 and run zero-liability policies. So on a fraud chargeback the consumer doesn't pay anything, which is worth remembering when you wonder why they filed. **The uncomfortable truth:** The law was designed to protect consumers, not merchants. The burden of proof falls on you. ## What Customers Can Dispute The FCBA covers these "billing errors": | Dispute Type | What It Means | Merchant Impact | |--------------|---------------|-----------------| | **Unauthorized charges** | Charges customer didn't make | Hard to win without 3DS | | **Wrong amount** | Charged $150 instead of $15 | Check your systems | | **Goods not received** | Customer never got the order | Need delivery proof | | **Not as described** | Product different from listing | Subjective, hard to win | | **Damaged on delivery** | Arrived broken | Carrier issue, still your problem | | **Credit not processed** | Refund promised but not given | Check refund logs | | **Calculation errors** | Math wrong on statement | Rare, easy to verify | ## The 60-Day Window Customers have **60 days from the statement date** to dispute a charge under the FCBA. This is the legal minimum. **But here's what matters for you:** Card networks extend this. | Network | Dispute Window | Notes | |---------|----------------|-------| | **Visa** | 120 days | From transaction or expected delivery | | **Mastercard** | 120 days | From transaction or expected delivery | | **American Express** | 120 days | Sometimes longer for certain disputes | | **Discover** | 120 days | From transaction date | **Scale callout:** High-value or delayed-delivery businesses (furniture, custom orders, travel) see disputes months after the sale. That's a cash flow problem, so plan for it. ## How the Dispute Process Works (Customer Side) Understanding the customer experience helps you anticipate disputes: 1. **Customer notices charge** - On statement or in banking app 2. **Customer contacts bank** - Through app or phone, one-click dispute 3. **Bank issues provisional credit** - Customer gets money back immediately 4. **Bank investigates** - Must acknowledge within 30 days 5. **Bank decides** - Must resolve within 90 days (two billing cycles) 6. **Merchant notified** - You get the chargeback notification **Key insight:** The customer doesn't have to contact you first. They can go straight to their bank. Many banks actively encourage this with "Dispute this charge" buttons in their apps. ## What the Bank Must Do Under FCBA, the issuing bank must: | Requirement | Timeframe | What It Means | |-------------|-----------|---------------| | **Acknowledge dispute** | 30 days | Written confirmation to customer | | **Investigate** | 90 days (2 billing cycles) | Review evidence | | **Don't collect disputed amount** | During investigation | Customer doesn't pay | | **Report as disputed** | If reporting to bureaus | Can't just report as delinquent | ## What This Means for Merchants ### You Start at a Disadvantage The FCBA creates an asymmetric system: | Customer | Merchant | |----------|----------| | One-click dispute | Multi-step representment | | Immediate provisional credit | Money held for months | | No proof required to file | Full evidence burden | | 60-120 days to dispute | 7-30 days to respond | ### Some Disputes Are Unwinnable When the customer has a statutory right you can't overcome: | Scenario | Why You Lose | |----------|--------------| | **No 3DS on fraud** | Unauthorized charge, no authentication proof | | **No delivery confirmation** | Goods not received, no proof otherwise | | **No refund processed** | Credit not issued, system logs will show | | **Signature not obtained (CP)** | Authorization issues | ### Where You Can Win Disputes where evidence can overcome the claim: | Scenario | Winning Evidence | |----------|------------------| | **Friendly fraud with 3DS** | 3DS authentication + delivery proof | | **"Not received" with tracking** | Signed delivery confirmation | | **"Not as described" with specs** | Product listing matching delivery | | **Prior customer relationship** | CE 3.0 matching device/IP | ## Beyond FCBA: Other Consumer Protections ### Regulation E (Debit Cards, ACH, P2P) Regulation E covers electronic fund transfers: debit cards, ACH debits and P2P payments. It isn't the same rulebook as credit, and it doesn't hit you the same way. **Why merchants care:** The dispute process works differently, and your ability to fight back varies by payment type. | Payment Type | Dispute Mechanism | Can You Fight It? | Merchant Impact | |--------------|-------------------|-------------------|-----------------| | **Credit card** | Network chargeback | Yes - full representment | FCBA rules, 7-45 days to respond | | **Debit card** | Network chargeback | Yes - similar to credit | Faster bank investigation (10-45 days) | | **ACH debit** | Return codes (R10, R29) | Barely | Returns are near-automatic; limited recourse | | **P2P (Zelle)** | Bank-to-bank push | No | Irrevocable once sent | | **P2P (Venmo/Cash App)** | Platform dispute | Limited | Platform decides, not network rules | **The practical differences:** **Debit cards:** Disputes work like credit card chargebacks. You get notified, you submit evidence, you can win. What's different is the clock: banks must investigate within 10 business days, against 90 for credit. **ACH debits:** When a customer disputes an ACH debit, you get a return code (R10 = unauthorized, R29 = corporate unauthorized). There's no real "representment" process. The return happens, you lose the money, and your recourse is collections or legal action. This is why ACH is riskier for merchants accepting it from unknown customers. **P2P payments:** Zelle is a push payment - once the customer sends, it's gone. Venmo and Cash App have dispute processes, but they're platform-specific, not network-governed. If you accept P2P, understand you're outside the card network chargeback system entirely. **What to do differently:** | If You Accept... | Adjust Your Approach | |------------------|---------------------| | **Debit cards** | Same fraud prevention as credit; disputes work similarly | | **ACH for subscriptions** | Verify bank account ownership; have clear authorization records | | **ACH for one-time** | Higher risk; consider only for trusted/verified customers | | **P2P payments** | Treat as cash-equivalent; no dispute protection for you | ### State Laws Some states add protections: - California: Additional consumer rights - New York: Specific disclosure requirements - Various states: Subscription cancellation laws **Practical note:** These rarely change your chargeback strategy, but they affect customer communication and refund policies. ## Test to Run Pull your last 20 chargebacks. For each one: 1. Did the customer contact you first? (Expect: no) 2. Was the dispute filed within 60 days or 120 days? 3. Did you have evidence that could overcome their claim? If customers never contact you first and you're losing disputes past 60 days, you're seeing the FCBA in action. ## Where This Breaks **Long delivery windows:** If you sell furniture that takes 12 weeks to deliver, customers can dispute well after you've fulfilled. The 120-day network window starts from expected delivery, not order date. **Digital goods:** The FCBA covers "goods not received" but digital delivery is hard to prove without proper logging. See [Digital Goods Evidence](/docs/chargebacks/digital-goods-evidence). **Subscriptions:** Customers dispute months of charges at once. Each transaction has its own 120-day window. See [Recurring Billing Compliance](/docs/compliance/subscriptions/recurring-billing). --- ## What This Means for Your Business Type | Business Type | Key Right to Know | Practical Implication | |--------------|------------------|---------------------| | **SaaS / Digital** | Customers can dispute up to 120 days after charge | Keep login/usage logs for 120+ days minimum | | **Physical Goods** | "Not received" disputes valid until delivery confirmed | Always use trackable shipping with delivery confirmation | | **Services** | "Not as described" disputes have broad interpretation | Document scope in writing BEFORE starting work | | **Subscriptions** | Cancellation disputes valid if process was unclear | Make cancellation as easy as signup | :::info[Work Within the Rules] Consumer protection laws exist to protect consumers, not merchants. You're working inside those rules, not around them. What wins is evidence and documentation, so see [compelling evidence](/docs/chargebacks/representment/compelling-evidence). ::: ## Next Steps **Understanding disputes better?** 1. [Learn the chargeback lifecycle](/docs/chargebacks/lifecycle) - Full process flow 2. [Study reason codes](/docs/reference/reason-codes) - Why disputes are filed 3. [Review evidence requirements](/docs/chargebacks/representment/compelling-evidence) - What wins **Reducing disputes?** 1. [Enable 3D Secure](/docs/fraud/prevention/3ds) - Shift liability, prove authorization 2. [Fix your descriptors](/docs/chargebacks/prevention/descriptors-and-comms) - Prevent "don't recognize" disputes 3. [Set up alerts](/docs/chargebacks/prevention/alerts) - Resolve before chargeback **Already in a dispute?** 1. [Check reason code guide](/docs/reference/reason-codes) - Specific response requirements 2. [Build evidence package](/docs/chargebacks/representment/compelling-evidence) - What to submit 3. [Submit representment](/docs/chargebacks/representment) - Fighting the chargeback --- ## Related Resources - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute process - [Reason Code Reference](/docs/reference/reason-codes) - Understanding dispute types - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift authentication - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - When customers abuse their rights - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Recurring Billing Compliance](/docs/compliance/subscriptions/recurring-billing) - Subscription dispute prevention --- ## Digital Goods Evidence Source: https://paymentsandrisk.com/docs/chargebacks/digital-goods-evidence # Digital Goods Evidence :::info[TL;DR] - Digital goods merchants win 20-25% of chargebacks. Physical goods merchants win 40-50%. The right data beats that average - Collect access logs, IPs, device fingerprints and usage records at transaction time. Not after the dispute lands - Compelling Evidence 3.0 shifts liability on Visa, if the cardholder has earlier undisputed transactions for the same product - Session logs proving delivery are the core. Support records showing a happy customer close out the borderline ones ::: Digital goods have the worst chargeback win rates in e-commerce. Physical goods merchants with tracking win 60-80% of "not received" disputes. Digital merchants with no evidence collection are lucky to hit 20-25%. The reason: no delivery proof, no signature, no package photo. Just bits on a wire. But you can win digital disputes if you collect the right data and present it correctly. This page shows you how. ## Why Digital Goods Are Different ```mermaid flowchart LR subgraph Physical["Physical Goods"] P1[Tracking #] --> P2[Carrier scan] P2 --> P3[Delivery photo] P3 --> P4[Signature] end subgraph Digital["Digital Goods"] D1[Purchase] --> D2[???] D2 --> D3[Claim: never received] end style P4 fill:#22c55e,color:#fff style D3 fill:#ef4444,color:#fff ``` ### The Evidence Gap | Physical Goods | Digital Goods | |----------------|---------------| | Tracking number | No tracking | | Carrier confirmation | No carrier | | Delivery photo | No photo | | Signature | No signature | | Weight/dimensions | No physical attributes | ### What You Have Instead Digital goods evidence relies on: - **Access logs** - Proof of login and usage - **Download records** - Proof of delivery to their device - **IP correlation** - Same person who bought also used - **Device matching** - Same device for purchase and access - **Account activity** - Ongoing usage proves receipt The hard part is presenting it in a form issuers understand. --- ## Evidence That Wins Digital Disputes ### Tier 1: Strongest Evidence These have the highest impact on dispute outcomes. | Evidence | Why It Works | How to Collect | |----------|--------------|----------------| | **Post-purchase login from same IP** | Proves cardholder accessed after buying | Log IP + timestamp at every login | | **Device fingerprint match** | Same device for purchase and usage | Implement fingerprinting SDK | | **In-product activity after purchase** | Proves they used what they bought | Log all feature usage with timestamps | | **Customer acknowledgment** | They admitted receiving/using | Support tickets, emails, chat logs | | **Account activity summary** | Pattern of ongoing access | Generate usage reports | ### Tier 2: Strong Evidence These support your case but rarely win alone. | Evidence | Why It Helps | Limitation | |----------|--------------|------------| | **Download/activation timestamp** | Proves delivery | Doesn't prove who downloaded | | **Email delivery confirmation** | Shows notification sent | Doesn't prove it was read | | **Account creation pre-dispute** | Shows established relationship | Doesn't prove this transaction | | **AVS/CVV match** | Authorization passed | Cardholder could still dispute | | **3DS authentication** | Cardholder verified | May shift liability, varies by issuer | ### Tier 3: Weak Evidence Don't rely on these alone. | Evidence | Why It's Weak | |----------|---------------| | **Terms of service screenshot** | Proves nothing about this transaction | | **Refund policy** | Proves you have a policy, not that it applies | | **"Digital goods are non-refundable"** | Doesn't override dispute rights | | **Email confirmation sent** | Doesn't prove delivery or receipt | | **Generic security description** | "We use SSL" means nothing to issuers | :::warning[If You Don't Have Access Logs] Plenty of SMBs have no device fingerprinting and no detailed access logs. On low-ticket items that's fine. Be honest about where you sit. - **No access logs, no device data, under $50:** refund instead of fighting. You'll lose. - **Basic access logs, no device fingerprinting:** you can fight. Expect 20-30%. - **Full logging (IP, device fingerprint, usage timestamps, downloads):** fight with confidence. That's strong evidence. The cheapest win is better evidence from tomorrow. Not fighting today's disputes with nothing. ::: --- ## Evidence Collection by Product Type ### SaaS / Subscription Software **What to capture at purchase:** - IP address + geolocation - Device fingerprint - Account ID - Subscription terms acknowledged (with timestamp) **What to capture ongoing:** - Login timestamps and IPs - Features accessed - Data created (documents, records, settings) - API calls made - Session duration **Evidence package for disputes:** ``` 1. Account overview - Created: [date] - Email: [email] - Subscription: [plan name] - Status: Active / Cancelled on [date] 2. Purchase transaction - Date: [date/time] - Amount: $X - IP: [IP address] (Location: [city, country]) - Device: [fingerprint hash] 3. Post-purchase activity (last 30 days before dispute) | Date | Action | IP Address | |------------|-------------------------|---------------| | [date] | Login | [same IP] | | [date] | Created document | [same IP] | | [date] | Invited team member | [same IP] | | [date] | Changed settings | [same IP] | 4. Customer communication [Any support tickets, emails acknowledging service] ``` ### Digital Downloads (Software, Games, Music) **What to capture at purchase:** - IP address - Device fingerprint - Download link generated **What to capture at download:** - Download initiation timestamp - Download completion (if trackable) - IP address at download - Device/browser at download **What to capture at activation:** - License key activation timestamp - Hardware ID (for device-locked licenses) - Activation IP **Evidence package for disputes:** ``` 1. Purchase record - Date: [date/time] - Product: [name] - IP: [IP address] - Device fingerprint: [hash] 2. Download record - Link generated: [timestamp] - First download: [timestamp] - Download IP: [IP address] - Downloads completed: [count] 3. Activation record (if applicable) - License key: [last 4 chars] - Activated: [timestamp] - Hardware ID: [hash] - Activation IP: [IP address] 4. IP correlation Purchase IP [X.X.X.X] matches download IP [X.X.X.X] ``` ### Streaming / Video / Courses **What to capture at purchase:** - Standard (IP, device, account) **What to capture ongoing:** - Content accessed (video IDs, lesson names) - Watch time / completion percentage - Progress saved - Notes or bookmarks created **Evidence package for disputes:** ``` 1. Account and purchase details [Standard info] 2. Content access log | Date | Content Accessed | Duration | Completion | |------------|-------------------------|-----------|------------| | [date] | Module 1: Introduction | 45 min | 100% | | [date] | Module 2: Basics | 62 min | 100% | | [date] | Module 3: Advanced | 28 min | 45% | 3. Total engagement - Videos watched: 12 of 20 - Total watch time: 8.5 hours - Last access: [date] (after dispute filed) ``` ### In-App Purchases / Gaming **What to capture:** - Account ID and age - Purchase IP and device - Virtual goods delivered - Goods consumed/used - Gameplay time **Evidence package:** ``` 1. Account overview - Account created: [date] - Account level/rank: [X] - Total playtime: [hours] 2. This purchase - Date: [date/time] - Item: [name] - IP: [IP address] - Device: [fingerprint] 3. Item delivery and usage - Item credited: [timestamp] - Item used/consumed: [timestamp] - Gameplay after purchase: [hours] 4. Account activity (post-purchase) [Login timestamps, achievements, multiplayer sessions] ``` --- ## Visa Compelling Evidence 3.0 for Digital :::info[Definitive CE 3.0 Reference] For the full CE 3.0 requirements and eligibility, see [Compelling Evidence: Visa CE 3.0](/docs/chargebacks/representment/compelling-evidence#visa-compelling-evidence-30). This section covers the digital side: how to capture matching data. ::: CE 3.0 works for digital goods, but you need to capture the right data. ### CE 3.0 Matching Elements You need **two** of these to match between the disputed transaction and prior undisputed ones: | Element | Digital Implementation | |---------|------------------------| | **Device ID/fingerprint** | Use fingerprinting SDK (DeviceAtlas, Iovation, etc.) | | **IP address** | Log at transaction time | | **Shipping address** | Use billing address (no shipping for digital) | | **User account** | Account ID / email | ### Prior Transaction Requirements Prior transactions must be: - 120-365 days before disputed transaction - Undisputed - Same card number ### Digital CE 3.0 Example ``` Disputed Transaction (Dec 15, 2024): - Amount: $99 - Device ID: abc123 - IP: 203.0.113.42 - Account: user@email.com Prior Transaction #1 (Aug 10, 2024): - Amount: $49 - Device ID: abc123 โ† MATCH - IP: 203.0.113.42 โ† MATCH - Account: user@email.com โ† MATCH - No dispute Prior Transaction #2 (May 22, 2024): - Amount: $29 - Device ID: abc123 โ† MATCH - IP: 198.51.100.23 (different) - Account: user@email.com โ† MATCH - No dispute CE 3.0 Qualification: YES Matching elements: Device ID + Account (2+ matches) ``` --- ## The Usage-After-Dispute Strategy The strongest evidence for digital goods is usage **after** the customer filed the dispute. ### Why This Works If the customer claims they never received the product, but you can show they: - Logged in after the dispute date - Accessed features after disputing - Created content after disputing - Made API calls after disputing Then they clearly received and used what they claim they didn't get. ### How to Present It ``` Timeline: Dec 1: Purchase made ($99) Dec 15: Dispute filed - "Never received" Dec 16: Customer logged in (IP: X.X.X.X) โ† AFTER DISPUTE Dec 17: Customer accessed Dashboard โ† AFTER DISPUTE Dec 18: Customer exported report โ† AFTER DISPUTE Dec 20: Dispute response due The customer claims they never received access to [Product]. However, our logs show they logged in and actively used the product on Dec 16, 17, and 18 - AFTER filing the dispute. This demonstrates the customer received and continues to use the service they claim was never delivered. ``` ### Logging Requirements To use this strategy, you need: - Login timestamps with IP - Feature access logs with timestamps - Session data (what they did, when) - Correlation to the specific account :::note[Ask Your Dev] "Can we generate a usage report for any account showing: all logins with IP, features accessed with timestamps, and any content created? We need this for chargeback responses." ::: --- ## Evidence Assembly Checklist Before you submit, check you've got: ### Required (Don't Submit Without) - [ ] Transaction timestamp and amount - [ ] Customer email and account ID - [ ] IP address at purchase - [ ] At least one proof of access/usage after purchase ### Strongly Recommended - [ ] Device fingerprint match (purchase to usage) - [ ] Multiple usage events with timestamps - [ ] IP correlation (purchase IP = usage IP) - [ ] Usage after dispute date (if available) ### Supporting (Include If Available) - [ ] Prior successful transactions on same account - [ ] Customer support tickets (especially positive ones) - [ ] Email confirmations with delivery timestamps - [ ] AVS/CVV match confirmation - [ ] 3DS authentication confirmation ### Format Checklist - [ ] Single PDF document - [ ] Summary on first page - [ ] Strongest evidence highlighted - [ ] Timestamps clearly visible - [ ] Under 10 pages if possible - [ ] Professional, not emotional --- ## Common Mistakes ### Mistake 1: "Digital = No Delivery Proof Needed" **Wrong thinking:** "It's digital, so there's no delivery to prove." **Reality:** you prove delivery a different way. Access logs, downloads and activations are your delivery proof. ### Mistake 2: Relying on Confirmation Emails **Wrong thinking:** "We sent a confirmation email, so they received it." **Reality:** Email confirmation proves you sent an email. It doesn't prove: - They opened it - They clicked the link - They accessed the product - They are the cardholder ### Mistake 3: Generic Responses **Wrong thinking:** "Our standard response covers everything." **Reality:** "We delivered the digital product as described" loses every time. Show this customer's access logs. ### Mistake 4: Not Collecting Data **Wrong thinking:** "We'll figure out evidence when we get a chargeback." **Reality:** you can't go back and capture login IPs, device fingerprints or usage patterns. Collect at transaction time and access time. Not at dispute time. ### Mistake 5: Fighting Unwinnable Disputes **Wrong thinking:** "We'll fight every chargeback on principle." **Reality:** no usage logs, no login records, no device match? You're going to lose. Save the effort for the ones you can win. --- ## Test to Run **Digital evidence audit (7 days):** **Day 1-2: Inventory** - List all data points you currently capture at purchase - List all data points you capture at login/usage - Identify gaps **Day 3-4: Implement** - Add missing logging (minimum: IP at purchase, IP at login, usage events) - Verify device fingerprinting is active - Test evidence retrieval for a sample account **Day 5-7: Template** - Create evidence package template by product type - Build query to pull usage report for any account - Train support team on evidence assembly **Success criteria:** you can build a full evidence package for any dispute in 30 minutes. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Implement basic logging (IP, login, usage). Manual evidence assembly. | | **$100k-$500k/mo** | Device fingerprinting. Automated usage report generation. CE 3.0 data capture. | | **Over $500k/mo** | Full fraud stack with fingerprinting. Auto-generated evidence packages. API integration with processor for CE 3.0 submission. | --- ## Where This Breaks 1. **Account sharing.** The cardholder shared their login? That person's usage doesn't prove the cardholder used anything. You may still lose. 2. **Stolen credentials.** A fraudster opened the account with stolen card data. Every usage log is the fraudster's, not the cardholder's. True fraud, true loss. 3. **Immediate disputes.** Dispute filed minutes after purchase? You have no usage logs. Some fraud rings do it on purpose. 4. **No logging infrastructure.** No IPs, no fingerprints, no usage data means no evidence. Build the logging before you need it. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Win rate (digital goods)** | Overall effectiveness | > 30% | | **Win rate by product type** | Where to focus | Varies | | **Evidence completeness rate** | Data capture health | > 90% of disputes have full evidence | | **Time to evidence package** | Response efficiency | 50% of fraud disputes | | **Usage-after-dispute rate** | Post-dispute access | Higher = better | ### Win Rate Benchmarks for Digital | Product Type | Typical Win Rate | Good Win Rate | |--------------|------------------|---------------| | SaaS subscriptions | 20-30% | 35-45% | | Digital downloads | 15-25% | 30-40% | | Streaming/courses | 25-35% | 40-50% | | In-app purchases | 10-20% | 25-35% | Below typical? You've got evidence collection gaps. --- ## Next Steps **Not collecting usage data?** 1. Implement IP logging at purchase and login โ†’ Minimum viable evidence 2. Add device fingerprinting โ†’ CE 3.0 eligibility 3. Log feature usage with timestamps โ†’ Proof of access **Getting chargebacks you should win?** 1. Audit your evidence package โ†’ What's missing? 2. Build product-specific templates โ†’ Standardize evidence 3. Check for usage-after-dispute โ†’ Your strongest argument **High volume digital business?** 1. Automate evidence assembly โ†’ One click to generate package 2. Integrate CE 3.0 data with processor โ†’ Automated submission 3. Build chargeback prevention โ†’ [Alerts](/docs/chargebacks/prevention/alerts) and [3DS](/docs/fraud/prevention/3ds) --- ## See Also - [Winning Evidence](/docs/chargebacks/winning-evidence) - General evidence strategy - [Compelling Evidence 3.0](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 details - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Customer abuse patterns - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Implementation - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Subscription disputes - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift for digital - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Prevention tools - [Chargeback Metrics](/docs/chargebacks/metrics) - Win rate tracking - [Refund Strategy](/docs/chargebacks/refund-strategy) - When not to fight --- ## Fraud vs. Friendly Fraud Source: https://paymentsandrisk.com/docs/chargebacks/fraud-vs-friendly # Fraud vs. Friendly Fraud :::info[TL;DR] - **True fraud** = Stolen card/identity, cardholder is the victim - **Friendly fraud** = Cardholder disputes their own legitimate purchase - This distinction determines your response strategy: fraud prevention vs. evidence collection - 60-80% of chargebacks are friendly fraud, not true fraud - "Friendly fraud" and "first-party fraud" mean the same thing here. [Not everyone agrees](/docs/reference/fraud-classification) ::: A chargeback lands and you've got one question to answer first. Did the real cardholder make this purchase? If they didn't, you're looking at true fraud. If they did, you're looking at friendly fraud. The two arrive as different [reason codes](/docs/reference/reason-codes) and need completely different responses. ```mermaid flowchart TD A[ChargebackReceived] --> B{Who Made theTransaction?} B -->|Stolen Card/Identity| C[True Fraud] B -->|ActualCardholder| D[Friendly Fraud] C --> E[FraudPrevention] C --> F[3DS LiabilityShift] D --> G[EvidenceCollection] D --> H[RepresentmentStrategy] E --> I[Low WinRate] G --> J[High WinRate] style C fill:#ef4444,color:#fff style D fill:#f59e0b,color:#fff style I fill:#ef4444,color:#fff style J fill:#22c55e,color:#fff ``` ## Definitions ### True Fraud (Third-Party) An **unauthorized transaction** where someone else used the card and the real cardholder wasn't involved: - Stolen card credentials - Account takeover - Identity theft Your odds of winning one of these are low. The cardholder's telling the truth, so there isn't much to argue with. ### Friendly Fraud (First-Party Misuse) A **legitimate transaction** the actual cardholder turns around and disputes: - "I don't recognize this" (but made the purchase) - Family member made purchase without disclosure - Buyer's remorse disguised as fraud claim - Intentional abuse of chargeback process These are the ones you can actually win. The evidence is usually sitting in your own systems. ## Why It Matters | Aspect | True Fraud | Friendly Fraud | |--------|------------|----------------| | **Cardholder Involvement** | None | Direct | | **Representment Potential** | Low | High | | **Prevention Method** | Fraud detection | Evidence collection | | **Liability** | Often merchant | Disputable | True fraud is a prevention problem, so you spend the money before the sale. Friendly fraud is an evidence problem, and you spend the effort after it. ## Detection Indicators No single signal settles it on its own. It's how many stack up on one side that gives you the answer. ### Signs of Friendly Fraud - โœ… Delivery confirmed to billing address - โœ… Device fingerprint matches prior purchases - โœ… IP geolocation consistent with cardholder - โœ… Customer contacted support before dispute - โœ… Digital goods accessed after purchase ### Signs of True Fraud - โš ๏ธ Shipping address differs from billing - โš ๏ธ New device/browser fingerprint - โš ๏ธ IP from different country - โš ๏ธ Multiple failed payment attempts - โš ๏ธ No prior customer relationship :::tip[Quick Classification (3 Questions)] If you don't have device fingerprinting or advanced analytics, these three questions get you most of the way: 1. **Did the customer use the product after claiming non-receipt or unauthorized?** Check login logs, download records, or delivery confirmation. If they used it = friendly fraud. 2. **Does the shipping address match the billing address?** If yes and they claim unauthorized = likely friendly fraud. If different country with no purchase history = likely true fraud. 3. **Did the customer contact you before disputing?** If they went straight to their bank without reaching out = likely friendly fraud or billing confusion. **What to do with the answer:** - Friendly fraud - fight it with evidence. See [winning evidence](/docs/chargebacks/winning-evidence). - True fraud - take the loss and tighten prevention. See [3DS](/docs/fraud/prevention/3ds). - Billing confusion - fix your descriptor. See [descriptors guide](/docs/chargebacks/prevention/descriptors-and-comms). ::: ## Next Steps **Dealing with friendly fraud?** 1. [Review compelling evidence](/docs/chargebacks/representment/compelling-evidence) - Build winning cases 2. [Improve descriptors](/docs/chargebacks/prevention/descriptors-and-comms) - Reduce recognition disputes 3. [Set up device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Prove cardholder involvement **Dealing with true fraud?** 1. [Implement 3DS](/docs/fraud/prevention/3ds) - Get liability shift 2. [Review prevention options](/docs/fraud/prevention) - Stop fraud before it happens 3. [Enhance detection](/docs/fraud/detection/velocity-rules) - Catch more fraud earlier **Trying to classify disputes?** 1. [Check detection indicators](#detection-indicators) - Score the signals 2. [Review third-party patterns](/docs/fraud/types/third-party) - True fraud signs 3. [Review friendly fraud patterns](/docs/fraud/types/friendly-fraud) - First-party abuse --- ## Related Topics - [Fraud Types Overview](/docs/fraud/types) - All fraud type definitions - [Friendly Fraud Deep Dive](/docs/fraud/types/friendly-fraud) - First-party dispute abuse - [First-Party Fraud](/docs/fraud/types/first-party) - Real person fraud patterns - [Third-Party Fraud](/docs/fraud/types/third-party) - Stolen identity/card fraud - [Representment](/docs/chargebacks/representment) - Fighting disputes - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence for friendly fraud - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Proving cardholder involvement - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift for true fraud - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention strategies - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Winning Evidence](/docs/chargebacks/winning-evidence) - What wins disputes --- ## Why Chargebacks Favor Cardholders (And What You Can Do) Source: https://paymentsandrisk.com/docs/chargebacks/issuer-side # Why Chargebacks Favor Cardholders :::info[TL;DR] - Issuers must follow **Reg E/Z timelines** that favor cardholders - **Provisional credit** is granted within days, before you even know about the dispute - Issuers have **10 business days** to investigate or must credit the cardholder - By the time you see a chargeback, the issuer has already sided with their customer - Understanding this helps you **build better evidence and respond faster** ::: :::info[Scope] This page covers how issuers process disputes and why outcomes favor cardholders. For why issuers decline transactions at authorization, see [Issuer Perspective on Fraud](/docs/fraud/issuer-perspective). For the technical authorization logic, see [Authorization Decisioning](/docs/fraud/detection/authorization-decisioning). ::: Most chargeback content focuses on what merchants should do after receiving a dispute. But understanding what happens on the issuer side, before you ever see a chargeback, explains why disputes flow the way they do. ## What Triggers the Process A cardholder contacts their bank through one of several channels: - Phone call to customer service - Online banking portal dispute function - Mobile app dispute button - In-person branch visit They'll report something like: - "I don't recognize this charge" - "I never received this item" - "I returned this but wasn't refunded" - "This wasn't me. My card was stolen." At this point, the issuer's clock starts ticking. ## Regulatory Deadlines Issuers operate under federal regulations that impose strict timelines: ### Regulation E (Debit Cards) | Deadline | Requirement | |----------|-------------| | 10 business days | Complete investigation OR provide provisional credit | | 20 business days | For new accounts (first 30 days) | | 45 days | Extended deadline if provisional credit issued (domestic ATM) | | 90 days | Extended deadline for POS, foreign transactions, or new accounts | | 3 business days | Notify cardholder of investigation results | | 1 business day | Correct error after confirming it occurred | If the issuer can't complete their investigation in 10 business days, they must provisionally credit the cardholder and can then take up to 45-90 days to finish investigating. ### Regulation Z (Credit Cards) | Deadline | Requirement | |----------|-------------| | 30 days | Acknowledge receipt of billing error notice | | 2 billing cycles (max 90 days) | Complete investigation and resolve | | Immediately | Consumer not obligated to pay disputed amount during investigation | Under Reg Z, the cardholder doesn't have to pay the disputed amount while it's being investigated. This is different from Reg E's provisional credit. It's more like automatic withholding. ## The Investigation Process Here's what happens inside the issuer: **1. Claim intake:** The cardholder provides details. The agent categorizes the dispute (fraud, merchandise not received, service issue, etc.) and enters it into the system. **2. Initial assessment:** The issuer evaluates whether the claim seems legitimate: - Does this cardholder have a history of disputes? - Does the transaction match their typical spending? - Has this merchant had other complaints? **3. Decision point:** The issuer decides whether to: - Resolve immediately (small-dollar claims often get auto-approved) - Investigate further before crediting - Issue provisional credit and continue investigating - File a chargeback with the merchant **4. Evidence gathering:** If investigating, the issuer may: - Query Order Insight/Consumer Clarity for transaction details - Review cardholder's transaction history - Check if the cardholder has a relationship with this merchant - Look for patterns suggesting true fraud vs. confusion **5. Chargeback decision:** If the claim appears valid and chargeback rights exist under network rules, the issuer files the chargeback. ## Why Issuers Often Side with Cardholders Merchants frequently feel that issuers rubber-stamp cardholder claims. There's truth to this, and understanding why helps: **Regulatory pressure:** Reg E and Reg Z create obligations to the cardholder. Non-compliance can bring CFPB enforcement. Siding with cardholders is the safe regulatory path. **Customer retention:** The cardholder is the issuer's direct customer. Denying a claim damages that relationship. The merchant is a stranger. **Cost-benefit:** Investigating a $15 dispute costs more than just paying it. Many issuers have auto-approval thresholds for small claims. **Liability dynamics:** With most chargebacks, liability shifts to the merchant. The issuer doesn't bear the loss, so they have less incentive to fight. **Limited information:** Issuers often can't verify the cardholder's claim. When in doubt, consumer protection laws tilt toward the consumer. This isn't corruption. It's rational behavior given issuer incentives and constraints. ## The Provisional Credit Reality Provisional credit is a regulatory requirement, but it also creates dynamics merchants should understand: **Cardholders get money quickly:** Most issuers credit the account within days of a claim, sometimes immediately. From the cardholder's perspective, the dispute is "resolved." **Investigation continues in background:** The issuer keeps investigating even after providing credit. If they determine the claim was invalid, they can reverse the provisional credit. **Reversals are rare for small amounts:** The investigation cost often exceeds the disputed amount. Many provisional credits become permanent by default. **Chargeback timing varies:** The chargeback might not reach you until well after provisional credit was issued. The cardholder already has their money; you're just now finding out about the dispute. ## What Doesn't Become a Chargeback Not every cardholder complaint becomes a merchant problem: **Issuer write-offs:** Issuers write off a lot of small-dollar disputes instead of filing them. Chasing a $3 transaction costs more than the transaction. Here's the arithmetic. Mastercard puts the bank's cost of processing one dispute at **$9.08 to $10.32**. A $12 dispute barely pays for itself. A $5 one never does. Roughly **18% of chargebacks get written off** rather than filed. REPORTED That changes what lands on you. Under about $10, the bank often eats it. You hear nothing. Just above that line, a chargeback costs the bank more than an alert does. So banks send it to Verifi or Ethoca first. Those only bill when you refund, and they undercut scheme fees. A small dispute arriving as an [alert](/docs/chargebacks/prevention/alerts) instead of a chargeback isn't luck. It's the bank taking the cheaper route. Expect more of it on low tickets. **Pre-dispute resolution:** If Order Insight or Consumer Clarity provide enough detail, the cardholder might recognize the charge and withdraw their claim. **Alert services:** RDR, CDRN, and Ethoca can resolve disputes before they become chargebacks. **Invalid claims:** If investigation reveals the charge was legitimate and the cardholder made the purchase, the issuer may deny the claim. **Out-of-scope claims:** Some complaints don't qualify for chargeback rights under network rules. ## TC40/SAFE vs. Chargebacks This is critical: fraud reports and chargebacks are separate processes. When a cardholder claims fraud, the issuer files a TC40 (Visa) or SAFE (Mastercard) report. This happens regardless of whether they pursue a chargeback. **TC40/SAFE report:** - Filed whenever fraud is claimed - Notifies card network of suspected fraud - Affects merchant's fraud-to-sales ratio - No direct financial impact on merchant **Chargeback:** - Filed when issuer wants to reverse the transaction - Initiates the formal dispute process - Direct financial impact on merchant - Counts toward chargeback ratio Under VAMP, both count against you. TC40 reports without chargebacks are invisible problems that still damage your network standing. ## Implications for Merchants **Your first notice is late:** By the time you see a chargeback, the cardholder was credited days or weeks ago. The issuer has already made their initial decision. **Representment fights an uphill battle:** You're trying to convince the issuer to reverse a credit they already gave their customer. Compelling evidence needs to be truly compelling. **Speed matters for alerts:** Alert services work because they catch disputes before provisional credit locks in the cardholder's expectation of keeping the money. **Small-dollar disputes might never reach you:** Your TC40/SAFE data can show fraud claims you never had a chance to address. **Issuer relationships matter:** Some fraud vendors have direct relationships with issuers that improve authorization rates and dispute outcomes. ## Next Steps **Understanding issuer behavior?** 1. [Review regulatory deadlines](#regulatory-deadlines) - Reg E/Z timelines 2. [Understand provisional credit](#the-provisional-credit-reality) - Why cardholders get money fast 3. [See why issuers favor cardholders](#why-issuers-often-side-with-cardholders) - Incentive structure **Improving dispute outcomes?** 1. [Review investigation process](#the-investigation-process) - What issuers check 2. [Understand TC40/SAFE vs chargebacks](#tc40safe-vs-chargebacks) - Hidden fraud reports 3. [Apply implications to your strategy](#implications-for-merchants) - Speed and evidence **Preventing disputes from reaching chargebacks?** 1. [Use alert services](/docs/chargebacks/prevention/alerts) - Catch disputes early 2. [Improve descriptors](/docs/chargebacks/prevention/descriptors-and-comms) - Reduce confusion 3. [Build compelling evidence](/docs/chargebacks/representment/compelling-evidence) - Fight effectively --- ## Related Topics - [Why Issuers Decline and Dispute](/docs/fraud/issuer-perspective) - Understanding issuer constraints - [How Issuers Decide to Approve or Decline](/docs/fraud/detection/authorization-decisioning) - Auth decisions - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - The full dispute flow - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - What wins disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution - [Representment](/docs/chargebacks/representment) - Fighting disputes - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP and TC40 impact - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party fraud patterns - [Regulation E](/docs/compliance/consumer-protection/reg-e) - Error resolution requirements - [Regulation Z](/docs/compliance/consumer-protection/reg-z) - Credit card protections --- ## Chargeback Lifecycle Source: https://paymentsandrisk.com/docs/chargebacks/lifecycle # Chargeback Lifecycle :::info[TL;DR] - **Inquiry/Retrieval** (optional): Bank requests info before filing chargeback - respond immediately - **First Chargeback**: Cardholder wins by default; you have 20-45 days to respond (representment) - **Pre-Arbitration**: If you won representment, issuer can challenge with new evidence - **Arbitration**: Card network makes final, binding decision - loser pays $500-1,000+ in fees - Full cycle can take 2-6 months; only ~2% of chargebacks reach arbitration ::: A chargeback moves through up to five stages: inquiry, first chargeback, representment, pre-arbitration, and arbitration. You've got 20-45 days to respond at each one, depending on the network, and the further it goes the more it costs. Arbitration alone runs $500-1,000+ in network fees. Only about 2% ever get there. ```mermaid %%{init: {'themeVariables': {'cScale0': '#8b5cf6', 'cScale1': '#8b5cf6', 'cScale2': '#8b5cf6', 'cScale3': '#8b5cf6', 'cScale4': '#8b5cf6', 'cScaleLabel0': '#ffffff', 'cScaleLabel1': '#ffffff', 'cScaleLabel2': '#ffffff', 'cScaleLabel3': '#ffffff', 'cScaleLabel4': '#ffffff'}}}%% timeline title Chargeback Lifecycle Timeline Inquiry (Optional) : Bank requests info : Respond immediately First Chargeback : Funds debited : 20-45 days to respond Representment : Submit evidence : Issuer reviews Pre-Arbitration : Issuer challenges win : New evidence required Arbitration : Network decides : $500-1000+ fees : Final and binding ``` ```mermaid flowchart TD A[๐Ÿ’ณ Transaction\nDay 0] --> B[๐Ÿ“ž Customer\nContacts Bank] B --> C{Inquiry/\nRetrieval?} C -->|Optional| D[๐Ÿ“‹ Request\nfor Info] D -->|Resolved| E[โœ… No Chargeback] D -->|Escalated| F C -->|Skip| F[๐Ÿ”ด First\nChargeback] F --> G{Merchant\nResponse?} G -->|No Response| H[โŒ Merchant\nLoses] G -->|Represent| I[๐Ÿ“„ Submit\nEvidence] I --> J{Representment\nOutcome} J -->|Won| K[โœ… Merchant Wins] J -->|Lost| L[โŒ Merchant Loses] K --> M{Issuer\nChallenges?} M -->|Yes| N[โš–๏ธ Pre-Arbitration] M -->|No| O[โœ… Closed] N --> P{Arbitration?} P -->|Yes| Q[๐Ÿ›๏ธ Network\nDecides] P -->|Settled| O Q --> R[๐Ÿ“‹ Final\nBinding Decision] ``` ## Retrieval Requests: The Pre-Chargeback Warning A retrieval request (also called a "request for information" or "RFI") is the issuer asking for documentation before it decides whether to file. It isn't a chargeback yet. ### How Retrievals Work | Step | What Happens | |------|--------------| | 1 | Cardholder questions a charge | | 2 | Issuer requests transaction documentation from acquirer | | 3 | Acquirer passes request to merchant | | 4 | Merchant provides documentation (typically 10-20 days) | | 5 | Issuer reviews and decides: resolve or escalate to chargeback | ### Retrieval Request by Network | Network | Retrieval Frequency | Response Window | |---------|--------------------|-----------------| | **Visa** | Rare (most skip to chargeback) | 20 days | | **Mastercard** | Rare (most skip to chargeback) | 20 days | | **Amex** | Common (inquiry process) | 10-20 days | | **Discover** | Moderate | 14 calendar days | ### Why Retrievals Matter - **Respond immediately.** Non-response often triggers automatic chargeback. - **No ratio impact yet.** Resolving at retrieval doesn't count as a chargeback. - **Opportunity to prevent.** Strong documentation can prevent escalation. - **Lower cost.** Retrieval fees are typically lower than chargeback fees. ### What to Submit | Document Type | Purpose | |---------------|---------| | **Transaction receipt** | Proves transaction details | | **Signed authorization** | Card-present proof | | **Delivery confirmation** | Physical goods delivery | | **Customer communication** | Context and acknowledgment | | **Product/service description** | What was purchased | :::tip[Retrieval Response Rule] Treat every retrieval request as urgent. Respond within 48 hours even if you've got 20. Fast, complete responses deflect the most. ::: --- ## Inquiry vs. Dispute: Understanding the Stages Before a formal chargeback, a transaction can go through inquiry stages. Intervene there and it's cheapest. ### Stage Definitions | Stage | What It Is | Ratio Impact | |-------|------------|--------------| | **Customer inquiry** | Cardholder asks issuer about charge | None | | **Order Insight / Consumer Clarity** | Issuer looks up transaction details | None | | **Retrieval request** | Formal request for documentation | None | | **First chargeback** | Formal dispute filed | **Yes** | | **Pre-arbitration** | Challenge to representment | No additional | | **Arbitration** | Network final decision | No additional | ### Intervention Points | Stage | How to Intervene | Tools | |-------|------------------|-------| | **Customer inquiry** | Rich merchant [descriptors](/docs/chargebacks/prevention/descriptors-and-comms) | Order Insight, Consumer Clarity | | **Retrieval request** | Fast, complete response | Document repository | | **Alert notification** | Proactive refund | Ethoca, Verifi CDRN/RDR | | **First chargeback** | [Representment](/docs/chargebacks/representment) | Processor portal | ### Why Early Intervention Wins | Resolution Stage | Cost to You | Ratio Impact | |------------------|-------------|--------------| | Customer recognizes charge | $0 | None | | Alert + refund | Alert fee (~$35) | None | | Retrieval resolved | Minimal | None | | Won representment | Time + chargeback fee | **Counts** | | Lost chargeback | Full transaction + fees | **Counts** | **Key insight:** Even winning at representment doesn't protect your ratio. The chargeback was filed; it counts. Stop disputes before they become chargebacks. --- ## Stage 0: Pre-Dispute (Prevention Window) Before a chargeback is filed, there are opportunities to resolve the issue: **Customer inquiry phase:** - Customer reviews statement, doesn't recognize charge - Customer contacts bank with question - Bank may query Order Insight/Consumer Clarity for transaction details - If customer recognizes charge, no dispute filed **Alert phase:** - If customer asks bank to dispute, alert services (RDR, CDRN, Ethoca) may notify you - You can refund proactively to prevent chargeback filing - See [Chargeback Alerts](/docs/chargebacks/prevention/alerts) for details ## Stage 1: Inquiry/Retrieval Request Some networks open an inquiry before filing a formal chargeback. It's a request for information, nothing more. **Who uses inquiries:** - American Express and Discover: Common - Visa and Mastercard: Rare (mostly skip to chargeback) - Mexico domestic transactions: All brands use inquiries **Timeline:** - You typically have 7-20 days to respond - If you don't respond, it may escalate to a chargeback automatically **What to do:** - Respond immediately with transaction details - Provide proof of delivery, authorization, customer communication - A good inquiry response can prevent the chargeback entirely **Fees:** Inquiry fees are often priced similarly to chargeback fees by acquirers. If it escalates to a chargeback, you typically won't be charged twice, but confirm with your processor. ## Stage 2: First Chargeback When a cardholder formally disputes a transaction, the issuing bank files a chargeback. At this point: - Funds are immediately debited from your merchant account - You're charged a chargeback fee ($0 to $30 depending on processor, and some refund it if you win) - The chargeback counts against your ratio - You must decide whether to accept or fight ### Timeline by Network | Network | Cardholder Filing Window | Merchant Response Time | |---------|-------------------------|------------------------| | Visa | 120 days (some codes shorter, e.g., 75 days) | 30 days | | Mastercard | 120 days (some codes shorter, e.g., 45 days) | 45 days | | American Express | 120 days | 20 days | | Discover | 120 days | 30 days | **Note on filing windows:** Some reason codes have shorter filing windows. Visa's "540-day rule" applies when goods or services are expected to be delivered much later than the transaction date (e.g., event tickets, travel bookings). Always confirm specific windows with your acquirer for your MCC and reason codes. ### Merchant Options 1. **Accept the chargeback:** Don't respond. Customer keeps the refund. Chargeback counts against your ratio. 2. **Representment:** Challenge the chargeback by submitting evidence that the transaction was legitimate. See [Representment](/docs/chargebacks/representment). ## Stage 3: Representment Representment is your formal answer to the chargeback. You "re-present" the transaction to the issuer with evidence, and that's your one real shot. **What you submit:** - Rebuttal letter explaining why the chargeback is invalid - Compelling evidence (proof of delivery, authorization records, customer communication) - Documentation specific to the reason code **Outcomes:** - **You win:** Funds returned, but chargeback still counts against your ratio - **You lose:** Customer keeps refund, you've spent time/money for nothing **Win rates:** Industry average is 20-40%. With strong evidence and proper process, some merchants achieve 60%+. For details, see [Representment](/docs/chargebacks/representment) and [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence). :::warning[When to Stop Fighting] If you're under $100K/month and lose at representment, stop here. Pre-arbitration and arbitration cost $500-1,000+ in fees alone - that's a month of processing costs for many small merchants. Only escalate past representment if the transaction is large enough to justify the fee AND you have strong evidence you didn't present the first time. For most SMBs, preventing the next chargeback beats fighting this one through five stages. That's not defeatism, it's arithmetic. See [SMB Prevention Priorities](/docs/chargebacks/prevention/smb-prevention-priorities). ::: ## Stage 4: Pre-Arbitration If you win representment, the issuer can challenge your victory by initiating pre-arbitration. This happens when: - The issuer has new evidence from the cardholder - The issuer believes your representment was insufficient - The cardholder provides additional documentation **Timeline:** - **Visa:** Issuer has 30 days to initiate; you have 30 days to respond - **Mastercard:** Issuer has 45 days to initiate; you have 30 days to respond **Your options:** 1. **Accept liability:** You lose the funds but avoid arbitration fees 2. **Challenge:** Provide additional evidence and proceed toward arbitration **Important:** Pre-arbitration is your last chance to settle before the expensive arbitration stage. ## Stage 5: Arbitration Arbitration is the last stop. The network (Visa, Mastercard) acts as the neutral party and its decision is binding. There's nowhere to go after it. **How it works:** 1. You or the issuer files for arbitration (within 45 days of pre-arb decision) 2. Both parties submit final evidence (usually same evidence from representment) 3. Card network reviews and issues ruling 4. Decision is final and cannot be appealed **Costs:** | Network | Filing Fee | Review Fee | Total (Loser Pays) | |---------|------------|------------|-------------------| | Visa | ~$600 | Varies | $600-1,000+ | | Mastercard | ~$575 | $150-250 | $575-1,000+ | **Timeline:** - Visa: 1-3 months for decision - Mastercard: 3-6 months for decision **Win rates:** merchants rarely win at arbitration. The network sides with the cardholder unless the evidence is overwhelming. Don't go there to make a point. **When to pursue arbitration:** - Transaction value significantly exceeds arbitration fees - You have strong, new evidence - Matter of principle (pattern of abuse from specific customer) **When to avoid arbitration:** - Low-value transactions - Same evidence as representment (unlikely to change outcome) - Tight cash flow (fees are non-refundable even if you win) ## Complete Timeline Example **Day 0:** Customer makes purchase **Day 45:** Customer contacts bank, claims fraud **Day 46:** Bank files chargeback (Stage 2) **Day 47:** You're notified, funds debited **Day 60:** You submit representment **Day 90:** Bank reviews, rules in your favor **Day 105:** Cardholder provides new evidence, issuer files pre-arbitration (Stage 4) **Day 120:** You respond to pre-arbitration **Day 135:** Issuer rejects your response, you file for arbitration (Stage 5) **Day 180-240:** Network issues final ruling **Total elapsed time:** 6-8 months for a fully contested dispute. ## Stage-by-Stage Costs | Stage | Your Cost if You Lose | Your Cost if You Win | |-------|----------------------|---------------------| | Pre-dispute (alert) | Alert fee ($20-40) | Alert fee ($20-40) | | First Chargeback | Transaction + chargeback fee | Chargeback fee only | | Representment | Transaction + fee + time | Time only (funds returned) | | Pre-Arbitration | Transaction + fee + time | Time only | | Arbitration | Transaction + fees + arbitration fee ($500+) | Time + filing fee (sometimes refunded) | ## Key Takeaways 1. **Earlier is cheaper:** Resolve disputes at the earliest possible stage. See [Chargeback Alerts](/docs/chargebacks/prevention/alerts) 2. **Respond to everything:** Missing a deadline = automatic loss. See [Time Frames](/docs/reference/time-frames) 3. **Document everything:** You can't submit evidence you don't have. See [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) 4. **Know when to fold:** Arbitration is rarely worth it for low-value disputes 5. **Track your data:** Understanding why you get chargebacks helps prevent them. See [Chargeback Metrics](/docs/chargebacks/metrics) ## Next Steps **Just received a chargeback?** 1. [Check the reason code](/docs/reference/reason-codes) - Understand what you're fighting 2. [Review representment process](/docs/chargebacks/representment) - Decide whether to fight 3. [Gather evidence](/docs/chargebacks/representment/compelling-evidence) - Prepare your response **Want to prevent chargebacks?** 1. [Set up alerts](/docs/chargebacks/prevention/alerts) - Stop disputes before they hit 2. [Review your descriptors](/docs/chargebacks/prevention/descriptors-and-comms) - Reduce "I don't recognize" disputes 3. [Track your metrics](/docs/chargebacks/metrics) - Know your ratio before problems **Approaching threshold?** 1. [Read Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response 2. [Understand network programs](/docs/chargebacks/reference/network-programs) - Know the consequences 3. [Follow the playbook](/docs/playbooks/reduce-chargebacks-fast) - Step-by-step crisis guide --- ## See Also - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention hierarchy - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - Network program limits - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Reason Codes](/docs/reference/reason-codes) - Dispute categories - [Winning Evidence](/docs/chargebacks/winning-evidence) - What wins disputes - [Fraud vs. Friendly](/docs/chargebacks/fraud-vs-friendly) - Classification - [Chargeback Vendors](/docs/chargebacks/vendors) - Representment services - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates --- ## Blacklisted: MATCH, and Why the TMF Is Not the Same Thing Source: https://paymentsandrisk.com/docs/chargebacks/match-tmf # Blacklisted: MATCH, and Why the TMF Is Not the Same Thing :::info[TL;DR] - MATCH is a shared database of terminated merchants. Land on it and no traditional merchant account will take you for 5 years - Termination puts you there, not your ratio. A reason code applying at termination makes listing mandatory within five calendar days. Nobody has to warn you first - Mastercard publishes the numbers. Code 04 is chargebacks over the previous three months above 1.5% of your Mastercard sales, plus USD 5,000 or more in chargebacks. Both, not either - Code 05 is an 8% fraud-to-sales ratio over the previous three months, plus 10 or more fraudulent transactions of USD 5,000 or more. That's far above the fraud rate your processor chases you about - Being listed isn't a ban. Mastercard says twice that an acquirer may still board you. Most won't, but that's appetite, not a rule - You can ask to come off. Mastercard states in writing that you don't need a lawyer ::: Almost nobody who worries about MATCH ends up on it. Terminating you costs your processor money. So they warn first, and they'd rather you fixed the problem. Merchants get listed when they go quiet. A ratio that wobbles for one month won't do it. ## What Is MATCH? Mastercard runs the database. It's **MATCH**, the Member Alert to Control High-risk Merchants. The current rules brand it MATCH Pro. Visa's **TMF** (Terminated Merchant File) is a different animal. Most pages get this wrong. The TMF is a file your acquirer keeps on you. That's Visa Core Rules 10.10.1.1. Merchant agreement, deposit history, correspondence, program reports. Visa's shared screening database is **VMSS**, the Visa Merchant Screening Service. Rule 10.17 covers that one separately. Your processor will use the two names interchangeably. Fine. They're still separate systems, and even the clocks differ. Visa's clock starts at notice of intent to terminate. The listing is due one business day later. Mastercard gives your acquirer five calendar days from the decision. Your processor adds you to MATCH for certain terminations. Every acquiring bank checks it before onboarding a new merchant. If you're on it, most legitimate processors won't touch you. Think of it as the credit report for merchants. Except there's no score, just a scarlet letter. ```mermaid flowchart LR subgraph Before["Before Termination"] A[Breach threshold] --> B[Processor warning] B --> C[Remediation attempt] C --> D{Remediationsuccessful?} end subgraph Term["Termination"] D -->|No| E[Account terminated] E --> F[Added to MATCH] end subgraph After["After MATCH"] F --> G[5 years on list] G --> H[High-risk processors only] H --> I[5-10% rates + 20% reserves] end D -->|Yes| J[Stay with processor] style F fill:#ef4444,color:#fff style G fill:#ef4444,color:#fff ``` ## The 11 MATCH Reason Codes Your processor must specify why they're adding you. Each reason code tells future processors what happened. | Code | Reason | Duration | How Common | |------|--------|----------|------------| | **01** | Account Data Compromise | 5 years | Rare | | **03** | Transaction Laundering | 5 years | Rare | | **04** | **Excessive Chargebacks** | 5 years | **Very Common** | | **05** | **Excessive Fraud** | 5 years | **Common** | | **06** | Coercion | 5 years | Rare | | **08** | Mastercard Questionable Merchant Audit Program | 5 years | Rare | | **09** | Liquidation/Insolvency | 5 years | Uncommon | | **10** | Violation of Standards | 5 years | Uncommon | | **12** | PCI Data Security Standard Noncompliance | 5 years (early removal possible with PCI certification) | Uncommon | | **13** | Illegal Transactions | 5 years | Rare | | **14** | Identity Theft | 5 years | Rare | Source: Mastercard, _Security Rules and Procedures - Merchant Edition_, 3 February 2026, section 11.14.1, Table 11.4, p.155. :::note[Eleven codes, not fourteen. The list changed in February 2025] Most of the internet still publishes the old fourteen. Codes **02, 07 and 11 no longer exist.** Common Point of Purchase folded into code 01 instead. That definition now ends "(i.e., Common Point of Purchase [CPP])". Fraud Conviction and Merchant Collusion were deleted outright. Code **06 was "Reserved for Future Use"** through the 6 August 2024 edition. It's Coercion now. Code **03 is Transaction Laundering**, not "Laundering". Its definition now ties to the merchant agreement. Code **09 dropped "Bankruptcy"** and is just Liquidation/Insolvency. Code **08 is spelled out** rather than abbreviated to QMAP. The change landed in the 11 February 2025 edition. The 3 February 2026 one keeps it. If a page shows you 14 codes, it's quoting a dead rulebook. ::: Mastercard also adds listings itself. It uses codes you won't find in Table 11.4. Chapter 8 has **00** Questionable Merchant/Under Investigation, **20** Mastercard Questionable Merchant Audit Program, and **24** Illegal Transactions. You can sit under code 00 during an investigation. No termination, and no acquirer decision behind it. **For most SMBs, codes 04 and 05 are the threat.** Excessive chargebacks and excessive fraud put small businesses on MATCH. --- ## What Triggers MATCH Listing Termination triggers it. Not the ratio. Section 11.5 (p.149) is blunt about this. Say either side moves to end the acquiring relationship. A Table 11.4 condition applies at that moment, or the acquirer has reason to believe one does. Then the acquirer **must** add you to MATCH Pro within five calendar days. The ratio is the gate. Walking out the door opens it. That cuts both ways. Section 11.4, item 8 is the half nobody ever quotes. A reason code "must be met or suspected (at decision to terminate) to justify a MATCH Merchant addition". Acquirers who use or threaten MATCH "as a collection tool for minor MATCH Merchant discretionary activity may be subject to a noncompliance assessment". So an acquirer who terminates you at 0.95% can't lawfully list you under code 04. You're under the floor. Item 9 of the same list runs the other way. Fail to list a merchant who does qualify, same assessment. It's mandatory both ways. Your processor doesn't get to decide. ### Reason Code 04, Excessive Chargebacks Mastercard publishes this one in full. Table 11.4, verbatim: > With respect to a MATCH Merchant reported by a Mastercard Acquirer, the aggregate number of Mastercard chargebacks over the previous three months exceeded 1.5% of its Mastercard sales Transactions in that month, and those chargebacks equaled or exceeded USD 5,000 in total. Two conditions, not one. 1.5% **and** USD 5,000. A small merchant can sit well above the percentage for months. They may still never clear the dollar floor. The denominator is Mastercard only. Not your total card volume, not Visa, not Amex. Say Mastercard is a quarter of your sales. You can be far over 1.5% there while the blended dashboard looks calm. Table 11.4 draws no line between credit, debit, prepaid, card-present or card-not-present. Mastercard chargebacks over Mastercard sales, full stop. One carve-out worth knowing: American Express acquirers report under ICA 102 through 125. For them, code 04 reads "exceeded the chargeback thresholds of American Express, as determined by American Express". No number. Entirely their call. The published 1.5% covers Mastercard-acquired merchants and nobody else. Before February 2025 the test read differently: 1% in any single month, plus USD 5,000. Terminated before then, you were judged on the old single-month rule. :::caution[The formula is broken, and Mastercard hasn't fixed it] Read code 04 again, exactly as printed. "The aggregate number of Mastercard chargebacks over the previous three months exceeded 1.5% of its Mastercard sales Transactions in **that month**." Three months of chargebacks. Divided by one month of sales. Nobody can compute that. It happened in the February 2025 rewrite. The old text read "in any single month exceeded 1% of the number of Mastercard sales Transactions in that month". Someone stretched the numerator out to three months. "In that month" stayed in the denominator. Code 05 carries the same scar. "Fraud-to-sales dollar volume ratio was 8% or greater than the previous three months" isn't a sentence. Both errors have now survived two consecutive annual editions. So here's the honest answer, the one no vendor hands you. The number is published: 1.5%, USD 5,000, three-month lookback. The formula isn't. Read literally, code 04 is arithmetically incoherent. Read charitably, it's three months over three months. That charity is ours, not Mastercard's. Got a clean code 04 calculator from a vendor? Ask which denominator it used. It picked one. Mastercard didn't. ::: ### Our estimate: when a processor actually pulls the trigger Everything in the next table is **our estimate**, not a published standard. Mastercard's number says when a listing is permitted. It says nothing about when your processor decides to terminate. Termination is the event that starts all of this. | Scenario | Likelihood of termination (our estimate) | |----------|------------------------------------------| | One month at 0.95% ratio | Low - warning issued | | Two months at 1.2% ratio | Medium - remediation required | | Three or more months over 1.5% ratio | High - termination likely | | Breach with no improvement after remediation | Very High | | Ignoring processor warnings | Very High | Read that as processor behavior and nothing else. A merchant at 1.2% is being watched. That same merchant isn't listable under code 04. They haven't cleared 1.5% on Mastercard volume with USD 5,000 in chargebacks behind it. Processors don't want to MATCH you. Every terminated merchant is lost revenue. They'll work with you if you show effort. The merchants who get listed are typically those who: - Ignored warnings - Failed to implement remediation plans - Showed no improvement over 3+ months - Had ratio spikes above 2-3% ### Reason Code 05, Excessive Fraud This one's published too. The number is nothing like what merchants are told to fear. Table 11.4, verbatim: > The MATCH Merchant effected fraudulent Transactions of any type (counterfeit or otherwise) meeting or exceeding the following minimum reporting Standard: the MATCH Merchant's fraud-to-sales dollar volume ratio was 8% or greater than the previous three months, and the MATCH Merchant effected 10 or more fraudulent Transactions equal to or greater than USD 5,000 in the previous three months. **8%.** Three conditions stacked: the ratio, 10 or more fraudulent transactions, and USD 5,000. You'll see 0.9% and 1.5% printed under code 05. That's wrong, and it's the most common error on the subject anywhere. Those are processor tolerance numbers, and they belong to [VAMP and ECM](/docs/chargebacks/reference/network-programs). Code 05 sits five to nine times higher. A merchant at 1.5% fraud has a real acquirer problem. Their network programs will notice too. Under code 05 they're nowhere close. ### Other Common Triggers **PayFac terminations:** A PayFac can list you the same way. Stripe, Square and PayPal can all do it when they terminate your account. Usually under Code 04 (excessive chargebacks) or Code 05 (excessive fraud). PayFacs tolerate less risk, because they're aggregating many merchants. **Code 10 (Violation of Standards):** Selling prohibited products, misrepresenting your business, processing for someone else. Code 10 carries no number at all. That's exactly why an acquirer reaches for it. Being under the 1.5% floor stops code 04. It doesn't stop code 10. --- ## How Long You Stay on MATCH Five years, and Mastercard publishes that too. Section 11.10, p.153: > MATCH Merchant records remain on the MATCH Pro system for five years, at which point they are automatically purged from the MATCH Pro system. Searches look back five years (11.6.1). Inquiry records are kept 365 days. | Reason Code | Duration | Early Removal Possible? | |-------------|----------|-------------------------| | 01, 03-06, 08-10, 13-14 | 5 years | Yes, by request through the acquirer that listed you | | 12 (PCI) | 5 years | Yes, on achieving PCI compliance certification | ### You can ask to come off, and you don't need a lawyer Mastercard's own rules say so. Section 11.5.1, p.149: > Any MATCH Merchant may contact an Acquirer regarding a request to be removed from MATCH Pro. For the avoidance of doubt, there is no requirement for a MATCH Merchant to engage legal counsel regarding a request to be removed from MATCH Pro. Mastercard wrote that second sentence on purpose. Consider who benefits from it staying obscure. The request needs four things: 1. Current and/or previous merchant name 2. Current and/or previous merchant address 3. Principal owner's first and last name 4. Merchant website URL, if you have one That's a letter, not a retainer. What your acquirer owes you: | Obligation | Deadline | Rule | |---|---|---| | Respond to a removal request | 30 calendar days | 11.4, item 1 | | Answer your questions about the listing | 7 calendar days | 11.4, item 2 | | Give you the listing ICA and the reason code | On request | 11.4, item 10 | Mastercard removes a listing when the acquirer reports it was added in error (11.13). For code 12, PCI noncompliance, you can go direct to Mastercard. Email MATCHPro.help@mastercard.com if your acquirer won't file. In the EEA or California you have a second lever. Appendix F.5 (p.225) confirms that GDPR rights apply to MATCH data. Access, rectification, erasure, portability, restriction and objection. CCPA rights to know, correct and delete come with it. Mastercard puts the work on your acquirer. They're "responsible for addressing the requests regarding the rectification or correction and erasure or deletion of Personal Information". None of this makes removal easy. Your acquirer still has to agree it was an error. Most of the time they won't. But "no appeal, hire a lawyer" isn't what the rulebook says. --- ## What Happens After MATCH Listing ### Immediate Effects 1. **Your current processing stops.** Accounts are closed. 2. **Reserves are held.** Usually 6 months, sometimes longer. 3. **Pending payouts may be delayed.** Until chargeback exposure passes. ### Finding a New Processor :::note[Being listed isn't a ban] Mastercard says this twice, in section 11.2 (p.146) and again in 11.6.4. Lawyers write like this when they're tired of being misquoted: "For the avoidance of doubt, an Acquirer may onboard a Merchant (and a Payment Facilitator may onboard a Sponsored Merchant) listed in MATCH Pro." The rule permits your rescue. The market usually declines it. Those are different sentences. Every page calling MATCH a five-year death sentence is describing acquirer appetite dressed up as a rule. Below is appetite. ::: You have three options: | Option | Reality | |--------|---------| | **Legitimate processors** | Will almost always decline you. They all check MATCH, and a listing is a hard no at most underwriting desks. | | **High-risk specialists** | Will consider you, at a price. | | **Cash only** | Always available, but limits growth. | ### High-Risk Processor Terms If you go the high-risk route, expect: | Term | Typical Range | |------|---------------| | **Discount rate** | 4-10% (vs. 2.5-3% for normal merchants) | | **Per-transaction fee** | $0.25-0.50 (vs. $0.10-0.30) | | **Rolling reserve** | 10-20% held for 6+ months | | **Monthly minimum** | $25-50 | | **Chargeback fee** | Above the $0-30 mainstream merchants pay, but no high-risk acquirer publishes a number | | **Setup fee** | $0-500 | :::caution[None of this table is published pricing] High-risk acquirers don't publish rates. Treat every row here as a planning range. It's built from merchant reports, not verified figures. One number you can check is the mainstream comparison. Published US dispute fees at ordinary processors top out at **$30**. Most sit at $15 ([verified table](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated)). Whatever a high-risk acquirer quotes above that, you're paying for the listing. Get it in writing before you sign. ::: **Math check:** $50k/month at 2.9% costs you ~$1,450 in processing. At 7% high-risk, you'd pay ~$3,500. That's $2,000/month extra, or $24,000/year. --- ## Avoiding MATCH ### Monitor Before You're in Trouble Set your own line far below the network and processor limits: | Metric | Where the line actually sits | Your internal threshold | |--------|------------------------------|-------------------------| | Chargeback ratio | Visa VAMP flags a merchant at 1.5%, and only once you're also over 1,500 disputes in the month. Most processors set a house limit far lower, commonly around 0.9% | 0.65% | | Monthly dispute count | Mastercard ECM needs 100-299 disputes **and** a 1.50-2.99% ratio in the same month. Both, not either. HECM starts at 300 and 3.00% | 50 | | Fraud ratio | Processor-set, not network-set. 0.9% is the usual trigger. MATCH code 05 doesn't bite until 8% | 0.5% | :::caution[Where these numbers come from] MATCH is the exception here, and it's the good kind. Codes 04 and 05 are published in full. We quote them verbatim above, with a section and page number. The monitoring programs aren't. Section 8.3 of that same 2026 manual defines ECM and HECM. Then it defers every actual number to "Edit 2 in Chapter 8 of the Data Integrity Monitoring Program manual". That manual isn't public, and Visa publishes no VAMP thresholds either. So every ECM, HECM and VAMP number above came from acquirer notices. Ours included. Treat those as the going rate. Then ask your own processor for the numbers in your agreement. Those are the ones that can terminate you. ::: When you hit your internal threshold, start remediation. Don't wait for processor warnings. ### Respond Immediately to Processor Warnings When your processor sends a warning email: 1. **Reply within 24 hours.** Silence looks like you don't care. 2. **Acknowledge the problem.** Don't make excuses. 3. **Commit to a remediation plan.** Be specific about actions and timelines. 4. **Ask what they need.** "What would you need to see to be comfortable?" ### Submit a Real Remediation Plan Your plan should include: | Element | What to Include | |---------|-----------------| | **Root cause** | Why chargebacks/fraud increased | | **Immediate actions** | What you did in the first 48 hours | | **Short-term fixes** | Changes this week (alerts, refund policy, etc.) | | **Long-term fixes** | Systemic changes (product, process, policy) | | **Metrics commitment** | "We expect to reach X% by [date]" | | **Reporting cadence** | "We'll report weekly progress" | ### Negotiate a Voluntary Exit Termination's coming and you can't turn it around? Try negotiating: **Ask:** "If we wind down processing voluntarily over 30 days, would you consider not listing us on MATCH?" Some processors will agree to this because: - It's less paperwork for them - They avoid potential disputes - You're showing good faith **This only works if:** - You're not egregiously over threshold - You have no fraud indicators - You're communicating proactively - You haven't been deceptive --- ## If You're Already on MATCH ### Step 1: Confirm the Listing There's no self-service lookup. You can't query MATCH yourself. You can make the acquirer who listed you hand it over. Section 11.4, item 10 requires the listing ICA and the reason code. Ask them in writing: - "What reason code did you list us under?" - "What is the listing ICA?" - "What is the listing date?" They owe you an answer within 7 calendar days. Processors declining you may confirm a listing exists, so ask. But the acquirer who listed you is the one on the hook. ### Step 2: Contact the Listing Processor Reach out to the processor who listed you: - Request documentation of why you were listed - Ask about reserve release timeline - File a removal request if the listing is wrong (30 calendar days for their response, and no lawyer required) ### Step 3: Evaluate Your Options ```mermaid flowchart TD A[On MATCH] --> B{Can you operatewithout cards?} B -->|Yes| C[Cash/check/ACH only] B -->|No| D{Budget forhigh-risk rates?} D -->|Yes| E[Find high-risk processor] D -->|No| F{Business viableat higher costs?} F -->|Yes| G[Raise prices to cover] F -->|No| H[Consider pivotingor closing] E --> I[Expect 5-10% rates] G --> I ``` ### Step 4: If Using High-Risk Processor 1. **Read the contract carefully.** High-risk processors have stricter terms. 2. **Understand reserve terms.** When do you get your money? 3. **Get chargeback thresholds in writing.** They may be lower than you had before. 4. **Budget for the extra cost.** Price your products accordingly. ### Step 5: Plan for Life After MATCH In 5 years, you'll be off the list. Prepare: - Maintain clean processing records with high-risk processor - Document your remediation and performance - Build relationships for when you can return to normal processing --- ## When to Get a Lawyer Not for a removal request. Mastercard says so in the rules (11.5.1). A lawyer adds cost to that letter without adding leverage. Legal help makes sense when: | Situation | Why Legal Help | |-----------|----------------| | **Erroneous listing** | You were listed incorrectly | | **Processor breach** | They didn't follow their own policies | | **Reserve disputes** | They won't release your money | | **Contract violations** | Either party | | **Significant losses** | Business damage from wrongful listing | **Cost reality:** Payment processing lawyers typically charge $300-600/hour. A dispute can cost $10,000-50,000+. Only worth it for significant errors or losses. --- ## Test to Run **MATCH avoidance health check:** | Check | Action | |-------|--------| | **Current ratio** | Calculate today. Are you under 0.65%? | | **Trend** | Compare last 3 months. Improving or worsening? | | **Processor relationship** | When did you last communicate proactively? | | **Alert coverage** | Do you have RDR/Ethoca/CDRN active? | | **Internal thresholds** | Have you set warning thresholds below network limits? | **If you're above 0.65%:** Start the [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) remediation now, before it's a crisis. --- ## Scale Callout | Volume | MATCH Risk Profile | |--------|-------------------| | **Under $50k/mo** | Low transaction count means a few chargebacks spike your ratio fast. Monitor closely. | | **$50k-$500k/mo** | Most at-risk range. High enough to attract attention, not high enough to absorb losses. | | **Over $500k/mo** | Processors work harder to keep you. More negotiating room, but bigger reserves if you breach. | | **PayFac merchants** | Lower threshold for termination. Stripe/Square/PayPal have less patience than traditional acquirers. | --- ## Where This Breaks 1. **PayFac terminations.** PayFacs (Stripe, Square, PayPal) can list you faster and with less warning than traditional processors. If you're on a PayFac and having issues, move to a traditional processor before termination. 2. **Fraud you didn't cause.** If you're a victim of a fraud attack, document everything. Ask your processor to note the circumstances if they must terminate. 3. **Industry-wide issues.** Some industries have structurally high chargeback rates (travel, supplements, subscriptions). Consider high-risk processors from the start. 4. **Multiple MCCs.** If you're processing under the wrong MCC code and get caught, that's a standards violation (code 10). Make sure your MCC matches your actual business. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Action Threshold | |--------|-------------------|------------------| | **Days since last processor warning** | Relationship health | If > 90 days, reach out proactively | | **Ratio trend (30/60/90 day)** | Trajectory | Any upward trend = investigate | | **Distance to threshold** | Risk buffer | Under 0.25% buffer = crisis mode | | **Chargeback reason code distribution** | Root cause | Shift in distribution = new problem | | **Reserve balance** | Cash flow exposure | Track what's held and release dates | ### Early Warning Dashboard Track weekly: ``` Chargeback ratio: [___]% (target: 0.25%) Trend: [UP/DOWN/FLAT] Chargebacks this month: [___] (target: < 50) Alert coverage: [YES/NO] Last processor contact: [___] days ago ``` --- ## Next Steps **Not on MATCH but worried?** 1. Calculate your current ratio โ†’ [Chargeback Metrics](/docs/chargebacks/metrics) 2. Set up alerts โ†’ [Setup Dispute Alerts Playbook](/docs/playbooks/setup-dispute-alerts) 3. Review your risk profile โ†’ [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) **Processor sending warnings?** 1. Respond immediately โ†’ Acknowledge and commit to action 2. Build remediation plan โ†’ Use the template above 3. Enable all deflection tools โ†’ [Chargeback Alerts](/docs/chargebacks/prevention/alerts) **Already on MATCH?** 1. Get the reason code and listing ICA โ†’ Ask the acquirer who listed you, they owe you both 2. File a removal request if it's wrong โ†’ Four facts, 30-day response 3. Explore high-risk options โ†’ Search "high risk merchant account [your industry]" 4. Consider non-card alternatives โ†’ ACH, cash, invoicing --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [Mastercard Security Rules and Procedures, Merchant Edition](https://www.mastercard.com/content/dam/mccom/shared/business/support/rules-pdfs/SPME-Manual.pdf) | The 11-code Table 11.4 (11.14.1, p.155), the verbatim code 04 and code 05 standards, the five-day listing duty (11.5), the removal process and the no-lawyer sentence (11.5.1), acquirer obligations (11.4), five-year retention (11.10), error removal and the code 12 route (11.13), "an Acquirer may onboard" (11.2 and 11.6.4), ECM/HECM deferral (8.3), Mastercard's own codes 00/20/24 (8.4.2, 8.4.6, 8.6.6), and privacy rights (Appendix F.5) | Primary, Mastercard's own published rules | Edition dated 3 February 2026, accessed 2026-08-02 | | Mastercard Security Rules and Procedures, Merchant Edition, earlier editions | Dating the change. The 11 February 2025 edition already carries the 11-code table and the 1.5% test. The 22 February 2022, 7 February 2023, 6 February 2024 and 6 August 2024 editions all carry 14 codes, "Reserved for Future Use" at code 06, and the old "1% in any single month" code 04 | Primary, archived via the Wayback Machine | Accessed 2026-08-02 | | Visa Core Rules and Visa Product and Service Rules | That the TMF is an acquirer-held file (10.10.1.1, ID# 0007371), that VMSS is the shared database (10.17), the one-business-day listing requirement, and that Visa publishes no numeric TMF standard at all | Primary, Visa's own published rules | 18 October 2025, V1.1 Visa Public edition | _Last verified: 2 August 2026._ --- ## See Also - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Crisis response before MATCH - [Network Programs Reference](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Chargeback Metrics](/docs/chargebacks/metrics) - Calculating your ratio - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Immediate triage - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN - [Processor Management](/docs/operations/processor-management) - Relationship management - [Holds and Reserves](/docs/operations/holds-and-reserves) - Understanding reserves - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Fraud Prevention](/docs/fraud/prevention) - Reducing fraud-based terminations - [PCI DSS Compliance](/docs/compliance/pci-dss) - Avoiding code 12 listings --- ## Chargeback Metrics Source: https://paymentsandrisk.com/docs/chargebacks/metrics # Chargeback Metrics :::info[TL;DR] - **Ratio targets**: Chargeback ratio under 0.9% (processor danger zone), under 1.5% (Mastercard ECM) - **Operational targets**: Win rate over 40%, response rate 100%, response time under 7 days - **Financial tracking**: Net CB loss = Gross - Recovered; CB fees $0 to $30 each - Segment by: reason code, channel (CNP vs. CP), product type, customer segment, BIN/issuer - See [Network Programs](/docs/chargebacks/reference/network-programs) for threshold details ::: Your chargeback ratio is the single most important number in payment risk. Go above the network thresholds and you face monthly fines, mandatory remediation, and potential account termination. These metrics tell you where you stand, whether you're trending in the right direction, and where to focus your efforts. 0.9% Processor danger zone (Visa concern threshold) $0-30 Published US processor fee per dispute (most charge $15) 40%+ Win rate target for representment ```mermaid flowchart LR A[Under 0.5%Safe Zone] --> B[0.5-0.9%Warning Zone] B --> C[0.9-1.5%Monitoring] C --> D[Over 1.5%Excessive] D --> E[TerminationMATCH List] style A fill:#22c55e,color:#fff style B fill:#f59e0b,color:#fff style C fill:#ef4444,color:#fff style D fill:#7f1d1d,color:#fff style E fill:#000,color:#fff ``` | Zone | Visa Threshold | What Happens | |------|----------------|--------------| | **Safe** | Under 0.65% | No action, monitor monthly | | **Warning** | 0.65-0.9% | Internal alert, investigate causes | | **Processor concern** | 0.9%+ | Processor may contact you, increase reserve | | **VAMP Merchant Excessive** | 1.5%+ (2.2% in CEMEA) | Enrolled in monitoring, fines begin | | **Termination** | Persistent violation | Account closed, added to MATCH | _Visa VAMP (effective April 2025) replaced the old VDMP/VFMP programs and changed how ratios are calculated. The VAMP ratio includes both TC40 fraud reports and TC15 chargebacks. See [Network Programs](/docs/chargebacks/reference/network-programs) for current thresholds._ ```mermaid %%{init: {'themeVariables': {'xyChart': {'titleColor': '#8b5cf6', 'plotColorPalette': '#8b5cf6'}}}}%% xychart-beta title "Chargeback Ratio Risk Zones (%)" x-axis ["Safe", "Warning", "Processor Concern", "VAMP Excessive", "Termination"] y-axis "Ratio %" 0 --> 3 bar [0.5, 0.77, 0.9, 1.5, 2.5] ``` ## Ratio Metrics | Metric | Calculation | Network Threshold | |--------|-------------|-------------------| | **Chargeback Ratio** | Chargebacks / Transactions | Under 0.9% (processor house limit, not a Visa number) | | **Dispute Ratio** | Disputes / Transactions | Under 1.5% and under 100 chargebacks (MC ECM) | | **Fraud Ratio** | Fraud chargebacks / Volume | Under 0.50% (Mastercard EFM). Visa folds fraud into the single VAMP ratio instead | ### How to Calculate Your Chargeback Ratio The card networks calculate chargeback ratio differently than you might expect: **Visa's method:** ``` Chargeback Ratio = Chargebacks received this month / Transactions processed this month Example: 45 chargebacks in January / 8,000 transactions in January = 0.56% ``` **The catch:** Visa counts chargebacks in the month they're received, not the month the original transaction happened. A December sale that gets disputed in February counts against your February ratio. This means a bad month of transactions creates a delayed spike in your ratio 30-90 days later. **Mastercard's method:** ``` Dispute Ratio = Disputes filed this month / Transactions processed previous month Example: 60 disputes in February / 7,500 transactions in January = 0.80% ``` Mastercard uses the previous month's transaction count as the denominator, which means the ratio can swing more with seasonal volume changes. :::warning[The Denominator Matters] If your transaction volume drops (seasonal slowdown, marketing pause, site issue) but chargebacks keep arriving from prior months, your ratio spikes even though your fraud didn't get worse. Watch your ratio during low-volume months. A business doing 10,000 transactions/month with 50 chargebacks (0.5%) that drops to 5,000 transactions/month with the same 50 chargebacks is suddenly at 1.0% and in monitoring territory. ::: ### Ratio vs. Count: Both Matter Network monitoring programs require both a ratio and a count threshold. Visa's VAMP merchant excessive threshold is currently 1.5% (2.2% in CEMEA) with 1,500+ disputes. Mastercard's ECM needs 100-299 chargebacks and a 1.50-2.99% ratio together. Clear 300 and 3.00% at the same time and it's HECM, at double the fines. Most processors start flagging you well before these levels - typically around 0.9% - which is why 0.9% remains the practical "danger zone" even though the network-level thresholds are higher. If you have a 2.0% ratio but only 15 chargebacks (because you process low volume), you won't be enrolled in a network program. But your processor may still have concerns. Conversely, 200 chargebacks on 100,000 transactions is only a 0.2% ratio, which is safe from network programs, but 200 chargebacks is still costing you $5,000-$20,000 in fees and staff time. ## Operational Metrics | Metric | Definition | Target | |--------|------------|--------| | **Win Rate** | Won representments / Total represented | >40% | | **Response Rate** | Responded / Total received | 100% | | **Response Time** | Days to respond | Under 7 days | | **Recovery Rate** | Recovered $ / Total CB $ | >30% | ### Win Rate: What's Realistic The average chargeback win rate across the industry is 20-30%. If you're above 40%, you're doing well. If you're above 60%, you have strong evidence collection. Win rate varies dramatically by reason code: | Reason Code Category | Typical Win Rate | Why | |---------------------|-----------------|-----| | "Not received" (with tracking) | 60-80% | Delivery proof is strong evidence | | Fraud (with 3DS/CE 3.0) | 50-70% | Authentication data is compelling | | Fraud (without 3DS) | 10-25% | Hard to prove without authentication | | "Not as described" | 15-30% | Subjective, hard to disprove | | "Cancelled recurring" | 20-40% | Depends on cancellation proof | | "Unrecognized" | 5-15% | Descriptor issue, hard to fight | **What to do with this data:** Don't fight every chargeback equally. Invest your time in categories where you can win. An "unrecognized" chargeback for $30 with a 10% win rate isn't worth 45 minutes of staff time. A $300 "not received" with tracking data and a 70% win rate is. For what evidence actually wins by reason code, see [Winning Evidence](/docs/chargebacks/winning-evidence#evidence-by-dispute-type). ### Response Rate: Always 100% Respond to every chargeback, even ones you expect to lose. Why: - Some issuers auto-resolve in your favor if you submit any evidence - An uncontested chargeback is a guaranteed loss - Your processor tracks your response rate; low rates suggest you're not managing disputes The only exception: if your chargeback vendor or alert service (Verifi, Ethoca) already resolved the dispute before it became a chargeback, there's nothing to respond to. ### Recovery Rate: The Financial Bottom Line ``` Recovery Rate = Dollars recovered through representment / Total chargeback dollars Example: $12,000 in chargebacks this month Fought 10 out of 12 (the two under $25 weren't worth fighting) Won 5 of 10 = $7,500 recovered Recovery rate = $7,500 / $12,000 = 62.5% ``` A 30%+ recovery rate means your representment process is working. Under 20% means your evidence collection needs improvement or you're fighting the wrong chargebacks. ## Financial Impact | Metric | Definition | Notes | |--------|------------|-------| | **Gross CB Loss** | Total chargeback volume | Before recoveries | | **Net CB Loss** | Gross - Recovered | True P&L impact | | **CB Fee Cost** | Fees per chargeback | $0 to $30 each, [verified table](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated) | | **Program Fee Risk** | Monthly monitoring fees | $10K-25K/month if in program | ### The Real Cost of a Chargeback A single chargeback costs more than the transaction amount: ``` True Chargeback Cost = Transaction amount (if lost) + Chargeback fee ($0-30) + Cost of goods (if already shipped/delivered) + Staff time to respond (~$20-50 per case) + Ratio damage (harder to quantify, very real) Example ($200 physical goods order, chargeback lost): $200 transaction + $15 chargeback fee (the typical US published figure) + $80 cost of goods (already shipped, not returned) + $30 staff time = $325 total loss on a $200 sale ``` For a business with 20% margins, you need to sell $1,625 in additional product to make up for one $200 lost chargeback. ### Program Fee Risk If your ratio crosses the threshold and you enter a network monitoring program, the fees escalate fast: | Month in Program | Visa VAMP Fee | |------------------|---------------| | Month 1-3 | $8 per CNP dispute (passed through by acquirer) | | Month 4-6 | $8 per dispute + remediation required | | Month 7-9 | $8 per dispute + enhanced monitoring | | Month 10+ | Risk of account termination | At 200 chargebacks/month over threshold, program fees add $1,600/month on top of your regular chargeback costs. See [Network Programs](/docs/chargebacks/reference/network-programs) for current fee schedules. ## Segmentation Track metrics by: - **[Reason code](/docs/reference/reason-codes) category** ([fraud](/docs/fraud/types) vs. non-fraud) - **Transaction channel** (CNP vs. CP) - **Product type** (digital goods have higher dispute rates) - **Customer segment** (new vs. returning) - **BIN/Issuer** (some issuers file more disputes) ### Segmentation That Actually Helps ```mermaid %%{init: {'themeVariables': {'pieStrokeColor': '#8b5cf6', 'pieOuterStrokeColor': '#8b5cf6', 'pieSectionTextColor': '#fff', 'pie1': '#ef4444', 'pie2': '#f59e0b', 'pie3': '#3b82f6', 'pie4': '#8b5cf6', 'pie5': '#6b7280'}}}%% pie title Typical Chargeback Reason Distribution "Fraud / Unauthorized" : 35 "Not Recognized" : 25 "Product Not Received" : 20 "Not as Described" : 12 "Other / Processing" : 8 ``` The most useful segmentation for most merchants: **By reason code:** Tells you whether your problem is fraud, fulfillment, billing confusion, or policy. If 60% of your chargebacks are "unrecognized," fix your billing descriptor. If 60% are "not received," fix your shipping confirmation. **By new vs. returning customers:** High dispute rates from new customers suggest fraud. High dispute rates from returning customers suggest product or service issues. **By product/SKU:** One problem product can drive your entire chargeback ratio. A single high-return item attracting disputes is cheaper to pull from your catalog than to fight. ## Test to Run **Chargeback source audit:** 1. Export your last 30 days of chargebacks. 2. Categorize each by reason code (fraud, not received, not as described, billing, other). 3. For each category, note: could this have been prevented with a refund, an alert, a descriptor fix, or better evidence? 4. Calculate your win rate per reason code category. 5. Identify the single category that accounts for the most chargebacks. That's your highest-leverage fix. **Success criteria:** You can name your top chargeback reason code and have a specific action to reduce it. If "unrecognized" is your top category, fix your billing descriptor this week. If "not received" is top, audit your shipping confirmation process. ## Scale Callout | Volume | What to Track | How | |--------|---------------|-----| | **Under $50K/month** | Chargeback count, ratio (monthly) | Check processor dashboard weekly. A single chargeback can swing your ratio at low volume, so trend over 90 days. | | **$50K-$250K/month** | Add: win rate, response time, reason code breakdown | Monthly spreadsheet. Respond to every chargeback within 5 business days. | | **$250K-$1M/month** | Add: recovery rate, cost per chargeback, segmentation by product | Weekly reporting. Set internal alert at 0.65% ratio. | | **Over $1M/month** | All metrics, segmented by BIN/issuer, product, geography | Automated dashboards. Dedicated dispute owner. Real-time ratio monitoring. | ## Where This Breaks - **Low volume ratio swings.** Under 2,000 transactions/month, a single bad week can push your ratio above thresholds even if your fraud rate is normal. Don't panic over one month. Trend over 90 days. - **Mixing CP and CNP chargebacks.** Card-present transactions rarely generate disputes. If you combine them with CNP, your ratio looks better than it is. Segment. - **Counting alerts as chargebacks.** If you use Verifi or Ethoca alerts and refund pre-dispute, those are not chargebacks. Don't count them in your ratio. Your processor doesn't. - **Ignoring the denominator.** A chargeback ratio can spike because chargebacks went up OR because transaction volume went down. Check both numbers before reacting. - **Treating all chargebacks equally.** A $20 chargeback and a $2,000 chargeback count the same toward your ratio, but the response strategy should be very different. ## What to Do When... **Ratio crosses 0.75%:** 1. This is your early warning. You have weeks, not months, before you hit 0.9%. 2. [Set up chargeback alerts](/docs/chargebacks/prevention/alerts) (Verifi/Ethoca) immediately if you haven't already. These deflect disputes before they become chargebacks. 3. Review your top 5 reason codes. The fix is different for each. 4. See [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) for the full emergency playbook. **Ratio crosses 0.9%:** 1. You're in program territory. See [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) for the emergency response. 2. Contact your processor proactively. They'll find out anyway. Being proactive shows you're taking it seriously. 3. Implement every quick win: alerts, descriptor fix, refund policy liberalization. **Win rate drops below 30%:** 1. Check if your evidence quality has degraded. Are you still submitting complete evidence packs? 2. Segment by reason code. A new fraud pattern may be generating chargebacks you can't win. 3. Review [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) for what wins by reason code. 4. Consider whether you're fighting chargebacks you shouldn't be. Under $50, refunding is usually cheaper than fighting and losing. **Chargebacks spike suddenly:** 1. Check for a pattern: same product, same BIN range, same geography, same day. 2. If it's fraud: tighten rules immediately, check for a card testing attack or compromised credentials. 3. If it's fulfillment: check for a shipping delay, product issue, or service outage that affected a batch of customers. 4. If it's billing: check if a subscription renewal batch just went out, or if a pricing change confused customers. ## Next Steps **Setting up tracking?** 1. [Understand the lifecycle](/docs/chargebacks/lifecycle) - Know what you're measuring 2. [Review network thresholds](/docs/chargebacks/reference/network-programs) - Set internal targets below limits 3. [Build your dashboard](/docs/compliance/metrics) - Combine with compliance metrics **Ratio too high?** 1. [Check Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response 2. [Set up alerts](/docs/chargebacks/prevention/alerts) - Deflect before they hit 3. [Follow the playbook](/docs/playbooks/reduce-chargebacks-fast) - Step-by-step guide **Optimizing win rate?** 1. [Study compelling evidence](/docs/chargebacks/representment/compelling-evidence) - Know what wins 2. [Improve representment process](/docs/chargebacks/representment) - Systematic approach 3. [Segment by reason code](/docs/reference/reason-codes) - Focus on winnable disputes --- :::info[Other Metrics Pages] Tracking chargebacks is just one piece. See also: [Payments Metrics](/docs/payments/metrics) ยท [Fraud Metrics](/docs/fraud/metrics) ยท [Compliance Metrics](/docs/compliance/metrics) ยท [Operations Metrics](/docs/operations/metrics) ::: ## Related Topics - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Understanding dispute flow - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Fraud Metrics](/docs/fraud/metrics) - Related fraud measurement - [Representment](/docs/chargebacks/representment) - Fighting disputes - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Winning representment - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution - [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - Network limits - [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring) - Compliance requirements - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Refund Policy](/docs/chargebacks/refund-policy) - When to refund vs fight - [Refund Strategy](/docs/chargebacks/refund-strategy) - Operational refund decisions - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence --- ## Monitoring & Remediation Source: https://paymentsandrisk.com/docs/chargebacks/monitoring/thresholds # Monitoring & Remediation :::info[TL;DR] - **Watch at 0.65%**, act at 0.75%, panic at 0.9% (Visa) - **Mastercard**: both count AND ratio must be met (ECM is 100-299 chargebacks AND 1.50-2.99%; HECM is 300+ AND 3.00%+) - **Exit requires**: 3 consecutive months below thresholds + remediation plan - **Termination risk**: 12+ months in program without improvement - This page covers *how to monitor and respond*. For exact thresholds, fees, and timelines, see [Network Programs Reference](/docs/chargebacks/reference/network-programs). ::: This page teaches you how to monitor your dispute ratios and what to do when they're trending in the wrong direction. For the complete threshold tables, fee schedules, and month-by-month escalation timelines, see [Network Programs Reference](/docs/chargebacks/reference/network-programs). --- ## What Happens at Different Ratios (SMB Quick Reference) | Your Ratio | What's Happening | What to Do | |-----------|-----------------|------------| | Under 0.5% | Healthy | Monitor monthly. No action needed. | | 0.5-0.65% | Early warning zone | Your processor may send a heads-up email. Start [free prevention fixes](/docs/chargebacks/prevention/smb-prevention-priorities). | | 0.65-0.75% | Processor warning likely | Active remediation needed. Fix descriptor + enable 3DS + consider alerts. | | 0.75-0.9% | Danger zone | You have weeks to fix this. See [reduce chargebacks fast](/docs/playbooks/reduce-chargebacks-fast). | | 0.9%+ | Crisis | Processor action likely: reserves, pass-through fees, or termination. No network program starts here (VAMP and ECM both start at 1.5%), but your processor's own limit is the one that ends the account. See [0.9% panic guide](/docs/chargebacks/zero-point-nine-panic). | :::warning[Low-Volume Warning] For SMBs under $50K/month: a single bad month can spike your ratio because your transaction count is low. 5 chargebacks on 1,000 transactions = 0.5%. Use a 90-day rolling average, not a single month, to gauge your actual risk level. ::: ## Programs at a Glance | Network | Program | Key Trigger | Details | |---------|---------|-------------|---------| | Visa | VAMP (replaced VDMP + VFMP, April 2025) | 1.5% merchant excessive (2.2% in CEMEA) + 1,500 combined fraud reports + disputes | [Full thresholds](/docs/chargebacks/reference/network-programs#visa-vamp-visas-chargeback-and-fraud-monitoring-program) | | Mastercard | ECP (ECM/HECM tiers) | ECM: 100-299 chargebacks AND 1.50-2.99%. HECM: 300+ AND 3.00%+ | [Full thresholds](/docs/chargebacks/reference/network-programs#mastercard-ecm-mastercards-chargeback-monitoring-program) | | Amex | Internal monitoring | No published number. Amex acts when your volume is "considered disproportionate" | [Details](/docs/reference/card-networks/amex) | | Discover | Internal monitoring | No published number. "Excessive returns or Disputes, as determined by us in our sole discretion" | [Details](/docs/reference/card-networks/discover) | All programs require **3 consecutive months** below thresholds to exit. --- ## Calculating Your Rates ### Chargeback Ratio ``` Chargeback Ratio = (Chargebacks in Month) / (Transactions in Month) x 100 Example: 150 chargebacks / 10,000 transactions = 1.5% ratio ``` ### Important Notes - **Transaction counts matter.** Low-volume merchants can hit ratio thresholds quickly. - **Both metrics.** Many programs require both ratio AND count thresholds. - **Month matters.** Visa uses current month; Mastercard uses prior month's transactions as denominator. --- ## Warning Signs ### Leading Indicators Monitor these to catch problems early: | Indicator | Warning Level | Action Level | |-----------|--------------|--------------| | Chargeback ratio | 0.65% | 0.75% | | Fraud ratio | 0.35% | 0.50% | | Dispute trend | +20% MoM | +50% MoM | | Customer complaints | Increasing | Spiking | One number in that table is real. **0.50% fraud-to-sales is Mastercard's EFM line**, and it's the only fraud figure any network attaches to a program. The 0.35% above it isn't a network number. It's just far enough below 0.50% to leave you a month to react. The chargeback rows aren't network numbers either. 0.65% and 0.75% are house levels, set below the 0.9% where processors typically act. Watch for advice that puts a fraud action level at 0.7% and a red flag at 0.65%. Both sit above the only threshold that actually exists, so a merchant following them is already past Mastercard's line before either one fires. ### Red Flags - Chargeback ratio approaching 0.75% - Fraud ratio approaching 0.50%, the Mastercard EFM line - Month-over-month increases - New fraud patterns emerging - Customer service complaints spiking --- ## Remediation Requirements When a network puts you in a monitoring program, they want to see a plan within 15 days. ### What Networks Want to See 1. **Root cause analysis** - Why are chargebacks occurring? 2. **Remediation plan** - Specific actions with timelines 3. **Progress reporting** - Regular updates 4. **Evidence of improvement** - Declining metrics 5. **Compliance commitment** - Ongoing monitoring ### Typical Remediation Actions | Area | Actions | |------|---------| | **Fraud Prevention** | 3DS implementation, enhanced scoring, velocity rules | | **Customer Experience** | Clear descriptors, easy cancellation, better support | | **Operations** | Faster refunds, delivery confirmation, dispute response | | **Policies** | Clear terms, visible disclosures, proper consent | --- ## Prevention Strategies ### Immediate Actions 1. **Enable fraud tools** - 3DS, AVS, CVV 2. **Review refund policies** - Make refunds easier 3. **Improve response time** - Customer service SLAs 4. **Implement alerts** - Ethoca, Verifi for pre-disputes ### Long-term Solutions 1. **Improve descriptors** - Clear merchant names 2. **Order confirmations** - Email with charge preview 3. **Delivery confirmation** - Tracking and signature 4. **Review sales practices** - No aggressive tactics 5. **Train customer service** - Dispute prevention focus ### Alert Services | Service | Function | |---------|----------| | Verifi CDRN | Pre-dispute alerts for Visa | | Ethoca | Pre-dispute alerts for Mastercard | | RDR (Rapid Dispute Resolution) | Auto-resolve disputes | For how alerts affect program ratios, see [Prevention Tool Impact](/docs/chargebacks/reference/network-programs#prevention-tool-impact). --- ## Next Steps **Checking your program status?** 1. [Review threshold tables](/docs/chargebacks/reference/network-programs) - Know exactly where the lines are 2. [Watch warning signs](#warning-signs) - Act before breach 3. [Calculate your ratio](#calculating-your-rates) - Chargebacks / transactions **Already in a program?** 1. [Follow remediation requirements](#remediation-requirements) - What networks want 2. [Implement prevention strategies](#prevention-strategies) - Get below thresholds 3. [Review fee escalation timelines](/docs/chargebacks/reference/network-programs) - Understand urgency **Preventing program entry?** 1. [Monitor leading indicators](#leading-indicators) - Early warning metrics 2. [Enable alert services](#alert-services) - Ethoca, Verifi 3. [Review prevention strategies](#long-term-solutions) - Reduce disputes proactively --- ## See Also - [Network Programs Reference](/docs/chargebacks/reference/network-programs) - Complete thresholds, fees, and timelines - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - Compliance perspective - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency actions - [Reduce Chargebacks Playbook](/docs/playbooks/reduce-chargebacks-fast) - Crisis response - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking your ratios - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention strategies - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN - [Processor Management](/docs/operations/processor-management) - Working with processors --- ## Chargeback Alerts Compared: RDR vs CDRN vs Ethoca (2026) Source: https://paymentsandrisk.com/docs/chargebacks/prevention/alerts # Chargeback Alerts Compared :::info[TL;DR] - They all do the same job: warn you a customer is about to dispute, so you can refund first and keep the chargeback off your ratio - **RDR is automatic and Visa only.** CDRN and Ethoca send an alert and wait for a human. If nobody works the queue, you pay for the alert *and* eat the chargeback anyway - **Mastercard's answer to RDR is Collaboration**, built into Mastercom. Most comparisons miss it and claim Mastercard has nothing - **Amex has two of its own.** ADR is free: 8 days to respond, non-fraud only, US merchant IDs. Digital Receipts is enrichment, and Amex runs it with Ethoca. Discover has neither - Card mix decides the rest: mostly Visa, start with RDR. Real Mastercard volume, you need Ethoca. Selling outside the US, CDRN is the wrong tool - Budget ~$15-25 per RDR case and ~$20-40 per CDRN or Ethoca alert. Activation runs 3-7 business days, so this isn't a today fix - Do the free things first: fix your billing descriptor, switch on Order Insight and Consumer Clarity. Paid alerts only start earning after the customer has already called their bank - Alerts kill the chargeback, not the fraud report. A fraud-driven ratio problem needs 3DS or CE 3.0 instead ::: Somebody is quoting you products that all sound identical, and you're trying to work out which one you actually need. They mostly are identical. Every one of them tells you a customer is about to dispute a charge, so you can refund first and keep the chargeback off your ratio. What genuinely differs: which card brands they reach, which countries, and whether a human has to do anything. Most comparisons cover three of them and stop. There are more, and one of the missing ones is free. :::tip[You're probably not late] If you landed here because your ratio ticked up this month, breathe. Alerts are the fourth thing to fix, not the first, and the three ahead of them cost nothing. No business dies from one month without alert coverage. Read the [order of operations](#do-the-free-things-first) before you spend a dollar. ::: ## Who Actually Runs What {/* #who-runs-what */} The product names hide the structure completely. There are two companies, four networks, and two different kinds of tool. Here's the whole thing. | | Visa | Mastercard | Amex | Discover | |---|---|---|---|---| | **Built into the network** | **[RDR](#rdr)** | **Collaboration**, inside Mastercom | **[ADR](#amex-adr)**, free | nothing | | **Third-party alert network** | **[CDRN](#cdrn)** | **[Ethoca Alerts](#ethoca)** | thin | thin | | **Enrichment** | [Order Insight](#order-insight) | [Consumer Clarity](#consumer-clarity) | **Digital Receipts**, [run by Ethoca](#amex-adr) | nothing found | | The company behind it | **Verifi**, Visa-owned | **Ethoca**, Mastercard-owned | Amex, plus Ethoca | - | Two things fall out of that. **RDR and CDRN are the same company.** Choosing between them was never a vendor decision. And **Mastercard does have an answer to RDR.** It's Collaboration, inside Mastercom. It isn't sold as an alert feed, so it gets missed. Plenty of write-ups say Mastercard has no equivalent. They're wrong. The top two rows differ by where the tool lives. RDR and Collaboration are wired into the network's own dispute flow. CDRN and Ethoca Alerts sit alongside it. That's why their reach depends on which banks joined. ### Why the coverage is such a mess {/* #legacy */} This confuses everyone, and the reason is history rather than logic. Both were founded in 2005. Both independent. Both worked across every card brand, because that was the product: a neutral bridge between issuers and merchants. Then Mastercard announced it was buying Ethoca in March 2019. Visa bought Verifi that September, openly as a response. So each network now owns a company built to be neutral. That old multi-brand reach didn't vanish on acquisition day. Roughly 75% of Verifi's alerts are Visa now. Ethoca still reaches Visa, Mastercard, Amex, JCB and Diners. REPORTED That's why sources contradict each other on what CDRN covers. Verifi calls it card-brand agnostic, which is true of its origins. Others say Visa only, which is closer to where its alert volume sits today. Both are describing the same thing from different ends. **The drift only applies to alerts.** Enrichment went the other way. American Express is a rival network. It publicly partners with Ethoca, which Mastercard owns, to run Amex Digital Receipts. That's live, not a leftover. There's a logic to it. Alerts touch dispute economics, so they're competitive. Showing a customer what they bought isn't. Nobody loses when a cardholder recognizes their own charge. So the enrichment layer stayed shared. The alert layer split. **What to do about it:** don't budget on any published coverage claim. Ask the reseller: *"Which card brands will I actually get alerts for, and what share of my volume is that?"* Get it in the email thread. ### Amex and Discover are the real gap {/* #amex-adr */} None of the three alert networks covers Amex or Discover properly. If either is a real share of your volume, alerts won't save you. **Amex fills its own gap, and it's free.** Accelerated Dispute Resolution gives you **8 calendar days** before a chargeback is raised. Amex's own factsheet is worth quoting: *"With no upfront chargeback, liability stays with American Express during the 8 days, not with you."* Four ways to answer. Refund with your business name shown. Challenge it with evidence. Settle with the customer direct. Or push it into the normal process if 8 days isn't enough. Two limits, both real. **Non-fraud disputes only**, and fraud codes are a large share of most merchants' disputes. **US Merchant IDs only.** Sign up with your Merchant ID through your Online Merchant Account, or ask your Amex representative. VENDOR **Amex has enrichment too, and most comparisons miss it.** Digital Receipts shows Card Members what's behind a charge they don't recognize. Amex runs it with Ethoca. That's the Mastercard company, which is worth pausing on. Amex's own words: *"American Express has partnered with Ethoca to bring you Digital Receipts."* Same flow as Order Insight and Consumer Clarity. Customer doesn't recognize a charge. Checks online or calls Amex. Gets the receipt instead of filing. Amex names one case in particular. Card Members can now spot *"transactions made by family or staff."* That's a big slice of what merchants log as friendly fraud. It was someone else's card, used at home. Amex publishes no price and no signup route. It says to contact Ethoca. So ask whoever sells you Ethoca alerts whether Amex Digital Receipts is already on your account. VENDOR **Discover has nothing like any of it.** No RDR equivalent, no ADR equivalent, and no enrichment partnership we can find. Retrieval requests are the only early warning you get. NOT PUBLISHED ## The 30-Second Comparison | | **[RDR](/docs/chargebacks/prevention/visa-rdr)** | **[CDRN](/docs/chargebacks/prevention/verifi-cdrn)** | **[Ethoca](/docs/chargebacks/prevention/ethoca-alerts)** | |---|---|---|---| | Run by | **Verifi**, a Visa company | **Verifi**, a Visa company | **Ethoca**, a Mastercard company | | Card brands | **Visa only** | Disputed. Visa for certain, non-Visa unclear R | **Mastercard-heavy**, some others | | Geography | Global | **US-focused** | **Global** | | Who acts | Nobody | You, within ~72 hours | You, within 24-72 hours | | You keep discretion | **No** | Yes | Yes | | Typical cost | ~$15-25 per case | ~$20-40 per alert | ~$20-40 per alert | | Time to activate | 3-7 business days | 3-7 business days | 3-7 business days | | Free tool on the same network | Order Insight | Order Insight | Consumer Clarity | ## Which One Do You Need? Three questions get you to an answer. **1. What's your card mix?** Mostly Visa, start with RDR. Meaningful Mastercard volume, you need Ethoca. Balanced, you need both. **2. Do you sell internationally?** If yes, CDRN is the wrong tool. Its strength is US domestic volume. Ethoca is the global one. **3. Is somebody actually going to open the alert queue every day?** Be honest. If that somebody is you, and you're already running the whole business, the answer is probably no. This one decides more than the other two put together. CDRN and Ethoca send you an alert and wait. Nobody refunds inside 24-72 hours, the alert expires, the chargeback gets filed, and you paid the fee for nothing. RDR needs no human at all. :::tip[If you can't promise a daily habit, buy the automation] An unworked queue is worse than no alerts at all, because you pay for the alert AND the chargeback. Yes, RDR gives away some fights you'd have won. Still cheaper than a queue nobody opens. ::: ```mermaid flowchart TD A[Need alertcoverage] --> B{Will someone workthe queue daily?} B -->|No| E[RDRAutomatic, Visa only] B -->|Yes| D{Sellinginternationally?} D -->|No, US only| G[CDRN72hr manual] D -->|Yes| H[Ethoca24-72hr manual] G --> I{SignificantMastercard volume?} H --> I I -->|Yes| J[Add Ethoca or bothWatch for duplicates] I -->|No| K["You're covered"] style E fill:#3b82f6,color:#fff style G fill:#8b5cf6,color:#fff style H fill:#f59e0b,color:#fff style J fill:#22c55e,color:#fff ``` ## How Alerts Work At All Before alerts existed, you found out about a dispute when the chargeback landed. By then it already counted against you. Alert networks open a channel between your customer's bank and you at the **pre-dispute** stage, which just means the customer is complaining but nothing has been filed yet. That window is what you're buying. ```mermaid flowchart LR A[Customercontacts bank] --> B[Bank queriesalert network] B --> C[Alert sentto merchant] C --> D{Merchantresponse} D -->|Refund| E[No chargebackRatio protected] D -->|Ignore| F[Chargebackfiled] style E fill:#22c55e,color:#fff style F fill:#ef4444,color:#fff ``` You still lose the sale. What you avoid is the fee, the staff time, and the ratio damage. ## Each One In Detail ### RDR, from Verifi {/* #rdr */} Automatic. You set the rules once, and qualifying Visa disputes get refunded without anyone touching them. No chargeback is filed. The catch: RDR never asks whether you'd have won. Set the rules too broad and you're paying to hand back money you would have kept. **โ†’ [Full guide to RDR](/docs/chargebacks/prevention/visa-rdr)** ### CDRN, also from Verifi {/* #cdrn */} You get an alert and about 72 hours to decide. Same company as RDR. Strongest on US Visa and Discover volume, and it reaches some non-Visa issuers because it runs outside the card networks. You keep judgment on every case, which is worth real money if you've got somebody to exercise it. **โ†’ [Full guide to CDRN](/docs/chargebacks/prevention/verifi-cdrn)** ### Ethoca Alerts, from Ethoca {/* #ethoca */} The other company. Mastercard's network, global reach, 24-72 hours to refund. The window moves by issuer, so build your process around 24 hours. If the plan is "I'll check the alerts on Friday," you don't have a plan. **โ†’ [Full guide to Ethoca Alerts](/docs/chargebacks/prevention/ethoca-alerts)** ## Do The Free Things First These work one step earlier than alerts, back when the customer is squinting at their statement and hasn't called anybody yet. Both are usually free, and they prevent the dispute instead of resolving it. ### Order Insight {/* #order-insight */} Visa's, delivered through Verifi. When a customer stares at an unfamiliar charge in their banking app, your merchant name, logo, and order details show up right beside it. They recognize it and move on. ("Enrichment" is just industry-speak for pushing your details into the bank's app.) Also matters for CE 3.0 qualification. ### Consumer Clarity {/* #consumer-clarity */} Mastercard's equivalent, delivered through Ethoca. Same idea, plus subscription management so customers can cancel directly instead of disputing. **How to switch them on:** neither one has a "buy now" button. Ask your processor or whoever sells you alerts: *"Can you enable Visa Order Insight and Mastercard Consumer Clarity on my MID, and what do they cost me?"* If the answer is "it's included," get that in the email thread. :::tip[The order of operations that saves the most money] 1. **Fix your [billing descriptor](/docs/chargebacks/prevention/descriptors-and-comms).** Free. "I don't recognize this charge" is the most common preventable dispute there is. 2. **Turn on Order Insight and Consumer Clarity.** Usually free. 3. **Make refunds easy to get.** A customer who can reach you doesn't need their bank. 4. **Then** buy alerts. Paid alerts only start earning after somebody has already picked up the phone. ::: ## What Alerts Don't Fix Refunding on an alert stops the chargeback. It doesn't erase a fraud report. Under Visa's VAMP program the count combines fraud reports (TC40s) with non-fraud disputes. Alerts remove the dispute. If the customer claimed fraud, the TC40 stays on your count. | Tool | Dispute count | Fraud report (TC40) | |---|---|---| | RDR | Excluded | Still counts if fraud claimed | | CDRN | Excluded | Still counts if fraud claimed | | Ethoca | Excluded at Mastercard level | Visa VAMP impact depends on issuer/acquirer | | Order Insight | Never filed | No TC40 if customer recognizes charge | | Consumer Clarity | Never filed | No TC40 if customer recognizes charge | **What that means in practice:** - **Billing confusion and service complaints:** alerts work, and work well - **Fraud claims:** alerts stop the chargeback, not the fraud report If your ratio problem is fraud-driven, alerts alone won't solve it. You need [3DS](/docs/fraud/prevention/3ds), [risk scoring](/docs/fraud/prevention/risk-scoring), or CE 3.0, which excludes both the dispute and the TC40. ## Scale Callout | Volume | Focus | |---|---| | **Under $100K/mo** | Free tools only (Order Insight, Consumer Clarity). Add RDR if your ratio passes 0.5%. | | **$100K-$1M/mo** | RDR + Ethoca minimum. CDRN if you're US-focused. The math clearly works. | | **Over $1M/mo** | Full stack, all through one vendor so you never get billed twice for the same dispute. | | **Ratio above 0.9%** | Everything, now. See [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic). | **โ†’ [Full pricing and ROI math](/docs/chargebacks/prevention/chargeback-alert-pricing)**, including the three ways alert costs creep up on you and the five numbers to track once you're paying. ## Buying Direct vs Through A Reseller **Direct** means calling Verifi for RDR and CDRN, and Ethoca for Ethoca and Consumer Clarity. Two vendors, two platforms, two invoices, and you're the integration. **Through a reseller** (one company that sells you all three on a single platform) you get one login, one bill, usually better pricing at volume, and de-duplication. De-duplication just means they catch it when CDRN and Ethoca both fire on the same dispute, so you don't get billed twice for one angry customer. Most merchants should use a reseller. Before you sign, send these four questions in an email and keep the reply: - *"What's my per-alert price at my current volume, and what happens to it if my volume drops?"* - *"If CDRN and Ethoca both alert on the same dispute, am I billed once or twice? Put the answer in the contract."* - *"Who issues the refund, you or me? If it's me, where does the alert land: email, dashboard, or webhook?"* - *"What's the minimum term, and what notice do I give to cancel?"* If the de-duplication answer gets vague, walk. Two things to demand in writing before you sign: a per-alert price with no monthly minimum you can't realistically hit, and a short cancellation notice. A 12-month lock-in on a merchant who has never bought alerts before is the vendor moving their risk onto you. ## Where This Breaks 1. **The dispute is real fraud.** Somebody used a stolen card. The alert stops the chargeback, the TC40 still lands, and your VAMP count barely moves. Wrong tool. Go to [3DS](/docs/fraud/prevention/3ds) and [risk scoring](/docs/fraud/prevention/risk-scoring). 2. **Your product is the problem.** If customers dispute because what showed up is nothing like what you sold them, you're paying $20-40 a head to buy your way out of a refund you owed anyway. Fix the product. 3. **Nobody opens the queue.** This is the one that actually happens. Somebody signs up for CDRN in a panic, works the alerts hard for two weeks, then gets busy. Now you're paying for alerts *and* collecting chargebacks. If that sounds like your shop, buy RDR and stop thinking about it. 4. **Your customer's bank sits outside the network.** Coverage only counts if their issuer participates. When it doesn't, the chargeback arrives cold, exactly the way it always did. Expect a mix of both, and don't let a salesperson tell you it's airtight. ## Test to Run Before you sign anything, spend 30 minutes finding out how many disputes alerts would actually have caught. 1. **Open your dispute list.** Stripe: Payments > Disputes. Square: Transactions > Disputes. PayPal: Resolution Center. Shopify Payments: Orders > the order > Chargebacks. Anywhere else, search the dashboard for "disputes," or call support and ask where they live. 2. **Pull the last 90 days and count them.** 3. **Split them into two piles.** Pile one: disputes you would have refunded on the spot, no argument. Pile two: disputes where you had evidence and would have fought. 4. **Look at pile one.** Of those, how many would you have caught if an email had landed and you had 72 hours? That number is what you're buying. Take it to the [pricing page](/docs/chargebacks/prevention/chargeback-alert-pricing) and run it against a real quote. If pile one runs under 3 a month, alerts aren't your problem yet, and your descriptor probably is. If pile two is bigger than pile one, buy CDRN or Ethoca and keep your discretion. Not RDR. ## Next Steps 1. [Check your current ratio](/docs/chargebacks/metrics) so you know whether you need this at all 2. [Fix your descriptor](/docs/chargebacks/prevention/descriptors-and-comms) - free, do it first 3. [Compare pricing and run the ROI math](/docs/chargebacks/prevention/chargeback-alert-pricing) 4. [Setup Dispute Alerts playbook](/docs/playbooks/setup-dispute-alerts) - step by step implementation ## See Also - [Visa RDR](/docs/chargebacks/prevention/visa-rdr) - automatic, Visa only - [Verifi CDRN](/docs/chargebacks/prevention/verifi-cdrn) - manual, US-focused - [Ethoca Alerts](/docs/chargebacks/prevention/ethoca-alerts) - manual, global - [Alert Pricing & ROI](/docs/chargebacks/prevention/chargeback-alert-pricing) - what it costs and when not to buy - [What Is a Chargeback?](/docs/chargebacks) - the fundamentals - [Chargeback Prevention Overview](/docs/chargebacks/prevention) - the full prevention hierarchy - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP and ECM thresholds - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - VAMP and ECM detail - [Chargeback Vendors](/docs/chargebacks/vendors) - resellers and platforms - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - emergency playbook {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What are chargeback alerts?","acceptedAnswer":{"@type":"Answer","text":"Chargeback alerts notify merchants when a customer disputes a charge, giving them 24-72 hours to issue a refund before the dispute becomes a formal chargeback. This keeps the dispute off the merchant's chargeback ratio. The three main services are Visa's RDR (automated, roughly $15-25 per case), Verifi CDRN (manual, roughly $20-40 per alert), and Ethoca (manual, roughly $20-40 per alert)."}},{"@type":"Question","name":"What is the difference between RDR, CDRN, and Ethoca?","acceptedAnswer":{"@type":"Answer","text":"RDR is Visa-only and fully automatic: qualifying disputes are auto-refunded based on rules you set, with no manual action. CDRN sends an alert requiring a manual refund within about 72 hours and is strongest on US Visa and Discover volume. Ethoca is Mastercard's network with global reach, requiring a manual refund within 24-72 hours. The deciding factors are your card mix, whether you sell internationally, and whether anyone will work the alert queue daily."}},{"@type":"Question","name":"Which chargeback alert service should I use?","acceptedAnswer":{"@type":"Answer","text":"Three questions decide it. What is your card mix: mostly Visa points to RDR, significant Mastercard volume requires Ethoca. Do you sell internationally: if yes, CDRN is the wrong tool since its strength is US domestic volume. And will someone work the alert queue every day: if not, choose RDR, because CDRN and Ethoca alerts that expire unworked cost you the fee and prevent nothing."}},{"@type":"Question","name":"Do chargeback alerts stop fraud reports counting against VAMP?","acceptedAnswer":{"@type":"Answer","text":"No. Alerts prevent the chargeback from being filed, so the dispute does not count toward your ratio. But if the cardholder claimed the transaction was fraudulent, the TC40 fraud report is still generated and still counts under Visa's VAMP program. Alerts are highly effective for billing confusion and service complaints, and only partly effective for fraud claims. Fraud-driven ratio problems need upstream prevention such as 3D Secure, risk scoring, or CE 3.0."}},{"@type":"Question","name":"Should a small business buy chargeback alerts?","acceptedAnswer":{"@type":"Answer","text":"Not as a first step. Below roughly $100K per month, do the free things first: fix your billing descriptor so customers recognize the charge, turn on the free enrichment tools Order Insight and Consumer Clarity, and make refunds easy to obtain. Paid alerts only help after a customer has already contacted their bank. Add RDR once your chargeback ratio passes 0.5%."}}]})} --- ## What Chargeback Alerts Cost (and When They're Not Worth It) Source: https://paymentsandrisk.com/docs/chargebacks/prevention/chargeback-alert-pricing # What Chargeback Alerts Cost :::info[TL;DR] - **$20-40 per alert** for Ethoca and CDRN. **$15-25 per resolved case** for RDR. Order Insight and Consumer Clarity are usually free - You're billed per alert that lands, not per chargeback you actually stopped, including the winnable ones - A $50 chargeback really costs you about $95 once you add the fee, the goods and your time. A $30 alert that stops one pays for itself - At 100 alerts a month the math isn't close: roughly $3,000 spent against roughly $15,000 avoided - At 3 chargebacks a month it barely clears zero, and fixing your billing descriptor is free and works better - Get two quotes, ask both the same four questions, and get de-duplication written into the contract ::: Somebody quoted you a price for chargeback alerts and you want to know whether the number is fair. Short version: $20-40 per alert for Ethoca and CDRN, roughly $15-25 per case for RDR. That price isn't what decides whether you should buy. Two other things do: how many of those disputes you would have won anyway, and whether anybody on your team actually opens the queue. :::tip[If the quote made you wince] The two fixes that prevent the most disputes at small volume cost nothing at all. Alerts are the fourth thing you do, not the first. No business ever died from skipping alerts for a quarter. ::: ## The Prices | Service | Typical cost | Billed per | Notes | |---|---|---|---| | **[Visa RDR](/docs/chargebacks/prevention/visa-rdr)** | ~$15-25 | Resolved case | Automatic, Visa only | | **[Verifi CDRN](/docs/chargebacks/prevention/verifi-cdrn)** | ~$20-40 | Alert received | Manual, US-focused | | **[Ethoca](/docs/chargebacks/prevention/ethoca-alerts)** | ~$20-40 | Alert received | Manual, global | | **Order Insight** | Often free | - | Visa enrichment, via Verifi | | **Consumer Clarity** | Often free | - | Mastercard enrichment, via Ethoca | Pricing moves with your volume and with who you buy from. Most merchants go through a reseller, a middleman who bundles all three services into one login and one invoice, instead of buying direct. One login beats three. A reseller also handles de-duplication, which just means they catch it when CDRN and Ethoca both fire on the same dispute, so you don't get billed twice for one angry customer. Ask about it by name. **Get two quotes and ask both the same four questions.** Paste these straight into the email: > "What's the per-alert price at my volume?" > > "Do you de-duplicate CDRN against Ethoca, so one dispute never bills twice?" > > "Who issues the refund, you or me?" > > "What's the minimum term, and how much notice do I need to cancel?" Put the two answers side by side. If a vendor goes vague on de-duplication, that's your answer. Whoever you pick, allow 3-7 business days to activate. This isn't a same-day purchase. :::warning[You're billed per alert, not per chargeback prevented] This is the detail that changes the math. Every alert costs you money, including the ones for disputes you would have won at representment, and including duplicates if you run overlapping services without de-duplication. ::: ## What a Chargeback Actually Costs You A chargeback costs more than the sale. Here's what it pulls out of your business. | Component | Typical | |---|---| | The sale | Whatever the customer paid | | Processor chargeback fee | $0 to $30, typically $15, and several processors refund it if you win | | The product | Gone, if you shipped it | | Staff time | 30-60 minutes | | Ratio damage | Pushes you toward monitoring programs and fines | A $50 chargeback usually costs around $85 all-in, and only $15 of that is the fee. Against that, a $30 alert that reliably prevents one is worth buying. Just don't buy it expecting the fee saving to cover it, because it won't. That math holds at volume. It falls apart at three chargebacks a month, and nobody selling you alerts will run that version for you. ## The Actual ROI Math ``` Monthly ROI = (alerts resolved ร— avoided chargeback cost) - (alerts received ร— alert cost) - staff time ``` Worked example at reasonable scale: - 100 alerts at $30 = **$3,000 cost** - 100 chargebacks avoided at $150 fully-loaded = **$15,000 avoided** - Staff time = **$500** - **Net: ~$11,500/month** That's why every alert vendor's deck says the ROI is obvious. At 100 alerts a month, they're right. Now run it at small-merchant scale. ## When Alerts Are Not Worth It **$30K/month merchant, 3 chargebacks/month.** - 3 alerts at $30 = $90/month - Maybe 2 prevented = ~$190 avoided - Net: ~$100/month Technically you're up $100. But two of those three disputes were probably your billing descriptor, and fixing that costs **zero**. Keep the $90, spend 10 minutes in your processor dashboard, and you prevent more disputes than the alerts would have. :::tip[Do these free things first] 1. **Fix your billing descriptor.** "I don't recognize this charge" is the most common dispute and the most preventable one. Stripe: Settings > Account Details > Statement descriptor. Square: Account & Settings > Business Information > Statement descriptor. Shopify Payments: Settings > Payments > Statement descriptor. Ten minutes, no invoice. 2. **Turn on Order Insight and Consumer Clarity.** Usually free, and they stop the dispute before the customer even calls. Email your processor: *"Can you enable Order Insight and Consumer Clarity on my account?"* 3. **Make refunds easy to get.** A customer who can reach you doesn't need their bank. Paid alerts only help *after* somebody has already picked up the phone. Buy them after the free fixes run out, not before. ::: ## Scale Callout | Your volume | What to buy | |---|---| | **Under $100K/mo** | Free enrichment only (Order Insight, Consumer Clarity). Add RDR if your ratio passes 0.5%. | | **$100K-$1M/mo** | RDR + Ethoca at minimum. Add CDRN if you sell mostly in the US. The math clearly works here. | | **Over $1M/mo** | Full stack, plus a reseller platform so you get one login and de-duplication. | | **Ratio above 0.9%** | Everything available, immediately. See [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic). | ## Three Ways The Price Goes Up Quietly **1. Duplicate alerts.** CDRN and Ethoca overlap. Run both without de-duplication and one dispute bills twice. Get it into the contract before you sign, not after the first invoice: *"If CDRN and Ethoca both alert on the same dispute, am I billed once or twice? Put the answer in writing."* **2. Refunding winnable fights.** With [RDR](/docs/chargebacks/prevention/visa-rdr) especially, rules fire without checking whether you had delivery confirmation. Track how often you auto-refund cases you could have won, and tighten the dollar threshold if that number climbs. **3. Alerts nobody opens.** CDRN and Ethoca need a human to refund inside 24-72 hours. An alert that expires costs you the fee and prevents nothing. If you can't promise a daily habit, RDR's automation beats CDRN's control. ## Test to Run Before you sign anything, spend 30 days counting. Pull your last 30 days of disputes out of your processor dashboard. Stripe: Payments > Disputes. Square: Transactions > Disputes. PayPal: Resolution Center. Shopify: Orders > the order > Chargebacks. Sort them into three piles: "didn't recognize the charge," "never got it," and real fraud. If the first pile is the biggest, fix your descriptor and count again next month. If it shrinks, you just kept the $90. If your disputes are spread evenly across all three and your ratio is still climbing, that's when alerts earn their price. ## Analyst Layer: Metrics to Track If you're paying for alerts, these five numbers tell you whether the money is doing anything. | Metric | What It Tells You | Target | |---|---|---| | Alert-to-refund rate | Is anybody actually working the queue? | Over 90% within the deadline | | Cost per prevented chargeback | Are you overpaying per save? | Under $40 | | Duplicate alert rate | Is de-duplication really switched on? | Under 5% | | Alerts that became chargebacks anyway | Are you refunding too late? | Under 5% | | RDR acceptance rate | Are your rules too tight or too loose? | 70-90% | If your cost per prevented chargeback creeps above what a chargeback actually costs you, you're paying for the privilege of losing money faster. Cancel it. ## Next Steps 1. [Work out your real chargeback cost](/docs/chargebacks/metrics) before you compare quotes 2. [Fix your descriptor](/docs/chargebacks/prevention/descriptors-and-comms) - free, and do it first 3. [Compare the three services](/docs/chargebacks/prevention/alerts) 4. [Setup Dispute Alerts playbook](/docs/playbooks/setup-dispute-alerts) ## See Also - [Chargeback Alerts Compared](/docs/chargebacks/prevention/alerts) - RDR vs CDRN vs Ethoca - [Visa RDR](/docs/chargebacks/prevention/visa-rdr) - automatic, ~$15-25/case - [Verifi CDRN](/docs/chargebacks/prevention/verifi-cdrn) - manual, US-focused - [Ethoca Alerts](/docs/chargebacks/prevention/ethoca-alerts) - manual, global - [Chargeback Vendors](/docs/chargebacks/vendors) - resellers and platforms - [What Is a Chargeback?](/docs/chargebacks) - the fundamentals {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"How much do chargeback alerts cost?","acceptedAnswer":{"@type":"Answer","text":"Ethoca and Verifi CDRN alerts typically cost $20-40 per alert. Visa RDR is generally $15-25 per resolved case. Transaction enrichment tools, Order Insight for Visa and Consumer Clarity for Mastercard, are often free. Pricing varies by reseller and volume, and most merchants buy through an aggregator rather than direct."}},{"@type":"Question","name":"Are chargeback alerts worth the money?","acceptedAnswer":{"@type":"Answer","text":"At scale, clearly yes. A merchant receiving 100 alerts a month at $30 each spends $3,000 to avoid roughly $15,000 in fully-loaded chargeback costs. At small volume the case is much weaker: a merchant with 3 chargebacks a month nets only around $100, and fixing a confusing billing descriptor is free and typically prevents more disputes than the alerts would."}},{"@type":"Question","name":"What does a chargeback actually cost a merchant?","acceptedAnswer":{"@type":"Answer","text":"The sale amount, plus a processor chargeback fee of $0 to $30, plus the product if it already shipped, plus 30-60 minutes of staff time, plus ratio damage that pushes you toward network monitoring programs. Most US processors charge $15, and Helcim, Shopify Payments and PayPal's standard tier refund it when you win. A $50 chargeback typically costs around $85 in total."}},{"@type":"Question","name":"Can chargeback alerts cost more than they save?","acceptedAnswer":{"@type":"Answer","text":"Yes, in three ways. Duplicate alerts, when CDRN and Ethoca overlap without de-duplication and one dispute bills twice. Auto-refunding disputes you would have won, which happens with RDR when rules are set too broadly. And alerts nobody actions, since CDRN and Ethoca require a manual refund within 24-72 hours and an expired alert cost you the fee while preventing nothing."}},{"@type":"Question","name":"What should a small business do instead of buying alerts?","acceptedAnswer":{"@type":"Answer","text":"Three free things first. Fix your billing descriptor so customers recognize the charge on their statement, which is the single most common preventable dispute. Turn on Order Insight and Consumer Clarity, the free transaction enrichment tools that stop disputes before a customer contacts their bank. And make refunds easy to obtain, since a customer who can reach you does not need to call their bank."}}]})} --- ## The Name on Your Customer's Statement (Descriptors) Source: https://paymentsandrisk.com/docs/chargebacks/prevention/descriptors-and-comms # The Name on Your Customer's Statement (Descriptors) :::info[TL;DR] - **"I don't recognize this charge"** = most preventable chargeback type (15-25% of disputes) - Fix your descriptor: lead with your customer-facing brand name, test on actual bank statements - Send confirmation emails immediately: include billing descriptor preview so they know what to expect - Subscription renewal reminders 7-14 days before charge. Cancellations are cheaper than disputes - Highest ROI chargeback prevention: costs almost nothing to implement ::: Your billing descriptor is the short line of text that shows up on your customer's card statement next to the amount they paid. It's usually the only clue they get about who charged them, and when it reads as random letters, "I don't recognize this charge" follows. That's the most preventable chargeback type, and confirmation emails landing in spam make it worse. Fix these two things and watch disputes drop. It's the highest-ROI chargeback prevention there is. It costs almost nothing and prevents 15-25% of disputes. ## What Matters 1. **Your descriptor is your first defense.** If customers can't recognize you, they dispute. 2. **Post-purchase communication confirms the transaction.** Silence breeds confusion. 3. **Subscription renewal reminders prevent "I didn't authorize" disputes.** Proactive beats reactive. 4. **Dynamic descriptors add context.** Order numbers, product categories, location identifiers. 5. **Mobile statement views are tiny.** Test what customers actually see. --- ## Upload Your Logo. It's Free and Takes Minutes {/* #free-logo */} Do this before anything else on this page. Ethoca is Mastercard's. It runs a free program that puts your logo beside your charge in participating banks' apps. Your customer opens the app. Sees an unfamiliar line. Sees your logo next to it. That's the dispute, gone, at the moment it would have started. Ethoca's own words: "We're inviting merchants around the world to upload their logos... The best part? It's free of charge!" **Where to go:** [logo.ethoca.com](https://logo.ethoca.com). Upload the logo, consent to its use. That's the whole job. Two catches. Only participating issuers show it, so coverage isn't everywhere. And the logo is just the visual half of Consumer Clarity. The rest pushes itemised receipts and your contact details into the same screen. See [chargeback alerts](/docs/chargebacks/prevention/alerts#consumer-clarity). **Why it matters more than it sounds.** Ethoca asked cardholders. **77% often can't recognise transactions on their statements. 96% want more detail in their banking app.** That's your descriptor problem in two numbers, measured by the company sitting between you and the issuer. VENDOR --- ## Fixing Your Billing Descriptor Your billing descriptor appears on the cardholder's statement. If it doesn't clearly identify you, disputes follow. ### What Customers See | What You Intended | What They See | Result | |-------------------|---------------|--------| | Acme Pet Supplies | ACME* PYPMT | "What's PYPMT? I'll dispute." | | Smith Consulting LLC | SQ *SMITH CO | "I don't know SQ." | | Online order from your store | STRIPE* [RANDOM] | "Never heard of STRIPE." | ### Descriptor Anatomy Most descriptors have two parts: | Component | Characters | Example | |-----------|------------|---------| | **Static prefix** | 3-12 chars | Company name or brand | | **Dynamic suffix** | Remaining chars | Order ID, location, product | Total length: Usually 22-25 characters visible. Varies by issuer and statement format. ### Descriptor Best Practices **Do:** - Lead with your customer-facing brand name - Include a phone number or URL if space allows - Test on actual bank statements (not just processor dashboard) - Keep it consistent across all payment methods **Don't:** - Use corporate entity names customers don't know - Let processor defaults stand ("STRIPE*" or "SQ*") - Assume what you enter is what they see - Use abbreviations that only make sense to you ### Testing Your Descriptor 1. Make a small purchase on your own site 2. Wait for it to post to your bank statement 3. Check desktop and mobile banking apps 4. Ask: "Would I recognize this if I forgot I bought something?" ### Changing Your Descriptor Contact your processor. Common steps: 1. Request descriptor change in processor dashboard 2. Submit required documentation (may need business verification) 3. Wait 1-3 days for activation 4. Test with a real transaction 5. Verify on bank statement :::note[Ask Your Dev] "What's our current billing descriptor? Where do I change it, and how long does it take to update?" ::: --- ## Dynamic Descriptors Dynamic descriptors add transaction-specific information to help customers recognize charges. ### What You Can Add | Suffix Type | Example | Best For | |-------------|---------|----------| | **Order number** | ACME #12345 | E-commerce | | **Product category** | ACME SHOES | Multi-product stores | | **Location** | ACME NYC | Multi-location retail | | **Service type** | ACME MONTHLY | Subscriptions | | **Date reference** | ACME OCT2024 | Recurring billing | ### Multi-Brand Businesses If you operate multiple brands under one merchant account: | Approach | Descriptor | Trade-off | |----------|------------|-----------| | **Parent company only** | ACME HOLDINGS | Low recognition, more disputes | | **Primary brand + product** | PETSHOP DOGFOOD | Better recognition | | **Brand as prefix** | PETSHOP* ORDER | Best recognition | Ask your processor about dynamic descriptors. That's how each transaction shows the brand the customer actually bought from. ### Character Limits and Truncation Descriptors get truncated differently: | Platform | Visible Characters | |----------|-------------------| | Desktop bank statement | 22-25 | | Mobile banking app | 15-20 | | Paper statement | 22-25 | **Front-load the important stuff.** Your brand name should be in the first 12 characters. ### Processor Support Not all processors support dynamic descriptors. Ask: - "Do you support dynamic descriptors?" - "What's the character limit for the dynamic portion?" - "How do I pass the dynamic portion via API/dashboard?" - "Is there an additional cost?" --- ## Post-Purchase Communication Confirmation emails are your receipt. If they don't arrive or don't make sense, customers doubt the purchase. ### Confirmation Email Essentials Send immediately after successful payment: | Element | Why It Matters | |---------|----------------| | **Brand name and logo** | Visual recognition | | **Order number** | Reference for support | | **What they bought** | Line items with descriptions | | **Amount charged** | Exact dollar amount | | **Payment method** | "Visa ending in 1234" | | **Billing descriptor preview** | "This will appear on your statement as ACME #12345" | | **Support contact** | Phone, email, or chat link | ### Shipping/Delivery Confirmation For physical goods: | Element | Why It Matters | |---------|----------------| | **Tracking number** | Proof of shipment | | **Carrier and link** | Easy tracking access | | **Expected delivery** | Sets expectations | | **Delivery confirmation** | "Your order was delivered to [address]" | For digital goods: | Element | Why It Matters | |---------|----------------| | **Access link** | How to use what they bought | | **Download confirmation** | "Your download started" | | **License/activation key** | Proof of delivery | ### Email Deliverability Your emails need to arrive. Check: - [ ] Sending from your domain (not generic @gmail) - [ ] SPF, DKIM, DMARC configured - [ ] Transactional emails separate from marketing - [ ] Not triggering spam filters (test with mail-tester.com) - [ ] "From" name matches your brand :::note[Ask Your Dev] "Are our transactional emails going to spam? What's our delivery rate? Do we have SPF/DKIM set up?" ::: --- ## Subscription Communication Recurring charges generate the most "I didn't authorize this" disputes. Communication prevents them. ### Renewal Reminders Send 7-14 days before renewal: ``` Subject: Your [Product] subscription renews on [Date] Hi [Name], Your [Product] subscription will renew on [Date] for [Amount]. Your payment method: Visa ending in 1234 If you want to cancel or change your subscription: [Cancel Link] | [Manage Subscription Link] Questions? Reply to this email or call [phone]. Thanks, [Your Brand] ``` ### Why Reminders Feel Scary But Work Merchants worry reminders trigger cancellations. Data says otherwise: - Customers who cancel were going to cancel (or dispute) - Reminders reduce disputes far more than they increase cancellations - A cancellation costs you revenue. A dispute costs you revenue + fee + ratio damage. ### Annual Subscription Reminders Annual subscriptions need more notice: | Timeline | Communication | |----------|---------------| | 30 days before | "Your annual subscription renews in 30 days" | | 7 days before | "Renewal coming up on [Date]" | | Day of | "Your subscription renewed today" | ### Renewal Confirmation After charging: ``` Subject: Your [Product] subscription renewed Hi [Name], Your subscription renewed today for [Amount]. This charge will appear on your statement as: [BILLING DESCRIPTOR] Next renewal: [Date] [Manage Subscription] | [Cancel] | [Get Help] ``` --- ## Descriptor Clarity Checklist Use this checklist to audit your descriptor and communication: ### Descriptor Audit - [ ] Descriptor leads with customer-facing brand name - [ ] Tested on actual bank statement (not just processor preview) - [ ] Visible on mobile banking app - [ ] Phone number or URL included if space allows - [ ] Dynamic suffix adds useful context (order number, product) - [ ] Multi-brand transactions show correct brand ### Communication Audit - [ ] Confirmation email sends immediately on payment success - [ ] Email includes brand name, order number, amount, and descriptor preview - [ ] Shipping confirmation includes tracking - [ ] Subscription renewal reminders sent 7-14 days before charge - [ ] Emails reach inbox (not spam) - [ ] Easy access to support contact --- ## Test to Run **2-week descriptor and communication audit:** **Week 1: Discovery** - Make a test purchase and check bank statement appearance - Review confirmation email content and delivery - Audit subscription renewal communication - Check email deliverability metrics **Week 2: Fixes** - Update descriptor to include brand name clearly - Add billing descriptor preview to confirmation emails - Implement or improve renewal reminders - Fix any email deliverability issues **Success criteria:** the descriptor shows your brand name. Confirmation emails include a descriptor preview. Renewal reminders are on for every subscription, and you've tested all three. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Fix your descriptor and confirmation emails. This is free. Just do it. | | **$100k-$1M/mo** | Add dynamic descriptors. Implement renewal reminders. Track "unrecognized charge" disputes separately. | | **Over $1M/mo** | Segment descriptor strategy by product line. A/B test communication timing. Analyze dispute reduction by communication type. | --- ## Where This Breaks 1. **Payment facilitators with limited descriptor control.** If you're on Square, Stripe, or similar, your descriptor options are limited. Push for maximum customization within their constraints. 2. **Legacy billing systems.** If your billing system is old, a descriptor change means development work. It's still worth doing first. 3. **International customers.** Descriptors can look different on non-US statements. If you've got real international volume, test with international cards. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **"Unrecognized charge" dispute %** | Descriptor effectiveness | 60% | | **Email click rate (renewal reminders)** | Customer awareness | > 20% | | **Dispute rate change after descriptor fix** | Impact of changes | Measurable reduction | | **Customer service "what is this charge" tickets** | Leading indicator | Trending down | ### Pre/Post Comparison When you make descriptor or communication changes: 1. Record dispute rate for 30 days before change 2. Implement change 3. Record dispute rate for 30-60 days after 4. Calculate % reduction 5. Estimate ROI (reduced disputes ร— chargeback cost) --- ## Next Steps **Fixing "unrecognized charge" disputes?** 1. [Audit your descriptor](#descriptor-audit) - What customers see 2. [Test on actual statements](#testing-your-descriptor) - Desktop and mobile 3. [Add descriptor preview to emails](#confirmation-email-essentials) - Set expectations **Improving subscription communication?** 1. [Set up renewal reminders](#renewal-reminders) - 7-14 days before charge 2. [Send renewal confirmations](#renewal-confirmation) - After charging 3. [Handle annual subscriptions](#annual-subscription-reminders) - Extra notice needed **Measuring impact?** 1. [Track key metrics](#analyst-layer-metrics-to-track) - Unrecognized charge % 2. [Run pre/post comparison](#prepost-comparison) - Measure reduction 3. [Check email deliverability](#email-deliverability) - Reach the inbox --- ## Related Pages - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention hierarchy - [Subscriptions and Recurring](/docs/payments/subscriptions-recurring) - Recurring billing setup - [Winning Evidence](/docs/chargebacks/winning-evidence) - What wins disputes - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Reason Codes](/docs/reference/reason-codes) - Dispute categories - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Refund Policy](/docs/chargebacks/refund-policy) - When to refund vs fight --- ## Ethoca Alerts: Mastercard's Alert Service Source: https://paymentsandrisk.com/docs/chargebacks/prevention/ethoca-alerts # Ethoca Alerts: Mastercard's Alert Service :::info[TL;DR] - **Buy Ethoca for the geography.** It's the global network. [CDRN](/docs/chargebacks/prevention/verifi-cdrn) is US-focused, so if you sell overseas, Ethoca is the one - **Strongest on Mastercard**, partial on Visa and everything else - **You get 24-72 hours to refund**, and the window depends on your customer's bank, so build for 24 - **Roughly $20-40 per alert** through a reseller, billed per alert that lands, not per chargeback you actually stopped - **Consumer Clarity comes with it, usually free**, and for a small merchant it's worth more than the alerts you're paying for - **Under $100K/month, don't buy the alerts yet.** Switch on Consumer Clarity, fix your billing descriptor, then look at your ratio again ::: Somewhere today, one of your customers is on the phone with their bank about a charge from you. Normally you find out weeks later. The chargeback lands and the money's already gone. Ethoca's job is to tell you now, while you can still just refund the person and make it disappear. Refund inside the window and no chargeback gets filed. Nothing touches your chargeback ratio. :::tip[Don't Panic] If you're here because your ratio is climbing, alerts aren't the emergency purchase they look like. Activation runs 3-7 business days. Nothing you buy this afternoon helps you this week. The free half of Ethoca and the descriptor fix both work faster, and both cost nothing. ::: ## How It Works 1. Your customer contacts their bank about a charge. 2. If that bank is in the Ethoca network, an alert gets routed to you. 3. You have 24-72 hours to refund. 4. Refund, and no chargeback is filed. 5. Ignore it and you're back where you started. A normal chargeback, except now you also paid for the alert that warned you. The window is shorter and less predictable than CDRN's 72 hours. It depends on your customer's issuer, the bank that gave them the card. Build your process around 24 hours. If your plan is "I'll check the queue on Friday," you don't have a plan. The refund itself happens in your own dashboard, same as any other refund. Stripe: Payments > the payment > Refund. Square: Transactions > the transaction > Issue Refund. PayPal: Activity > the transaction > Refund. Shopify: Orders > the order > Refund. ## What It Covers Ethoca reaches most Mastercard volume worldwide. The vendor says 90%+, and vendors always say 90%+. Treat it as "most, not all," plus partial coverage of Visa and other brands. Coverage only counts if your customer's own bank is in the network. If not, that chargeback shows up cold. No warning, exactly like always. Expect a mix of both, and ignore any salesperson who tells you it's airtight. **Pick Ethoca** if you sell internationally, or if Mastercard is a big slice of your volume. **Pick CDRN** if you sell US-only and mostly Visa. Plenty of merchants run both. If you do, one angry customer can trigger two bills, unless your reseller catches it. That's all de-duplication means. Ask about it by name before you sign. ## Consumer Clarity: The Part Worth More Than The Alerts Ethoca also gives you **Consumer Clarity**. It's usually free, and for a small merchant it beats the paid alerts outright. It works one step earlier. Your customer is squinting at a confusing line in their banking app. Consumer Clarity shows them your merchant name, your logo, and what they bought. They recognize it and never call the bank. No dispute, no alert, no fee. - Usually included free through Ethoca - The vendor claims it kills a big chunk of "I don't recognize this charge" disputes. Nobody's published an independent number. Measure it yourself - Includes subscription management, so customers cancel directly instead of disputing - Supports Mastercard's First-Party Trust program Visa's equivalent is Order Insight, delivered through Verifi. Turn on both. Most merchants never ask. Plenty of processors have it on at the platform level and never mention it. Email yours today: > *"Am I enrolled in Ethoca Consumer Clarity and Verifi Order Insight? If not, please turn both on and tell me what each one costs me."* If the answer is "already on," go fix your [billing descriptor](/docs/chargebacks/prevention/descriptors-and-comms) instead and spend nothing. Under $100K/month, the free tool plus a readable descriptor is the whole strategy. Paid alerts only fire after your customer has already picked up the phone. Consumer Clarity stops them dialling. ## What It Costs Typically **$20-40 per alert** through a reseller. Like CDRN, you're billed **per alert received**, not per chargeback prevented. So you pay on the disputes you'd have won, too. Say you've got signed delivery confirmation and a solid case. The alert lands. You refund anyway. You just paid $30 to lose on purpose. Watch the duplicate billing. Ethoca and CDRN overlap. Run both without de-duplication and one dispute bills you twice. **โ†’ Full pricing breakdown: [What Chargeback Alerts Cost](/docs/chargebacks/prevention/chargeback-alert-pricing)** ## How To Actually Buy This You don't buy Ethoca from Mastercard. You buy it from a reseller. A middleman that plugs you into the alert networks and sends you one bill. 1. **Ask your processor first.** Most already have a reseller partnership. The integration is a switch, not a project. 2. **Get quotes from two or three resellers**, not one. 3. **Send all of them the same four questions**, word for word: - *"What's the per-alert price at my volume?"* - *"If Ethoca and CDRN both fire on the same dispute, am I billed once or twice? Put the answer in the contract."* - *"Who issues the refund, you or me?"* - *"What's the minimum term, and what notice do I give to cancel?"* 4. **Demand three things in writing** before you sign. De-duplication against CDRN, no minimum monthly commitment, a 30-day out. If any answer gets vague, walk. 5. **Activation runs 3-7 business days**, so don't promise your processor a result this week. Before you ask anyone for a quote, go count what you've actually got. Stripe: Payments > Disputes. Square: Transactions > Disputes. PayPal: Resolution Center. Shopify: Orders > the order > Chargebacks. Three items this month? Alerts at $20-40 each aren't your problem. Your descriptor is. ## Ethoca vs CDRN | | **Ethoca** | **[CDRN](/docs/chargebacks/prevention/verifi-cdrn)** | |---|---|---| | Owner | Mastercard | Verifi (Visa) | | Card brands | Mastercard-heavy, some others | Visa + Discover, some MC | | Geography | **Global** | US-focused | | Response window | 24-72 hours (varies) | ~72 hours | | Who acts | You | You | | Cost | ~$20-40/alert | ~$20-40/alert | | Free tool included | Consumer Clarity | Order Insight (via Verifi) | Neither one is automatic. If you want hands-off prevention on Visa volume, that's [RDR](/docs/chargebacks/prevention/visa-rdr). **โ†’ Full head-to-head: [Chargeback Alerts Compared](/docs/chargebacks/prevention/alerts)** ## Scale Callout | Volume | What to do | |--------|-----------| | **Under $100k/mo** | Consumer Clarity and Order Insight, both free. Fix your descriptor. Skip the paid alerts entirely. | | **$100k-$1M/mo** | Keep the free tools on. Add Ethoca if you sell overseas or Mastercard is heavy, and only if somebody opens the queue every working day. | | **Over $1M/mo** | Ethoca plus CDRN plus RDR through one reseller, with de-duplication written into the contract. Someone owns the queue as part of their actual job. | ## Where This Breaks 1. **Your customer's bank isn't in the network.** That dispute arrives as a chargeback with zero warning, same as it always did. Nobody covers 100%. 2. **Nobody opens the queue.** An unworked alert is money you set on fire. You pay for the alert, then eat the chargeback anyway. If you can't promise a daily habit, [RDR's](/docs/chargebacks/prevention/visa-rdr) automation beats Ethoca's control. 3. **Your product or your signup flow is the real problem.** Alerts buy time, they don't fix a cause. If customers dispute because the order never arrived or the cancel button was buried, fix that. See [SMB prevention priorities](/docs/chargebacks/prevention/smb-prevention-priorities). ## The VAMP Catch Ethoca stops the chargeback at the Mastercard level. Whether that flows through to Visa's VAMP ratio depends on how your acquirer and the issuer implement it. Don't assume it does. That's true of every alert service. If the customer claimed fraud, the TC40 report still exists and still counts. Alerts fix billing confusion well. On fraud claims they get you halfway. ## Test to Run **The 60-day Consumer Clarity test, cost $0.** - **Days 1-30:** Change nothing. Count every dispute and ticket that boils down to "I don't recognize this charge." Write the number down. - **Day 30:** Turn on Consumer Clarity and Order Insight. Fix your descriptor the same afternoon. - **Days 31-60:** Count the same thing again. If that number drops hard, you solved it for free. Stop reading about alerts. If it barely moves, your disputes come from somewhere else, and now you know where to spend. ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Alert-to-refund rate** | Is anybody actually working the queue? | Over 80%, inside the deadline | | **Cost per prevented chargeback** | Are you paying more than the chargeback would have cost? | Below your all-in chargeback cost | | **Duplicate bills per month** | Is de-duplication actually working? | Zero | | **Chargebacks that arrived with no alert** | How big your coverage gap really is | Track the trend, bring it to the renewal | | **"Don't recognize this charge" disputes** | Whether Consumer Clarity and your descriptor are doing their job | Trending down | ## Next Steps 1. [Turn on Consumer Clarity and Order Insight first](/docs/chargebacks/prevention) - usually free 2. [Check your ratio](/docs/chargebacks/metrics) to see whether paid alerts are justified 3. [Compare all three services](/docs/chargebacks/prevention/alerts) 4. [Setup Dispute Alerts playbook](/docs/playbooks/setup-dispute-alerts) ## See Also - [Chargeback Alerts Compared](/docs/chargebacks/prevention/alerts) - RDR vs CDRN vs Ethoca - [Verifi CDRN](/docs/chargebacks/prevention/verifi-cdrn) - the US-focused alternative - [Visa RDR](/docs/chargebacks/prevention/visa-rdr) - the automatic option - [What Is a Chargeback?](/docs/chargebacks) - the fundamentals - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - the free fix to do first {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What are Ethoca alerts?","acceptedAnswer":{"@type":"Answer","text":"Ethoca is Mastercard's chargeback alert network. When a cardholder contacts their bank to dispute a charge and that bank participates in the network, Ethoca notifies the merchant. The merchant then has 24 to 72 hours to refund the customer voluntarily, which prevents the chargeback from being filed and keeps it off their chargeback ratio."}},{"@type":"Question","name":"How much do Ethoca alerts cost?","acceptedAnswer":{"@type":"Answer","text":"Ethoca alerts typically cost $20-40 per alert through a reseller, varying by provider and volume. Billing is per alert received rather than per chargeback prevented. Consumer Clarity, Ethoca's transaction enrichment tool, is often included free."}},{"@type":"Question","name":"What is the difference between Ethoca and CDRN?","acceptedAnswer":{"@type":"Answer","text":"Ethoca is Mastercard's network with global coverage and the strongest reach on Mastercard volume. CDRN is Verifi's network, owned by Visa, and is US-focused with the strongest reach on domestic Visa and Discover volume. Both require you to manually refund within a deadline. Choose Ethoca for international or Mastercard-heavy volume, CDRN for US-only Visa-heavy volume. Running both without de-duplication can mean paying twice for the same dispute."}},{"@type":"Question","name":"What is Consumer Clarity?","acceptedAnswer":{"@type":"Answer","text":"Consumer Clarity is Mastercard's transaction enrichment tool, delivered through Ethoca and often free. When a customer views an unfamiliar charge in their banking app, it displays the merchant name, logo, and purchase details so the customer recognizes the transaction and never disputes it. It also includes subscription management so customers can cancel directly instead of filing a dispute. Visa's equivalent is Order Insight."}},{"@type":"Question","name":"Should a small business pay for Ethoca alerts?","acceptedAnswer":{"@type":"Answer","text":"Usually not as a first step. Paid alerts only help after a customer has already contacted their bank. Free transaction enrichment tools like Consumer Clarity and Order Insight prevent the dispute from being filed at all, and fixing a confusing billing descriptor costs nothing. Merchants under roughly $100K per month should exhaust those free options before paying per alert."}}]})} --- ## SMB Prevention Priorities Source: https://paymentsandrisk.com/docs/chargebacks/prevention/smb-prevention-priorities # SMB Prevention Priorities :::info[TL;DR] - **Four actions, in order.** Each one cuts your remaining chargebacks by a meaningful percentage - Do them sequentially. Stop when your ratio is healthy - Combined effect: up to 76% chargeback reduction without buying fraud software - Total cost: $0 for the first two, minimal for the third, and roughly $45-400/month for the fourth at SMB volume ::: Every chargeback prevention guide gives you 20 things to do with no sense of order. This page ranks them. Four priorities, sequenced by impact and cost. Do them in order. Each one reduces the chargebacks that survived the previous step. If you're an SMB processing under $1M/month, this is your playbook. Start at Priority 1 and work down. Stop when your chargeback ratio sits comfortably below 0.9%. ## Priority 1: Fix Your Billing Descriptor **Cost:** Free | **Time:** 10 minutes | **Impact:** Prevents 15-25% of chargebacks ### What Change your billing descriptor to match your customer-facing brand name. Add your website URL or phone number if space allows. ### Why "I don't recognize this charge" is the most common chargeback trigger for SMBs. When your descriptor reads "SQ*XYZHOLD" or "STRIPE*RNDM" instead of your actual brand name, customers call their bank instead of you. This is the single easiest fix in all of payments. ### How **Stripe:** Settings > Account Details > Statement descriptor. Enter your brand name (up to 22 characters). Save. **Square:** Account & Settings > Business Information > Statement descriptor. Update to your brand name. **Shopify Payments:** Settings > Payments > Statement descriptor. Change to your storefront name. **Other processors:** Search your dashboard for "statement descriptor" or "billing descriptor." If you can't find it, call support and ask them to update it. **Test it:** Make a small purchase on your own site. Wait for it to post to your bank statement. Check desktop and mobile. If you wouldn't recognize it, your customers won't either. For the full guide on descriptor optimization, dynamic descriptors, and communication strategy, see [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms). ## Priority 2: Make Refunds Easier Than Disputes **Cost:** Free | **Time:** 1 hour | **Impact:** Prevents 10-15% of remaining chargebacks ### What Add a prominent "billing question?" or "need help with a charge?" contact option to your receipt emails, website footer, and checkout confirmation page. ### Why Customers dispute when they can't reach you. Most don't want to call their bank - it's a hassle. But if they can't find your contact info, or if your refund process is buried behind three forms and a two-week wait, they take the easy route: call the bank and dispute the charge. A refund costs you the sale. A chargeback costs you the sale plus a fee of up to $30 plus ratio damage plus operational overhead. Make the refund path obvious. ### How 1. **Receipt emails:** Add a "Question about this charge? Contact us at [link/phone]" line near the total 2. **Website footer:** Add "Billing Help" or "Refund Request" link 3. **Checkout confirmation page:** Include customer service contact info 4. **Subscriptions:** Make the cancel button visible in the account portal - don't hide it behind "contact support" The goal isn't to give away refunds. It's to make sure customers who have a legitimate question talk to you first, not their bank. For refund policy guidance, see [Refund Policy](/docs/chargebacks/refund-policy) and [Refund Strategy](/docs/chargebacks/refund-strategy). ## Priority 3: Enable 3D Secure on High-Risk Orders **Cost:** Free on most processors | **Time:** 30 minutes | **Impact:** Prevents 50%+ of true fraud chargebacks on covered orders ### What Require 3D Secure (3DS) authentication on orders over a threshold (commonly $200) from new customers, or on orders that your processor flags as elevated risk. ### Why 3DS shifts fraud liability from you to the card-issuing bank. If a fraudster uses a stolen card and the transaction was authenticated with 3DS, the issuer absorbs the chargeback - not you. This is the most powerful free tool for true fraud prevention. ### How **Stripe Radar:** Go to Radar > Rules. Add a rule: "Request 3D Secure if amount > 200 AND customer is new." You can also trigger 3DS based on risk score or country. **Other processors:** Search for "3D Secure" or "3DS" in your processor's dashboard or documentation. Most modern processors support 3DS rules. If yours doesn't, ask about it. ### Threshold Guidance | Your AOV | Suggested 3DS Threshold | Reasoning | |----------|------------------------|-----------| | Under $50 | $100+ from new customers | Catch outlier orders | | $50-$150 | $200+ from new customers | Balance friction vs. protection | | $150+ | All new customer orders | Higher ticket = higher risk | **Important:** 3DS adds a step to checkout and can reduce conversion slightly. Apply it selectively (new customers, high amounts, risky geographies) rather than on every transaction. See [3D Secure](/docs/fraud/prevention/3ds) for the full trade-off analysis. ## Priority 4: Add Chargeback Alerts **Cost:** $15-40 per alert, so ~$45-400/month at 3-10 alerts | **Time:** 3-7 business days to activate | **Impact:** Prevents many remaining disputes from becoming chargebacks ### What Subscribe to Visa's RDR (Rapid Dispute Resolution) and Mastercard's Ethoca alert services. These notify you when a customer disputes a charge, giving you a window to refund before the chargeback is filed. ### Why Alerts catch the disputes that survive your first three priorities. When a customer contacts their bank, the alert network notifies you. You refund within the window (24-72 hours depending on the service), and no chargeback is recorded against your ratio. ### How 1. **Contact your processor** and ask about RDR and Ethoca integration. Many processors have partnerships with alert resellers 2. **Or contact a reseller directly** - providers like Chargebacks911 and Verifi bundle multiple alert services into a single platform 3. **Set your rules** - RDR can auto-refund below a threshold (e.g., auto-refund all disputes under $50) 4. **Activation takes 3-5 days** typically **When alerts make sense:** Your chargeback ratio is above 0.5% and you need it down. Don't buy them to save on fees. An alert costs $15-40. The fee it avoids is $15 at most US processors and $30 at the worst published figure, so on fees alone it's a wash or a loss. You don't save the sale either, because resolving an alert means refunding the customer. What you're buying is the ratio and the hour you'd have spent responding. **When alerts are premature:** Under $100K/month with a ratio below 0.5%. The free fixes (Priorities 1-3) should be enough. For the full comparison of RDR, CDRN, Ethoca, and enrichment tools, see [Chargeback Alerts](/docs/chargebacks/prevention/alerts). ## When Each Priority Matters | Priority | Cost | Impact | Implement When... | |----------|------|--------|-------------------| | 1. Fix descriptor | Free | -15-25% of chargebacks | Immediately. No reason to wait | | 2. Easy refunds | Free | -10-15% of remaining | Immediately. Takes 1 hour | | 3. Enable 3DS | Free | -50%+ of true fraud on covered orders | You see true fraud chargebacks, or process $50K+/month | | 4. Chargeback alerts | $15-40/alert (~$45-400/mo at SMB volume) | -50%+ of remaining disputes | Ratio exceeds 0.5%, or volume exceeds $100K/month | ## The Compounding Effect These priorities compound because each one reduces the pool that the next one works on. **Starting point:** 100 chargebacks per year | Step | Action | Chargebacks Prevented | Remaining | |------|--------|----------------------|-----------| | Start | - | - | 100 | | Priority 1 | Fix descriptor | 20 | 80 | | Priority 2 | Easy refunds | 12 | 68 | | Priority 3 | 3DS on high-risk | 20 | 48 | | Priority 4 | Alerts | 24 | 24 | **Result: 76% reduction** - from 100 chargebacks to 24 - without buying fraud scoring software, ML models, or enterprise platforms. The exact numbers will vary by business, but the order holds. Descriptor fixes and refund accessibility are free and fast. 3DS is free but adds checkout friction. Alerts cost money but catch what slips through. ## What About Fraud Tools? Fraud scoring, device fingerprinting, and machine learning are Priority 5 and beyond. Most SMBs under $500K/month never need them. If you've done all four priorities above and your ratio is still above 0.9%, or if true fraud (stolen cards) makes up the majority of your chargebacks, then it's time to evaluate dedicated fraud tools. See [SMB Fraud Checklist](/docs/fraud/fundamentals/smb-fraud-checklist) for tier-by-tier guidance on when fraud tools make sense, what to look for, and how to calculate ROI. ## Next Steps **Just getting started?** 1. [Fix your descriptor](/docs/chargebacks/prevention/descriptors-and-comms) - Priority 1, do it today 2. [Review your refund accessibility](/docs/chargebacks/refund-policy) - Priority 2, takes an hour 3. [Understand your current ratio](/docs/chargebacks/metrics) - Know your baseline **Ratio is above 0.9% and climbing?** 1. [Enable 3DS](/docs/fraud/prevention/3ds) - Liability shift on risky orders 2. [Set up alerts](/docs/chargebacks/prevention/alerts) - Stop chargebacks from filing 3. [Read Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response plan **Done with all four priorities and still struggling?** 1. [SMB Fraud Checklist](/docs/fraud/fundamentals/smb-fraud-checklist) - Evaluate fraud tools by revenue tier 2. [Chargeback Metrics](/docs/chargebacks/metrics) - Dig into your data 3. [Refund Strategy](/docs/chargebacks/refund-strategy) - Optimize refund vs. fight decisions --- ## Related Pages - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Full descriptor optimization guide - [Refund Policy](/docs/chargebacks/refund-policy) - When and how to refund - [Refund Strategy](/docs/chargebacks/refund-strategy) - Refund vs. fight decision framework - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and liability shift - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, and CDRN - [SMB Fraud Checklist](/docs/fraud/fundamentals/smb-fraud-checklist) - Fraud prevention by revenue tier - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency chargeback response - [Chargeback Metrics](/docs/chargebacks/metrics) - Ratio tracking and benchmarks - [Chargeback Prevention Overview](/docs/chargebacks/prevention) - Full prevention hierarchy - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party dispute patterns --- ## Verifi CDRN: Visa's Manual Alert Service Source: https://paymentsandrisk.com/docs/chargebacks/prevention/verifi-cdrn # Verifi CDRN: Visa's Manual Alert Service :::info[TL;DR] - **You stay in control.** Nothing fires on its own. Every alert lands in a queue and you decide, case by case. [RDR](/docs/chargebacks/prevention/visa-rdr) is the opposite. - **About 72 hours to refund.** Refund inside the window and no chargeback gets filed. Miss it and you get a regular chargeback, same as always. - **$20-40 per alert.** You buy it from a reseller, never from Visa. - **US-focused.** Strongest on domestic Visa and Discover volume. Selling internationally? [Ethoca](/docs/chargebacks/prevention/ethoca-alerts) is the one you want. - **You pay per alert, not per chargeback you stopped.** Every alert bills you, including the ones you'd have won. - **Activation runs 3-7 business days.** A next-month lever, not a today lever. ::: One of your customers just called their bank instead of calling you. CDRN is the tip-off. You get a heads-up before the chargeback lands, plus about 72 hours to refund and make it go away. (It stands for Cardholder Dispute Resolution Network, which nobody says out loud.) Refund in time and nothing hits your chargeback ratio. Ignore the alert and you land where you'd have been anyway. A normal chargeback, except now you've also paid for the warning that told you it was coming. CDRN is run by Verifi, which Visa owns. That's why coverage is strongest on Visa cards, and why RDR comes out of the same building. :::tip[An alert isn't bad news] Getting alerts means the thing you bought is working. That customer was calling their bank either way. Before alerts, you'd have found out 30 days later, when the chargeback showed up on your statement. Now you find out while you can still fix it. ::: ## How It Works 1. Your customer contacts their bank about a charge. 2. If that bank is in the network, an alert gets routed to you. 3. You have roughly 72 hours to refund. 4. Refund, and the dispute never becomes a chargeback. 5. Ignore it, and it proceeds like any other chargeback. ### The Codes Your Answer Turns Into {/* #outcome-codes */} Your response doesn't reach the bank as a sentence. It reaches it as a code, and the code decides what happens next. | Code | What it means | |------|---------------| | **100** | Full credit processed. Case resolved | | **101** | Partial credit processed. Case resolved | | **951** | Already credited. Nothing left to refund | | anything else | You're not refunding. It goes to chargeback | REPORTED These come from Kount's implementation notes and match Pega's issuer documentation. Verifi doesn't publish the list publicly. **951 is the one to know.** It means you'd already refunded before the alert arrived. Answer anything else and you refund the same transaction twice. Check your own records first, every time, because the alert won't know what you did yesterday. **101 is the one that bites.** A partial credit can still leave the customer disputing the remainder, so a partial refund doesn't reliably close the case. ```mermaid flowchart LR A[Customer callstheir bank] --> B[Alert sentto you] B --> C{You refundwithin 72h?} C -->|Yes| D[No chargebackRatio protected] C -->|No| E[Chargeback filedRespond as normal] style D fill:#22c55e,color:#fff style E fill:#ef4444,color:#fff ``` The alert names the transaction. You issue the refund in your own processor dashboard: | Processor | Where to refund | |-----------|-----------------| | **Stripe** | Payments > the payment > Refund | | **Square** | Transactions > the transaction > Issue Refund | | **PayPal** | Activity > the transaction > Issue a refund | | **Shopify Payments** | Orders > the order > Refund | | Anyone else | Find the original sale and refund the full amount. A partial refund leaves the dispute alive | Some resellers issue the refund for you, plugged straight into your processor. Ask which setup you're getting before you sign. ## What It Covers Visa for certain. Beyond that, sources disagree, and we can't settle it. Verifi describes CDRN as card-brand agnostic. Chargebacks911 says Visa only. A third write-up says most US Visa plus one reason code each on Amex and Discover. Three answers, no primary source. So treat non-Visa coverage as unproven and make the reseller commit in writing before you pay for it. REPORTED What you actually get also depends on which banks your customers use. No vendor can promise full coverage. Here's the honest limit. An alert only fires if your customer's own bank, their issuer, is in the network. A dispute from a bank outside it arrives cold, as a chargeback, exactly like it always did. Expect a mix of both. Don't let a salesperson tell you coverage is airtight. For international volume, CDRN is the wrong tool. [Ethoca](/docs/chargebacks/prevention/ethoca-alerts) has the broader global reach. ## What It Costs Typically **$20-40 per alert** through a reseller, moving with your volume. You get billed for every alert that lands, win or lose. **You pay for the ones you'd have won.** You've got signed delivery and a solid representment case, and you refund anyway because the alert showed up. You just paid $30 to lose on purpose. **You can also pay twice for one angry customer.** CDRN and Ethoca overlap. De-duplication is your reseller catching that both networks fired on the same dispute. Run both without it and one complaint bills you twice. Most resellers de-dupe automatically. Ask anyway, in writing: *"If CDRN and Ethoca both fire on one dispute, am I billed once or twice?"* Get the answer in the contract, not on the sales call. **โ†’ Full pricing breakdown: [What Chargeback Alerts Cost](/docs/chargebacks/prevention/chargeback-alert-pricing)** ## CDRN vs RDR Both come from Verifi, and both are Visa-adjacent. That's why people mix them up. The difference is who makes the call. | | **CDRN** | **[RDR](/docs/chargebacks/prevention/visa-rdr)** | |---|---|---| | Who decides | **You**, case by case | Rules you set, fired automatically | | Your involvement | Manual, within 72 hours | None after setup | | Card brands | Visa + Discover, some MC | Visa only | | Geography | US-focused | Global | | Cost | ~$20-40/alert | ~$15-25/case | | Risk | Staff must act in time | Refunds fights you'd have won | **Pick CDRN** if somebody will actually work the queue. You keep judgment over each dispute. **Pick RDR** if nobody's opening those alerts inside 72 hours. An alert you never work is money you set on fire. Merchants get that second one wrong most often. CDRN only pays off if a human responds every day. Including the days you're slammed. If that human is you, be honest. Automation beats a queue nobody opens. ## The VAMP Catch Refunding on a CDRN alert stops the chargeback. The dispute stays off your ratio. It doesn't erase the fraud report. Say your customer told their bank the charge was fraudulent. A TC40 got filed, and TC40s still count under Visa's VAMP program. So alerts are excellent against billing confusion and service complaints. They're half a fix for fraud claims. If your ratio problem is fraud-driven, alerts won't get you out of it. You need [3D Secure](/docs/fraud/prevention/3ds) or better screening upstream. ## How to Actually Buy It You can't buy CDRN from Visa. Verifi owns the rails, but below enterprise scale you buy through a reseller. That's a middleman platform bundling CDRN, Ethoca and RDR into one dashboard and one invoice. Chargebacks911, Chargeblast and Chargeflow all do this, and some processors resell it too. See [Chargeback Vendors](/docs/chargebacks/vendors) for the wider landscape. :::note[Midigator isn't on that list any more] Midigator still gets named as a reseller. Equifax acquired it in 2022 and folded it into Kount. As of 2 August 2026, midigator.com 301-redirects to kount.com. Kount then 301-redirects to [equifax.com/business/identity-fraud/](https://www.equifax.com/business/identity-fraud/). If someone pitches you Midigator alerts, ask which Equifax entity the contract sits with. Redirect chains observed 2026-08-02. ::: Get quotes from two or three. Send all of them the same four questions. Make them answer in writing: 1. *"What's the per-alert price at my volume, and what does it drop to as volume grows?"* 2. *"Do you de-duplicate CDRN against Ethoca? If both fire on one dispute, am I billed once or twice?"* 3. *"Who issues the refund, you through a connection to my processor, or me by hand?"* 4. *"What's the minimum term, and how much notice do I give to cancel?"* Then demand three things in the contract. The per-alert price. The de-duplication answer in writing. A term you can walk away from. If a rep says "we handle that" and won't put it on paper, walk. Budget 3-7 business days from signature to your first alert. ## Where This Breaks 1. **Your customer's bank isn't in the network.** No alert fires, and the chargeback arrives with no warning. Coverage is real but partial, whatever the sales deck says. 2. **Nobody opens the queue.** An expired alert costs the fee and prevents nothing. You pay for the alert AND the chargeback. That's the most common way merchants waste money on CDRN. 3. **The dispute is real fraud.** You stop the chargeback, the TC40 stays, and your VAMP count barely moves. Fix that upstream, not here. 4. **Your product is the problem.** Customers dispute because what you sold them was bad. Alerts just make you pay for the same complaint twice. Fix the product. ## Test to Run Run it for 30 days. Log every alert: the date it landed, the date you refunded, the amount. - **Over 80% refunded inside the window:** CDRN is earning its money. Keep it. - **Under 80%:** you don't have a CDRN problem, you have a staffing problem. Move to [RDR](/docs/chargebacks/prevention/visa-rdr) and stop paying for alerts nobody opens. ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100K/mo** | Skip alerts. Fix your descriptor, turn on the free enrichment tools, make refunds easy to get. Add RDR if your ratio passes 0.5% | | **$100K-$1M/mo** | CDRN works here if you're US-focused and one named person owns the queue daily. Otherwise RDR | | **Over $1M/mo** | CDRN plus Ethoca through one reseller, de-duplicated. Queue coverage is somebody's actual job | | **Ratio above 0.9%** | Start the paperwork today. Relief lands next month, not this one. See [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) | ## Next Steps 1. [Check your ratio](/docs/chargebacks/metrics) and find out whether you need alerts at all. 2. [Fix your descriptor](/docs/chargebacks/prevention/descriptors-and-comms) first if you haven't. It's free. "I don't recognize this charge" is the most common dispute you can prevent. 3. [Compare all three services](/docs/chargebacks/prevention/alerts) before you buy. 4. [Setup Dispute Alerts playbook](/docs/playbooks/setup-dispute-alerts) for the implementation steps. ## See Also - [Chargeback Alerts Compared](/docs/chargebacks/prevention/alerts) - RDR vs CDRN vs Ethoca - [Ethoca Alerts](/docs/chargebacks/prevention/ethoca-alerts) - the global alternative - [What Is a Chargeback?](/docs/chargebacks) - the fundamentals - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP and ECM thresholds - [Chargeback Vendors](/docs/chargebacks/vendors) - resellers and platforms {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What does CDRN stand for?","acceptedAnswer":{"@type":"Answer","text":"CDRN stands for Cardholder Dispute Resolution Network. It is an alert service operated by Verifi, which is owned by Visa. When a cardholder contacts their bank to dispute a charge and that bank participates in the network, CDRN notifies the merchant, who then has roughly 72 hours to refund voluntarily and avoid a chargeback."}},{"@type":"Question","name":"How much do CDRN alerts cost?","acceptedAnswer":{"@type":"Answer","text":"CDRN alerts typically cost $20-40 per alert through a reseller, varying by provider and volume. You are billed per alert received rather than per chargeback prevented, which means you also pay for alerts on disputes you might have won through representment."}},{"@type":"Question","name":"What is the difference between CDRN and RDR?","acceptedAnswer":{"@type":"Answer","text":"CDRN sends you an alert and you decide case by case whether to refund, within about 72 hours. RDR is fully automatic: you set rules once and qualifying Visa disputes are auto-refunded with no manual action and no discretion. CDRN covers Visa and Discover with some Mastercard and is US-focused; RDR is Visa-only but works globally. CDRN only helps if someone actually works the alert queue."}},{"@type":"Question","name":"How long do I have to respond to a CDRN alert?","acceptedAnswer":{"@type":"Answer","text":"Approximately 72 hours. If you refund the customer within that window, no chargeback is filed and the dispute does not count toward your chargeback ratio. If you miss the window, the dispute proceeds as a normal chargeback and you respond with evidence as usual."}},{"@type":"Question","name":"Can I be charged twice for the same dispute with CDRN and Ethoca?","acceptedAnswer":{"@type":"Answer","text":"Yes, if the services are not de-duplicated. CDRN and Ethoca coverage overlaps, so a single dispute can generate an alert from both networks and two billable charges. Most resellers de-duplicate automatically, but confirm this is included before signing a contract."}}]})} --- ## Visa RDR: Automatic Refunds, Run by Verifi Source: https://paymentsandrisk.com/docs/chargebacks/prevention/visa-rdr # Visa RDR: Automatic Refunds, Run by Verifi :::info[TL;DR] - **Visa only.** It does nothing for Mastercard, Amex, or Discover. - **Nobody has to do anything.** You write the rules once. Matching disputes settle themselves. - **Roughly $15-25 per case.** You buy it through a reseller, not from Visa. Activation runs 3-7 business days. - **The dispute stays off your chargeback ratio.** But a fraud report (TC40) still counts under VAMP. - **It refunds fights you'd have won.** That's the real cost, not the per-case fee. - **Under $50K/month, don't.** Fix your billing descriptor first. It's free. ::: Your Visa disputes are adding up. Somebody pitched you RDR as the one where nobody lifts a finger. That part's true. You write the rules once. Then a Visa cardholder disputes a charge that matches, and Visa refunds them out of your account. No chargeback gets filed. You don't get a call. You don't review it. It just happens. That's the whole point. It's also the whole problem. RDR never asks whether you'd have won. ## How It Actually Works 1. You write the rules. Example: *auto-refund every Visa dispute under $50.* 2. A Visa cardholder calls their bank to dispute a charge. 3. Before any chargeback gets filed, Visa checks your RDR rules. 4. If it matches, your account gets debited and your customer gets refunded. 5. No chargeback, so nothing touches your chargeback ratio. ```mermaid flowchart LR A[Cardholderdisputes charge] --> B{Matches yourRDR rules?} B -->|Yes| C[Auto-refundNo chargeback filed] B -->|No| D[Normal chargebackYou respond as usual] style C fill:#22c55e,color:#fff style D fill:#ef4444,color:#fff ``` The money leaves your account either way. RDR isn't insurance, and you get nothing back. You're choosing to lose the small ones fast and quiet, instead of slow and expensive. ## What It Costs Usually **low-teens to mid-$20s per case**. It's priced per resolved dispute, and you buy it through a reseller, not direct from Visa. A chargeback drags out more. You lose the sale, up to $30 in processor fees, staff time, and ratio damage. The fee is the small part. If the dispute was heading for a chargeback anyway, RDR wins on the sale and the staff time alone. The problem is the disputes that cost you nothing. ## Before You Buy, Pull Your Own Numbers Twenty minutes in your dashboard beats any vendor deck. You want two numbers: how many Visa disputes you got in the last 90 days, and how many of those were winnable. | Processor | Where to look | |-----------|---------------| | **Stripe** | Payments > Disputes, then filter to Visa | | **Square** | Transactions > Disputes | | **PayPal** | Resolution Center | | **Shopify Payments** | Orders > the order > Chargebacks | | **Braintree** | Control Panel > Disputes | | Anyone else | Search your dashboard for "Disputes," or call support and ask | Go through them one at a time and mark each one *would have won* or *would have lost*. Tracking number, signed delivery, login records, earlier orders from the same customer? That's a win. An empty file is a loss. Mostly losses? RDR buys back the hours you burn losing those fights. Mostly wins? Then RDR is a fee for giving away money you were keeping. ## When RDR Quietly Wastes Money Your reseller won't bring this up on the call, so here it is. RDR refunds on rule match. It has no idea whether you had tracking, a signed delivery, or a solid representment case. Say your rule refunds everything under $50. If half of those were winnable, you paid a fee to hand back money you'd have kept. Run the math before you switch it on: - 10 disputes a month ร— $15 per case = **$150/month**. - If half were winnable, you just paid $150 to hand back 5 wins. At 10 disputes a month, that's a bad trade. At 100 it isn't. **Rule of thumb:** turn it on when your ratio's above 0.5%. Or when you're big enough that peace of mind beats the handful you'd have won. :::tip[If you're under $50K/month] Don't start here. Fix your [billing descriptor](/docs/chargebacks/prevention/descriptors-and-comms) first. It's free. "I don't recognize this charge" is the most common dispute you can actually prevent. Buy alerts and RDR after you run out of free fixes. ::: :::tip[Don't panic-buy] Your ratio ticked up for one month? You've got room to think. Activation runs 3-7 business days anyway. Nothing you sign today rescues this week. Spend those days on the free fixes and on pulling your dispute history. One bad month is a data point, not a network problem. ::: ## How to Actually Buy It You don't buy RDR from Visa. You buy it through a reseller, a middleman that packages the network dispute tools into one login and one invoice. Start with your own processor and ask whether they already have a partner. Then get one or two outside quotes, so you can see the real price. Send all of them the same four questions by email, so the answers land in writing: - *"What's the per-case price at my volume, and what happens to it if my volume drops?"* - *"Do you de-dupe RDR against CDRN and Ethoca? If two services fire on the same dispute, am I billed once or twice?"* - *"Who configures my rules, you or me, and how fast can I change a threshold?"* - *"What's the minimum term, and what does it cost me to leave?"* De-duplication catches it when two services fire on the same angry customer. One dispute bills you once, not twice. Ask for it by name. **Get these in the contract, not on the sales call:** - The de-duplication answer, in writing. - Your per-case price, and whether it moves with volume. - The shortest term you can negotiate. - Who eats the fee when a case gets double-billed anyway. If the answers go vague, walk. They're all reselling the same Visa product. Once you sign, activation runs 3-7 business days. This is a next-week lever, not a today lever. ## Tuning Your Rules Once RDR is running, check the acceptance rate monthly. It tells you whether your rules are the right shape. | What you see | What it means | What to do | |---|---|---| | Acceptance under 60% | Rules too tight | You're missing preventable chargebacks. Widen them. | | Acceptance 70-90% | Healthy | Leave it alone. | | Acceptance over 95% | Rules too broad | You're refunding winnable disputes. Tighten them. | | High-value auto-refunds | Threshold set too high | Move $100+ disputes to manual review. | Also track **RDR false positives**. Those are cases you auto-refunded and would have won. If that number climbs, tighten the dollar threshold first. ## The VAMP Catch RDR keeps the dispute off your ratio. It **doesn't** erase a fraud report. Under VAMP, the count that matters combines fraud reports (TC40s) with non-fraud disputes. RDR removes the dispute side only. Say your customer told their bank the charge was fraud. The TC40 sticks and still counts against you. | Dispute type | Does RDR help? | |---|---| | Billing confusion, unrecognized charge | **Yes.** Very effective. | | Service or delivery complaint | **Yes.** Dispute never posts. | | Customer claims fraud | **Partly.** Chargeback avoided, TC40 still counts. | So if fraud claims drive your ratio, RDR alone won't fix it. You need upstream prevention like [3DS](/docs/fraud/prevention/3ds) or [risk scoring](/docs/fraud/prevention/risk-scoring), to stop the TC40 from getting written at all. ## RDR vs the Alternatives RDR only covers Visa, so most merchants pair it with something else. | | **RDR** | [CDRN](/docs/chargebacks/prevention/verifi-cdrn) | [Ethoca](/docs/chargebacks/prevention/ethoca-alerts) | |---|---|---|---| | Card brands | Visa only | Visa + Discover, some MC | Mastercard-heavy, some others | | Who acts | Nobody | You, within 72 hours | You, within 24-72 hours | | Geography | Global | US-focused | Global | | Cost | ~$15-25/case | ~$20-40/alert | ~$20-40/alert | | You keep discretion | **No** | Yes | Yes | **โ†’ Full head-to-head: [Chargeback Alerts Compared](/docs/chargebacks/prevention/alerts)** ## Where This Breaks 1. **Fraud claims are your actual problem.** RDR kills the chargeback and leaves the TC40 standing, so your VAMP count barely moves. Fix it upstream or don't bother. 2. **Most of your volume isn't Visa.** Amex and Discover disputes land cold, and so does most Mastercard. RDR does nothing for any of them. 3. **You set the rules once and never look again.** A $50 threshold fit last year. This year it quietly refunds a growing pile of winnable cases. Check acceptance every month, or it quietly drifts on you. ## Test to Run **Two 30-day windows:** 1. Before you switch anything on, tag your last 30 days of Visa disputes. *Would have won* or *would have lost*, using the dashboard path above. Write the counts down. 2. Turn RDR on conservatively. Auto-refund below $25 only, and everything above it stays manual. 3. After 30 days, pull the cases RDR auto-refunded and tag them the same way. **Success looks like:** your Visa chargeback count drops by more than the RDR fees cost you, and the *would have won* pile stays small. If it doesn't, drop the threshold before you widen it. ## Scale Callout | Volume | Focus | |--------|-------| | **Under $50K/mo** | Skip RDR. Descriptor, refund path, order confirmation emails. All free, all worth more at this size. | | **$50K-$500K/mo** | Worth buying once your ratio goes over 0.5%. Start with a low threshold and check acceptance monthly. | | **Over $500K/mo** | RDR on Visa, alerts on everything else. At this volume, never thinking about Visa disputes is worth more than the handful you were going to win. | ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **RDR acceptance rate** | Are your rules the right shape? | 70-90% | | **Auto-refunds that were winnable** | Are you paying to lose on purpose? | Trending down | | **Cost per prevented chargeback** | Is this still cheaper than the chargeback? | Below your all-in chargeback cost | | **TC40 count** | Is fraud driving your ratio behind RDR's back? | Trending down | | **Visa share of your disputes** | Is RDR even aimed at your problem? | If Visa is a minority, RDR isn't your fix | ## Next Steps 1. [Check your chargeback ratio](/docs/chargebacks/metrics). RDR starts paying off above the 0.5% line. 2. [Fix your descriptor first](/docs/chargebacks/prevention/descriptors-and-comms) if you haven't already. 3. [Setup Dispute Alerts playbook](/docs/playbooks/setup-dispute-alerts) for step-by-step implementation. 4. [Compare alert pricing](/docs/chargebacks/prevention/chargeback-alert-pricing) across services and resellers. ## See Also - [Chargeback Alerts Compared](/docs/chargebacks/prevention/alerts) - RDR vs CDRN vs Ethoca - [What Is a Chargeback?](/docs/chargebacks) - the fundamentals - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP and ECM thresholds - [Representment](/docs/chargebacks/representment) - fighting disputes instead of refunding them - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - if your ratio is already in crisis {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What is RDR in chargebacks?","acceptedAnswer":{"@type":"Answer","text":"RDR stands for Rapid Dispute Resolution. It is Visa's automated pre-dispute service: you configure rules, and when a Visa cardholder disputes a charge that matches those rules, Visa refunds the cardholder from your account automatically and no chargeback is filed. The dispute never hits your chargeback ratio. It requires no manual action from you."}},{"@type":"Question","name":"How much does Visa RDR cost?","acceptedAnswer":{"@type":"Answer","text":"RDR is typically priced per resolved case, generally in the range of $15-25, and is usually purchased through a reseller rather than directly from Visa. Exact pricing varies by provider and transaction volume. This compares to a chargeback costing $0 to $30 in processor fees, typically $15, plus the transaction amount plus ratio damage. The fee is the smallest part; the sale and the staff time are what make RDR worth buying."}},{"@type":"Question","name":"What is the difference between RDR and CDRN?","acceptedAnswer":{"@type":"Answer","text":"RDR is Visa-only and fully automatic: qualifying disputes are auto-refunded based on rules you set, with no manual action and no discretion. CDRN sends you an alert and gives you 72 hours to decide whether to refund, so you keep control over each case. CDRN also covers more card brands but is US-focused, while RDR works globally on Visa transactions only."}},{"@type":"Question","name":"Does RDR stop fraud reports counting against VAMP?","acceptedAnswer":{"@type":"Answer","text":"No. RDR prevents the chargeback from being filed, so the dispute does not count toward your ratio. But if the cardholder claimed the transaction was fraudulent, the TC40 fraud report is still generated and still counts under Visa's VAMP program. For fraud-driven ratio problems you need upstream prevention such as 3D Secure or risk scoring, not alerts."}},{"@type":"Question","name":"Is RDR worth it for a small business?","acceptedAnswer":{"@type":"Answer","text":"Often not at first. RDR auto-refunds disputes without checking whether you would have won them, so at low volume you may pay per-case fees to give back money you would have kept. Below roughly $50K per month with a chargeback ratio under 0.5%, fixing your billing descriptor is free and prevents more disputes. RDR generally makes sense once your ratio exceeds 0.5% or your volume makes the operational simplicity worth the lost win rate."}}]})} --- ## What to Do When Your Processor Sends a Warning Source: https://paymentsandrisk.com/docs/chargebacks/processor-warnings # What to Do When Your Processor Sends a Warning :::info[TL;DR] - A warning email doesn't mean your account is closed. It means you're approaching or have crossed a threshold. - Your **first action** is to find out exactly which threshold you crossed (chargeback ratio, fraud ratio, or both) and by how much. - On VAMP, grace covers **program months 1, 2 and 3**. Fees start in program month 4. Count from the identification notice, not from the month you breached. Use the window to cut disputes hard. - The playbook: identify root cause, fix the biggest leak first, document everything for your processor. ::: You opened an email from your processor and your stomach dropped. Words like "monitoring program," "excessive chargebacks," "remediation required," or "account review" stare back at you. Take a breath. This email is the warning shot, not the outcome, and most merchants who get one never see a fine. ## Types of Processor Warnings Not all warning emails are equal. Here's what each type means: | Warning Type | Severity | What It Means | Time to Act | |--------------|----------|---------------|-------------| | **Friendly heads-up** | Low | Your ratio is trending up but not yet at threshold | Weeks to months | | **Early warning notification** | Medium | You've hit an early warning threshold (~0.65%) | 1-2 months before escalation | | **Monitoring program entry** | High | You've crossed a processor or network threshold (~0.9% at most processors; MC ECM needs 100-299 disputes **and** 1.50-2.99%) | Fines start in 1-4 months | | **Remediation required** | High | You must submit a plan to reduce disputes | Days to weeks | | **Account review / potential termination** | Critical | Your account may be closed | Immediate | ## Step 1: Find the Numbers Before you do anything else, find out exactly where you stand. Log into your processor dashboard or call your account manager and get these numbers: | What to Find | Why | |--------------|-----| | **Your current chargeback ratio** | Visa VAMP treats a merchant as excessive at 1.5% (2.2% in CEMEA). Mastercard ECM starts at 1.50%. Your processor's house limit sits lower than both, often around 0.9% | | **Your current dispute count** | Every one of these programs needs a count as well as a ratio. VAMP has a floor of 1,500 combined fraud reports and disputes in the month; ECM needs 100 to 299 chargebacks, and 300 or more moves you to HECM. Under the count, the ratio alone can't put you in the program | | **Which months triggered the warning** | Is this a one-month spike or a trend? | | **Which network program you're in** | VAMP? Mastercard ECM? Both? Or just your processor's internal watchlist, which isn't a network program and carries no network fine | | **Your current month in the program** | The month number decides whether you owe money yet. See the timeline in Step 2 | When you recalculate the ratio yourself, watch the denominator, because the two networks don't use the same one. Mastercard divides this month's chargebacks by **last month's** transaction count. Visa uses the same calendar month for both. If your volume is growing fast, your Mastercard ratio will read higher than your Visa ratio on identical data, and that gap is arithmetic rather than a new problem. :::caution[Ask your acquirer for the numbers in your agreement] Neither Visa nor Mastercard publishes its monitoring thresholds, fine schedules or exit criteria. Every figure on this page reached the public through acquirers passing on notices, and acquirers apply stricter house limits on top. The only thresholds that can actually cost you money are the ones your own acquirer is measuring you against, so ask them in writing. ::: See [Network Programs Reference](/docs/chargebacks/reference/network-programs) for the full threshold tables and fee schedules. ## Step 2: Understand the Timeline You have more time than the email makes it feel like. **Visa VAMP:** | Month | What Happens | |-------|-------------| | 1-3 | Grace period on first identification. No fees yet. This is your window to fix things. | | 4+ | Per-dispute fees begin: USD 8 per CNP dispute once you're at merchant excessive. The USD 4 rate is an acquirer-portfolio charge, not a merchant tier, so whether any of it reaches you depends on your acquirer's own status. At high dispute volumes this adds up fast. | | Persistent | Termination risk. | Two things about those VAMP figures. Visa bills them to your **acquirer**, not to you, and your acquirer decides how much to pass through, so ask yours what they charge. And the $4/$8 numbers come from Checkout.com's merchant notice of 12 June 2026, not from Visa. Visa's own VAMP fact sheet carries no fee figures at all, so treat any page that cites Visa for these numbers with suspicion. **Mastercard ECM:** | Month | What Happens | |-------|-------------| | 1 | Warning. No fines yet. | | 2-3 | $1,000/month. | | 4-6 | $5,000/month. | | 7-11 | $25,000/month. | | 12+ | $50,000-$100,000/month and escalating. | Remember that ECM needs 100-299 disputes **and** a 1.50-2.99% ratio in the same month. Clear either one and you're out of the program. Above 300 disputes and 3.00% you're in HECM instead, where the schedule escalates faster. **To exit:** get below the count threshold, the ratio threshold, or both, and hold it. Acquirers commonly ask for three consecutive clean months before they stop treating you as a monitored merchant, but the exit rule is unpublished and yours may differ. Ask your acquirer to put its exit criteria in writing at the same time you ask for your monthly numbers. ## Step 3: Find the Root Cause Pull your last 30 chargebacks. Categorize each one: | Category | What It Looks Like | Likely Fix | |----------|-------------------|------------| | **"I don't recognize this"** | Reason code 10.4, no customer contact first | Fix your billing descriptor ([Descriptors](/docs/chargebacks/prevention/descriptors-and-comms)) | | **"I cancelled"** | Reason code 13.2, subscription disputes | Make cancellation easier ([Refund Policy](/docs/chargebacks/refund-policy#making-cancellation-easy)) | | **"Never received"** | Reason code 13.1 | Add tracking and delivery confirmation | | **Actual fraud** | Reason code 10.4, different name/address | Enable 3DS ([3D Secure](/docs/fraud/prevention/3ds)) | | **Friendly fraud** | Reason code 10.4, but customer used the product | Collect device/IP evidence for CE 3.0 ([Compelling Evidence](/docs/chargebacks/representment/compelling-evidence)) | If one category makes up more than 40% of your chargebacks, fix that one thing first. ## Step 4: Take Immediate Action **This week:** - [ ] Sign up for [chargeback alerts](/docs/chargebacks/prevention/alerts) (Ethoca, Verifi CDRN, or RDR). These let you resolve disputes before they become chargebacks. - [ ] Refund any pending customer complaints that could become disputes. A refund costs 3%; a chargeback costs $50+. - [ ] Check your billing descriptor. If it doesn't clearly show your business name, fix it today. **This month:** - [ ] Enable 3D Secure if you haven't already. It shifts fraud liability to the issuer. - [ ] Make cancellation self-service (no phone-only cancellation). - [ ] Reduce refund processing time to same-day or next-day. **Ongoing:** - [ ] Track your chargeback ratio weekly, not monthly. You need to see the trend moving down. - [ ] Follow the [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) playbook for the full crisis response. ## Step 5: Talk to Your Processor Your processor isn't your enemy here. They don't want to terminate you (they make money from your transactions). But they need to see that you're taking action. **What to tell them:** 1. You're aware of the issue 2. You've identified the root cause (be specific: "42% of our disputes are descriptor confusion") 3. Here's what you've already done (alerts signed up, descriptor fixed, 3DS enabled) 4. Here's your plan for the next 30/60/90 days 5. Ask: "What specifically do you need from me to stay in good standing?" **What to ask them:** - Can they share your exact ratio by month for the last 6 months? - Are they reporting both Visa and Mastercard ratios, or just one? - Do they have any additional tools or programs that could help (some processors offer fraud tools or alert programs)? - What's their termination threshold, and how close are you? ## Communication Templates ### Phone Script: First Call After Warning Use this when calling your processor's risk team: > "Hi, I'm [your name] with [business name], merchant ID [your MID]. I received an email about [chargeback monitoring / account review / excessive disputes]. I want to understand exactly where I stand and share what I'm doing about it. > > Can you tell me: > 1. My exact chargeback ratio for the last 3 months? > 2. Which network program I've been placed in, and what month I'm in? > 3. What specific metrics I need to hit, and by when, to exit the program? > > Here's what I've already done: [list 2-3 actions, e.g. alerts signed up, descriptor fixed, refund policy updated]. I'm putting together a full remediation plan. What format do you need that in, and who should I send it to?" ### Email Template: Remediation Plan Send this within 48 hours of the warning: > **Subject:** Remediation Plan - [Business Name] - [MID] > > [Processor Risk Team], > > Thank you for notifying us about our chargeback ratio. We take this seriously and have already begun remediation. > > **Current situation:** Our ratio reached [X%] in [month], driven primarily by [root cause, e.g. "descriptor confusion" or "subscription cancellation disputes"]. > > **Actions already taken (this week):** > - Enrolled in [Verifi RDR / Ethoca alerts / CDRN] for pre-dispute resolution > - Updated billing descriptor from "[old]" to "[new]" > - Authorized support team to issue same-day refunds for billing inquiries > > **30-day plan:** > - [Specific action 1, e.g., "Enable 3DS on all transactions over $50"] > - [Specific action 2, e.g., "Add cancellation self-service to customer portal"] > - [Specific action 3, e.g., "Send renewal reminder emails 7 days before charge"] > > **Target:** Reduce ratio to below [X%] within [60/90] days. > > We will send weekly updates on our progress. Please let us know if you need anything additional. > > Best regards, > [Your name] ### Email Template: Weekly Progress Update > **Subject:** Chargeback Remediation Update - Week [#] - [Business Name] > > [Processor contact name], > > Quick update on our progress: > > - **This week's ratio:** [X%] (down from [Y%] last week) > - **Disputes received:** [#] (down from [#] last week) > - **Alerts resolved:** [#] via RDR/Ethoca > - **Actions completed this week:** [1-2 bullet points] > > On track to be below [target]% by [date]. > > Best, > [Your name] :::tip[Why Written Updates Matter] Processors handle thousands of merchants. A weekly email creates a paper trail showing you're actively fixing the problem. If your account ever goes to a termination review, this documentation can save you. ::: ## What If Your Account Gets Terminated If your processor terminates your account: 1. **Don't panic about MATCH.** Not all terminations result in MATCH listing. Ask your processor directly: "Will I be placed on MATCH?" If the answer is yes, see [MATCH/TMF](/docs/chargebacks/match-tmf). 2. **Find a new processor immediately.** Some processors specialize in higher-risk merchants. You'll pay higher fees, but you can keep processing. 3. **Fix the underlying problem first.** A new processor won't help if you bring the same chargeback problem with you. ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100K/month** | Alert services may cost more than they save at low volume. Focus on descriptor fixes and refund policy instead. | | **$100K-$500K/month** | Alert services are cost-effective. Enable 3DS. Consider a chargeback management vendor. | | **Over $500K/month** | Full alert coverage (Ethoca + Verifi + RDR). Dedicated dispute management. Weekly ratio monitoring. | --- ## Next Steps **Just got the email?** 1. [Find your numbers](#step-1-find-the-numbers) - Know exactly where you stand 2. [Check the timeline](#step-2-understand-the-timeline) - How much time you have 3. [Find your root cause](#step-3-find-the-root-cause) - What's driving the chargebacks **Building your response plan?** 1. [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Full crisis playbook 2. [Set up alerts](/docs/chargebacks/prevention/alerts) - Resolve before chargeback 3. [Fix descriptors](/docs/chargebacks/prevention/descriptors-and-comms) - Stop "I don't recognize" disputes **Understanding the programs?** 1. [Network Programs Reference](/docs/chargebacks/reference/network-programs) - Full threshold tables 2. [Chargeback Metrics](/docs/chargebacks/metrics) - Track your ratio 3. [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response framework --- ## Related Pages - [Network Programs Reference](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds and fees - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis response playbook - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency actions - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention strategies - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution - [MATCH/TMF](/docs/chargebacks/match-tmf) - Blacklist implications - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund vs. fight - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift authentication - [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms) - Fix billing confusion --- ## How to Read a Chargeback Notification Source: https://paymentsandrisk.com/docs/chargebacks/reading-a-chargeback-notification # How to Read a Chargeback Notification :::info[TL;DR] - Your chargeback notification contains the **reason code**, **amount**, **deadline**, and **ARN** you need to respond - The reason code tells you **what the customer claimed** and **what evidence you need** - Your response deadline is the most time-sensitive field: miss it and you lose automatically - Most processors show this in a dashboard, not a paper letter ::: You just got a chargeback notification. It might be an email from your processor, a dashboard alert, or a letter. Whatever the format, it contains the same core information. Here's what each field means and what to do with it. ## First 24 Hours: What to Do Right Now ### Hour 1: Don't Panic, Get Oriented - [ ] Log into your processor dashboard and find the disputed transaction - [ ] Note the response deadline (write it on your calendar minus 3 days for safety) - [ ] Read the reason code. It tells you exactly what the customer claims happened ### Hours 1-4: Assess the Situation - [ ] Was the customer right? (Did you fail to deliver, ship wrong item, ignore refund request?) - [ ] If yes: Accept the chargeback, fix the process, move on - [ ] If no: Continue to evidence gathering ### Hours 4-24: Gather What You Have - [ ] Pull the order confirmation, shipping tracking, and any customer communications - [ ] Check if this customer has prior successful orders (helps prove legitimacy) - [ ] If you don't have evidence (no tracking, no logs, no communications): Consider accepting. Fighting without proof wastes time and still loses ### The Refund-or-Fight Decision - **Under $25 with no evidence?** Accept it. The time cost exceeds the loss. - **$25-$100 with some evidence?** Evaluate whether your evidence directly addresses the reason code. - **Over $100 with strong evidence?** Fight it. See [Responding to a Dispute](/docs/learning-pathways/handling-your-first-chargeback/responding-to-a-dispute). :::info[Deadlines Are Real, But You Have Time] You have 20-45 days to respond (varies by network). The deadline is real. Miss it and you auto-lose. But you don't need to rush your response in 24 hours. Use this time to gather evidence methodically. ::: ## What a Notification Looks Like Every processor formats notifications differently, but they all include the same core fields. Here's what you'll see: | Field | What It Means | Why It Matters | |-------|---------------|----------------| | **Case/Reference Number** | Your processor's internal ID for this dispute | Use this when contacting support or submitting evidence | | **ARN (Acquirer Reference Number)** | 23-digit number identifying the original transaction | Links the dispute to the specific transaction in your processor's system | | **Transaction Date** | When the original charge was made | Helps you find the order in your records | | **Transaction Amount** | How much was charged | May differ from dispute amount if partial | | **Dispute Amount** | How much the customer is disputing | Sometimes less than the full transaction | | **Reason Code** | Why the customer says they're disputing | Determines what evidence you need (most important field) | | **Response Deadline** | When your evidence must be submitted | Miss this and you lose automatically | | **Card Number (last 4)** | Partial card number for identification | Match to the transaction in your system | | **Cardholder Name** | Name on the card | Match to customer records | ## The Five Fields That Matter Most ### 1. Reason Code It's the most important field on the notice. It tells you what the customer claimed, and that tells you what evidence you need. | Code Pattern | What It Means | Your Response | |--------------|---------------|---------------| | **Visa 10.x** | Fraud (customer says they didn't make the purchase) | Device data, 3DS proof, delivery confirmation | | **Visa 13.1** | Not received | Tracking, delivery confirmation, signature | | **Visa 13.2** | Cancelled recurring | Cancellation policy, usage after cancel date | | **Visa 13.3** | Not as described | Product listing, photos, correspondence | | **MC 4837** | Fraud | Similar to Visa 10.x | | **MC 4853** | Service/goods dispute | Depends on sub-reason | Full lookup: [Reason Code Reference](/docs/reference/reason-codes) ### 2. Response Deadline This is your drop-dead date. If you miss it, you lose the dispute automatically regardless of evidence. | Network | Representment Window | Documentation Deadline | Notes | |---------|---------------------|----------------------|-------| | **Visa** | 30 calendar days | 18 calendar days | From chargeback date | | **Mastercard** | 45 calendar days | 8 calendar days | From Central Site Business Date | | **Amex** | 20 calendar days | 10 calendar days | From notification date | :::warning[Two Different Deadlines] Each network has both a **representment window** (how long to file your response) and a shorter **documentation deadline** (how long to submit supporting evidence). Your processor can impose deadlines shorter than the network maximum, so don't work off the network number. Use the shortest deadline on your notification. ::: See [Time Frames Reference](/docs/reference/time-frames) for the full breakdown. **What to do:** check this field first. If the deadline is tomorrow, you're gathering evidence right now. If you've got two weeks, take a day to investigate first. ### 3. Dispute Amount The dispute amount might not match the original transaction. Customers can dispute part of an order, one item out of several. Check which it is, because it changes what you're arguing. ### 4. ARN The Acquirer Reference Number links everything together. Use it to: - Find the original transaction in your processor's dashboard - Pull up the order details in your system - Reference the specific transaction when submitting evidence ### 5. Reason Code Description Most processors put a plain-English description next to the numeric code. Read it carefully, because that's the claim in the cardholder's own words. ## Where to Find Your Notification | Processor | Where to Look | |-----------|---------------| | **Stripe** | Dashboard > Payments > Disputes (also email alert) | | **Square** | Dashboard > Transactions > Disputes | | **PayPal** | Resolution Center | | **Braintree** | Control Panel > Disputes | | **Adyen** | Customer Area > Disputes | | **Shopify Payments** | Orders > disputed order (also email alert) | Most processors send an email alert when a chargeback arrives. Don't rely solely on email; check your dashboard regularly. ## What to Do First When you receive a chargeback notification: 1. **Note the deadline.** Put it in your calendar. Working backward, give yourself at least 3 days before the deadline to assemble evidence. 2. **Look up the reason code.** Check the [Reason Code Reference](/docs/reference/reason-codes) for what evidence defeats this specific claim. 3. **Pull the original transaction.** Find the order in your system. Pull up customer name, order details, shipping info, and any communication. 4. **Decide: fight or accept.** Use the [Refund Strategy](/docs/chargebacks/refund-strategy) framework. Under $25 with no evidence? Accept it. Over $100 with delivery confirmation? Fight it. 5. **Gather evidence.** Match evidence to the reason code. See [Evidence Checklists](/docs/chargebacks/representment/compelling-evidence) for what each network requires. 6. **Submit your response.** Through your processor's dashboard, not by email or phone. See [Representment](/docs/chargebacks/representment) for the full process. ## Common Confusion **"I got two notifications for the same transaction."** This can happen if the dispute moves through stages (inquiry, then chargeback). Check the case numbers; if they're different, it may be two separate actions on the same transaction. **"The reason code doesn't match what happened."** Issuers sometimes miscategorize disputes. The customer might say "fraud" when they really mean "I don't recognize this charge." You still need to respond to the stated reason code with evidence that addresses that specific claim. **"The amount is wrong."** The dispute amount may include or exclude tax, shipping, or tips depending on how the issuer processed it. What matters is whether the core transaction amount is right, so don't argue the cents. **"I already refunded this customer."** If the refund went out before the chargeback arrived, pull the proof (date, amount, ARN of the credit) and submit it. That's a strong defense. --- ## Next Steps **Just got a notification?** 1. [Look up your reason code](/docs/reference/reason-codes) - Know what you're fighting 2. [Check the deadline](/docs/reference/time-frames) - Don't miss it 3. [Decide to fight or accept](/docs/chargebacks/refund-strategy) - Make it a math decision **Ready to respond?** 1. [Build your evidence package](/docs/chargebacks/representment/compelling-evidence) - Match evidence to reason code 2. [Submit representment](/docs/chargebacks/representment) - Step-by-step process 3. [Understand the lifecycle](/docs/chargebacks/lifecycle) - What happens after you respond --- ## Related Pages - [Your First Chargeback](/docs/chargebacks/your-first-chargeback) - New to chargebacks - [Reason Code Reference](/docs/reference/reason-codes) - What each code means - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Evidence Checklists](/docs/chargebacks/representment/compelling-evidence) - What to submit - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to fight vs. accept - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute process --- ## Mastercard GMAP: Suspended Since 2020, Reported Back for 2027 Source: https://paymentsandrisk.com/docs/chargebacks/reference/gmap # Mastercard GMAP: Suspended Since 2020, Reported Back for 2027 :::info[TL;DR] - **Two different programs share the GMAP acronym**, about seven years apart. Which one someone means changes the whole answer. - **The original is suspended.** Mastercard's Security Rules and Procedures, Merchant Edition, 3 February 2026 gives section 8.2 one sentence and nothing else. Suspended since 15 October 2020. It never carried fines even when it ran. - **A second, different GMAP is reported for 1 April 2027.** Fraud plus disputes, fine ladders, acquirers included. Three industry sources reported it at the end of July 2026. None could cite a bulletin number. Neither can anyone quoting an ECM or HECM figure REPORTED. - **Right now, in between the two, GMAP measures nothing.** No merchant has been assessed under it since October 2020. - **Reason code 4849 is a QMAP code, not a GMAP code.** Kount, Justt and Chargeback.io all still label it GMAP on live pages. All three are wrong. - **What you're actually measured against today**: ECM and HECM for chargebacks, EFM for fraud, VAMP on Visa, and SMMP if you sell card-not-present. ::: Search GMAP today and you land on acquirer PDFs from 2019. An orphaned Mastercard eLearning module. Three vendors' reason-code libraries calling 4849 "the GMAP chargeback." Every one of them presents a suspended program as if it's running. Nobody publishes the correction, so here it is. For the live programs, see [Network Programs Reference](/docs/chargebacks/reference/network-programs). --- ## The direct answer GMAP stands for Global Merchant Audit Program. **Two different Mastercard programs have carried that name.** Seen GMAP described as both dead and coming? That's why. Both statements are true. Different programs, different years. | | The original GMAP | The reported 2027 GMAP | |---|---|---| | **Status** | Suspended 15 October 2020. Still suspended in the 3 February 2026 rules | Reported for 1 April 2027 REPORTED | | **Measures** | Fraud only, as a share of sales | Fraud reports plus non-fraud disputes, combined | | **Applies to** | Merchant locations | Merchants and acquirers | | **Consequences** | A fraud alert and training. No fines, ever | Fine ladders reported into six figures | | **Verified?** | Yes, in Mastercard's own rulebook | No. No bulletin number exists in any source we found | They share an acronym and nothing else. A fraud-only program with no fines isn't the same thing as a combined fraud-and-dispute program with a fine ladder. The likeliest reading is that Mastercard is reusing a shelved name, not restarting the old program. We can't prove that. The February 2027 rulebook settles it either way. **In the meantime, and that means right now, GMAP measures nothing.** The gap between 15 October 2020 and 1 April 2027 is where you're sitting. The original program comes first here. It's what generates the stale material people land on. [Skip to the 2027 program](#the-reported-2027-gmap) if that's what you came for. ### The original program It was a Mastercard **fraud** program. It isn't running. Mastercard's Security Rules and Procedures, Merchant Edition, dated **3 February 2026**, cuts section 8.2 to one sentence. > The Global Merchant Audit Program (GMAP) has been suspended until further notice. That's the entire section. No tiers, no thresholds, no dates. The 2021 and 2022 editions carried the same suspension with a date attached: **effective 15 October 2020**. Across seven editions in the Wayback Machine's index, the wording never quietly changed back. :::tip[If something told you GMAP applies to you, it doesn't] No merchant has been measured against GMAP since October 2020. A compliance checklist, an onboarding pack, a reason-code lookup, a vendor deck: if it put GMAP in front of you, it's stale. That's not a judgment about your account. It's a judgment about the document. Skip to [what actually applies](#what-actually-applies-to-you-right-now). ::: --- ## What GMAP was (history, not a live threshold) _Historical only. Effective 15 October 2020, suspended until further notice. These aren't thresholds anyone is measured against today._ GMAP watched fraud, not chargebacks. It ran three tiers. Each tier needed the fraud count, the fraud dollar amount and the fraud-to-sales ratio met together. | Tier | Name | Fraud transactions | Fraud amount | Fraud-to-sales ratio | Consequence | |---|---|---|---|---|---| | 1 | Informational Fraud Alert | 3 | USD 3,000 | 3% to 4.99% | Notification | | 2 | Suggested Training | 4 | USD 4,000 | 5% to 7.99% | Training recommendation | | 3 | High Fraud Alert | 5 | USD 5,000 | 8%+ | Alert and remediation | **GMAP carried no fines.** Not at any tier. You got a notification, a training recommendation, and a remediation conversation with your acquirer. Compare ECM, where month 19 costs USD 100,000 a month. Told you're "in GMAP" and bracing for an assessment? There was never an assessment to brace for. **GMAP didn't supersede ECM or HECM.** It sat in Chapter 8 under fraud control, separate from the Excessive Chargeback Program. They ran alongside each other, measuring different things. Anyone saying GMAP replaced the chargeback programs is describing a 2027 claim, not a past fact. Mastercard's eLearning module still sits at `mastercard.com/elearning/gmap/story.html`, unlinked from anywhere on the site. That's a big part of why the program still looks alive to a search engine. --- ## Reason code 4849 is a QMAP code, not a GMAP code Mastercard reason code **4849, Questionable Merchant Activity**, belongs to **QMAP**, the Questionable Merchant Audit Program. Not GMAP. In the Chargeback Guide, Merchant Edition, dated 19 May 2026, 4849 is tied solely to QMAP. QMAP is live. It's a fraud-driven audit needing three of four conditions. One of them is a fraud-to-sales transaction ratio of **70% or greater**. No ordinary business gets near that. QMAP targets merchants whose transactions are mostly fraud. It's the one [MATCH](/docs/chargebacks/match-tmf) reason code (08) tied to a named audit program. Kount, Justt and Chargeback.io all still market 4849 as the GMAP chargeback on live pages. They're wrong. The error is sticky, too. It gets copied into internal runbooks, dispute training and vendor comparison sheets, and it sits there for years. **What to do about it:** a 4849 is a QMAP matter. The response looks nothing like a chargeback-ratio problem. Ask your acquirer whether an audit is open on your MID and what evidence they need. Don't go hunting for a GMAP tier to argue about. --- ## What actually applies to you right now Five programs. Two networks. GMAP isn't one of them. | Program | Network | Measures | Live thresholds | |---|---|---|---| | [ECM](/docs/chargebacks/reference/network-programs#mastercard-ecm-mastercards-chargeback-monitoring-program) | Mastercard | Chargebacks | 100-299 chargebacks AND 1.50%-2.99% ratio | | [HECM](/docs/chargebacks/reference/network-programs#mastercard-ecm-mastercards-chargeback-monitoring-program) | Mastercard | Chargebacks | 300+ chargebacks AND 3.00%+ ratio | | [EFM](/docs/chargebacks/reference/network-programs#mastercard-efm-excessive-fraud-merchant) | Mastercard | Fraud | 1,000+ transactions, USD 50,000+ fraud, 0.50%+ fraud ratio | | [VAMP](/docs/chargebacks/reference/network-programs#visa-vamp-visas-chargeback-and-fraud-monitoring-program) | Visa | Fraud + disputes combined | 1.5% merchant excessive (2.2% CEMEA), 1,500 count minimum | | [SMMP](/docs/chargebacks/reference/scam-merchant-monitoring) | Mastercard | Scam signals | Live since 24 July 2026. No ratio you're graded on, a 72-hour acquirer investigation clock | _Last verified: 2 August 2026._ **Mastercard divides this month's chargebacks by last month's transactions.** Visa uses the same calendar month for both. Growing fast? The Mastercard ratio runs hotter than you'd expect, because the denominator is a smaller month. See [Chargeback Metrics](/docs/chargebacks/metrics) for the arithmetic. **The umbrella name is ACMP,** the Acquirer Chargeback Monitoring Program. ECM, HECM and EFM live inside it. It has no thresholds of its own. It's the chapter, not the program. That's why the reported 2027 story about "retiring ACMP" reads as bigger news than it is. One ACMP rule is public and genuinely merchant-facing. It's in the Transaction Processing Rules dated 9 December 2025, section 5.4.1. Four of Mastercard's five subscription standards already bind every recurring merchant, including the online cancellation method. The fifth is a receipt after each individual charge. That one is only a recommendation until you're identified in ACMP for **four months or more** in the same audit period. Then it becomes a requirement, with Category A assessments on your acquirer on top of the normal ACMP ones. Not-for-profit and charity recurring merchants get all five as recommendations, and the same trigger makes all five mandatory. --- ## Scale Callout | Volume | Focus | |---|---| | **Under $100k/mo** | GMAP is irrelevant to you, and so is most of this page. Track one number: your Mastercard chargeback count against 100. Count is what a small merchant crosses first, not ratio | | **$100k-$1M/mo** | ECM's 100-chargeback floor is genuinely reachable here. Watch count and ratio together, and confirm which transactions land in your acquirer's denominator | | **Over $1M/mo** | Ask your acquirer in writing whether they've received anything on a 2027 change. They see the Connect-gated manual and the announcements. You don't | --- ## The reported 2027 GMAP :::warning[Acquirer-relayed, like every other threshold on this site] Everything in this section traces to three industry sources publishing within roughly 48 hours at the end of July 2026: - **Chargeback Gurus**, 30 July 2026, [chargebackgurus.com](https://www.chargebackgurus.com/blog/mastercard-global-merchant-audit-program-gmap). By far the most detailed account, and the only one carrying tier definitions and fine ladders. - **Solidgate**, updated 31 July 2026, [solidgate.com/blog/mastercard-gmap](https://solidgate.com/blog/mastercard-gmap/). - **Corepay**, roughly 29 July 2026, posted on LinkedIn. Not one cites a Mastercard announcement or bulletin number. **That objection is worth less than it sounds.** The same is true of almost every number on this site. ECM's 1.5% and HECM's 3.0% appear in no public Mastercard document either. Both are defined by cross-reference to a manual behind an acquirer login. Every figure in circulation, ours included, reached the public through an acquirer. Three parties with acquirer channel access publishing inside two days, none able to link a document, is what a real acquirer-facing announcement looks like from outside. So we treat it the way we treat ECM. Best available account, sourced and dated, not rumor. The caveats below are about specific figures that don't hold up, not about whether the program is real. There's no primary source in public. All four current Mastercard rulebooks - Security Rules and Procedures (3 February 2026), Mastercard Rules (2 June 2026), the Chargeback Guide (19 May 2026) and the Transaction Processing Rules (9 December 2025) - return **zero hits** on the new tier names. Mastercard's public announcement paths carry nothing either. Block Chargeback Gurus from a search and the story largely disappears. NOT PUBLISHED That isn't a debunk. All four rulebooks predate the 30 July reports. Mastercard's threshold manual sits behind an acquirer login on Mastercard Connect, so a real change would be invisible to any public search. A program taking effect in April 2027 has no reason to appear in a February 2026 rulebook yet. **We can't confirm it and we can't rule it out.** The next honest checkpoint is the February 2027 edition of the Security Rules. ::: All three agree on this much. A new Global Merchant Audit Program, effective **1 April 2027**, tightening dispute monitoring on merchants and acquirers alike. Open audits carry over and month counts don't reset. The ratio is reported as fraud filed to the Fraud and Loss Database plus non-fraud chargebacks, over the **prior** month's sales. That at least matches how Mastercard already does the arithmetic. They don't agree on what happens to the programs you're in today. Chargeback Gurus says ACMP is retired and ECM, HECM and EFM fold into the new framework. Corepay says ECM and HECM stay, running in tandem with an updated GMAP. Those are different architectures. Both can't be right. More [below](#where-the-sources-disagree-with-each-other). The reported tiers, all REPORTED: | Reported tier | Applies to | Reported ratio | |---|---|---| | High Dispute Merchant (HDM) | Merchant | 500 bps (5%) | | Excessive Dispute Merchant (EDM) | Merchant | 5,000 bps (50%) | | High Dispute Acquirer (HDA) | Acquirer portfolio | 50 bps (0.5%) | | Excessive Dispute Acquirer (EDA) | Acquirer portfolio | 70 bps (0.7%) | ### Which of these numbers hold up **HDA at 0.5% and EDA at 0.7% are VAMP's acquirer portfolio numbers exactly.** VAMP gates its own acquirer levels on a combined fraud-and-dispute count of 1,500. That's the strongest thing going for the story. It's what Mastercard's answer to VAMP would plausibly look like. An acquirer already tuned for VAMP wouldn't have much new work to do. **EDM at a 50% ratio is a scam-shop threshold.** Half of everything you sell coming back as a dispute isn't a merchant having a bad quarter. If you're here worrying about your 1.2% ratio, EDM isn't a number in your life. HDM at 5% is still more than three times today's ECM trigger. **The transaction-count minimums don't survive arithmetic, so we're not publishing them.** The acquirer minimum as printed needs 1,500 cleared transactions *and* 1,500 reported as fraud or charged back. That's a 100% ratio sitting under a 0.5% threshold. The merchant minimum is printed as 5 cleared transactions, which would sweep in every merchant on the network. It also sits suspiciously close to the suspended 2020 tiers above. Both look like transcription problems. :::warning[The HDA fine ladder in the source runs backwards] Chargeback Gurus' High Dispute Acquirer table reads **USD 25,000 at months 12 through 18, then USD 10,000 at months 19 and beyond**. The fine falls the longer the breach lasts. That's backwards from every other ladder Mastercard publishes, and from the article's own three others. It's almost certainly a typo in that one table, not a reason to doubt the article. The other three ladders in the same piece escalate normally, HDM topping out at USD 25,000 and EDM at USD 300,000. Treat that row as unreliable in either direction, since there's no way to tell which of the two figures is the typo. Solidgate publishes no ladders at all, so every one of these amounts rests on one source. ::: ### Where the sources disagree with each other | Question | Chargeback Gurus | Solidgate | Corepay | |---|---|---|---| | What happens to ECM and HECM | Folded into the new program | Not stated in detail | Kept "in tandem with" an updated GMAP | | Fine ladders | Full tables for four tiers | None published | None published | | ECM phase-down | 1.5%-2.99% for 2027-2028, 1.3% floor 2029, 1.1% 2030, 0.9% 2031 | 1.5% falling to 0.9% by 2031, starting 2029 | Says ECM thresholds are being reduced | "Folded into" and "running in tandem with" are different architectures, not two wordings for the same thing. That's a real disagreement from two sources publishing a day apart. The ECM phase-down is the part most likely to touch an ordinary merchant. It's also the thinnest. One source carries the detail, and even it says nothing changes before 2029. If it's real, today's 1.5% eventually becomes 0.9%. That's where most processors already draw their own line. Treat it as a reason not to get comfortable at 1.2%, not as a calendar date. Chargebacks911 actively maintains Mastercard threshold pages and has published **nothing** about a 2027 GMAP. That's silence, not a rebuttal. Solidgate is odder. Its marketing blog carries the story. Its own product documentation still lists only ACMP with ECM, HECM and EFM. A vendor that hasn't updated its operational docs hasn't operationalized the claim. --- ## Why this is so hard to verify **Mastercard publishes no numeric ECM, HECM or EFM threshold in any public document.** The Security Rules define both chargeback programs by cross-reference to Chapter 8 of the Data Integrity Monitoring Program manual. That manual sits behind an acquirer login on Mastercard Connect. Merchants can't read it. Visa is no better. Core Rules 10.4.3.1 defers to a VAMP Guide distributed to acquirers and never published. Section 12.5.4, "Dispute Monitoring Fees and Non-Compliance Assessments," is a printed heading with nothing underneath it. So every threshold number in circulation, including the ones on this site, is an acquirer or PSP relay of a document neither of us can open. That's how a suspended program stays alive online for six years. Nobody who copied the tiers in 2019 had a way to check them in 2021. We'd rather say that than pretend to a citation we don't have. VENDOR is read from Mastercard's own manual. REPORTED is a named third party with a date. NOT PUBLISHED is a search that failed, with the places we looked written down. --- ## Where This Breaks **Your acquirer's threshold is stricter than the network's.** Theirs is the one that ends the relationship. Most processors act around 0.9%, well below any published network line. The network number tells you when you get named. It doesn't tell you when you get offboarded. **A suspended program can come back.** "Suspended until further notice" isn't "cancelled." If Mastercard reinstates GMAP, the numbers on this page become history twice over. The reported 2027 program may be exactly that reinstatement, or it may be three vendors amplifying one article. **Legacy tier numbers survive in internal documents.** If anyone ever built a fraud dashboard against 3%, 5% and 8% GMAP tiers, those alerts are still firing against a program that stopped existing in 2020. Worth an afternoon to check. --- ## Test to Run One search and two questions. Fifteen minutes. **1. Search your own documents for GMAP.** Onboarding pack, acquirer agreement, internal risk runbook, chargeback vendor dashboard. Anything naming GMAP as a live program is stale. Whatever else that document says deserves the same suspicion. **2. Ask your acquirer the ratio question:** > "What's my current Mastercard chargeback ratio and count, which month's volume are you using as the denominator, and what internal threshold do you apply to me before the network's?" That last clause is the one that gets you the useful answer. **3. Ask the 2027 question neutrally.** Don't lead with the vendor blogs, or you'll get a salesperson's answer back: > "Have you received any Mastercard announcement about changes to the Acquirer Chargeback Monitoring Program or merchant monitoring thresholds taking effect in 2027? If so, can you send me the announcement number?" An AN number means there's a primary source and you've found it. A vendor blog link back tells you something too. --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [Mastercard Security Rules and Procedures, Merchant Edition](https://www.mastercard.com/content/dam/mccom/shared/business/support/rules-pdfs/SPME-Manual.pdf) | The verbatim suspension sentence at 8.2 and QMAP's conditions at 8.4. Its 2021 and 2022 editions, via the Wayback Machine, gave the 15 October 2020 date and the legacy tiers | Network rulebook, publicly published | Edition dated 2026-02-03 | | Mastercard Chargeback Guide, Merchant Edition | Reason code 4849 tied solely to QMAP | Network rulebook, publicly published | Edition dated 2026-05-19 | | Mastercard Transaction Processing Rules, section 5.4.1 | ACMP as the umbrella for ECM, HECM and EFM, and the four-month subscription rule | Network rulebook, publicly published | Edition dated 2025-12-09 | | [Solidgate blog](https://solidgate.com/blog/mastercard-gmap/) | The 2027 program shape, effective date, HDM and EDM ratios, ECM phase-down. **Vendor selling chargeback services.** Its own product docs still list only ACMP | Vendor marketing blog | Updated 2026-07-31 | | [Chargeback Gurus](https://www.chargebackgurus.com/blog/mastercard-global-merchant-audit-program-gmap) | The four reported tiers, the fine ladders, the ECM phase-down detail. **Vendor selling chargeback services.** Sole source for most specific figures | Vendor marketing blog | 2026-07-30 | | Corepay, LinkedIn post | The "in tandem with" framing that conflicts with Chargeback Gurus | Vendor social post | Approximately 2026-07-29 | | Chargebacks911 Mastercard threshold pages | Nothing. No mention of a 2027 GMAP on pages they actively maintain | Vendor pages, checked for non-corroboration | Accessed 2026-08-02 | _All rulebooks retrieved 2 August 2026._ --- ## Next Steps **Came here because something said GMAP applies to you?** 1. [Network Programs Reference](/docs/chargebacks/reference/network-programs) - the thresholds that are actually live 2. [Chargeback Metrics](/docs/chargebacks/metrics) - work out where you really sit 3. [Processor Warnings](/docs/chargebacks/processor-warnings) - what a real notice looks like **Dealing with a fraud-side problem?** 1. [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - EFM and the fraud thresholds in detail 2. [Mastercard Reason Codes](/docs/reference/reason-codes/mastercard) - what each code actually means 3. [MATCH and the TMF](/docs/chargebacks/match-tmf) - reason code 08 and the QMAP listing **Ratio climbing right now?** 1. [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - the emergency playbook 2. [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca and CDRN 3. [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - tactical intervention ## Related Pages - [Network Programs Reference](/docs/chargebacks/reference/network-programs) - VAMP, ECM, HECM, EFM in one table - [SMMP](/docs/chargebacks/reference/scam-merchant-monitoring) - Mastercard's scam merchant monitoring, live since July 2026 - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - the deep dive on each program - [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - threshold detail by network - [MATCH and the TMF](/docs/chargebacks/match-tmf) - the blacklist and its reason codes - [Mastercard Reason Codes](/docs/reference/reason-codes/mastercard) - full code list - [Chargeback Metrics](/docs/chargebacks/metrics) - ratio arithmetic, including the prior-month denominator - [Processor Warnings](/docs/chargebacks/processor-warnings) - reading a real notice - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - crisis playbook - [Chargeback Prevention](/docs/chargebacks/prevention) - the prevention hierarchy - [Mastercard Network Guide](/docs/reference/card-networks/mastercard) - QMAP and the wider rule set - [Holds and Reserves](/docs/operations/holds-and-reserves) - what program enrollment does to your cash --- ## Network Programs Reference Source: https://paymentsandrisk.com/docs/chargebacks/reference/network-programs # Network Programs Reference :::info[TL;DR] - **Visa VAMP**: 1.5% merchant excessive since 1 April 2026 (2.2% in CEMEA only), on a minimum of 1,500 fraud reports and disputes combined. Fraud and disputes land in the same number - **Mastercard ECM**: 100-299 chargebacks AND a 1.50%-2.99% ratio. **HECM** is 300+ AND 3.00%+. You have to breach the count and the ratio together. One on its own does nothing - **The two networks divide differently.** Mastercard puts this month's chargebacks over *last* month's transactions. Visa uses the same calendar month for both. Growing fast? The Mastercard number runs hotter - **Mastercard SMMP**: live since 24 July 2026. Refunds plus chargebacks over 5% can start a 72-hour acquirer investigation. Only in your first six months, though, and only at 500+ transactions. No fines, no ratio you can look up - **MATCH**: a 5-year listing. It isn't a legal ban. But ordinary acquirers won't board you while you're on it, and the ones that will want 5-10% and a fat reserve - **Safe zone**: under 0.9% on Visa, under 100 chargebacks and under 1.5% on Mastercard. Getting out takes three consecutive months under the line plus a remediation plan ::: Processor just named a program at you? Sitting at 0.9% and want to know where the lines fall? This is the cheat sheet. One thing first. Neither network publishes these numbers. Every figure here, ours included, reached the public through an acquirer. For the deep version, see [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring). ## Visa VAMP (Visa's chargeback and fraud monitoring program) Live since April 2025. It folded the old VDMP and VFMP together, so fraud reports and disputes now land in one ratio instead of two. :::note[VFMP-3DS is gone too, and that one matters] Visa retired **four** programs into VAMP on 1 April 2025, not two. VDMP, VFMP, DGMFM and **VFMP-3DS**. VFMP-3DS was the US-only track that measured fraud on your Visa Secure traffic on its own. The penalty was the sharp part: while you were in it, you lost the 3DS liability shift. You'd done the authentication and still carried the fraud. It's dead. Fraud on authenticated transactions now just lands in the single VAMP ratio like everything else. Reported thresholds while it ran were 0.5% and $5,000 of fraud for early warning, 0.75% and $7,500 for the standard program. Those come from vendor write-ups, and the vendors don't agree with each other on whether fines ever applied. Visa published none of it. REPORTED Why it's worth knowing: a fraud vendor quoting VFMP-3DS at you is selling against a program that closed over a year ago. ::: ### Current Thresholds _Last verified: 1 August 2026._ | Threshold | Ratio | Volume Minimum | |-----------|-------|----------------| | **Merchant Non-Compliant** | 0.5% | 5 | | **Merchant Excessive** | 1.5% since 1 April 2026 (2.2% in CEMEA only) | 1,500 combined fraud reports + disputes. CEMEA is 150 events **and** US$75,000 in value | | **Acquirer Above Standard** | 0.5% (portfolio level), since 1 June 2025 | Same as merchant excessive: 1,500 combined fraud reports + disputes, or 150 **and** US$75,000 in CEMEA | | **Acquirer Excessive** | 0.7% (portfolio level), since 1 June 2025 | Same as above standard | | **Enumeration** | 20% | 300,000 | The CEMEA row has two tests, not one. A CEMEA merchant needs 150 combined fraud reports and disputes. **And** US$75,000 of value in them. Only then does the 2.2% ratio do anything. The count alone isn't enough. Most summaries drop the dollar half. **A threshold and a fee are two different events.** Both acquirer lines, 0.5% and 0.7%, have run since 1 June 2025. That's off Visa's own VAMP overview. The US$4 charge at the above-standard tier didn't start until 1 January 2026. Plenty of summaries print 1 January 2026 as the date the 0.5% threshold appeared. It isn't. The threshold was already seven months old. 0.5% is the line you'll cross first. Watch it. It isn't automatically a fee event, though. Visa applies the merchant thresholds only when your acquirer isn't already in Above Standard or Excessive. And the $8 per-dispute charge at 0.5% lands when your acquirer's whole portfolio has breached Excessive. Stripe's wording catches the difference. Visa *may* assess at non-compliant. It *assesses* at excessive. So 0.5% puts you on your acquirer's watch list. 0.9% is where most processors act for their own reasons. 1.5% is the number that gets you named. :::warning[Where these numbers come from, and why you should still ask your acquirer] **Visa doesn't publish VAMP thresholds publicly.** Visa Core Rules 10.4.3.1 defers entirely to the VAMP Guide. That guide goes to acquirers, not merchants. Section 12.5.4 of the public rules, "Dispute Monitoring Fees and Non-Compliance Assessments", is a printed heading with nothing under it. So every VAMP figure you find online, this page included, comes from acquirer-facing summaries. Not from a citable Visa document. The figures above match [Stripe's published documentation](https://docs.stripe.com/disputes/monitoring-programs). They hold up across several independent acquirer sources too. That's the strongest evidence available. It still isn't a primary source. Mastercard is only slightly better. "ECM" appears four times in the 503 pages of the public Mastercard Rules (2 June 2026 edition). Only one of those is an operative rule: section 5.11.4, on address verification at automated fuel dispensers. The rest point at a Connect-only manual. "HECM" doesn't appear at all. Neither acronym is ever attached to a number. **What to do about it:** ask your acquirer for your current ratio, the thresholds they apply to you, and which transactions land in the denominator. Their internal threshold is usually stricter than the network's. And theirs is the one that gets you offboarded. ::: ### What Counts in VAMP | Component | Counts? | Notes | |-----------|---------|-------| | TC40 (fraud reports) | Yes | Counts even if no chargeback | | TC15 (chargebacks) | Yes | Standard disputes | | Fraud + chargeback same transaction | Effectively 2x | Double impact | | RDR-resolved disputes | TC15 excluded | TC40 may still count | | CE 3.0 qualified | Both excluded | Best protection | ### Fee Structure _Last verified: 1 August 2026._ | Level | Per-Dispute Fee | |-------|-----------------| | Merchant Excessive | US$8 per CNP dispute, passed through by your acquirer | | Acquirer Above Standard (0.5% portfolio) | US$4 per dispute, from 1 January 2026 | | Acquirer Excessive (0.7% portfolio), on disputes at merchants whose own ratio is 0.5% or higher | US$8 per dispute | These are flat amounts, not the ranges most summary pages circulate. And the $8 doesn't hit every dispute in an excessive acquirer's book. Only the ones at merchants sitting at 0.5% or above themselves. REPORTED The fees come from [Checkout.com's acquirer notice](https://www.checkout.com/blog/visa-acquirer-monitoring-program) dated 12 June 2026, corroborated by Antom. They do **not** come from Visa. Visa's own VAMP fact sheet is a single page, created 14 May 2026. It carries the ratios and count minimums above. It carries no fee figure of any kind. Neither does the public rulebook. Watch which fact sheet you open. Visa hosts two at near-identical URLs, both stamped 2025 on their faces, and the earlier one still prints 220 bps and a 1,000 count. Several vendor pages link to the stale one, Stripe's included. If you see these amounts attributed to a Visa document, ask which one. NOT PUBLISHED Your acquirer decides how much of its portfolio fee to pass down. Nothing in the rules stops it passing down more than it pays. Ask what your per-dispute pass-through is before you're in a program, not after. ### Timeline and Remediation | Event | Deadline | |-------|----------| | Identification notice | Month after breach. That month is program month 1 | | Remediation plan required | 15 days from notice | | Grace period | Program months 1, 2 and 3. First identification in a rolling 12 months only | | First fee | Program month 4 | | Exit criteria | Below threshold 3 consecutive months | Count in program months, not calendar months. The breach happens in one calendar month and the notice lands in the next, so the two counters sit a month apart. That gap is where most published VAMP timelines go wrong. Grace runs program months 1 to 3. The first fee lands in program month 4. --- ## Visa MERP (Merchant Elevated Risk Program) **Asia Pacific only.** Effective 9 April 2026. Selling into AP through an AP acquirer? This one can reach you. Everywhere else, skip it. MERP isn't a ratio program. Visa identifies a merchant showing "unusual activity" and can then require the acquirer, or you, to deploy remediation tools or technologies. There's no published number to stay under, because the criteria sit in the Merchant Elevated Risk Program Guide. That guide goes to acquirers. Same pattern as VAMP. | Event | Assessment on your acquirer | |---|---| | First identification | USD 25,000 | | Repeat identification, same acquirer | USD 50,000 | | Continued non-compliance after that | Monthly assessments, then risk reduction requirements | Those amounts are unusual: they're **published**, in Visa's public rulebook, at Table 12-6. The thresholds that trigger them aren't. So Visa will tell you what it costs and not what sets it off. The assessment lands on the acquirer, not on you. That doesn't help much. An acquirer facing USD 25,000 has a cheaper option than paying it, and the cheaper option is offboarding you. Source: Visa, _Visa Core Rules and Visa Product and Service Rules_, 18 April 2026, sections 10.4.4.4 and 12.5.8.1. --- ## Mastercard ECM (Mastercard's chargeback monitoring program) Two tiers, and you have to breach the count AND the ratio. One on its own doesn't put you in anything. ### First, the umbrella name nobody uses ECM, HECM and EFM aren't three loose programs. They all sit inside the **Acquirer Chargeback Monitoring Program (ACMP)**. That's the name Mastercard's own rules use. Its Transaction Processing Rules (9 December 2025, section 5.4.1) refer to a merchant "identified for four months or more in the Acquirer Chargeback Monitoring Program (ACMP) as an Excessive Chargeback Merchant (ECM), a High Excessive Chargeback Merchant (HECM) and/or an Excessive Fraud Merchant (EFM)". ACMP has no threshold of its own. No ACMP ratio, no ACMP fine. The ECM, HECM and EFM numbers below *are* the ACMP numbers. The acronym is worth knowing for one reason: your acquirer will use it in an email and expect you to follow. One consequence is real and specific. It's also narrower than most summaries claim. Four of Mastercard's five subscription standards already bind every recurring merchant, in or out of any program. Disclose the terms up front and capture acceptance. Confirm the order electronically. Provide an online cancellation method, or clear cancel instructions. Send an advance reminder before any bill six months or more apart. Only the fifth is a recommendation: the receipt after each individual charge. Get identified in ACMP for four months or more in one audit period, as ECM, HECM or EFM, and that fifth one becomes a requirement too. Category A assessments then land on your acquirer for each month of noncompliance, on top of whatever ECM or HECM already costs. Not-for-profit and charity recurring merchants start with the whole list as recommendations. The same four-month trigger makes all five mandatory. ### ECM Thresholds You have to hit both: | Level | Chargeback Count | Chargeback Ratio | |-------|------------------|------------------| | **ECM** | 100-299 | 1.5% - 2.99% | | **HECM** | 300+ | 3.0%+ | ### Ratio Calculation ``` Mastercard Ratio = (First Presentment Chargebacks in Month N) / (Transactions in Month N-1) ร— 100 ``` The denominator is **last** month's transactions, not this month's. Visa uses the same calendar month for both. That's why the same merchant can show two different ratios in one week. Growing fast? The Mastercard number runs hotter, because the denominator is a smaller month. This is the most commonly botched fact in the field. Check which month your acquirer is actually using. See [Chargeback Metrics](/docs/chargebacks/metrics) for the arithmetic. The result is a percentage. Compare it against 1.5% (ECM) and 3.0% (HECM) directly. ### ECM Fine Escalation | Month in Program | Monthly Assessment | |------------------|-------------------| | 1 | $0 (warning) | | 2 | $1,000 | | 3 | $1,000 | | 4-6 | $5,000 | | 7-11 | $25,000 | | 12-18 | $50,000 | | 19+ | $100,000 | ECM carries no issuer recovery charge. That one belongs to HECM. ### HECM Fine Escalation | Month in Program | Monthly Assessment | Issuer Recovery Assessment | |------------------|-------------------|---------------------------| | 1 | $0 (warning) | No | | 2 | $1,000 | No | | 3 | $2,000 | No | | 4-6 | $10,000 | Yes | | 7-11 | $50,000 | Yes | | 12-18 | $100,000 | Yes | | 19+ | $200,000 | Yes | The **Issuer Recovery Assessment** is the HECM column, and only from program month 4. It isn't an ECM charge, whatever a summary page tells you. Mastercard collects it from your acquirer and pays it out to the issuers that ate the chargebacks. An issuer needs at least USD 20 owed to get anything. If nobody clears USD 20, the issuer carrying the most takes the whole pot. Two tied, and they split it. Source: Mastercard, _Security Rules and Procedures - Merchant Edition_, 3 February 2026, section 8.3.3. So an issuer recovery line on your statement is a tier signal. It means HECM. Ask your acquirer which program you're actually in, because the fine ladder doubles between the two. ### Exit Criteria - Below ECM thresholds ( 1.5% (2.2% in CEMEA) | | Mastercard ECM | 100-299 chargebacks AND 1.50%-2.99% | | Mastercard HECM | 300+ chargebacks AND 3.00%+ | --- ## Timeline: How Fast Things Escalate ### Visa VAMP Timeline ``` Calendar month 1: You breach Calendar month 2: Identification notice. Program month 1 starts Remediation plan due 15 days later Program months 1-3: Grace period, first identification only Program month 4: Fees begin Program month 7+: Termination risk climbs ``` Grace is three program months, not four, and it only applies to a first identification in a rolling 12 months. Breach again inside that window and there's no grace at all. ### Mastercard ECM Timeline ``` Month 1: First month above threshold Month 2: Identified as ECM. Program month 1, no assessment Month 3: Program month 2, $1,000 Month 4: Program month 3, $1,000 Month 5+: Program month 4 and up, $5,000/month and climbing Month 13+: Program month 12 and up, $50,000/month, termination likely ``` Only the first month in the program is free. The "warning period" a lot of summaries describe as months two and three is $1,000 a month. --- ## Analyst Layer: Metrics to Track Ratio alone tells you where you are. Distance-to-threshold tells you how much room is left. That's the number that decides whether you act this week or next quarter. ### Distance Metrics | Metric | Your Value | Threshold | Distance | Status | |--------|-----------|-----------|----------|--------| | **Visa dispute ratio** | 0.72% | 0.90% (processor line, not VAMP's) | 0.18% | โš ๏ธ Watch | | **Mastercard CB ratio** | 1.1% | 1.50% | 0.40% | โœ“ Safe | | **Mastercard CB count** | 65 | 100 | 35 | โš ๏ธ Watch | | **Mastercard fraud ratio** | 0.25% | 0.50% | 0.25% | โœ“ Safe | ### Distance Alert Thresholds | Distance to Threshold | Action | |----------------------|--------| | > 50% buffer | Monitor monthly | | 25-50% buffer | Monitor weekly | | 10-25% buffer | Monitor daily, prepare plan | | < 10% buffer | Emergency mode, implement plan | ### Calculating Distance ``` Distance % = (Threshold - Current) / Threshold ร— 100 ``` **Example:** - Current ratio: 0.72% - Threshold: 0.90% - Distance: (0.90 - 0.72) / 0.90 = 20% At 20% distance you're in the 10-25% band. That means daily monitoring and a plan already drafted, not a weekly check-in. ### Trend Projection Track your trajectory: | Week | Ratio | Week-over-Week Change | Projected at Trend | |------|-------|----------------------|-------------------| | 1 | 0.60% | - | - | | 2 | 0.65% | +0.05% | - | | 3 | 0.72% | +0.07% | Breach in ~3 weeks | | 4 | 0.71% | -0.01% | Stable | If your trend shows breach within 4 weeks, act now. ### Dashboard Requirements Build a real-time dashboard showing: 1. **Current ratios** vs thresholds (visual gauge) 2. **Distance to each threshold** (percentage) 3. **Trend line** (past 8 weeks) 4. **Projection** (at current trend) 5. **Alert status** (green/yellow/red) **Alert rules:** - Yellow: < 25% distance OR upward trend - Red: < 10% distance OR projected breach < 4 weeks --- ## Next Steps **Approaching threshold limits?** 1. [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response playbook 2. [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deploy RDR, Ethoca, CDRN fast 3. [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Tactical intervention guide **Building monitoring dashboards?** 1. [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - Threshold detail by network 2. [Chargeback Metrics](/docs/chargebacks/metrics) - Set up ratio tracking 3. [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - Detailed program requirements **Been told a program applies to you and want to check?** 1. [Scam Merchant Monitoring (SMMP)](/docs/chargebacks/reference/scam-merchant-monitoring) - Live since 24 July 2026, and refunds count 2. [Mastercard GMAP](/docs/chargebacks/reference/gmap) - Suspended since 2020, plus the reported 2027 version 3. [MATCH and the TMF](/docs/chargebacks/match-tmf) - The listing that actually ends an account **Preventing program enrollment?** 1. [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention hierarchy 2. [Winning Evidence](/docs/chargebacks/winning-evidence) - CE 3.0 for ratio protection 3. [3D Secure](/docs/fraud/prevention/3ds) - Fraud liability shift ## Related Pages - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - Detailed VAMP, ECM coverage - [Scam Merchant Monitoring (SMMP)](/docs/chargebacks/reference/scam-merchant-monitoring) - The 72-hour acquirer investigation program - [Mastercard GMAP](/docs/chargebacks/reference/gmap) - Suspended since 2020, and the reported 2027 relaunch - [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - Threshold detail - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Crisis playbook - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN - [Winning Evidence](/docs/chargebacks/winning-evidence) - CE 3.0 requirements - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency playbook - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention hierarchy - [Chargeback Metrics](/docs/chargebacks/metrics) - Ratio tracking - [3D Secure](/docs/fraud/prevention/3ds) - Fraud liability shift - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Holds and Reserves](/docs/operations/holds-and-reserves) - Program consequences - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow --- ## Mastercard Scam Merchant Monitoring (SMMP) Source: https://paymentsandrisk.com/docs/chargebacks/reference/scam-merchant-monitoring # Mastercard Scam Merchant Monitoring (SMMP) :::info[TL;DR] - **Live since 24 July 2026**, on card-not-present merchants. It's enforceable now, not a proposal. - **It's an acquirer obligation, not a merchant ratio.** Your acquirer or payfac has to open an investigation within 72 hours of a trigger. You get no notice, no portal and no published appeal. - **Refunds count.** The 5% trigger adds refunds and chargebacks together. Refund hard to protect your chargeback ratio and you build the exact number this program watches. - **That 5% trigger only applies in your first six months** on Mastercard. And only if you did at least 500 purchase transactions in the 30-day window. - **No fines, no ladder, no grace period.** The only outcome is that Mastercard and Maestro acceptance stops. So the goal is being easy to clear in 72 hours, not staying under a number. - **Every figure here is reported, not published.** "SMMP" appears zero times in Mastercard's four current public rulebooks. ::: You just heard "SMMP" from your processor or a forum thread. You want to know if you're in trouble. For most established merchants, no. This is a screening program built for fake shops, subscription traps and investment fronts. Only one number in it could catch an ordinary business, and that one expires after your first six months on the network. The monthly ratio programs do apply to you forever. See [Network Programs Reference](/docs/chargebacks/reference/network-programs). :::tip[Don't panic] SMMP carries no fine, no assessment ladder and no monthly ratio. Six months or more on Mastercard? The 5% combined refund-and-chargeback trigger doesn't touch you at all. One trigger can still fire on your own numbers: an authorization approval rate collapse. Collapse means a 50 percentage point drop, or falling below 30% outright. That's a broken gateway or a fraud rule set to the wrong value. It isn't a bad week of trading. BIN attacks and processor outages are reported to be carved out entirely. Most legitimate small merchants run a combined refund-and-chargeback rate in the low single digits. They never come close. ::: --- ## What SMMP actually is Mastercard's revision document is reportedly titled "Potential Scam Merchant Monitoring". The acronym SMMP comes from the trade press and from PSP blogs, not from Mastercard. Mastercard's own newsroom described the identical 72-hour duty on 19 May 2026. It used the umbrella brand "Merchant Trust Services" and never used the acronym once. Ask your acquirer about "SMMP" and you may get a blank look. Try "the new scam merchant rules" instead. The mechanism is a screening and investigation duty on acquirers and payment facilitators. Certain signals oblige them to open a file on you and act fast. It isn't a ratio program. There's no scoreboard you can log in and check. What changed is narrower than the headlines suggest. Mastercard's public Security Rules and Procedures already required acquirers to alert on "an authorization approval rate that falls below a threshold set by the Acquirer for that Merchant" (section 6.2.2.2, 3 February 2026 edition). Your acquirer picked the number. The scam rules swap that discretion for a network number and a hard clock. The clock is the real story. Under the existing Merchant Monitoring Program, a monitoring provider reports an identification within 5 business days. The acquirer then investigates within 15 calendar days (section 8.9.1). For scam signals that becomes 72 hours. Roughly a five-fold compression. It's why onboarding got tighter across the industry this year. --- ## The triggers, and the numbers attached to them Every figure in this section is REPORTED. Nobody outside an acquirer login can read the source document. Sources and dates are in the [Sources](#sources) table. ### If you've been on Mastercard more than six months | Trigger | The number | What it really catches | |---|---|---| | **Authorization approval rate collapse** | At least 25 purchase transactions in a 72-hour window, and the approval rate either drops by 50 percentage points or more (the worked example in circulation is 95% falling to 45%) or falls below 30% outright | A gateway or 3DS misconfiguration, or a fraud rule set to the wrong value. BIN attacks and processor outages are reported to be excluded | | **GRIP letter** | No threshold. Receipt of the letter is the trigger | A Mastercard compliance investigation already reached your acquirer | | **Monitoring provider alert** | No threshold | A Mastercard-approved monitoring vendor flagged your website | That's the full list for an established merchant. There's no refund test, no chargeback test and no dollar amount. ### If you've been on Mastercard six months or less Any one of these three is enough: | Trigger | The number | |---|---| | **Two issuers report fraud type 56** | Two different card issuers file transactions under code 56, Manipulation of Cardholder | | **Two issuers cite scam language** | At least two issuers file chargebacks, fraud or non-fraud, where the supporting documentation mentions scams, manipulation or similar | | **Combined refund and chargeback rate above 5%** | Refunds plus chargebacks above 5% of purchase transactions in any rolling 30-day period, provided you did at least 500 purchase transactions in that window | A fourth item shows up in two sources only. Asking your acquirer for multiple Merchant IDs without a clear business reason. Treat that as reported, not established. It's cheap to avoid anyway. Document the reason before you ask. :::warning[How settled are those minimums?] The 500-transaction floor on the 5% trigger is the better supported of the two. Every write-up carries it, Justt included. So does the one source that cites Mastercard's document reference. The 25-transaction floor on the approval rate trigger is carried by every source except Justt. Justt gives the ratio with no minimum attached. That reads like an omission rather than a denial. You can't verify either way, because none of us can read the document. The scope of the 5% trigger is the genuine disagreement. Every source but one scopes it to merchants with six months or less of Mastercard acceptance history. That again includes the one citing the document reference. Justt lists it as a general merchant trigger applying to everyone. We follow the majority. This page would be badly wrong if the dissenter turns out to be right. **What to do about it:** ask your acquirer which version they apply to you. Their answer governs your account, whatever the network document says. ::: --- ## Refunds count toward SMMP, and toward nothing else Every other network program on this site counts chargebacks. [ECM and HECM](/docs/chargebacks/reference/network-programs) divide chargebacks by the prior month's transactions. EFM looks only at fraud chargebacks, reason codes 4837 and 4863. Visa's VAMP combines fraud reports and disputes. Refunds appear in none of them. So the standard advice when your ratio climbs is simple. Refund faster. Refund on request. Refund pre-emptively through [alerts](/docs/chargebacks/prevention/alerts). That advice is right for ECM and right for VAMP. Every chargeback vendor, every processor risk email and most of this site will tell you so. SMMP adds the two together. In your first six months, the refunds you issue to protect your chargeback ratio land in the same numerator as the chargebacks you avoid. Take a merchant doing 800 purchase transactions in a 30-day window, four months into their Mastercard history: | Scenario | Transactions | Chargebacks | Refunds | Chargeback rate | Combined rate | |---|---|---|---|---|---| | Baseline | 800 | 10 | 28 | 1.25% | 4.75% | | Alert deflection: 6 disputes refunded before they land | 800 | 4 | 34 | 0.50% | 4.75% | | Plus a no-questions refund policy adding 12 goodwill refunds | 800 | 4 | 46 | 0.50% | 6.25% | The first two rows have the same combined rate. The third doesn't. **Deflection is neutral.** Turning a dispute into a refund moves one unit from the chargeback column to the refund column. The combined number doesn't move. RDR, Ethoca and CDRN don't hurt you here. They don't help you here either. A vendor who says their alert product protects you from scam monitoring is selling. **Net new refunds aren't neutral.** The third row is the trap. A 0.50% chargeback ratio is excellent. It clears every threshold on this site with room to spare. It's the number you'd put in a processor email to prove you fixed the problem. And that merchant just crossed the SMMP line. Twelve goodwill refunds they'd never have issued are twelve units of net new numerator. Refunds are the half of that number you fully control. So they're the half you can accidentally blow up. Nobody accidentally issues 12 extra chargebacks. The timing makes it worse. The 5% trigger only lives in your first six months. That's exactly when a new merchant discovers their ratio, panics, and starts refunding everything that moves. The tactic that saves you from ECM starts a 72-hour clock under SMMP. ### Who genuinely runs a high combined rate For most businesses, 5% combined is a long way off. The verticals that sit near it in normal operation: - **Free-trial and trial-to-paid subscriptions.** Cancellation refunds and first-bill disputes stack in the same window. - **Apparel, footwear and anything with sizing.** Return-driven refund rates of 10% to 30% are ordinary retail, and they're all refunds. - **Ticketing and events.** One cancelled event refunds an entire month of sales at once. - **Digital goods and app subscriptions.** Low friction to buy, low friction to regret. - **Anything with a 30-day money-back guarantee** you actually honour. In one of those and under six months old? Watch this number weekly, not quarterly. A high refund rate isn't evidence you're doing anything wrong. It isn't something to stop doing. It just means the trigger sits closer to you than to a hardware store. Be ready to explain your refund pattern in one sentence when your acquirer calls. --- ## The 72-hour window, and what your acquirer actually pulls Once a trigger fires, your acquirer or payfac has to begin investigating within 72 hours. Not resolve it. Begin it. Reported scope of that review: your onboarding file, transaction records, refund behaviour, chargeback documentation, issuer reports against you, website content, billing descriptors and your emails with the acquirer. Acquirers also reportedly check Mastercard's Fraud and Loss Database daily for newly listed scam merchants. If the investigation confirms scam activity, Mastercard and Maestro authorization and clearing get blocked immediately. **The obligation sits on your acquirer. The consequence lands on you.** Mastercard doesn't notify you. There's no merchant-facing portal. There's no documented appeal. You find out when your acquirer emails asking for records, and by then the clock has been running. So every bit of preparation has to happen in advance. Seventy-two hours won't cover assembling a fulfilment archive, rewriting a terms page and pulling customer service logs out of a helpdesk you left last year. --- ## What actually happens to a merchant | Outcome | Does SMMP do this? | |---|---| | Monthly fine | No. No source reports any assessment | | Escalating ladder | No | | Warning tier before enforcement | No. Reported to have no separate warning stage | | Remediation plan with a deadline | No published process | | Documented appeal | None found | | Loss of Mastercard and Maestro acceptance | Yes, if the investigation confirms scam activity | That's the trade. No bill, no negotiation, and no runway either. As one write-up put it, ECM and EFM give you time to fix things and this doesn't. ### The MATCH question You'll see claims that SMMP puts you on the [MATCH list](/docs/chargebacks/match-tmf). One source asserts it. No source documents it. Mastercard's published MATCH reason code table has no scam-specific code. The honest version: a termination for cause after a confirmed scam investigation would land under an existing code. Most plausibly 10 Violation of Standards, 13 Illegal Transactions or 03 Transaction Laundering. That's reasoning about how MATCH works, not a rule anyone has published. Don't let a vendor sell you protection against a listing mechanism nobody can point to. --- ## Fraud code 56, and why one scam complaint counts three times Code 56 is Manipulation of Cardholder. In merchant language: the cardholder really did make the payment, and somebody tricked them into it. The issuer files it into Mastercard's Fraud and Loss Database. It never appears on your statement. You can't see it and you can't dispute it. Mastercard's Chargeback Guide (19 May 2026) says it "encourages" issuers to report scam-related disputes this way. Doing so doesn't invalidate the chargeback itself. "Encourages" matters. Reporting is discretionary. So the two-issuer trigger depends entirely on which banks bother to file. Two banks that do can start a clock on you. Two that don't, can't. It isn't a measure of how bad you are. Now the part that catches people. A scam victim did authorise the payment. Mastercard's cardholder dispute chargeback requires that the cardholder engaged in the transaction. So scam complaints arrive as [4853 Cardholder Dispute](/docs/reference/reason-codes/mastercard/cardholder-dispute) chargebacks, not as fraud codes. One complaint lands in three different places: | Program | Does this scam complaint count? | |---|---| | **ECM and HECM** | Yes. They take any reason code, so a 4853 counts like any other chargeback | | **SMMP and QMAP** | Yes, separately, through the code 56 entry the issuer files into the Fraud and Loss Database | | **EFM** | No. EFM is limited to reason codes 4837 and 4863 | That's why a merchant can run a clean fraud ratio, pass EFM comfortably, and still be the subject of a scam investigation. The two systems read different data. --- ## How SMMP differs from ECM, HECM, EFM and VAMP | Program | What it measures | What it costs | Who acts, and how fast | |---|---|---|---| | **SMMP** | Scam signals: refunds plus chargebacks, approval rate collapse, issuer scam reports | No fine. Acceptance switched off if confirmed | Your acquirer, within 72 hours | | **ECM / HECM** | Chargeback count and ratio, any reason code | $1,000 to $200,000 a month | Mastercard, monthly | | **EFM** | Fraud chargebacks only (4837, 4863) plus 3DS penetration | Escalating assessments | Mastercard, monthly | | **Visa VAMP** | Fraud reports plus disputes combined | Per-dispute fees | Visa, monthly | | **QMAP** | Fraud-to-sales ratio, three of four conditions met | Audit, and MATCH code 08 | Mastercard | One structural point worth having straight. ECM, HECM and EFM all sit inside the Acquirer Chargeback Monitoring Program, or ACMP. SMMP isn't part of ACMP. It lives in the merchant screening and monitoring rules. Different mechanism, different consequence. It runs in parallel and it replaces nothing. Its closest live relative isn't ECM at all. It's QMAP, the Questionable Merchant Audit Program. QMAP is fraud-driven and identified from the same Fraud and Loss Database. One of its four conditions is literally that the merchant has been submitting transactions for fewer than six months. Same six-month concept, same database, same instinct. --- ## Where these numbers come from :::warning[There's no public document, and you should know that before you act on any of this] "SMMP" appears **zero times** across the four current public Mastercard manuals: the Security Rules and Procedures Merchant Edition (3 February 2026), Mastercard Rules (2 June 2026), Transaction Processing Rules (9 December 2025) and the Chargeback Guide (19 May 2026). "GRIP" appears zero times too. All four editions predate 24 July 2026, so that absence refutes nothing. It does mean no document exists that you can read to check any figure on this page. The only reference anywhere is a document number, GLB 12772, cited by exactly one source. No announcement number. No bulletin. No Mastercard-hosted page. Same situation as ECM, HECM, EFM and VAMP. The real thresholds live in acquirer-login manuals and every number in circulation is a relay. SMMP has only been relayed for a few months rather than a few years. So the relays haven't been corrected as often. **What to do about it:** email your acquirer and ask three things. "Do the new Mastercard scam monitoring rules apply to my account?" "Which triggers do you apply to me, and with what minimums?" "If one fires, will you contact me before you act?" Whatever they answer is your operative rule. Their internal thresholds are usually stricter than the network's, and theirs are the ones that end your account. ::: One part of the story is corroborated outside vendor marketing: the effective date. Payments Dive reported on Monday 27 July 2026 that the rules "went into effect Friday". That's a trade publication with a named editor and no product to sell. That Friday was 24 July 2026. Mastercard's own newsroom confirmed the 72-hour investigation duty on 19 May 2026. Everything else on this page is vendor relay. Source tiers used here: VENDOR from Mastercard's own published rules, REPORTED from a named third party with its date and type stated, NOT PUBLISHED where Mastercard doesn't publish it. [How the tier system works](/docs/payments/reference/cost-model-assumptions#how-we-tier-every-figure). --- ## Scale Callout | Volume | Focus | |---|---| | **Under $100k/mo** | If you're under 500 purchase transactions in any 30-day window, the 5% trigger can't fire on you even in month one. Your realistic exposure is an approval rate collapse from a misconfigured gateway. Fix your [billing descriptor](/docs/chargebacks/prevention/descriptors-and-comms), keep fulfilment records somewhere you can export them, and stop worrying about this | | **$100k-$1M/mo** | You're past 500 transactions, so tenure is what decides your exposure. Under six months on Mastercard, track refunds and chargebacks as one combined number weekly and keep it under 5%. Over six months, switch your attention to approval rate monitoring and tell your acquirer before any flash sale, pricing change or gateway migration | | **Over $1M/mo** | Approval rate is the trigger that matters, and at your volume a BIN attack or a bad 3DS rule can drop you 50 points in an afternoon. Alert on approval rate hourly, not daily. Keep a standing evidence pack you can send inside a working day, and give your acquirer a named contact who answers the phone | --- ## Test to Run An hour of work that tells you exactly where you stand. 1. **Pull 30 days of counts.** Purchase transactions, refunds issued, chargebacks received. Calculate `(refunds + chargebacks) / purchase transactions`. That single number is your SMMP exposure. Almost nobody tracks it, because no other program asks for it. 2. **Check your tenure.** Find the date of your first Mastercard transaction on your current MID. Less than six months ago? The number from step 1 has a 5% ceiling on it. More than that, and it doesn't. 3. **Find your worst 72 hours.** Chart daily authorization approval rate for the last 90 days. Look for any 72-hour window with a 50 point drop or a sub-30% reading. Find one and you know what an investigation trigger looks like on your own data. 4. **Read your own descriptor.** Pull a real statement line for a real order. If it doesn't obviously say who you are, some of your "I was tricked" complaints are just people not recognising the charge. Fix that first. It's the cheapest item on this list. 5. **Build the 72-hour pack now.** Fulfilment and delivery records, terms and refund policy as they appeared on the day of sale, customer service logs, and a one-paragraph explanation of your refund pattern. Put it in one folder. If your acquirer calls, you're forwarding a link, not starting a project. 6. **Make the call.** Ask: "Do the new Mastercard scam monitoring rules apply to my account, and which triggers do you apply?" Then: "If one fires, do you contact me before you act?" --- ## Where This Breaks 1. **The scope of the 5% trigger is genuinely disputed.** Every source but one scopes it to merchants under six months old. Justt applies it to everyone. If your acquirer takes the broader reading, that governs your account. The reassurance on this page won't apply to you. 2. **Nobody can read the source.** Every number here is a relay of a document behind an acquirer login. Relays get transcribed wrong. This one has only been in circulation since February 2026. 3. **"Refunds" isn't a clean count.** Partial refunds, order adjustments, refunds issued to resolve an alert, and refunds of already-disputed transactions could each count as one, as a fraction, or not at all. No public source defines the counting rule. Ask your acquirer how they count a partial. 4. **"Six months of Mastercard acceptance history" is undefined.** Per MID, per legal entity, or per acquirer relationship? It matters. A new MID after a [processor switch](/docs/playbooks/processor-switch-checklist) could restart your clock while your business is three years old. Nobody has published the answer. 5. **GRIP's own name is unresolved.** Four SMMP-era sources expand it as Global Rules Investigation Program. A PSP's own documentation, written before any of this, expands it as Global Risk Investigation Program. If you get one of these letters, the process is what matters. You respond within 5 business days, either confirming compliance or supplying an action plan. Assessments for ignoring it are set case by case. 6. **Your acquirer's rules are stricter than the network's.** They always are. A processor that decides scam exposure isn't worth the revenue will offboard you long before Mastercard notices you exist. --- ## Sources {/* #sources */} | Source | What it gave us | Kind | Date | |---|---|---|---| | [Mastercard Security Rules and Procedures, Merchant Edition](https://www.mastercard.com/content/dam/mccom/shared/business/support/rules-pdfs/SPME-Manual.pdf) | The pre-existing acquirer-set approval rate alert (6.2.2.2), the 5-business-day and 15-calendar-day monitoring timetable (8.9.1), QMAP's conditions (8.4), the MATCH reason code table (11.14.1), and a verified zero hits for "SMMP" and "GRIP" | Primary, Mastercard's own published rules | Edition dated 3 February 2026, accessed 2026-08-02 | | Mastercard Chargeback Guide, Merchant Edition | The verbatim code 56 language, that reporting is "encouraged" rather than required, and that a cardholder dispute chargeback requires the cardholder to have engaged in the transaction | Primary, Mastercard's own published rules | Edition dated 19 May 2026, accessed 2026-08-02 | | [Payments Dive](https://www.paymentsdive.com/) | The effective date. Reported Monday 27 July 2026 that the rules "went into effect Friday" | Trade publication with a named editor and no product to sell | 27 July 2026 | | Mastercard newsroom | Confirmation of the 72-hour acquirer investigation duty, under the umbrella name "Merchant Trust Services" | Primary, vendor announcement | 19 May 2026 | | Austreme | The trigger detail and both transaction minimums, plus the only document reference in existence (GLB 12772) and the BIN attack and outage exclusions. **A Mastercard-approved merchant monitoring vendor, so it sells into this program** | Approved vendor blog | 20 February 2026 | | Global Payments Consultants | Independent corroboration of the 24 July date and the 5% combined trigger, plus the absence of any warning tier | Consultancy, not a chargeback vendor | 14 July 2026 | | Solidgate, Chargeback Gurus, Chargeflow, cside, merchanto, Fraudbeat | The six-month scoping of the 5% trigger, the 500 and 25 transaction minimums, and the scope of the acquirer's review. **All sell chargeback or payment services** | Vendor blogs | May to July 2026 | | Justt | The 50 point / 30% approval rate figures, and the dissenting unscoped reading of the 5% trigger. **Sells chargeback services** | Vendor blog | 20 May 2026 | | Nuvei PSP documentation | The GRIP process, the 5-business-day response window, and the alternative expansion of the acronym. Written before SMMP existed, so uncontaminated by it | Vendor documentation | October 2025 | _Last verified: 2 August 2026._ --- ## Next Steps **Just heard the term and want to know if you're exposed?** 1. [Test to Run](#test-to-run) - the one-hour version, above 2. [Refund Strategy](/docs/chargebacks/refund-strategy) - when refunding is right and when it's expensive 3. [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - the cheapest fix on the list **Under six months old on Mastercard?** 1. [Underwriting](/docs/payments/buying-payments/underwriting) - what your acquirer already knows about you 2. [Recurring Billing Compliance](/docs/compliance/subscriptions/recurring-billing) - free trials, cancellations and the rules around them 3. [SMB Prevention Priorities](/docs/chargebacks/prevention/smb-prevention-priorities) - what to do first with limited time **Already in a ratio program?** 1. [Network Programs Reference](/docs/chargebacks/reference/network-programs) - VAMP, ECM, HECM, EFM thresholds 2. [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - the crisis playbook 3. [Processor Warnings](/docs/chargebacks/processor-warnings) - how to answer the email you just got ## See Also - [Network Programs Reference](/docs/chargebacks/reference/network-programs) - the ratio programs and their fines - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - deeper VAMP and ECM coverage - [The merchant blacklist (MATCH)](/docs/chargebacks/match-tmf) - the blacklist and its reason codes - [Refund Strategy](/docs/chargebacks/refund-strategy) - refund versus fight, by ticket size - [Refund Policy Design](/docs/chargebacks/refund-policy) - writing a policy that holds up as evidence - [4853 Cardholder Dispute](/docs/reference/reason-codes/mastercard/cardholder-dispute) - the code scam complaints arrive under - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca and CDRN, and what they don't cover - [Chargeback Metrics](/docs/chargebacks/metrics) - tracking ratios that actually matter - [Processor Management](/docs/operations/processor-management) - running the acquirer relationship - [Holds and Reserves](/docs/operations/holds-and-reserves) - what happens to your money when risk gets nervous - [Refund Fraud](/docs/fraud/types/refund-fraud) - when the refunds aren't yours to control - [Mastercard Network Reference](/docs/reference/card-networks/mastercard) - rules, codes and program overview --- ## Refund Policy Design Source: https://paymentsandrisk.com/docs/chargebacks/refund-policy # Refund Policy Design :::info[TL;DR] - A refund costs ~3% (lost interchange); a chargeback costs $50+ in fees plus ratio damage, so refunding proactively almost always wins the math, and you'll see it in the ratio - Make your refund policy impossible to miss: checkout, confirmation emails and receipts. What they can see, they don't dispute - No-questions-asked refunds within 30 days stop the majority of "I don't want it" chargebacks without enabling significant abuse - Restrictive policies backfire: customers who can't get a refund go directly to their bank, and banks almost always side with cardholders on service disputes ::: A generous refund policy prevents [chargebacks](/docs/chargebacks). A too-generous one invites [abuse](/docs/fraud/types/refund-fraud). The math: a refund costs you ~3% ([interchange](/docs/payments/reference/interchange) you don't get back). A [chargeback costs](/docs/chargebacks/metrics) $50+ in fees, plus ratio damage, plus operational time. Refund generously and still come out ahead. Most merchants are too stingy with refunds and too slow to process them. That's where the [chargebacks](/docs/chargebacks/lifecycle) come from. ## What Matters 1. **Refund cost < chargeback cost.** Always. Math doesn't lie. 2. **Easy refunds prevent disputes.** If customers can get money back easily, they don't call their bank. 3. **Cancellation friction causes chargebacks.** If they can't cancel, they dispute. 4. **Support team is your first line.** Empowered support prevents escalation. 5. **Policy clarity prevents disputes.** Customers who understand terms don't feel tricked. --- ## The Refund vs. Chargeback Math | Outcome | Cost to Merchant | |---------|------------------| | **Refund** | ~3% of transaction (interchange not returned) + operational time | | **Chargeback (lost)** | Full transaction amount + a $0-30 fee, typically $15 + ratio impact + operational time | | **Chargeback (won)** | Operational time + ratio impact, plus the fee unless your processor refunds it. Helcim, Shopify Payments and PayPal's standard tier don't charge it on a win. Stripe and Toast do | A refund almost always costs less than a chargeback. It isn't close on most ticket sizes. For the worked dollar math, see the [Refund Strategy](/docs/chargebacks/refund-strategy#the-math-refund-vs-fight) field manual. --- ## When to Refund vs. Fight Refund anything under $25. Fight anything over $500 if you've got strong evidence. Everything in between comes down to evidence quality, reason code and customer history. See the [decision flowchart](/docs/chargebacks/refund-strategy#decision-flowchart) and [triage grids](/docs/chargebacks/refund-strategy#refund-vs-fight-grid) for the full framework. --- ## Customer Support as Risk Control Your support team prevents more chargebacks than any fraud tool. A customer who can reach you doesn't need to call their bank. **Key setup:** Give support agents authority to refund without escalation. Respond within 2 minutes on phone, 1 minute on chat, 4 hours on email. If your response time is measured in days, they'll go to their bank instead. See the [Refund Strategy](/docs/chargebacks/refund-strategy#support-as-risk-control) for refund authority thresholds by volume, response time SLAs, and sample scripts that prevent chargebacks. --- ## Making Cancellation Easy Hard-to-cancel subscriptions cause chargebacks. California, New York, and FTC rules increasingly require easy cancellation. Beyond compliance, it's good business. ### Cancellation Checklist - [ ] Cancellation available in account settings (not just "contact support") - [ ] Works on mobile - [ ] Takes less than 3 clicks - [ ] Confirmation email sent immediately - [ ] No dark patterns (hidden buttons, guilt-trip messaging) - [ ] No mandatory "retention call" ### What Happens After Cancellation | Timing | Good Practice | |--------|---------------| | Immediately | Stop access and billing | | Within 1 hour | Send confirmation email | | Within 24 hours | Confirm no future charges scheduled | **Never** charge after cancellation. "Your billing cycle ends on [date]" invites a dispute if they've forgotten. ### Cancellation Proof When cancellation happens, log: - Timestamp - IP address - Account identifier - Cancellation method (self-service vs. support) - Confirmation number sent You'll need this if they claim they cancelled and you kept charging. ### Subscription Dispute Prevention Checklist Subscription chargebacks are the most preventable type. Set up these systems: **Cancellation proof (collect at time of cancellation):** - Email confirmation with timestamp ("Your subscription was cancelled on [date] at [time]") - Database record of the cancellation request with IP and timestamp - Keep both for at least 540 days (covers all network dispute windows) **Renewal reminders (send before each charge):** - Send 7 days before renewal: "Your [plan] renews on [date] for [$amount]" - Include one-click cancel link in the reminder email - Send confirmation after successful charge: "You were charged [$amount] for [plan]" **Cancellation flow requirements:** - Must be completable in under 3 clicks from account settings - Must work on mobile - No "call to cancel." This generates disputes, not loyalty - Stop charging immediately on cancellation, not "end of billing period" - Send cancellation confirmation email within 5 minutes --- ## Policy Clarity Ambiguous policies invite disputes. Clear policies set expectations. ### Refund Policy Essentials | Element | Why | |---------|-----| | **Time limit** | "Refunds available within 30 days" | | **Condition requirements** | "Item must be unused and in original packaging" | | **Process** | "Contact support or use self-service portal" | | **Timeline** | "Refunds processed within 5 business days" | | **Exceptions** | "Final sale items are not eligible for refund" | ### Where Policy Must Appear 1. Product page (near buy button) 2. Checkout page (before payment) 3. Confirmation email (after purchase) 4. Help center (searchable) 5. Account settings (for subscriptions) ### Policy Language That Works **Clear:** "Full refund within 30 days, no questions asked." **Unclear:** "Refunds may be available subject to our discretion and applicable terms." The first version sets expectations. The second invites arguments. --- ## Void vs. Refund If a customer requests money back before the transaction settles, void instead of refund. ### Void vs. Refund Comparison | Void | Refund | |------|--------| | Before settlement (usually same day) | After settlement | | Authorization cancelled | New credit transaction | | No interchange paid | Interchange not returned | | Cleaner for customer (no charge appears) | Charge and credit both appear | ### When to Void - Customer cancels order same day - Duplicate transaction caught immediately - Wrong amount charged (void and re-auth correctly) :::note[Ask Your Dev] "Can our support team void transactions before settlement? How do they access this?" ::: **Related:** [Auth and Capture](/docs/payments/auth-and-capture) for void mechanics. --- ## Return Fraud Prevention Generous refund policies attract abusers. Balance generosity with fraud controls. ### Common Abuse Patterns | Pattern | Detection | Response | |---------|-----------|----------| | **Wardrobing** (buy, use, return) | Tags removed, signs of use | Partial refund or deny | | **Return to different address** | Shipping address doesn't match purchase | Flag for review | | **Serial returner** | High return rate for customer | Limit future orders | | **Empty box** | Package weight mismatch | Require photo, deny refund | | **Swap** (return different item) | SKU mismatch, photo evidence | Deny, document for pattern | ### Prevention Measures | Measure | Impact | |---------|--------| | Return limits (3 per 90 days) | Reduces serial returners | | Restocking fee for opened items | Deters wardrobing | | Photo requirement for damaged claims | Reduces false claims | | Loyalty tier for unlimited returns | Rewards good customers | | Device fingerprinting across accounts | Catches multi-account abusers | ### Balance: Prevention vs. Friction Overly aggressive fraud prevention hurts legitimate customers: - Too many verification steps = abandoned returns = chargebacks - Denying too many refunds = bad reviews + chargebacks - Treating everyone as fraudster = customer loss **Rule:** Make refunds easy for most, add friction only for flagged accounts. --- ## Test to Run **30-day refund policy audit:** **Week 1: Baseline** - Calculate current refund rate and chargeback rate - Review support ticket volume for refund requests - Time how long refunds take to process - Audit cancellation flow UX **Week 2-3: Implement** - Increase support refund authority threshold - Simplify cancellation to 3 clicks - Add policy preview to checkout - Reduce refund processing time **Week 4: Measure** - Compare chargeback rate to baseline - Compare refund rate to baseline - Calculate net impact **Success criteria:** Refunds may increase, but chargebacks should decrease by more. Net cost should be lower. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Generous refund policy. Empower support to refund up to $50 without approval. Easy cancellation. | | **$100k-$1M/mo** | Refund vs. fight decision framework. Return fraud monitoring. Support SLA tracking. | | **Over $1M/mo** | Automated refund processing. Abuse detection system. Tiered customer treatment based on history. | --- ## Where This Breaks 1. **High-value physical goods with resale market.** Electronics, luxury items. Returns get resold, so you need stricter verification that doesn't cost you legitimate customers. 2. **Subscription boxes with upfront costs.** If you ship a $50 box and they dispute after receiving it, you've lost product and money. Consider deposit or prepay models. 3. **Digital goods with no "return."** You can't undownload a file. Refund policy needs to account for immediate delivery. Consider delayed delivery for high-risk transactions. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Refund rate** | Customer satisfaction indicator | < 5% of transactions | | **Chargeback rate** | Prevention effectiveness | < 0.5% | | **Refund-to-chargeback ratio** | Are you refunding enough? | Refunds should be 3-5x chargebacks | | **Time to refund** | Process efficiency | < 3 days | | **Return fraud rate** | Abuse level | < 1% of refunds | | **Cancellation-to-dispute ratio** | Is cancellation easy enough? | Most should cancel, few should dispute | ### Healthy Ratios If your refunds are low and chargebacks are high, you're not refunding enough. If your refunds and chargebacks are both high, you have a product or expectation problem. --- ## Next Steps **Setting up refund policy?** 1. [Review cost comparison](#the-refund-vs-chargeback-math) - Refund vs. chargeback math 2. [Set support thresholds](/docs/chargebacks/refund-strategy#empowered-refund-authority) - Refund authority limits 3. [Fix cancellation flow](#making-cancellation-easy) - Easy cancellation checklist **Deciding refund vs. fight?** 1. [Use the decision flowchart](/docs/chargebacks/refund-strategy#decision-flowchart) - Amount-based routing 2. [Check reason code win rates](/docs/chargebacks/refund-strategy#by-dispute-reason) - Reason code guidance 3. [Consider customer history](/docs/chargebacks/refund-strategy#by-customer-history) - Repeat behavior **Preventing refund abuse?** 1. [Identify abuse patterns](#common-abuse-patterns) - Wardrobing, empty box 2. [Implement prevention measures](#prevention-measures) - Limits, restocking fees 3. [Track abuse metrics](#analyst-layer-metrics-to-track) - Return fraud rate --- ## Related Pages - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund vs. fight - [Refund Fraud](/docs/fraud/types/refund-fraud) - Abuse patterns and prevention - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention strategies - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution - [Representment](/docs/chargebacks/representment) - Fighting disputes - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response - [Auth and Capture](/docs/payments/auth-and-capture) - Void mechanics - [Subscriptions and Recurring](/docs/payments/subscriptions-recurring) - Recurring billing - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Tracking abusers - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Detecting abuse patterns --- ## chargebacks/refund-strategy.md Source: https://paymentsandrisk.com/docs/chargebacks/refund-strategy # Refund Strategy (Operator Field Manual) :::info[TL;DR] - Refund vs. fight is a math problem, not a policy debate - Under $25: always refund. Over $500: fight with evidence. In between: use the grid below. - Fast refunds prevent chargebacks. A refund costs ~3% of the transaction. A chargeback costs $50-175+. - Customer support is your best fraud prevention tool. Empower agents to refund without escalation. - Track refund-to-chargeback ratio. Healthy is 3-5 refunds for every 1 chargeback. ::: Cold reality: refund fast when it's cheaper than a chargeback, fight when evidence is strong, and route edge cases by ticket size and business model. ## The Math: Refund vs. Fight Every refund-or-fight decision comes down to expected value. Here's the calculation: ``` Expected cost of refunding = Transaction amount x ~3% (interchange not returned) + Staff time to process (~$2-5) Expected cost of fighting = (1 - Win rate) x Transaction amount + Chargeback fee ($15 typical, $0-30 published range) + Staff time to build evidence pack (~$20-50) + Ratio damage (hard to quantify, real) ``` ### Worked Examples **$30 order, fraud claim, no 3DS:** | Action | Math | Total Cost | |--------|------|-----------| | Refund | $30 x 3% + $3 staff time | **$3.90** | | Fight (25% win rate) | 75% x $30 + $15 fee + $25 evidence work | **$62.50** | Refund. Not even close. These examples use a **$15** chargeback fee, which is what most US processors publish ([verified table](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated)). On Stripe, fighting costs $30, because Stripe charges $15 to receive the dispute and another $15 to counter it. On Helcim or Square the fee line is $0. Swap in your own number before you act on any of this. **$200 order, "not received," tracking confirms delivery:** | Action | Math | Total Cost | |--------|------|-----------| | Refund | $200 x 3% + $3 staff time | **$9** | | Fight (70% win rate) | 30% x $200 + $15 fee + $30 evidence work | **$105** | But if you win (70% chance), you keep $200 and only pay $45 in fees and time. Expected value of fighting = (0.70 x $200) - $45 = **$95 net positive**. Fight. **$150 order, "not as described," no photos:** | Action | Math | Total Cost | |--------|------|-----------| | Refund | $150 x 3% + $3 staff time | **$7.50** | | Fight (20% win rate) | 80% x $150 + $15 fee + $30 evidence work | **$165** | Expected value of fighting = (0.20 x $150) - $45 = **-$15**. Refund. ## Decision Flowchart :::note[Three Complementary Decision Axes] This framework focuses on **dollar amount and evidence strength**. For the reason-code decision, see [Chargebacks Overview](/docs/chargebacks). For 3DS liability considerations, see [Representment](/docs/chargebacks/representment). ::: ```mermaid flowchart TD A[Dispute received] --> B{Amount?} B -->|Under $25| C[Refund immediately] B -->|$25-$100| D{Strong evidence?} B -->|$100-$500| E{Strong evidence?} B -->|Over $500| F{Any evidence?} D -->|No| C D -->|Yes| G{Win rate >50%for this reason code?} G -->|No| C G -->|Yes| H[Fight] E -->|No| I{Customer history?} E -->|Yes| H I -->|First dispute| C I -->|Repeat disputer| H F -->|No| J[Refund butinvestigate] F -->|Yes| H style C fill:#22c55e,color:#fff style H fill:#ef4444,color:#fff style J fill:#f59e0b,color:#fff ``` ## Refund vs. Fight Grid ### By Ticket Size | Amount | Default | Exception | Reasoning | |--------|---------|-----------|-----------| | **Under $25** | Always refund | None. | Fee alone exceeds the transaction. | | **$25-$50** | Refund | Fight only with delivery proof + fraud claim | Staff time to fight exceeds potential recovery. | | **$50-$100** | Usually refund | Fight with strong evidence AND high win-rate reason code | Break-even zone. Evidence quality decides. | | **$100-$500** | Evaluate evidence | Fight with strong evidence; refund if evidence is weak | Worth the effort when evidence is solid. | | **Over $500** | Fight with evidence | Refund only if zero evidence exists | Almost always worth attempting. | ### By Business Model | Type | Refund Bias | Why | What Changes the Calculus | |------|-------------|-----|--------------------------| | **Digital goods** | High | No physical delivery proof; hard to prove customer received it | Device fingerprint matching (CE 3.0) or download logs | | **Physical goods** | Low | Shipping confirmation and tracking are strong evidence | Missing or ambiguous tracking weakens your case | | **Services** | Medium | Subjective "quality" claims are hard to disprove | Signed contracts, completion photos, or time logs help | | **Subscriptions** | High | Cancellation-related disputes are hard to win without clear proof | Timestamped cancellation logs, confirmation emails, renewal notices | ### By Dispute Reason | Reason | Default | Win Rate | Notes | |--------|---------|----------|-------| | "I don't recognize this" | Refund | 5-15% | This is a billing descriptor problem. Fix the descriptor; don't waste time fighting. | | "I cancelled" | Refund unless proof exists | 20-40% | Cancellation timestamp + confirmation email wins this. Without those, refund. | | "Product not as described" | Evaluate | 15-30% | Product photos, specs, and terms help. Subjective claims are hard. | | "Never received" | Fight with tracking | 60-80% | Tracking to billing address is strong evidence. This is your most winnable category. | | "Duplicate charge" | Verify and refund if true | N/A | Easy to confirm. If it's actually a duplicate, refund immediately. | | "Fraud" | Fight with CE 3.0 data | 10-25% (no 3DS), 50-70% (with 3DS/CE) | Device match, 3DS authentication, or Visa CE 3.0 data makes this winnable. | ### By Customer History | History | Approach | Reasoning | |---------|----------|-----------| | First-time customer | Lean toward refund | Preserve the relationship. A refund might earn a repeat customer. | | Repeat customer, first dispute | Refund + benefit of doubt | Good customers have bad days. Don't punish loyalty for one incident. | | Customer with 2+ prior disputes | Evaluate carefully, document pattern | Possible [friendly fraud](/docs/fraud/types/friendly-fraud) abuser. | | Known abuser (3+ disputes) | Fight and document | Build a pattern file. Consider blocking from future purchases. | ## Support as Risk Control Your support team prevents more chargebacks than any fraud tool. A customer who can reach you doesn't need to call their bank. ### Empowered Refund Authority Give support agents authority to refund up to a threshold without manager approval: | Volume | Suggested Threshold | Why | |--------|--------------------|----| | Under $100K/month | $50 per refund | Covers most small-ticket issues instantly | | $100K-$500K/month | $100 per refund | Matches typical order value | | $500K-$1M/month | $150 per refund | Reduces escalation queue | | Over $1M/month | $200+ per refund | Speed at scale | **The math:** If an agent refunds a $75 order that would have become a chargeback, you saved ~$70 (the chargeback fee + staff time for representment - the refund's interchange cost). Every "unnecessary" refund that prevents a chargeback is a net positive. ### Response Time SLAs | Channel | Target | Why This Matters | |---------|--------|-----------------| | Phone | Under 2 minutes hold | Calling the bank takes 3 minutes. Beat them to it. | | Live chat | Under 1 minute | Same urgency as phone. | | Email | Under 4 hours | Before the customer gives up and disputes. | | Social media | Under 2 hours | Public complaints escalate fast. | If your response time is measured in days, customers go to their bank instead. Every day of delay increases the probability of a chargeback. ### Scripts That Prevent Chargebacks **"I don't recognize this charge":** > "I can see the charge you're asking about. It's from your order on [date] for [item], and it shows on your statement as [descriptor]. I can send you a copy of the receipt. Would you like a refund, or does that clear things up?" **"I want to cancel":** > "Done. I've cancelled your subscription effective immediately. You won't be charged again. Your confirmation number is [number]. Is there anything else?" **"This isn't what I expected":** > "I'm sorry to hear that. I can process a full refund right now, or if you'd prefer, I can send a replacement. What works best for you?" The pattern: acknowledge the problem, offer a solution, execute immediately. No transfers, no hold music, no "let me check with my manager." ## Seasonal Adjustments Refund strategy isn't static. Adjust thresholds based on seasonal patterns: | Season | Adjustment | Why | |--------|-----------|-----| | **Nov-Dec (holiday)** | Raise refund threshold by 50% | Gift purchases, higher returns, "I didn't order this" from gift recipients | | **Jan (post-holiday)** | Keep elevated for 30 days | Returns peak in January; chargebacks from holiday purchases start arriving | | **Major sale events** | Temporarily raise refund authority | Volume spike + impulse purchases = more buyer's remorse | | **Subscription renewal dates** | Staff up support | Renewal batch = spike in "I cancelled" complaints | ## Test to Run **Refund threshold experiment:** 1. Calculate your current average chargeback cost (fee + staff time + lost transaction amount x loss rate). 2. For the next two weeks, refund any dispute request under that amount immediately, no questions asked. 3. Track: number of refunds issued, number of chargebacks received, total cost of refunds vs. estimated cost of chargebacks those refunds prevented. 4. After two weeks, compare your chargeback count to the prior two-week period. **Success criteria:** Chargebacks decrease by more than refunds increase (in dollar terms). If they don't, your chargebacks aren't coming from refund-preventable scenarios, and you need to look at fraud rules or billing descriptors instead. ## Metrics to Track | Metric | What It Tells You | Target | Red Flag | |--------|-------------------|--------|----------| | **Refund rate** | Overall return/refund volume | Under 5% | Over 8% suggests product or expectation issue | | **Refund-to-CB ratio** | Are you refunding enough to prevent disputes? | 3-5:1 | Under 2:1 means disputes are filling the gap | | **Time to refund** | How fast you process | Under 3 business days | Over 7 days = customers give up and dispute | | **Win rate by reason code** | Where fighting pays off | Varies by code | Below 20% on any code = stop fighting that category | | **Cost per chargeback** | True all-in cost including staff time | Track, don't target | Use to calibrate your refund threshold | ### The Monthly Refund Review Once a month, spend 15 minutes on this: 1. **Pull your refund-to-chargeback ratio.** If it's under 3:1, you're probably not refunding enough. 2. **Check win rate by reason code.** Stop fighting categories where you win less than 20%. 3. **Review your top 5 refund reasons.** Are they product issues, shipping issues, or billing confusion? Each has a different fix. 4. **Spot-check 5 chargebacks that were previously refund requests.** These are failures - the customer asked for a refund, didn't get one (or got it too slowly), and disputed instead. Fix the process. 5. **Update your refund threshold.** If your average chargeback cost has changed (new processor fees, different win rates), recalculate the break-even point. ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100K/month** | Default to refund under $100 unless high-risk pattern. Document cancellations. Empower one person to issue refunds same-day. | | **$100K-$500K/month** | Add reason-code routing. Implement renewal reminder emails for subscriptions. Capture delivery proof on all physical goods. Track refund-to-CB ratio monthly. | | **$500K-$1M/month** | Dedicated dispute owner. Evidence packs by reason code. Alert on ratio approaching 0.75%. Seasonal threshold adjustments. | | **Over $1M/month** | Automated refund processing for low-ticket items. Abuse detection on serial refunders. Tiered customer treatment based on history. Real-time chargeback ratio monitoring. | ## Where This Breaks - **No cancellation proof for subscriptions.** Add renewal reminders, cancellation confirmation emails, and timestamp logs. Without these, every "I cancelled" dispute is a loss. - **Partial shipments or backorders without customer communication.** If the customer ordered 3 items and you shipped 2, tell them before they assume you shorted them. - **Refund promises without follow-through.** Support says "we'll refund you" but finance never processes it. The customer waits a week, then disputes. Track refund fulfillment rate. - **International shipping with weak delivery confirmation.** Domestic tracking that shows "delivered" wins cases. International tracking that shows "in transit to destination country" does not. Use a carrier with delivery confirmation in the destination country, or accept higher refund rates on international orders. - **"No refund" policies on digital goods.** A strict no-refund policy doesn't prevent chargebacks; it causes them. The customer's bank doesn't care about your policy. Offer refunds within a reasonable window (24-48 hours for digital goods) and your chargeback rate will drop. ## Next Steps **Setting up triage grid?** 1. [Apply the decision flowchart](#decision-flowchart) - Route by amount and evidence 2. [Implement by scale](#scale-callout) - Right-sized for your volume 3. [Track monthly metrics](#the-monthly-refund-review) - 15-minute monthly check **Empowering support?** 1. [Set refund authority thresholds](#empowered-refund-authority) - Agents refund without escalation 2. [Set response time SLAs](#response-time-slas) - Beat the bank 3. [Use the scripts](#scripts-that-prevent-chargebacks) - Consistent, fast resolution **Fighting specific disputes?** 1. [Check reason codes](/docs/reference/reason-codes) - What evidence defeats each 2. [Build evidence packs](/docs/chargebacks/representment/compelling-evidence) - By reason code 3. [Follow representment guide](/docs/chargebacks/representment) - Full workflow --- ## Related - [Refund Policy Design](/docs/chargebacks/refund-policy) - Policy design and customer-facing language - [Refund Fraud](/docs/fraud/types/refund-fraud) - Abuse patterns and prevention - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes - [Winning Evidence](/docs/chargebacks/winning-evidence) - Fighting chargebacks - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence types by reason code - [Representment](/docs/chargebacks/representment) - Full representment guide - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Fraud Metrics](/docs/fraud/metrics) - Fraud rate tracking - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Subscription refund scenarios - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Reason Codes](/docs/reference/reason-codes) - Understanding dispute types - [Experimentation](/docs/reference/experimentation) - Testing approaches - [Alerts Configuration](/docs/operations/alerts-configuration) - Setting up alerts - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence --- ## What Proof Card Networks Accept (Compelling Evidence) Source: https://paymentsandrisk.com/docs/chargebacks/representment/compelling-evidence # What Proof Card Networks Accept (Compelling Evidence) :::info[TL;DR] - **Evidence strength ranking**: [3DS](/docs/fraud/prevention/3ds) (+40-60% [win rate](/docs/chargebacks/metrics)) > Signed delivery (+30-40%) > Prior undisputed txns (+25-35%) > AVS+CVV (+15-25%) - **Visa CE 3.0**: 2+ prior undisputed transactions, 120+ days old, matching 2 of 4 elements (IP, device, address, account) - one MUST be IP or device ID - **Mastercard**: Include `COMP EVID` in DE 72; need signed receipt, delivery confirmation, or correspondence - **Amex**: Respond within 20 days (not 30); use Amex portal - Before building evidence packets: call 5 customers who disputed and understand the root cause ::: :::info[This Page vs. Winning Evidence] **This page** is the *reference checklist*: what evidence each network requires, CE 3.0 specs, submission deadlines, and format standards. **[Winning Evidence](/docs/chargebacks/winning-evidence)** is how to think about it: what issuers actually look at, how to organize a response, and what people get wrong. That one's strategy, this one's the checklist. ::: Compelling evidence is the proof you send back when you fight a chargeback: documentation that shows the cardholder participated in or benefited from the transaction. Before you build [evidence packets](/docs/operations/representment-workflow), understand WHY you're losing. Evidence quality matters less than root cause. ## Feedback Loop: Talk to Customers First Pull 5 recent disputes you lost. Call or email the cardholder. **Questions to ask:** - "Walk me through what happened after you placed the order." - "When did you first think something was wrong?" - "Did you contact us before disputing?" **What you'll learn:** - If it's descriptor confusion: you have a recognition problem, not an evidence problem (see [descriptors and comms](/docs/chargebacks/prevention/descriptors-and-comms)) - If it's shipping delays: you have a fulfillment problem - If the customer is lying: you have a [friendly fraud](/docs/fraud/types/friendly-fraud) problem (fight these) - If the customer genuinely didn't receive value: you have a product/service problem 5 conversations tell you whether it's a representment problem or a root cause problem. Then you know where to invest. :::tip[Evidence Experiment] For a month, add delivery photos to 50% of "goods not received" packets. Track the win rate difference. If it doesn't move, stop, your time's better spent elsewhere. ::: ## Evidence Hierarchy Not all evidence is equal. Here's the general strength ranking: | Evidence Type | Strength | Win Rate Impact | |--------------|----------|-----------------| | [3D Secure](/docs/fraud/prevention/3ds) authentication | Strongest | +40-60% | | Signed delivery confirmation | Strong | +30-40% | | Prior undisputed transactions | Strong | +25-35% | | [AVS match + CVV match](/docs/fraud/prevention/avs-cvv) | Medium | +15-25% | | Customer communication | Medium | +10-20% | | IP/[device](/docs/fraud/detection/device-fingerprinting) match only | Weak | +5-10% | :::info[What Counts as "Signed Delivery"?] - **Carrier signature:** FedEx, UPS, or USPS signature confirmation (the strongest proof) - **Photo proof of delivery:** Amazon-style photo showing package at the door with visible address. Accepted by most issuers but weaker than signature - **Carrier delivery confirmation without signature:** Shows "Delivered" with date and time. It's the minimum standard, and it won't always win over $100 - **For high-value items ($500+):** Always require signature confirmation. Photo delivery alone won't win these disputes. ::: --- ## Mastercard Compelling Evidence ### E-commerce / Mail Order / Telephone Order You need **at least one** of the following: | Evidence Type | Description | Documentation | |--------------|-------------|---------------| | **Signed receipt** | Receipt or work order signed by cardholder | Scanned copy with signature visible | | **Delivery confirmation** | Written confirmation of electronic delivery registration | Carrier confirmation + registration | | **Correspondence** | Email, SMS, or chat with cardholder about the transaction | Full conversation thread with timestamps | | **Pickup confirmation** | Merchant statement documenting in-store pickup | Pickup receipt with signature/ID | | **Authenticated follow-on** | For partial shipments after authenticated initial transaction | Original auth + subsequent transaction link | **Message text:** Include `COMP EVID` in DE 72 ### Registered Account Purchases When your site requires account registration, you can use: | Evidence Type | Description | |--------------|-------------| | **Purchase history** | Other undisputed purchases from same registered account | | **Device/IP match** | Transaction from registered device and IP address | | **Delivery proof** | Signed proof of delivery to registered address | | **Digital delivery** | Email addresses used for digital downloads | | **Product registration** | Cardholder registered goods for warranty/updates | | **Usage proof** | Evidence disputed goods were used | | **Identity Check** | Fully enabled Identity Check used for PAN registration | :::warning[Guest Checkout] This defense does **NOT** apply to guest [checkout](/docs/payments/checkout-conversion) purchases. Customer must have created an account before the transaction. ::: ### Airline Transactions You need **at least one** of: | Evidence Type | Description | |--------------|-------------| | **Boarding documents** | Flight ticket or boarding pass with passenger name | | **Manifest** | Flight manifest or itinerary with passenger name | | **Connected charges** | Upgrades, baggage fees, in-flight purchases | | **ID linkage** | Passenger ID documentation linked to cardholder | | **Loyalty credits** | Frequent flyer miles credited for the flight | | **Ticket delivery** | Proof of ticket receipt (signed delivery, email confirmation) | ### Recurring / Subscription Transactions For [recurring and subscription](/docs/payments/subscriptions-recurring) transactions, you need **ALL** of these: 1. โœ… Description of goods/services provided 2. โœ… Start date with: - Original transaction [authorization](/docs/payments/reference/authorization-basics) date - Authorization approval code - CIT value (if present) 3. โœ… Proof transaction was properly identified as recurring in both authorization and [clearing](/docs/payments/settlement) ### Gaming Payment Transactions When cardholder disputes funding but received payouts: | Required Per Gaming Payment | |----------------------------| | Date of each Gaming Payment Transaction | | Switch Serial Number or ARN | | Transaction amount | --- ## Visa Compelling Evidence 3.0 Visa's CE 3.0 program provides enhanced representment for merchants with customer history. ### CE 3.0 Requirements To qualify: 1. **Two prior undisputed transactions** with same payment credentials 2. **Between 120 and 365 days before** the disputed transaction 3. **Matching data elements** - at least **two of four**, and **one must be IP Address or Device ID**: | Data Element | Description | Required? | |-------------|-------------|-----------| | IP Address | Same IP as prior undisputed transactions | At least one of these two is mandatory | | Device ID | Same device fingerprint | At least one of these two is mandatory | | Shipping Address | Same shipping address | Optional (cannot be the only two matches) | | User Account ID | Same customer account | Optional (cannot be the only two matches) | :::warning[IP or Device ID Is Mandatory] You can't qualify for CE 3.0 on Shipping Address + User Account ID alone. At least one of the two matching elements **must** be IP Address or Device ID/fingerprint. ::: ### CE 3.0 Process Flow ```mermaid flowchart TD A[Chargeback Received] --> B[Check Prior Transactions] B --> C{2+ undisputed120+ days old?} C -->|No| STD1[Standard Representment] C -->|Yes| D[Check Matching Elements] D --> E{2+ of 4 match?IP, Device, Address, Account} E -->|No| STD2[Standard Representment] E -->|Yes| F[CE 3.0 Eligible] F --> G[Submit Evidence] G --> H[Enhanced Protection] style A fill:#8b5cf6,color:#fff style F fill:#10b981,color:#fff style H fill:#10b981,color:#fff style STD1 fill:#6b7280,color:#fff style STD2 fill:#6b7280,color:#fff ``` ### CE 3.0 Benefits - Pre-arbitration liability protection - Higher win rates (70-85%) - Faster resolution - Reduced dispute costs ### Standard Visa Compelling Evidence For disputes not qualifying for CE 3.0: | Evidence Type | When to Use | |--------------|-------------| | Signed delivery | Physical goods delivered | | Access logs | Digital goods accessed | | Customer correspondence | Email/chat showing acknowledgment | | AVS/CVV match | Address and CVV verification | | Prior transactions | Same card, undisputed | --- ## American Express Requirements ### Fraud Disputes (F Codes) | Evidence Type | Effectiveness | |--------------|---------------| | SafeKey ([3DS](/docs/fraud/prevention/3ds)) authentication | Highest - [liability shift](/docs/fraud/reference/emv-liability) | | Delivery confirmation | High | | Customer verification records | Medium | | [AVS](/docs/fraud/prevention/avs-cvv) match documentation | Medium | ### Service/Merchandise Disputes (C Codes) | Evidence Type | Effectiveness | |--------------|---------------| | Signed service completion | High | | Delivery with signature | High | | Terms and conditions accepted | Medium | | Quality documentation | Medium | ### Amex Response Requirements - Respond within **20 days** (not 30 like Visa/MC) - see [time frames](/docs/reference/time-frames) - Use Amex merchant portal - Include Amex case number - Provide required evidence per [reason code](/docs/reference/reason-codes/amex) --- ## Evidence Quality Standards ### Document Requirements All documentation must be: - โœ… **Legible** - Clear and readable - โœ… **Complete** - All pages, not truncated - โœ… **Relevant** - Specific to disputed transaction - โœ… **Properly identified** - With transaction reference ### PAN Handling Per [PCI DSS](/docs/compliance/pci-dss) requirements: - **Show only last 4 digits** of card number - **Mask full PAN** in all documents - **Match visible digits** to dispute ### Language Requirements | Network | Requirement | |---------|-------------| | Mastercard | English translation for arbitration | | Visa | English preferred | | Amex | English required | ### Submission Deadlines These are **documentation submission** deadlines: how long you've got to provide supporting evidence after filing. The total representment window is longer (Visa 30 days, Mastercard 45 days, Amex 20 days), so don't confuse the two. See [Time Frames](/docs/reference/time-frames) for the full breakdown. | Network | Documentation Window | |---------|---------------------| | Mastercard | 8 calendar days (10 for ATM/Maestro) | | Visa | 18 calendar days | | Amex | 10 calendar days | --- ## Evidence by Dispute Type ### [Fraud Disputes](/docs/fraud/types) | Priority | Evidence | |----------|----------| | 1 | [3D Secure](/docs/fraud/prevention/3ds)/SafeKey authentication data | | 2 | [AVS + CVV](/docs/fraud/prevention/avs-cvv) match | | 3 | Delivery confirmation to verified address | | 4 | Prior undisputed transactions (same card) | | 5 | [Device fingerprint](/docs/fraud/detection/device-fingerprinting) match | | 6 | Customer correspondence | ### Non-Receipt Disputes | Priority | Evidence | |----------|----------| | 1 | Signed delivery confirmation | | 2 | Tracking showing delivered to billing address | | 3 | Photo proof of delivery | | 4 | Digital access logs | | 5 | Download confirmation | ### Not-As-Described Disputes | Priority | Evidence | |----------|----------| | 1 | Product listing as shown to customer | | 2 | Terms and conditions accepted | | 3 | Customer communications (pre-sale) | | 4 | Inspection/return refusal documentation | | 5 | Quality specifications met | ### Credit Not Processed | Priority | Evidence | |----------|----------| | 1 | Proof credit was issued (with ARN) | | 2 | Credit pending notification | | 3 | Terms showing refund not applicable | | 4 | Return not received | --- ## Common Mistakes ### Documentation Errors | Mistake | Impact | |---------|--------| | Wrong transaction referenced | Automatic loss | | Illegible copies | Evidence rejected | | Missing pages | Incomplete case | | Late submission | Time frame expired | | No English translation | Rejected at arbitration | ### Evidence Gaps | Gap | How to Fix | |-----|------------| | No delivery proof | Implement tracking + signature | | No customer communication | Start confirmation emails (see [descriptors and comms](/docs/chargebacks/prevention/descriptors-and-comms)) | | No [AVS](/docs/fraud/prevention/avs-cvv) data | Require address verification | | No login records | Enable access logging (see [behavioral analytics](/docs/fraud/detection/behavioral-analytics)) | --- ## Building Your Evidence Collection System ### At Transaction Time Collect and store (per your [evidence framework](/docs/fraud/detection/evidence-framework)): - IP address - [Device fingerprint](/docs/fraud/detection/device-fingerprinting) - [AVS/CVV](/docs/fraud/prevention/avs-cvv) results - Session data - Click timestamps ### At Order Confirmation Document: - Order details email sent - Confirmation page shown - Terms acceptance timestamp - Customer contact info verified ### At Fulfillment Record: - Shipping carrier + tracking - Delivery confirmation - Signature (if applicable) - Digital delivery logs ### Throughout Lifecycle Maintain: - Customer communications - Support tickets - Login/access history - Transaction history --- :::tip[Minimum Viable Evidence (No Fancy Infrastructure Required)] Don't have device fingerprinting or advanced logging? Use what you have: - **Order confirmation email** (screenshot it) - proves the customer received purchase details - **Shipping tracking page** (screenshot the carrier's delivery confirmation) - proves delivery - **Customer communication** (screenshot email/text thread) - proves engagement after purchase - **Login or access logs** (even basic Google Analytics showing visits from their IP) - proves digital delivery - **Signed agreement or invoice** (for services) - proves scope was agreed This gets you to a 20-35% win rate instead of the 50-70% you'd get with device fingerprinting. Still better than not responding. Start collecting better evidence going forward - see the [evidence hierarchy](#evidence-hierarchy) above for what to add when you can. ::: ## Next Steps **Building your evidence system?** 1. [Start with transaction-time collection](#building-your-evidence-collection-system) - IP, device, AVS 2. [Enable 3DS](/docs/fraud/prevention/3ds) - Strongest possible evidence 3. [Implement device fingerprinting](/docs/fraud/detection/device-fingerprinting) - CE 3.0 matching **Improving win rates?** 1. [Talk to customers first](#feedback-loop-talk-to-customers-first) - Understand root cause 2. [Check CE 3.0 eligibility](#visa-compelling-evidence-30) - Higher win rates 3. [Review by dispute type](#evidence-by-dispute-type) - Match evidence to reason code **Responding to a specific dispute?** 1. [Check the reason code](/docs/reference/reason-codes) - Know required evidence 2. [Review time frames](/docs/reference/time-frames) - Don't miss deadlines 3. [Follow representment process](/docs/chargebacks/representment) - Step-by-step --- ## See Also - [Mastercard 4837 - Fraud](/docs/reference/reason-codes/mastercard/fraud) - Mastercard fraud codes - [Visa 10.4 - CNP Fraud](/docs/reference/reason-codes/visa/10-4-fraud-cnp) - Visa fraud codes - [Time Frames Reference](/docs/reference/time-frames) - Response deadlines - [3D Secure Implementation](/docs/fraud/prevention/3ds) - Liability shift authentication - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Winning Evidence](/docs/chargebacks/winning-evidence) - What wins disputes - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - CE 3.0 matching - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification evidence - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention hierarchy - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP ratio protection --- ## Representment for Service Businesses Source: https://paymentsandrisk.com/docs/chargebacks/representment/service-businesses # Representment for Service Businesses :::info[TL;DR] - You can't show a tracking number or a delivery photo. Your evidence is signed agreements and work photos. Customer messages and completion sign-offs too - Different service types need different habits. Contractors need before/after photos. Consultants need signed SOWs. Salons need appointment confirmations - Build documentation into your workflow before you need it. Evidence collected after a dispute is too late - Win rates run 30-55% with proper documentation. Below 15% without it ::: Most [evidence guides](/docs/chargebacks/winning-evidence) here are built for e-commerce and digital goods. Tracking numbers, delivery confirmation, download logs, device fingerprints. You're a contractor, a salon owner, a consultant, a repair shop. That advice doesn't map. You don't ship packages. You perform work. A customer disputes a charge for work you already finished. You need a different playbook. This page is that playbook. --- ## Why Service Chargebacks Are Different E-commerce merchants prove delivery with carrier scans and signatures. Service businesses prove it with documentation of the work. The evidence types are different. So is the reason code mix. ### Evidence Comparison | Category | E-Commerce Evidence | Service Business Evidence | |----------|---------------------|--------------------------| | **Proof of delivery** | Tracking number, carrier confirmation | Signed completion form, walkthrough sign-off | | **Product verification** | Product photos, packaging images | Before/after photos with timestamps | | **Customer agreement** | Terms accepted at checkout | Signed work order, SOW, or service agreement | | **Communication trail** | Order confirmation email | Texts, emails, and calls documenting scope and approval | | **Usage proof** | Login logs, download records | Permit records, inspection reports, service receipts | | **Third-party verification** | Carrier delivery scan | Inspector sign-off, permit closure, warranty registration | ### Reason Code Distribution Service businesses see a different mix of dispute reasons than e-commerce: | Reason Code Type | E-Commerce Frequency | Service Business Frequency | |------------------|---------------------|---------------------------| | "Not received" (13.1) | Very common | Less common | | "Not as described" (13.3) | Common | Very common | | "Service not provided" | Rare | Common | | "Cancelled service" (13.2) | Moderate | Common | | Fraud / unauthorized (10.4) | Very common | Less common | Service businesses get hit hardest by "not as described" and "service not provided." E-commerce gets hit hardest by fraud and non-receipt. So your evidence leans on scope documentation and completion proof. Not delivery tracking. --- ## Evidence by Service Type ### Contractors and Home Services The work is literally attached to someone's house. You can't "return" a remodeled bathroom. Document properly and that's an advantage. **Before the job:** - Signed work order describing scope, materials, timeline, and total cost - Before photos of the work area (with timestamps and location metadata) - Permit applications (if applicable) - these create a government paper trail - Written change order process for any scope additions **During the job:** - Progress photos at key milestones - Material receipts showing what was purchased and installed - Time logs for labor-based billing - Any change orders signed by the customer **At completion:** - After photos showing finished work (with timestamps) - Customer walkthrough sign-off - even a simple "looks good" text counts - Final inspection or permit closure documentation - Warranty information provided to customer **Evidence package for a dispute:** ``` 1. Signed work order (scope + price agreed before work began) 2. Before photos [date/time stamp] showing pre-work condition 3. After photos [date/time stamp] showing completed work 4. Customer text message: "Looks great, thanks!" [date] 5. Permit closure from [city/county] confirming work passed inspection 6. Material receipts totaling $X ``` ### Consulting and Professional Services Consulting disputes come down to "I didn't get value." That's subjective. Your defense is that you delivered what you agreed to deliver. Not that the client liked the outcome. **Before engagement:** - Signed statement of work (SOW) with clearly defined scope, deliverables, and payment terms - Engagement letter or contract with cancellation terms - Email confirming project kick-off and timeline **During engagement:** - Time tracking logs (by task or deliverable) - Deliverable receipt confirmations - even a "received, thanks" email works - Meeting notes or summaries sent to the client - Progress update emails documenting work performed **At completion:** - Final deliverable transmission with read receipt or download confirmation - Project close-out email summarizing what was delivered - Client feedback or sign-off (if you can get it) - Invoice tied to specific deliverables **Evidence package for a dispute:** ``` 1. Signed SOW listing deliverables A, B, and C 2. Email from client [date]: "Got the report, reviewing now" 3. Time log: 22 hours across 4 weeks on deliverables A-C 4. Final deliverable email [date] with attachment confirmation 5. Client email [date]: "Can you also look at X?" (proves engagement) ``` ### Salons, Spas, and Personal Services Personal services are tough. The work is performed and consumed on the spot. There's no deliverable to point at later. Capture your evidence in real time. **Before the appointment:** - Appointment confirmation via text or email (proves the customer scheduled the visit) - Service menu or price list signed or acknowledged - Consent form for chemical treatments, medical aesthetics, or any procedure with risks - Intake form documenting customer requests **During the service:** - Before/after photos (with written photo consent - this matters) - Service notes documenting what was performed - Product usage records (for chemical treatments, color formulas, etc.) **At checkout:** - Itemized receipt with services listed - Tip line on receipt (a tip strongly implies satisfaction) - Signed receipt or digital payment confirmation - Rebooking for next appointment (proves satisfaction) **Evidence package for a dispute:** ``` 1. Text confirmation [date]: "See you at 2pm for highlights + cut" 2. Signed consent form for color treatment 3. Before/after photos [timestamps] (with photo release on file) 4. Signed receipt: $185 + $35 tip = $220 5. Rebooking text [date]: "Same time next month?" ``` A signed tip is the strongest evidence in personal services. Hard to claim "service not provided" after you added a tip. ### Repair and Maintenance Repair shops have a built-in advantage. You can document the item's condition on arrival. And again when it leaves. Use it. **At intake:** - Intake form documenting the item's condition on arrival (ideally with photos) - Customer-reported issue written in their words - Diagnostic authorization (signed approval to evaluate) - Estimated cost range communicated and acknowledged **During repair:** - Diagnostic report detailing what was found - Parts receipts (OEM or aftermarket, with part numbers) - Photos of damaged components removed - Repair authorization for any costs exceeding the estimate **At completion:** - Completion sign-off confirming the repair was performed - Test results or quality verification - Before/after comparison (especially for visible repairs) - Warranty terms for the repair **Evidence package for a dispute:** ``` 1. Intake form [date]: Customer reported "AC not cooling" 2. Diagnostic report: Found failed compressor, quoted $850 3. Customer text [date]: "Go ahead with the repair" 4. Parts receipt: Compressor part #XYZ, $420 5. Completion photo showing installed compressor 6. Customer signature on pickup form [date] ``` --- ## Building Documentation Habits A strategy your team doesn't follow is worth nothing. Make documentation automatic. ### Create Templates for Everything Build simple templates for your business type: - **Work order / service agreement** - Scope, price, timeline, signature line - **Intake form** - Condition on arrival, customer-reported issues - **Change order** - New scope, new price, customer signature - **Completion form** - Work performed, customer sign-off, date You don't need fancy software. A printed form with a signature line works. A PDF you email for digital signature works. Even a clear text message exchange works. ### Photo Requirements Photos are only useful evidence if they include context: | Requirement | Why It Matters | |-------------|---------------| | **Timestamp visible** | Proves when the photo was taken | | **Location metadata** | Proves where (turn on GPS tagging in your camera app) | | **Context in frame** | Include address numbers, street signs, or room identifiers | | **Before AND after** | One without the other is much weaker | | **Consistent angle** | Same angle for before/after makes comparison obvious | ### Digital Signature Options You don't need expensive tools. Options by budget: | Tool | Cost | Best For | |------|------|----------| | **Email confirmation** | Free | "Reply YES to confirm" - simple and effective | | **Text message approval** | Free | Screenshot the exchange | | **Square / Clover receipt** | Already paying | Built-in signature capture at checkout | | **DocuSign / HelloSign** | $10-25/month | Formal contracts and SOWs | | **Jotform / Google Forms** | Free-$20/month | Intake forms and consent forms | ### Communication Logging Save everything. Texts, emails, voicemails. A customer texts "looks amazing, thank you!" Then disputes the charge. That's your strongest scenario. **Practical tips:** - Screenshot text conversations. Don't rely on them staying in your phone. - Use email for scope changes, even after a phone call. "Per our call, confirming you'd like to add..." - Save voicemails as audio files. - Keep support tickets and complaint records. Even complaints help. A minor complaint proves they got the service. --- ## Common Reason Codes for Services The codes you'll face, and the evidence that beats them: | Reason Code | Meaning | Key Evidence Needed | Approximate Win Rate | |-------------|---------|---------------------|----------------------| | **13.1 / 4855** - Service not provided | Customer claims the service was never performed | Completion sign-off, after photos, time logs, customer communications acknowledging the work | 40-55% with documentation | | **13.3 / 4853** - Not as described | Customer claims the service didn't match what was promised | Signed SOW or work order defining scope, correspondence showing expectations were met, before/after photos | 30-45% with documentation | | **13.2 / 4841** - Cancelled service | Customer claims they cancelled before the service was performed | Cancellation policy in signed agreement, proof service was performed before cancellation request, no cancellation on record | 35-50% with documentation | | **10.4 / 4837** - Unauthorized | Customer claims they didn't authorize the transaction | Signed receipt or work order, appointment confirmation to their phone/email, in-person ID verification | 25-40% with documentation | Without documentation, all of these drop below 15%. That's the gap between doing the work and proving you did. --- ## Next Steps **Just starting to document your services?** 1. Create a work order template with a signature line. Use it on every job starting today 2. Turn on timestamps and GPS tagging in your phone's camera app 3. Screenshot customer text confirmations. Save them in a folder by customer name **Already documenting but getting disputes?** 1. Review your last 5 disputes - what evidence was missing? 2. Add a completion sign-off to your workflow. Even a "reply to confirm" text works 3. Read the [representment workflow](/docs/operations/representment-workflow) to make sure you're submitting responses correctly **Want to improve your win rate?** 1. Study the [compelling evidence checklists](/docs/chargebacks/representment/compelling-evidence) to understand what networks require 2. Cross-reference your reason codes with the [winning evidence strategy](/docs/chargebacks/winning-evidence) for prioritization 3. Consider whether a [refund](/docs/chargebacks/refund-strategy) is cheaper than fighting for low-dollar disputes --- ## Related Pages - [Representment Overview](/docs/chargebacks/representment) - When and how to fight chargebacks - [Winning Evidence](/docs/chargebacks/winning-evidence) - What issuers look for in dispute responses - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Network-specific evidence checklists - [Digital Goods Evidence](/docs/chargebacks/digital-goods-evidence) - Evidence for digital products (the other side of this coin) - [Reading a Chargeback Notification](/docs/chargebacks/reading-a-chargeback-notification) - Understanding what you're responding to - [Representment Workflow](/docs/operations/representment-workflow) - Step-by-step response process - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund instead of fight - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking your win rates --- ## Winning Evidence Source: https://paymentsandrisk.com/docs/chargebacks/representment/winning-evidence # Winning Evidence :::info[TL;DR] - Issuer analysts review your dispute in 30 seconds using a checklist - match the checklist, win the dispute; miss items, lose automatically - Win rates average 20-30% for most merchants. The best hit 40-50%, and it's because they submit evidence about that transaction, not a boilerplate terms-of-service PDF - Visa CE 3.0 lets you shift fraud dispute liability by proving a prior undisputed transaction from the same device and card. If you're high-volume, it's the highest-ROI evidence work you can do - Three strong, specific pieces of evidence beat a 15-page packet - issuers don't read walls of text ::: :::info[This Page vs. What Proof Card Networks Accept] **This page** is how to think about evidence: what issuers actually look at, how to organize a response, and what people get wrong. **[What proof each network accepts](/docs/chargebacks/representment/compelling-evidence)** is the *reference checklist*: what evidence each network requires, CE 3.0 specs, submission deadlines, and format standards. Read this one first, then work off that one when you're actually building a response. ::: Most [chargeback](/docs/chargebacks) responses lose because merchants submit the wrong evidence. You're not arguing with a jury. You're arguing with an [issuer](/docs/fraud/issuer-perspective) analyst who has 30 seconds to review your case and a checklist to follow. [Win rates](/docs/chargebacks/metrics) are 20-30% for typical merchants. The best hit 40-50%. The difference is knowing what issuers actually look for. ## What Matters 1. **Issuers have checklists.** Match the checklist, win the [dispute](/docs/chargebacks). 2. **Transaction-specific evidence beats boilerplate.** Your TOS doesn't prove this customer got this product. 3. **Visa CE 3.0 can exclude [fraud](/docs/fraud) disputes from your [VAMP ratio](/docs/chargebacks/reference/network-programs).** But only if you have the right data. 4. **Less is more.** A 15-page PDF gets skimmed. Three strong pieces of evidence get read. 5. **Timing matters.** Evidence of usage after the dispute date is gold. --- ## Evidence by Dispute Type ```mermaid flowchart TD A[ChargebackReceived] --> B{ReasonCode Type?} B -->|10.x Fraud| C[Fraud Evidence] B -->|13.1 Not Received| D[Delivery Evidence] B -->|13.2 Cancelled| E[Subscription Evidence] B -->|13.3 Not as Described| F[Product Evidence] C --> C1[Device MatchIP MatchPrior Orders] D --> D1[TrackingSignatureDelivery Photo] E --> E1[Consent ProofNo Cancel RequestUsage After] F --> F1[Product PhotosDescription ShownCorrespondence] style C fill:#ef4444,color:#fff style D fill:#3b82f6,color:#fff style E fill:#8b5cf6,color:#fff style F fill:#f59e0b,color:#fff ``` ## What Issuers Look For Issuer analysts work from [network reason code](/docs/reference/reason-codes) requirements. Each code has specific evidence that proves or disproves the claim, and they aren't reading anything else. See the [Visa](/docs/reference/reason-codes/visa) and [Mastercard](/docs/reference/reason-codes/mastercard) lists. ### Fraud Claims (Reason Code 10.x) Customer claims they didn't authorize the transaction. This could be [true fraud](/docs/fraud/types/third-party) or [friendly fraud](/docs/fraud/types/friendly-fraud). **Winning evidence:** - [Device fingerprint](/docs/fraud/detection/device-fingerprinting) matches prior purchases - IP address matches cardholder location - Shipping address matches billing address (strong [AVS match](/docs/fraud/prevention/avs-cvv)) - Prior successful transactions on same card - Customer login after purchase date - Customer communication acknowledging purchase **Not helpful:** - Signed TOS (proves nothing about this transaction) - Generic fraud prevention description - "We have robust security" statements ### Product/Service Issues (Reason Code 13.x) Customer claims they didn't receive what was promised. **Winning evidence:** - Delivery confirmation with signature - Tracking showing delivery to billing address - Photos of product as shipped - Customer communication confirming receipt - Customer usage logs after delivery - Refund/exchange offer made and declined **Not helpful:** - Generic shipping policies - Average delivery times - "Most customers are satisfied" claims ### Subscription/Recurring (Reason Code 13.2, 13.7) Customer claims they cancelled or didn't authorize [recurring billing](/docs/payments/subscriptions-recurring). **Winning evidence:** - Original consent with timestamp and IP - Terms they agreed to at signup - Renewal notification emails (with delivery proof) - Account login activity after alleged cancellation - No cancellation request in support tickets - Continued usage after disputed charge **Not helpful:** - Pointing to cancellation policy they didn't follow - "They should have cancelled properly" - Generic subscription terms --- ## Visa Compelling Evidence 3.0 :::info[Definitive CE 3.0 Reference] For the full CE 3.0 requirements, eligibility criteria, and implementation details, see [Compelling Evidence: Visa CE 3.0](/docs/chargebacks/representment/compelling-evidence#visa-compelling-evidence-30). What's here is strategy: when CE 3.0 actually moves your win rate. ::: CE 3.0 is [Visa's](/docs/reference/reason-codes/visa) program that can exclude qualifying [fraud](/docs/fraud) disputes from your [VAMP ratio](/docs/chargebacks/reference/network-programs). It requires 2+ prior undisputed transactions (120-365 days old, same card) with at least two of four matching data elements: device fingerprint, IP address, shipping address, or user account. At least one of the two matching elements **must** be IP address or device ID. When you qualify, your win rate jumps to 70-85%, and the TC40 fraud report doesn't have to count against your VAMP ratio. See [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence#visa-compelling-evidence-30) for full requirements, process flow, and network-specific details. :::note[Ask Your Dev] "Are we collecting and storing device fingerprints and IP addresses in a way that supports CE 3.0 submission? Can we query prior transactions for matching data elements?" ::: For the operational strategy (when and how to collect CE 3.0 data throughout the transaction lifecycle), see [Defending Against Fraud Losses](/docs/fraud/prevention/defending-against-fraud-losses#layer-3-visa-compelling-evidence-30). --- ## Digital Goods Evidence Digital goods are harder to prove because there's no physical delivery. See [digital goods fraud risks](/docs/fraud/types/third-party) for prevention strategies. ### What Works for Digital | Evidence Type | Why It Helps | |---------------|--------------| | **IP at purchase** | Links transaction to location | | **IP at usage** | Proves access after purchase | | **Account login timestamps** | Shows ongoing usage | | **In-app activity logs** | Proves they used the product | | **Download records** | Proves they received delivery | | **License key activation** | Ties specific purchase to usage | | **Streaming/viewing history** | Proves content consumption | ### Digital Evidence Package For digital goods disputes, compile: 1. Purchase timestamp and IP 2. Account creation date (if before dispute) 3. Login timestamps after purchase 4. Usage activity (features used, content accessed) 5. Download or activation records 6. Any customer support tickets (especially ones acknowledging the product works) --- ## Evidence Organization How you present evidence matters as much as what you present. ### Format Guidelines | Do | Don't | |----|-------| | Single PDF, clearly labeled | Multiple attachments | | Page numbers and sections | Wall of text | | Key evidence on first page | Bury important items | | Highlighted relevant sections | Raw log dumps | | Clear timestamps | Ambiguous dates | ### Ideal Response Structure **Page 1: Summary** - Transaction details (date, amount, last 4) - Customer details (name, address, email) - 2-3 sentence summary of why this should be reversed **Page 2-3: Key Evidence** - The strongest pieces proving your case - Screenshots with timestamps - Highlighted delivery confirmation **Page 4+: Supporting Documentation** - Full logs if needed - Complete communication history - Policies (only if directly relevant) ### What Wastes Analyst Time - 30+ page responses - Unformatted server logs - Irrelevant company history - Emotional appeals - Legal threats - Screenshots of your TOS homepage --- ## Inquiry Deflection Many disputes start as inquiries before becoming [chargebacks](/docs/chargebacks/lifecycle). ### Inquiry vs. Chargeback | Stage | What It Is | Your Opportunity | |-------|------------|------------------| | **Inquiry** | Issuer asking for information | Resolve here, no chargeback filed | | **First chargeback** | Formal dispute filed | Representment required to reverse | | **Pre-arbitration** | Second review | Higher stakes, more evidence needed | | **Arbitration** | Network decides | Expensive, rarely worth it | ### Deflecting at Inquiry If you can resolve at the inquiry stage: - No chargeback hits your ratio - No chargeback fee - Lower cost of resolution **How to enable inquiry deflection:** 1. Enroll in [Order Insight (Visa) and Consumer Clarity (Mastercard)](/docs/chargebacks/prevention/alerts) 2. Provide rich [transaction data](/docs/chargebacks/prevention/descriptors-and-comms) (product details, images, tracking) 3. Respond to inquiries within 24 hours 4. Offer proactive refunds for clear losses --- ## Evidence Templates: Use Carefully :::warning[Templates Are Overrated] Template responses are less effective than you think. Issuers see the same templates repeatedly. Focus on transaction-specific evidence, not boilerplate. ::: ### What Templates Can't Do - Prove this specific customer received this specific product - Show device or IP matching - Demonstrate customer usage - Provide unique transaction details ### When Templates Help Templates are useful for: - Consistent formatting - Reminder checklists (what evidence to gather) - Standard policy language (as supplement, not substitute) ### Building Useful Templates **Instead of boilerplate responses, build evidence checklists by reason code:** | Reason Code | Evidence Checklist | |-------------|-------------------| | **10.4 (Fraud CNP)** | โ–ก 3DS data โ–ก Device fingerprint โ–ก IP match โ–ก Prior transactions โ–ก AVS match | | **13.1 (Not received)** | โ–ก Tracking # โ–ก Carrier โ–ก Delivery confirmation โ–ก Signature โ–ก Delivery photo | | **13.2 (Cancelled recurring)** | โ–ก Original consent โ–ก IP at signup โ–ก Cancellation policy โ–ก No cancel request โ–ก Usage after dispute | | **13.3 (Not as described)** | โ–ก Product description at sale โ–ก Images โ–ก Return policy โ–ก Correspondence โ–ก Refund offered? | **Use this checklist before responding.** Missing evidence = likely loss. ### Template Dos and Don'ts | Do | Don't | |----|-------| | Use templates for document formatting | Copy-paste the same letter for every dispute | | Include evidence collection reminders | Submit generic "we have a fraud prevention system" | | Standardize header/transaction info | Skip transaction-specific details | | Create reason-code-specific structures | Use one template for all reason codes | ### Evidence Assembly Workflow 1. **Receive chargeback notification** 2. **Check reason code โ†’ pull corresponding checklist** 3. **Gather evidence from each checklist item** 4. **Identify gaps โ†’ decide if worth fighting** 5. **Assemble package in standard format** 6. **Submit with summary highlighting strongest evidence** :::tip[Evidence First, Template Second] Gather the evidence first, then use a template to format it. Don't let the template decide what goes in. ::: --- ## Test to Run **30-day evidence improvement audit:** **Week 1:** Baseline - Pull win rate by reason code for past 90 days - Review 10 lost disputes for evidence gaps - Identify most common reason codes **Week 2-3:** Improve - Create evidence checklist by reason code - Verify CE 3.0 data is being collected - Train team on new evidence standards **Week 4:** Measure - Compare win rate to baseline - Identify remaining gaps **Success criteria:** 10-20% improvement in win rate within 60 days. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Manual evidence collection. Focus on top 2-3 reason codes. Don't over-invest in low-volume disputes. | | **$100k-$1M/mo** | Standardized evidence packages. CE 3.0 data collection. Track win rates by reason code. | | **Over $1M/mo** | Automated evidence assembly. Dedicated representment team or vendor. Real-time win rate optimization. | --- ## Where This Breaks 1. **[True fraud](/docs/fraud/types/third-party).** If the transaction really was fraudulent, no evidence saves you. The card was stolen and the cardholder's the victim. Take the loss, you aren't winning that one. 2. **Service failures.** If you actually failed to deliver, fighting the [chargeback](/docs/chargebacks) is wasted effort. Refund, learn, fix the problem. 3. **[Friendly fraud](/docs/fraud/types/friendly-fraud) with no data.** If you don't collect [device fingerprints](/docs/fraud/detection/device-fingerprinting), IPs, and usage logs, you can't prove legitimate transactions. [Prevention](/docs/chargebacks/prevention) (data collection) beats cure ([representment](/docs/chargebacks/representment)). --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Overall win rate** | Representment effectiveness | > 30% | | **Win rate by reason code** | Where to focus | Varies by code | | **Response time** | Meeting deadlines | 50% of fraud disputes | | **Evidence completeness score** | Process quality | Internal benchmark | ### Win Rate Benchmarks by Reason Code | Reason Code Category | Typical Win Rate | Good Win Rate | |----------------------|------------------|---------------| | Fraud (10.x) | 15-25% | 30-40% | | No merchandise (13.1) | 40-60% | 60-80% | | Not as described (13.3) | 20-30% | 35-45% | | Subscription (13.2, 13.7) | 25-35% | 40-50% | If your win rate is well below typical, it's an evidence problem or a process problem. It isn't bad luck. For win rate in the context of overall chargeback metrics and when to stop fighting specific reason codes, see [Chargeback Metrics: Win Rate](/docs/chargebacks/metrics#win-rate-whats-realistic). --- ## Next Steps **Just getting started with representment?** 1. [Review the representment workflow](/docs/operations/representment-workflow) โ†’ Step-by-step response process 2. Pull your last 10 chargebacks โ†’ What evidence did you have? What was missing? 3. Implement device fingerprinting and IP logging โ†’ Start collecting CE 3.0 data now **Improving your win rate?** 1. Segment by reason code โ†’ Focus on codes where you have evidence advantage 2. Build evidence templates by reason code โ†’ Standardize your response packages 3. Set up evidence collection at transaction time โ†’ You can't gather evidence after the fact **Already fighting chargebacks?** 1. Track win rates by reason code โ†’ Find your weak spots 2. Review lost cases โ†’ What evidence would have won? 3. [Prevent chargebacks first](/docs/chargebacks/prevention) โ†’ Prevention beats representment every time --- ## Related Pages - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Detailed evidence guide - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Fraud vs. Friendly Fraud](/docs/chargebacks/fraud-vs-friendly) - Classification - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Crisis response - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention hierarchy - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - CE 3.0 matching - [Reason Codes](/docs/reference/reason-codes) - Code-specific evidence - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP ratio protection - [Chargeback Vendors](/docs/chargebacks/vendors) - Representment services - [Chargeback Metrics](/docs/chargebacks/metrics) - Win rate tracking - [Representment for Service Businesses](/docs/chargebacks/representment/service-businesses) - Evidence strategies for contractors, consultants, salons, and repair shops --- ## Chargeback Management Vendors Source: https://paymentsandrisk.com/docs/chargebacks/vendors # Chargeback Management Vendors :::info[TL;DR] - **Three main categories**: alert providers (prevent [chargebacks](/docs/chargebacks)), representment services (recover), automation platforms (both) - **Almost nothing here has published pricing.** Chargeflow's 25% success fee is the exception. Alert networks, guarantee providers and full-service vendors all quote privately. Get two written quotes and compare them against each other - **Midigator is gone.** Equifax owns it and folded it into Kount. The domain now redirects into Equifax. It wasn't a Mitek company - **For [Visa](/docs/reference/reason-codes/visa)/[Mastercard](/docs/reference/reason-codes/mastercard) rails**: Ethoca and Verifi are the only first-party [alert networks](/docs/chargebacks/prevention/alerts). Everyone else is reselling or aggregating those two, whatever they're calling it. - **RDR automates, CDRN/Ethoca require action**: RDR auto-refunds based on rules; CDRN/Ethoca need manual response within 24-72 hours - **Reseller vs direct tradeoff**: Resellers offer single dashboard but add cost; direct enrollment is cheaper at scale ::: Chargeback vendors split into categories. Each one covers a different point in the dispute lifecycle. ## Chargeback Vendor Categories | Type | What They Do | Key Players | Pricing (checked 2026-08-02) | |------|--------------|-------------|-----------------| | **[Alert Networks](/docs/chargebacks/prevention/alerts)** | Pre-dispute notification to prevent [chargebacks](/docs/chargebacks) | Ethoca (Mastercard), Verifi (Visa) | Not published. Neither network publishes a per-alert rate | | **Alert Resellers** | Aggregate Ethoca + Verifi in one dashboard | Chargebacks911, Chargeblast, Chargeback Gurus | Not published. Per-alert fee, quoted individually | | **[Representment](/docs/chargebacks/representment)** | Fight chargebacks with [evidence](/docs/chargebacks/representment/compelling-evidence) | Chargebacks911, Chargeflow, Justt | Mostly not published. Chargeflow publishes 25% of what it recovers | | **Full-Service** | Prevent + fight + analyze | Chargeback Gurus, Chargebacks911 | Not published. Hybrid retainer plus success fee | | **Guarantee** | Absorb [fraud](/docs/fraud) chargeback liability | Signifyd, Riskified, NoFraud | Not published. A percentage of each approved order; no vendor publishes the percentage | Most merchants start with [alert services](/docs/chargebacks/prevention/alerts) and nothing more. [Representment](/docs/chargebacks/representment) and guarantees get added later, depending on [fraud](/docs/fraud/types) mix and volume. The right combination comes down to where your chargebacks come from. If it's [third-party fraud](/docs/fraud/types/third-party), you want guarantees. If it's [friendly fraud](/docs/fraud/types/friendly-fraud), you want [representment](/docs/chargebacks/representment). The [setup dispute alerts playbook](/docs/playbooks/setup-dispute-alerts) has the wiring. :::info[Minimum Viable Stack (Under $500K/Month)] Most SMBs don't need a full vendor stack. Here's what actually moves the needle: 1. **Alerts only**: RDR + Ethoca stops chargebacks from being filed. It's your highest-ROI spend. Neither network publishes a cost. Resellers quote per alert, so get two quotes. See [what alerts cost](/docs/chargebacks/prevention/chargeback-alert-pricing). 2. **Add representment** (a share of what they recover): only if you're losing more than 10 chargebacks a month AND you've got strong evidence. Chargeflow publishes its fee. It's 25% of recovered value, no monthly fee, no setup fee. That makes it the easiest one to price before you sign. Everyone else quotes. 3. **Add guarantee**: only if true fraud losses are big enough to justify it. No guarantee vendor publishes a rate. Signifyd publishes the model and nothing else. It's a percentage of the order total on approved orders, and nothing on fraud declines. See [chargeback guarantees](/docs/fraud/prevention/chargeback-guarantees) for the break-even math and the quote request. **Don't buy** fraud scoring platforms, consortium data, or enterprise analytics under $500K/month. Your processor's built-in tools handle it. ::: ## Alert Networks Alert networks warn you before a dispute becomes a chargeback. Refund it there and you skip the chargeback fee, the ratio impact and the representment cost. It's the cheapest thing on this page. ### The Two Networks Visa and Mastercard have exactly two first-party alert networks: 1. **Verifi** (owned by Visa since 2019, founded 2005 in Los Angeles, CA) 2. **Ethoca** (owned by Mastercard since 2019, founded 2005 in Toronto, Canada) Every other "chargeback alert" vendor is a reseller or an aggregator sitting on those two networks. Remember that when someone pitches you their network. It isn't theirs. ### Verifi Products #### RDR (Rapid Dispute Resolution) RDR auto-refunds disputes against rules you set yourself. You write the rule, say "auto-refund any dispute under $50". The rule gets evaluated the moment a dispute starts. Matching disputes are refunded before a chargeback is filed. Nobody has to touch it after that. **Key characteristics:** - Visa only - Global coverage - Automated: set rules and forget - Visa's preferred/modern approach - Prevents chargeback from being filed entirely **Best for:** High-volume merchants wanting automation #### CDRN (Cardholder Dispute Resolution Network) CDRN is a manual alert system with a typical 72-hour response window. It's being folded into Visa Resolve Online and rebranded. You get a notice that a dispute is pending, and roughly 72 hours to respond. Stopping it means refunding by hand. Refund it and no chargeback gets filed. **Key characteristics:** - Covers Visa and some Discover transactions - Primarily US-focused coverage - Manual process - Being supplanted by RDR for many use cases (and integrated into Visa Resolve Online) **Best for:** Merchants wanting review before refund #### Order Insight A cardholder calls their bank about a charge they don't recognize. Order Insight pushes your order details to the issuer live: items, shipping info, delivery confirmation, digital receipts. All of it lands before anything gets filed. It works with [descriptors](/docs/chargebacks/prevention/descriptors-and-comms) to cut the confusion. **How it works:** 1. Cardholder calls issuer about an unfamiliar charge 2. Issuer queries Verifi Order Insight in real-time 3. Merchant's stored order data (purchase details, shipping, merchant info) is returned 4. Issuer shows cardholder the enriched data 5. Cardholder recognizes the purchase - no dispute filed It plugs into the issuer's customer service systems and cuts down "I don't recognize this charge" disputes ([friendly fraud](/docs/fraud/types/friendly-fraud)). That's prevention, not reaction. You have to feed it data first: order details, shipping and tracking, delivery confirmation, contact info. It's often free or low-cost. See the [prevention hierarchy](/docs/chargebacks/prevention) for where this fits. ### Ethoca Products #### Ethoca Alerts Ethoca Alerts warn you before a dispute becomes a chargeback. The network runs 5,000+ participating issuers globally. The cardholder opens a dispute with their bank. If that bank is in Ethoca, you get an alert. You've got 24-72 hours to respond, and it varies by issuer. The refund is yours to process by hand. **Key characteristics:** - Mastercard primary, some Visa coverage - 5,000+ issuers globally - strongest cross-network coverage - Global coverage, especially strong outside US (EU, Canada, Asia) - Manual process: merchant must act - Typical 24-72 hour response window **Best for:** Non-US merchants, Mastercard-heavy volumes #### Consumer Clarity Consumer Clarity enriches what the cardholder sees, and issuer call center agents see the same thing. Disputes stop before they start. Your name, logo, location and digital receipt all show in the banking app. Itemized purchase details show at the point of inquiry. The cardholder sees all that and doesn't file. That cuts [friendly fraud](/docs/fraud/types/friendly-fraud) from non-recognition. It hooks into issuer customer service and mobile banking. You submit the descriptor, logo, transaction details and contact info. #### Fraud Insights Ethoca Fraud Insights feeds confirmed fraud data back to you, to train your fraud models. It tells you which transactions the issuer confirmed as fraud. That's how you find root causes and fraud patterns. It isn't an alert service. It's an analytical data feed that sharpens your [fraud prevention](/docs/fraud/prevention) models. ### Coverage Comparison Two companies here, not three. **Verifi runs both RDR and CDRN, and Verifi is Visa's own company. Ethoca is Mastercard's.** So the RDR-or-CDRN decision is about automatic versus manual, not about picking a vendor. Full breakdown in [chargeback alerts compared](/docs/chargebacks/prevention/alerts). | Feature | RDR | CDRN | Ethoca Alerts | |---------|-----|------|---------------| | Run by | **Verifi**, a Visa company | **Verifi**, a Visa company | **Ethoca**, a Mastercard company | | Card Networks | Visa only | Visa, some Discover | Mastercard, some Visa | | Geographic Reach | Global | US-focused | Global (stronger outside US) | | Process | Automated | Manual (typical 72h window) | Manual (typical 24-72h window) | | Best For | High-volume, automation | US Visa merchants | Non-US, Mastercard-heavy | ### Pricing :::note[Alert Pricing] **Not published.** Mastercard doesn't publish an Ethoca rate. Visa doesn't publish a Verifi rate. Reseller pricing is contract-specific, and it moves with volume, channel and provider. Direct network pricing is negotiated. RDR tends to be cheaper per event than CDRN or Ethoca, because it's automated. Get quotes from two resellers minimum. Ask them the same four questions. What's the per-alert price at your volume? Do they de-duplicate CDRN against Ethoca so one dispute doesn't bill twice? Who issues the refund? And what's the minimum term and notice period? See [what chargeback alerts cost](/docs/chargebacks/prevention/chargeback-alert-pricing) for the full breakdown. ::: ### Reseller vs Direct #### Reseller Approach **Pros:** - Single dashboard for both networks - Consolidated billing - Often simpler onboarding - Analytics and reporting **Cons:** - Added margin on alert fees - One more vendor relationship **Examples:** Chargebacks911, Chargeflow, Chargeblast, Chargeback Gurus #### Direct Enrollment **Pros:** - Potentially lower per-alert cost at scale - Direct relationship with networks - No reseller markup **Cons:** - Separate platforms for Verifi and Ethoca - More operational overhead - May require higher volumes to justify **Recommendation:** start with a reseller. Once volume grows and someone owns chargebacks full-time, price direct enrollment. ### Alert Reseller Comparison | Reseller | Alert Networks | Additional Services | Best For | |----------|---------------|---------------------|----------| | **Chargebacks911** | Ethoca + Verifi | ISD root cause analysis, representment, compliance review | Mid-market merchants wanting full-service management | | **Chargeback Gurus** | Ethoca + Verifi | Dedicated analyst, root cause consulting, representment | Travel, hospitality and subscription merchants wanting advice as well as alerts | | **Chargeflow** | Ethoca + Verifi | AI-automated representment, analytics dashboard | Shopify/e-commerce merchants wanting automation | | **Chargeblast** | Ethoca + Verifi CDRN | Automated refund processing, dashboard | Merchants wanting simple alert aggregation with fast onboarding | :::warning[Midigator used to be on this list. It no longer exists] Midigator was the analytics-led option here, and it still gets described as a Mitek company. That's wrong twice over. **Equifax** acquired Midigator in 2022 and folded it into Kount. As of 2 August 2026, midigator.com 301-redirects to kount.com. That 301-redirects again, to [equifax.com/business/identity-fraud/](https://www.equifax.com/business/identity-fraud/). The brand is retired at the vendor's own domain. If someone's still pitching you Midigator, ask which Equifax entity holds the contract, whether the product is still being developed, and what the exit terms are. If you want the analytics-heavy, self-service style Midigator occupied, look at Equifax's identity and fraud line, or at Chargeflow. ::: :::tip[Chargeblast - Simple Alert Aggregation] Chargeblast does alert aggregation and not much else. Ethoca and Verifi CDRN alerts land in one dashboard. Refund processing is automated. It doesn't do representment, analytics or consulting. If alert coverage is all you want, that's a feature. Onboarding is fast, through a simple API or dashboard-only setup. ::: ## Representment Services Representment services fight chargebacks for you. They compile the evidence and run the dispute. Win rates swing hard on reason code and evidence quality. Anyone quoting you one number isn't being straight. ### Representment Vendor Comparison | Vendor | Founded | Pricing Model | Approach | Platform Integrations | Best For | |--------|---------|---------------|----------|-----------------------|----------| | **Chargebacks911** | 2011 (Tampa, FL) | Not published. Success-based or per-dispute fee | ISD root cause analysis + managed representment | Ethoca/Verifi aggregation, processor integrations | Mid-market to enterprise; high-risk verticals | | **Chargeflow** | 2020 (Tel Aviv) | **Published: 25% success fee**, no monthly fee, no setup fee | AI-automated evidence compilation and submission | Shopify, Stripe, PayPal, Braintree, WooCommerce | Shopify-first e-commerce; outcome-based pricing | | **Justt** | 2020 (Tel Aviv) | Not published. Pay-for-success, no upfront costs | AI evidence compilation + expert human review | Stripe, PayPal, Adyen, Braintree, multi-processor | E-commerce merchants wanting managed automation | | **Chargeback Gurus** | 2014 (McKinney, TX) | Not published. Service-based, success-based representment common | Dedicated analyst + consulting + managed services | Ethoca/Verifi alert handling, e-commerce platforms | Travel, hospitality, subscription verticals | ### Key Players #### Chargebacks911 Chargebacks911 runs managed services plus software. It's built around their Intelligent Source Detection (ISD) technology. ISD classifies each chargeback by true source. True fraud, [friendly fraud](/docs/fraud/types/friendly-fraud), or merchant error. That's how you fix the actual cause, not everything at once. They use Compelling Evidence 3.0 (CE 3.0) on Visa disputes. The model is human plus technology, and they know the network rules on Visa, Mastercard, Amex and Discover. Ethoca and Verifi alerts sit in one platform, with automated refund processing. False Positive Reduction (FPR) cuts false declines from your fraud filters. They're strong in high-risk verticals: supplements, nutraceuticals, subscription, dating. **Pricing model:** managed services. Representment is success-based or per-dispute. Alert management is per-alert. Consulting is retainer or project. They don't publish any of it. **Note:** they settled with the FTC and the Florida AG in 2023 over deceptive practices. The allegations were misleading evidence submission and artificial ratio manipulation. They're prohibited from certain high-risk client practices. Don't take current compliance on trust. #### Midigator (retired) You can't buy this one any more. Equifax acquired Midigator in 2022 and folded it into Kount. midigator.com now redirects to kount.com. That redirects to Equifax (checked 2026-08-02). Details in the [warning above](#alert-reseller-comparison). #### Chargeflow Chargeflow compiles evidence with AI and charges for success. Founded in 2020, it aims at e-commerce merchants, and it's Shopify-first. They claim an ~80% win rate. Pricing is 25% of recovered value, with no monthly fee and no setup fee. The AI detects the chargeback and pulls evidence from connected platforms. It builds a package per reason code, then files it. The dashboard shows win rates, dispute trends and revenue recovered. It plugs into Shopify, Stripe, PayPal, Braintree and WooCommerce. There's a free plan with basic analytics and dispute tracking. **Best for:** merchants who want outcome-based pricing and little manual effort #### Justt Justt automates dispute resolution. The AI compiles evidence and a human reviews the hard ones. Founded in 2020 in Tel Aviv. Evidence collection pulls from multiple data sources, and complex disputes get a human review layer. It works across Stripe, PayPal, Adyen, Braintree and others. Responses are tailored per network and reason code. You get win rate tracking, dispute analytics and revenue recovery reporting. They charge for success, with no upfront costs. **Best for:** e-commerce merchants who want it fully managed and hands-off #### Chargeback Gurus Chargeback Gurus does prevention and representment. A dedicated analyst owns your account. Founded in 2014 in McKinney, TX. They specialize in travel, hospitality and subscription. Prevention consulting comes bundled with the representment work: root cause analysis and process fixes. Ethoca and Verifi alert management is included. So is dispute data analysis and chargeback reduction consulting. **Pricing model:** service-based, and it varies by engagement. Representment is typically a success fee. You have to contact them for a number. ### What to Ask Representment Vendors - What's your win rate **by reason code** (not just overall)? - How do you calculate win rate (recovered $ vs. cases won)? - What evidence sources do you integrate with? - Do you handle all reason codes or specialize? - What's your fee structure (flat, percentage, hybrid)? - How long until I see results? ## Chargeback Guarantee Providers Guarantee providers take fraud chargeback liability off you. They approve a transaction, it comes back as a fraud chargeback, and they pay it. That's the whole product. ### How Guarantees Work 1. Transaction submitted to guarantee provider 2. Provider returns Approve/Decline decision 3. Merchant ships only approved orders 4. If approved order results in fraud chargeback, provider reimburses merchant **Important**: guarantees usually cover fraud chargebacks only. Here's what they don't cover: - Friendly fraud / first-party fraud - Product not received (unless proven delivery) - Product not as described - Subscription billing disputes ### Guarantee Provider Comparison | Provider | Founded | Target Market | Pricing (checked 2026-08-02) | Key Differentiator | |----------|---------|---------------|---------|-------------------| | **Signifyd** | 2011 (San Jose, CA) | Enterprise ecommerce | **Model published, numbers not.** "A percentage of the order total when an order is approved," varying by products, vertical, volume and average ticket. "No charge when an order is declined due to fraud" ([signifyd.com/pricing](https://www.signifyd.com/pricing/)) | Commerce Network cross-merchant intelligence | | **Riskified** | 2013 (Tel Aviv) - NYSE: RSKD | Enterprise (fashion, luxury, electronics, travel) | **Not published.** The pricing page is a contact form ([riskified.com/pricing](https://www.riskified.com/pricing/)) | High approval rates claimed, strong account management | | **NoFraud** | 2015 (New York) | SMB e-commerce | **Not published.** Per-transaction fee | Simple pass/fail model, easy onboarding | | **ClearSale** | 2001 | Cross-border merchants | **Not published.** Contact sales | Latin America strength, multilingual support | :::note[Nobody publishes a guarantee rate, so don't budget off a range] The 0.4-1.5% of GMV range you'll see quoted isn't a vendor number. No guarantee provider publishes one. Signifyd goes furthest and describes the shape of the deal. Riskified, Forter, NoFraud and ClearSale publish nothing at all. **Ask every one of them for the same four things in writing.** The percentage for your vertical at your average ticket. Exactly what it covers, including whether item-not-received abuse counts. How fast they reimburse. What happens to your rate if your fraud rate moves. Then compare the four quotes against each other. That's the only real market data you'll get. ::: For a deeper look at fraud prevention vendors beyond their guarantee products, see the [Fraud Vendor Landscape](/docs/fraud/vendors/landscape). ### Key Players #### Signifyd Founded 2011 in San Jose, CA. It's a Commerce Protection Platform for mid-market and enterprise e-commerce. Approved orders carry a 100% financial guarantee. That covers unauthorized transaction chargebacks and item-not-received claims. The Commerce Network pulls cross-merchant intelligence from thousands of merchant sites. Identities, devices and payment methods link across the network. The decision engine scores orders 0-1000 on 100+ signals, from order data plus Commerce Network history. There's more than the guarantee. Abuse Prevention handles return and promo abuse, Payments Optimization works auth rates and 3DS, and Account Protection covers ATO and fake accounts. Integrations: Shopify, Magento, Salesforce Commerce Cloud, BigCommerce, SAP Commerce, custom API. **Pricing:** Signifyd publishes its model and no numbers. In its own words: "Signifyd charges a percentage of the order total when an order is approved. What that percentage is varies depending on the specific products purchased, merchant vertical, order volume, and average ticket price, among other metrics." And: "There is no charge when an order is declined due to fraud." Enterprise contracts with annual commitments. Source: [signifyd.com/pricing](https://www.signifyd.com/pricing/), checked 2026-08-02. **Not covered:** Service/quality disputes, subscription cancellation disputes, non-fraud reason codes. #### Riskified Founded 2013 in Tel Aviv. Publicly traded (NYSE: RSKD). Enterprise fraud prevention, built around pushing approval rates up. The guarantee comes with reported approval rates of 95-98%. That's revenue back from orders other providers would decline. The merchant network is thousands of enterprise merchants. They share cross-merchant identity data, behavioral patterns and chargeback outcomes. Dispute Resolve handles representment on guaranteed orders. Device fingerprinting adds behavioral biometrics, mouse movements and typing patterns, through a JavaScript beacon and mobile SDKs. Four other products sit alongside it. Policy Protect covers return, promo and reseller abuse. Account Secure covers ATO, and Payment Optimization works auth rates and retry logic. PSD2 Optimization handles SCA and 3DS exemptions for the EU. Integrations: Shopify, Magento, Salesforce Commerce Cloud, BigCommerce, WooCommerce, custom API. **Pricing:** not published. The pricing page is a contact form ([riskified.com/pricing](https://www.riskified.com/pricing/), checked 2026-08-02). No rate card, no description of the model. Annual enterprise contracts are typical. **Ask for** the percentage of approved GMV. Ask whether declined orders carry any fee. Ask for the guarantee scope and the chargeback liability transfer terms. **Not covered:** Quality disputes, subscription cancellations, service complaints. #### NoFraud Founded 2015 in New York. SMB fraud prevention, built for non-technical merchants. Approved orders carry a 100% financial guarantee. The decision comes back pass, fail or review. No score to interpret. The pitch is "pay only for orders we approve". The guarantee sits inside the per-transaction fee. Integration is fast, through native apps for Shopify, WooCommerce, Magento, BigCommerce, Volusion and 3dcart, or a custom API. Manual review for borderline orders is built in. So are device fingerprinting, identity verification and velocity checks. It costs less than the enterprise options, Signifyd and Riskified. **Best for:** SMB merchants who want the guarantee without enterprise complexity #### ClearSale **Key strengths:** - Guaranteed fraud protection - Strong presence in Latin America - Multilingual support **Best for:** Cross-border merchants :::note[Guarantee Provider Comparison] Signifyd tends to win large-enterprise retail on its Commerce Network. Riskified gets noted for account management and high approval rates in fashion and luxury. NoFraud serves SMBs with a simpler, cheaper model. All three back approved orders with 100% financial guarantees against fraud chargebacks. Ratings move, so don't take this as current without checking. ::: ## Issuer-Specific Considerations Issuers receive disputes, they don't send them. The vendor landscape looks different from that side. ### Issuer Focus Areas #### Reducing Inbound Disputes Consumer Clarity and Order Insight enrollment cuts "unrecognized charge" disputes. Better transaction descriptors help cardholders recognize what they bought. Real-time alerts warn cardholders about suspicious transactions. #### Alert Network Participation Issuers receive Ethoca and Verifi alerts, they don't send them. Enrollment improves merchant relationships. It may cut cardholder friction against an immediate chargeback. #### Important Note on TC40/SAFE Alerts stop the chargeback, but the fraud report can still get filed. That's TC40 for Visa and SAFE for Mastercard. Those feed into VAMP (Visa Acquirer Monitoring Program) and similar monitoring. Resolving an alert doesn't suppress the fraud report. It matters if you're watching your network ratios. #### Case Management Integration Pull alert data into your existing fraud case management. Track alert-to-chargeback conversion. Use alert patterns to spot fraud trends. ## Building Your Chargeback Stack The right mix depends on volume, fraud mix and capacity. ### Minimum Viable Approach RDR for Visa plus Ethoca Alerts for Mastercard, through one reseller. That covers both major networks without much complexity. It's a good starting point for most merchants. ### Full-Stack Approach RDR plus CDRN plus Ethoca gives maximum pre-dispute coverage. A representment service catches what slips through. An analytics platform finds root causes. Add a guarantee provider if fraud losses are big. ### ROI Calculation Framework **Alert ROI:** ``` Alert cost: not published - use your reseller's written per-alert quote Chargeback cost avoided: transaction value + your processor's dispute fee + operational cost + ratio impact Break-even: alert cost cost, ROI is positive ``` **Guarantee ROI:** ``` Cost: % of approved GMV Value: Fraud loss elimination + operational savings Break-even: If fraud rate ร— AOV > guarantee cost, ROI is positive ``` ## Questions to Ask Chargeback Vendors ### Alert Providers - What's your coverage overlap with my card network mix? - How do you handle duplicate alerts across networks? - What's the SLA for alert delivery and response window? - How do you measure and report prevented chargebacks? - What integration options exist (API, processor, platform)? ### Representment Services - What's your win rate by reason code? - How do you define "win" (cases or dollars)? - What evidence sources do you integrate with? - What's your average time to resolution? - Do you handle all networks/reason codes? ### Guarantee Providers - Exactly what chargeback types are covered? - What's excluded from the guarantee? - What's the claims process? - How quickly are reimbursements paid? - What happens if my fraud rate spikes? Can you terminate? :::warning[Red Flags] - Unclear coverage percentages - No transparency on alert sources (are they reselling or direct?) - Excessive volume minimums for your transaction count - No dispute-level reporting - Vague guarantee exclusions - High-pressure annual commitment for unproven service ::: ## Next Steps **Setting up alert services?** 1. [Understand the two networks](#the-two-networks) - Verifi and Ethoca 2. [Compare coverage](#coverage-comparison) - RDR vs CDRN vs Ethoca 3. [Choose reseller vs direct](#reseller-vs-direct) - Start with reseller **Evaluating representment services?** 1. [Compare vendors](#representment-vendor-comparison) - Side-by-side comparison table 2. [Review key players](#key-players) - Chargebacks911, Chargeflow, Justt, Chargeback Gurus 3. [Ask the right questions](#what-to-ask-representment-vendors) - Win rate by reason code 4. [Calculate ROI](#roi-calculation-framework) - Recovery vs cost **Considering chargeback guarantees?** 1. [Understand how guarantees work](#how-guarantees-work) - What's covered 2. [Compare providers](#guarantee-provider-comparison) - Signifyd, Riskified, NoFraud 3. [Calculate ROI](#roi-calculation-framework) - Fraud rate vs cost --- ## See Also - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - How chargebacks work end-to-end - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention strategies - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deep dive on alert services - [Fraud Vendor Landscape](/docs/fraud/vendors/landscape) - Prevention vendors - [Fraud Vendor Selection](/docs/fraud/vendors/selection-guide) - How to evaluate vendors - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Winning Evidence](/docs/chargebacks/winning-evidence) - What wins disputes - [Setup Dispute Alerts](/docs/playbooks/setup-dispute-alerts) - Implementation guide - [Vendor Selection Guide](/docs/reference/vendor-selection) - Evaluation framework - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates --- ## Your First Chargeback Source: https://paymentsandrisk.com/docs/chargebacks/your-first-chargeback :::tip[Quick Action Guide] Just got a chargeback? You're in the right place. This page gets you to a decision fast. If you want the background first, start with [What Is a Chargeback?](/docs/chargebacks). ::: # Your First Chargeback :::info[TL;DR] - One chargeback is normal - the real cost is $140-150 (transaction + fee + your time), not an emergency unless it becomes a pattern - **Find your response deadline first.** You have 20-45 days depending on the card network, and missing it means you lose automatically - Your chargeback ratio is what matters: under 0.5% is healthy, 0.65% is where you should set your own alarm, 0.9% requires immediate crisis response - Fix your billing descriptor first - customers disputing because they don't recognize the charge is the most common and most preventable cause - Fight the chargeback only if you have evidence and the transaction is large enough to justify 1-3 hours of your time ::: :::tip[Don't Panic] Every business that accepts cards gets chargebacks eventually. One chargeback does not put your business at risk. What matters is how you respond and whether it becomes a pattern. ::: A customer or their bank disputed a charge, the money is already out of your account, and one of these is normal. ## What Just Happened A customer (or their bank) disputed a charge you made. Instead of contacting you for a refund, they went through their bank's dispute process. The bank sided with the cardholder and reversed the transaction, pulling the money back out of your account. This is called a chargeback. You didn't just lose the sale. You probably also got hit with a chargeback fee. Most processors charge $15, the published US range is $0 to $30, and Square charges nothing at all. The dispute now counts toward your chargeback ratio. That ratio is the number the card networks use to decide if you have a dispute problem. The good news: one chargeback is completely normal. It happens to every merchant. The process exists to protect consumers under the [Fair Credit Billing Act](/docs/chargebacks/consumer-rights), and sometimes legitimate customers use it instead of asking you for a refund. What matters now is how you handle it. ## What It Actually Costs You Here's the real cost of a single chargeback on a $100 transaction: | Line Item | Amount | Notes | |-----------|--------|-------| | Transaction amount | $100.00 | Returned to the customer's bank | | Chargeback fee | $0 to $30, usually $15 | [Check your processor](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated). Some refund it if you win | | Product/service | Already delivered | You don't get it back | | Your time to respond | 1-3 hours | Gathering evidence, writing rebuttal | | **Total real cost** | **~$140-150** | Sale + fee + time + cost of goods | One chargeback at these amounts is annoying, not dangerous. It's the equivalent of a bad Yelp review. Worth paying attention to, but not an emergency. ## Should You Fight It? Not every chargeback is worth fighting. Ask yourself three questions: **1. Was the customer right?** If you didn't deliver, the product was defective, or you forgot to cancel a subscription, accept the chargeback. Fix the root cause so it doesn't happen again. Fighting a legitimate dispute wastes your time and you'll lose anyway. **2. Do you have evidence?** If you have delivery confirmation, signed receipts, login logs, or communication showing the customer received what they paid for, fight it. See the [Representment Guide](/docs/chargebacks/representment) for how to build your case and the [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) page for what actually wins. **3. Is it under $25?** If the transaction was small and you don't have strong evidence, it's probably not worth the 1-3 hours to fight it. Your time is better spent preventing the next one. ## What to Do Right Now (30 Minutes) ### Step 1: Find the dispute and write down your deadline (5 minutes) | Processor | Where to look | |-----------|---------------| | **Square** | Dashboard > Transactions > Disputes | | **Stripe** | Dashboard > Payments > Disputes (also emailed to you) | | **PayPal** | Resolution Center | | **Shopify Payments** | Orders > the disputed order (also emailed to you) | | **Braintree** | Control Panel > Disputes | | Anyone else | Search your dashboard for "Disputes," or call support and ask | The notification shows a **response deadline**. This is the single most time-sensitive fact on it: miss the deadline and you lose automatically, no matter how good your case is. Put it on your calendar, minus 3 days for safety. How much time the networks allow: | Network | Time to respond | |---------|-----------------| | Visa | 30 days | | Mastercard | 45 days | | Amex | 20 days | Your processor may give you *less* time than the network allows, so **the date printed on your notification is the one that counts.** The good news: you have days, not hours. Respond methodically, just don't let it slip. ### Step 2: Read the reason code (5 minutes) The notification includes a reason code (like "10.4" or "4853") that tells you what the customer claims happened - fraud, "never received it," "cancelled but still charged," and so on. The reason code determines what evidence you'd need to win. Look yours up in the [Reason Code Reference](/docs/reference/reason-codes), and see [Reading a Chargeback Notification](/docs/chargebacks/reading-a-chargeback-notification) for a field-by-field breakdown of everything else on the notice. ### Step 3: Decide whether to fight (10 minutes) Use the three questions in [Should You Fight It?](#should-you-fight-it) above. If you're fighting, the [Representment Guide](/docs/chargebacks/representment) shows how to build the case. If you're accepting, you're done with this dispute - spend your remaining 10 minutes on the checks below so the next one is less likely. :::note[Take cards in person? Your evidence is different] If the disputed charge was dipped, tapped, or swiped in your shop, most online-merchant advice (delivery confirmation, shipping tracking) doesn't apply to you. Your evidence is the receipt: for a "fraud" dispute on a chip or tap transaction, submit the receipt showing the card was chip-read (plus signature if you have one). Under the networks' EMV liability rules, counterfeit-fraud disputes on chip-read transactions generally fall on the card's bank, not on you. ::: ### Then: three quick checks (10 minutes) - **Check your chargeback ratio.** Log into your processor dashboard and look at your dispute rate. Divide your chargebacks this month by your total transactions this month. If the result is under 0.5%, you're fine. Write the number down so you have a baseline. - **Look at your billing descriptor.** Pull up your own credit card statement and find a charge from your business. Does it look recognizable? If it says something like "PAY*XYZ LLC" instead of your actual business name, customers may be disputing because they don't recognize the charge. This is one of the most common (and most fixable) causes of chargebacks. - **Search your email for this customer.** Did they try to contact you before filing the dispute? If they did and you missed it (or were slow to respond), that's a signal your customer service process needs tightening. If they never reached out at all, that tells you something different: they may not have known how, or they may be committing friendly fraud. ## When to Actually Worry Not all chargeback situations are equal. Here's how to calibrate your concern: - **1 chargeback:** Normal. Respond to it (or accept it), learn from it, and move on with your day. - **2-3 per month on low volume:** Pay attention. Look for a pattern. Is it the same product? Same complaint? Same customer demographic? Patterns mean there's a root cause you can fix. - **Ratio approaching 0.65%:** You've hit early warning territory. That's an internal alarm rather than a Visa one, since Visa's own first line is 0.5% non-compliant. Time to read about [monitoring thresholds](/docs/chargebacks/monitoring/thresholds) and take preventive action. - **Ratio above 0.9%:** This is a real problem. You're at risk of entering a network monitoring program with monthly fines. Go to [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) immediately. **How to calculate your ratio:** ``` Chargeback Ratio = Chargebacks This Month รท Transactions This Month ร— 100 Example: 3 chargebacks รท 500 transactions = 0.6% ``` :::note Visa uses the *current month's* chargebacks divided by the *current month's* transactions. Mastercard uses the *current month's* chargebacks divided by the *prior month's* transactions. For a rough check, either method works. Just know the exact calculation varies by network. ::: ## Prevent the Next One You can't eliminate chargebacks entirely, but you can dramatically reduce them. These five actions have the highest impact for merchants who are just starting to deal with disputes: - **Make your billing descriptor recognizable.** It should show your business name as customers know it, not your legal entity name. Contact your processor to update it if needed. - **Send order confirmation emails with your business name prominently displayed.** When a customer sees a charge they don't recognize, the first thing they check is their email. Make sure your confirmation is easy to find and clearly matches the charge. - **Make refunds easy to find.** Put your refund policy and contact info on your website, in confirmation emails, and on receipts. A refund costs you the sale. A chargeback costs you the sale *plus* a fee *plus* a ratio hit. You always want the refund. - **If you bill on a recurring basis, send renewal reminders before charging.** "You'll be charged $49 on March 1st" sent 3-5 days before the charge prevents a huge number of "I didn't authorize this" disputes. - **Respond to customer service inquiries fast.** Many chargebacks happen because the customer couldn't reach you or gave up waiting. A same-day response to a complaint is cheaper than a chargeback every time. For a complete prevention strategy, see the [Prevention Overview](/docs/chargebacks/prevention). :::tip[Experiment to Run] For the next 30 days, add a clearly worded return/refund link to your order confirmation emails. Track whether chargeback volume changes. Most merchants who do this see chargebacks drop because customers refund instead of disputing. ::: :::info[Scale Matters] **Under $50K/month:** One chargeback is noise. Respond if you have evidence, accept if you don't, and focus on making your descriptor and refund process clear. **$50K-$500K/month:** Track your ratio monthly. If chargebacks are consistently above 0.5%, investigate the pattern and consider [alert services](/docs/chargebacks/prevention/alerts). **Over $500K/month:** You should have a formal dispute response process. See the [Prevention Overview](/docs/chargebacks/prevention) for tools and strategies at this tier. ::: ## Next Steps [ ๐Ÿ“– The Full Walkthrough 25-minute learning pathway covering the entire dispute process from start to finish. ](/docs/learning-pathways/handling-your-first-chargeback/how-disputes-work) [ ๐Ÿ›ก๏ธ Prevention Overview Strategies and tools to stop chargebacks before they happen. ](/docs/chargebacks/prevention) [ โš”๏ธ Representment Guide How to fight a chargeback and build a winning case. ](/docs/chargebacks/representment) --- ## Zero Point Nine Panic Source: https://paymentsandrisk.com/docs/chargebacks/zero-point-nine-panic # Zero Point Nine Panic :::info[TL;DR] - At 0.9% chargeback ratio you have days, not weeks - the cash flow spiral (more reserves, slower payouts, less inventory) compounds fast if you don't act today - Hour 1: stop processing the channel generating most chargebacks and call your processor before they call you - Days 1-3: start alert enrollment, but don't count on it this week. Only RDR is automatic. Ethoca and CDRN just send an alert, and someone on your side has to refund inside 24-72 hours. Enrollment runs 3-7 business days per provider, so it's a week-2 lever, not a today lever - This page is for stopping the bleeding right now; use the [Reduce Chargebacks Fast playbook](/docs/playbooks/reduce-chargebacks-fast) for the 4-week root-cause fix ::: :::info[This Page vs. Reduce Chargebacks Fast] **This page** is hour-by-hour triage: what to do right now to stop the bleeding. **[Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast)** is the structured 4-week playbook to diagnose root cause and fix it. Start here for the emergency, then move to the playbook for sustained reduction. ::: Your [chargeback ratio](/docs/chargebacks/metrics) hit 0.9%. Your [processor](/docs/operations/processor-management) is sending warning emails. They may start passing through [VAMP fees](/docs/chargebacks/reference/network-programs). This isn't the week to build a [fraud](/docs/fraud) strategy. This is triage. 0.9% Visa processor concern threshold 30-60 days Window to fix before escalation $0-30 Per-chargeback fee, most often $15, on top of the lost sale The cash flow spiral starts now. Your processor holds more in reserve. Payouts slow down. You can't fund inventory or ads, so sales drop, so the ratio gets worse. Break the cycle today. ## Crisis Response Timeline ```mermaid flowchart LR subgraph H1["Hour 1"] A[Stop risky\ntransactions] A1[Call processor] A2[Enable RDR/Ethoca] end subgraph D1["Day 1"] B[Audit recent\norders] B1[Support blitz] B2[Check descriptor] end subgraph W1["Week 1"] C[Refund-first\npolicy] C1[Proactive outreach] C2[Fix cancellation] end subgraph W2["Week 2+"] D[Monitor metrics] D1[Track ratio daily] D2[Iterate on fixes] end H1 --> D1 --> W1 --> W2 ``` ## What Matters 1. **Stop the bleeding first.** New chargebacks hurt more than old ones right now. 2. **Deflection tools won't work this week.** Enrollment runs 3-7 business days per provider, often 1-2 weeks all in. Start the paperwork today. But this week's relief has to come from refunds, and from switching off whatever is generating the disputes. 3. **Refund generously this week.** A refund costs less than a chargeback. 4. **Your ratio is a 30-day rolling window.** Today's actions affect next month's math. 5. **MATCH listing costs you 5 years of normal processing.** Avoid it at almost any cost. At 0.9% you're under the published code 04 floor, so you aren't listable for chargebacks yet. --- ## Hour 1: Immediate Actions Do these now. Not after lunch. Now. ### Stop Risky Transactions - **Pause high-risk product sales** if you have clear problem SKUs - **Increase fraud screening aggressiveness** temporarily (accept higher false positives) - **Require 3DS on all transactions** if you weren't already - **Block high-risk countries** you don't need ### Contact Your Processor Call, don't email. - Ask: "What's my current ratio and what's the threshold?" - Ask: "Am I in a monitoring program or warning period?" - Ask: "What happens if I breach next month?" - Tell them: "I'm implementing remediation today. What do you need from me?" Processors want you to survive. They make money when you process. But they need to see you moving. :::tip[Need a script?] See [Processor Warnings: Communication Templates](/docs/chargebacks/processor-warnings#communication-templates) for phone scripts, remediation plan emails, and weekly update templates. ::: ### Enable Deflection Tools If you don't have these, sign up today: | Tool | What It Does | Time to Active | |------|--------------|----------------| | **Verifi RDR** | Auto-refunds Visa disputes based on rules you set. The only genuinely hands-off option | 3-7 business days to activate | | **Ethoca Alerts** | Alerts you on Mastercard disputes. **You** refund, within 24-72 hours | 3-7 business days to activate | | **CDRN** | Alerts you on Visa disputes. **You** refund, within ~72 hours | 3-7 business days to activate | RDR is the fastest win. You set rules, say "auto-refund all disputes under $100". Matching disputes never become chargebacks. **Cost:** $15-40 per alert or resolution. Your processor's chargeback fee runs $0 to $30, most often $15, and the ratio damage costs more than either. --- ## Day 1: Stabilization ### Audit Recent Transactions Pull the last 7 days of orders. Flag: - High-ticket items to new customers - International orders (if you're domestic-focused) - Rush shipping requests - Mismatched billing/shipping - Velocity anomalies (same card, same device, same address) Refund the suspicious ones now, before they turn into chargebacks. ### Customer Support Blitz Your support team is your front line. **Immediate changes:** - Authorize support to issue refunds up to $X without approval - Reduce response time target to ~1.5% | Merchant Excessive threshold. Fines start. | The merchant excessive threshold is 1.5% (2.2% in CEMEA), effective 1 April 2026. Your acquirer may apply stricter internal thresholds (most flag you around 0.9%). ### Mastercard ECM | Chargebacks | Ratio | Status | |-------------|-------|--------| | 80% of alerts refunded | | **Support contacts about billing** | Leading indicator of disputes | Trending down | | **Ratio projection** | Where will you be next month? | Below threshold | | **Dispute reason code distribution** | What type of disputes? | Identifies root cause | ### Daily Ratio Tracking In a crisis, track it every day. This is the Mastercard-shaped estimate, which is the harsher of the two: ``` Today's estimate = (Chargebacks in rolling 30 days) / (Sales in prior 30 days) ``` Plot it. Watch the trend. Celebrate when it turns. --- ## Next Steps **In a crisis right now?** 1. [Follow the Reduce Chargebacks Fast playbook](/docs/playbooks/reduce-chargebacks-fast) โ†’ Immediate triage steps 2. [Set up dispute alerts today](/docs/playbooks/setup-dispute-alerts) โ†’ Stop chargebacks before they hit 3. Calculate your exact ratio โ†’ Know how close you're getting **Stabilizing after a spike?** 1. Analyze your dispute reasons โ†’ What's driving the chargebacks? 2. Fix root causes โ†’ Descriptors, refund process, customer communication 3. Build monitoring โ†’ Daily ratio tracking to catch problems early **Preventing the next crisis?** 1. [Understand VAMP/ECM thresholds](/docs/compliance/network-rules/dispute-monitoring) โ†’ Know the program rules 2. Set internal thresholds lower than network limits โ†’ Early warning system 3. [Review chargeback prevention](/docs/chargebacks/prevention) โ†’ Systematic prevention --- ## Related Pages - [Network Programs Reference](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN setup - [Reduce Chargebacks Fast Playbook](/docs/playbooks/reduce-chargebacks-fast) - Crisis playbook - [Winning Evidence](/docs/chargebacks/winning-evidence) - Fighting chargebacks - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Billing clarity - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention hierarchy - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking ratios - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund vs. fight - [Processor Management](/docs/operations/processor-management) - Working with processors - [Holds and Reserves](/docs/operations/holds-and-reserves) - Understanding reserves - [3D Secure](/docs/fraud/prevention/3ds) - Fraud prevention with auth :::tip[New to chargebacks?] Crisis handled? Learn the foundations so this doesn't happen again. **[Start The Guide, Pathway 2: Handling Your First Chargeback](/docs/learning-pathways/handling-your-first-chargeback/how-disputes-work)**, a 25-minute walkthrough of what chargebacks are, how to respond, and what evidence wins. ::: --- # Fraud ## Fraud Detection Source: https://paymentsandrisk.com/docs/fraud/detection # Fraud Detection :::info[TL;DR] - **Signals** = Data points indicating risk (device, velocity, behavior, identity) - **Rules** = Fast, explainable, good for known patterns - **ML models** = Find patterns you haven't seen, but they need training data - **Stack by stage**: Starter (rules + AVS) โ†’ Intermediate (+ device ID + ML) โ†’ Advanced (+ behavioral) - Detection is **layered**. Nothing catches everything on its own ::: Something's getting through and you want to catch it earlier. Build the stack your volume justifies, not the one a vendor's selling. --- ## How Detection Works ```mermaid flowchart LR A[Transaction\nData] --> B[Signal\nExtraction] B --> C{Rules &\nML Models} C -->|Low Risk| D[Auto-Approve] C -->|High Risk| E[Auto-Decline] C -->|Medium Risk| F[Manual Review] F --> G{Analyst\nDecision} G -->|Legit| D G -->|Fraud| E ``` | Component | Purpose | Example | |-----------|---------|---------| | **Signals** | Raw data points | Device ID, IP, velocity, AVS result | | **Rules** | Known-pattern matching | "Block if >5 cards in 1 hour" | | **ML Models** | Pattern discovery | Anomaly score from transaction features | | **Review** | Human judgment | Edge cases, high-value orders | ## Core Topics ### [Evidence Framework](./evidence-framework) How to sort signals into Tier 1 and Tier 2: - Tier 1: High confidence, standalone indicators - Tier 2: Supporting evidence, combine for confidence ### [Rules vs. ML](./rules-vs-ml) Which one you've actually got a use for: - When rules work best - When ML excels - Hybrid approaches ## Detection Methods | Method | Coverage | Use Case | |--------|----------|----------| | [Velocity Rules](./velocity-rules) | Transaction patterns | Real-time decisioning | | [Data Enrichment](./data-enrichment) | IP, email, phone signals | Enriching transaction data | | [Building Fraud Rules](./building-fraud-rules) | Rule sets, allow/block lists | Day-one setup and lifecycle | | [Fraud Model Feedback](./fraud-model-feedback) | ML feedback loops | Model accuracy and monitoring | | [Device Fingerprinting](./device-fingerprinting) | Device/browser attributes | Account-level linking | | [Behavioral Analytics](./behavioral-analytics) | User behavior patterns | ATO, bot detection | | [Identity Verification](./identity-verification) | Identity confirmation | Application, step-up | | [Manual Review](./manual-review) | Complex/edge cases | High-value decisions | ## Building Your Detection Stack ### Starter Stack 1. Basic [velocity rules](./velocity-rules) 2. [AVS/CVV verification](/docs/fraud/prevention/avs-cvv) 3. Simple device ID 4. [Manual review](./manual-review) queue ### Intermediate Stack 1. Advanced [velocity rules](./velocity-rules) 2. [Device fingerprinting](./device-fingerprinting) service 3. [Data enrichment](./data-enrichment) (IP, email, phone intelligence) 4. [ML scoring](./rules-vs-ml) (vendor or custom) 5. [Fraud rule lifecycle management](./building-fraud-rules) (shadow mode, allow/block lists) 6. Case management system A [full-stack fraud platform](/docs/fraud/vendors#full-stack-fraud-platforms) (Sift, Sardine, Kount) bundles items 2-4 into one integration. You can assemble the same thing from separate vendors. It's just more plumbing. [Fraud vendors](/docs/fraud/vendors) covers when each way makes sense. ### Advanced Stack 1. Real-time [ML models](./rules-vs-ml) 2. [Behavioral biometrics](./behavioral-analytics) 3. Network analysis 4. Custom feature engineering 5. Automated decision engine 6. [ML feedback loops](./fraud-model-feedback) and model monitoring 7. [Operational cadence](/docs/operations/running-fraud-operations) (daily/weekly/monthly reviews) ## When to Escalate It's all in the [evidence framework](./evidence-framework): Tier 1/Tier 2 indicators and when to escalate. ## Popular in This Section - **[Evidence Framework](./evidence-framework)** - Tier 1/Tier 2 indicator system - **[Velocity Rules](./velocity-rules)** - Real-time transaction limits - **[Device Fingerprinting](./device-fingerprinting)** - Identifying devices across sessions - **[Manual Review](./manual-review)** - When humans beat algorithms ## Related Topics - [Fraud Types](/docs/fraud/types) - Know what you're detecting - [Prevention Strategies](/docs/fraud/prevention) - Stop fraud before it happens - [Fraud Metrics](/docs/fraud/metrics) - Measure detection effectiveness - [Risk Appetite](/docs/fraud/fundamentals/risk-appetite) - Tolerance thresholds - [Fraud Economics](/docs/fraud/fundamentals/economics) - Cost of fraud decisions - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Native fraud tools - [Fraud Vendor Landscape](/docs/fraud/vendors/landscape) - Third-party tools - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence playbook - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflection before dispute - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence for representment - [Network Programs](/docs/chargebacks/reference/network-programs) - Monitoring thresholds - [Benchmarks](/docs/reference/benchmarks) - Industry comparisons - [3D Secure](/docs/fraud/prevention/3ds) - Authentication layer --- ## Fraud Fundamentals Source: https://paymentsandrisk.com/docs/fraud/fundamentals # Fraud Fundamentals :::info[TL;DR] - Pick tools and write rules later. First understand what's driving every fraud decision you make - Two pages here: [Economics of Fraud](./economics) for what fraud really costs, and [Risk Appetite](./risk-appetite) for how tight to set the rules - The core trade-off never changes. Block more fraud or block fewer good customers. You don't get both - Read this before you spend money on a fraud tool ::: Pick tools and write rules later. First understand what's driving every fraud decision you'll make. These two pages cover the why. ## What You'll Learn | Page | What It Covers | Read This If... | |------|---------------|-----------------| | **[Economics of Fraud](./economics)** | The true cost of fraud (direct losses, false positives, operational costs, customer impact) | You need to justify fraud prevention spend or understand why blocking too much is also expensive | | **[Risk Appetite](./risk-appetite)** | How to balance fraud loss tolerance, customer friction, conversion targets, and regulatory requirements | You're deciding how aggressive your fraud rules should be or where to set your score thresholds | ## The Core Trade-off Every fraud decision is the same trade-off. **Block more fraud** or **block fewer good customers**. Tighten your rules and you catch more fraud. You also reject more real sales. Loosen them and you approve more revenue and eat more losses. The right balance depends on your business. A $5 digital good isn't a $500 physical product. A business at a 0.1% fraud rate doesn't choose like one at 1.5%. These two pages get you there: 1. **Start with [Economics](./economics)** and learn what fraud actually costs. It's more than the transaction amount. 2. **Then read [Risk Appetite](./risk-appetite)** and set your thresholds against your own business model. ## Key Principles 1. **Not all fraud is created equal** - [first-party](/docs/fraud/types/first-party) abuse and [third-party fraud](/docs/fraud/types/third-party) need different responses. 2. **Prevention has costs too** - false positives cost you revenue and customers. See [Economics](./economics). 3. **Speed matters** - early detection limits losses, so read the [Detection Framework](/docs/fraud/detection/evidence-framework). 4. **Data is your weapon** - invest in [device fingerprinting](/docs/fraud/detection/device-fingerprinting), [velocity rules](/docs/fraud/detection/velocity-rules), and evidence collection. 5. **3DS is your friend** - [3D Secure](/docs/fraud/prevention/3ds) shifts liability for stolen card fraud to the issuer. ## Related Topics - [Fraud Types](/docs/fraud/types) - Taxonomy of fraud patterns - [Detection Methods](/docs/fraud/detection) - How to identify fraud - [Prevention Strategies](/docs/fraud/prevention) - How to stop fraud before it happens - [Chargebacks](/docs/chargebacks) - When fraud becomes disputes - [Fraud Metrics](/docs/fraud/metrics) - Measuring fraud performance - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold consequences - [3D Secure](/docs/fraud/prevention/3ds) - Authentication trade-offs - [Rules vs ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches - [Benchmarks](/docs/reference/benchmarks) - Industry comparisons --- ## Fraud Source: https://paymentsandrisk.com/docs/fraud # Fraud :::info[TL;DR] - Fraud hurts twice. You lose money on bad orders, then you lose more when you panic and block good customers - There's no single fraud strategy. You run a series of bets and keep the ones that improve your loss-adjusted margin - Pick your mode below: Operator for what to do this week, Analyst for what to measure, Reference for the lookup tables - Before you buy anything, find out which [fraud type](/docs/fraud/types) you actually have. Most SMBs guess wrong - Seen a different definition of first- or third-party fraud elsewhere? [The industry does not agree](/docs/reference/fraud-classification) ::: Fraud hurts twice. You lose money on bad orders, then you lose more when you panic and block good customers. You don't pick a single fraud strategy. You run a series of bets and keep the ones that improve your loss-adjusted margin. --- ## Pick Your Mode [ ๐Ÿ”ง Operator Actions for this week. Configure processor rules, set up AVS/CVV, tune velocity limits. Start: Processor Rules Config ](/docs/fraud/processor-rules-configuration) [ ๐Ÿ“Š Analyst Metrics and measurement. Fraud rates, false positives, rules vs ML analysis. Start: Fraud Metrics ](/docs/fraud/metrics) [ ๐Ÿ“š Reference Codes and patterns. Fraud types, card-present vs CNP, liability rules. Start: Fraud Types ](/docs/fraud/types) Popular --- ## Before You Do Anything Else Most merchants buy fraud tools before doing the basics. Do these first: 1. **Configure your processor's built-in fraud tools.** Stripe Radar, Braintree rules, Adyen RevenueProtect. These are free or cheap and catch obvious stuff. โ†’ [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) 2. **Use AVS and CVV.** Turn them on. Decline on full mismatch. โ†’ [AVS & CVV](/docs/fraud/prevention/avs-cvv) 3. **Prefer chip/tap for in-person.** If you're still swiping, stop. EMV shifts liability. โ†’ [Card-Present Fraud](/docs/fraud/card-present-fraud) 4. **Secure your terminals (card-present).** Check for skimmers, isolate from your network, use P2PE if possible. โ†’ [Terminal Security](/docs/fraud/terminal-security) 5. **Fix your descriptor and communication.** "I don't recognize this charge" is the most preventable dispute type. โ†’ [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms) 6. **Make refunds easy.** A refund costs 3%. A chargeback costs $50+. โ†’ [Refund Strategy](/docs/chargebacks/refund-strategy) 7. **Be cautious with real-time bank payments.** RTP and FedNow are irrevocable. โ†’ [FX and Settlement](/docs/payments/reference/fx-and-settlement) :::tip[If You Only Have 2 Hours This Week] 1. Pull your last 20 chargebacks and classify them: actual fraud vs. friendly fraud vs. merchant error 2. Call 2 customers who disputed. Ask what actually happened. 3. Check if your chargeback ratio is trending up or down That's it. Everything else can wait. ::: :::info[Scale Matters] **Under $100K/month:** Your processor's built-in tools are enough. Your "fraud" is probably friendly fraud, so focus on [chargebacks](/docs/chargebacks) instead. Don't buy a fraud vendor yet. **$100K-$1M/month:** Turn on AVS + CVV, configure your [processor's rules](/docs/fraud/processor-rules-configuration), and watch your chargeback ratio. Test one rule change per month. **Over $1M/month:** Time for dedicated fraud tooling. Evaluate vendors and run a pilot on one segment before going all-in. Read the [Selection Guide](/docs/fraud/vendors/selection-guide). **Over $10M/month:** You need a person, not just tools. Build the fraud function. Layer experiments across segments and instrument everything. ::: ### Fraud Prevention Setup Path Build your fraud defenses in this order. Each step builds on the previous. ```mermaid flowchart LR subgraph BASICS["1. Basics (Week 1)"] A1[AVS + CVV] --> A2[Processor Rules] A2 --> A3[Clear Descriptors] end subgraph INTERMEDIATE["2. Intermediate (Month 1)"] B1[Velocity Limits] --> B2[3DS for High-Risk] B2 --> B3[Address Verification] end subgraph ADVANCED["3. Advanced (Quarter 1)"] C1[Device Fingerprinting] --> C2[ML Scoring] C2 --> C3[Custom Rules Engine] end BASICS --> INTERMEDIATE INTERMEDIATE --> ADVANCED style A1 fill:#22c55e,color:#fff style A2 fill:#22c55e,color:#fff style A3 fill:#22c55e,color:#fff style B1 fill:#3b82f6,color:#fff style B2 fill:#3b82f6,color:#fff style B3 fill:#3b82f6,color:#fff style C1 fill:#8b5cf6,color:#fff style C2 fill:#8b5cf6,color:#fff style C3 fill:#8b5cf6,color:#fff ``` | Phase | When | Investment | Expected Impact | |-------|------|------------|-----------------| | **Basics** | Day 1 | Free/included | Catch 60-70% of obvious fraud | | **Intermediate** | $50k+/mo volume | $500-2k/mo | Reduce fraud 30-50% more | | **Advanced** | $500k+/mo volume | $5k+/mo | Fine-tune last 10-20% | **Don't skip ahead.** Most merchants who buy ML fraud tools without doing basics are wasting money. --- --- --- --- --- ## Card-Present vs. Card-Not-Present Different worlds, different fraud, different experiments. **Card-present (retail, restaurants):** Your main risk is counterfeit cards, which EMV chip largely solved. If you're still swiping, stop. Chip/tap shifts counterfeit liability to the issuer. Remaining risk is mostly employee fraud and return abuse. **Card-not-present (ecommerce, phone orders):** This is where the real fraud lives. No chip to verify, no signature that matters. You're relying on AVS, CVV, device signals, and 3DS. Default liability is on you unless you authenticate with 3DS. Most of this site focuses on CNP fraud because that's where merchants have real decisions to make. --- --- Detection **Start here:** [Rules vs. ML](/docs/fraud/detection/rules-vs-ml). Most teams under $10M should start with rules. [ โšก Velocity Rules The 80/20 of fraud detection. Quick wins that catch obvious patterns. ](/docs/fraud/detection/velocity-rules) [ ๐Ÿ“ฑ Device Fingerprinting When it works, when it doesn't. Browser vs native considerations. ](/docs/fraud/detection/device-fingerprinting) [ ๐Ÿ” Evidence Framework Tier 1 vs Tier 2 indicators. What signals actually matter. ](/docs/fraud/detection/evidence-framework) [ ๐Ÿ‘๏ธ Manual Review Building a review queue that doesn't waste time. ](/docs/fraud/detection/manual-review) Prevention [ โœ“ AVS & CVV The basics everyone should use. Free and effective. ](/docs/fraud/prevention/avs-cvv) [ ๐Ÿ” 3D Secure Liability shift and when it's worth the friction. ](/docs/fraud/prevention/3ds) [ ๐Ÿ“ˆ Risk Scoring Building or buying a scoring system. ](/docs/fraud/prevention/risk-scoring) Vendors **Under $1M:** Use your processor's built-in tools. Stripe Radar is fine. Don't buy anything else yet. **$1M-$10M:** If you want to outsource the decision, look at Signifyd or Riskified (chargeback guarantees) or Forter (decisions only, no guarantee by default). Test a guarantee model on a segment before going all-in. If you want control, look at Kount or Sift. If account-level fraud (ATO, onboarding) is your problem, look at Sardine. **Over $10M:** Layer tools. Consider Sardine for device/behavior alongside a transaction scoring tool. [ ๐Ÿ—บ๏ธ Vendor Landscape Full breakdown of who does what in the fraud prevention market. ](/docs/fraud/vendors/landscape) [ ๐Ÿ“‹ Selection Guide How to evaluate and choose the right tools for your business. ](/docs/fraud/vendors/selection-guide) --- ## Operations Day-to-day fraud operations: managing your review queue, maintaining block lists, reviewing rule performance, and responding to fraud spikes. [Running Fraud Operations](/docs/operations/running-fraud-operations) covers the full daily/weekly/monthly operational checklist. --- ## Metrics [Fraud Metrics](/docs/fraud/metrics) covers what to measure: fraud rate, false positive rate, detection rate, and benchmarks by vertical. --- ## Next Steps New to fraud prevention? [Fraud Economics](/docs/fraud/fundamentals/economics) - Understand the math [AVS & CVV](/docs/fraud/prevention/avs-cvv) - The basics everyone should use [Processor Rules](/docs/fraud/processor-rules-configuration) - Free tools first Experiencing fraud now? [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) - Stop the bleeding [Velocity Rules](/docs/fraud/detection/velocity-rules) - Quick wins [Manual Review](/docs/fraud/detection/manual-review) - Triage suspicious orders Building a fraud program? [Rules vs ML](/docs/fraud/detection/rules-vs-ml) - Choose your approach [Vendor Selection](/docs/fraud/vendors/selection-guide) - When to buy tools [Fraud Metrics](/docs/fraud/metrics) - What to measure --- :::tip[New to fraud prevention?] Start with **[The Guide, Pathway 3: Protecting from Fraud](/docs/learning-pathways/protecting-from-fraud/fraud-basics)**, a beginner-friendly 20-minute walkthrough that covers what fraud looks like, how to set up free protections, and what to monitor. This page is the full deep dive. ::: :::tip[Looking for a definition?] See the [Glossary](/docs/reference/glossary) for quick definitions of payments and fraud terms. ::: ## See Also [๐Ÿ’ณ Chargebacks](/docs/chargebacks) [๐Ÿ’ฐ Payments](/docs/payments) [๐Ÿ“‹ Compliance](/docs/compliance) [๐Ÿšจ Network Programs](/docs/chargebacks/reference/network-programs) [๐Ÿ“Š Benchmarks](/docs/reference/benchmarks) - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Chargeback Prevention](/docs/chargebacks/prevention) - Stopping disputes - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device intelligence - [Behavioral Analytics](/docs/fraud/detection/behavioral-analytics) - User behavior patterns - [Identity Verification](/docs/fraud/detection/identity-verification) - KYC and IDV - [Processor Management](/docs/operations/processor-management) - Working with acquirers - [Holds and Reserves](/docs/operations/holds-and-reserves) - Program consequences --- ## Asking the Bank to Verify the Shopper (3D Secure / 3DS) Source: https://paymentsandrisk.com/docs/fraud/prevention/3ds # Asking the Bank to Verify the Shopper (3D Secure / 3DS) :::info[TL;DR] - **3DS** = Authentication that shifts fraud liability from you to issuer on CNP transactions - **Worth it if**: Fraud over 0.5%, approaching Visa thresholds, margins can absorb a 2-5% [authorization](/docs/payments/reference/authorization-basics) drop - **Liability shift**: Visa ECI 05/06 = full shift; Mastercard SLI 2 (fully authenticated) / SLI 1 (attempted) = full shift; ECI 07 or no auth = you're liable - **Frictionless rate**: More data sent = 60-90% frictionless (no challenge); send everything you have - Roll out in phases: high-risk segments first, measure for 2 weeks, expand or kill ::: 3D Secure (3DS) is the step where the customer's bank checks that the real cardholder is the one buying. Sometimes the shopper sees it: a code by text, a tap in the banking app. Often the bank recognizes the customer from the data you sent and approves without showing anything at all. When the bank authenticates the payment, it takes on the fraud risk for it instead of you. That handover is called the liability shift, and it's the main reason merchants turn 3DS on. :::warning[The Golden Rule: 3DS Instead of Decline] **If you're thinking about declining a transaction for fraud, use 3DS instead.** When your fraud rules flag a transaction as risky, you have two options: 1. **Decline it** - You lose the sale. If it was a good customer, they're gone. 2. **Trigger 3DS** - The issuer authenticates them. If they pass, you get liability shift AND the sale. If they fail or abandon, you've lost nothing you wouldn't have lost anyway. 3DS is not just a fraud prevention tool. It's a recovery mechanism for transactions your rules would otherwise kill. ::: :::danger[3DS Does NOT Prevent All Chargebacks] Liability shift only covers **fraud chargebacks** (Visa 10.4, Mastercard 4837). Customers can still dispute for: - **Merchandise not received** - Package lost or never shipped - **Not as described** - Product doesn't match what you sold - **Services not rendered** - You didn't deliver what was promised - **Credit not processed** - You owe them a refund and didn't give it - **Processing errors** - Duplicate charges, wrong amounts A fully authenticated transaction that results in an unhappy customer is still a chargeback waiting to happen. 3DS protects you from "I didn't do it" fraud. It doesn't protect you from bad fulfillment, misleading product descriptions, or poor customer service. ::: :::info[Do I Need 3DS?] **No** - if your fraud rate is below 0.3% and you're not approaching [network program thresholds](/docs/chargebacks/reference/network-programs). Your current setup is working. Don't add friction you don't need. **Maybe** - if your fraud rate is 0.3-0.65%, or you see repeat disputers on high-value orders. Test 3DS on your riskiest segment first and measure the impact for 2 weeks. **Yes** - if your fraud rate exceeds 0.65%, chargebacks exceed 15% of orders in any product segment, or you're approaching monitoring program thresholds. You need the liability shift. **Simple starting rule:** Require 3DS on orders over $200 from customers with no prior purchase history. Measure auth rate impact for 2 weeks before expanding. If auth drops more than 5% with no fraud improvement, pull it back. ::: 3DS shifts liability to the [issuer](/docs/fraud/issuer-perspective) for authenticated [CNP](/docs/payments/payment-methods/cards) transactions. But it also adds friction that kills [conversion](/docs/payments/checkout-conversion) for some merchants. Before you flip the switch everywhere, run an experiment. :::tip[Experiment to Run] **Population:** Orders over $200 from customers with fewer than 2 prior purchases **Control:** Same segment, no 3DS challenge **Metrics:** Auth rate, cart abandonment, fraud rate, CB ratio (reason code 10.4) **Guardrail:** Auth rate can't drop more than 3% **Run length:** 2 weeks or 1,000 transactions per variant **Kill criteria:** If auth rate drops more than 5% in first 3 days with no fraud improvement, turn it off ::: :::info[This is a Bet] If you turn 3DS on for a segment, you're trading an expected auth rate drop (typically 2-5%) for liability shift on fraud chargebacks. That's worth it if: - Your [fraud rate](/docs/fraud/metrics) is high (over 0.5%) - You're approaching [Visa thresholds](/docs/chargebacks/reference/network-programs) (0.65%+) - Your margins can absorb the conversion hit It's probably NOT worth it if: - Your fraud rate is already low (under 0.3%) - Your margins are thin (see [interchange optimization](/docs/payments/interchange-optimization)) - Your customer base is older/less tech-savvy (higher challenge abandonment) Write down your assumptions before you start. Revisit them in 30 days. ::: --- ## 3DS Topics [ ๐ŸŽซ 3DS Exemptions When to skip authentication: TRA, low-value, recurring, corporate ](/docs/fraud/prevention/3ds/exemptions) [ ๐Ÿ“‹ First-Time 3DS Setup Step-by-step implementation playbook ](/docs/playbooks/first-time-3ds-setup) --- ## How 3DS Works | Version | Status | Key Features | |---------|--------|--------------| | 3DS 1.0 | Deprecated | Static passwords, high friction | | 3DS 2.0 | Current | Risk-based, frictionless options | | 3DS 2.1 | Current | Enhanced data, mobile support | | 3DS 2.2 | Current | SCA compliance, exemptions | ### Brand Names | Network | 3DS Brand Name | |---------|----------------| | Visa | Visa Secure | | Mastercard | Mastercard Identity Check | | American Express | American Express SafeKey | | Discover | ProtectBuy | --- ## Liability Shift Rules This is the whole point. When 3DS authentication succeeds, fraud liability shifts from you to the issuer. ### Visa (ECI Values) | ECI | Meaning | Liability Shift | |-----|---------|-----------------| | 05 | Fully authenticated | Yes, to issuer | | 06 | Attempted, issuer not enrolled/unavailable | Yes, to issuer (merchant attempted, issuer didn't participate) | | 07 | Not authenticated / Failed | No, merchant liable | ### Mastercard (SLI Values) | SLI | Meaning | Liability | |-----|---------|-----------| | 2 | Fully authenticated | Issuer | | 1 | Authentication attempted (merchant supports UCAF) | Issuer | | Other | Not authenticated | Merchant | ### When Liability Does NOT Shift Even with authentication: - Mail order/telephone order (MOTO) - [Recurring transactions](/docs/payments/subscriptions-recurring) (after initial) - Merchant-initiated transactions (MIT) - see [recurring billing compliance](/docs/compliance/subscriptions/recurring-billing) - Certain [MCC](/docs/reference/mcc-codes) exclusions --- ## Frictionless vs. Challenge Flow ### Frictionless Authentication The issuer's risk engine decides the cardholder is low-risk and authenticates without interaction. **Benefits:** - Better conversion (no extra steps) - Faster checkout - Still provides liability shift ### Challenge Flow Cardholder must complete verification (OTP, biometric, etc.). **When triggered:** - High-risk transaction signals - Issuer policy - Cardholder behavior anomalies - Amount thresholds ### Impact on Frictionless Rate More data = higher frictionless rate: | Data Quality | Typical Frictionless Rate | |--------------|--------------------------| | Minimal data | 30-50% | | Good data | 60-75% | | Excellent data | 80-90%+ | Send everything you have: shipping address, email, phone, device info, customer history, IP address. --- ## Rollout Strategy Don't turn it on everywhere at once. ### Phase 1: High-Risk Only (Week 1-2) Start with segments where [fraud](/docs/fraud/types) is concentrated: - High-risk BINs (prepaid, certain countries) - see [going global](/docs/payments/going-global) - New customers with no history - Orders over your average fraud amount Measure: [CB rate](/docs/chargebacks/metrics) change, [auth rate](/docs/payments/auth-optimization) change, cart abandonment. ### Phase 2: Expand or Kill (Week 3-4) If Phase 1 shows improvement: - Expand to medium-risk segments - Keep monitoring auth rate closely If Phase 1 shows no fraud improvement and auth dropped: - Kill it - Try a different segment or approach ### Phase 3: Steady State Once you find segments where 3DS works: - Lock in those rules - Monitor monthly for drift - Re-test quarterly as issuer behavior changes :::warning[Where Experiments Lie to You] - **Small samples:** 500 transactions isn't enough to measure fraud rate changes. You need thousands. - **Seasonality:** Fraud patterns shift. A rule that works in December may fail in March. - **Issuer behavior changes:** Frictionless rates depend on issuer risk engines, which update constantly. - **Selection bias:** If you only enable 3DS on high-risk orders, of course it will look effective. Compare to a control. ::: --- ## Chargeback Handling for 3DS When you get a fraud [chargeback](/docs/chargebacks/lifecycle) on an authenticated transaction, include the authentication data in your [representment](/docs/chargebacks/representment) response. **Mastercard (4837):** ``` AUTH MMDDYY/NNNNNN SL 1 ``` **Visa (10.4):** Include ECI value, CAVV, and 3DS transaction ID. ### When 3DS Doesn't Protect Even with authentication, [chargebacks](/docs/chargebacks) can occur for: - Non-fraud [reason codes](/docs/reference/reason-codes) (13.x) - Services not rendered (see [13.3](/docs/reference/reason-codes/visa/13-3-not-as-described)) - Goods not received (see [13.1](/docs/reference/reason-codes/visa/13-1-not-received)) - Processing errors - Authentication data errors --- ## Metrics to Watch Track these during your experiment: | Metric | What It Tells You | |--------|-------------------| | Frictionless rate | How often issuers are letting transactions through without challenge | | Challenge completion rate | How many customers complete the challenge vs. abandon | | Auth rate by ECI | Are you getting liability shift or just friction? | | Cart abandonment | Measure at checkout step, not just overall | | CB ratio on 10.4/4837 | The fraud chargebacks you're trying to prevent | --- ## The Bet Framing Sometimes the "right" decision loses a specific fight, but you keep it because expected value is positive over many fights. 3DS will occasionally let through a fraudster who passes the challenge. It will also occasionally cause a good customer to abandon. That's fine. The question is whether, across thousands of transactions, you're better off with it than without it. If you're not measuring, you're not betting. You're just guessing. --- ## Next Steps **If 3DS is working for you:** 1. [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combine with scoring for precision 2. [Velocity Rules](/docs/fraud/detection/velocity-rules) - Catch what 3DS misses 3. [Fraud Metrics](/docs/fraud/metrics) - Track your improvement **If 3DS is killing conversion:** 1. [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Lower-friction alternatives 2. [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Passive signals 3. [Rules vs ML](/docs/fraud/detection/rules-vs-ml) - Other approaches **Fighting 3DS chargebacks:** 1. [Visa 10.4 - CNP Fraud](/docs/reference/reason-codes/visa/10-4-fraud-cnp) - Reason code details 2. [Mastercard 4837 - Fraud](/docs/reference/reason-codes/mastercard/fraud) - Mastercard specifics 3. [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Win with authentication data --- ## See Also - [3DS Exemptions](./exemptions) - When to skip authentication - [PSD2 & SCA](/docs/compliance/psd2-sca) - European authentication requirements for US merchants - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining 3DS with scoring - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Complementary verification controls - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Catching what 3DS misses - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Passive fraud signals - [Fraud Metrics](/docs/fraud/metrics) - Measuring detection performance - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Network Programs](/docs/chargebacks/reference/network-programs) - Visa/MC thresholds - [Checkout Conversion](/docs/payments/checkout-conversion) - Friction impact - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Issuer Perspective](/docs/fraud/issuer-perspective) - How issuers evaluate 3DS - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - MIT after initial auth - [Representment](/docs/chargebacks/representment) - Fighting authenticated disputes --- ## Fraud Prevention Source: https://paymentsandrisk.com/docs/fraud/prevention # Fraud Prevention :::info[TL;DR] - Prevention works in layers: authentication, verification, then monitoring - [3D Secure](./3ds) is the only layer that shifts fraud liability to the issuer. Everything else just informs your own decision - [AVS and CVV](./avs-cvv) are free and worth switching on. Neither shifts liability, and neither should hard-decline on its own - Use what your processor already gives you before you buy anything ::: You're trying to stop fraud without blocking real customers. It's layers. Authenticate, verify, then watch. Nothing here works on its own. ## Key Prevention Methods ### Authentication | Method | Protection Level | Use Case | |--------|-----------------|----------| | [3D Secure 2.0](./3ds) | Strong | All CNP transactions | | Multi-Factor Auth | Strong | Account access | | Biometrics | Strong | Mobile/app transactions | ### Verification | Method | Protection Level | Use Case | |--------|-----------------|----------| | AVS | Medium | Address verification | | CVV/CVC | Medium | Card presence | | Email verification | Medium | Account validity | | Phone verification | Medium | Identity confirmation | ### Monitoring | Method | Protection Level | Use Case | |--------|-----------------|----------| | Machine learning | High | Pattern detection | | Rules-based | Medium | Known patterns | | Velocity checks | Medium | Unusual activity | | Manual review | Variable | High-risk orders | ## Authentication Deep Dive ### [3D Secure Implementation](./3ds) It's the strongest CNP tool you've got: - **Visa Secure** - Visa's 3DS brand - **Mastercard Identity Check** - Mastercard's 3DS brand - **American Express SafeKey** - Amex's 3DS brand - **Discover ProtectBuy** - Discover's 3DS brand Key benefits: - Liability shift to issuer on fraud - Reduced fraud chargebacks - Better customer authentication ## Prevention by Fraud Type ### [Third-Party Fraud](/docs/fraud/types/third-party) | Prevention | Effectiveness | |------------|--------------| | [3DS authentication](./3ds) | High | | [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) | High | | [Velocity rules](/docs/fraud/detection/velocity-rules) | Medium | | [AVS/CVV matching](./avs-cvv) | Medium | ### [Friendly Fraud](/docs/fraud/types/friendly-fraud) | Prevention | Effectiveness | |------------|--------------| | [3DS liability shift](./3ds) | Highest ([details](./defending-against-fraud-losses#layer-1-3ds-as-liability-shift)) | | [CE 3.0 evidence collection](./defending-against-fraud-losses#layer-2-evidence-collection-at-every-stage) | High | | [Clear descriptors](/docs/chargebacks/prevention/descriptors-and-comms) | High | | Order confirmations | High | | Delivery confirmation | High | | Pre-billing alerts | High | The full strategy's in [defending against fraud losses](./defending-against-fraud-losses). ### [Account Takeover](/docs/fraud/types/account-takeover) | Prevention | Effectiveness | |------------|--------------| | MFA on login | High | | [Device recognition](/docs/fraud/detection/device-fingerprinting) | High | | [Behavioral analytics](/docs/fraud/detection/behavioral-analytics) | High | | Session management | Medium | ## Layered Defense Strategy ```mermaid flowchart TD A[Transaction Attempt] --> B{Device\nFingerprint} B -->|Known bad| X1[Block] B -->|OK| C{Velocity\nCheck} C -->|Exceeds limits| X2[Block/Review] C -->|OK| D{3D Secure\nChallenge} D -->|Failed auth| X3[Block] D -->|Passed/Frictionless| E{AVS/CVV\nVerification} E -->|Mismatch| F[Flag for Review] E -->|Match| G{Fraud Score\nEvaluation} G -->|High risk| H[Manual Review] G -->|Low/Medium| I[Transaction Approved] F --> G H -->|Approved| I H -->|Declined| X4[Block] ``` ## Key Metrics | Metric | Target | Description | |--------|--------|-------------| | Fraud rate | under 0.5% | Fraud CBs / Total transactions | | False positive rate | under 3% | Good orders declined | | 3DS frictionless rate | 70-85%+ | Frictionless auth / Total 3DS | | Review rate | under 5% | Orders needing manual review | ## Vendor Landscape Third-party tools are in [fraud vendors](/docs/fraud/vendors). ## Popular in This Section - **[3D Secure Implementation](./3ds)** - Liability shift and authentication for CNP - **[AVS & CVV](./avs-cvv)** - Basic verification checks explained - **[Risk Scoring](./risk-scoring)** - Building effective fraud scores ## Next Steps **Just starting fraud prevention?** 1. [Enable 3D Secure](./3ds) - Biggest impact, liability shift 2. [Implement AVS/CVV](./avs-cvv) - Basic verification layer 3. [Set up velocity rules](/docs/fraud/detection/velocity-rules) - Catch obvious patterns **Optimizing existing prevention?** 1. [Review fraud metrics](/docs/fraud/metrics) - Know your rates 2. [Tune risk scoring](./risk-scoring) - Balance fraud vs. friction 3. [Evaluate vendors](/docs/fraud/vendors/selection-guide) - Consider specialized tools **Experiencing a fraud attack?** 1. [Follow the playbook](/docs/playbooks/survive-fraud-attack) - Emergency response 2. [Increase friction temporarily](/docs/fraud/detection/velocity-rules) - Slow down attackers 3. [Enable 3DS challenge mode](./3ds) - Maximum authentication --- ## Related Resources - [Defending Against Fraud Losses](./defending-against-fraud-losses) - 3DS, CE 3.0, and evidence collection for friendly fraud - [Chargeback Guarantees](./chargeback-guarantees) - Should you buy fraud protection? - [3D Secure Guide](./3ds) - Liability shift and authentication - [AVS & CVV](./avs-cvv) - Basic verification checks - [Account Takeover Prevention](/docs/fraud/types/account-takeover) - ATO patterns - [Fraud Types](/docs/fraud/types) - Know what you're preventing - [Fraud Detection](/docs/fraud/detection) - Detection methods - [Fraud Metrics](/docs/fraud/metrics) - Measuring prevention success - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting friendly fraud - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflect before dispute - [Fraud Vendor Landscape](/docs/fraud/vendors/landscape) - Third-party tools - [Network Programs](/docs/chargebacks/reference/network-programs) - Fraud thresholds - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Native fraud tools - [Risk Appetite](/docs/fraud/fundamentals/risk-appetite) - Tolerance thresholds --- ## Fraud Reference Source: https://paymentsandrisk.com/docs/fraud/reference # Fraud Reference :::info[TL;DR] - Technical reference material for fraud operations - [EMV Liability](./emv-liability) is the page that lives here: who pays for card-present fraud, and how chip, swipe and contactless change the answer - The reference pages you'll reach for most often sit in other sections. The table below points at them ::: Technical reference materials for fraud operations. ## In This Section - **[EMV Liability](./emv-liability)** - Chip card liability shift rules: who pays for fraud at the terminal, and how chip vs. swipe vs. contactless affects your liability ## Also Useful These reference pages live in other sections but are frequently used for fraud work: | Need | Page | |------|------| | Why a transaction was declined | [Decline Codes](/docs/reference/decline-codes) | | Why a chargeback was filed | [Reason Codes](/docs/reference/reason-codes) | | Industry fraud rate benchmarks | [Benchmarks](/docs/reference/benchmarks) | | Network monitoring thresholds | [Network Programs](/docs/chargebacks/reference/network-programs) | | Processor-specific fraud rules | [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) | --- ## Fraud Types Source: https://paymentsandrisk.com/docs/fraud/types # Fraud Types :::info[TL;DR] - **By actor**: [First-party](./first-party) (your customer, lying), **second-party** (they handed their details to someone else), [Third-party](./third-party) (taken, never given), [Fake identity](./synthetic-identity) (no real person). [Full definitions](/docs/reference/fraud-classification) - **Seen a different definition elsewhere?** The industry doesn't agree. [Here's who says what](/docs/reference/fraud-classification) - **First-party subtypes**: [Friendly fraud](./friendly-fraud) (chargeback abuse), [Refund fraud](./refund-fraud) (return exploitation), [Promo abuse](./promo-abuse) (discount abuse) - **By method**: [Account fraud](./application-fraud) (fake signups), [ATO](./account-takeover) (account hijack), [Card testing](./card-testing) (validation), [Fraud rings](./bust-out) (organized attacks) - Focus your resources on prevention. Chargebacks from true fraud are hard to win ::: Most merchants only have one or two of these. Work out which before you read further. --- ## Which Fraud Type Is YOUR Problem? ```mermaid flowchart TD A[What are you seeing?] --> B{Stolen card\nor identity?} B -->|Yes - Stolen card| F[Third-Party Fraud] B -->|Yes - Fake identity| G[Synthetic Identity] B -->|No - Real customer| H{What did they do?} H -->|Disputed valid purchase| C[Friendly Fraud] H -->|Abused refunds/promos| J[Refund/Promo Abuse] H -->|Account was hijacked| I[Account Takeover] H -->|Sent it themselves,after being deceived| K[Victim-Initiated] H -->|Handed their card or accountto someone else| SP[Second-Party Fraud] C --> FP[First-Party Fraud] J --> FP style FP fill:#f59e0b,color:#fff click C "./friendly-fraud" click F "./third-party" click G "./synthetic-identity" click I "./account-takeover" click J "./first-party" click K "./ach-fraud" click SP "/docs/reference/fraud-classification" click FP "./first-party" ``` | If you see... | Start here | |---------------|------------| | Chargebacks on legitimate orders | [Friendly Fraud](./friendly-fraud) | | Many small transactions, then fraud | [Card Testing](./card-testing) | | Good customer suddenly acting strange | [Account Takeover](./account-takeover) | | New account, immediate high spending | [Third-Party Fraud](./third-party) or [Account Fraud](./application-fraud) | | Coordinated attack across accounts | [Fraud Rings](./bust-out) | | Return/refund abuse | [Refund Fraud](./refund-fraud) | | Promotion/coupon exploitation | [Promo Abuse](./promo-abuse) | | ACH returns or unauthorized bank debits | [ACH Fraud](./ach-fraud) | | Customer sent a payment, then said they were scammed | [ACH Fraud](./ach-fraud) | | A seller or customer account exists to receive and forward money | [Second-party fraud](/docs/reference/fraud-classification#second-party-they-handed-it-over) | --- ## How to Find Out What Fraud Type You Have Don't buy a tool yet. Find out what you've actually got: 1. **Pull your last 30 chargebacks** (or however many you have from the last 6 months) 2. **Tag each one** into one of four buckets: - **Third-party fraud** - Stolen card, customer says "I didn't do this" and they're telling the truth - **Friendly fraud** - Customer made the purchase but disputes it anyway - **Billing confusion** - Customer didn't recognize the charge on their statement - **Service issue** - Customer had a real problem with the product or delivery 3. **Count.** Your biggest bucket is your problem. :::info[What Most SMBs Find] Most SMBs under $1M are over 70% friendly fraud and billing confusion. If that's you, the fix is operational, not technical. Better [descriptors](/docs/chargebacks/prevention/descriptors-and-comms), easier refunds, clearer emails. Not fraud scoring or device fingerprinting. Read [Friendly Fraud](/docs/fraud/types/friendly-fraud) first, then [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms), and buy nothing until you have. ::: --- ## Classification Framework Sorted by **who commits it**: | Type | Actor | Key Characteristic | |------|-------|-------------------| | [First-Party](./first-party) | Your customer | Own identity, and they're lying | | **[Second-party](/docs/reference/fraud-classification#second-party-they-handed-it-over)** | Your customer, for somebody else | They handed their card or account over. The money goes elsewhere | | **Victim-initiated** | Your customer | They sent it themselves. Somebody deceived them into it | | [Third-Party](./third-party) | External fraudster | Never given access. It was taken | | [Fake Identity](./synthetic-identity) | Nobody real | Real and fake details mixed. No such person | **Second-party and victim-initiated look alike and aren't.** One handed over an account. The other sent a payment. Both may have been deceived, and the deception doesn't change which one it is. Ask what they gave away: access, or money? Most taxonomies leave both middle rows out. They're the ones where your customer is telling the truth and still lost the money. It barely happens on cards. A criminal with a stolen number does the initiating there. It happens constantly on [ACH and push payments](./ach-fraud), where your customer taps send. ## How the Federal Reserve Classifies This The Fed publishes two classification models, free and open. They're worth knowing for one reason. Nobody's selling you anything with them. **[FraudClassifier](https://fedpaymentsimprovement.org/fraudclassifier/index.html)** opens with a different question than this page does. Not "who is the fraudster" but **"who initiated the payment?"** Everything else hangs off that. | Who initiated it | How | Then | |---|---|---| | **Authorized Party** | Acted fraudulently | Embezzlement, False Claim, Synthetic ID | | **Authorized Party** | Was manipulated | Products and Services Fraud, Relationship and Trust Fraud | | **Unauthorized Party** | Took over the account | Compromised credentials | | **Unauthorized Party** | Misused account information | Digital payment, physical forgery | | **Unauthorized Party** | Modified the payment | Compromised credentials, impersonation, physical alteration | **Check the rail before you map it onto cards.** The Fed built this for a different problem. Jim Cunha of the Boston Fed, in the announcement, says it addresses "the industrywide challenge of inconsistent classifications for fraud involving ACH, wire, or check payments." Cards weren't the target. That's why the two schemes look like they disagree. Phish a customer, then use their card yourself. **You** initiated the payment. Third-party here, Unauthorized Party there, no argument. Now phish a customer into sending the money. **They** initiated it. The Fed calls that Authorized Party Was Manipulated. Here it's the victim-initiated row above. One place the Fed splits from this page. It files **Synthetic ID under Authorized Party Acted Fraudulently**. That treats the fabricated persona as an account holder with rights. This page gives fake identity its own actor row instead. At your checkout there's nobody real to hold responsible. **[ScamClassifier](https://fedpaymentsimprovement.org/strategic-initiatives/payments-security/scams/scamclassifier-model/)** is the companion. It sorts the scam itself into nine types. The Fed says it can run before or after FraudClassifier. Reach for it when you're describing what happened to a person, not to a payment. | On this site | FraudClassifier | |---|---| | [First-party](./first-party), [friendly fraud](./friendly-fraud) | Authorized Party Acted Fraudulently โ†’ False Claim | | [Refund fraud](./refund-fraud) run by your own staff | Authorized Party Acted Fraudulently โ†’ Embezzlement | | [Fake identity](./synthetic-identity) | Authorized Party Acted Fraudulently โ†’ Synthetic ID | | Victim-initiated | Authorized Party Was Manipulated | | Second-party, knowing | Authorized Party Acted Fraudulently | | Second-party, deceived into it | Authorized Party Was Manipulated | | [Third-party](./third-party), [card testing](./card-testing) | Unauthorized Party โ†’ Misused Account Information | | [Account takeover](./account-takeover) | Unauthorized Party โ†’ Took Over Account | ## Quick Reference ### By Method | Fraud Type | Description | When You See It | |------------|-------------|-----------------| | [Account Fraud](./application-fraud) | Fake account signups | Bot attacks, promo farming | | [Account Takeover](./account-takeover) | Hijacked customer accounts | Password breaches, phishing | | [ACH Fraud](./ach-fraud) | Unauthorized bank debits, BEC | ACH returns, payment redirects | | [Card Testing](./card-testing) | Validating stolen cards | Small transaction bursts | | [Fraud Rings](./bust-out) | Organized multi-account attacks | Coordinated patterns | | [Triangulation](./triangulation) | Three-party resale scheme | Marketplace fraud | | [BEC & Phishing](./bec-phishing) | Attacks on your operations | Fake invoices, credential theft | ### First-Party Fraud Subtypes These are all forms of [first-party fraud](./first-party). The customer is the fraudster: | Fraud Type | Description | Your Defense | |------------|-------------|--------------| | [Friendly Fraud](./friendly-fraud) | Dispute legitimate purchase | Evidence collection, CE 3.0 | | [Refund Fraud](./refund-fraud) | Exploit return policies | Policy enforcement | | [Promo Abuse](./promo-abuse) | Game promotions/discounts | Device linking, limits | ## Comparison at a Glance | Type | Who Loses | Detection Difficulty | Can You Fight Chargebacks? | Primary Defense | |------|-----------|---------------------|---------------------------|-----------------| | [Third-Party](./third-party) | You (without 3DS) | Medium | Rarely (unless 3DS) | [3D Secure](/docs/fraud/prevention/3ds) | | [First-Party](./first-party) | You | High | Yes (with evidence) | Policy enforcement, evidence collection | | โ†ณ [Friendly Fraud](./friendly-fraud) | You | High | Yes (CE 3.0) | Descriptors, evidence, easy refunds | | โ†ณ [Refund Fraud](./refund-fraud) | You | Medium | N/A | Policy enforcement, pattern tracking | | โ†ณ [Promo Abuse](./promo-abuse) | You | Medium | N/A | Device linking, limits | | [Fake Identity](./synthetic-identity) | You | High | Sometimes | Identity verification | | [ATO](./account-takeover) | Customer + You | Medium | Yes | MFA, behavioral analytics | | [Card Testing](./card-testing) | You | Low | N/A | [Velocity rules](/docs/fraud/detection/velocity-rules), CAPTCHA | | [Fraud Rings](./bust-out) | You | High | Sometimes | Device fingerprinting | ## Prevention Priority For most merchants, in this order: ### 1. High Impact, Easier to Prevent | Type | Action | |------|--------| | [Third-Party Fraud](./third-party) | Enable [3D Secure](/docs/fraud/prevention/3ds) for liability shift | | [Card Testing](./card-testing) | Add [velocity rules](/docs/fraud/detection/velocity-rules) and CAPTCHA | | [Account Fraud](./application-fraud) | Require email/phone verification | ### 2. High Impact, Harder to Prevent | Type | Action | |------|--------| | [Friendly Fraud](./friendly-fraud) | Collect evidence, implement CE 3.0 | | [Refund Fraud](./refund-fraud) | Tighten policies, track patterns | | [Account Takeover](./account-takeover) | Require MFA, monitor logins | ### 3. Specialized Threats | Type | Action | |------|--------| | [Fraud Rings](./bust-out) | Device fingerprinting, consortium data | | [Promo Abuse](./promo-abuse) | Device linking, redemption limits | | [Triangulation](./triangulation) | Shipping address analysis | ## Popular in This Section - **[Third-Party Fraud](./third-party)** - Stolen cards used at your store - **[Friendly Fraud](./friendly-fraud)** - Legitimate purchases disputed dishonestly - **[Account Takeover](./account-takeover)** - Hijacked customer accounts - **[Card Testing](./card-testing)** - Small transactions to validate stolen cards - **[Refund Fraud](./refund-fraud)** - Return and refund exploitation ## Related Topics - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift for fraud - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Payment verification - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Tracking fraudsters - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern detection - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining signals - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting chargebacks - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes --- ## Fraud Prevention Vendors: Sift, Signifyd, Riskified & More (2026) Source: https://paymentsandrisk.com/docs/fraud/vendors # Fraud Prevention Vendors :::info[TL;DR] - **Under $1M/year: buy nothing.** Your processor's fraud tools come free and they're enough. Stripe Radar Lite ships with Stripe Payments. RevenueProtect ships with Adyen. Square and Shopify screen automatically - **No full-stack fraud platform publishes a price.** Sift, Sardine, Signifyd, Forter, Riskified and Kount were all checked on 2 August 2026. Not one does. The nearest public anchor is SEON, a tier down in enrichment: $699/month for 2,500 checks, about 28 cents a check. Quote it back when a sales rep names a number - **Two ownership corrections.** Midigator no longer exists. Equifax bought it and folded it into Kount, and Kount itself now redirects to Equifax. Accertify is no longer an American Express company - **Guarantee vendors get paid to decline your borderline orders.** Before you celebrate the liability shift, ask for their decline rate on your traffic - **Run shadow mode before you sign anything.** Any vendor worth buying will let you test without going live ::: Most merchants reading this don't need to buy anything. Over $1M, with your processor's tools out of road? The sections below say which category solves your problem. And which one is somebody else's. This page covers **card-not-present and online fraud tools only**. Point-of-sale fraud is a different stack: EMV terminals, P2PE, physical card security. None of it is here. After POS security? Wrong page. ## Find Your Row, Ignore the Rest | Volume | What to Do | What to Ignore | |--------|------------|----------------| | Under $100K/year | Processor tools only. If fraud is painful at this volume, you probably have a product or customer acquisition problem, not a fraud tool problem. | Everything else on this page | | $100K-$1M/year | Still processor tools. Add Plaid-type verification only if ACH returns are your specific pain point. | Full-stack platforms, orchestration layers | | $1M-$10M/year | Evaluate ONE dedicated platform. Test in shadow mode before committing. | Orchestration layers, enterprise tools | | Over $10M/year | Layer deliberately. Consider orchestration. Hire someone full-time for this. | Nothing, but do not buy everything at once | If fraud is killing you under $1M, you've probably got a product, pricing or customer acquisition problem. Fraud tools won't fix that. --- ## Processor-Native Tools ### When This Matters When you need fraud protection but can't take on another vendor. ### Who Should Use This Everyone under $1M in volume. Anyone who prefers simple over tunable. Merchants already on these processors who would rather skip another contract. | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **Stripe Radar** | You are already on Stripe and want one-click fraud protection. Decent ML, good defaults for most e-commerce. Radar Lite is included with Stripe Payments at no extra charge. | Only works on Stripe. Custom rules and review queues need a paid tier (Standard, Plus or Pro). If you leave Stripe, you start over. | | **Adyen Risk** | You are on Adyen and want integrated protection. Strong in enterprise and international. | Adyen-only. Less transparent than standalone tools. | | **Braintree / PayPal** | You are on Braintree or want PayPal buyer protection dynamics. | PayPal ecosystem lock-in. Less configurable than Stripe Radar. | | **Shopify Fraud Analysis** | You are on Shopify and want zero additional integration. Basic but functional for small stores. | Very basic. Shopify-only. Not suitable above $500K unless supplemented. | :::tip[Test to Run] Before you look outside, find out what your processor already gives you. Book 30 minutes with your account rep. Ask two things. "What fraud tools are in my current plan?" And "what would upgrading cost me?" That call often saves six months of vendor evaluation. ::: **Under $1M:** stop here. Use your processor's tools. Come back when you hit a specific problem they miss. --- ## Full-Stack Fraud Platforms ### When This Matters When your processor's tools miss too much. When you need real control over the rules. Or when you want a chargeback guarantee. ### Who Should Use This Merchants above $1M with someone touching fraud at least a few hours a week. Companies with enough volume that a per-transaction fee still pays for itself. | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **Sardine** | You need device fingerprinting, behavioral analytics, fraud rules, and compliance in one SDK. Best for fintech, crypto, BNPL, platforms that hold balances or issue cards. | Overkill for simple DTC e-commerce under $1M. Fintech-native, less e-commerce playbook out of the box. | | **Signifyd** | You want a guarantee model where they reimburse fraud they approve. E-commerce focus, easy integration. | They make money by being conservative. They will decline borderline transactions you might have approved. Calculate false positive cost before celebrating the guarantee. | | **Forter** | Similar guarantee model to Signifyd. High automation, less manual review. | Less customizable. Guarantee model means conservative decisions. | | **Riskified** | Guarantee model with strong e-commerce vertical expertise. | Limited to certain verticals. Same guarantee tradeoff: they profit from declining edge cases. | | **Sift** | Real-time ML, strong account protection and ATO prevention. More customizable than guarantee vendors. | Can be expensive at scale. No guarantee model means you own the losses. | | **Kount** (Equifax) | Configurable rules plus ML. Good for teams that want control over decisioning logic. | Steeper learning curve. Requires more hands-on management than guarantee vendors. Kount is also mid-absorption: kount.com now redirects to equifax.com/business/identity-fraud/, so confirm the current product name and roadmap before you sign. | :::warning[None of these vendors publishes a price] Sift, Sardine, Signifyd, Forter, Riskified and Kount were all checked against their own sites on 2 August 2026. Not one publishes a rate card. Signifyd goes furthest. It publishes the model without the numbers: "a percentage of the order total when an order is approved," and "no charge when an order is declined due to fraud." Riskified's pricing page is a contact form. Forter's is a request for a sales call. Sardine's returns a 404. That's normal for this market. It also means no cost comparison until you've sat through three sales calls. The nearest published number in fraud tooling is SEON, at $699/month for 2,500 checks. SEON is a tier down from these platforms. Bring it up anyway. Ask a vendor charging several times more per screen to justify the gap. Silence is an answer. ::: :::tip[Test to Run] Pull your last 90 days of chargebacks. Tag the ones your processor already flags high-risk. Ask any vendor for a 30-day shadow mode pilot. Compare their "would-block" list against your real fraud and your real customers. If the false positives cost more than the catches save, don't buy. ::: **Guarantee model warning:** Signifyd, Forter and Riskified reimburse you for fraud they approve. Sounds great. They also make money by being conservative. So they'll decline borderline orders you'd have taken. Before you celebrate the guarantee, work out what their false positives cost you. A 0.5% fraud rate with 2% false positives is worse than 0.8% fraud with 0.3% false positives. **Under $1M:** these are overkill. Stay on processor tools until you hit specific pain they miss. --- ## Identity Verification / KYC ### When This Matters When you need to know a person is who they say. Account opening. High-value orders. A regulatory obligation. Or something suspicious tripping a flag. See [KYC & KYB for Fraud Prevention](/docs/fraud/prevention/kyc-kyb) to size the verification to the risk. ### Who Should Use This Fintechs. Marketplaces onboarding sellers. Anyone with a KYC obligation. Platforms where account-level fraud hurts more than transaction-level fraud. **Passive verification** (no customer friction, $0.02-0.50/check): | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **Socure** | You want ML-based identity verification without requiring document uploads. Strongest synthetic fraud detection in the US market. | Premium pricing. US-centric - international coverage is thinner. | | **SentiLink** | You need synthetic identity scoring specifically. Does one thing extremely well. Often layered with other vendors. | US only. Synthetic fraud only - not a full IDV solution. | | **Prove** | You want zero-friction phone-centric verification. Strong carrier data signals (SIM tenure, port history). | Phone-focused. Less comprehensive than document-based options. | | **Ekata** (Mastercard) | You want lightweight identity enrichment (phone, email, address, IP). Quick integration, simple API. | Not a full IDV solution. Best as a supplementary signal. | | **Trulioo** | You need global coverage (195+ countries) for cross-border identity verification. Combined KYC + KYB + AML. | Less depth on US synthetic fraud than Socure. | | **Plaid Identity** | You already use Plaid for bank connectivity and want the strongest identity signal available. Bank data is hard to fake. | ~$500/month platform baseline + per-check. High friction (bank-linking flow). Not for simple e-commerce. | **Documentary verification** (ID scan + selfie + liveness, $0.80-5.00/check): | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **Stripe Identity** | **You're already on Stripe** and want documentary verification with zero new vendor setup. **$1.50 per verification** (document plus selfie), first 50 free. | Stripe-only. Less configurable than standalone IDV vendors. At $1.50 it sits mid-range against Veriff's published $0.80-1.89, so pick it for the zero-integration path, not for the price. | | **Veriff** | You want transparent, published pricing ($0.80-1.89/check). Self-serve signup. Strong in Europe. | Less US-centric than alternatives. | | **Sumsub** | You want all-in-one KYC + KYB + AML. 2025 Gartner Leader. No-code verification links available. | Broader platform means more to configure if you only need basic document checks. | | **Persona** | Developer-friendly, flexible multi-step workflows, good for custom verification flows. Also does KYB. 2025 Gartner Leader. | Higher starting cost than Veriff. | | **Jumio** | You need global document coverage (5,000+ document types). Strong in regulated industries. | Enterprise pricing. No self-serve. | | **Onfido** (Entrust) | Strong in fintech, good user experience for document capture. Acquired by Entrust in 2024. | Regional coverage varies. Check your specific markets. | | **Incode** | Speed matters (1.5s average verification) or you need strong Latin America coverage. 2025 Gartner Leader. | Enterprise-focused. No self-serve. | | **Mitek** | Enterprise with strong biometric needs. MiPass 4D combines face + voice + liveness. Datos Insights leader (Jan 2026). | Enterprise-only. No self-serve. | | **Au10tix** | You need fast (4-8s) automated verification and consortium-based coordinated attack detection. | Enterprise-focused. | | **iProov** | You need the strongest deepfake and injection attack detection available. Liveness specialist. | Biometrics only - does not do document verification. Pair with a doc vendor. | :::tip[Test to Run] Before you buy IDV, measure your signup abandonment rate today. Then run the vendor on one segment for two weeks. If abandonment climbs more than fraud falls, the friction isn't worth it. ::: **Under $1M and not in a regulated industry:** you don't need dedicated IDV yet. Email and phone verification is enough. --- ## Data Enrichment APIs ### When This Matters When you want to add context to transactions without a client-side SDK. These APIs look up IP, email, phone and identity signals server-side. That feeds your fraud rules. ### Who Should Use This Merchants above $500K who want more signals than the processor gives them. Without the cost of a full-stack platform. See [Data Enrichment for Fraud Rules](/docs/fraud/detection/data-enrichment) for the full guide. **Already running a full-stack platform?** Sift, Sardine, Signifyd, Forter and Kount all pull IP, email and phone signals internally. Don't double-buy. Ask your vendor what it ingests before you add a standalone API. | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **MaxMind** | You want the industry-standard IP intelligence. GeoLite2 is free. minFraud adds email, phone, and device scoring. | IP-focused. Email and phone signals are thinner than specialists. | | **IPQS** | You want IP + email + phone in one API. Free plan for testing, paid from $99/month. | Gives you signals, not decisions. You write the rules yourself. | | **SEON** | You want deep social media lookups (90+ platforms) on email addresses, or you just want to see a price before a sales call. Starter is **$699/month** for 2,500 fraud checks, 10 users and 50 rules; Premium is custom ([seon.io/pricing](https://seon.io/pricing/), checked 2026-08-02). | About 28 cents a check at the Starter allowance. Evaluate whether a [full-stack platform](#full-stack-fraud-platforms) gives you more for similar money - though you'll have to sit through a sales call to find out, because none of them publish rates. | :::tip[Test to Run] Pull your last 30 chargebacks. Look up each IP with MaxMind GeoLite2. It's free. Then run the email and phone on the IPQS free plan. More than half coming back as datacenter IPs, disposable emails or VoIP numbers? Enrichment pays for itself. ::: **Under $500K:** MaxMind GeoLite2 is free and takes 15 minutes to wire up. Start there. --- ## Risk Orchestration Platforms ### When This Matters When you're pulling 3+ fraud signals from different sources. And you need one decision out of them. When keeping the integrations alive has quietly become somebody's job. ### Who Should Use This Companies above $10M with several fraud vendors already running. Teams with fraud engineers. Businesses where the decisioning logic is the product, not an afterthought. | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **Alloy** | You need identity, fraud and compliance signals running through one workflow. Strong in fintech onboarding. | These are meta-tools and plumbing, not magic fraud brains. If you don't know which signals you need, orchestration won't help. | | **Unit21** | You want case management plus orchestration. Good for teams doing manual review at scale. | Same caveat: orchestration without strategy is just expensive plumbing. | Does your fraud stack fit on one whiteboard in under five boxes? You don't need orchestration yet. :::tip[Test to Run] Draw your current fraud flow on a whiteboard. Count the integrations. Fewer than 5 and orchestration is premature. More than 5, with real engineering time keeping them alive? Worth a look. ::: **Under $10M:** ignore this section. You don't need orchestration. Get one or two tools working well first. --- ## Bank Account / ACH Verification ### When This Matters When you take ACH and the returns are eating your margin. R01 is insufficient funds, R10 is unauthorized. ### Who Should Use This Any business with meaningful ACH volume. Subscription businesses with recurring debits. Platforms that pay out to bank accounts (gig economy, marketplaces). | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **Plaid** | You want the broadest bank coverage and the most features (Auth, Identity, Balance, Signal). Default choice for most. | Some customers resist linking their bank. Pricing can add up at volume. | | **Stripe Financial Connections** | You are already on Stripe and want tight integration. | Stripe-only. Less coverage than Plaid for some banks. | | **Finicity** (Mastercard) | You want an alternative to Plaid with enterprise features. | Smaller network than Plaid. | | **MX** | Strong coverage in credit unions. Good if your customer base skews toward CUs. | Less coverage in large banks than Plaid. | :::tip[Test to Run] For 30 days, run balance checks only on first debits over $500. Compare R01 rates against a control segment with no checks. Multiply the drop in R01s by your average recovery cost. Does it beat the verification cost? Keep it. If not, raise the threshold or drop the tool. ::: **Under $100K in ACH volume:** micro-deposits for new customers are enough. Don't buy verification tools yet. --- ## Chargeback and Dispute Management ### When This Matters When dispute volume is drowning your team. Or your ratio is climbing toward a network program. 0.65% is a sensible internal warning line. It isn't where the networks act. Visa enforces through VAMP now, Mastercard through ECM. Read [dispute monitoring thresholds](/docs/compliance/network-rules/dispute-monitoring) before you go vendor shopping. ### Who Should Use This Merchants with steady chargeback volume who want to kill disputes before the network sees them. Or who need representment help at scale. | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **Ethoca** (Mastercard) | You want pre-dispute alerts. When a cardholder complains to their bank, you get notified before it becomes a chargeback. Refund quickly and it never hits your ratio. | A refund costs you the sale. A dispute costs you the sale plus fees plus program risk. Alerts are a tax on bad customer experience, not a fix. | | **Verifi** (Visa) | Same pre-dispute alert concept, plus CE 3.0 integration for compelling evidence automation. | Same tradeoff as Ethoca. Fix root causes, not just symptoms. | | **Chargebacks911** | Full-service dispute management. They handle representment for you. Often includes Ethoca and Verifi access bundled. | You are outsourcing expertise you might want in-house. | | **Chargeflow** | Automated representment, Shopify-first, and one of the few vendors here that publishes its pricing: 25% of what it recovers, no monthly fee. | Pay-for-success means you only pay on wins, but you're also handing over the evidence decisions. | | ~~Midigator~~ | **Gone.** Acquired by Equifax in 2022 and folded into Kount. midigator.com now 301-redirects to kount.com, which itself redirects to equifax.com/business/identity-fraud/ (checked 2026-08-02). | If a broker pitches you Midigator, they're selling a brand that no longer exists. Ask what Equifax entity the contract sits with. | **Bundling note:** Chargebacks911, Chargeback Gurus and similar vendors usually bundle Ethoca and Verifi access. One integration, and sometimes cheaper than going direct on their volume pricing. Neither Ethoca nor Verifi publishes a per-alert rate. So compare two reseller quotes instead of a published number. See [what chargeback alerts cost](/docs/chargebacks/prevention/chargeback-alert-pricing). **From the issuer side:** a pre-dispute alert is a customer complaint that hasn't become a chargeback yet. Refund fast and it never reaches the network as a dispute. A refund costs you the sale. A dispute costs you the sale plus fees plus program risk. Alerts buy you the right to pick the cheaper loss. :::tip[Test to Run] Before you buy alerts, pull your last 50 chargebacks. How many would you have refunded with 24 hours' notice? Under half, and alerts solve nothing here. You have a root cause issue, not a notification issue. ::: --- ## Bot and Abuse Mitigation ### When This Matters When you're taking automated attacks. Card testing, credential stuffing, fake accounts, promo abuse at scale. ### Who Should Use This Platforms with public signup or checkout flows that bots have found. E-commerce running flash sales or limited inventory. Anyone watching velocity patterns that don't look human. | Vendor | Good fit if... | Tradeoff | |--------|----------------|----------| | **Arkose Labs** | You want to make bot attacks economically unviable. Strong against credential stuffing and fake accounts. | Adds friction. Not every business needs this level of protection. | | **DataDome** | Alternative in bot mitigation. Real-time detection. | Similar tradeoffs to Arkose. | | **HUMAN** | Another player in the bot detection space. | Evaluate based on your specific attack patterns. | :::tip[Test to Run] Before you buy bot mitigation, read your last 30 days of server logs. What share of traffic is clearly automated? What's it actually costing you in failed auths, infrastructure and fraud? Under 5% of traffic and under $1K/month, rate limiting is enough. ::: **If you aren't seeing obvious bot attacks:** you don't need dedicated bot mitigation. Start with rate limiting and CAPTCHA. --- ## Build vs. Buy Under $10M, you're buying. Building your own models needs stable data and enough fraud to learn from. Without both, it's an expensive hobby project. ### When to Buy - Speed to market matters more than tuning - You don't have ML or data science people - You want consortium data, because vendors see fraud across many merchants - Your fraud patterns are ordinary for your vertical ### When to Build - You have unique data no vendor can see - You have ML engineers who understand fraud - Your volume economics make per-transaction fees painful - You want to own the decisioning logic as a competitive advantage ### Hybrid Approach (Most Common Above $10M) - Buy: Device fingerprinting, identity verification, consortium signals - Build: Core decisioning logic, model tuning, custom rules - Integrate: Multiple vendor signals into your own scoring --- ## What This Page Does Not Cover **Card-present / POS fraud tools:** a different category with different vendors. EMV terminal security, P2PE encryption, physical card fraud. **Issuer-side tools:** FICO Falcon, Mastercard Decision Intelligence, Visa Advanced Authorization. Those are for issuers making authorization decisions, not merchants. **Pure AML / compliance tools:** transaction monitoring for money laundering, SAR filing and sanctions screening are compliance tools, not fraud tools. There's overlap at Sardine and Alloy, but dedicated AML platforms are out of scope here. --- ## Before You Buy Anything - [ ] **Categorize your fraud.** Pull 100 chargebacks and tag them: true fraud, friendly fraud, service issues. If most are friendly fraud, you've got a customer experience problem, not a fraud tool problem. - [ ] **Work out what fraud actually costs you.** Count disputes, fees, staff time and false positives. A tool that catches 20% more fraud while blocking 2% of good customers loses you money. - [ ] **Run shadow mode.** Any vendor worth buying will let you test without going live. If they won't, walk away. - [ ] **Set kill criteria before you start.** Decide what a bad outcome looks like before you see any results. Otherwise you'll rationalize whatever happens. - [ ] **Talk to your processor first.** Thirty minutes with Stripe, Adyen or your acquirer can save you six months of vendor evaluation. Ask what's already in your plan. --- ## Popular in This Section - **[Vendor Selection Guide](/docs/fraud/vendors/selection-guide)** - Detailed evaluation criteria and questions to ask - **[Processor-Native Tools](#processor-native-tools)** - Start here if under $1M volume - **[Chargeback Management](#chargeback-and-dispute-management)** - Ethoca, Verifi, and dispute tools ## Related - [Chargeback Guarantees](/docs/fraud/prevention/chargeback-guarantees) - Should you buy guarantee coverage? - [Vendor Selection Guide](/docs/fraud/vendors/selection-guide) - Detailed evaluation criteria - [Vendor Landscape](/docs/fraud/vendors/landscape) - Market overview - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Understanding vendor technology - [Dispute Monitoring Thresholds](/docs/compliance/network-rules/dispute-monitoring) - Where the networks actually start fining you - [Chargeback Vendors](/docs/chargebacks/vendors) - Dispute management tools - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Alert services - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP, email, phone enrichment APIs - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device intelligence - [Identity Verification](/docs/fraud/detection/identity-verification) - IDV tools - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Scoring systems - [3D Secure](/docs/fraud/prevention/3ds) - Authentication vendors - [Fraud Metrics](/docs/fraud/metrics) - Measuring vendor performance - [Processor Management](/docs/operations/processor-management) - Processor-native tools --- ## Card-Present Fraud Source: https://paymentsandrisk.com/docs/fraud/card-present-fraud # Card-Present Fraud :::info[TL;DR] - EMV chip transactions push counterfeit liability onto the issuer. Swipe it or key it and that liability stays with you - Your three real threats are skimming, employee theft, and counterfeit cards presented as a swipe - Check terminals daily, not weekly. A skimmer usually goes on and comes back off inside a day or two - Keyed entry is the worst deal at your counter. You pay a downgraded interchange tier and you eat the fraud loss on top - Most in-store fraud you'll actually see comes from staff, not from strangers ::: If you take payments in person, somebody has told you that's the safe channel. It's safer. It isn't safe, and the losses that do land are yours to keep, because card-present [fraud](/docs/fraud) rarely gets pushed back to the issuer the way [CNP fraud](/docs/fraud/types/third-party) does. [EMV](/docs/fraud/reference/emv-liability) moved counterfeit liability, but only on transactions where the chip actually gets used. Everything else - keyed entries, swipes, employee schemes, tampered hardware - stays on your side of the line. None of this needs a fraud vendor. The controls that work at the counter are a two-minute terminal check, a written keyed-entry policy, and a per-employee report your processor already runs. See [fraud metrics](/docs/fraud/metrics) to size your exposure before you spend anything. ## What Matters 1. **[EMV liability shift](/docs/fraud/reference/emv-liability) only works if you dip the chip.** Swipe or key the card and you own the [fraud](/docs/fraud). 2. **Skimming didn't go away.** Attackers still overlay devices on your [terminals](/docs/operations/terminal-operations) to harvest card data. 3. **Employee fraud is your biggest card-present risk.** [Refund schemes](/docs/fraud/types/refund-fraud), keyed abuse, card data walking out the door. 4. **Keyed transactions are high-risk by definition.** Every keyed entry should hit your [velocity rules](/docs/fraud/detection/velocity-rules). 5. **Physical security is fraud prevention.** Terminals in view, tamper checks, access control. See [PCI DSS Requirement 9](/docs/compliance/pci-dss). --- ## Skimming Detection A skimmer sits between the customer's card and your terminal and copies the data on the way through. Nobody spots one by accident. Your staff will only find it if you've told them exactly what to look for. ### Types of Skimmers | Type | How It Works | Detection | |------|--------------|-----------| | **Overlay skimmer** | Fits over existing card slot | Wiggle test, visual inspection | | **Deep insert skimmer** | Inside the card slot | Harder to detect visually | | **Bluetooth skimmer** | Transmits data wirelessly | RF detection, Bluetooth scan | | **Shimmer** | Thin device reads chip data | Very hard to detect | ### Daily Terminal Check Two minutes, done by whoever opens: - [ ] Card slot sits flush, doesn't wiggle - [ ] No overlay on PIN pad - [ ] Terminal casing is intact, no gaps - [ ] Cables are secure, no additions - [ ] Tamper stickers/seals unbroken - [ ] Terminal serial number matches inventory ### Weekly Deep Check - [ ] Compare terminal to photo of known-good state - [ ] Check for unusual Bluetooth devices nearby - [ ] Verify firmware version matches expected - [ ] Review transaction patterns for anomalies Take the photos now, while you know the terminals are clean. You can't do a known-good comparison later if you've got nothing to compare against. --- ## Terminal Tampering Skimmers aren't the only way a terminal gets compromised. Somebody can open the housing, swap a component, or hand it back looking untouched. ### Tamper Indicators | Sign | What It Means | |------|---------------| | Broken or missing tamper seal | Terminal may have been opened | | Loose screws or panels | Internal access attempted | | Different colored parts | Replacement components | | Unusual weight | Internal additions | | Strange behavior | Slow transactions, unexpected prompts | ### What to Do If Tampering Suspected 1. **Stop using the terminal immediately** - see [terminal operations](/docs/operations/terminal-operations) 2. **Don't run another transaction on it** 3. **Preserve it as evidence.** Don't open it, don't clean it, don't try to fix it 4. **Call your [processor's](/docs/operations/processor-management) security team** 5. **Pull 30 days of transactions from that terminal** - check [metrics](/docs/operations/metrics) 6. **File a police report if it's confirmed** - and document the whole thing for [PCI](/docs/compliance/pci-dss) incident response ### Physical Security Basics - Terminals in view of staff at all times - Cable/lock terminals to counter - Limit who can access back of terminal - Lock terminals in safe overnight (high-risk locations) - Visitor/vendor check-in for anyone who touches terminals --- ## Employee Fraud Schemes Your staff are your biggest card-present [fraud](/docs/fraud) risk. It isn't close. When an insider runs the scheme, it's [first-party fraud](/docs/fraud/types/first-party) with your own credentials behind it. Don't read that as distrust your team. Read it as build controls that clear the honest ones fast. A per-employee refund report does that. It also makes the dishonest ones obvious. ### Common Schemes #### Refund Fraud **Pattern:** Employee refunds to their own card, or a friend's, with no sale behind it. ([Refund fraud](/docs/fraud/types/refund-fraud) is the customer-side version. Different scheme, different controls.) **Signals:** - High refund count for specific employee - Refunds without corresponding sales - Refunds to same card repeatedly - Refunds processed after hours or at close **Prevention:** - Manager approval above a set amount ($50 is a normal starting line) - Match refunds to original transactions - Review refund reports by employee weekly - Dual control for cash refunds **Then watch your own threshold.** Set approval at $50 and you've described a $49 scheme. You're not looking for one big refund. You're looking for a cluster just under your own line. Read the distribution, not the outliers. #### Overstated Refunds **Pattern:** The sale is real. The refund is real. The amount is wrong. A customer returns a $40 item. The employee puts through $140. The extra $100 goes to cash, or to another card. This walks straight past the control above. "Match refunds to original transactions" passes here, because there **is** an original transaction. Compare the amounts, not just that a sale existed. **Signals:** - Any refund larger than the sale behind it - Refund value per employee climbing while refund count stays flat - Refunds that land on round numbers **Prevention:** - Cap refunds at the original amount in the POS, not in the policy document - Flag every refund that exceeds its original, by any amount - Track refund value and refund count separately by employee #### Skimming by Staff **Pattern:** Employee uses a hidden reader to copy card data, then sells it or spends it. **Signals:** - Employee handles cards out of customer view - Transactions take unusually long - Multiple fraud reports traced to your location **Prevention:** - Customer-facing terminals only - Cards never leave the customer's hand - Clear sightlines to all terminals - Background checks for new hires #### Keyed Transaction Abuse **Pattern:** Employee types in card numbers from memory, a photo, or a note, and buys things. **Signals:** - High keyed ratio for specific employee - Keyed transactions to same card - Keyed transactions after hours **Prevention:** - Monitor keyed ratio by employee - Manager approval for keyed transactions - Review keyed transactions daily - Turn keyed entry off entirely on terminals that don't need it #### Void/Cancel Manipulation **Pattern:** Employee rings the sale, takes the cash, then voids the transaction. **Signals:** - High void rate for specific employee - Voids at end of shift - Voids without customer present **Prevention:** - Customer signature on voids - Manager approval for voids - Receipt required for all voids - Camera coverage of the register area ### Monitoring by Employee Track these per person: | Metric | Red Flag Threshold | |--------|-------------------| | Refund count | > 2x average | | Refund value | > 2x average | | Keyed transaction % | > 5% | | Void rate | > 2% | | After-hours transactions | Any | | Same-card refunds | > 1 per month | ### The check that needs no suspect Everything above needs you watching a particular person. This one doesn't. Run it first. Track **refunds as a share of gross sales**, monthly, across the business. A refund scheme moves that ratio. It moves whether or not you know who's running it. Sales flat and refunds climbing is the shape. It's already in your processor's settlement reporting, so it costs you nothing. Two things move it that aren't fraud. Seasonality, so compare to the same month last year. And a real product or fulfilment problem, which you want to find anyway. **The ratio tells you to look. It doesn't tell you what you'll find.** :::note[If you want the scale of this] The ACFE publishes [Occupational Fraud: A Report to the Nations](https://www.acfe.com/fraud-resources/report-to-the-nations) as a free PDF. It's the standard benchmark for staff stealing from their own employer. It breaks out by organization size, by scheme, and by how each case got caught. It isn't payments-specific. It's also the only dataset of its kind that nobody's selling you a control off the back of. ::: :::note[Ask Your Dev] "Can we pull reports showing refund and void rates by employee? What about keyed transaction percentage?" ::: --- ## MOTO/Keyed Transaction Risk Every keyed transaction is a bet you're placing with your own money. ### When Keyed Entry Is Acceptable | Scenario | Risk Level | Notes | |----------|------------|-------| | Established B2B customer, phone order | Lower | Known relationship, verify identity | | Card present but chip failed once | Medium | One retry, then request different card | | Delivery driver collecting payment | Medium | Consider mobile terminal instead | ### When Keyed Entry Is a Red Flag | Scenario | Risk Level | Notes | |----------|------------|-------| | Walk-in says chip "doesn't work" | High | Common fraud tactic | | Customer reads card number from phone | High | Likely stolen card data | | Rush to complete before closing | High | Pressure tactic | | High-ticket item, new customer | High | Classic fraud pattern | | Employee keying without customer present | Critical | Potential internal fraud | ### Liability Shift Loss | Transaction Type | Liability for Fraud | |------------------|---------------------| | Chip dip (EMV) | Issuer | | Contactless (NFC) | Issuer | | Swipe (mag-stripe) | Merchant | | Keyed (MOTO) | Merchant | **If you key a fraudulent transaction, you eat the loss.** No exceptions. Keyed entry costs you twice, and the second cost is the one people forget. It downgrades to a worse interchange tier than a chip read, so you're paying more per transaction on top of carrying the fraud. ### Keyed Transaction Policy 1. Chip must be attempted first 2. If chip fails, tap must be attempted 3. If both fail, request a different card 4. Keyed entry requires manager approval 5. Document the reason for every keyed transaction 6. Never key a number read off a phone or a scrap of paper Write those six lines on a card and tape it next to the register. A policy that lives in a binder isn't a policy. --- ## EMV Liability Shift Mechanics Liability shift decides who pays when a counterfeit card gets used. The line matters, because it's the difference between a chargeback you never see and one you can't fight. ### How Liability Shift Works **Before the US shift (October 2015):** the issuer usually ate counterfeit fraud. **After:** whoever brought the weaker technology eats it. | Merchant Has | Card Has | Liability | |--------------|----------|-----------| | Chip terminal | Chip | Issuer | | Chip terminal | No chip | Issuer | | No chip terminal | Chip | Merchant | | No chip terminal | No chip | Issuer | ### What "Chip Terminal" Means - Terminal must be EMV-capable - EMV must be enabled and active - Transaction must be processed as chip (not fallback) All three, not two of three. If your terminal has a chip reader and your staff swipe anyway, you've lost the shift and you won't find out until the chargeback lands. ### Fallback Transactions When the chip fails and the terminal drops to swipe, that's a fallback. - **Occasional fallback:** some liability protection, and it varies by network - **Repeated fallback:** the protection goes away, and it's a signal something's wrong If one terminal falls back constantly, it's almost always one of four things: - Dirty chip reader - Worn chip slot - Firmware issue - Someone testing you --- ## Test to Run **2-week card-present security audit:** **Week 1: Assessment** - Inspect all terminals for tampering signs - Pull keyed transaction report by employee - Review refund patterns for past 90 days - Verify terminal firmware is current - Check physical security (locks, sightlines, access) **Week 2: Remediation** - Address any tampering concerns - Investigate high keyed ratios - Stand up employee monitoring dashboards - Update terminal check procedures - Train staff on fraud indicators **Success criteria:** All terminals verified clean. Keyed ratio under 2%. Monitoring in place. If week 1 turns up nothing, that's a real result. Write down the date, keep the terminal photos, and run it again next quarter. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo CP** | Daily terminal checks. Manager approval for keyed entries. Basic employee monitoring. | | **$100k-$1M/mo CP** | Automated employee metrics. Weekly refund review. Tamper detection procedures. | | **Over $1M/mo CP** | Dedicated loss prevention. Camera integration. Real-time anomaly detection. Regular security audits. | --- ## Where This Breaks 1. **High-turnover retail.** New faces every month means training never sticks. Don't fight that with a longer manual. Shorten the procedure until a new hire can do it on day one, and automate the monitoring. 2. **Mobile and delivery.** A terminal you can't see is a terminal you can't inspect. Use cellular units you can track, and turn keyed entry off on them. 3. **Multi-location franchises.** You won't get consistency by asking for it. Centralized reporting and a real audit schedule, or you're guessing. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Keyed transaction %** | Liability exposure | baseline + 2 std dev | Real-time alert | | **Off-hours transactions** | Transactions outside business hours | Any occurrence | | **Refund without sale** | Refund not matched to prior sale | Any occurrence | | **High-value void** | Void > $X (set threshold) | Each occurrence | | **Multiple cards, same device** | 3+ distinct cards on one terminal/hour | Real-time alert | | **Repeated decline then success** | 3+ declines followed by approval | Flag for review | **Anomaly Investigation Workflow:** 1. **Alert fires** โ†’ Identify employee, terminal, transaction details 2. **Verify legitimate?** โ†’ Check with manager, review camera 3. **If suspicious** โ†’ Escalate to loss prevention 4. **If false positive** โ†’ Tune threshold 5. **Document outcome** โ†’ Train detection model ### Employee Risk Scoring Score on these factors: | Factor | Weight | Signal | |--------|--------|--------| | Keyed % vs peers | High | Above-average = risk | | Refund % vs peers | High | Above-average = risk | | After-hours transactions | Medium | Any = flag | | Void pattern | Medium | Clustered voids = risk | | Tenure | Low | New employees = higher monitoring | **Score monthly and look at the top 10%.** Most of them won't be fraud. They'll be your best closer, or the person who handles the complicated orders because nobody else will. That's fine. You're looking for the one who can't explain the pattern. --- ## Next Steps **Preventing skimming and tampering?** 1. [Train daily terminal checks](#daily-terminal-check) - Staff inspection routine 2. [Perform weekly deep checks](#weekly-deep-check) - Compare to known-good state 3. [Handle suspected tampering](#what-to-do-if-tampering-suspected) - Response protocol **Addressing employee fraud?** 1. [Know common schemes](#common-schemes) - Refund, skimming, keyed abuse 2. [Monitor by employee](#monitoring-by-employee) - Per-employee metrics 3. [Put prevention controls in place](#common-schemes) - Manager approvals **Managing keyed transactions?** 1. [Identify acceptable scenarios](#when-keyed-entry-is-acceptable) - Low-risk cases 2. [Recognize red flags](#when-keyed-entry-is-a-red-flag) - High-risk signals 3. [Enforce keyed policy](#keyed-transaction-policy) - Chip first, approval required --- ## Related Pages - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Terminal selection - [Terminal Operations](/docs/operations/terminal-operations) - Day-to-day management - [Fraud Prevention](/docs/fraud/prevention) - Prevention strategies - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern detection - [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Chip security - [PCI DSS](/docs/compliance/pci-dss) - Physical security requirements - [Refund Fraud](/docs/fraud/types/refund-fraud) - Employee abuse patterns - [First-Party Fraud](/docs/fraud/types/first-party) - Customer abuse - [Chargeback Prevention](/docs/chargebacks/prevention) - Dispute reduction - [Fraud Metrics](/docs/fraud/metrics) - Measuring CP fraud --- ## How Issuers Decide to Approve or Decline Source: https://paymentsandrisk.com/docs/fraud/detection/authorization-decisioning # How Issuers Decide to Approve or Decline :::info[TL;DR] - The issuer decides in milliseconds, on very little data - Rules, ML models and velocity checks, same as your own fraud stack - Key signals: cardholder history, transaction patterns, **your merchant reputation** - **"Do Not Honor" usually means fraud suspicion.** Nobody will confirm that - You can lift approvals with cleaner traffic, richer data and 3DS ::: The issuer approves or declines in under 100 milliseconds. It runs rules, ML models and velocity checks to get there. It sees almost none of your fraud signals. So it leans on cardholder history, transaction patterns and your reputation as a merchant. This page covers what those signals are, why good transactions still get declined, and which levers you hold. :::tip[Related: The Issuer Perspective] This page is the technical decisioning process. For the wider view of what issuers see, read [Why Issuers Decline and Dispute](/docs/fraud/issuer-perspective). For disputes specifically, read [Why Chargebacks Favor Cardholders](/docs/chargebacks/issuer-side). ::: ## What Happens During Authorization From outside it's one step. Inside the issuer it's a whole decision tree, and it runs in under 100 milliseconds. ```mermaid flowchart TD A[Auth Request\nReceived] --> B{Account\nValid?} B -->|No| C[Decline:\nInvalid Card] B -->|Yes| D{Sufficient\nFunds/Credit?} D -->|No| E[Decline:\nInsufficient Funds] D -->|Yes| F{Fraud\nCheck} F -->|High Risk| G[Decline:\nDo Not Honor] F -->|Medium Risk| H{Step-up\nAuth?} H -->|Yes| I[Request 3DS] H -->|No| J{Velocity\nCheck} F -->|Low Risk| J J -->|Exceeded| K[Decline:\nVelocity Limit] J -->|OK| L[Approve] I -->|Pass| L I -->|Fail| G ``` The fraud check is where merchant transactions get caught. ## Signals Issuers Use Issuers weigh a mix of factors. Roughly these. ### Cardholder History - Typical spending patterns (amounts, frequencies, categories) - Geographic usage patterns (where has this card been used before?) - Previous fraud claims filed by this cardholder - Account age and status ### Transaction Characteristics - Amount (unusually large for this cardholder?) - Merchant category (high-risk MCC?) - Time of day (consistent with cardholder behavior?) - Card-present vs. card-not-present ### Merchant Signals - Merchant reputation (historical fraud and [chargeback](/docs/chargebacks) rates) - [AVS](/docs/fraud/prevention/avs-cvv) result (address match?) - [CVV](/docs/fraud/prevention/avs-cvv) result (code match?) - [3DS](/docs/fraud/prevention/3ds) authentication result ### Device and Location - IP geolocation (does it match cardholder's typical locations?) - Distance from last transaction (impossible travel?) - Device fingerprint (if available through enhanced data sharing) ## Rules vs. Models Issuers mix rules with machine learning, same as you do. **Rules-based checks:** - Hard limits: "Decline if card has been used more than 10 times in 1 hour" - Category restrictions: "Decline if merchant is in blocked MCC list" - Geographic rules: "Decline if transaction is in country where cardholder has never been" **ML models:** - Pattern recognition across the cardholder's full history - Comparison to similar cardholders' behavior - Real-time scoring (typically 0-1000 scale) Visa Advanced Authorization and Mastercard Decision Intelligence score at the network level. They read hundreds of signals and hand back a number in under a millisecond. Issuers fold that score into their own decision. ## Velocity Limits Velocity checks matter most to issuers. They're the brake on a card that just got stolen. | Velocity Type | Example | |--------------|---------| | Transaction count | Max 5 transactions per hour | | Daily spend limit | Max $2,000 per day | | Geographic velocity | Can't transact in two distant cities within an hour | | Decline count | Too many declines in short period triggers lockout | | MCC velocity | Unusual concentration in high-risk categories | See "card_velocity_exceeded" and the cardholder has hit one of these. It isn't negotiable. They'll have to call their bank. ## Decline Reason Codes Issuers send back a response code. Most of them hide behind the generic ones. | Code | Meaning | What's Really Happening | |------|---------|------------------------| | 05 | Do Not Honor | Could be anything: fraud suspicion, velocity, internal policy | | 14 | Invalid Card Number | Card number doesn't exist or has a typo | | 41 | Lost Card | Cardholder reported card lost | | 43 | Stolen Card | Cardholder reported card stolen | | 51 | Insufficient Funds | Not enough balance available | | 54 | Expired Card | Card is past expiration date | | 57 | Transaction Not Permitted | Card restricted for this MCC or transaction type | | 61 | Exceeds Withdrawal Limit | Hit a daily or transaction limit | | 65 | Exceeds Activity Count | Hit a velocity limit | Code 05 is a huge share of all declines. It's a catch-all. The issuer reaches for it when it doesn't want to name the reason. Usually the reason is fraud suspicion, and naming it would tip off the fraudster. **Important:** 05 can be a soft decline or a hard one, depending on the issuer. Treat it carefully. Two or three retries is reasonable. A retry loop makes it worse. ## Soft vs. Hard Declines Not all declines are equal. **Soft declines** are temporary and can be retried: - Insufficient funds (customer might add money) - Velocity exceeded (limit might reset) - Issuer system unavailable (try again later) **Hard declines** are permanent and shouldn't be retried: - Invalid card number - Lost or stolen card - Account closed - Fraud confirmed Retrying a hard decline wastes money. You're still paying the network fee. Do it often enough and you trip fraud flags of your own. **Retry guidance:** two or three attempts, no more. Space them out over days or billing cycles, not seconds. ## Improving Authorization Rates You do have levers here. ### Send Better Data More context, better decision. - Full billing address for AVS - CVV for every first-time transaction - Merchant name that matches your billing descriptor - Level 2/3 data for B2B transactions ### Use Enhanced Data Sharing Some networks, processors and acquirers run data-sharing programs. Your risk scores, model output and 3DS results go straight to the issuer. An issuer that can see somebody trusted already vetted the transaction approves more of them. VAA and Mastercard Decision Intelligence are the network versions. Some acquirers and PSPs run their own issuer-linking programs. ### Authenticate When Appropriate 3D Secure shifts liability. It also lifts approval rates. An issuer that authenticated the cardholder itself has no reason to doubt the transaction. ### Keep Credentials Updated Account updater refreshes expired and reissued card numbers for you. Network tokens help too. A token survives a reissue. A raw PAN doesn't. ### Don't Hammer Declines Aggressive retry logic looks like fraud. Issuers track retry patterns. Ignore their first answer often enough and they start declining you on sight. ## What You Can't Control Some of this isn't yours to fix. - Cardholder's account status (frozen, closed, restricted) - Cardholder's available balance - Issuer's global risk policies - International restrictions When one of these declines you, the customer has to call their bank. Or pay another way. --- ## Next Steps **Improving authorization rates?** 1. [Optimize auth strategy](/docs/payments/auth-optimization) - Merchant-side improvements 2. [Understand decline codes](/docs/reference/decline-codes) - Know why you're declined 3. [Implement 3DS](/docs/fraud/prevention/3ds) - Issuer authentication improves approval **Understanding why you're declined?** 1. [Check issuer perspective](/docs/fraud/issuer-perspective) - How issuers think 2. [Review AVS/CVV](/docs/fraud/prevention/avs-cvv) - Verification signals you control 3. [Fix retry strategy](#soft-vs-hard-declines) - Don't hammer declines --- ## Related Topics - [Why Issuers Decline and Dispute](/docs/fraud/issuer-perspective) - Understanding issuer constraints - [Authorization Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Decline Codes](/docs/reference/decline-codes) - Full decline code reference - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification signals you control - [3D Secure](/docs/fraud/prevention/3ds) - Shifting liability through authentication - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate limiting patterns - [Card Testing](/docs/fraud/types/card-testing) - Understanding retry abuse - [Network Programs](/docs/chargebacks/reference/network-programs) - Fraud thresholds --- ## Behavioral Analytics Source: https://paymentsandrisk.com/docs/fraud/detection/behavioral-analytics # Behavioral Analytics :::info[TL;DR] - **Behavioral analytics** = Detecting fraud through *how* users interact, not just *what* they do - Fraudsters steal credentials, but can't steal behavior (typing rhythm, mouse curves, navigation patterns) - Use cases: [ATO detection](/docs/fraud/types/account-takeover), bot detection, fraud ring identification - Signals: straight-line mouse paths (bot), instant form completion (paste), erratic typing (unfamiliar) - Vendors: BioCatch, BehavioSec (LexisNexis), NeuroID ::: Detecting fraud through user behavior patterns. ```mermaid flowchart TD A[User Session] --> B[CollectBehavior] B --> C[MouseMovement] B --> D[TypingPatterns] B --> E[NavigationFlow] C --> F[BehavioralProfile] D --> F E --> F F --> G{Match KnownUser?} G -->|Yes| H[Low RiskContinue] G -->|No| I{Bot orHuman?} I -->|Bot Signals| J[Block] I -->|Human but Different| K[Step-UpAuth] style H fill:#22c55e,color:#fff style J fill:#ef4444,color:#fff style K fill:#f59e0b,color:#fff ``` ## Overview Behavioral analytics examines **how** users interact with your platform, not just **what** they do. Fraudsters may have stolen credentials, but they can't steal behavior. ## Types of Behavioral Signals ### Navigation Behavior | Signal | Legitimate Pattern | Fraud Pattern | |--------|-------------------|---------------| | Time on page | Varies, reads content | Minimal, jumps to goals | | Scroll behavior | Gradual, pauses | No scrolling or erratic | | Mouse movement | Natural curves | Straight lines, robotic | | Click patterns | Reads before clicking | Direct to buttons | | Tab switching | Occasional | Frequent (copy-paste) | ### Input Behavior | Signal | Legitimate Pattern | Fraud Pattern | |--------|-------------------|---------------| | Typing speed | Consistent, personal | Erratic, paste-heavy | | Typing rhythm | Unique cadence | Automated, unnatural | | Error correction | Natural mistakes | Few errors (pasted) | | Form completion | Gradual | Instant (autofill abuse) | | Field focus order | Natural flow | Random or optimized | ### Session Behavior | Signal | Legitimate Pattern | Fraud Pattern | |--------|-------------------|---------------| | Session duration | Reasonable for task | Very short or very long | | Page sequence | Exploratory | Direct to high-value | | Return visits | Pattern exists | First and only visit | | Time to transaction | Normal deliberation | Immediate | ## Behavioral Biometrics More advanced signals based on physical behavior: ### Keystroke Dynamics - Time between keystrokes (dwell time) - Time between key releases (flight time) - Typing rhythm patterns - Error patterns and corrections ### Mouse Dynamics - Movement velocity and acceleration - Curve patterns (humans curve, bots don't) - Click pressure (on supported devices) - Scroll patterns ### Touch Dynamics (Mobile) - Touch pressure - Touch area (finger size) - Swipe patterns - Hold duration ## Use Cases ### Account Takeover Detection ``` Normal User Behavior: - Knows password (types smoothly) - Familiar with site layout - Consistent navigation pattern - No hesitation on familiar fields ATO Behavior: - Password pasted or typed differently - Explores unfamiliar areas - Changes sensitive settings immediately - Different behavioral biometric signature ``` ### Bot Detection | Bot Indicator | Description | |---------------|-------------| | No mouse movement | Keyboard-only navigation | | Perfect timing | Superhuman speed | | Linear paths | No natural curves | | Consistent rhythm | No human variation | | Missing events | JavaScript events not fired | ### Fraud Ring Detection Shared behavior patterns across accounts: - Similar navigation sequences - Identical typing rhythms - Same form completion patterns - Matching session characteristics ## Implementation ### Data Collection If implementing behavioral analytics in-house, your developer will track events like: - Keystroke timing (time between key presses) - Mouse movement patterns (speed, curves, pauses) - Form interaction (field focus order, completion time) - Session navigation (page sequence, time on page) **What to tell your developer:** "We need behavioral analytics. Evaluate vendors like BioCatch or NeuroID first. They have pre-built models. If building in-house, start with keystroke and mouse tracking on login/checkout pages." ### Building Baselines 1. **Collect** behavior data during normal usage 2. **Build profile** for each user/segment 3. **Score** new sessions against baseline 4. **Alert** on significant deviations ### [Risk Scoring](/docs/fraud/prevention/risk-scoring) | Deviation Level | Behavioral Score Impact | |-----------------|------------------------| | 3 std dev | +50 risk points | These scores combine with [velocity rules](/docs/fraud/detection/velocity-rules), [device signals](/docs/fraud/detection/device-fingerprinting), and other factors in your overall [risk scoring](/docs/fraud/prevention/risk-scoring) model. ## Privacy Considerations :::note[Data Sensitivity] Behavioral data can be highly personal. Consider: - Disclosure in privacy policy - Purpose limitation - Data minimization - Retention periods ::: ## Vendor Landscape - BioCatch - BehavioSec (LexisNexis) - NeuroID - Darktrace - Recorded Future (behavioral) ## Next Steps **Implementing behavioral analytics?** 1. [Start with navigation behavior](#navigation-behavior) - Easy to collect 2. [Add input behavior](#input-behavior) - Typing patterns 3. [Integrate with risk scoring](/docs/fraud/prevention/risk-scoring) - Combine signals **Detecting specific threats?** 1. [Use for ATO detection](#account-takeover-detection) - Behavior mismatch 2. [Add bot detection](#bot-detection) - Robotic patterns 3. [Find fraud rings](#fraud-ring-detection) - Shared behavior **Evaluating vendors?** 1. [Review vendor landscape](#vendor-landscape) - BioCatch, NeuroID, etc. 2. [Consider privacy requirements](#privacy-considerations) - Data sensitivity 3. [Plan baseline building](#building-baselines) - Collection first --- ## Related Topics - [Account Takeover](/docs/fraud/types/account-takeover) - ATO detection use case - [Data Enrichment](./data-enrichment.md) - IP, email, phone signals that complement behavioral data - [Device Fingerprinting](./device-fingerprinting.md) - Device-level signals - [Rules vs. ML](./rules-vs-ml.md) - Detection approaches - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining behavioral signals - [Velocity Rules](./velocity-rules.md) - Pattern detection - [Manual Review](./manual-review.md) - When behavior triggers review - [Card Testing](/docs/fraud/types/card-testing) - Bot detection use case - [Identity Verification](./identity-verification.md) - Step-up verification triggers - [Evidence Framework](./evidence-framework.md) - Behavioral Tier 2 indicators - [Fraud Metrics](/docs/fraud/metrics) - Measuring detection performance - [Fraud Vendors](/docs/fraud/vendors/landscape) - Behavioral analytics vendors --- ## Building Fraud Rules: Stripe Radar & Adyen Copy-Paste Templates Source: https://paymentsandrisk.com/docs/fraud/detection/building-fraud-rules # Building Fraud Rules :::info[TL;DR] - **Start with six rules.** Amount ceilings, velocity limits, country mismatch, repeated declines, new-account risk - **Use allow and block lists** to override decisions for trusted customers and confirmed fraudsters - **Shadow mode everything** for 2 weeks before you enforce. Skip that and you'll learn about false positives from angry emails - **Lifecycle: Create, Shadow, Live, Tune, Retire.** Monthly reviews keep the set healthy - Rules are your first line. They catch known patterns, and [ML](/docs/fraud/detection/rules-vs-ml) catches the rest ::: Rules turn "we know this is fraud" into automated decisions. They're fast to deploy and easy to explain, and they only catch the patterns you already understand. That's the tradeoff, not a flaw. Here's a working starter set. Then list management, then the full lifecycle from creation to retirement. For the theory behind rules vs. ML, see [Rules vs. ML](/docs/fraud/detection/rules-vs-ml). For velocity tuning, see [Velocity Rules](/docs/fraud/detection/velocity-rules), and for platform syntax, see [Processor Rules Configuration](/docs/fraud/processor-rules-configuration). --- ## How Fraud Rules Work ### Rule Anatomy Every fraud rule has three parts: a **condition** (what to check), an **action** (what to do), and a **threshold** (where to draw the line). ``` RULE: High-value new customer CONDITION: account_age $300 ACTION: review THRESHOLD: any match RATIONALE: New accounts with high-value orders have 4x the fraud rate ``` The condition reads transaction data in real time. The action fires when the condition is true, and the threshold sets the sensitivity. ### Decision Actions Most fraud systems support these actions: | Action | What Happens | When to Use | |--------|-------------|-------------| | **Approve** | Transaction proceeds normally | Low-risk, trusted customers | | **Review** | Transaction queued for manual inspection | Ambiguous signals, medium risk | | **Decline** | Transaction rejected | High confidence of fraud | | **Request 3DS** | Trigger authentication challenge | Moderate risk, want liability shift | :::info[How Actions Work Together] When several rules fire on one transaction, the highest-risk action wins, so if one says "review" and another says "decline," it gets declined. Allow list entries are the one exception, and they override everything else (see [Allow Lists](#allow-lists-and-block-lists) below). ::: ### How Rules Map Across Vendors The concepts are the same everywhere. The syntax differs. | Concept | Stripe Radar | Sift | Forter | Adyen | |---------|-------------|------|--------|-------| | **Block a transaction** | `Block if ...` | Workflow: set decision = "block" | Decision rule: Decline | Risk rule: Refuse | | **Send to review** | `Review if ...` | Workflow: set decision = "watch" | Decision rule: Manual Review | Risk rule: Review | | **Allow a trusted customer** | `Allow if ...` | Allow list + workflow | Approve list | Risk rule: Accept | | **Trigger 3DS** | `Request 3D Secure if ...` | Not native (use processor) | Not native (use processor) | Risk rule: 3D Secure | | **Score threshold** | `:risk_score: > 75` | `abuse_score > 75` | Confidence threshold | On a processor like Stripe or Adyen, you build rules in their dashboard. On a standalone vendor like Sift or Forter, you build them in the vendor's console, which then passes its decision back to your processor. Until your fraud outgrows the processor's own tools, build in the processor dashboard. A standalone vendor is a second bill and a second console you don't need yet. See [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) for platform-specific setup. --- ## Your Day-One Rule Set :::info[Start Here] These six rules cover the most common fraud patterns and take about 15 minutes to set up. Deploy them in shadow mode first (see [Shadow Mode](#shadow-mode-test-before-you-block) below), then promote to live after two weeks. If you can only set one up today, make it the hourly velocity limit. Once it's live it declines rather than queues, so it costs you no manual review time. ::: ### Rule 1: Transaction Amount Ceiling Flag unusually large orders for review. Fraudsters maximize value per stolen card. ``` RULE: high_value_review IF order_total > $X THEN review ``` Set `$X` at 3-5x your average order value, so if your AOV is $80, start at $300. **What it catches:** Stolen card purchases. Fraudsters buy the most expensive thing they can. **Stripe Radar:** ``` Review if :amount_in_usd: > 300 ``` ### Rule 2: Hourly Velocity Limit Several charges on one card in a short window. That's usually automation, or [card testing](/docs/fraud/types/card-testing). ``` RULE: card_velocity_hourly IF transactions_per_card_1hr > 3 THEN decline ``` **What it catches:** Card testing attacks, automated purchases with stolen cards. **Stripe Radar:** ``` Block if :total_charges_per_card_number_hourly: > 3 ``` See [Velocity Rules](/docs/fraud/detection/velocity-rules) for tuning windows and thresholds by business type. ### Rule 3: Daily Velocity Limit A broader window catches slower attacks that dodge hourly limits. ``` RULE: card_velocity_daily IF transactions_per_card_24hr > 10 THEN review ``` **What it catches:** Distributed card testing. Repeated small purchases off one stolen card. **Stripe Radar:** ``` Review if :total_charges_per_card_number_daily: > 10 ``` ### Rule 4: Country Mismatch The card's issuing country doesn't match the customer's IP. Worth a second look. ``` RULE: country_mismatch IF card_country != ip_country THEN review ``` **What it catches:** Cross-border fraud on stolen card numbers. One of the highest-signal indicators there is. **Stripe Radar:** ``` Review if :ip_country: != :card_country: ``` :::warning[Don't Auto-Decline on Country Mismatch Alone] Travelers, expats and VPN users trigger this constantly. Start with "review," not "decline." Get the false positive rate under 20%, then tighten. See [Velocity Rules edge cases](/docs/fraud/detection/velocity-rules#where-this-breaks) for VPN and travel patterns. ::: ### Rule 5: Repeated Declines Failed authorization attempts stacked up in minutes. Classic [card testing](/docs/fraud/types/card-testing). ``` RULE: repeated_declines IF declined_transactions_per_card_10min > 3 THEN decline ``` **What it catches:** Fraudsters cycling stolen card numbers to find the live ones. **Stripe Radar:** ``` Block if :total_declined_charges_per_card_number_hourly: > 3 ``` ### Rule 6: New Account + High Value Brand new accounts making large purchases are high risk. Real new customers don't start with their biggest order. ``` RULE: new_account_high_value IF account_age $300 THEN review ``` **What it catches:** [Account takeover](/docs/fraud/types/account-takeover) on a freshly compromised account, synthetic accounts built for fraud, and stolen credentials on new signups. **Stripe Radar:** ``` Review if :seconds_since_first_seen: 300 ``` ### Putting It Together | Rule | Condition | Action | Primary Fraud Type | |------|-----------|--------|--------------------| | Amount ceiling | order > $X (3-5x AOV) | Review | Stolen card maximization | | Hourly velocity | 3+ charges/card/hour | Decline | [Card testing](/docs/fraud/types/card-testing) | | Daily velocity | 10+ charges/card/day | Review | Distributed card testing | | Country mismatch | card country != IP country | Review | Cross-border fraud | | Repeated declines | 3+ declines in 10 min | Decline | Card testing | | New account + high value | account $300 | Review | [ATO](/docs/fraud/types/account-takeover), synthetic identity | :::tip[Scale Matters] **Under $100K/month:** These six rules plus your processor's default ML are enough. Don't over-engineer. **$100K-$1M/month:** Add product-specific rules (gift cards, electronics) and customer tenure exceptions. **Over $1M/month:** Layer these with [ML scoring](/docs/fraud/prevention/risk-scoring) and [device fingerprinting](/docs/fraud/detection/device-fingerprinting). Rules become backstops, not your primary defense. ::: --- ## Device Intelligence as Rule Inputs The six rules above use transaction data. Amount, velocity, country, decline count, account age. Device intelligence adds a second layer that transaction data can't see. Run a device vendor, or your processor's built-in fingerprinting, and these become rule conditions. This section shows what's possible. Fields and syntax depend on your vendor. See [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) for the deep dive. ### Example: Combining Transaction Rules with Device Signals A transaction rule catches *what happened*. A device signal catches *how it happened* and *who did it*. ``` RULE: high_value_new_account (transaction-only) IF account_age $300 THEN review RULE: high_value_new_account_v2 (with device signals) IF account_age $300 AND (device_age_hours 3` | [Promo abuse](/docs/fraud/types/promo-abuse), multi-accounting, [synthetic identity](/docs/fraud/types/synthetic-identity) | | **Sensor anomaly** | `gyroscope_data = none` AND `device_type = mobile` | Emulator (no physical sensors) or phone farm device on a rack | ### Layering Transaction and Device Rules Use device signals to sharpen the rules you already have. Don't build a separate device rule set. | Existing Rule | Enhanced With Device Signal | Result | |--------------|---------------------------|--------| | Country mismatch (card != IP) | + `vpn_detected = false` | If no VPN, the mismatch is a real geographic discrepancy, not a traveler | | High-value new account | + `device_age > 30_days` | New account on a long-established device = lower risk (probably a real person, new to your site) | | Hourly velocity > 3 | + `emulator_detected = true` | Velocity from an emulator = almost certainly automated [card testing](/docs/fraud/types/card-testing) | | Repeated declines | + `accounts_per_device > 5` | Multiple accounts with failed auths from one device = fraud ring testing cards | :::tip[You Don't Need All of This on Day One] On Stripe Radar or Adyen RevenueProtect, the basics are already in your ML score: IP type, device fingerprint, velocity per device. Standalone vendors add the deeper stuff: behavioral biometrics, sensor data, True IP, remote desktop detection. Layer those in when your fraud outgrows the processor tools. See [Device Fingerprinting: Choosing a Vendor](/docs/fraud/detection/device-fingerprinting#choosing-a-vendor) for when to upgrade. ::: --- ## Data Enrichment as Rule Inputs The rules above use transaction and device data. Enrichment adds a third layer. Server-side API lookups on the IP, email and phone. Is the IP a datacenter? Is the email disposable? Is the phone a prepaid burner? These signals are cheap, often free, and need no client-side SDK. That makes enrichment the cheapest of the three layers to add once your six starter rules are live. See [Data Enrichment for Fraud Rules](/docs/fraud/detection/data-enrichment) for the full catalog, the vendors, and example rules. --- ## Rules That Prevent Fraud Losses The rules above block fraud. But with [friendly fraud](/docs/fraud/types/friendly-fraud) the transaction IS legitimate, so blocking it means blocking a real customer. You need two other kinds of rule instead: **3DS for liability shift**, and **evidence collection** so you win the chargeback when it lands. Preventing fraud and preventing fraud losses aren't the same job. See [Defending Against Fraud Losses](/docs/fraud/prevention/defending-against-fraud-losses) for the full strategy. ### Rules That Trigger 3DS [3DS](/docs/fraud/prevention/3ds) moves liability to the issuer on fraud chargebacks. So **any transaction you'd decline for fraud risk, challenge with 3DS instead.** Customer passes, you get the sale and the liability shift. Customer fails, you lost a sale you were declining anyway. Trigger it selectively, on the transactions most likely to be disputed: ``` RULE: 3ds_high_value_new_customer IF account_age $200 THEN request_3ds RATIONALE: New customer + high value = highest chargeback rate segment ``` ``` RULE: 3ds_high_dispute_category IF product_category IN (digital_goods, subscriptions, electronics) THEN request_3ds RATIONALE: These categories have 2-3x the dispute rate of general retail ``` ``` RULE: 3ds_repeat_disputer IF customer_prior_disputes > 0 THEN request_3ds RATIONALE: Customers who dispute once are 40% likely to dispute again ``` | Rule | Condition | Why 3DS | Friction Impact | |------|-----------|---------|-----------------| | High-value + new customer | account $200 | Highest friendly fraud segment | Low (frictionless 60-90% of the time) | | High-dispute product category | digital goods, subscriptions, electronics | These categories generate the most disputes | Low to medium | | Prior disputer | customer has 1+ previous disputes | Repeat behavior is predictable | Acceptable (protecting yourself) | | Moderate risk score | risk_score 50-75 (not high enough to decline) | Grey zone transactions benefit from authentication | Low | | International + high value | cross-border AND order > $150 | Cross-border disputes are harder to win | Medium (some issuers have higher challenge rates) | **Stripe Radar examples:** ``` Request 3D Secure if :amount_in_usd: > 200 AND :seconds_since_first_seen: 50 ``` :::tip[3DS Is Not Just for Fraud Prevention] For friendly fraud, 3DS is your strongest defense. The customer authenticated with their own bank, so when they later claim "I didn't make this purchase," liability sits with the issuer. It's your best answer to the most common reason code, fraud (10.4/4837). See [3D Secure](/docs/fraud/prevention/3ds) for implementation details. ::: ### Rules That Trigger Evidence Collection Not every rule has to block or challenge. Some should quietly escalate evidence collection. Then you're ready when a chargeback lands weeks later. ``` RULE: evidence_escalation_high_value IF order_total > $150 THEN require_signature_on_delivery RATIONALE: Signature confirmation wins "not received" disputes ``` ``` RULE: evidence_escalation_digital IF product_type = digital THEN log_device_fingerprint + log_ip + log_usage_after_delivery RATIONALE: CE 3.0 requires device/IP match to prior undisputed transactions ``` ``` RULE: evidence_escalation_subscription_renewal IF transaction_type = recurring AND renewal_count > 1 THEN send_renewal_reminder_email + log_email_delivery RATIONALE: "I cancelled" is the #1 subscription dispute. Renewal reminder email with confirmed delivery defeats it ``` | Trigger Condition | Evidence Action | What It Defeats | |-------------------|----------------|-----------------| | Order > $150 (physical goods) | Require signature on delivery | "Not received" (Visa 13.1, MC 4855) | | Digital goods delivery | Log device fingerprint, IP, download timestamp | Fraud claim (Visa 10.4) via CE 3.0 | | Subscription renewal | Send reminder email 7 days before, log delivery receipt | "I cancelled" (Visa 13.2) | | First purchase from customer | Capture device ID, IP, and link to account | Builds CE 3.0 history for future disputes | | Order > $500 | Require delivery photo + signature | "Not received" and "not as described" | | Customer has prior dispute history | Log all post-purchase activity (logins, usage, downloads) | Friendly fraud repeat behavior | :::info[Evidence Collection Is Not Friction] None of these rules add checkout friction. The customer doesn't see a difference. You're storing data you already have, in a form you can pull back when a dispute arrives. The cost is a few lines of integration code, not conversion. See [Defending Against Fraud Losses](/docs/fraud/prevention/defending-against-fraud-losses) for the full evidence strategy. ::: --- ## Allow Lists and Block Lists Allow and block lists are manual overrides. They bypass the rule engine entirely. Simple, powerful, and they rot if nobody manages them. ### Block Lists Block lists prevent known bad actors from transacting. Add entries when you have confirmed fraud. **What to block:** | Identifier | When to Block | Notes | |------------|--------------|-------| | Email address | Confirmed fraud from this email | Fraudsters reuse emails less than you'd think | | Card hash/fingerprint | Chargeback received, confirmed stolen | Most effective single identifier | | IP address | Active attack from this IP | **Set an expiration** (see warning below) | | Device ID | Device linked to multiple fraud incidents | Requires [device fingerprinting](/docs/fraud/detection/device-fingerprinting) | | Shipping address | Known reshipping address | Common with package forwarding fraud | If you only maintain one of these, maintain the card hash list. Every other identifier expires, some in as little as 30 days. A card that produced a chargeback stays compromised. **When to add entries:** - Confirmed chargeback (automatic in most processors) - Manual review confirms fraud (reviewer marks as fraudulent) - Fraud reported by customer (e.g., "I didn't make this purchase") **Expiration policy:** | Entry Type | Recommended Expiration | |------------|----------------------| | Card hash | Permanent (card is compromised) | | Email | 12 months, then review | | IP address | 30-90 days | | Device ID | 6 months | | Shipping address | 6 months, then review | :::warning[Don't Over-Block] Set expiration dates on IP and device blocks. A fraudster's IP today is an innocent customer's IP tomorrow. Shared IPs can take out thousands of real users. VPNs, corporate networks, mobile carriers. Review the list quarterly and prune it. ::: ### Allow Lists Allow lists let trusted customers bypass rules that would otherwise flag them. Use them sparingly, because an allow list entry nobody prunes is a fraud backdoor with your own signature on it. **What to allow:** | Identifier | When to Allow | Scope | |------------|--------------|-------| | Customer ID | Verified repeat customer with clean history | Time-capped (12 months) | | Email domain | Your own corporate domain, trusted partners | Permanent | | Card fingerprint | Customer's primary card, verified via support | Transaction cap ($5,000/month) | **Precedence:** Allow list entries override block rules. A customer on the allow list who trips a velocity rule still gets through. **Bounded scope:** Don't give unlimited allow list access. Set limits: - **Time cap:** Allow list entry expires after 12 months - **Spend cap:** Allow list bypasses rules only up to $X per month - **Rule cap:** Allow list bypasses velocity rules but NOT amount ceilings ### Automatic vs. Manual Management | Trigger | Action | Manual or Auto | |---------|--------|----------------| | Chargeback received | Add card hash to block list | **Automatic** (most processors do this) | | Review confirms fraud | Add email + device to block list | **Manual** (reviewer action) | | Review confirms legitimate | Add customer to allow list | **Manual** (reviewer action) | | Block list entry expires | Remove from block list | **Automatic** (TTL-based) | | Customer contacts support about block | Investigate, potentially add to allow list | **Manual** | Everything a reviewer decides stays manual on purpose. An automatic block on anything softer than a confirmed chargeback will eventually take out a real customer, and nobody will know why. :::tip[Stripe Block/Allow Lists] On a paid Radar tier (Standard, Plus or Pro), lists live under Dashboard > Radar > Lists. Radar Lite ships free with Stripe Payments and doesn't do lists. Build custom lists of emails, card fingerprints or IPs, then call them in rules: ``` Block if :email: in @block_list Allow if :customer_id: in @trusted_customers ``` For other processors, see [Processor Rules Configuration](/docs/fraud/processor-rules-configuration). ::: --- ## Shadow Mode: Test Before You Block In shadow mode a rule fires and logs the result. It doesn't block anything. Every rule should spend time there before it goes live. Skip it and you learn about false positives from customer complaints, not your dashboard. ### The Decision Framework Deploy every new rule in shadow mode for at least 2 weeks. Then analyze: - **Over 30% fraud in hits:** Promote the rule to live (with exceptions for trusted customers) - **10-30% fraud in hits:** Tighten the threshold or add conditions - **Under 10% fraud in hits:** Kill the rule. It's not worth the false positives Triggering on more than 5% of total traffic? The threshold is too loose, whatever the fraud-in-hits says. The full 4-week method lives in [Velocity Rules: How to Actually Test a Rule](/docs/fraud/detection/velocity-rules#how-to-actually-test-a-rule). Shadow, analyze, enforce, monitor, plus backtest math and sample sizes. The process is the same for any rule type. :::tip[Shadow Mode in Stripe] Stripe doesn't have a native shadow mode toggle. Write a Review rule instead of a Block rule. Review flags a transaction without blocking it. After two weeks, read the queue to see what you'd have caught. For Adyen, use the simulation feature in RevenueProtect. It runs rules against historical transactions. ::: --- ## The Rule Lifecycle Rules are never "done." They follow a lifecycle from creation to retirement. ```mermaid flowchart LR A[Create] --> B[Shadow] B --> C[Live] C --> D[Tune] D --> C D --> E[Retire] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#10b981,color:#fff style D fill:#f59e0b,color:#fff style E fill:#6b7280,color:#fff ``` | Stage | Duration | Key Activity | |-------|----------|-------------| | **Create** | 1 day | Write rule based on observed fraud pattern | | **Shadow** | 2-4 weeks | Collect data, measure trigger rate and fraud-in-hits | | **Live** | Ongoing | Rule actively blocking or reviewing transactions | | **Tune** | Monthly | Adjust thresholds based on performance data | | **Retire** | When stale | Remove rules that haven't triggered in 90 days | ### Monthly Review Checklist Run this every month to keep your rule set healthy: ``` โ–ก Pull trigger rate per rule - Which rules are firing most? - Any rule blocking > 1% of traffic? (Probably too aggressive) โ–ก Check fraud caught vs. false positives per rule - Fraud-in-hits > 30%? Keep the rule, consider tightening - Fraud-in-hits 70%? Move from decline to review, or add exceptions โ–ก Tighten rules with low false positives - If a rule has 5% FP rate and 60% fraud-in-hits, tighten the threshold โ–ก Loosen rules with high false positives - If a rule has 80% FP rate, add customer tenure or history exceptions โ–ก Retire rules that haven't triggered in 90 days - If the pattern it was catching no longer exists, remove the rule - Keep a log of retired rules in case the pattern returns โ–ก Check for new fraud patterns not covered by existing rules - Review recent chargebacks: what got through? - Talk to your review team: what patterns are they seeing? ``` For processor-specific review processes, see [Processor Rules Configuration: Monthly Review](/docs/fraud/processor-rules-configuration#monthly-review). ### When to Create New Rules New rules come from patterns you've watched happen, not guesses: 1. **Chargeback analysis reveals a pattern** (e.g., all recent chargebacks came from accounts under 7 days old) 2. **Review team flags a trend** (e.g., "we're seeing a lot of gift card orders from the same IP range") 3. **Fraud attack post-mortem** (e.g., "this attack would have been caught by a BIN-range rule") - see [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) 4. **Industry alert** (e.g., new fraud technique targeting your product category) --- ## Next Steps **Just getting started?** 1. Deploy the [day-one rule set](#your-day-one-rule-set) in shadow mode 2. Set up your [block list](#block-lists) to auto-add on chargebacks 3. Review shadow results after 2 weeks **Rules deployed but need tuning?** 1. Run the [monthly review checklist](#monthly-review-checklist) 2. Check your [allow list](#allow-lists) scope and expiration dates 3. See [Velocity Rules](/docs/fraud/detection/velocity-rules) for threshold tuning **Ready for the full operations picture?** 1. [Running Fraud Operations](/docs/operations/running-fraud-operations) - Daily/weekly/monthly operational cadence 2. [Fraud Model Feedback](/docs/fraud/detection/fraud-model-feedback) - How your vendor's ML learns from your data 3. [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Platform-specific syntax and setup --- ## Related - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - When to use rules, when to use ML - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate-based detection and threshold tuning - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining rules with ML scores - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Stripe, Adyen, Braintree syntax - [Fraud Model Feedback](/docs/fraud/detection/fraud-model-feedback) - Feedback loops and model tuning - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence playbook - [Manual Review](/docs/fraud/detection/manual-review) - Managing the review queue - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP, email, phone signals for rules - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device-based signals - [Card Testing](/docs/fraud/types/card-testing) - The fraud type rules catch best - [Account Takeover](/docs/fraud/types/account-takeover) - Login and credential fraud - [Fraud Metrics](/docs/fraud/metrics) - Measuring rule effectiveness - [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) - Emergency rule deployment - [Experimentation](/docs/reference/experimentation) - A/B testing rule changes --- ## Data Enrichment for Fraud Rules Source: https://paymentsandrisk.com/docs/fraud/detection/data-enrichment # Data Enrichment for Fraud Rules :::info[TL;DR] - **Data enrichment** = looking up what you don't know about a transaction via API. No SDK, no client-side code. Just server-side calls - **Start free**: MaxMind GeoLite2 (IP) costs nothing. IPQS offers a free plan (limited lookups) to test email/phone/IP signals - **All-in-one options**: IPQS and SEON bundle IP + email + phone lookups into a single API - **Enrichment feeds rules, it doesn't block anything alone.** You still need a [rules engine](/docs/fraud/detection/building-fraud-rules) to act on the signals - **Don't double-buy**: If you're already on Sift, Sardine, or Kount, these signals are baked into your platform ::: Enrichment is the cheapest layer you can bolt onto a fraud stack. You send one data point to an API. An IP, an email, a phone number. You get back context. Is the IP a datacenter? Is the email two days old? Is the phone a burner? That context feeds your [fraud rules](/docs/fraud/detection/building-fraud-rules). Enrichment doesn't decide anything. It just gives your rules something better to work with. --- ## What Data Enrichment Is (and Isn't) ```mermaid flowchart LR A[Transaction\nData] --> B[Enrichment\nAPIs] B --> C[IP Signals] B --> D[Email Signals] B --> E[Phone Signals] B --> F[Identity Signals] C --> G[Rules\nEngine] D --> G E --> G F --> G G --> H[Decision] ``` It's a specific layer, and it's easy to confuse with the ones next to it: | | Data Enrichment | Device Fingerprinting | Identity Verification | Full-Stack Platform | |---|---|---|---|---| | **What it does** | Looks up context on IP, email, phone via API | Collects device/browser attributes via client-side SDK | Confirms a person's identity (documents, liveness, KYC) | Combines enrichment, fingerprinting, ML, and decisioning | | **Integration** | Server-side API call | JavaScript SDK or mobile SDK | SDK + user-facing flow | SDK + API + dashboard | | **Customer friction** | None | None | High (document upload, selfie) | Varies | | **Cost** | Free tiers available, paid from $49/month | $0.002-0.05/session | $0.50-5.00/check | % of GMV or per-transaction | | **Examples** | MaxMind, IPQS, AtData, Telesign | ThreatMetrix, Fingerprint, Sardine | Socure, Veriff, Persona | Sift, Sardine, Signifyd | The difference that matters: **no SDK, no customer interaction**. Your backend calls an API, gets signals, feeds them to rules. That's it. It's the cheapest layer to add and the fastest to ship. ### Do You Need Standalone Enrichment? Not always. - **Already on a full-stack fraud platform** (Sift, Sardine, Signifyd, Forter, Kount)? They already eat IP, email and phone signals internally, often from MaxMind, Emailage and carrier feeds. Bolting enrichment on top is redundant. Ask your vendor what they use before you buy anything on this page. - **On processor tools only** (Stripe Radar, Adyen RevenueProtect) and want more signal without paying for a platform? Enrichment is your next step. It's cheap, it's quick, and it gives you something to write smarter [rules](/docs/fraud/detection/building-fraud-rules) against. - **Weighing enrichment against a full-stack platform?** See [What to Buy by Merchant Size](#what-to-buy-by-merchant-size) below. It comes down to volume and how complex your fraud is. Enrichment is a stepping stone, not a destination. Most merchants who grow past $5M end up on a [full-stack platform](/docs/fraud/vendors) or a [guarantee provider](/docs/fraud/prevention/chargeback-guarantees) that bundles these signals anyway. --- ## IP Intelligence IP is where most merchants start. Every transaction has one, and a single API call tells you whether it's suspicious. ### Signals | Signal | What It Tells You | Fraud Relevance | |--------|-------------------|-----------------| | **Geolocation** | Country, region, city, lat/long | Compare to billing/shipping address, card country | | **IP type** | Residential, datacenter, mobile, education | Datacenter IPs are 20-50x more likely to be fraud | | **VPN detection** | Whether the IP belongs to a known VPN provider | VPN + country mismatch = higher risk | | **Proxy detection** | Open proxy, anonymous proxy, residential proxy | Residential proxies are harder to detect and increasingly used in fraud | | **Tor exit node** | Whether the IP is a known Tor exit | Very high risk for e-commerce transactions | | **ISP/ASN** | Internet service provider, autonomous system number | Hosting providers (AWS, DigitalOcean) vs. consumer ISPs (Comcast, BT) | | **Connection type** | Broadband, cellular, satellite | Unexpected types for the transaction context | | **IP age/first seen** | How long the IP has been active in the vendor's network | Brand-new IPs (recently provisioned VPS) are higher risk | | **Risk score** | Composite score combining multiple signals | Quick triage - dig into components for rule building | ### Vendors | Vendor | What You Get | Free Tier | Paid Pricing | |--------|-------------|-----------|-------------| | **MaxMind** | GeoIP2 (geolocation, ISP, connection type) + minFraud (risk scoring, device, email, phone) | GeoLite2: free database with city/country/ASN accuracy | GeoIP2 Web: $0.0001-0.002/query depending on tier. minFraud: from $0.005/query | | **IP2Location** | Geolocation, proxy detection, VPN, Tor, ISP | LITE: free database download | API plans from $49/month. Database subscriptions from $99/year | | **IPQS** | IP + email + phone + device in one API | Free plan (5,000 lookups/month) | Starter $49/month (50K lookups), Pro $199/month (250K lookups), Enterprise custom | **MaxMind** is the default. GeoLite2 is free and good enough for basic geolocation. Paid GeoIP2 buys accuracy. minFraud adds risk scoring on email, phone and device. Most fraud platforms (Sift, Kount, Sardine) run MaxMind data under the hood. **IP2Location** is the budget option. LITE is free, and the downloadable databases let you look up locally instead of calling an API on every transaction. **IPQS** bundles IP with email, phone and device signals in one API. The free plan is 5,000 lookups a month, enough to test on real traffic. Paid starts at $49/month for 50K lookups. Deeper network signals need a client-side SDK. WebRTC leaks, TLS fingerprinting, residential proxy detection by device correlation. Those live in [device fingerprinting: true IP and network intelligence](/docs/fraud/detection/device-fingerprinting#2-true-ip-and-network-intelligence). --- ## Email Intelligence Email is one of the highest-signal enrichment sources. A legitimate customer's email has history. A fraudster's email was created yesterday. ### Signals | Signal | What It Tells You | Fraud Relevance | |--------|-------------------|-----------------| | **Validity/deliverability** | Whether the email exists and accepts mail | Invalid email = throwaway account | | **Domain type** | Free (Gmail), corporate, disposable (Guerrilla Mail, Mailinator) | Disposable domains are very high risk | | **Domain age** | When the domain was registered | Brand-new domains are suspicious | | **Email age/first seen** | How long the email has existed in the vendor's network | Emails first seen $200` | Review | Fresh accounts targeting high-value goods | | Prepaid phone + new account | `IF phone_line_type = "prepaid" AND account_age $100` | Review | Synthetic or throwaway identities on medium+ orders | | Identity mismatch | `IF name_to_phone_match = "none" AND name_to_email_match = "none"` | Decline | Stolen identity - none of the contact info matches the name | | Tor exit node | `IF tor_exit_node = true` | Decline | Anonymous browsing on e-commerce is almost always fraud | ### Layering Enrichment with Existing Rules Your [day-one rules](/docs/fraud/detection/building-fraud-rules#your-day-one-rule-set) use transaction data: amount, velocity, country. Enrichment makes those rules smarter: | Existing Rule | + Enrichment Signal | Improved Rule | |--------------|---------------------|---------------| | Country mismatch (card != IP) | + `vpn_detected = false` | If no VPN, the mismatch is a real geographic discrepancy | | New account + high value | + `email_age_days 3 | + `ip_type = "datacenter"` | Velocity from a datacenter IP = almost certainly automated | | Amount ceiling ($300+) | + `phone_line_type = "voip"` | High-value order from a VoIP number deserves extra scrutiny | ### Risk Score Adjustments If your system uses point-based scoring (see [Risk Scoring](/docs/fraud/prevention/risk-scoring)), enrichment signals feed directly into score adjustments: ``` Base score: 0 # IP signals IF ip_type = "datacenter" THEN +25 IF vpn_detected = true THEN +15 IF tor_exit_node = true THEN +40 IF ip_country != card_country THEN +20 # Email signals IF email_domain_disposable = true THEN +35 IF email_age_days = 70 THEN decline IF total_score >= 40 THEN review IF total_score < 40 THEN approve ``` :::warning[Shadow Mode First] Run every enrichment rule in shadow mode for two weeks before you enforce it. These signals throw false positives you won't see coming. VPN use varies by country, plenty of legitimate businesses sit on datacenter IPs, and prepaid phones are normal in some places. See [shadow mode: test before you block](/docs/fraud/detection/building-fraud-rules#shadow-mode-test-before-you-block) for the method. ::: --- ## What to Buy by Merchant Size | Annual Volume | Enrichment Recommendation | Or Consider Instead | |--------------|--------------------------|-------------------| | **Under $100K** | Nothing. [Processor tools](/docs/fraud/vendors#processor-native-tools) are enough | - | | **$100K-$500K** | MaxMind GeoLite2 (free IP geolocation database) | - | | **$500K-$2M** | MaxMind GeoIP2 + IPQS free plan for testing | Still manageable with enrichment + manual rules | | **$2M-$10M** | IPQS paid plan ($49-199/month) | A [full-stack platform](/docs/fraud/vendors#full-stack-fraud-platforms) ($500-2,000+/month) that includes these signals + ML + decisioning | | **Over $10M** | Layer specialists: MaxMind + Telesign + Emailage | Almost certainly better served by a full-stack platform or [guarantee provider](/docs/fraud/prevention/chargeback-guarantees) at this volume | At **$2M+**, the question isn't which enrichment vendor. It's enrichment plus your own rules, or a platform that does the lot. Got a fraud analyst who can write and tune rules? Enrichment gives you more control for less money. No analyst? A [full-stack platform](/docs/fraud/vendors#full-stack-fraud-platforms) or a [guarantee provider](/docs/fraud/prevention/chargeback-guarantees) is a better use of the budget. **Already on Sift, Sardine, Kount, Signifyd or Forter?** Don't double-buy. Ask your vendor which signals they already ingest before you buy anything on this page. :::tip[Experiment to Run] Pull your last 30 chargebacks. Look up the IP on each (MaxMind GeoLite2 is free) and the email and phone (IPQS free plan). How many would have thrown an obvious signal? If more than half show datacenter IPs, disposable emails or VoIP numbers, enrichment pays for itself. If they all look clean, your fraud is more sophisticated than this and enrichment alone won't touch it. ::: --- ## Privacy and Compliance :::warning[Data Handling] Enrichment APIs handle personal data: IPs, emails, phone numbers. Make sure yours clears the privacy laws that apply to you. - **GDPR**: fraud prevention usually rides on "legitimate interest", but you need a documented DPIA and the processing has to appear in your privacy policy - **CCPA/CPRA**: fraud prevention is an exempted purpose, but you still disclose the data sharing in your privacy notice - **Data retention**: don't keep enrichment results longer than you need them. 90 days is a reasonable default for fraud investigation - **Vendor DPAs**: sign one with every enrichment vendor. They're processing your customers' personal data on your behalf ::: --- ## Next Steps **Just getting started?** 1. Sign up for [MaxMind GeoLite2](https://www.maxmind.com/en/geolite2/signup) (free) and check IPs on your last 10 chargebacks 2. Create an [IPQS](https://www.ipqualityscore.com/) free account and test email/phone lookups on a few transactions 3. [Build rules](/docs/fraud/detection/building-fraud-rules) using the enrichment signals that show the most signal **Ready to buy?** 1. Pick a tier from the [size recommendation table](#what-to-buy-by-merchant-size) 2. Run your chosen vendor in shadow mode for 2 weeks 3. Compare enrichment-flagged transactions against actual chargebacks **Already have enrichment?** 1. Review your [rule performance monthly](/docs/fraud/detection/building-fraud-rules#monthly-review-checklist) 2. Layer enrichment with [device fingerprinting](/docs/fraud/detection/device-fingerprinting) for deeper signals 3. Consider [identity verification](/docs/fraud/detection/identity-verification) for high-risk transactions --- ## Related Topics - [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Rules that consume enrichment signals - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Client-side signals that complement server-side enrichment - [Identity Verification](/docs/fraud/detection/identity-verification) - When you need to confirm identity, not just enrich data - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate-based detection enrichment enhances - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - How enrichment feeds into composite scores - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Where enrichment fits in the rules/ML spectrum - [Fraud Vendor Landscape](/docs/fraud/vendors/landscape) - Full vendor comparison - [Fraud Vendors](/docs/fraud/vendors) - Vendor selection by merchant size - [Card Testing](/docs/fraud/types/card-testing) - Attack type enrichment catches well - [Account Takeover](/docs/fraud/types/account-takeover) - SIM swap and email signals - [Evidence Framework](/docs/fraud/detection/evidence-framework) - How enrichment signals fit Tier 1/Tier 2 - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence --- ## Spotting Repeat Fraudsters (Device Fingerprinting) Source: https://paymentsandrisk.com/docs/fraud/detection/device-fingerprinting # Spotting Repeat Fraudsters (Device Fingerprinting) :::info[TL;DR] - **Device fingerprinting** has evolved into **device intelligence**: hundreds of signals across hardware, browser, network, behavior, and sensor data - Modern platforms can detect VPNs, emulators, phone farms, remote desktop tools, and anti-detect browsers - Signals like **battery state**, **gyroscope data**, **TLS fingerprints**, and **typing cadence** reveal things transaction data alone can't - Vendors range from consortium-scale networks (ThreatMetrix, Iovation) to deep behavioral analytics (Sardine) to fully managed decisions (Forter) - No single signal is definitive. The power comes from **cross-layer correlation**: transport + device + browser + behavior ::: Device fingerprinting is a way of recognizing the phone or computer placing an order. A small script reads details the device gives away anyway - browser version, screen size, graphics chip, time zone, network - and builds an ID out of them. The point is that the ID sticks even when the fraudster comes back with a new name, a new email and a different card. Your processor already does some of this. Stripe Radar and Adyen RevenueProtect both fingerprint devices. The question is whether you need more than that. Device fingerprinting started as a unique ID for a browser. Device intelligence goes much deeper. It collects hundreds of signals across hardware, software, network and behavior. All of it answers four questions. Is this a real device? Is a real person using it? Have we seen it before? Is someone else driving it? That's the whole job. This page is the signals, what each one reveals, and which vendors have them. Putting them into rules? See [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules#device-intelligence-as-rule-inputs). --- ## How It Works ```mermaid flowchart TD A[User VisitsSite/App] --> B[SDK CollectsSignals] B --> C[Transport LayerTLS, IP, ASN] B --> D[Device LayerHardware, OS, GPU] B --> E[Browser LayerCanvas, WebGL, Fonts] B --> F[Behavior LayerTyping, Mouse, Sensors] C --> G[Cross-LayerCorrelation] D --> G E --> G F --> G G --> H{KnownDevice?} H -->|Known Bad| I[Block orReview] H -->|Known Good| J[TrustSignal] H -->|New| K[CreateProfile] K --> L{SignalsConsistent?} L -->|Anomalies| I L -->|Clean| M[NormalActivity] style I fill:#ef4444,color:#fff style J fill:#22c55e,color:#fff ``` ### Fingerprint Types | Type | How It Works | Persistence | Evasion Difficulty | |------|-------------|-------------|-------------------| | **Cookie-based** | Stores a token in the browser | Low (cleared easily) | Trivial | | **Browser fingerprint** | Hashes browser attributes (user agent, plugins, fonts) | Medium (changes with updates) | Moderate | | **Device fingerprint** | Combines hardware signals (GPU, CPU, screen, sensors) | High (survives browser changes) | Hard | | **Probabilistic/fuzzy** | Uses ML to match devices even when some attributes change | High (survives cookie clearing, incognito) | Very hard | | **Behavioral** | Learns how a specific person uses a device (typing, movement) | Medium-High (builds over sessions) | Very hard to replicate | Good vendors combine several types. They don't lean on any single fingerprint. They cross-reference every layer instead. Spoof one signal and you've created inconsistencies in the others. --- ## Signal Categories Platforms collect signals across seven categories. No one category decides anything on its own. You catch fraud on the inconsistencies *between* them. ### 1. Browser and App Signals The traditional fingerprinting layer. Still useful, but easily spoofed in isolation. | Signal | What It Reveals | Fraud Relevance | |--------|----------------|-----------------| | **Canvas fingerprint** | Hash of rendered 2D graphics (varies by GPU, driver, OS) | Matches known emulator/headless signatures | | **WebGL fingerprint** | GPU vendor and renderer string, 3D rendering output | `Google SwiftShader` = software GPU (headless/emulator). `VirtualBox Graphics Adapter` = VM | | **Audio fingerprint** | Audio processing output unique to hardware/OS stack | Absent in headless browsers, identical across emulator instances | | **Font enumeration** | Installed font list | Windows device claiming Linux fonts = spoofed user agent | | **Navigator properties** | Plugins, languages, hardware concurrency, device memory | `navigator.webdriver === true` = automation (Selenium, Puppeteer) | | **User agent** | Browser and OS identification | Easily spoofed, but inconsistencies with other signals are revealing | :::info[Anti-Detect Browsers] Multilogin, GoLogin and Dolphin Anty spoof all of these signals. Every profile looks unique, and fraud operations use them heavily. Platforms still catch them. The spoofed browser attributes don't line up with the signals that are hard to fake: TLS fingerprints, sensor data, behavior. ::: :::info[Looking for Basic IP Enrichment?] Want server-side IP lookups with no SDK? Geolocation, VPN detection, datacenter detection, all by API - see [Data Enrichment](/docs/fraud/detection/data-enrichment#ip-intelligence). This section is the deeper network stuff, and it needs a client-side SDK. WebRTC leak detection, TLS fingerprinting, residential proxy detection by device correlation. You can't get those from an API. ::: ### 2. True IP and Network Intelligence The IP is the most spoofed signal in fraud. Good platforms go past the visible one and hunt for the real one. | Technique | How It Works | What It Catches | |-----------|-------------|-----------------| | **WebRTC leak detection** | Creates a hidden peer connection via STUN servers. UDP traffic can bypass VPN tunnels, revealing the real IP | VPN users whose real IP leaks through WebRTC | | **TLS fingerprinting (JA3/JA4)** | Hashes the TLS ClientHello message (cipher suites, extensions). Each TLS client has a unique signature | User agent says "Chrome" but TLS fingerprint matches Python `requests` library = bot | | **ASN/datacenter detection** | Maps IP to owning organization. Classifies as residential, mobile, datacenter, or hosting | Datacenter IPs are 20-50x more likely to be fraud than residential | | **Residential proxy detection** | Correlates IP rotation patterns with stable device fingerprints | IP changes every request but device fingerprint stays constant = rotating residential proxy | | **Timezone vs. IP mismatch** | Compares browser timezone (`Intl.DateTimeFormat`) with IP geolocation | IP in London, timezone set to `America/Los_Angeles` = VPN user who forgot to change timezone | Several vendors sell "True IP" technology. It tries to surface the actual IP behind a VPN or proxy. ThreatMetrix pioneered it with TrueIP. Sardine sells a similar "True Piercing" set (TrueIP, TrueOS, TrueLocation). Accuracy swings by technique, and by how the VPN is configured. Don't treat it as ground truth. **IP classification matters as much as the IP itself:** | IP Type | Example Owner | Risk Level | |---------|--------------|-----------| | Residential | Comcast, AT&T, BT | Low (expected for consumers) | | Mobile/Cellular | T-Mobile, Vodafone | Low (expected for mobile) | | Datacenter/Hosting | AWS, DigitalOcean, OVH | High (real consumers don't browse from datacenters) | | Known VPN provider | NordVPN, ExpressVPN ranges | Medium-High | | Known proxy service | Bright Data, Oxylabs | High | | Tor exit node | Published exit node lists | Very High | ### 3. Device Integrity These signals check the device itself. Has it been tampered with, or is it an emulator? Is someone driving it remotely? | Signal | Normal Device | Fraud Indicator | |--------|-------------|----------------| | **Emulator detection** | Real hardware identifiers (e.g., `samsung/...`) | Generic build strings (`goldfish`, `ranchu`, `sdk_gphone`), SwiftShader GPU, missing sensors | | **Root/jailbreak** | Stock OS, normal permissions | Presence of `su` binary, Cydia/Magisk, SELinux permissive, writable system partition | | **Remote desktop** | No remote access software active | TeamViewer, AnyDesk, Windows RDP, Zoom screen sharing detected | | **VM detection** | Real GPU, normal CPU | VirtualBox/VMware graphics adapters, low CPU core count, VM-specific BIOS strings | | **Developer tools** | `navigator.webdriver` is false | `navigator.webdriver === true`, empty plugins array, CDP connection active | | **Frida/instrumentation** | No runtime hooks | Frida toolkit detected (commonly used to bypass security checks and manipulate API responses) | :::warning[Remote Desktop Detection Matters] Remote access scams are growing. A fraudster calls the victim and talks them into installing TeamViewer. Then he drives their device and makes the transaction himself. It comes off the victim's real device, on their real IP. Traditional signals look clean. Spotting active remote desktop software is one of the few ways to catch it. ::: ### 4. Behavioral Biometrics How someone *uses* a device is very hard to fake at scale. The newest and strongest signals live here. **Typing and keystroke dynamics:** | Signal | What It Measures | What Fraud Looks Like | |--------|-----------------|----------------------| | Typing speed | Characters per second, words per minute | Perfectly uniform timing = bot/automation | | Dwell time | How long each key is held | Zero variance = programmatic key injection | | Flight time | Gap between releasing one key and pressing the next | Identical intervals = scripted input | | Segmented typing | Typing in bursts with pauses (switching to reference material) | Typing name/address in fragments while looking at a stolen data sheet | | Copy-paste in identity fields | Whether name, SSN, or address was pasted vs. typed | Legitimate users type their own name from memory. Pasting it is a strong fraud signal | **Mouse and pointer behavior:** | Signal | What It Measures | What Fraud Looks Like | |--------|-----------------|----------------------| | Movement trajectories | Cursor path between targets | Perfectly straight lines = simplest bot. Geometric patterns = scripted | | Micro-movements | Tiny jitter when cursor is "still" | Zero jitter = bot. Humans always have hand tremor | | Click patterns | Timing, location, frequency | Uniform click intervals = automation | | Scroll behavior | Speed, direction, pauses | Uniform scroll with no pauses = bot | | Guided movement | Cursor controlled by someone else (latency artifacts) | Remote access tool in use | **Mobile sensor data:** | Signal | What It Measures | What Fraud Looks Like | |--------|-----------------|----------------------| | Gyroscope | Device orientation and rotation | Zero readings = emulator (no physical sensors) or phone farm device sitting on a rack | | Accelerometer | Movement and vibration | Perfectly static = not being held by a human | | Touch pressure | Force of finger on screen | Uniform pressure = automation. No pressure data = emulator | | Device orientation | How the phone is held | Static at ~90 degrees = propped up on a rack, not in someone's hand | ### 5. Battery and Power Signals A small category, and a revealing one. You get it through the Battery Status API on web, and native SDKs on mobile. | Signal | Normal User | Fraud Indicator | |--------|-------------|-----------------| | Always at 100%, always charging | Battery fluctuates throughout the day | Phone farm: devices permanently plugged into USB hubs | | Battery level never changes across sessions | Varies naturally | Emulator (many report a static level like `0.50` or `1.00`) | | Inconsistent battery between "same user" sessions | Consistent within short timeframes | Account sharing or credential selling | Battery data alone is weak, and it's only useful as corroboration. Take a device that's always charging and never moving the gyroscope. It's turned up on 50 accounts. That's almost certainly a phone farm device. ### 6. Phone Farm and Fraud Factory Detection A phone farm is a rack of devices pretending to be independent users. Physical or virtual, doesn't matter. No single signal catches them, so don't go hunting for one. You catch farms on the composite profile. | Signal | What a Farm Device Looks Like | |--------|------------------------------| | Battery | Always at 100%, always charging (plugged into USB hubs) | | Gyroscope/accelerometer | Zero movement (mounted on rack, not held by a human) | | Device attributes | Same hardware fingerprint appearing across many "different" accounts | | Factory resets | Frequent resets (every few hours/days) to create "fresh" identities | | Device ID cycling | IMEI, Android ID, or advertising ID changes on the same hardware | | Network patterns | Many devices sharing the same IP range or cycling through a small pool | | Behavioral uniformity | All devices show identical interaction patterns, timing, and session flow | | No natural idle periods | Legitimate users sleep. Farm devices may operate 24/7 | | Physical proximity | Dozens of "independent" devices co-located in the same physical space | ### 7. Consortium and Reputation Data The strongest signal here is also the simplest. Has this device committed fraud before? Consortium networks pool device reputation across thousands of merchants. Flag a device at one merchant. Everyone else in the network sees it in real time. That's the whole value. | What Consortium Data Tells You | Example | |-------------------------------|---------| | Device has been involved in fraud before | Device flagged for chargebacks at 3 other merchants in the past 90 days | | Device is brand new to the network | Never seen before, no history (higher risk for new accounts) | | Device has long trusted history | First seen 2 years ago, clean history across 12 merchants (strong trust signal) | | Device is linked to known fraud rings | Same device cluster seen in coordinated attacks across the network | --- ## How Signals Work Together No single signal is definitive, so you layer them and cross-reference. It's the inconsistencies between layers that give you the strongest read. **Example: Catching an anti-detect browser** An anti-detect browser spoofs canvas fingerprint, WebGL renderer, user agent, timezone and language. But: - The TLS fingerprint (JA3/JA4) still matches the underlying Chromium build, not the spoofed user agent - The battery API reports a static level (emulated environment) - Typing patterns don't match the account's historical behavior - The IP is residential, but the ASN belongs to a known residential proxy provider Any one of these alone might be explainable. All four together aren't. **Example: Detecting a remote access scam** The transaction comes from the victim's real device, real IP, real location. Traditional signals look clean. But: - Remote desktop software (TeamViewer) is active - Mouse movements show latency artifacts consistent with remote control - The user is on an active phone call during the session - Typing patterns show hesitation and segmented entry (victim being coached) --- ## Vendor Landscape Vendors vary a lot. What they collect, how big the consortium is, how they hand you a decision. The table below compares capabilities, not marketing claims. ### Comparison by Capability | Capability | Sardine | ThreatMetrix | Iovation | Kount | Sift | Forter | |-----------|---------|-------------|----------|-------|------|--------| | **Behavioral biometrics** | Deep (typing, mouse, sensors, copy-paste, active calls) | Yes (BehavioSec integration) | Limited | Limited | Basic | Yes (6,000 attributes) | | **True IP / proxy piercing** | Yes (True Piercing) | Yes (TrueIP, pioneer) | Basic proxy detection | Basic proxy flag | Basic | Yes | | **Emulator detection** | Yes + TrueOS | Yes | Yes | Yes (`PC_REMOTE` flag) | Yes | Yes | | **Remote desktop detection** | Yes (92% precision, protocol-agnostic) | Limited | Limited | `PC_REMOTE` flag | Limited | Limited | | **Phone farm detection** | Yes (sensor + behavioral composite) | Via consortium | Via device reputation | Via velocity | Via velocity | Via identity graph | | **TLS fingerprinting** | Yes | Yes | Limited | Limited | Limited | Yes | | **Anti-detect browser detection** | Yes | Yes | Limited | Limited | Limited | Yes | | **Consortium network scale** | Growing | 1.4B identities, 110M daily decisions | 5B devices, 185M fraud reports | 17.5B devices (Equifax network) | 1T+ events/year | 1.2B identities | | **Custom rule engine** | Yes (4,000+ features) | Yes (60+ assertions) | Yes (business rules) | Yes (policies + UDFs) | Yes (Workflows) | No (fully managed) | | **Credit bureau data** | No | No | No | Yes (Equifax) | No | No | | **Chargeback guarantee** | No | No | No | No | No | Yes | ### Choosing a Vendor The right vendor matches your biggest problem. Not the longest feature list. | If Your Primary Problem Is... | Look At | |------------------------------|---------| | **Sophisticated fraud bypassing basic rules** (anti-detect browsers, residential proxies, emulators) | Sardine, ThreatMetrix - deepest signal collection and cross-layer correlation | | **Needing device reputation at scale** (has this device been seen in fraud before?) | ThreatMetrix (1.4B identities), Iovation (6B+ devices) - largest consortium networks | | **Remote access / social engineering scams** | Sardine - only vendor with protocol-agnostic remote desktop detection at reported 92% precision | | **Identity verification + device signals** (synthetic identity, application fraud) | Kount/Equifax - unique credit bureau integration alongside device fingerprinting | | **Multi-abuse-type detection** (payment fraud + promo abuse + content abuse + ATO) | Sift - independent scores for 5 abuse types, ThreatClusters for industry-specific models | | **Not wanting to manage rules at all** (fully outsourced decisions with financial guarantee) | Forter - managed decisions with 100% chargeback guarantee on approved transactions | | **Budget-conscious / just getting started** | Fingerprint Pro (device ID focused, lower cost), or your processor's built-in tools (Stripe Radar, Adyen RevenueProtect) | ### Pricing and Accessibility | Vendor | Entry Price | Free Tier? | Self-Serve? | Primary Use Case | |--------|-----------|-----------|------------|-----------------| | **Fingerprint** | From $99/month (100K identifications) | Yes - 20,000 identifications/month | Yes | Device identification, returning visitor recognition | | **SEON** | Starter $699/month (2,500 fraud checks, 10 users, 50 rules) | No published free tier | Yes | Social profiling + email/phone enrichment + device signals | | **ThreatMetrix** (LexisNexis) | Enterprise quotes only | No | No | Large enterprise device intelligence, consortium reputation | | **BioCatch** | Enterprise quotes only | No | No | Behavioral biometrics for banks, social engineering detection | | **NeuroID** | Enterprise quotes only | No | No | Form interaction analytics, application fraud detection | | **Iovation** (TransUnion) | Enterprise quotes only | No | No | Device reputation + credit bureau integration | | **Sardine** | Enterprise quotes only | No | No | Deep behavioral biometrics, True IP piercing, remote desktop detection | One row there carries a price read off the vendor's own page. That's SEON: [seon.io/pricing](https://seon.io/pricing/), verified 2026-08-02. The Fingerprint figures weren't re-checked in that pass. Confirm them on Fingerprint's own pricing page before you budget. Everything marked enterprise-quotes-only publishes nothing at all. **Budget-conscious?** Two self-serve options here, Fingerprint and SEON. Only Fingerprint publishes a free tier, SEON publishes none. You start at Starter: **$699/month for 2,500 fraud checks**, ten users, fifty custom rules. Premium is quote-only. That's roughly **28 cents a fraud check**, and it's worth writing down. SEON's the only fraud vendor on this page that publishes one at all. Use it as your yardstick when a quote-only vendor sends a proposal. And SEON isn't a pure device fingerprinting tool. It bundles a basic device hash into a lightweight fraud platform, alongside email and phone enrichment. **Enterprise?** ThreatMetrix, BioCatch, NeuroID, Iovation and Sardine all want a sales call and an annual contract. None of them publishes a minimum volume. There's no threshold you can check yourself. The only way to find out if you're too small is to ask. A vendor that won't quote you has answered the question. If that happens, start with Fingerprint or your processor's built-in tools (Stripe Radar, Adyen RevenueProtect). :::info[Processor Tools vs. Standalone Vendors] On Stripe Radar or Adyen RevenueProtect? You've already got basic device fingerprinting, IP intelligence and ML scoring. Standalone vendors add the deeper signals: behavioral biometrics, sensor data, True IP, consortium reputation. Processor tools don't collect those. Whether you need one comes down to your fraud sophistication and your volume. See [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) for what each processor includes. ::: --- ## Use Cases ### Fraud Detection | Use Case | How Device Intelligence Helps | |----------|------------------------------| | **[Card testing](/docs/fraud/types/card-testing)** | Same device cycling through hundreds of card numbers = single fraud source | | **Multi-accounting / [promo abuse](/docs/fraud/types/promo-abuse)** | Same device fingerprint across multiple "different" accounts | | **[Account takeover](/docs/fraud/types/account-takeover)** | New device + new location + new behavioral pattern on existing account | | **Fraud ring linkage** | Cluster of devices with shared attributes, same IP ranges, same behavioral patterns | | **Application fraud** | Emulator detected, copy-paste in identity fields, no sensor data | | **Remote access scams** | Active remote desktop software, mouse latency artifacts, active phone call | ### Account Security and Trust | Use Case | How Device Intelligence Helps | |----------|------------------------------| | **Step-up authentication** | Trigger MFA on unknown device (see [3DS](/docs/fraud/prevention/3ds)) | | **Trusted device recognition** | Returning device with clean history = lower friction | | **Session management** | Limit active devices per account | | **[Compelling evidence](/docs/chargebacks/representment/compelling-evidence)** | Device fingerprint matching for Visa CE 3.0 chargeback representment | --- ## Implementation Approaches ### Build vs. Buy | Approach | What You Get | What You Don't Get | |----------|-------------|-------------------| | **In-house** (FingerprintJS open source) | Basic device fingerprinting, full control, no data sharing | No consortium data, no behavioral biometrics, no True IP | | **Device ID vendor** (Fingerprint Pro) | Stable device IDs, basic bot detection, good accuracy | Limited behavioral signals, smaller consortium | | **Full platform** (Sardine, ThreatMetrix, Sift, etc.) | Deep signals, behavioral biometrics, consortium, rules engine | Higher cost, data sharing requirements, vendor dependency | | **Processor-included** (Stripe Radar, Adyen) | Basic fingerprinting + ML scoring included in processing fees | Black-box scoring, limited device signal visibility, no cross-merchant reputation | See [vendor selection guide](/docs/fraud/vendors/selection-guide) for evaluation criteria. ### What to Ask a Vendor Ask these on the vendor call, in these words: 1. **What signals do you collect beyond basic fingerprinting?** (Behavioral biometrics, sensor data, TLS fingerprints) 2. **How do you handle anti-detect browsers and residential proxies?** (Cross-layer correlation, not just database lookups) 3. **How big is your consortium, and is it relevant to my vertical?** (A billion devices doesn't help if none are in your industry) 4. **Can I write custom rules against your signals, or are decisions fully managed?** 5. **What's the latency?** (Sub-100ms is the standard for real-time decisioning) 6. **How do you handle privacy compliance?** (Data tokenization, consent management, GDPR readiness) --- ## Privacy Considerations :::warning[[Compliance](/docs/compliance) Required] Device fingerprinting may be subject to: - GDPR (consent requirements, legitimate interest basis) - CCPA (disclosure requirements) - ePrivacy Directive - Local regulations Consult legal before implementation. See [compliance overview](/docs/compliance) for related requirements. ::: ### Best Practices 1. **Transparency** - Disclose device fingerprinting in your privacy policy 2. **Purpose limitation** - Use only for fraud prevention and security 3. **Data minimization** - Collect only what's needed for fraud detection 4. **Retention limits** - Expire device profiles (consortium retention may differ) 5. **Consent where required** - Cookie banners, opt-in where legally necessary 6. **Vendor data sharing** - Know what your vendor shares across its consortium, and on what terms --- ## Next Steps **Just getting started?** 1. Use your processor's built-in device fingerprinting first (Stripe Radar, Adyen RevenueProtect) 2. [Build velocity rules](/docs/fraud/detection/velocity-rules) using device ID as a dimension 3. [Review privacy requirements](#privacy-considerations) before adding standalone tools **Adding standalone device intelligence?** 1. [Choose a vendor](#choosing-a-vendor) based on your primary fraud problem 2. Integrate it and run shadow mode for 30 days 3. Compare the new signals to your current catches and false positives **Already have device intelligence?** 1. [Use device signals in fraud rules](/docs/fraud/detection/building-fraud-rules#device-intelligence-as-rule-inputs) 2. [Build behavioral patterns into your review process](/docs/fraud/detection/manual-review) 3. [Prepare device data for CE 3.0](/docs/chargebacks/representment/compelling-evidence) chargeback representment --- ## Related Topics - [Data Enrichment](/docs/fraud/detection/data-enrichment) - Server-side IP, email, phone signals (no SDK) - [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Using device signals in rules - [Account Takeover](/docs/fraud/types/account-takeover) - ATO detection with device data - [Velocity Rules](./velocity-rules.md) - Device-based velocity limits - [Promo Abuse](/docs/fraud/types/promo-abuse) - Multi-account detection - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Incorporating device signals into scores - [Behavioral Analytics](./behavioral-analytics.md) - Complementary detection method - [Evidence Framework](./evidence-framework.md) - How device data fits Tier 1/Tier 2 - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Using device data in representment - [Manual Review](/docs/fraud/detection/manual-review) - When device signals trigger review - [Fraud Vendors](/docs/fraud/vendors/landscape) - Full vendor landscape - [Card Testing](/docs/fraud/types/card-testing) - Bot detection patterns - [Fraud Model Feedback](/docs/fraud/detection/fraud-model-feedback) - How device signals improve ML - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence --- ## Evidence Framework Source: https://paymentsandrisk.com/docs/fraud/detection/evidence-framework # Evidence Framework :::info[TL;DR] - **Tier 1 = Conviction** (one alone justifies fraud classification): Device linked to 3+ fraud cases, identity confirmed stolen, previous confirmed fraud - **Tier 2 = Evidence** (combine 3+ for fraud): Never-pay, email under 30 days old, device anomalies, phone recently ported - **Decision**: 1+ Tier 1 = Block/Decline. 3+ Tier 2 = High risk, review. 1-2 Tier 2 = Medium risk. 0 = Low risk ::: Two tiers of signal. Tier 1 convicts by itself, and Tier 2 doesn't, so it only counts when it stacks. ## Overview Not all fraud signals are equal. Sort them by confidence and you'll call the same case the same way twice. :::tip[Core Principle] **Tier 1 = Conviction** (one's enough) **Tier 2 = Evidence** (multiple required) ::: ## Tier 1 Indicators You don't need a second signal here. Any one of these classifies the case: ### Identity-Related | Indicator | How to Confirm | |-----------|----------------| | SSN issued after stated DOB would suggest | Bureau data, SSA verification | | Identity confirmed as fraud victim | Police report, affidavit, bureau alert | | SSN belongs to deceased individual | Bureau data, death records | | SSN never issued | SSA verification | | Document forensically invalid | Document verification technology | ### Pattern-Related | Indicator | How to Confirm | |-----------|----------------| | [Device](/docs/fraud/detection/device-fingerprinting)/IP linked to 3+ confirmed fraud cases | Device intelligence, internal data | | Address used by known fraud ring | Consortium data, internal analysis | | Exact application data matches confirmed fraud | Pattern matching, feature vectors | | Account explicitly claimed by identity theft victim | Affidavit, [manual review](./manual-review.md) | When a Tier 1 indicator fires, classify and stop. A reviewer who keeps digging past a confirmed stolen identity is spending hours to reach a conclusion they already have. ## Tier 2 Indicators One of these on its own isn't a case. Three of them is: ### Application Signals | Indicator | Weight | Notes | |-----------|--------|-------| | Email created > bureau income indicators | โš ๏ธ Medium | Could be recent change | ### Behavior Signals | Indicator | Weight | Notes | |-----------|--------|-------| | Never-pay (0 payments from origination) | โš ๏ธ High | Strong but not conclusive (see [first-party fraud](/docs/fraud/types/first-party)) | | [Bust-out pattern](/docs/fraud/types/bust-out) (utilization spike) | โš ๏ธ High | May be financial hardship | | [Device](/docs/fraud/detection/device-fingerprinting) seen on prior fraud (1-2 cases) | โš ๏ธ Medium | Could be shared device | | [Velocity](/docs/fraud/detection/velocity-rules) anomaly | โš ๏ธ Medium | Context dependent | ### Link Analysis Signals | Indicator | Weight | Notes | |-----------|--------|-------| | Same phone on multiple identities | โš ๏ธ Medium | Could be family | | Same device on multiple identities | โš ๏ธ Medium | Could be shared device | | Address velocity (3+ apps, same address, 30 days) | โš ๏ธ High | Strong ring indicator | ## Decision Matrix ### Classification Rules | Evidence | Classification | |----------|---------------| | 1+ Tier 1 indicator | Fraud | | 3+ Tier 2 indicators (High weight) | Fraud | | 4+ Tier 2 indicators (any weight) | Fraud | | 1-2 Tier 2 indicators | Investigation | | 0 indicators | Credit loss (if loss exists) | ### Example Scenarios **Scenario A: Clear Fraud** - SSN issued after DOB โ†’ Tier 1 โœ“ - **Classification: FRAUD** **Scenario B: Clear Credit Loss** - Verified employment, verified income - No velocity anomalies - No device/address flags - Customer payment pattern consistent with financial hardship - **Classification: CREDIT LOSS** **Scenario C: Needs Investigation** - Email created recently (Tier 2) - Never-pay pattern (Tier 2) - Employment unverifiable (Tier 2) - **Action: Gather more evidence, time-box decision** Scenario C is the one that eats your team. Time-box it before you open it, because an investigation with no deadline becomes a case nobody closes. ## Documentation Requirements Every fraud classification needs a paper trail. Here's what goes in it: 1. **Indicators present** - List all relevant signals 2. **Evidence sources** - Where each signal came from 3. **Decision rationale** - Why classification was made 4. **Reviewer** - Who made the decision 5. **Date** - When decision was made Write it the day you decide. A rationale reconstructed six months later is a guess with a date on it. ## Next Steps **Setting up evidence framework?** 1. [Define Tier 1 indicators](#tier-1-indicators) - High-confidence signals 2. [Define Tier 2 indicators](#tier-2-indicators) - Supporting signals 3. [Create decision matrix](#decision-matrix) - Classification rules **Investigating a case?** 1. [Check for Tier 1 indicators](#tier-1-indicators) - One's enough on its own 2. [Count Tier 2 indicators](#tier-2-indicators) - 3+ for fraud classification 3. [Manual review](./manual-review.md) - Human investigation for complex cases **Documenting decisions?** 1. [Review documentation requirements](#documentation-requirements) - What to record 2. [Use example scenarios](#example-scenarios) - Apply to your case 3. [Classify per decision matrix](#classification-rules) - Make the call --- ## Related Topics - [Manual Review](./manual-review.md) - Human investigation for complex cases - [Fraud Types](/docs/fraud/types) - All fraud type definitions - [Fake Identity Fraud](/docs/fraud/types/synthetic-identity) - Fabricated identities - [First-Party Fraud](/docs/fraud/types/first-party) - Customer abuse - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining signals into scores - [Velocity Rules](./velocity-rules.md) - Detecting abuse patterns - [Data Enrichment](./data-enrichment.md) - Email age, phone type, IP signals (Tier 2 indicators) - [Device Fingerprinting](./device-fingerprinting.md) - Tracking devices - [Fraud Rings](/docs/fraud/types/bust-out) - Organized fraud attacks --- ## Fraud Model Feedback Source: https://paymentsandrisk.com/docs/fraud/detection/fraud-model-feedback # Fraud Model Feedback :::info[TL;DR] - Your vendor's ML model improves when you give it **outcomes**. Chargebacks, fraud reports, false positive flags - **Chargebacks** arrive 30-120 days late. Send fraud reports the moment you confirm fraud, so the model gets a faster signal - **Score drift** is real. The same score means different things over time. Check your distribution weekly - **Monitor four things**: score distribution (weekly), block rate trend (weekly), fraud-in-approved rate (monthly), false positive sample (monthly) - At minimum, check that chargebacks reach your fraud vendor. That's the baseline. Everything else is optimization ::: Your fraud vendor's ML model is only as good as the data it learns from. Every score comes from patterns it found in past transactions and their outcomes. Don't feed the outcomes back and it stagnates. Here's how the loop works, what breaks it, and what to watch. For thresholds and cost math, see [Risk Scoring](/docs/fraud/prevention/risk-scoring). For rule-based detection, see [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules). --- ## What Your Fraud Score Actually Means Every fraud vendor gives you a number. It's the model's estimate that a transaction is fraudulent. | Vendor | Score Range | Higher Means | |--------|-----------|-------------| | Stripe Radar | 0-100 | Higher risk | | Sift | 0-100 | Higher risk | | Forter | Confidence % | Higher confidence in approve/decline decision | | Signifyd | 0-1000 | Higher confidence the order is good | | Adyen | 0-100+ | Higher risk | **The same score means different things at different businesses.** A Radar 65 on a $20 digital download is a different bet than a 65 on a $2,000 electronics order. Your thresholds should track your margins, your fraud rate, and how much false positive pain you'll take. For setting thresholds and calculating the cost trade-off, see [Risk Scoring: Finding Your Thresholds](/docs/fraud/prevention/risk-scoring#finding-your-thresholds). --- ## How the Model Learns: The Feedback Loop The model improves when you tell it what actually happened after it scored a transaction. That's the feedback loop. ```mermaid flowchart TD A[TransactionScored] --> B{Decision} B -->|Approved| C[CustomerReceives Order] B -->|Declined| D[TransactionBlocked] B -->|Review| E[ManualReview] C --> F{Outcome} E -->|Approve| C E -->|Decline| D F -->|Legitimate| G[No FeedbackNeeded] F -->|Chargeback| H[ChargebackSignal] F -->|Fraud Report| I[Fraud ReportSignal] D --> J[False PositiveFlag?] H --> K[ModelLearns] I --> K J -->|Yes| K style K fill:#10b981,color:#fff style H fill:#ef4444,color:#fff style I fill:#f59e0b,color:#fff ``` ### The Three Types of Feedback **1. Chargebacks (automatic in most setups)** A customer disputes a charge with their bank. The chargeback flows from the card network through your processor. If your fraud vendor IS your processor (Stripe, Adyen), that's automatic. On a third-party vendor like Sift or Forter, check the integration is actually passing dispute data. - **Signal strength:** High. A chargeback is a confirmed bad outcome. - **Delay:** 30-120 days after the transaction. That's the core problem (see below). **2. Fraud reports (manual or semi-automated)** You flag a transaction as confirmed fraud before any chargeback lands. Maybe a customer called ("I didn't make this purchase"). Maybe your review team spotted a pattern. - **Signal strength:** High, and much faster than waiting for a chargeback. - **Delay:** As fast as you flag it. Days instead of months. **3. False positive flags (manual)** You tell the model a blocked transaction was actually legitimate. It's the signal most merchants forget to send. - **Signal strength:** Medium. Helps the model learn what "good" looks like, not just what "bad" looks like. - **Delay:** Whenever you catch it. Usually when a customer calls support about a block. ### How Feedback Reaches Your Vendor | Vendor | Chargebacks | Fraud Reports | False Positive Flags | |--------|------------|--------------|---------------------| | **Stripe** | Automatic from disputes | Via Dashboard or API (`Report as fraudulent`) | Mark review items as legitimate | | **Sift** | Requires `$chargeback` event via API | Requires `$label` event via API | Requires `$label` with `is_fraud: false` | | **Forter** | Requires feedback API call | Requires feedback API call | Requires feedback API call | | **Signifyd** | Automatic from guarantee claims | Via case management | Via case management | | **Adyen** | Automatic from disputes | Via dispute management or API | Via risk rule feedback | :::tip[At Minimum, Verify Chargebacks Flow] Make sure chargebacks reach your fraud vendor. That's automatic on most processor-integrated tools, like Stripe Radar and Adyen RevenueProtect. On a third-party tool like Sift or Forter, check the integration is sending chargeback events. Your vendor's docs will tell you. That's the baseline. Everything else here is optimization on top. ::: --- ## The Feedback Delay Problem Chargebacks arrive 30-120 days after the transaction. So the model is always learning from stale data. ``` Timeline: Day 0: Transaction scored (model uses what it knows NOW) Day 1-30: Fraud happens, goes undetected Day 30: Customer notices unauthorized charge Day 45: Customer files dispute with bank Day 60: Chargeback reaches your processor Day 75: Chargeback data feeds back to model Day 90+: Model updates (next training cycle) The model is learning from data that's 2-3 months old. ``` ### What This Means The model is always one fraud cycle behind. If a new fraud pattern emerges in January, the model won't learn about it from chargebacks until March or April. Meanwhile, you're exposed. ### What You Can Do **Send fraud reports immediately.** Don't wait for the chargeback. When you confirm fraud through any channel, report it to your vendor right away. | Signal | Speed | How to Send | |--------|-------|-------------| | Chargeback | 30-120 days | Automatic (verify integration) | | Fraud report | 1-7 days | Manual via dashboard or API | | Customer complaint ("I didn't buy this") | 1-3 days | Flag in review tool, report to vendor | | Refund-before-chargeback | 1-14 days | Some vendors auto-learn from refund reason codes | | Manual review decline | Same day | Review queue decision feeds back | The faster you send outcomes, the faster the model adapts. Report fraud within 48 hours and you've handed your model a 2-3 month head start. :::info[Refund Reason Codes] Some processors, Stripe and Adyen among them, learn from refund reason codes. Refund with reason "fraudulent" and the processor may read that as a fraud signal. Check your processor's docs. ::: --- ## When Models Go Wrong ML models aren't set-and-forget. They degrade if nobody watches them. ### Score Drift The distribution of fraud scores shifts over time. A transaction that scored 60 last quarter might score 45 now. The underlying risk hasn't changed at all. **Why it happens:** The model retrains on new data. New fraud patterns emerge. Seasonal traffic changes the mix. Or the vendor ships a model update. **How to spot it:** Check your score distribution weekly. Median shifting, or tails changing shape? Your thresholds need a look. ``` Last quarter: Median score = 25 | 5% of transactions scored > 70 This quarter: Median score = 32 | 8% of transactions scored > 70 If your decline threshold is 70, your block rate just went from 5% to 8%. Did fraud actually increase, or did the scores shift? ``` **What to do:** Re-test your thresholds quarterly. Run the [threshold sweep experiment](/docs/fraud/prevention/risk-scoring#setting-thresholds) from Risk Scoring to recalibrate. ### Fraud Pattern Changes Fraudsters change tactics. A new attack hits you that the model has never seen. **Why it happens:** Fraudsters adapt. If your model catches one pattern, they try another. New fraud techniques emerge industry-wide. **What to do:** Rules cover the gap while the model catches up. When you spot a new pattern: 1. Write a rule to catch it (see [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules)) 2. Report the fraud to your vendor (speeds model learning) 3. The model learns the pattern from outcomes, eventually That's why you need both. Rules are your fast response. ML is your long-term learner. ### Cold Start New business, new vertical, or new geography. The model has no history, so it's guessing. **Strategy:** 1. Lean heavily on rules early (they work without training data) 2. Use conservative thresholds (more reviews, fewer auto-approvals) 3. Weight the model higher as data accumulates (3-6 months) 4. Send all outcomes (fraud and legitimate) to accelerate learning For a detailed cold start strategy, see [Risk Scoring: Cold Start Strategy](/docs/fraud/prevention/risk-scoring#cold-start-strategy). ### Seasonal Shifts Holiday shopping, back-to-school, end-of-year. That traffic looks nothing like your normal traffic. The model may flag real holiday behavior as anomalous. **What to do:** - **November-December:** Relax thresholds slightly (higher volume, more gift purchases, more new shipping addresses). Move borderline declines to review - **January:** Tighten thresholds back (holiday fraud chargebacks start arriving, legitimate volume drops) - **Your seasonal peaks:** If your business has specific peak periods (tax season, semester start, etc.), adjust thresholds around those dates :::warning[Don't Relax Too Much] "Relax for the holidays" doesn't mean "turn off fraud detection." Fraudsters know you're relaxing. Adjust by 10-15%, not 50%. And monitor daily during peak periods. ::: --- ## What to Monitor ### Weekly Checks **Score distribution: Is it shifting?** Pull a histogram of fraud scores for the past week. Compare to the previous 4-week average. | What to Look For | What It Means | Action | |-----------------|--------------|--------| | Median score increasing | Model is scoring more transactions as risky | Check if fraud is actually rising, or if scores drifted | | More transactions in the "review" band | Review queue will grow | Verify you have capacity, or adjust thresholds | | Scores clustering at extremes | Model is more "decisive" (fewer gray areas) | Usually fine, but check false positive rate | **Block rate trend: Did something break?** | Signal | Possible Cause | Action | |--------|---------------|--------| | Sudden increase in blocks | New rule deployed too aggressively, model update, fraud spike | Investigate immediately | | Gradual increase in blocks | Score drift, traffic mix change | Re-test thresholds | | Sudden decrease in blocks | Rule disabled accidentally, model update | Check fraud-in-approved rate | ### Monthly Checks **Fraud-in-approved rate: Are you missing fraud?** ``` Fraud-in-approved = Chargebacks on approved transactions / Total approved transactions ``` If it's rising, your detection is getting worse. Either your thresholds are too loose, or something new is getting through. **False positive sample: Are you blocking good customers?** Pull a random sample of 10-20 declined or blocked transactions. Investigate each one: - Was it actually fraud? - Was it a legitimate customer? - What rule or score triggered the block? If more than 50% of your sample are false positives, your detection is too aggressive. ### Quarterly Checks **Threshold re-calibration:** Re-run the [threshold sweep experiment](/docs/fraud/prevention/risk-scoring#setting-thresholds). Scores drift. Last quarter's optimal threshold isn't this quarter's. ### Monitoring Summary | Cadence | What to Check | Red Flag | |---------|--------------|----------| | **Weekly** | Score distribution | Median shifted > 5 points | | **Weekly** | Block rate | Changed > 20% from baseline | | **Monthly** | Fraud-in-approved rate | Rising for 2+ consecutive months | | **Monthly** | False positive sample (10-20 blocked txns) | Over 50% are legitimate | | **Quarterly** | Threshold sweep | Optimal thresholds shifted > 10 points | --- ## Next Steps **Just getting started with ML scoring?** 1. Verify chargebacks flow to your vendor (the baseline) 2. Set initial thresholds using [Risk Scoring](/docs/fraud/prevention/risk-scoring) 3. Start weekly score distribution checks **Already have ML but want to improve it?** 1. Start sending fraud reports within 48 hours of confirmation 2. Flag false positives in your review tool 3. Run the [threshold sweep experiment](/docs/fraud/prevention/risk-scoring#setting-thresholds) quarterly **Want the full operational picture?** 1. [Running Fraud Operations](/docs/operations/running-fraud-operations) - Daily/weekly/monthly cadence 2. [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Rules as fast response to new patterns 3. [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Platform-specific setup --- ## Related - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Thresholds, cost calculations, cold start - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - When to use each approach - [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Starter rules, allow/block lists, shadow mode - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate-based detection - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP, email, phone features for ML models - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence playbook - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Vendor-specific setup - [Manual Review](/docs/fraud/detection/manual-review) - Review queue as feedback source - [Fraud Metrics](/docs/fraud/metrics) - Measuring detection performance - [Fraud Vendors](/docs/fraud/vendors/landscape) - Vendor ML capabilities - [Fraud Economics](/docs/fraud/fundamentals/economics) - Cost of fraud decisions - [Experimentation](/docs/reference/experimentation) - Testing threshold changes --- ## Identity Verification Source: https://paymentsandrisk.com/docs/fraud/detection/identity-verification # Identity Verification :::info[TL;DR] - **Passive verification** ($0.02-0.50/check): Database checks, phone/carrier signals, email risk, synthetic fraud scoring. No customer friction. - **Documentary verification** ($0.80-5.00/check): Government ID scan + selfie + liveness detection. High friction, high assurance. - Use a risk-based waterfall: passive first, step up to documentary only when needed. - Top vendors: Socure, SentiLink (passive/synthetic); Veriff, Persona, Jumio (documentary); Plaid (bank+ID combined); iProov (deepfake/liveness specialist). - US lenders faced $3.3B in synthetic identity exposure (TransUnion, 2024). Ask vendors about injection attack detection, not just presentation attacks. - **Need the bigger picture?** See [KYC & KYB for Fraud Prevention](/docs/fraud/prevention/kyc-kyb) for when to verify, ROI math, and building a proportional program. ::: Confirming that customers are who they claim to be. ## What Identity Verification Is Up Against Before choosing a verification method, you need to understand what's actually hitting your onboarding flow. Identity fraud falls into two categories: **data-layer attacks** (beating passive checks) and **document-layer attacks** (beating documentary verification). Most fraud programs need defenses against both. ### Data-Layer Attacks (Target Passive Verification) These attacks exploit the data sources that passive verification relies on. The fraudster never touches a document. They're through on stolen or fabricated data alone. | Attack | How It Works | Scale | |---|---|---| | **Synthetic identity** | Combine a real SSN (often a child's, elderly person's, or immigrant's) with a fabricated name, DOB, and address. Build credit history over months. The identity looks real in databases because parts of it are. | $3.3B in lender exposure in the US (TransUnion, 2024). Fastest-growing fraud type. | | **Stolen identity (third-party fraud)** | Use a real person's complete identity - name, SSN, DOB, address - obtained from data breaches, phishing, or dark web purchases. Passes database checks because all the data is real. | Billions of records available from breaches. Most common identity fraud type by volume. | | **Burner contact info** | Create accounts with prepaid phones, VoIP numbers, and disposable email addresses. These pass basic "does this phone/email exist?" checks but fail carrier tenure and domain age checks. | Trivial to execute. Prepaid SIMs cost $1-5. | | **Data breach exploitation** | Use leaked PII to answer KBA questions, verify SSN matches, and pass identity quizzes. Most KBA questions have been compromised by breaches. | Virtually every US adult has had PII exposed in at least one breach. | **What catches these:** Synthetic fraud scoring (Socure, SentiLink), carrier tenure checks (Prove), email age/domain analysis, device fingerprinting, bank account verification (Plaid). No single signal catches all of them, so you're layering passive checks. ### Document-Layer Attacks (Target Documentary Verification) These attacks target the ID scan + selfie + liveness flow. They've evolved rapidly since 2023 as AI tools have become accessible and cheap. | Attack | How It Works | Difficulty to Detect | |---|---|---| | **Forged documents** | Alter a real ID template - swap the photo, change the name or DOB. Physical forgeries are declining; digital forgeries (edited images submitted to verification APIs) are growing. | Medium. Template matching and tamper detection catch most. | | **Synthetic documents** | Generate a complete fake ID from scratch using AI. Modern tools produce IDs that pass basic template checks. | Medium-High. Requires document forensics and database cross-referencing. | | **Presentation attacks** | Hold a photo, video, or mask in front of the camera during the selfie step. The simplest biometric attack. | Low. Basic liveness detection (blink, turn head) catches most. | | **Deepfakes** | Use AI to generate a realistic face video in real-time during the selfie step. Lip-syncs, blinks, and moves naturally. | High. Requires advanced liveness detection. Deepfake tools are free or under $10/month. | | **Injection attacks** | Bypass the camera entirely. Feed a synthetic video stream directly into the verification API or intercept the camera feed at the OS/driver level. The verification system never sees a real camera - it sees a manufactured video feed. | Very High. Now **more common than presentation attacks** (iProov). Bypasses all basic liveness checks. Only vendors with device integrity and camera source validation catch these. | | **Credential sharing** | A real person willingly passes verification on behalf of a fraudster. The document is real, the face is real, the liveness is real - the intent is fraudulent. | Very High. Technically undetectable at verification time. Requires behavioral analysis and ongoing monitoring. | **The key stat:** Roughly 1 in 20 IDV attempts in financial services is fraudulent (Veriff, 2025). Injection attacks are up 40% year-over-year (Entrust, 2026). Deepfake selfies specifically are up 58% YoY. ### Why This Matters for Choosing Your Approach The split between data-layer and document-layer attacks is why you need both passive and documentary verification - but not on every customer: - **Passive catches** synthetic identities, stolen data, burner phones, and breach-sourced fraud. It handles 70-90% of bad actors with zero customer friction. - **Documentary catches** forged documents, deepfakes, and injection attacks. It's the step-up when passive flags something or the risk level demands higher assurance. - **Neither catches** credential sharing (real person helping a fraudster). That requires behavioral analytics and ongoing monitoring. This is the foundation for the [verification waterfall](#verification-waterfall) approach: start passive, step up to documentary only when needed. ## Passive vs. Documentary: The Core Split Every identity verification method falls into one of two categories. Understanding this split is the single most important thing for choosing the right approach. | | **Passive Verification** | **Documentary Verification** | |---|---|---| | **What happens** | You send customer data (name, SSN, phone, email) to an API. Get back a risk score. | Customer uploads a government ID and takes a selfie. System checks document + face match + liveness. | | **Customer friction** | None - customer doesn't know it's happening | High - up to 60 seconds, significant abandonment | | **Cost per check** | $0.02-0.50 | $0.80-5.00 | | **What it catches** | Synthetic identities, stolen data, burner phones, disposable emails | Forged documents, deepfakes, impersonation | | **What it misses** | Sophisticated synthetic identities with real documents | Nothing, if done well (but friction kills conversion) | | **Best for** | Every new account as a baseline | High-risk accounts, regulatory requirements, step-up from failed passive | **The right answer for most merchants:** Passive on everyone. Documentary only when passive flags something or your risk model demands it. ## Passive Verification Methods ### Database Verification Cross-referencing customer data against authoritative sources. Understanding what's behind the curtain helps you evaluate vendors - some check two or three sources, others check dozens. | Source | What It Verifies | Why It Matters | |--------|-----------------|----------------| | **Credit bureaus** | SSN, name, address history, credit file age | Core identity anchoring. Key for [synthetic identity](/docs/fraud/types/synthetic-identity) detection - synthetic IDs have thin or recently manufactured credit files. | | **Alternative credit headers** | Utility, rent, telecom, insurance records from 180+ regional sources | Catches people the credit bureaus miss - thin-file consumers, recent immigrants, young adults. Fills gaps that synthetics exploit. | | **Government agencies** | SSA (SSN issuance), IRS (TIN matching), DMV, professional licenses, court records | Highest-authority verification. SSA confirms the SSN was actually issued, not just present in a credit file. | | **Deceased databases** | Death Master File (DMF), probate records, obituaries, cemetery records | Synthetic fraudsters frequently build identities around deceased persons' SSNs. Deceased checks catch this. | | **Sanctions/watchlists** | OFAC, PEP, adverse media | AML compliance requirement (see [AML Basics](/docs/compliance/aml-basics)). Not fraud prevention per se, but often bundled with KYC. | | **Educational records** | Enrollment at accredited institutions | Useful for age verification and thin-file identity validation (young consumers often have education records before credit records). | ### Phone and Carrier Verification | Signal | What It Tells You | Fraud Indicator | |---|---|---| | Phone type | Postpaid, prepaid, VoIP | Prepaid/VoIP = higher risk. Prepaid SIMs cost $1-5 and require no identity. | | Network tenure | How long on carrier | Under 90 days = higher risk. Legitimate users average 3+ years on the same carrier. | | Port history | How often ported, days since last port | Frequent porting or recent port = possible [SIM swap](/docs/fraud/types/account-takeover). | | **SIM swap detection** | Has the SIM been swapped in a configurable window (e.g., last 48 hours)? | Critical for protecting OTP-based verification. If the SIM was swapped, the fraudster - not the real customer - receives the code. | | Name match | Does carrier name match provided name? | Mismatch = flag for investigation. | | Line status | Active, suspended, disconnected | Inactive = high risk. Suspended lines may indicate unpaid accounts or fraud holds. | | Area code vs. address | Does phone area code match stated location? | Mismatch isn't always fraud (people move), but adds to risk scoring. | :::warning[SIM Swap Is an Active Threat] SIM swap attacks intercept SMS-based OTP codes by convincing a carrier to transfer a victim's phone number to a new SIM. This breaks any verification flow that relies on "does this person control this phone number?" Real-time SIM swap detection - checking whether the SIM was recently changed - is a critical passive signal, especially if you send OTPs as part of your step-up verification flow. ::: ### Email Risk Scoring | Signal | Low Risk | High Risk | |---|---|---| | Email age | Years old | Created in last 30 days | | Domain | Major provider (Gmail, Outlook) | Disposable domain (tempmail, guerrilla) | | Social presence | Linked to social accounts | No social footprint | | Breach history | Not in breach databases | In multiple breaches (stolen address) | | Deliverability | Active mailbox, receives mail | Undeliverable or inactive | | Pattern | firstname.lastname format | Random/gibberish string (xj3kd9@...) | | Private relay | Not a relay domain | Apple Private Relay, Hide My Email (not fraud per se, but limits correlation) | ### Identity Correlation This is the concept most merchants miss about passive KYC. Vendors don't just check "does this phone number exist?" They check "**does this phone number belong to this person?**" Correlation scoring measures the strength of the relationship between an identity element (email, phone, address) and the person's name. The result is a confidence level: | Confidence | What It Means | |---|---| | Very high (0.95+) | Full name match confirmed by multiple sources | | High (0.85-0.94) | Partial name match (nicknames, fuzzy matches) confirmed | | Medium (0.75-0.84) | Last name match confirmed | | Low (0.65-0.74) | Partial match only, weak correlation | | Unknown (0.20-0.64) | Can't determine relationship | | Disconnected (below 0.20) | No correlation found - identity elements don't belong together | **Why this matters:** a stolen identity can have a valid SSN, a valid phone number and a valid email. The SSN just belongs to one person, the phone to another and the email to a third. Every individual check passes. It's the correlation that doesn't. **Three key correlations to look for in any passive KYC vendor:** - **Name-to-phone** - Is this phone registered to this person? - **Name-to-email** - Is this email associated with this person? - **Name-to-address** - Does this person live (or have lived) at this address? ### Synthetic Fraud Scoring Probabilistic models that answer: is this a real person, or a fabricated identity? These models combine multiple signals - credit header data, phone tenure, email age, address history, SSN issuance patterns, inquiry velocity - into a single synthetic fraud score. A real person has a consistent data trail across all these sources. A [synthetic identity](/docs/fraud/types/synthetic-identity) doesn't. Key signals these models analyze: | Signal Category | What It Looks For | |---|---| | **SSN analysis** | Was the SSN issued to a person of this age? Is it randomized (post-2011)? Does the issue state match the applicant's history? | | **Credit file velocity** | How many unique names, phones, or addresses are tied to this SSN? Multiple different names on one SSN = synthetic. | | **Inquiry patterns** | How many credit applications has this SSN been used for recently? What's the average time between inquiries? Rapid-fire applications = fraud. | | **Name gibberish detection** | Does the name contain nonsensical patterns? Auto-generated names have detectable statistical signatures. | | **Deceased SSN usage** | Is the SSN associated with a deceased person? Fraudsters often build synthetics on deceased individuals' SSNs. | Key vendors: [Socure](#vendor-comparison) (multi-signal), [SentiLink](#vendor-comparison) (specialist). ### Knowledge-Based Authentication (KBA) Questions only the real person should know: | Type | Example | Reliability | |------|---------|-------------| | **Static** | "What was your first car?" | Low (data breaches) | | **Dynamic** | "What was your mortgage payment in 2019?" | Medium | | **Out-of-wallet** | Credit bureau-sourced questions | Medium | :::warning[KBA Is Broken] Data breaches have compromised most KBA questions. Use it as a supplementary signal, never as primary verification. KBA on its own shouldn't pass anyone through. ::: ## Documentary Verification Methods ### Document Verification Verifying government-issued ID documents: | Check | Description | |-------|-------------| | **Authenticity** | Is the document real (not forged)? | | **Validity** | Is it expired? Revoked? | | **Tampering** | Has it been altered? | | **Consistency** | Do fields match each other? | | **Data extraction** | OCR pulls name, DOB, address, ID number | #### Document Types | Type | Trust Level | Notes | |------|-------------|-------| | Passport | High | Standardized, hard to forge, MRZ machine-readable | | Driver's license | Medium | Varies by jurisdiction, some easy to fake | | National ID | Medium | Common outside US, varies widely | | Utility bill | Low | Address proof only, easy to fabricate | ### Biometric Verification Matching faces to documents: ```mermaid flowchart LR A[Document Photo] --> B[Face Extraction] B --> C[Live Selfie] C --> D[Liveness Check] D --> E[Face Match] E --> F[Confidence Score] style A fill:#ef4444,color:#fff style F fill:#10b981,color:#fff ``` | Check | Purpose | |-------|---------| | **Face match** | Does selfie match ID photo? | | **Liveness** | Is this a real person (not photo/video/deepfake)? Look for NIST PAD Level 2 certification (the industry standard for presentation attack detection). | | **Age consistency** | Does apparent age match DOB? | | **Injection detection** | Is the video feed coming from a real camera or being fed in digitally? This is separate from liveness - a deepfake can pass liveness but fail injection detection. | ## Verification Waterfall Order verification methods from least to most friction: ```mermaid flowchart TD S1[Step 1: Passive checksBureau match, device, email/phone] --> R1{Result?} R1 -->|Pass| A1[Approve] R1 -->|Fail/Unclear| S2[Step 2: Low-friction activeOTP, phone verification] S2 --> R2{Result?} R2 -->|Pass| A2[Approve] R2 -->|Fail/Unclear| S3[Step 3: DocumentaryID + selfie + liveness] S3 --> R3{Result?} R3 -->|Pass| A3[Approve] R3 -->|Fail| D[Decline or Manual Review] style S1 fill:#10b981,color:#fff style S2 fill:#f59e0b,color:#fff style S3 fill:#ef4444,color:#fff style A1 fill:#10b981,color:#fff style A2 fill:#10b981,color:#fff style A3 fill:#10b981,color:#fff style D fill:#ef4444,color:#fff ``` :::warning[False Rejections Are a Cost Too] Verification doesn't just reject fraudsters - it also rejects real customers. Thin-file populations (young adults, recent immigrants, people without credit history) often fail passive KYC checks because they don't have enough data in the databases these checks rely on. If your verification flow rejects 5% of real applicants and those applicants are worth $125 each, that's a measurable revenue loss. Build escalation paths (documentary step-up instead of outright decline) so legitimate thin-file customers have a way through. ::: ## Risk-Based Verification ### When to Step Up | Signal | Recommended Action | |--------|-------------------| | New customer, low-risk profile | Passive only | | New customer, medium-risk ([risk score](/docs/fraud/prevention/risk-scoring) 30-60) | OTP + enhanced passive (carrier check) | | New customer, high-risk ([risk score](/docs/fraud/prevention/risk-scoring) 60+) | Documentary verification | | High-value transaction | Step up from baseline | | Account change (address, phone) | Re-verify (may indicate [ATO](/docs/fraud/types/account-takeover)) | | Suspicious [behavior](/docs/fraud/detection/behavioral-analytics) detected | Full documentary verification | ### Segment-Based Requirements | Segment | Minimum Verification | |---------|---------------------| | Low-risk product, returning customer | None | | Low-risk product, new customer | Passive (bureau match + email/phone scoring) | | High-risk product, returning customer | OTP | | High-risk product, new customer | Documentary (ID + selfie + liveness) | ## Vendor Comparison ### Passive Verification Vendors | Vendor | Specialty | Est. Cost/Check | Coverage | Best For | |---|---|---|---|---| | **Socure** | Multi-signal identity + synthetic fraud scoring | $0.10-0.50+ | US-centric | Strongest synthetic ID detection. Used by 4 of top 5 US banks. | | **SentiLink** | Synthetic identity scoring only | $0.02-0.15 | US only | Specialist. Does one thing extremely well. Often layered with other vendors. | | **Prove** | Phone-centric identity (carrier data, SIM tenure) | $0.05-0.25 | Global | Zero-friction verification. Customer enters phone number, done. | | **Ekata** (Mastercard) | Lightweight API - phone, email, address, IP | $0.05-0.30 | Global | Quick integration, good for adding identity signals without a heavy lift. | | **Trulioo** | Global identity verification (KYC + KYB + AML) | $0.50-2.00+ | Global (195+ countries) | Strong international coverage. Good for cross-border merchants. | | **LexisNexis** | Full identity data network (Emailage, ThreatMetrix, ID Analytics) | $3.00-8.00+ | Global | Enterprise. Largest data network, but enterprise pricing to match. | ### Documentary Verification Vendors | Vendor | Est. Cost/Check | Self-Serve? | Best For | Notable | |---|---|---|---|---| | **Stripe Identity** | $1.50/verification (first 50 free) | Yes | Stripe merchants, easiest on-ramp | Built into Stripe dashboard. No new vendor. ID + selfie + liveness. | | **Veriff** | $0.80-1.89 | Yes | SMBs, transparent pricing | Published pricing. Video-based verification option. 230+ countries. | | **Sumsub** | $1.35+ | Yes | All-in-one KYC/KYB/AML | 2025 Gartner Leader. 220+ countries. No-code verification links available. | | **Persona** | $1.50+ (Essential) | Yes | Developers, custom workflows | 2025 Gartner Leader. Strong orchestration. Also does KYB. | | **Jumio** | $1-5+ | No | Global document coverage | 5,000+ document types. 200+ countries. Enterprise-focused. | | **Onfido** (Entrust) | $0.50-4+ | No | Fintech, workflow builder | Acquired by Entrust in April 2024. Strong AI document analysis. | | **Incode** | $1-4+ | No | Latin America, speed | 2025 Gartner Leader. 1.5-second average verification. | | **Mitek** | $1-4+ | No | Enterprise, strong growth | Datos Insights leader (Jan 2026). MiPass 4D biometric. | | **Au10tix** | $1-3+ | No | Speed, consortium detection | 4-8 second automated verification. Detects coordinated attacks across 60+ companies. | | **iDenfy** | $0.50-1.35 | Yes | Mid-market, competitive pricing | 3,000+ doc types. Includes KYB and AML screening. | ### Biometric / Liveness Specialists | Vendor | Est. Cost/Check | What It Does | Notable | |---|---|---|---| | **iProov** | $0.50-2+ | Liveness detection + deepfake prevention only (no document verification) | The strongest injection attack detection we've seen. Used by governments and banks. | | **FaceTec** | SDK licensing | 3D liveness + face matching | On-device processing option for privacy-sensitive use cases. | ### Combined / Hybrid Approaches | Vendor | Type | Est. Cost/Check | Coverage | Best For | |---|---|---|---|---| | **Socure** | Passive + Documentary | $0.10-0.50+ (passive), more for doc | US-centric | Teams wanting one vendor for both passive and documentary | | **Plaid** | Passive + Bank verification | $1-5+ (full flow) | US/Canada | Bank+ID combined. Strongest signal when you already need bank connectivity. [See detailed analysis](/docs/fraud/prevention/kyc-kyb#plaid-bank--identity-combined). | | **Persona** | Documentary + KYB + Orchestration | $1.50+ | Global | Developers who want to build multi-step verification flows | | **Alloy** | Orchestration layer | $1-5+ | US-focused | Combines multiple vendor signals into unified decisioning. Fintech-focused. | ### Plaid: Bank + Identity Combined Plaid's identity verification works differently from pure IDV vendors. When a customer links their bank account, you get ownership verification, account history, and identity data from the bank's records. **Why it's powerful:** Bank data is hard to fake. You can create a synthetic identity with a fabricated SSN and a burner phone, but you can't easily create a fake bank account with years of transaction history. **Why it costs more:** ~$500/month platform baseline + per-check fees ($1-5+ for full Identity + Auth). Plus the customer goes through a bank-linking flow. Best when you already need bank connectivity (ACH payments, balance checks) and you're layering identity on top. ## Cost Comparison | Tier | What You Get | Cost Per Check | Monthly at 1,000 checks | |---|---|---|---| | **Passive only** | Database match, phone/email scoring, synthetic fraud score | $0.02-0.50 | $20-500 | | **Documentary only** | ID scan + selfie + liveness | $0.80-5.00 | $800-5,000 | | **Full KYC bundle** | Passive + documentary step-up + ongoing monitoring | $1.50-8.00 | $1,500-8,000 | | **Bank + ID (Plaid)** | Bank account verification + identity signals | $1.00-5.00 + platform fee | $1,500-5,500 | ### When to Buy What | Your Situation | Recommendation | Budget | |---|---|---| | Under $1M, standard e-commerce | Don't buy dedicated IDV. Processor tools + [3DS](/docs/fraud/prevention/3ds) are enough. | $0 | | Under $1M, on Stripe, need doc verification | **Stripe Identity.** First 50 free, pay-per-use. Already integrated. | $0-100/month | | $1M-$5M, seeing synthetic fraud | Add passive KYC. Start with Prove or Ekata for lightweight checks. | $100-500/month | | $1M-$5M, high first-order fraud | Passive + documentary step-up. Stripe Identity (if on Stripe), Veriff, or Sumsub for self-serve. | $300-2,000/month | | $5M-$20M, multiple fraud types | Full waterfall. Socure or SentiLink for passive + Veriff/Persona/Jumio for documentary. | $1,000-5,000/month | | $20M+, enterprise | Multi-vendor stack. LexisNexis or Socure passive + Jumio/Onfido/Mitek documentary + iProov liveness. | $5,000-20,000+/month | | Fintech, lending, crypto | Full KYC (regulatory requirement). Socure + Persona/Sumsub/Jumio. Consider Plaid if bank-connected. | $2,000-15,000+/month | | Marketplace (seller KYB) | KYB platform. See [KYC & KYB](/docs/fraud/prevention/kyc-kyb#kyb-verifying-businesses) for vendor comparison. | $500-5,000/month | ## Defending Against IDV Fraud For the full threat landscape, see [What Identity Verification Is Up Against](#what-identity-verification-is-up-against) at the top of this page. This section covers countermeasures and vendor evaluation. ### Countermeasures by Attack Type | Attack | Defense | Key Vendors | |--------|---------|-------------| | Synthetic identities | Synthetic fraud scoring, credit bureau cross-ref | [Socure](#passive-verification-vendors), [SentiLink](#passive-verification-vendors) | | Stolen identities | Multi-signal verification (phone tenure + email age + device + address), bank account verification | [Prove](#passive-verification-vendors), [Plaid](#plaid-bank--identity-combined) | | Forged/synthetic documents | Document forensics, template matching, NFC chip reading | [Jumio](#documentary-verification-vendors), [Onfido/Entrust](#documentary-verification-vendors) | | Presentation attacks | Liveness detection (blink, turn head, random prompts) | Most documentary vendors include basic liveness | | Deepfakes | Advanced liveness, multi-angle capture, texture analysis | [iProov](#biometric--liveness-specialists), [Jumio](#documentary-verification-vendors) | | Injection attacks | Device integrity checks, camera source validation, SDK-level protection | [iProov](#biometric--liveness-specialists), [Jumio](#documentary-verification-vendors), [Incode](#documentary-verification-vendors) | | Credential sharing | Behavioral analytics, ongoing monitoring, velocity checks | [BioCatch](/docs/fraud/vendors/landscape#biocatch), [Sardine](/docs/fraud/vendors/landscape#platform-head-to-head) | ### What to Ask Your Documentary Verification Vendor The most important questions, in order of priority: 1. **Do you detect injection attacks, or only presentation attacks?** Injection attacks now outnumber presentation attacks. If your vendor only catches someone holding up a photo, they're missing the bigger threat. 2. **What's your deepfake detection rate on injected video?** Get a number. "We detect deepfakes" is not an answer. 3. **How often do you update your detection models?** AI-generated attacks improve weekly. Monthly or quarterly model updates are not fast enough. 4. **Can you detect if the camera feed is being intercepted or replaced?** That's the injection attack question in different words. Vendors with native SDKs have an advantage over pure API-based verification here. 5. **What's your false rejection rate?** Leading vendors target under 2%. Above 5% means you're rejecting real customers at a rate that costs you money. Ask specifically about thin-file populations (young adults, immigrants) - some vendors have higher false rejection rates for these groups. 6. **Are you NIST PAD Level 2 certified for liveness detection?** NIST's Presentation Attack Detection standard is the industry benchmark. Level 2 means the vendor has been independently tested against spoofing attacks. Not all vendors have this certification. 7. **Do you support NFC chip reading?** Modern passports and some national IDs have NFC chips with cryptographically signed data. Reading the chip is the strongest document authentication available. ## Next Steps **Implementing identity verification?** 1. [Understand passive vs. documentary](#passive-vs-documentary-the-core-split) - Start with the right approach 2. [Design your waterfall](#verification-waterfall) - Least to most friction 3. [Compare vendors](#vendor-comparison) - Match to your volume and risk 4. [Read the KYC/KYB guide](/docs/fraud/prevention/kyc-kyb) - ROI math and program design **Choosing a vendor?** 1. [Check the cost comparison](#cost-comparison) - Budget by tier 2. [Match to your situation](#when-to-buy-what) - Recommendations by volume 3. [Evaluate deepfake defense](#what-to-ask-your-documentary-verification-vendor) - Questions to ask **Defending against IDV fraud?** 1. [Understand the threat landscape](#what-identity-verification-is-up-against) - Data-layer and document-layer attacks 2. [Implement countermeasures](#countermeasures-by-attack-type) - Match defenses to attack types 3. [Ask the right vendor questions](#what-to-ask-your-documentary-verification-vendor) - Injection detection, deepfake rates, NFC --- ## Related Topics - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP, email, phone signals (enrichment, not verification) - [KYC & KYB for Fraud Prevention](/docs/fraud/prevention/kyc-kyb) - When to verify, building a proportional program - [Account Fraud](/docs/fraud/types/application-fraud) - Fake signups and onboarding-stage fraud - [Synthetic Identity](/docs/fraud/types/synthetic-identity) - Fabricated identities - [Third-Party Fraud](/docs/fraud/types/third-party) - Stolen identity usage - [Account Takeover](/docs/fraud/types/account-takeover) - Hijacked accounts - [Evidence Framework](./evidence-framework.md) - Tier 1/Tier 2 indicators - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - When to step up verification - [Device Fingerprinting](./device-fingerprinting.md) - Device-based identity signals - [Behavioral Analytics](./behavioral-analytics.md) - Behavior-based identity signals - [AML Basics](/docs/compliance/aml-basics) - KYC, OFAC, and PEP requirements - [Fraud Vendors](/docs/fraud/vendors/landscape) - IDV vendor options - [Manual Review](/docs/fraud/detection/manual-review) - When IDV triggers review --- ## Manual Review Source: https://paymentsandrisk.com/docs/fraud/detection/manual-review # Manual Review :::info[TL;DR] - **Manual review** = Human investigation for gray-zone cases where automation is uncertain - Good candidates: high-value transactions, VIP customers, ML uncertain, customer appeals - Bad candidates: clear fraud (auto-decline), clear legitimate (auto-approve), low-value - Target metrics: >95% decision accuracy, >90% SLA adherence - Feed decisions back to ML models to improve automation over time ::: Human investigation for complex fraud decisions. ## Manual Review Without a Dedicated Analyst Most SMBs don't have a fraud analyst. If that's you, here's how to handle manual review without one: **The 2-minute rule:** For transactions flagged as high-risk, spend up to 2 minutes investigating. Check: does the shipping address match billing? Is this a repeat customer? Does the order size match your typical AOV? If anything looks off and you can't quickly verify, decline it. **The time budget rule:** If you're spending more than 1 hour/week on manual review, your rules are too loose. Tighten your auto-decline thresholds instead of reviewing more orders. Your time is better spent running your business. **The value threshold rule:** Don't manually review transactions under $100. Either block them automatically or accept the fraud loss. At $100 and a 30% margin, you're risking $30 per fraudulent order. If you spend 5 minutes reviewing, that's $30/hour work - not a good use of an owner's time. :::info[When to Upgrade] When you hit 50+ flagged orders per week, manual review stops being practical. At that point, either tighten your automated rules to reduce the review queue, or invest in a dedicated reviewer or [automated fraud tool](/docs/fraud/vendors/landscape). ::: ## When to Use Manual Review ### Good Candidates for Review | Scenario | Why Manual Review | |----------|-------------------| | **Gray zone scores** | ML uncertain, needs judgment | | **High-value transactions** | Loss too big for automation error | | **VIP customers** | False positive cost too high | | **Complex patterns** | Multiple signals, needs synthesis | | **Appeals** | Customer disputes automated decision | ### Poor Candidates for Review | Scenario | Better Alternative | |----------|-------------------| | **Clear fraud signals** | Auto-decline | | **Clear legitimate signals** | Auto-approve | | **Low-value transactions** | Risk-accept the loss | | **High volume attacks** | Automated rules | ## Review Queue Design ### Prioritization ``` Priority Score = (Transaction Value ร— Risk Score ร— Time Sensitivity) รท Analyst Capacity ``` | Priority | Criteria | SLA | |----------|----------|-----| | **Critical** | >$5K, high risk, time-sensitive | 15 min | | **High** | >$1K, high risk OR VIP | 1 hour | | **Medium** | Medium risk, medium value | 4 hours | | **Low** | Low value, marginal signals | 24 hours | ### Queue Management 1. **Real-time SLA tracking** - Monitor aging 2. **Automatic escalation** - If SLA breached 3. **Capacity planning** - Staff to volume 4. **Skill-based routing** - Complex cases to senior ## The Review Process ### Investigation Steps ``` 1. Review automated decision reason โ†“ 2. Examine transaction/application details โ†“ 3. Check customer history โ†“ 4. Query external data (device, email, phone) โ†“ 5. Look for linked accounts โ†“ 6. Make decision โ†“ 7. Document rationale ``` ### Key Data Points | Category | What to Check | |----------|---------------| | **[Identity](/docs/fraud/detection/identity-verification)** | Name, address, SSN verification | | **[Device](/docs/fraud/detection/device-fingerprinting)** | Fingerprint, reputation, [velocity](/docs/fraud/detection/velocity-rules) | | **[Behavior](/docs/fraud/detection/behavioral-analytics)** | Pattern vs. history | | **Network** | Links to other accounts (see [synthetic identity](/docs/fraud/types/synthetic-identity)) | | **External** | Email age, phone history, bureau | ### Decision Framework | Evidence | Decision | |----------|----------| | Clear fraud ([Tier 1 indicators](/docs/fraud/detection/evidence-framework)) | Decline, flag account | | Strong fraud (multiple [Tier 2](/docs/fraud/detection/evidence-framework)) | Decline, flag account | | Unclear but risky | Challenge ([step-up verification](/docs/fraud/detection/identity-verification)) | | Risky but VIP | Approve with monitoring | | Clear legitimate | Approve, whitelist signals | ## Analyst Tools ### Essential Features - **Single pane of glass** - All data in one view - **Decision shortcuts** - One-click common actions - **Notes/comments** - For handoffs and history - **Timer** - Track review time - **Feedback loop** - Outcome tracking ### Nice-to-Have Features - **Similar case search** - "Show me cases like this" - **Graph visualization** - Network connections - **Communication tools** - Contact customer if needed - **Quality scoring** - Manager review integration ## Quality Assurance ### Review Sampling | Sample Rate | Application | |-------------|-------------| | 100% | New analysts (first 30 days) | | 20% | Standard analyst | | 10% | Senior analyst | | 5% | Expert analyst | ### Quality Metrics | Metric | Target | |--------|--------| | Decision accuracy | >95% | | Documentation completeness | 100% | | SLA adherence | >90% | | False positive rate | Track by analyst | | False negative rate | Track by analyst | ### Feedback Loop 1. **Track outcomes** - Was decision correct? 2. **Feed to models** - Human decisions train ML 3. **Identify patterns** - What do humans catch that ML misses? 4. **Update rules** - Encode learnings ## Scaling Manual Review ### When Volume Exceeds Capacity 1. **Raise review threshold** - Only highest risk 2. **Auto-decide more** - Accept some error 3. **Reduce review scope** - Focus on key signals 4. **Add staff** - If sustainable 5. **Improve models** - Long-term solution ### Efficiency Improvements | Initiative | Impact | |------------|--------| | Better data presentation | 10-20% faster | | Keyboard shortcuts | 5-10% faster | | Pre-computed insights | 15-25% faster | | Decision templates | 10-15% faster | ## Next Steps **Setting up manual review?** 1. [Define queue prioritization](#prioritization) - Critical vs. low priority 2. [Design the review process](#the-review-process) - Step-by-step workflow 3. [Set quality targets](#quality-metrics) - SLA and accuracy goals **Improving review efficiency?** 1. [Check efficiency improvements](#efficiency-improvements) - Quick wins 2. [Build better analyst tools](#essential-features) - Single pane of glass 3. [Implement feedback loop](#feedback-loop) - Train ML from decisions **Scaling beyond capacity?** 1. [Raise review threshold](#when-volume-exceeds-capacity) - Only highest risk 2. [Improve models](#when-volume-exceeds-capacity) - Long-term solution 3. [Consider vendors](/docs/fraud/vendors/landscape) - Outsource review --- ## Related Topics - [Evidence Framework](./evidence-framework.md) - Tier 1/Tier 2 indicators - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Automated scoring - [Data Enrichment](./data-enrichment.md) - Email age, phone history, IP signals for reviewers - [Device Fingerprinting](./device-fingerprinting.md) - Device intelligence - [Behavioral Analytics](./behavioral-analytics.md) - User behavior patterns - [Identity Verification](./identity-verification.md) - Document and biometric checks - [Fraud Metrics](/docs/fraud/metrics) - Measuring performance - [Chargeback Representment](/docs/chargebacks/representment) - Fighting disputes - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern detection - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse cases --- ## Rules vs. ML Source: https://paymentsandrisk.com/docs/fraud/detection/rules-vs-ml # Rules vs. ML :::info[TL;DR] - **Rules**: Fast to deploy, interpretable, great for known patterns and regulatory requirements - **ML**: Better for complex patterns, scale, novel fraud. But needs data science expertise - **Best approach**: Hybrid. Hard rules (blocklists, OFAC) โ†’ ML scoring โ†’ soft rules (thresholds, overrides) - **Start with rules**: Use processor ML (Stripe Radar, Adyen Risk) until you have data science resources - Layer with [velocity rules](./velocity-rules.md), [device fingerprinting](./device-fingerprinting.md), [behavioral analytics](./behavioral-analytics.md) ::: Rules and machine learning both work. Which one fits depends on the [fraud types](/docs/fraud/types) you actually see. ## Overview Both rules and machine learning have their place in fraud detection. The question isn't "which one" but "how to combine them effectively." ## Comparison | Aspect | Rules | Machine Learning | |--------|-------|------------------| | **Interpretability** | High - clear logic | Lower - "black box" | | **Speed to deploy** | Fast - hours/days | Slower - weeks/months | | **Maintenance** | Manual updates | Retraining required | | **Novel fraud** | Misses new patterns | Can detect anomalies | | **Known fraud** | Excellent | Good | | **False positives** | Higher if too strict | Optimizable | | **Expertise needed** | Domain knowledge | Data science + domain | ## When to Use Rules Rules excel when: ### Known Fraud Patterns ``` IF transaction_country != billing_country AND account_age $500 THEN block ``` ### Regulatory Requirements ``` IF customer_on_OFAC_list = true THEN block (no exceptions) ``` See [AML Basics](/docs/compliance/aml-basics) for compliance requirements. ### Business Logic ``` IF order_contains(gift_cards) AND order_total > $1000 AND first_order = true THEN manual_review ``` ### Immediate Response When you discover a new fraud pattern, rules can be deployed in minutes. ## When to Use ML Machine learning excels when: ### Pattern Complexity - Hundreds of features interacting - Non-linear relationships - Patterns too complex for human rule-writing ### Scale - Millions of transactions - Need for real-time scoring - Too many segments for manual rules ### Evolution - Fraud patterns shifting constantly - Need to catch novel approaches - Want to optimize over time ### Probability Needed - Gradated risk scores (not just yes/no) - Threshold tuning required - Different actions at different confidence levels ## The Hybrid Approach Most production systems combine both: ```mermaid flowchart TD TX[Transaction] --> HR{Hard RulesBlacklist, OFAC} HR -->|Block| BLOCK[Blocked] HR -->|Pass| ML[ML Model] ML -->|Score 0-100| SR{Soft RulesThresholds, Overrides} SR -->|Score > 80| BLOCK SR -->|Score 50-80| REVIEW[Manual Review] SR -->|Score max) - Known fraud fingerprints (via [device fingerprinting](/docs/fraud/detection/device-fingerprinting)) ### Layer 2: ML Scoring - Probability of fraud - Contextual risk assessment - Feature-rich evaluation ### Layer 3: Soft Rules (Post-ML) - Threshold application (score > 80 = block) - See [risk scoring](/docs/fraud/prevention/risk-scoring) - Override rules (VIP customers) - [Manual review](/docs/fraud/detection/manual-review) triggers - Business logic gates ## Building Effective Rules ### Rule Anatomy ``` RULE: High-risk first purchase CONDITIONS: - first_order = true - order_value > $300 - shipping_address != billing_address - email_age_days < 30 ACTION: manual_review RATIONALE: New customers with high-value orders to different addresses have 3x fraud rate PERFORMANCE: - Triggers: 2.3% of orders - Fraud rate when triggered: 8.2% - FP rate: 45% ``` ### Rule Hygiene 1. **Document every rule** - Purpose, conditions, rationale 2. **Track performance** - Hit rate, precision, recall 3. **Review quarterly** - Remove underperformers 4. **Sunset old rules** - Don't let rules accumulate 5. **Version control** - Track changes over time ## Building Effective ML ### Feature Engineering Best features typically include: - Velocity (transactions per hour/day/week) - Deviation from normal (customer's own baseline) - Network features (links to other accounts) - Device/IP reputation - Time-based patterns ### Model Considerations | Factor | Recommendation | |--------|----------------| | Algorithm | Gradient boosting (XGBoost, LightGBM) often wins | | Training data | Use confirmed fraud, not just chargebacks | | Refresh frequency | Monthly minimum, weekly ideal | | Feature stability | Monitor for drift | | Explainability | Use SHAP values for investigation | ## Next Steps **Just starting fraud detection?** 1. Start with rules โ†’ Known patterns are easier to block with rules 2. Use your processor's ML โ†’ Stripe Radar, Adyen Risk for baseline scoring 3. Build a review queue โ†’ Some transactions need human eyes **Improving your detection?** 1. Analyze your rule performance โ†’ Which rules catch fraud? Which just add friction? 2. Add velocity rules โ†’ [Velocity Rules guide](./velocity-rules.md) 3. Layer signals โ†’ Rules + ML + device fingerprinting together **Going advanced?** 1. Build custom ML models โ†’ If you have the data science resources 2. Invest in feature engineering โ†’ Better signals beat better algorithms 3. A/B test continuously โ†’ Track precision/recall tradeoffs --- ## Related Topics - [Building Fraud Rules](./building-fraud-rules.md) - Starter rule set, allow/block lists, rule lifecycle - [Fraud Model Feedback](./fraud-model-feedback.md) - How ML learns from your data - [Velocity Rules](./velocity-rules.md) - Detecting abuse patterns - [Behavioral Analytics](./behavioral-analytics.md) - How users interact - [Data Enrichment](./data-enrichment.md) - IP, email, phone signals for rules and ML features - [Device Fingerprinting](./device-fingerprinting.md) - Tracking devices - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining signals - [Manual Review](./manual-review.md) - Human investigation - [Fraud Metrics](/docs/fraud/metrics) - Measuring performance - [Evidence Framework](./evidence-framework.md) - Tier 1/Tier 2 indicators - [3D Secure](/docs/fraud/prevention/3ds) - Authentication layer - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification signals - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Processor-level rules - [Fraud Vendors](/docs/fraud/vendors/landscape) - Vendor ML capabilities - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence playbook - [Experimentation](/docs/reference/experimentation) - Testing rule changes --- ## Limiting How Often Someone Can Try (Velocity Rules) Source: https://paymentsandrisk.com/docs/fraud/detection/velocity-rules # Limiting How Often Someone Can Try (Velocity Rules) :::info[TL;DR] - **Velocity rules** = Thresholds on transaction/action frequency to catch automated fraud - Start with: 3 txns/card/hour, 10/card/day, 5/IP/hour. Then tune from your data - Always backtest: run in shadow mode 2 weeks before blocking - Target: over 30% of flagged transactions are fraud, under 0.5% of traffic blocked - Best for [card testing](/docs/fraud/types/card-testing), [ATO](/docs/fraud/types/account-takeover); complement with [ML](/docs/fraud/detection/rules-vs-ml) at scale ::: A velocity rule is a cap on how many times something can happen in a set stretch of time: one card, one email, one IP address, one hour. Go over the cap and the next attempt gets flagged or blocked. Velocity rules catch the lazy fraud. A single card hitting your [checkout](/docs/payments/checkout-conversion) 47 times in an hour is obvious. The challenge is tuning thresholds that catch fraud without blocking legitimate customers during flash sales. Those threshold recommendations you see everywhere (3 transactions per hour, 10 per day) are someone else's guess. Here's how to find yours using your own [fraud metrics](/docs/fraud/metrics). :::tip[Experiment to Run: Backtest Before You Block] **Hypothesis:** Rule X would have blocked Y% of fraud with Z% false positives. **Method:** 1. Pull last 30 days of transactions 2. Apply proposed rule in shadow mode (flag, don't block) 3. Calculate: - Hit rate (% of traffic that would trigger) - Fraud rate inside hits - Good customer rate inside hits **Decision rule:** Only enforce if more than 30% of flagged transactions were fraud AND fewer than 0.5% of total traffic is blocked. **Run length:** At least 2 weeks or 5,000 transactions, whichever is longer. ::: ## Finding Your Thresholds Start here, then adjust based on your data: | Dimension | Starting Threshold | Tune By | |-----------|-------------------|---------| | Transactions per card per hour | 3 | Your flash sale patterns | | Transactions per card per day | 10 | Your repeat customer behavior | | Transactions per IP per hour | 5 | Your corporate/VPN traffic | | Transactions per [device](/docs/fraud/detection/device-fingerprinting) per day | 15 | Your multi-account legitimate use | | Failed [auths](/docs/payments/auth-and-capture) per card in 10 min | 3 | Your retry patterns (see [decline codes](/docs/reference/decline-codes)) | :::info[Scale Matters] **Under $100K/month:** Turn on your [processor's](/docs/operations/processor-management) default velocity rules and stop. You don't have enough data to tune anything meaningful. When you see a pattern, come back. **$100K-$1M/month:** You can start experimenting. Run 1-2 custom rules in shadow mode. [Manual review](/docs/fraud/detection/manual-review) anything over $300 that gets flagged. **Over $1M/month:** Manual review is now a bottleneck. You need automated reject thresholds for the bottom 10% of [trust scores](/docs/fraud/prevention/risk-scoring). Custom velocity rules become worth the effort. **Over $10M/month:** You have enough data to train [ML models](/docs/fraud/detection/rules-vs-ml). Velocity rules become backstops for ML misses, not your primary defense. ::: ## How to Actually Test a Rule ### Week 1: Shadow Mode Deploy the rule but only flag, don't block. ``` RULE: card_velocity_hourly DIMENSION: card_number WINDOW: 1 hour THRESHOLD: 3 transactions ACTION: flag_for_review (NOT block) ``` ### Week 2: Analyze Flags For every flagged transaction: - Was it fraud? (Check chargebacks 30-60 days later) - Was it a good customer? (Check if they're still active) - Was it a false positive? (Legitimate customer blocked) ### Week 3: Decision If the rule would have blocked: - More than 30% fraud: Consider enforcing - 10-30% fraud: Tighten the threshold or add conditions - Less than 10% fraud: Kill the rule, it's not worth it ### Week 4+: Enforce and Monitor ``` RULE: card_velocity_hourly DIMENSION: card_number WINDOW: 1 hour THRESHOLD: 3 transactions ACTION: block EXCEPTION: customer_tenure > 12_months ``` Watch your false positive rate for the first two weeks. If you're blocking more than 0.5% of transactions, your thresholds are probably too aggressive. ## Velocity by Fraud Type ### [Card Testing](/docs/fraud/types/card-testing) High transaction count, low amounts, sequential card numbers, concentrated IP/[device](/docs/fraud/detection/device-fingerprinting). ``` IF transactions_per_IP_1hr > 10 AND average_amount 50% THEN block_IP ``` **Backtest first:** Pull last 30 days, apply this rule, check false positives. See [fraud metrics](/docs/fraud/metrics) for measurement guidance. ### [Account Takeover](/docs/fraud/types/account-takeover) Login velocity spike, profile change velocity, transaction pattern change. Use with [behavioral analytics](/docs/fraud/detection/behavioral-analytics) for best results. ``` IF failed_logins_1hr > 3 AND new_device = true AND password_changed_24hr = true THEN lock_account + step_up_auth ``` ### [Bust-Out / Fraud Rings](/docs/fraud/types/bust-out) Merchants can detect fraud ring patterns through coordinated velocity spikes across accounts. ``` IF utilization_change_7d > 40% AND current_utilization > 85% AND cash_advance_7d > $500 THEN flag_for_review ``` ## Velocity Windows | Window | Use Case | Watch Out For | |--------|----------|---------------| | Real-time (seconds) | [Card testing](/docs/fraud/types/card-testing), bot attacks | High infrastructure cost | | Hourly | Transaction anomalies | Flash sales, legitimate bursts | | Daily | Spending patterns | Time zone issues | | Weekly | [Application fraud](/docs/fraud/types/application-fraud) | Low sample size | | Monthly | [Bust-out](/docs/fraud/types/bust-out) patterns | Slow feedback loop | ## Advanced Rule Structure Start simple. Add complexity only when simple doesn't work. **Simple (start here):** ``` IF transactions_per_card_1hr > 3 THEN block ``` **Add exceptions for good customers:** ``` IF transactions_per_card_1hr > 3 AND customer_tenure 3 AND customer_tenure $500 THEN manual_review ``` ## Metrics to Watch While You Experiment | Metric | What It Tells You | Red Flag | |--------|-------------------|----------| | Block rate | % of traffic blocked by this rule | Over 1% is probably too aggressive | | Block-to-fraud ratio | % of blocked transactions that were actual fraud | Under 30% means too many false positives | | Appeal/complaint rate | Customers contacting support about blocks | Rising = rule is too tight | | Fraud rate on passed transactions | Is fraud sneaking through elsewhere? | Rising = rule isn't catching what matters | :::warning[Where Experiments Lie to You] - **Small samples:** 3 days on 2K transactions isn't enough. Fraud is rare, so you need large samples to measure fraud rate changes. - **Seasonality:** Fraud patterns shift. A rule that works in December may fail in March. Re-test quarterly. - **Risk shifting:** Blocking one channel pushes fraud to another. Measure total losses, not just the channel you changed. - **Correlation โ‰  causation:** Just because fraudsters do X doesn't mean everyone who does X is a fraudster. - **Fraudster adaptation:** If you tighten velocity rules, sophisticated fraudsters will slow down. Your rule may "work" but total fraud doesn't drop. ::: ## If a Single Rule is Dominating If one rule is blocking more than 1% of traffic or driving more than 20% of all blocks, review it: 1. Is the threshold too tight? 2. Is there a legitimate use case you're catching? 3. Can you add exceptions for good customers? 4. Should you split it into multiple rules? ## Implementation Tips ### Counter Management 1. **Atomic updates:** Increment counters transactionally 2. **TTL-based expiry:** Auto-expire old counts (Redis, DynamoDB) 3. **Distributed counting:** Handle scale appropriately 4. **Pre-computation:** For complex aggregations ### Evasion Resistance Fraudsters adapt. Counter with: - Multiple overlapping rules (can't evade all at once) - Combined conditions (not just single thresholds) - Behavioral baselines (anomaly from normal, not absolute) - Network-level rules (device graphs, address clusters) ## The Iteration Loop Velocity rules are never "done." Run this loop monthly: 1. **Review performance:** Which rules are firing? What's their false positive rate? 2. **Check escapes:** What fraud got through that a rule could have caught? 3. **Adjust thresholds:** Tighten where false positives are low, loosen where they're high 4. **Retire stale rules:** If a rule hasn't fired in 60 days, consider removing it ## Where This Breaks :::danger[Edge Cases That Will Burn You] **Flash sales and drops:** Your velocity rule says "3 transactions per card per hour." Your marketing just announced a limited sneaker drop. Your best customers are trying to buy fast. You block them. They tweet about it. Rule of thumb: have a flash sale exception flag that relaxes velocity rules for 2 hours around announced promotions. **Corporate cards:** A company card might legitimately hit your site 20 times in a day. Different employees, same card. If you sell [B2B](/docs/payments/reference/b2b-commercial) or have corporate accounts, your velocity thresholds need to be 3-5x higher for commercial BINs. **Gift giving season:** November-December, legitimate customers buy multiple items to multiple addresses. Your "1 shipping address per card" rule becomes a false positive machine. **VPN and shared IP traffic:** College dorms, corporate offices, and VPN exit nodes concentrate thousands of users behind one IP. IP-based velocity rules will block your entire customer segment. **Mobile carrier NAT:** Cellular carriers route many users through the same IP. Your IP velocity rule is blocking everyone on AT&T in that cell tower's range. **Test before you block.** Run every rule in shadow mode for 2 weeks minimum. If you skip this step, you'll learn about false positives from angry customer emails instead of from your dashboard. ::: ## Next Steps **Just starting with velocity rules?** 1. [Enable processor defaults](#finding-your-thresholds) - Start with built-in rules 2. [Run in shadow mode](#how-to-actually-test-a-rule) - Test before blocking 3. [Set up measurement](/docs/fraud/metrics) - Track false positives **Tuning existing rules?** 1. [Backtest changes](#week-1-shadow-mode) - 2 weeks minimum 2. [Add customer exceptions](#advanced-rule-structure) - Protect good customers 3. [Review by fraud type](#velocity-by-fraud-type) - Match rules to attacks **Experiencing fraud despite rules?** 1. [Check for edge cases](#where-this-breaks) - Flash sales, VPNs, corporate cards 2. [Consider ML augmentation](/docs/fraud/detection/rules-vs-ml) - Rules + ML together 3. [Follow attack playbook](/docs/playbooks/survive-fraud-attack) - Emergency response --- ## Related - [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Starter rule set, allow/block lists, full rule lifecycle - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - When to use each approach - [Card Testing](/docs/fraud/types/card-testing) - The fraud type velocity rules catch best - [Account Takeover](/docs/fraud/types/account-takeover) - Login velocity detection - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device-based velocity dimensions - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining velocity with other signals - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Setting up rules in your processor - [Fraud Metrics](/docs/fraud/metrics) - Measuring detection effectiveness - [Manual Review](/docs/fraud/detection/manual-review) - Review queue management - [Behavioral Analytics](/docs/fraud/detection/behavioral-analytics) - Session-based detection - [Decline Codes](/docs/reference/decline-codes) - Understanding auth failures - [Fraud Prevention](/docs/fraud/prevention) - Prevention strategy overview - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence playbook - [Experimentation](/docs/reference/experimentation) - A/B testing rules --- ## Economics of Fraud Source: https://paymentsandrisk.com/docs/fraud/fundamentals/economics # Economics of Fraud :::info[TL;DR] - **Total fraud cost** = Direct loss + chargeback fees + review labor + tool costs + program fees - **False positive cost often exceeds fraud loss.** Blocked legitimate transactions = lost revenue + lost customers - Goal: minimize *net fraud cost* (fraud loss + false positive loss + prevention cost), not just fraud rate - A balanced approach typically outperforms both aggressive and permissive strategies - See [Risk Appetite](./risk-appetite.md) for tolerance framework ::: Every dollar of fraud costs merchants $2-4 when you include chargeback fees, review labor, tool costs, and program penalties. False positive cost often exceeds the fraud loss itself: blocking 700 legitimate $100 orders at 40% margin destroys $28,000 in value. This page covers the full cost breakdown, the false positive problem, and how to minimize net fraud cost rather than just fraud rate. ```mermaid %%{init: {'themeVariables': {'pieStrokeColor': '#ef4444', 'pieOuterStrokeColor': '#ef4444', 'pieSectionTextColor': '#fff', 'pie1': '#ef4444', 'pie2': '#f59e0b', 'pie3': '#3b82f6', 'pie4': '#8b5cf6', 'pie5': '#6b7280'}}}%% pie title True Cost of a $100 Chargeback "Transaction Amount" : 100 "Product/COGS" : 50 "Chargeback Fee" : 25 "Labor (review + response)" : 20 "Payment Fees Lost" : 5 ``` ## Quick SMB Math Before reading the detailed breakdown below, here's the question most SMBs should ask first: is my fraud loss big enough to justify spending money on it? **Simple formula:** Monthly fraud loss = Monthly volume x fraud rate x average order value If your average order is $100 and fraud rate is 0.3%, you're losing roughly $300/month on $100K volume. Before buying a $500/month fraud tool, ask: can I absorb the fraud and focus on free prevention instead? | Monthly Fraud Loss | What to Do | |-------------------|------------| | **Under $500/month** | Absorb it. Focus on free fixes - [billing descriptors](/docs/chargebacks/prevention/descriptors-and-comms), [3DS](/docs/fraud/prevention/3ds) on high-risk orders | | **$500-$2,000/month** | Free fixes first. Tune your processor's built-in rules, add [chargeback alerts](/docs/chargebacks/prevention/alerts) | | **$2,000-$5,000/month** | Consider paid tools. A $500/month fraud platform or [guarantee](/docs/fraud/prevention/chargeback-guarantees) may pay for itself | | **Over $5,000/month** | Definitely buy tools. At this level, even a 50% reduction pays for most fraud platforms | :::tip[Program Fees Are Irrelevant to Most SMBs] The $10-25K/month program fees mentioned in the detailed breakdown only apply when you're flagged by Visa or Mastercard monitoring programs - typically at $5M+ volume. If you're under $1M/month, those numbers don't apply to you. Focus on the direct fraud loss math above. ::: ## The Full Cost of Fraud Fraud cost extends far beyond the direct dollar loss: ``` Total Fraud Cost = Direct Loss + Operational Cost + Chargeback Fees + Recovery Cost ``` ### Direct Loss Components | Component | Description | Typical % | |-----------|-------------|-----------| | **Transaction Amount** | The fraudulent purchase value | 100% | | **Product/Service Cost** | Your COGS on the fraud | 30-70% | | **Shipping** | Fulfillment cost (if applicable) | 5-15% | | **Payment Fees** | Interchange, processor fees | 2-3% | ### Indirect Costs | Component | Description | Typical Cost | |-----------|-------------|--------------| | **Chargeback Fee** | Per-dispute processor fee | $0-30, [verified table](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated) | | **Review Labor** | Manual investigation time | $5-20/case | | **Tool/Vendor Cost** | Fraud prevention stack | 0.1-0.5% of volume | | **Program Fees** | Network monitoring programs | $10-25K/month | ## The False Positive Problem :::warning[Hidden Cost] **False positive cost often exceeds fraud loss cost.** ::: ### Calculating False Positive Cost ``` FP Cost = Blocked Good Transactions ร— Average Order Value ร— Gross Margin ``` **Example:** - 1,000 transactions blocked - 70% were actually legitimate (700 false positives) - $100 average order value - 40% gross margin - **FP Cost = 700 ร— $100 ร— 40% = $28,000** ### The Trade-off | Approach | Fraud Loss | False Positive Loss | Total Loss | |----------|------------|---------------------|------------| | Very Aggressive | $5,000 | $50,000 | $55,000 | | Balanced | $15,000 | $15,000 | $30,000 | | Very Permissive | $40,000 | $2,000 | $42,000 | ## Optimizing the Trade-off ### Key Levers 1. **Improve model precision** - Better targeting reduces both fraud and FPs 2. **Segment your rules** - Different risk tolerance by customer segment 3. **Use friction wisely** - Step-up auth instead of hard blocks 4. **Invest in review** - Manual review for gray zone, not auto-decline ### Measuring Success Track **Net Fraud Cost**: ``` Net Fraud Cost = Fraud Loss + False Positive Loss + Prevention Cost ``` Goal: Minimize net fraud cost, not just fraud rate. ## Next Steps **Calculating your fraud costs?** 1. [Add up full costs](#the-full-cost-of-fraud) - Include indirect costs 2. [Calculate false positive cost](#the-false-positive-problem) - Often the bigger problem 3. [Find your trade-off sweet spot](#the-trade-off) - Balance both sides **Optimizing the trade-off?** 1. [Define risk appetite](./risk-appetite.md) - Set clear targets 2. [Improve model precision](#key-levers) - Better targeting 3. [Use step-up auth](/docs/fraud/prevention/3ds) - Friction where needed **Measuring success?** 1. [Track net fraud cost](#measuring-success) - Not just fraud rate 2. [Review fraud metrics](/docs/fraud/metrics) - Full picture 3. [Compare to benchmarks](/docs/reference/benchmarks) - Industry standards --- ## Related Topics - [Risk Appetite](./risk-appetite.md) - Setting tolerance levels - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches - [Fraud Metrics](/docs/fraud/metrics) - Measuring fraud rates - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining signals - [Manual Review](/docs/fraud/detection/manual-review) - Review labor costs - [3D Secure](/docs/fraud/prevention/3ds) - Authentication trade-offs - [Chargeback Metrics](/docs/chargebacks/metrics) - Dispute costs - [Network Programs](/docs/chargebacks/reference/network-programs) - Program fee impact - [Fraud Vendors](/docs/fraud/vendors/landscape) - Tool costs - [Auth Optimization](/docs/payments/auth-optimization) - False positive impact - [Checkout Conversion](/docs/payments/checkout-conversion) - Friction impact - [Benchmarks](/docs/reference/benchmarks) - Industry comparisons --- ## Risk Appetite Source: https://paymentsandrisk.com/docs/fraud/fundamentals/risk-appetite # Risk Appetite :::info[TL;DR] - **Risk appetite** = The [fraud](/docs/fraud) loss level you accept to achieve business goals ([conversion](/docs/payments/checkout-conversion), growth, UX) - No "zero fraud" without "zero revenue." Every fraud decision is a trade-off - Conservative: under 10 bps [fraud rate](/docs/fraud/metrics), under 30% false positives. Aggressive: 30-50 bps, 50-70% FPs - Segment by customer type (new vs. returning) and transaction type (digital vs. physical) - See [Economics of Fraud](./economics.md) for cost calculations ::: Risk appetite is the [fraud](/docs/fraud) loss you take on purpose, to keep revenue, conversion, and customer experience. Every fraud decision is a trade. Conservative (under 10 bps fraud rate) blocks more good customers. Aggressive (30-50 bps) lets more fraud through and maximizes sales. Neither one is wrong, but not picking is. ## SMB Risk Appetite in Plain English Here's what that looks like if you're a smaller merchant: | Approach | What It Means | False Positive Rate | Best For | |----------|--------------|---------------------|----------| | **Conservative** | "I'll decline the occasional good customer to block fraud" | 0.5-1% of good orders declined | Under $500K/month. The cost of a false positive (one $100 order) is lower than the cost of sophisticated fraud tools. | | **Balanced** | "I want to block obvious fraud without annoying customers" | 1-3% of good orders declined | $500K-$5M/month. You have enough volume that false positives start to matter, but fraud losses also add up. | | **Aggressive** | "I'd rather lose a few dollars to fraud than lose a good customer" | Under 0.5% of good orders declined | When your fraud rate is already low and customer retention is your priority. Requires confidence in your detection tools. | :::tip[For Most SMBs] If you're under $500K/month, "conservative" is almost always correct. The math is simple: a blocked $100 order costs you $30 in margin. A fraud tool that reduces false positives by 1% saves you maybe $150/month. That's not worth $500+/month in tool costs. Start conservative, and only loosen your thresholds when false positive complaints become a real business problem. ::: ## What is Risk Appetite? It's the [fraud loss](/docs/fraud/metrics) you'll accept to hit business goals. That means [conversion](/docs/payments/checkout-conversion), growth, and customer experience. :::tip[Key Insight] There's no "zero fraud" without "zero revenue." Every fraud decision is a trade-off. ::: ## Defining Your Risk Appetite ### Quantitative Targets | Metric | Conservative | Moderate | Aggressive | |--------|--------------|----------|------------| | Fraud Rate (bps) | Under 10 | 10-30 | 30-50 | | False Positive Rate | Under 30% | 30-50% | 50-70% | | Manual Review Rate | 5-10% | 2-5% | Under 2% | | Block Rate | 3-5% | 1-3% | Under 1% | Pick a column and write the numbers down. If you can't name the target, you don't have one. ### Qualitative Factors Consider your: - **Industry** - [High-risk MCCs](/docs/reference/mcc-codes) have different norms - **Margin structure** - High-margin can absorb more [fraud](/docs/fraud) - **Customer base** - New vs. established customers - **Regulatory environment** - [Compliance requirements](/docs/compliance) - **Competitive landscape** - Friction vs. competitors (see [checkout conversion](/docs/payments/checkout-conversion)) ## Segmented Risk Appetite One number for every customer is the lazy answer. Split it: ### By Customer Type | Segment | Risk Appetite | Rationale | |---------|---------------|-----------| | Returning customers | Higher | Trust earned, lower fraud rate | | New customers | Lower | Unproven, higher fraud rate | | High-value customers | Higher | Worth the risk for LTV | | First transaction | Lowest | Highest fraud concentration | ### By Transaction Type | Type | Risk Appetite | Rationale | |------|---------------|-----------| | Small purchases | Higher | Limited loss exposure | | Large purchases | Lower | Significant single-transaction risk - use [3DS](/docs/fraud/prevention/3ds) | | Digital goods | Lower | Instant delivery, no recovery - see [third-party fraud](/docs/fraud/types/third-party) | | Physical goods | Moderate | Delivery delay allows intervention | ## Operationalizing Risk Appetite ### Translate to [Rules](/docs/fraud/detection/velocity-rules) ``` IF customer_tenure > 12_months AND prior_orders > 5: threshold = "permissive" ELIF new_customer AND order_value > $500: threshold = "strict" ELSE: threshold = "standard" ``` See [processor rules configuration](/docs/fraud/processor-rules-configuration) for implementation. ### Regular Calibration - **Monthly:** Review [fraud rate](/docs/fraud/metrics) vs. target - **Quarterly:** Adjust [thresholds](/docs/fraud/processor-rules-configuration) based on performance - **Annually:** Strategic review of risk appetite ## Next Steps **Defining your risk appetite?** 1. [Set quantitative targets](#quantitative-targets) - Pick your thresholds 2. [Segment by customer type](#segmented-risk-appetite) - Different rules for different segments 3. [Understand the economics](./economics.md) - Know the cost trade-offs **Operationalizing risk appetite?** 1. [Configure processor rules](/docs/fraud/processor-rules-configuration) - Translate to rules 2. [Set up risk scoring](/docs/fraud/prevention/risk-scoring) - Combine signals 3. [Build velocity rules](/docs/fraud/detection/velocity-rules) - Implement limits **Optimizing existing approach?** 1. [Review fraud metrics](/docs/fraud/metrics) - Know your current rates 2. [Check network thresholds](/docs/chargebacks/reference/network-programs) - Stay below limits 3. [Balance with conversion](/docs/payments/checkout-conversion) - Monitor friction --- ## Related Topics - [Economics of Fraud](./economics.md) - Cost calculations - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches - [Fraud Prevention](/docs/fraud/prevention) - Prevention strategies - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining signals - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rule-based detection - [3D Secure](/docs/fraud/prevention/3ds) - Authentication trade-offs - [Manual Review](/docs/fraud/detection/manual-review) - Review costs - [Fraud Metrics](/docs/fraud/metrics) - Measuring performance - [Chargeback Metrics](/docs/chargebacks/metrics) - Dispute costs - [Checkout Conversion](/docs/payments/checkout-conversion) - Friction impact - [Auth Optimization](/docs/payments/auth-optimization) - Approval rate impact - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold consequences --- ## SMB Fraud Checklist Source: https://paymentsandrisk.com/docs/fraud/fundamentals/smb-fraud-checklist # SMB Fraud Checklist :::info[TL;DR] - Most SMBs don't have a fraud problem - they have a **descriptor problem**, a **refund policy problem**, or a **friendly fraud problem** - Fix operations first. Tools come later - Free fixes prevent more chargebacks than most paid tools for businesses under $500K/month - Match your fraud investment to your revenue tier - don't overbuy ::: Every other fraud page assumes you'll read 10 pages, learn the theory, and figure out what to do. This one doesn't. This is the "just tell me what to do" page for SMBs processing under $1M/month. Follow the checklist in order. Stop when your numbers are healthy. ## Do You Actually Have a Fraud Problem? Before spending anything on fraud prevention, figure out what's actually happening. Pull your last 20 chargebacks and sort them into four buckets: | Category | What It Looks Like | Example | |----------|-------------------|---------| | **True fraud** | Stolen card, cardholder never ordered | "I never made this purchase" from a new customer shipping to a different state | | **Friendly fraud** | Customer lying or confused | Customer received product but claims they didn't | | **Billing confusion** | Didn't recognize the charge | "What is STRP*XYZCO on my statement?" | | **Service issues** | Product problem, never arrived | "Item was broken" or "never delivered" | **Here's the key insight:** If more than 50% of your chargebacks are NOT true fraud, a fraud tool won't help. You have an operations problem, not a fraud problem. - Billing confusion? [Fix your descriptor](/docs/chargebacks/prevention/descriptors-and-comms). - Service issues? Fix your product or fulfillment. - Friendly fraud? [Tighten your evidence trail](/docs/fraud/types/friendly-fraud). - True fraud? Keep reading. ## The Free Fixes (Do These First) These cost nothing and take less than a day. Do all of them regardless of your fraud situation. ### 1. Fix Your Billing Descriptor (10 minutes) Your billing descriptor is what shows up on your customer's bank statement. If it says "SQ*RANDOM123" instead of your brand name, customers dispute charges they actually made. **Impact:** Prevents 15-25% of "unrecognized charge" disputes. **How:** Go to your processor's dashboard and change your statement descriptor to your customer-facing brand name. Include your website or phone number if space allows. See [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) for step-by-step instructions. ### 2. Require CVV on All Transactions (5 minutes) CVV (the 3-digit code on the back of the card) is already enabled on most processors. Verify it's required and that you're declining transactions without a CVV match. **Impact:** Blocks the lowest-effort stolen card fraud. **How:** Check your processor settings. Stripe, Square, and most modern processors require CVV by default. ### 3. Make Refunds Easier to Find (30 minutes) Customers dispute charges when they can't figure out how to get a refund. If your refund process requires three emails and a carrier pigeon, they'll call their bank instead. **Impact:** Prevents customers from escalating billing questions to disputes. **How:** Add a "billing question?" or "need a refund?" link to your receipt emails, website footer, and checkout page. Make the path obvious. See [Refund Policy](/docs/chargebacks/refund-policy) for guidance on balancing accessibility with abuse risk. ### 4. Send Confirmation and Shipping Emails (1 hour) Order confirmation and shipping notification emails serve as proof of purchase and delivery. They also remind customers what they ordered and what the charge will look like. **Impact:** Creates evidence trail for representment and reduces "I didn't order this" disputes. **How:** Enable order confirmation and shipping notification emails through your e-commerce platform or payment processor. Include the billing descriptor in the confirmation so customers know what to expect on their statement. ### 5. Make Subscription Cancellation Easy (30 minutes) If customers can't cancel, they dispute. A cancellation costs you revenue. A dispute costs you revenue plus a fee plus ratio damage. **Impact:** Prevents 10-15% of subscription-related disputes. **How:** Add a visible "cancel subscription" option in your account portal. Send renewal reminders 7-14 days before charging. ## By Revenue Tier Once the free fixes are done, your next steps depend on your volume. ### Under $50K/month **Do:** The free fixes above. That's it. **Don't buy:** Fraud tools, scoring services, or alert subscriptions. At this volume, the tool cost likely exceeds your fraud losses. Your time is better spent on operations. ### $50K - $250K/month **Add:** - [3D Secure](/docs/fraud/prevention/3ds) on orders over $200 from new customers (shifts fraud liability to the issuer) - [RDR/Ethoca alerts](/docs/chargebacks/prevention/alerts) if your chargeback ratio exceeds 0.5% **Don't buy:** Full fraud scoring platforms. The ROI doesn't work yet. ### $250K - $500K/month **Add:** - Tune your processor's built-in fraud rules (velocity limits, address mismatch blocking) - [Ethoca and/or RDR alerts](/docs/chargebacks/prevention/alerts) if not already active - Monthly review of chargebacks by reason code to spot patterns **Start tracking:** Fraud rate by channel, product category, and customer type. ### $500K - $1M/month **Add:** - Evaluate dedicated fraud tools (a paid Stripe Radar tier, Signifyd, Kount - now part of Equifax) - see [Vendor Selection Guide](/docs/fraud/vendors/selection-guide) - Manual review for orders exceeding 2x your average order value - Weekly fraud review meeting (15 minutes, pull the numbers) **Start tracking:** False positive rate, review queue volume, fraud-to-sales ratio by segment. ### Over $1M/month You need a dedicated fraud person or a managed fraud vendor. The checklist approach no longer scales. See the [Vendor Selection Guide](/docs/fraud/vendors/selection-guide) for evaluating platforms, and [Economics of Fraud](/docs/fraud/fundamentals/economics) for building a business case. ## The Math That Matters Before buying any fraud tool, run this calculation: ``` Monthly tool cost = Per-transaction price x Monthly transaction count Example: Fraud tool at $0.07/txn x 10,000 txns/month = $700/month Compare against: Actual monthly fraud losses = $____ ``` **If the tool costs more than your losses, don't buy it.** This sounds obvious, but vendors sell on fear. They'll show you industry averages and worst-case scenarios. What matters is YOUR numbers. Pull your actual fraud losses for the last 6 months, average them, and compare. Also factor in false positives. A fraud tool that blocks 2% of legitimate orders at $100 AOV and 40% margin costs you more in lost revenue than most SMBs lose to fraud. See [Economics of Fraud](/docs/fraud/fundamentals/economics) for the full calculation. ## What NOT to Do **Don't buy fraud tools before $500K/month.** At lower volumes, free fixes and processor-native rules handle the vast majority of cases. You're paying for peace of mind, not measurable prevention. **Don't block international orders.** Most international orders are legitimate. Blanking out entire countries because of a few bad transactions costs you far more in lost revenue than the fraud. Use 3DS for international orders instead - it shifts liability without blocking the sale. **Don't ignore chargebacks.** Chargebacks compound. Network monitoring programs (VAMP, ECM) have thresholds. If you cross them, you face penalties, fines, and potential termination. Even a handful of unaddressed chargebacks per month can push a low-volume merchant over the threshold. **Don't assume all fraud is stolen cards.** For most SMBs, [friendly fraud](/docs/fraud/types/friendly-fraud) (customers who received their order but dispute anyway) exceeds true fraud. A fraud scoring tool won't catch a real customer lying to their bank. Better evidence and clear policies will. ## Next Steps **Your chargebacks are mostly billing confusion or service issues?** 1. [Fix your descriptor](/docs/chargebacks/prevention/descriptors-and-comms) - 10 minutes, biggest impact 2. [Review your refund policy](/docs/chargebacks/refund-policy) - Make it easier to refund than dispute 3. [Read the SMB Prevention Priorities](/docs/chargebacks/prevention/smb-prevention-priorities) - Ranked action list **You have a real fraud problem (stolen cards, account takeover)?** 1. [Enable 3D Secure](/docs/fraud/prevention/3ds) - Liability shift on risky orders 2. [Understand fraud economics](/docs/fraud/fundamentals/economics) - Build the business case 3. [Evaluate vendors](/docs/fraud/vendors/selection-guide) - When you're ready for tools **Your chargeback ratio is climbing fast?** 1. [Set up alerts](/docs/chargebacks/prevention/alerts) - Stop chargebacks from filing 2. [SMB Prevention Priorities](/docs/chargebacks/prevention/smb-prevention-priorities) - Do things in the right order 3. [Understand friendly fraud](/docs/fraud/types/friendly-fraud) - It's probably not what you think --- ## Related Pages - [Economics of Fraud](/docs/fraud/fundamentals/economics) - Full cost breakdown and ROI math - [Fraud Prevention Overview](/docs/fraud/prevention) - Prevention tools and techniques - [Vendor Selection Guide](/docs/fraud/vendors/selection-guide) - Evaluating fraud platforms - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Fix your billing descriptor - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, and CDRN - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and liability shift - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes - [Refund Policy](/docs/chargebacks/refund-policy) - When to refund vs. fight - [SMB Prevention Priorities](/docs/chargebacks/prevention/smb-prevention-priorities) - Ranked chargeback prevention actions --- ## Why Issuers Decline and Dispute: A Merchant's Guide Source: https://paymentsandrisk.com/docs/fraud/issuer-perspective # Why Issuers Decline and Dispute :::info[TL;DR] - Issuers see **almost nothing** about your transaction, just amount, MCC, and billing address - They decline based on cardholder history, not your fraud signals - **Reg E/Z forces issuers** to side with cardholders unless you provide compelling evidence - Issuers **want to approve** legitimate transactions but need help identifying them - Understanding issuer constraints helps you **improve auth rates and win more disputes** ::: :::info[Scope] This page covers why issuers decline transactions (the authorization decision). For how issuers handle disputes after the fact, see [Issuer Side of Chargebacks](/docs/chargebacks/issuer-side). For the technical deep dive on authorization logic, see [Authorization Decisioning](/docs/fraud/detection/authorization-decisioning). ::: The issuer's role in payments fraud is to approve or decline transactions using almost no data about your business, just amount, MCC, and billing address. Regulations (Reg E and Reg Z) force issuers to side with cardholders unless you provide compelling evidence, which means your evidence collection directly determines dispute outcomes. This page covers what issuers see, why they decline legitimate transactions, and how to work with their constraints to improve auth rates and win more disputes. --- ## What Issuers See (Almost Nothing) When you authorize a transaction, you might have 50+ data points: device fingerprint, session behavior, address history, account age, velocity patterns. The issuer sees almost none of that. **What the issuer receives in an auth request:** | Data Point | What They See | |------------|---------------| | Transaction amount | $127.50 | | Merchant name | "ACME STORE" | | MCC | 5411 (Grocery) | | Billing address | 123 Main St (if you send AVS) | | CVV match | Yes/No | | Cardholder name | John Smith | **What the issuer does NOT see:** - Your fraud score - Device fingerprint or IP address - Session behavior (time on site, pages viewed) - Shipping address - Product category or cart contents - Customer account history with you - Whether this is a repeat customer The issuer is making a decision with almost no context about your specific transaction. They're guessing based on patterns. --- ## Why Issuers Decline Legitimate Transactions Issuers decline for reasons that have nothing to do with your fraud controls: | Decline Reason | What's Happening | Your Fix | |----------------|------------------|----------| | **Unusual spending pattern** | Cardholder doesn't normally shop your MCC | Nothing you can do | | **Geographic anomaly** | Transaction from unusual location for this cardholder | Customer's issue | | **Velocity flag** | Cardholder has hit their own daily limits | Nothing you can do | | **Your merchant reputation** | High historical chargebacks/fraud from your MID | Fix your ratios | | **BIN-level blocking** | Issuer blocks certain merchant categories | Choose different BINs | **The key insight:** Many declines are about the cardholder's history, not your transaction quality. ### The False Decline Problem Industry data suggests: - ~20% of issuer declines are fraud-flagged - Of those, **40% are actually legitimate customers** - For every $100M in declines, ~$8M are false declines Issuers know this. They hate false declines because cardholders call angry, and 39% will abandon a card after being falsely declined. --- ## Why Issuers Side with Cardholders on Disputes When a cardholder disputes a charge, Reg E (debit) and Reg Z (credit) create specific obligations: ### Reg E (Debit Cards) | Requirement | What It Means for Merchants | |-------------|----------------------------| | Investigate within 10 business days | Fast timeline, limited investigation depth | | Provisional credit within 10 days | Cardholder gets money back before you can respond | | 45-90 days for full investigation | But provisional credit is already issued | | Consumer liability capped at $50 (often $0) | Cardholders lose almost nothing by disputing | ### Reg Z (Credit Cards) | Requirement | What It Means for Merchants | |-------------|----------------------------| | Cardholder liability capped at $50 | No real downside to disputing | | "Billing error" broadly defined | Includes "didn't receive" and "not as described" | | Issuer must investigate | But they often lack proof either way | | No interest on disputed amounts | Incentivizes disputes | :::warning[The Evidence Problem] Issuers often have **no way to know** if a cardholder is telling the truth. They didn't see the delivery. They didn't see the customer use the product. They only know the cardholder claims there's a problem. **This is why your evidence matters so much.** You're the only one who can prove what actually happened. ::: --- ## What Issuers Need From You ### For Authorization (Improve Approval Rates) | Action | Why It Helps | |--------|--------------| | **Use 3D Secure** | Issuer authenticates the cardholder themselves, much higher confidence | | **Send clean traffic** | Your fraud rates affect issuer models; high-fraud merchants get more declines | | **Provide transaction enrichment** | Order Insight/Consumer Clarity give issuers context (your logo, item details) | | **Don't retry aggressively** | Repeated retries on declined cards looks like fraud, damages your MID reputation | ### For Disputes (Win More Representments) Issuers can't side with you unless you give them proof. Here's what they need: | Dispute Type | Evidence That Works | Why | |--------------|---------------------|-----| | **"I didn't authorize this"** | 3DS authentication proof, IP/device match to prior orders | Proves cardholder was present | | **"Never received"** | Signed delivery confirmation, GPS delivery photo | Proves delivery happened | | **"Not as described"** | Product photos, description at checkout, correspondence | Shows what was promised vs. delivered | | **"Cancelled but still charged"** | Cancellation policy shown at checkout, cancellation confirmation | Proves policy was clear | | **"Already refunded"** | Refund transaction ID, date, amount | Proves duplicate dispute | :::tip[The Compelling Evidence Standard] Visa's [Compelling Evidence 3.0](/docs/chargebacks/representment/compelling-evidence) rule lets you win fraud disputes if you can prove the same device/IP was used for prior undisputed transactions. **This is specifically designed to help merchants prove to issuers that the cardholder is lying.** ::: --- ## What Issuers Track About You Your merchant reputation affects future authorizations: | Metric | Impact | |--------|--------| | **Chargeback ratio** | High ratio = more declines, possible program enrollment | | **TC40/SAFE fraud reports** | Fraud reported (even without chargeback) hurts your standing | | **MCC risk** | Some categories (digital goods, travel) get more scrutiny | | **Historical patterns** | Bad history takes months to recover from | :::warning[TC40/SAFE Reports] Even if you prevent a chargeback through an alert or refund, issuers may still file a TC40 (Visa) or SAFE (Mastercard) fraud report. These affect your reputation with issuer models even when you never see a dispute. ::: --- ## Working With Issuer Constraints ### Improve Auth Rates 1. **Reduce chargebacks** - Your chargeback ratio directly affects issuer models 2. **Use 3DS strategically** - Issuers trust their own authentication 3. **Send enrichment data** - Help cardholders recognize charges (reduces disputes too) 4. **Fix soft declines properly** - Don't retry hard declines; do retry soft declines with proper intervals ### Win More Disputes 1. **Collect evidence before you need it** - IP, device, delivery confirmation, screenshots 2. **Use Compelling Evidence 3.0** - Match device/IP to prior undisputed orders 3. **Respond quickly** - Issuer deadlines are tight, especially for Reg E 4. **Be specific** - Generic evidence doesn't help; show exactly what happened ### Build Long-Term Reputation 1. **Keep ratios low** - Below 0.5% keeps you off issuer radar 2. **Respond to alerts** - Ethoca/Verifi alerts prevent chargebacks AND reduce TC40s 3. **Don't fight everything** - Accept true fraud losses; fighting hurts your win rate metrics --- ## Next Steps **Improving auth rates?** 1. [Optimize authorization](/docs/payments/auth-optimization) - Reduce declines 2. [Implement 3DS](/docs/fraud/prevention/3ds) - Issuer authentication 3. [Check decline codes](/docs/reference/decline-codes) - Understand why you're being declined **Winning more disputes?** 1. [Review Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 requirements 2. [Build evidence collection](/docs/chargebacks/winning-evidence) - What to gather upfront 3. [Understand reason codes](/docs/reference/reason-codes) - What evidence each code needs **Understanding issuer regulations?** 1. [Review Reg E](/docs/compliance/consumer-protection/reg-e) - Debit card rules 2. [Review Reg Z](/docs/compliance/consumer-protection/reg-z) - Credit card rules 3. [Check network programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds --- ## Related Topics - [Authorization Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 for fraud disputes - [3D Secure](/docs/fraud/prevention/3ds) - Issuer authentication and liability shift - [Decline Codes](/docs/reference/decline-codes) - Understanding issuer declines - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before they start - [Regulation E](/docs/compliance/consumer-protection/reg-e) - Debit card dispute rules - [Regulation Z](/docs/compliance/consumer-protection/reg-z) - Credit card dispute rules - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, TC40 impact --- ## Fraud Metrics Source: https://paymentsandrisk.com/docs/fraud/metrics # Fraud Metrics :::info[TL;DR] - **Loss metrics**: Fraud rate 5-50 bps typical; Net fraud loss = Gross - Recoveries - **Detection targets**: Detection rate over 90%, false positive rate under 50%, precision over 50% - **Operational**: Review rate 1-5%, manual review under 5 min, auto-decision over 95% - **Prevention balance**: Block rate + friction rate vs. [insult rate](/docs/fraud/fundamentals/economics) - Segment by: [fraud type](/docs/fraud/types), channel, product, customer segment, geography ::: You can't manage fraud without measuring it. These are the KPIs that tell you whether your fraud program is working, wasting money, or blocking good customers. Track loss metrics to know how much fraud costs you, detection metrics to know if your tools are catching it, and operational metrics to know if your team can keep up. ```mermaid %%{init: {'themeVariables': {'xyChart': {'titleColor': '#ef4444', 'plotColorPalette': '#ef4444'}}}}%% xychart-beta title "Typical Fraud Rate by Business Type (bps)" x-axis ["Retail", "SaaS", "Digital Goods", "Travel", "Gaming", "Crypto"] y-axis "Basis Points" 0 --> 200 bar [15, 20, 45, 100, 125, 200] ``` ## Loss Metrics | Metric | Definition | Benchmark | |--------|------------|-----------| | **Fraud Rate (bps)** | Fraud $ / Transaction $ x 10,000 | 5-50 bps | | **Fraud Rate (#)** | Fraud count / Transaction count | 0.05-0.5% | | **Gross Fraud Loss** | Total confirmed fraud | Before recoveries | | **Net Fraud Loss** | Gross - Recoveries | True P&L impact | ### How to Calculate Fraud Rate Fraud rate is the most important number in your fraud program. Two ways to calculate it: **By dollar volume (most common):** ``` Fraud Rate (bps) = (Fraud Dollars / Total Transaction Dollars) x 10,000 Example: $2,500 fraud in a month / $500,000 total volume = 0.005 0.005 x 10,000 = 50 bps (0.50%) ``` **By count:** ``` Fraud Rate (%) = (Fraud Transactions / Total Transactions) x 100 Example: 12 fraud transactions / 5,000 total transactions = 0.24% ``` Dollar-based and count-based rates tell different stories. If your dollar rate is high but your count rate is low, you have a high-ticket fraud problem. If both are high, you have a volume problem. :::warning[What Counts as "Fraud"?] Only count confirmed fraud: chargebacks with a fraud reason code, transactions you refunded because you confirmed fraud, and transactions flagged by your processor as confirmed unauthorized. Don't count friendly fraud, product disputes, or "I don't recognize this" chargebacks. Those are [chargeback metrics](/docs/chargebacks/metrics), not fraud metrics. Mixing them inflates your fraud rate and sends you chasing the wrong problem. ::: ### Net Fraud Loss: The Number That Matters Gross fraud is the headline number, but net fraud loss is what hits your P&L: ``` Net Fraud Loss = Gross Fraud - Chargebacks won (representment recoveries) - Insurance/guarantee recoveries - Pre-chargeback refund savings Example: $10,000 gross fraud - $2,000 won through representment - $3,000 covered by chargeback guarantee vendor - $500 caught and refunded before chargeback filed = $4,500 net fraud loss ``` Track both. Gross fraud tells you how much fraud is getting through your defenses. Net fraud loss tells you the actual financial damage. ## Detection Metrics | Metric | Definition | Target | |--------|------------|--------| | **Detection Rate** | Detected fraud / Total fraud | >90% | | **False Positive Rate** | Good transactions blocked / Total blocked | Under 50% | | **Precision** | True fraud / All flagged | Over 50% | | **Recall** | Detected fraud / All fraud | >90% | ### The False Positive Problem False positives are legitimate transactions your fraud tools incorrectly blocked. They're the hidden cost of fraud prevention, and for most merchants, they cost more than actual fraud. ``` False Positive Rate = Legitimate Blocked / Total Blocked Example: You blocked 100 transactions this month. 30 were confirmed fraud. 70 were legitimate customers. False positive rate = 70 / 100 = 70% ``` What's "too high" depends on your [risk appetite](/docs/fraud/fundamentals/risk-appetite). Conservative businesses target under 30%. Most merchants should aim for under 50%. Aggressive strategies (high-margin digital goods, where false declines cost more than fraud) may accept 50-70%. If you're above 50% without a deliberate reason, your rules are too tight and you're losing more revenue to false declines than you're saving from fraud prevention. **How to measure false positives:** Pick 20-30 blocked transactions per month at random. Review each one. Was it actually fraud? A customer who calls after being blocked, a repeat customer with a normal order, an order that matches the customer's usual pattern -- those are false positives. **What false positives actually cost:** | Scenario | Cost | |----------|------| | Customer buys elsewhere | Lost sale + lifetime value | | Customer calls support | $5-15 in support cost + friction | | Customer doesn't come back | Permanent revenue loss | | Customer posts negative review | Reputation damage | A 1% false positive rate on $500K/month in volume means $5,000/month in blocked legitimate sales. That's $60K/year in revenue you turned away. ### Detection Rate vs. Precision: The Tradeoff These two metrics pull in opposite directions: - **Tighter rules** (block more) = higher detection rate, but more false positives (lower precision) - **Looser rules** (block less) = fewer false positives (higher precision), but more fraud slips through (lower detection rate) There is no right answer. The balance depends on your margins, your fraud type mix, and how much your customers tolerate friction. | Business Type | Lean Toward | |---------------|-------------| | Low-margin physical goods | Higher precision (can't afford blocking good orders) | | High-margin digital goods | Higher detection rate (fraud is expensive, false positives less so) | | Subscriptions | Higher precision (blocking a subscriber has high LTV cost) | ## Operational Metrics | Metric | Definition | Target | |--------|------------|--------| | **Review Rate** | Transactions reviewed / Total | 1-5% | | **Manual Review Time** | Avg time per case | Under 5 minutes | | **Auto-Decision Rate** | Auto-approved or declined / Total | Over 95% | | **Time to Detection** | Transaction to fraud confirmation | Under 7 days | ### Review Rate: Your Automation Gauge If more than 5% of your transactions need manual review, your rules or model thresholds are too aggressive. Manual review doesn't scale. ``` Review Rate = Transactions Sent to Review / Total Transactions Example: 250 reviews / 10,000 transactions = 2.5% (healthy) 1,200 reviews / 10,000 transactions = 12% (unsustainable) ``` **What to do if review rate is too high:** 1. Check which rules are sending the most transactions to review. One overly broad rule often accounts for 40%+ of review volume. 2. Tighten the rule or raise the threshold so only the most suspicious cases go to review. 3. Convert obvious patterns to auto-decisions: if 90% of a rule's reviews are approved, the rule is too broad. ### Time to Detection The faster you confirm fraud, the faster your model learns and the faster you can stop similar transactions. "Time to detection" measures how long it takes from when a fraudulent transaction processes to when you know it was fraud. | Detection Source | Typical Time | |------------------|-------------| | Customer contacts you | 1-3 days | | Internal review catches it | Same day to 7 days | | Chargeback arrives | 30-120 days | | Fraud vendor flags it | 1-7 days | Waiting for chargebacks means your fraud tools are always learning from stale data. Proactive detection (internal review, customer reports, vendor flags) gives you faster feedback. See [Fraud Model Feedback](/docs/fraud/detection/fraud-model-feedback) for how faster signals improve your detection over time. ## Prevention Metrics | Metric | Definition | Notes | |--------|------------|-------| | **Block Rate** | Transactions blocked / Total attempts | Higher isn't always better | | **Friction Rate** | Step-ups triggered / Total | Balance UX vs. security | | **3DS Challenge Rate** | Challenges / Total 3DS | 5-15% typical | | **Insult Rate** | Good customers declined | Minimize | ### Block Rate: When Higher is Worse A rising block rate doesn't mean your fraud prevention is working better. It often means your rules are too aggressive or a new rule is catching too many legitimate transactions. **Warning signs:** - Block rate jumps 2x or more in a single week with no corresponding fraud spike - Block rate is above 10% (you're almost certainly blocking too many good transactions) - Block rate rises but fraud losses don't decrease (you're blocking the wrong transactions) **What a healthy block rate looks like:** | Business Type | Typical Block Rate | |---------------|-------------------| | Low-risk e-commerce | 1-3% | | Digital goods | 3-8% | | High-risk verticals | 5-15% | ## Segmentation Track every metric above by: - **[Fraud type](/docs/fraud/types)** ([first-party](/docs/fraud/types/first-party), [third-party](/docs/fraud/types/third-party), [ATO](/docs/fraud/types/account-takeover), etc.) - **Channel** (web, mobile, in-store) - **Product type** (high-value items often have different fraud patterns) - **Customer segment** (new vs. returning customers) - **Geography** (cross-border transactions have higher fraud rates) Aggregate numbers hide problems. A 0.2% overall fraud rate looks healthy, but if your digital goods category is running at 1.5% while your physical goods are at 0.05%, you have a targeted problem that aggregate metrics won't surface. ## Test to Run **False positive audit:** 1. Pull 30 blocked or declined transactions from the past week (random sample). 2. For each one, determine: was it actually fraud, or would it have been a legitimate sale? 3. Calculate your false positive rate (legitimate blocked / total blocked). 4. Identify which rules or score thresholds caused the most false positives. 5. Move the worst offender to shadow mode for a week and measure impact. **Success criteria:** False positive rate drops without fraud rate increasing. If you can't tell whether a blocked transaction was fraud or not, that's a data collection problem to fix first. ## Scale Callout | Volume | What to Track | How | |--------|---------------|-----| | **Under $50K/month** | Fraud rate (monthly), chargeback count | Check processor dashboard weekly. Manual count is fine. | | **$50K-$250K/month** | Add: false positive rate, detection rate, review rate | Monthly spreadsheet. Sample 20 blocked transactions for FP rate. | | **$250K-$1M/month** | Add: precision per rule, time to detection, block rate trends | Weekly reporting. Segment by fraud type and product category. | | **Over $1M/month** | All metrics, segmented by channel, geography, and customer segment | Automated dashboards. Daily review of anomalies. | ## Where This Breaks - **Optimizing one metric in isolation.** Pushing detection rate to 99% will spike false positives. Pushing false positives to zero will miss fraud. Read metrics as a set, not individually. - **Comparing across business models.** A 0.3% fraud rate is a crisis for a physical goods retailer but normal for digital goods. Use [benchmarks by industry](/docs/reference/benchmarks#by-industry-cnp) for your vertical. - **Low volume noise.** Under 1,000 transactions/month, individual fraud cases swing your rate by 0.1%+ in either direction. Trend over 90 days, not weekly snapshots. - **First-party fraud miscategorization.** If you're counting [friendly fraud](/docs/fraud/types/first-party) as third-party, your detection rate looks worse than it is and your prevention strategy targets the wrong problem. - **Only counting chargebacks as fraud.** Chargebacks represent fraud you missed. If you refund a fraudulent transaction before the chargeback arrives, that's still fraud. Count it. ## What to Do When... **Fraud rate is climbing:** 1. Segment by fraud type. Is it third-party fraud (stolen cards) or friendly fraud (legitimate customers disputing)? 2. Check if a specific product, geography, or customer segment is driving the increase. 3. If it's third-party fraud, tighten your [velocity rules](/docs/fraud/detection/velocity-rules) or [risk scoring thresholds](/docs/fraud/prevention/risk-scoring). 4. If it's friendly fraud, the solution is better evidence collection and [refund policy design](/docs/chargebacks/refund-policy), not tighter fraud rules. **False positive rate is too high:** 1. Identify the rules sending the most transactions to review or block. 2. Check what percentage of those flagged transactions were actually fraud (precision per rule). 3. Rules with precision under 20% are doing more harm than good. Move them to shadow mode or tighten the conditions. 4. See [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules#shadow-mode-test-before-you-block) for shadow testing methodology. **Detection rate is too low:** 1. Review recent chargebacks. What fraud got through? Was there a pattern your rules should have caught? 2. Check if your rules cover the fraud types you're actually seeing ([card testing](/docs/fraud/types/card-testing), [ATO](/docs/fraud/types/account-takeover), etc.). 3. Consider adding [device intelligence signals](/docs/fraud/detection/device-fingerprinting) to catch fraud that transaction data alone misses. ## Next Steps **Setting up fraud tracking?** 1. [Understand fraud types](/docs/fraud/types) - Know what you're measuring 2. [Define risk appetite](/docs/fraud/fundamentals/risk-appetite) - Set acceptable thresholds 3. [Review industry benchmarks](/docs/reference/benchmarks) - Know what "good" looks like **Fraud rate too high?** 1. [Implement risk scoring](/docs/fraud/prevention/risk-scoring) - Better detection 2. [Add velocity rules](/docs/fraud/detection/velocity-rules) - Catch patterns 3. [Consider 3DS](/docs/fraud/prevention/3ds) - Liability shift for fraud **Optimizing detection?** 1. [Review rules vs ML](/docs/fraud/detection/rules-vs-ml) - Choose right approach 2. [Tune manual review](/docs/fraud/detection/manual-review) - Reduce false positives 3. [Evaluate vendors](/docs/fraud/vendors/selection-guide) - Consider specialized tools --- :::info[Other Metrics Pages] Tracking fraud is just one piece. See also: [Payments Metrics](/docs/payments/metrics) ยท [Chargeback Metrics](/docs/chargebacks/metrics) ยท [Compliance Metrics](/docs/compliance/metrics) ยท [Operations Metrics](/docs/operations/metrics) ::: ## Related Topics - [Chargeback Metrics](/docs/chargebacks/metrics) - Dispute measurement - [Economics of Fraud](/docs/fraud/fundamentals/economics) - Cost context - [Risk Appetite](/docs/fraud/fundamentals/risk-appetite) - Setting thresholds - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Detection performance - [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Rule construction and testing - [Fraud Model Feedback](/docs/fraud/detection/fraud-model-feedback) - ML feedback loops - [Rules vs ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches - [Manual Review](/docs/fraud/detection/manual-review) - Review process metrics - [Benchmarks](/docs/reference/benchmarks) - Industry comparisons - [Network Programs](/docs/chargebacks/reference/network-programs) - Fraud ratio thresholds - [3D Secure](/docs/fraud/prevention/3ds) - 3DS challenge rate optimization - [Fraud Vendors](/docs/fraud/vendors/landscape) - Vendor performance measurement - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern detection metrics - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device intelligence - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence --- ## 3DS Exemptions Source: https://paymentsandrisk.com/docs/fraud/prevention/3ds/exemptions # 3DS Exemptions :::info[TL;DR] - Exemptions let eligible transactions skip 3DS friction, preserving conversion while maintaining liability shift - but the issuer, not you, decides whether to honor the exemption - Low-value exemption (under โ‚ฌ30) is the most commonly used; transaction risk analysis (TRA) exemption is available for merchants with fraud rates below defined thresholds - Recurring transaction exemptions apply after the first authenticated payment - subsequent charges don't need 3DS authentication - If an issuer overrides your exemption request with a soft decline, you must re-submit with full 3DS - build this retry path into your integration ::: Even when SCA is required (Europe) or you want [liability shift](/docs/fraud/reference/emv-liability), certain transactions can skip 3DS. Understanding exemptions is critical for optimizing [conversion](/docs/payments/checkout-conversion) while maintaining [compliance](/docs/compliance). --- ## Exemption Types | Exemption | Criteria | Who Decides | |-----------|----------|-------------| | **Low value** | Under โ‚ฌ30 (โ‚ฌ100 cumulative limit) | [Issuer](/docs/fraud/issuer-perspective) | | **Low risk (TRA)** | Based on [fraud rate](/docs/fraud/metrics) thresholds | Acquirer or Issuer | | **Recurring/MIT** | After initial authenticated transaction | Merchant initiates (see [subscriptions](/docs/payments/subscriptions-recurring)) | | **Corporate cards** | Secure corporate payment process | Issuer (see [B2B](/docs/payments/reference/b2b-commercial)) | | **Trusted beneficiary** | Cardholder whitelisted merchant | Cardholder/Issuer | | **Secure corporate** | Dedicated payment processes | Varies | --- ## Transaction Risk Analysis (TRA) Thresholds TRA exemptions are based on your fraud rate. Lower fraud rate = higher exemption threshold. | Your Fraud Rate | Exemption Threshold | |-----------------|---------------------| | Below 0.13% | Up to โ‚ฌ100 | | Below 0.06% | Up to โ‚ฌ250 | | Below 0.01% | Up to โ‚ฌ500 | **Reality check:** Most merchants can't claim TRA exemptions because they don't have the verified fraud rate data or the acquirer support. ### TRA Eligibility Requirements To qualify for TRA exemptions, you typically need: - Verified fraud rate data over 90 days - Acquirer that supports TRA requests - Technical integration to request exemptions - Monitoring for fraud rate drift --- ## Exemption Decision Flow ```mermaid flowchart LR A[Transaction] --> B{Exemptcategory?} B -->|Yes: MIT, recurring| C[Skip 3DS] B -->|No| D{Low value?} D -->|Under โ‚ฌ30| E{Issuerapproves?} D -->|No| F{TRA eligible?} F -->|Yes| G{Acquirerapproves?} F -->|No| H[Full 3DS] E -->|Yes| C E -->|No| H G -->|Yes| C G -->|No| H style A fill:#3b82f6,color:#fff style C fill:#10b981,color:#fff style H fill:#ef4444,color:#fff ``` --- ## Exemption Risks | Risk | Description | |------|-------------| | **Issuer decline** | Issuer can reject exemption request | | **Liability stays with you** | Exempted transactions = no liability shift | | **Ratio impact** | Fraud on exempted transactions counts against you | | **Cumulative tracking** | Low-value exemptions have limits | ### The Liability Trade-off When you request an exemption and it's approved: - You skip the friction of 3DS - You keep liability for fraud on that transaction - If fraud occurs, it counts against your fraud rate This is a conscious trade-off: better conversion in exchange for fraud liability. --- ## When to Request Exemptions | Request Exemption | Don't Request | |-------------------|---------------| | Repeat customers with history | First-time high-risk orders | | Low-value transactions | High-value orders | | Low-risk profile | Any fraud signals present | | Conversion-critical flow | When liability shift matters | ### Good Exemption Candidates - **Subscription renewals** - MIT after initial authenticated payment - **Low-value add-ons** - Under โ‚ฌ30 with established customer - **Trusted repeat customers** - Multiple successful purchases, no disputes - **Corporate cards** - Secure corporate payment processes ### Bad Exemption Candidates - **New customers** - No history to assess risk - **High-value orders** - Fraud loss outweighs friction cost - **International transactions** - Higher fraud risk - **Any fraud signals** - Velocity, address mismatch, device risk --- ## Implementation Notes :::note[Ask Your [Processor](/docs/operations/processor-management)] "Do you support 3DS exemption requests? Which exemption types can we request? How do we flag transactions for TRA?" ::: **Not all processors support all exemptions.** Verify: 1. Which exemptions your processor can request 2. How to flag transactions for exemption 3. What data is required for TRA 4. How declined exemptions are handled (fallback to full 3DS?) ### Technical Implementation Exemption requests are made during the 3DS authentication request: | Processor | Typical Field | |-----------|---------------| | Stripe | `payment_intent.payment_method_options.card.request_three_d_secure` | | Adyen | `additionalData.scaExemption` | | Braintree | `transactionSource` + exemption flags | Check your processor's documentation for exact implementation. --- ## Exemption Strategy by Business Type | Business Type | Recommended Approach | |---------------|---------------------| | **Subscriptions** | Authenticate first payment, MIT exemption for renewals | | **High-frequency, low-value** | Request low-value exemption, accept liability | | **High-value goods** | Full authentication, don't exempt | | **Return customers** | Trusted beneficiary (if supported) | | **Mixed** | Segment by risk, exempt low-risk only | ### Subscription Best Practice 1. **Initial signup:** Full 3DS authentication 2. **First renewal:** MIT exemption (prior consent established) 3. **Subsequent renewals:** Continue MIT exemption 4. **Failed renewal retry:** May need re-authentication This pattern gives you liability shift on the initial high-risk transaction while removing friction from renewals. --- ## Monitoring Exemption Performance Track these metrics for exempted transactions: | Metric | Target | Action if Exceeded | |--------|--------|-------------------| | Fraud rate on exempted txns | Under 0.1% | Reduce exemption scope | | Exemption approval rate | Over 90% | Check issuer compatibility | | Conversion lift vs. 3DS | Over 2% | Keep exempting | | Chargeback rate on exempted | Under 0.3% | Tighten exemption criteria | If fraud on exempted transactions rises, you're exempting the wrong transactions. --- ## Next Steps 1. **Check processor support** โ†’ Verify which exemptions are available 2. **Know your fraud rate** โ†’ Determine TRA eligibility 3. **Segment your transactions** โ†’ Identify good exemption candidates 4. **Monitor results** โ†’ Track fraud on exempted vs. authenticated --- ## See Also - [3DS Overview](/docs/fraud/prevention/3ds) - Core 3DS concepts - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - MIT implementation - [Fraud Metrics](/docs/fraud/metrics) - Understanding your fraud rate - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing checkout flow - [Processor Management](/docs/operations/processor-management) - Working with processors - [B2B Commercial](/docs/payments/reference/b2b-commercial) - Corporate card handling - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold requirements --- ## AVS & CVV Source: https://paymentsandrisk.com/docs/fraud/prevention/avs-cvv # AVS & CVV :::info[TL;DR] - **AVS**: Checks billing address vs. issuer records. Y=full match (accept), N=no match (review/decline), U/G=unavailable (use other signals) - **CVV**: Verifies card code. M=match (accept), N=no match (decline). Proves physical card possession - **Neither shifts liability.** For liability shift, use [3D Secure](/docs/fraud/prevention/3ds) - **Don't hard-decline AVS mismatches blindly**: 20-30% of legitimate customers fail AVS (formatting, moves, issuer quirks) - **Test first**: Shadow mode 2 weeks, enforce only if over 30% of flagged transactions were fraud ::: :::tip[If you just take cards and don't run your own fraud rules] You need two settings, both in your processor dashboard and both usually on by default: **require CVV** for online payments, and **turn on AVS**. Don't auto-block AVS mismatches - customers move, typo their zip, or use work addresses, and you'll block real sales. That's it. The rest of this page is for teams tuning their own decline rules. ::: AVS checks if billing address matches what the [issuer](/docs/fraud/issuer-perspective) has. CVV verifies the 3-4 digit code on the physical card. Neither is foolproof and neither shifts [liability](/docs/fraud/reference/emv-liability). They just help you make a better [authorization decision](/docs/fraud/detection/authorization-decisioning) about which transactions to accept. If it's liability shift you want, that's [3D Secure](/docs/fraud/prevention/3ds). :::warning[Don't Hard-Decline on AVS Mismatch Until You've Measured] Legitimate customers fail AVS surprisingly often (20-30% for some merchants) on formatting differences, recent moves or issuer quirks. Get too strict and you're killing good orders. ::: :::tip[Experiment to Run] **Before enforcing any AVS rule:** 1. Run in shadow mode for 2 weeks (flag but don't block) 2. For every transaction you WOULD have declined, check: was it actually fraud? 3. Calculate your false positive rate **Decision rule:** Only enforce if more than 30% of flagged transactions were fraud AND fewer than 1% of total transactions would be blocked. ::: ## AVS + CVV Decision Flow ```mermaid flowchart TD A[TransactionReceived] --> B{CVVMatch?} B -->|No Match| C[Decline] B -->|Match| D{AVSResult?} B -->|Not Provided| E[Higher RiskAdd to Score] D -->|Y or X| F[Low RiskAccept] D -->|A or Z| G[Medium RiskCheck Other Signals] D -->|N| H[High RiskReview or Decline] D -->|U, G, S| I[UnknownUse Other Signals] G --> J{Other SignalsOK?} J -->|Yes| F J -->|No| H style C fill:#ef4444,color:#fff style F fill:#22c55e,color:#fff style H fill:#f59e0b,color:#fff ``` ## Address Verification Service (AVS) ### How AVS Works 1. Customer enters billing address at [checkout](/docs/payments/checkout-conversion) 2. Your [processor](/docs/operations/processor-management) sends address data to card network 3. [Issuer](/docs/fraud/issuer-perspective) compares submitted address to their records 4. AVS response code returned in the [authorization response](/docs/payments/reference/authorization-basics) 5. You decide: accept, [decline](/docs/reference/decline-codes), or review ### AVS Response Codes | Code | Meaning | Risk Level | Recommendation | |------|---------|------------|----------------| | **Y** | Full match (address + zip) | Low | Accept | | **X** | Full match (9-digit zip) | Low | Accept | | **A** | Address matches, zip doesn't | Medium | Review or accept with CVV match | | **Z** | Zip matches, address doesn't | Medium | Review or accept with CVV match | | **N** | No match | High | Decline or manual review | | **U** | Issuer doesn't support AVS | Unknown | Use other signals | | **R** | Retry (system unavailable) | Unknown | Retry or use other signals | | **S** | AVS not supported for card type | Unknown | Use other signals | | **G** | International card (non-US issuer) | Unknown | Use other signals | ### AVS Limitations **Geographic coverage:** - Strong support: US, Canada, UK - Limited/no support: Most other countries (see [going global](/docs/payments/going-global)) - [International cards](/docs/payments/payment-methods/international) often return "G" or "U" **Formatting issues:** - "123 Oak St" vs "123 Oak Street" may not match - Apartment numbers handled inconsistently - PO boxes may fail - Recent moves not yet updated with issuer --- ## International AVS: What Works Outside the US AVS was designed for US addresses. International transactions require a different approach. ### AVS Support by Region | Region | AVS Support | Notes | |--------|-------------|-------| | **United States** | Full | Street number + zip | | **Canada** | Full | Street number + postal code | | **United Kingdom** | Full | Numeric portion of address + postcode | | **Western Europe** | Partial | Varies by country and issuer | | **Latin America** | Limited | Most return U/G | | **Asia Pacific** | Limited | Japan/Australia have some support | | **Other** | Minimal | Expect U/G responses | ### Response Code Reality for International | Response | What It Means | Frequency (International) | |----------|---------------|---------------------------| | **G** | Global/international card | 40-60% of non-US | | **U** | Unavailable | 20-30% | | **S** | Service not supported | 10-20% | | **Y/A/Z** | Actual match data | 10-30% (varies by country) | ### International AVS Strategy **Don't:** Decline all G/U responses (you'll reject 50%+ of international orders) **Do:** Layer additional verification for international transactions | Signal | Use For International | |--------|----------------------| | **CVV** | Always require (still works internationally) | | **[3DS](/docs/fraud/prevention/3ds)** | Strongly recommended (liability shift) | | **Email verification** | Check for free/disposable emails (see [identity verification](/docs/fraud/detection/identity-verification)) | | **Phone verification** | Consider SMS verification for high-value | | **Shipping address analysis** | Freight forwarders, PO boxes, known [fraud](/docs/fraud/types/third-party) addresses | | **[Device fingerprint](/docs/fraud/detection/device-fingerprinting)** | Works regardless of location | ### UK-Specific AVS UK AVS checks: - Numeric part of building number/name - Numeric part of postcode **Example:** "Flat 42, 15 High Street, London SW1A 2AA" - Checks: 42, 15, 1, 2 (numerics extracted) - Different from US format ### International Risk Framework | Transaction Value | G/U Response | Recommended Action | |-------------------|--------------|-------------------| | Low (<$50) | G or U | Accept with CVV match | | Medium ($50-200) | G or U | Accept with CVV + 3DS | | High ($200+) | G or U | 3DS required + manual review | ### Country-Specific Considerations | Country | Notes | |---------|-------| | **Germany** | Privacy laws limit AVS; use 3DS | | **France** | AVS rarely supported; 3DS common | | **Japan** | Limited AVS; 3DS well-adopted | | **Australia** | Moderate AVS support | | **Brazil** | CPF (tax ID) more useful than AVS | :::tip[International Best Practice] For international transactions, treat CVV + 3DS as your primary fraud prevention. AVS is a bonus signal, not a gatekeeper. ::: ### Finding Your AVS Thresholds Those generic "decline on N" recommendations are someone else's guess. Here's how to find yours: **Backtest experiment:** 1. Pull last 30 days of transactions 2. Apply proposed rule in shadow mode 3. Calculate: What % would have been blocked? What % of those were actually fraud? If the rule would block 2% of traffic but only 10% of those were fraud, you're blocking 1.8% of good customers. Probably too aggressive. **Decision rule:** Only enforce if more than 30% of blocked transactions were fraud AND fewer than 0.5% of total traffic is blocked. ### AVS Rules by Transaction Type | Transaction Type | Suggested Starting Point | How to Test | |------------------|-------------------------|-------------| | Physical goods, domestic | Require Y/A/Z, decline N | Shadow mode 2 weeks, measure FP rate | | Physical goods, international | Accept U/G with CVV match | Compare fraud rates U/G vs. Y | | Digital goods | Accept with CVV match regardless | Monitor for abuse patterns | | High-value orders | Require Y + CVV + additional verification | Lower threshold, more review | | Recurring/saved cards | AVS not available | Use other signals | ## Card Verification Value (CVV) ### How CVV Works 1. Customer enters CVV at checkout 2. Processor sends CVV to issuer 3. Issuer verifies CVV matches card records 4. Response: match/no match/not processed ### CVV Response Codes | Code | Meaning | Action | |------|---------|--------| | **M** | Match | Accept (good signal) | | **N** | No match | Decline | | **P** | Not processed | Use other signals | | **S** | CVV should be on card but wasn't provided | Request CVV | | **U** | Issuer doesn't support CVV | Use other signals | ### Why CVV Matters **Proves physical possession:** The CVV is printed on the card, not encoded on the magnetic stripe or stored in most databases. A fraudster with a stolen card number often doesn't have the CVV. That's what makes it useful against [third-party fraud](/docs/fraud/types/third-party) and [card testing](/docs/fraud/types/card-testing). **Required for [compelling evidence](/docs/chargebacks/representment/compelling-evidence):** In [chargeback](/docs/chargebacks) disputes, CVV match strengthens your [representment](/docs/chargebacks/representment) case. **Cannot be stored:** [PCI DSS](/docs/compliance/pci-dss) prohibits storing CVV after authorization. [Recurring transactions](/docs/payments/subscriptions-recurring) can't re-verify CVV. ### CVV Best Practices **Do:** - Require CVV on all first-time transactions - Re-request CVV when shipping address changes - Re-request CVV from unrecognized devices - Decline CVV mismatches on CNP orders **Don't:** - Store CVV (PCI violation) - Skip collection because "it's extra friction" - Assume CVV match = legitimate (can be compromised with card) ## Combining AVS and CVV | AVS Result | CVV Result | Risk | Recommendation | |------------|------------|------|----------------| | Y (full match) | M (match) | Low | Accept | | Y | N | Medium-High | Decline or review | | A or Z (partial) | M | Medium | Accept with monitoring | | A or Z | N | High | Decline | | N | M | Medium-High | Review (fraudster may have CVV but not address) | | N | N | Very High | Decline | | U/G (unavailable) | M | Medium | Accept with additional signals | | U/G | N | High | Decline | :::info[This is a Bet] Every threshold you set is a tradeoff: blocking more fraud vs. blocking more good customers. Your optimal thresholds depend on: - Your [fraud rate](/docs/fraud/metrics) (high fraud = tighter thresholds are worth it) - Your margin (low margin = false positives hurt more) - Your customer base (international customers hit AVS limits) There's no universal right answer. Test and measure. ::: ## Beyond AVS/CVV AVS and CVV are table stakes. They're necessary but not sufficient. Modern fraud prevention layers additional signals: - **3D Secure:** Shifts liability to issuer for authenticated transactions - **Device fingerprinting:** Identifies returning devices, detects anomalies - **Behavioral analytics:** Analyzes how customers interact with your site - **Velocity rules:** Flags unusual patterns (many orders, same card, short time) - **Risk scoring:** ML models that combine all signals into a single score See [Risk Scoring](/docs/fraud/prevention/risk-scoring) for how these signals combine. ## Processor Configuration Most payment gateways let you configure AVS/CVV rules: ``` IF cvv_result = "N" THEN decline IF avs_result = "N" AND amount > 100 THEN decline IF avs_result IN ("A", "Z") AND cvv_result = "M" THEN accept IF avs_result = "U" AND card_country != "US" AND cvv_result = "M" THEN accept ``` :::warning[Where Experiments Lie to You] - **Selection bias:** If you only look at declined transactions, you don't know how many good customers you blocked - **Lag time:** Fraud shows up as chargebacks 30-90 days later. Your 2-week test might look clean but fail later. - **Fraudster adaptation:** Tighten AVS rules and the good fraudsters just start using correct addresses. Measure total fraud, not the AVS-flagged slice, or you won't see it move. ::: ## Impact on Chargebacks **For [representment](/docs/chargebacks/representment):** - AVS match is often required to fight [fraud chargebacks](/docs/reference/reason-codes/visa/10-4-fraud-cnp) - CVV match strengthens your case against [friendly fraud](/docs/fraud/types/friendly-fraud) - Without either, you may not qualify to represent under [network rules](/docs/compliance/network-rules) **For [Visa CE 3.0](/docs/chargebacks/representment/compelling-evidence):** - Historical transactions with matching data help prove customer relationship - AVS/CVV data from past orders supports [compelling evidence](/docs/chargebacks/representment/compelling-evidence) ## Next Steps **Just starting with AVS/CVV?** 1. [Understand response codes](#avs-response-codes) - What each code means 2. [Test your thresholds](#finding-your-avs-thresholds) - Backtest before enforcing 3. [Check CVV requirements](#cvv-best-practices) - Always require on first purchase **Tuning existing rules?** 1. [Run shadow mode test](#finding-your-avs-thresholds) - 2 weeks minimum 2. [Review international strategy](#international-avs-strategy) - Different rules needed 3. [Combine signals](#combining-avs-and-cvv) - AVS + CVV decision matrix **Fighting chargebacks with AVS/CVV?** 1. [Check compelling evidence requirements](/docs/chargebacks/representment/compelling-evidence) - AVS/CVV for representment 2. [Review impact on disputes](#impact-on-chargebacks) - What wins cases 3. [Layer with 3DS](/docs/fraud/prevention/3ds) - For liability shift --- ## See Also - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift authentication - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining fraud signals - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device intelligence - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting chargebacks - [Third-Party Fraud](/docs/fraud/types/third-party) - Stolen card fraud - [Decline Codes](/docs/reference/decline-codes) - Understanding declines - [Representment](/docs/chargebacks/representment) - Fighting disputes - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern detection - [Authorization Basics](/docs/payments/reference/authorization-basics) - Auth flow - [Going Global](/docs/payments/going-global) - International AVS challenges - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Setting up rules - [Checkout Conversion](/docs/payments/checkout-conversion) - Friction balance --- ## Chargeback Guarantees Source: https://paymentsandrisk.com/docs/fraud/prevention/chargeback-guarantees # Chargeback Guarantees :::info[TL;DR] - A guarantee service approves or declines each order. Fraud on an approved order gets reimbursed. It's also incentivized to over-decline the borderline ones. That protects its margin, not yours - **No guarantee provider publishes a price.** Signifyd publishes the model, not the number. It's a percentage of the order total on approved orders. Nothing gets charged when an order is declined for fraud. Riskified, Forter, NoFraud and ClearSale publish nothing at all (checked 2026-08-02) - That makes the breakeven test simple. Take your fraud losses as a percentage of revenue. Compare it to **the percentage in your quote**. Above the quote, the guarantee pays for itself. Not a range off a comparison site. The number they put in writing for you - Below that line, 3DS and your processor's own tools win. Stripe Radar Lite comes free with Stripe Payments - Always negotiate a false positive SLA. Declined legitimate orders cost you money. They should own that too, not just fraud chargebacks ::: A guarantee vendor takes your fraud liability off you. They approve or decline each order, and when an approved order turns out to be fraud, they pay you back. You're buying certainty. The price of it is the good orders they decline to protect their own margin. Whether that trade is worth it comes down to one number. You can work it out in five minutes. :::warning[Should an SMB Buy a Chargeback Guarantee?] Do the math before signing anything. Use the number in your quote. Not one off a web page. The test is one line: **Buy the guarantee only if your fraud losses, as a percentage of revenue, beat the percentage they quote you.** Take a 1% quote as an illustration. No vendor publishes a rate, so substitute yours: - 0.5% fraud rate on $500K of revenue is **$2,500 a year** of fraud losses - A guarantee quoted at 1% of approved orders costs roughly **$5,000 a year** - You'd pay double your losses for the privilege At a 1% quote, you need a fraud rate above 1%. Below that, the deal loses money. And a rate above 1% is rare for an SMB. Two things make the real comparison kinder. Signifyd charges nothing on orders it declines for fraud, so you pay on approved volume, and the guarantee absorbs the dispute fees on the chargebacks it covers. Neither changes the answer under $500K a year. Before spending money on a guarantee, fix your [billing descriptor](/docs/chargebacks/prevention/descriptors-and-comms). Enable [3DS](/docs/fraud/prevention/3ds) on high-risk segments. Both are free. Both hit the most common sources of disputes. ::: :::info[CNP Only] Chargeback guarantees are for card-not-present transactions. Card-present already has liability shift from EMV chip plus signature or PIN. CP-only? Skip this page. ::: ## How Chargeback Guarantees Work Traditional fraud tools give you a **score**. "This order is 73% likely to be fraud." You still decide whether to ship. Get it wrong and you eat the loss. Guarantee providers give you a **decision**: approve or decline. If they approve and it's fraud, they reimburse you. ``` Traditional: Score (73%) โ†’ You decide โ†’ You liable Guarantee: Decision (Approve) โ†’ You ship โ†’ They liable ``` ### What's Covered | Covered | Not Covered | |---------|-------------| | Fraud chargebacks on approved orders | Friendly fraud (check your contract) | | Chargeback fees | Non-fraud disputes (not as described, etc.) | | Shipping costs (some providers) | Orders you approve against their decision | | | Chargebacks from transactions before contract | **Read your contract carefully.** Coverage varies significantly between providers, and the friendly fraud line is the one to check. ## Major Providers | Provider | Model | Best For | What they publish about price (checked 2026-08-02) | |----------|-------|----------|------------------| | **Signifyd** | Guarantee + score | Enterprise e-commerce | The model, not the number. "A percentage of the order total when an order is approved," varying by products, vertical, order volume and average ticket. "There is no charge when an order is declined due to fraud." ([signifyd.com/pricing](https://www.signifyd.com/pricing/)) | | **Forter** | Decisions + guarantee options available | Enterprise, high volume | Nothing. No model, no tiers, no rate card - just "speak with one of our Forter experts" ([forter.com](https://www.forter.com/)) | | **Riskified** | Guarantee | Fashion, luxury, high-AOV, travel | Nothing. The pricing page is a contact form ([riskified.com/pricing](https://www.riskified.com/pricing/)) | | **ClearSale** | Guarantee + manual review | International, emerging markets | Nothing | | **Kount (Equifax)** | Score + optional guarantee | Flexible needs | Nothing. Note that kount.com now redirects to equifax.com/business/identity-fraud/, so you're buying an Equifax product line mid-rebrand | | **NoFraud** | Guarantee | SMB e-commerce | Nothing | Signifyd's "no charge when an order is declined due to fraud" is worth reading twice. The vendor only earns on orders it approves. That's better alignment than paying on total volume. Ask every other provider whether their fee works the same way. None of them says so publicly, which makes Signifyd's incentive the only one you can check before a sales call. ## The Cost Guarantee pricing works one of two ways: | Model | How It Works | What vendors publish | |-------|--------------|---------------| | **Percentage of approved order value** | X% of every order they approve | The percentage is not published by anyone. Signifyd confirms this is the model and that fraud declines carry no charge | | **Per-transaction fee** | Flat fee per approved order | Not published. NoFraud describes a per-transaction model with the guarantee included, without a number | So the honest cost table is blank. You can't fill it in without a quote. Run the arithmetic when the quote arrives. **Example math.** The 1% below is an illustration, because nobody publishes a rate. Swap in your quoted percentage: | Scenario | Guarantee Cost | Your Fraud Rate | Fraud Loss Without | Net Savings | |----------|----------------|-----------------|-------------------|-------------| | $1M approved, quoted 1% | $10,000 | 0.5% | $5,000 | -$5,000 (lose money) | | $1M approved, quoted 1% | $10,000 | 1.5% | $15,000 | +$5,000 (save money) | | $1M approved, quoted 1% | $10,000 | 2.5% | $25,000 | +$15,000 (save money) | **The breakeven question:** is your fraud rate above their quoted percentage? Some vendors won't put that in writing before a pilot, and if they won't, you can't answer the question. Don't sign. One sanity check from the neighboring market. SEON sells scoring, not a guarantee, and it publishes $699/month for 2,500 fraud checks, roughly 28 cents a check ([seon.io/pricing](https://seon.io/pricing/), checked 2026-08-02). It's the only public price in fraud tooling. A guarantee costs far more per order, and it should. It's buying liability transfer, not a score. But the gap can be enormous. If the vendor can't explain what they're absorbing, that's your answer. ## The Hidden Cost: Declined Good Orders **Guarantee providers are incentivized to decline borderline orders.** They approve a $500 order and it's fraud. They lose $500. They decline it and it would have been good. You lose the sale. They lose nothing. | Provider Incentive | Your Incentive | |--------------------|----------------| | Minimize fraud payouts | Maximize approved revenue | | Decline when uncertain | Approve when uncertain | | Protect their margin | Grow your business | **The Forter argument:** Forter now offers guarantees, but it historically pushed a technology-first approach instead. The argument: pure guarantee providers decline 5-15% of good orders to protect themselves. Better technology approves more orders and still covers the losses. **The Signifyd counter:** guarantee providers approve more orders than merchants would alone. They have better data. So the net effect is positive. **Who's right?** Depends on your risk tolerance and your margins. And on how good you already are at fraud detection. But below the breakeven, the Forter critique is the one that holds. You're paying for coverage you don't need and eating declined good orders on top. ## When Guarantees Make Sense ### Good Fit | Situation | Why Guarantee Works | |-----------|---------------------| | **Fraud rate above the percentage you were quoted** | Math works in your favor. This is the whole test | | **No fraud team** | Outsource the expertise | | **High AOV** | Single fraud loss is catastrophic | | **Approaching VAMP/ECM threshold** | Can't afford more chargebacks | | **Low margins** | Can't absorb fraud losses | | **Scaling fast** | Don't have time to build fraud ops | ### Poor Fit | Situation | Why Guarantee Doesn't Work | |-----------|---------------------------| | **Fraud rate below the percentage you were quoted** | You're paying more for the coverage than the fraud costs you | | **Strong fraud team** | Already doing well internally | | **Low AOV, high volume** | Per-transaction fees add up | | **Mostly friendly fraud** | Guarantees don't cover it | | **Tight margins** | Fee exceeds fraud savings | ## What to Ask Providers Before signing: | Question | Why It Matters | |----------|----------------| | **What's your approval rate for my vertical?** | Tells you how many orders they'll decline | | **What's NOT covered?** | Friendly fraud, specific reason codes | | **How fast do you reimburse?** | Cash flow impact | | **Do you cover chargeback fees, not just the transaction?** | Your processor's dispute fee is real money and it varies a lot. Verified on 2026-08-02: Stripe charges $15 to receive a dispute plus $15 to counter it, and returns neither on a partial win. PayPal charges $15.00 on wallet and Guest Checkout disputes or $20.00 on card chargebacks, never both, rising to $30.00 above a 1.5% dispute ratio. Braintree charges $15.00. Moneris charges CA$25.00 plus a CA$80.00 authorization chargeback handling fee. Helcim charges $0 when you win and $15 when you lose. Square charges $0.00. The whole published US range is $0 to $30, so a guarantee sold on "we cover your $100 chargeback fee" is quoting a number no US processor publishes | | **What data do you need from me?** | Integration complexity | | **Can I override your decisions?** | Flexibility vs. coverage | | **What's the contract term?** | Locked in for how long? | | **How do you handle disputes?** | If you disagree with a denial | ## Test to Run Before committing to a guarantee: 1. **Calculate your true fraud rate** - Fraud chargebacks / Total transactions 2. **Calculate your fraud cost** - Fraud losses + chargeback fees + operational time 3. **Get guarantee pricing** - Usually need to share volume for a quote 4. **Compare** - Is guarantee cost < fraud cost? 5. **Ask about decline rate** - What percentage of your orders would they decline? The guarantee costs more than your fraud, and they'd decline orders you'd approve. You're paying to lose sales, so walk. ## Scale Callout **Under $500K annual GMV:** Guarantees don't make economic sense. Focus on 3DS, basic rules, and manual review. **$500K - $5M GMV:** evaluate case by case. If fraud is a problem and you have nobody running it, a guarantee can be the right outsourcing call. **Over $5M GMV:** you can probably negotiate better rates. Also weigh whether building it internally makes more sense long term. ## Where This Breaks **Friendly fraud dominant:** most of your chargebacks are customers lying. They claim they never got the order, or that the charge was "unauthorized" when they placed it themselves. Guarantees won't help, because they cover true fraud, not customer abuse. See [Friendly Fraud](/docs/fraud/types/friendly-fraud). **Mixed fraud types:** low third-party fraud, which a guarantee helps with. High friendly fraud, which it doesn't. Understand your mix before buying, and if friendly fraud is the bigger half, a guarantee is the wrong purchase. **International complexity:** some providers cover fewer countries. Others charge more for international transactions. --- ## Alternatives to Guarantees | Alternative | Pros | Cons | |-------------|------|------| | **3D Secure everywhere** | Liability shift, no ongoing fee | Adds friction, some decline lift | | **In-house fraud team** | Full control, no per-txn cost | Need expertise, slower to scale | | **Score-only tools** | Cheaper than a guarantee, and at least one of them will tell you the price: SEON publishes $699/month for 2,500 checks | You keep the liability | | **Processor native tools** | Already integrated, and free. Stripe Radar Lite is included with Stripe Payments, RevenueProtect with Adyen | Often less sophisticated | | **Manual review** | Highest accuracy | Doesn't scale, slow | See [Fraud Vendors](/docs/fraud/vendors) for the full landscape. --- ## Next Steps **Evaluating guarantees?** 1. [Calculate your fraud rate](/docs/fraud/metrics) - Know your baseline 2. [Understand your fraud types](/docs/fraud/types) - What's actually causing losses 3. Get quotes from 2-3 providers - Compare pricing and coverage **Not ready for guarantee?** 1. [Enable 3D Secure](/docs/fraud/prevention/3ds) - Free liability shift 2. [Set up velocity rules](/docs/fraud/detection/velocity-rules) - Catch obvious patterns 3. [Review processor tools](/docs/fraud/processor-rules-configuration) - Use what you have **Already have high fraud?** 1. [Survive a fraud attack playbook](/docs/playbooks/survive-fraud-attack) - Emergency response 2. [Check network program status](/docs/chargebacks/reference/network-programs) - Know your thresholds 3. Consider guarantee as bridge - While you fix root causes --- ## Related Resources - [Fraud Vendors](/docs/fraud/vendors) - Full vendor landscape - [Fraud Vendor Selection Guide](/docs/fraud/vendors/selection-guide) - How to choose - [3D Secure](/docs/fraud/prevention/3ds) - Alternative liability shift - [Fraud Types](/docs/fraud/types) - Understanding what you're preventing - [Fraud Metrics](/docs/fraud/metrics) - Measuring your fraud rate - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - What guarantees don't cover - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches --- ## Defending Against Fraud Losses Source: https://paymentsandrisk.com/docs/fraud/prevention/defending-against-fraud-losses # Defending Against Fraud Losses :::info[TL;DR] - **Preventing fraud** and **preventing fraud losses** are different problems. Blocking stolen cards is one job. Not losing money on disputes is another. - **3DS is your strongest friendly fraud defense.** It shifts liability to the issuer. Use fraud rules to trigger 3DS on high-dispute segments instead of declining. - **Visa CE 3.0 wins 70-85% of qualifying fraud disputes.** But only if you collected device fingerprint, IP, and account data at transaction time. - **Evidence collection rules add zero checkout friction.** They run silently, storing the data you'll need if a chargeback lands weeks later. - **Pre-transaction defenses** stop the chargeback from ever being filed. Clear descriptors, visible terms, easy cancellation. ::: Preventing fraud means stopping criminals from using stolen cards at your store. Preventing fraud losses means not losing money when a chargeback arrives, legitimate or not. :::tip[For SMBs Under $100K/Month] Your highest-impact fraud prevention isn't technical. It's operational: 1. **Fix your billing descriptor** (10 minutes, prevents 20% of disputes) - see [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms) 2. **Make cancellation easy** (1 hour of product work, prevents 10-15% of disputes) - see [Refund Policy](/docs/chargebacks/refund-policy) 3. **Send clear order confirmation emails** (proof of purchase for representment) That's it. Don't buy device fingerprinting or behavioral analytics until you're past $250K/month. Those three are free, and they cover most of the preventable disputes at your volume. ::: For [third-party fraud](/docs/fraud/types/third-party), the answer is blocking: [rules](/docs/fraud/detection/building-fraud-rules), [ML](/docs/fraud/detection/rules-vs-ml), [device intelligence](/docs/fraud/detection/device-fingerprinting). [Friendly fraud](/docs/fraud/types/friendly-fraud) is different. The real customer disputes a real purchase, so blocking does nothing. The customer IS legitimate. The answer is liability shift, evidence collection, and making a refund easier than a dispute. ```mermaid flowchart TD A[Transaction arrives] --> B{Fraud type?} B -->|Third-partyStolen card| C[Block or 3DS] B -->|Friendly fraudReal customer| D[Can't blockwithout losing the sale] D --> E[3DS: Shift liabilityto issuer] D --> F[Collect evidencesilently] D --> G[Make refund easierthan disputing] E --> H[If they dispute:issuer pays] F --> I[If they dispute:win with CE 3.0] G --> J[They refundinstead of disputing] style C fill:#ef4444,color:#fff style H fill:#22c55e,color:#fff style I fill:#22c55e,color:#fff style J fill:#22c55e,color:#fff ``` --- ## Layer 1: 3DS as Liability Shift [3D Secure](/docs/fraud/prevention/3ds) gets sold as a fraud prevention tool. For friendly fraud, it's a loss prevention tool. The real cardholder authenticates with their bank, then disputes, claiming "I didn't authorize this." The issuer bears the liability, not you. ### When to Trigger 3DS for Loss Prevention Use [fraud rules](/docs/fraud/detection/building-fraud-rules#rules-that-trigger-3ds) to trigger 3DS on high-dispute segments. Not just high-fraud ones: | Segment | Why This Segment Disputes | 3DS Impact | |---------|--------------------------|------------| | **Digital goods** | No physical proof of delivery, buyer's remorse | Liability shift on fraud claims; 60-90% go frictionless | | **Subscriptions (renewal)** | "I forgot I signed up," "I thought I cancelled" | Liability shift; send renewal reminder email as backup evidence | | **High-value + new customer** | Highest dispute rate segment across all merchants | Liability shift; most issuers approve frictionless for verified cardholders | | **Customers with prior disputes** | 40% of disputers dispute again within 60 days | Liability shift on the repeat; acceptable friction given history | | **Electronics, luxury, resellable goods** | High resale value attracts "receive and dispute" abuse | Liability shift; combine with signature delivery | ### What 3DS Protects (and What It Doesn't) 3DS liability shift covers **fraud reason codes only** (Visa 10.4, Mastercard 4837, Amex F29). It does **nothing** for "not received," "not as described," "cancelled recurring," or processing errors. So 3DS alone isn't enough, and you need the evidence layers below for everything it doesn't cover. See [3D Secure](/docs/fraud/prevention/3ds#chargeback-handling-for-3ds) for the full list. ### The Friction Tradeoff 3DS adds a step at checkout. But 3DS 2.0 with rich data runs [60-90% frictionless](/docs/fraud/prevention/3ds#frictionless-vs-challenge-flow). The issuer approves silently and the customer sees nothing. The other 10-40% get a challenge: OTP, biometric, or a bank app notification. For high-dispute segments, the trade is almost always worth it. Say you drop 2-5% of conversion on a segment. If that segment throws 3x the disputes, you come out ahead. :::tip[The Golden Rule] **If your fraud rules would decline a transaction, trigger 3DS instead.** They authenticate, you keep the sale and get liability shift. They fail or abandon, you lose nothing a decline wouldn't have cost you. More in [Building Fraud Rules: Rules That Trigger 3DS](/docs/fraud/detection/building-fraud-rules#rules-that-trigger-3ds). ::: --- ## Layer 2: Evidence Collection at Every Stage Evidence wins chargebacks. But you can't collect it after the dispute arrives. You've got to collect at every stage of the transaction, silently, with no friction on the customer. ### Pre-Transaction: Set Expectations These prevent the dispute from being filed in the first place. | Action | What It Defeats | Effort | |--------|----------------|--------| | **Clear billing descriptor** | "I don't recognize this charge" (10-20% of disputes) | 10 minutes to fix in processor settings | | **Descriptor includes phone or URL** | Customer contacts you instead of their bank | 10 minutes | | **Terms checkbox at checkout** (not just a link) | "I didn't agree to this" claims | 1 hour dev time | | **Cancellation policy visible before purchase** | "I didn't know I couldn't cancel" | Content update | | **Delivery timeline shown before buy button** | "I expected it sooner" complaints | Content update | | **Renewal reminder email** (7 days before charge) | "I forgot about this subscription" disputes | Email automation setup | :::warning[Billing Descriptor Is the Highest-ROI Fix] More than 10% of your chargebacks coded "unrecognized"? Your billing descriptor is wrong. Fixing it takes 10 minutes, and it can cut your dispute rate by 20-30%. Check yours at [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms). ::: ### At Transaction Time: Collect Silently These run in the background during checkout. The customer sees nothing. | Data Point | Why You Need It | How to Collect | |------------|----------------|----------------| | **Device fingerprint** | CE 3.0 matching against prior transactions | JavaScript SDK (Stripe, Sift, ThreatMetrix, or Sardine) | | **IP address** | CE 3.0 matching + geolocation evidence | Server-side, every processor captures this | | **Account ID** | CE 3.0 matching + proves account ownership | Your authentication system | | **Shipping address** | CE 3.0 matching + delivery confirmation | Checkout form | | **Terms acceptance timestamp** | Proves customer agreed to policy | Log the click event with timestamp and IP | | **Product page snapshot** | Defeats "not as described" claims | Cache the product listing they saw at purchase time | **The CE 3.0 minimum.** You need **two of four** data elements matching: IP, device ID, shipping address, account ID. They have to match between the disputed transaction and **two or more prior undisputed transactions** on the same card, at least 120 days prior. One of the two matches **must** be IP address or device ID. Shipping address plus account ID alone won't qualify. See [Compelling Evidence 3.0](/docs/chargebacks/representment/compelling-evidence#visa-compelling-evidence-30). Every transaction you process today builds your CE 3.0 defense, for disputes that arrive 3-6 months from now. Not storing device fingerprints against transactions? Start today. :::note[Ask Your Dev] "Are we storing device fingerprint and IP address with every transaction in a way we can query later? When a chargeback arrives, can we pull matching prior transactions for CE 3.0 submission within 24 hours?" ::: ### At Fulfillment: Prove Delivery | Business Type | Evidence to Collect | What It Defeats | |---------------|-------------------|-----------------| | **Physical goods (under $150)** | Tracking number + carrier delivery confirmation | "Not received" (13.1) | | **Physical goods (over $150)** | Tracking + signature confirmation | "Not received" (13.1) with strong evidence | | **Physical goods (over $500)** | Tracking + signature + delivery photo | "Not received" and "not as described" | | **Digital goods** | Download timestamp + device/IP at download + access log | Fraud (10.4) via CE 3.0 | | **SaaS/subscriptions** | Login timestamps + feature usage logs + API call logs | "I didn't use it" and "I cancelled" | | **Services** | Completion confirmation + client sign-off + deliverable access logs | "Service not rendered" | ### Post-Purchase: Prove Engagement Engagement after the purchase date is powerful in representment, because it proves the customer got value. | Signal | Where to Find It | Representment Value | |--------|------------------|-------------------| | **Customer logged in after purchase** | Auth logs | Proves they accessed the product/account | | **Customer used the product** | Usage analytics, API logs | Proves they received and engaged | | **Customer contacted support** | Support ticket system | Proves they acknowledged the purchase | | **Customer left a review** | Review platform | Proves they received and evaluated the product | | **Customer made a subsequent purchase** | Transaction history | Proves ongoing relationship and satisfaction | | **Customer clicked renewal reminder email** | Email analytics | Proves they were aware of the upcoming charge | --- ## Layer 3: Visa Compelling Evidence 3.0 CE 3.0 is the strongest friendly fraud defense available today. Qualify, and your win rate on fraud chargebacks jumps to 70-85%. Qualifying disputes can also come out of your [VAMP ratio](/docs/chargebacks/reference/network-programs). ### How CE 3.0 Works The customer says "I didn't make this purchase." CE 3.0 shows a history of undisputed purchases from the same device and location. It makes the claim implausible. You need 2+ prior undisputed transactions on the same card, 120-365 days old. At least two of four data elements have to match. IP address, device fingerprint, shipping address, or user account ID. One of the two **must** be IP address or device ID. See [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence#visa-compelling-evidence-30) for the full requirements and network details. ### CE 3.0 in Practice ``` Disputed transaction (January 15): Card: ****4242 Device: fp_abc123 IP: 98.76.54.32 Account: user@email.com Amount: $299 Prior undisputed transactions: Aug 10: ****4242, fp_abc123, 98.76.54.32, user@email.com, $49 Sep 22: ****4242, fp_abc123, 98.76.54.32, user@email.com, $89 Nov 5: ****4242, fp_abc123, 98.76.54.32, user@email.com, $129 CE 3.0 match: Device (fp_abc123) + IP (98.76.54.32) + Account (user@email.com) 3 of 4 elements match. 3 prior undisputed transactions. All within 120-365 day window. Result: CE 3.0 qualified. Submit with representment. Expected win rate: 70-85%. TC40 excluded from VAMP ratio. ``` ### How to Implement CE 3.0 | Platform | CE 3.0 Support | What You Need to Do | |----------|---------------|---------------------| | **Stripe** | Built-in (automatic for Radar users) | Enable Radar. Stripe automatically submits CE 3.0 data when available. | | **Adyen** | Supported via dispute API | Store device fingerprint and IP. Submit via dispute response API. | | **Braintree** | Supported via evidence submission | Collect and store device/IP data. Submit with representment. | | **Sift/Forter/Signifyd** | Varies by integration | These vendors collect device data. Confirm they pass it to your processor for CE 3.0 submission. | | **Manual/other** | Via Visa's VROL platform | You must collect, store, and submit the matching data yourself. | :::tip[If You Use Stripe] Stripe attempts CE 3.0 on qualifying disputes if you use Radar. But Stripe can only use the data it has. If your checkout doesn't pass device fingerprint through Stripe.js, CE 3.0 can't match on device ID. Make sure your integration collects all four elements. Run `stripe disputes list` to see whether CE 3.0 fired on recent disputes. ::: --- ## Layer 4: Pre-Transaction Defenses These stop the chargeback from being filed. They cost almost nothing, and they cut dispute volume before evidence or representment enters the picture. ### Billing Descriptor Your billing descriptor is the text on the customer's card statement. They don't recognize it, they call their bank. That's how 10-20% of chargebacks start. | Bad Descriptor | Good Descriptor | Why | |----------------|-----------------|-----| | PAY*ACME | ACME WIDGETS 800-555-1234 | Customer recognizes the business name and can call you instead of their bank | | STRIPE TRANSFER | MYSTORE.COM | Generic processor name tells the customer nothing | | PMT*12345 | PETBOX MONTHLY BOX | Transaction ID is meaningless to a customer checking their statement | Fix this today. It's 10 minutes in your processor's dashboard. See [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms). ### Easy Cancellation Hard-to-cancel subscriptions cause chargebacks. Can't find your cancel button? They call their bank instead. There's an evidence bonus too: every self-service cancellation leaves you timestamped proof. When someone who never cancelled claims "I cancelled," you can show they didn't. See [Refund Policy Design: Making Cancellation Easy](/docs/chargebacks/refund-policy#making-cancellation-easy) for the checklist, the post-cancellation flow, and proof logging. ### Purchase Confirmation Send a confirmation email or SMS immediately after purchase with: - Business name (matching your billing descriptor) - Product/service purchased - Amount charged - Expected delivery date - How to contact you for help - How to request a refund That email does two jobs. It prevents "I don't recognize this" disputes, and it becomes evidence in representment. ### Refund-Before-Dispute A refund costs you about 3% of the transaction, the interchange you don't get back. A chargeback costs the whole sale plus a fee. That fee runs $0 to $30, most commonly $15, and then there's your time. Easy, fast refunds keep customers off the phone with their bank. | Customer Action | If Refund Is Easy | If Refund Is Hard | |----------------|-------------------|-------------------| | Unhappy with product | Requests refund, you process it, costs $3 on a $100 order | Calls bank, files dispute, you lose the $100 and the fee on top | | Forgot about subscription | Contacts you, you cancel and refund, they stay on good terms | Doesn't remember your company name, disputes, you lose the sale plus the fee | | Didn't recognize charge | Sees your descriptor, finds your phone number, calls you | Calls bank, files "fraud" chargeback | See [Refund Strategy](/docs/chargebacks/refund-strategy) for the refund-vs-fight framework with worked dollar examples. [Refund Policy Design](/docs/chargebacks/refund-policy) covers the customer-facing language. --- ## Putting It All Together by Business Model ### Physical Goods | Layer | Action | |-------|--------| | **3DS** | Trigger on orders > $200 from new customers | | **Pre-transaction** | Clear descriptor, order confirmation with tracking ETA | | **At transaction** | Collect device fingerprint, IP, account ID for CE 3.0 | | **Fulfillment** | Tracking on every order. Signature required over $150. Photo proof over $500 | | **Post-purchase** | Delivery confirmation email with "contact us if there's an issue" CTA | ### Digital Goods / SaaS | Layer | Action | |-------|--------| | **3DS** | Trigger on all first purchases (highest dispute category) | | **Pre-transaction** | Clear descriptor, instant confirmation with product access link | | **At transaction** | Collect device fingerprint, IP, account ID. Log terms acceptance | | **Fulfillment** | Log download timestamp, activation, and device at download | | **Post-purchase** | Log every login, feature usage, and API call. This is your CE 3.0 goldmine. | ### Subscriptions | Layer | Action | |-------|--------| | **3DS** | Trigger on initial signup. Subsequent renewals use stored credentials (no 3DS). | | **Pre-transaction** | Clear descriptor with "MONTHLY" or "ANNUAL." Easy cancellation flow. | | **At transaction** | Collect device fingerprint and IP at signup for CE 3.0 baseline | | **Renewal** | Send reminder email 7 days before charge. Log email delivery confirmation. | | **Post-purchase** | Log usage between renewals. A customer who logged in 15 times between charges didn't "forget" they were subscribed. | --- ## Test to Run **Evidence collection audit, 30 days:** 1. Pick 10 recent chargebacks you lost. 2. For each one, check what you had stored. Device fingerprint, IP, delivery confirmation, terms acceptance. 3. Then ask whether CE 3.0 would have qualified. 2+ prior undisputed transactions with matching elements? 4. More than 3 of 10 would have qualified on data you never collected? You've got gaps. 5. Implement the missing collection points. Re-check in 30 days. **Success criteria:** CE 3.0 qualification rate on new fraud disputes rises above 50%. If it doesn't, your integration isn't passing enough data elements. ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100K/month** | Fix your billing descriptor. Enable 3DS on your highest-dispute product category. Start collecting device fingerprint and IP with every transaction. These three actions cover 80% of the value. | | **$100K-$500K/month** | Add: evidence collection rules by business model. Set up renewal reminder emails. Enable CE 3.0 submission (confirm with your processor). Track CE 3.0 qualification rate monthly. | | **$500K-$1M/month** | Add: selective 3DS on all high-dispute segments (not just high-fraud). Post-purchase activity logging. Monthly evidence audit on lost chargebacks. | | **Over $1M/month** | Automated evidence assembly for representment. Real-time CE 3.0 qualification check when disputes arrive. A/B test 3DS on borderline segments. Dedicated dispute analysis. | ## Where This Breaks - **True third-party fraud.** Someone actually stole the card. No amount of evidence collection helps. The cardholder is the victim. This page is for friendly fraud and grey-area disputes. For stolen card prevention, see [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) and [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting). - **3DS on recurring transactions.** Liability shift applies to the initial authenticated transaction. Renewals are merchant-initiated, so they get none. That's why renewal reminder emails and usage logging matter for subscriptions. - **CE 3.0 cold start.** New businesses have no transaction history to match against. It takes 120+ days of collecting before anything qualifies. Start now, and CE 3.0 protects you in 4-6 months. - **International transactions.** Delivery confirmation standards vary by country. "Delivered" in the US means the carrier confirmed at the address. Elsewhere the last tracking update is "arrived at destination post office." For cross-border, use a carrier that confirms delivery in the destination country. - **Guest checkout and CE 3.0.** No accounts means no account ID to match on. You can still match device fingerprint, IP, and shipping address, but you're down to three elements. Worth asking whether account creation fits your business. - **Over-triggering 3DS.** Put 3DS on everything and your conversion drops. The goal is selective 3DS on high-dispute segments. Test before you widen it. See [3DS Rollout Strategy](/docs/fraud/prevention/3ds#rollout-strategy). --- ## Next Steps **Just getting started?** 1. [Fix your billing descriptor](/docs/chargebacks/prevention/descriptors-and-comms). 10 minutes, prevents 10-20% of disputes. 2. [Enable 3DS on your highest-dispute segment](/docs/fraud/prevention/3ds). Biggest single impact. 3. Confirm your processor is collecting device fingerprint and IP for CE 3.0. **Building your evidence system?** 1. [Set up evidence collection rules](/docs/fraud/detection/building-fraud-rules#rules-that-trigger-evidence-collection). Zero friction, background capture. 2. [Review CE 3.0 requirements](/docs/chargebacks/representment/compelling-evidence#visa-compelling-evidence-30) so you know what data you need. 3. [Audit 10 lost chargebacks](#test-to-run) and find your evidence gaps. **Fighting friendly fraud specifically?** 1. [Understand the pattern](/docs/fraud/types/friendly-fraud). Why customers dispute legitimate purchases. 2. [Design your refund policy](/docs/chargebacks/refund-policy). A refund is cheaper than a chargeback. 3. [Build winning evidence packages](/docs/chargebacks/winning-evidence). What issuers actually look for. --- ## Related - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift implementation and rollout - [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Rules that trigger 3DS and evidence collection - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 details and network requirements - [Winning Evidence](/docs/chargebacks/winning-evidence) - What issuers look for in representment - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Why customers dispute and detection signals - [Refund Policy Design](/docs/chargebacks/refund-policy) - Refund vs. fight decision frameworks - [Refund Strategy](/docs/chargebacks/refund-strategy) - Operational refund decisions - [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms) - Billing descriptor best practices - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device intelligence for CE 3.0 data - [Chargeback Prevention](/docs/chargebacks/prevention) - Full prevention hierarchy - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP ratio and CE 3.0 exclusion - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring billing compliance --- ## EMV & Contactless Source: https://paymentsandrisk.com/docs/fraud/prevention/emv-contactless # EMV & Contactless (Operator Field Manual) :::info[TL;DR] - EMV chip liability shift is live. If your terminal can't read a chip, you're carrying the fraud loss on chip card transactions - Contactless (NFC/tap) uses the same chip security with tokenized credentials. It doesn't raise your fraud risk, whatever you've heard - Fallback to swipe when a chip fails is allowed, but it puts liability back on you. Don't let it happen except on a genuine terminal failure - Contactless spending limits vary by country (typically $50-$200 per tap). Over the limit and you're asking for a PIN or a signature ::: EMV chip cards shifted [fraud liability](/docs/fraud/reference/emv-liability) to whoever didn't support the chip. Contactless adds speed without sacrificing security. Know the liability rules and keep your [terminals](/docs/operations/terminal-operations) compliant. _Last verified: Dec 2025. EMV mandates and contactless limits vary by region, so confirm yours with your acquirer. They aren't universal._ ## What Matters (5 bullets) - **EMV liability shift is live.** Non-chip terminals bear fraud liability for chip cards. - **Contactless uses the same chip security.** NFC transactions get EMV protections. - **Fallback to swipe creates liability.** If the card has a chip and you swipe it, that's on you. - **Contactless limits vary by region.** Above-limit requires PIN or device auth. - **Tokenized wallets (Apple Pay, Google Pay) are even more secure.** Device-bound, biometric. --- ## EMV Chip Basics ### How EMV Works 1. Card inserted into terminal (or tapped for contactless) 2. Chip generates unique cryptogram for this transaction 3. Cryptogram sent with auth request 4. Issuer validates cryptogram 5. Cryptogram can't be reused (prevents replay attacks) ### Why Chip Is Secure | Magnetic Stripe | EMV Chip | |-----------------|----------| | Static data | Dynamic cryptogram | | Easily cloned | Can't be copied | | No transaction binding | Unique per transaction | | Counterfeit-prone | Counterfeit-resistant | --- ## Liability Shift ### The Rule When fraud occurs, liability falls on the party that didn't support EMV: | Card Type | Terminal | Liability | |-----------|----------|-----------| | Chip card | Chip terminal | Issuer | | Chip card | Swipe-only terminal | Merchant | | Non-chip card | Any terminal | Issuer | | Chip card | Chip failed, swipe fallback | Usually merchant | ### Key Dates | Region | Liability Shift Date | |--------|---------------------| | US (non-fuel) | October 2015 | | US (fuel/AFD) | April 2021 | | Europe | 2005-2006 | | Canada | 2011-2012 | | Latin America | Varies by country | ### What This Means If you have: - **Chip-enabled terminals:** Protected from counterfeit liability - **Swipe-only terminals:** Liable for chip card counterfeits - **Fallback transactions:** Need to follow proper procedures --- ## Contactless Payments ### How Contactless Works 1. Card or device tapped on terminal 2. NFC communication (short range, under 4cm) 3. Same EMV chip technology, wireless 4. Cryptogram generated and validated 5. Transaction completes in seconds ### Contactless Methods | Method | Technology | Security | |--------|------------|----------| | Contactless card | Chip via NFC | EMV cryptogram | | Apple Pay | Device token + biometric | EMV + device binding | | Google Pay | Device token + auth | EMV + device binding | | Samsung Pay | MST or NFC | Varies by mode | ### Contactless Transaction Limits Transactions above certain amounts require additional authentication (PIN or device auth): | Region | Typical Limit | Notes | |--------|---------------|-------| | US | No strict limit | CVM threshold varies | | UK | ยฃ100 | Raised from ยฃ45 during COVID | | EU | โ‚ฌ50 typical | Varies by country | | Canada | CAD $250 | Raised during COVID | | Australia | AUD $200 | Higher than most | ### When PIN Is Required Even on contactless, PIN may be required when: - Amount exceeds limit - Cumulative contactless spend exceeds limit - Random PIN verification (issuer-determined) - High-risk merchant category --- ## Fallback Procedures When chip can't be read, fallback to swipe may be allowed, but creates liability. ### Proper Fallback Process 1. **Attempt chip first** - Always try chip read 2. **Second attempt** - Try chip again if first fails 3. **Terminal prompts fallback** - Only after chip failures 4. **Document the reason** - Error log for disputes 5. **Swipe only as last resort** - With proper fallback indicator ### Fallback Red Flags Watch for fraud patterns: - Customer insists on swiping - Chip "doesn't work" but card looks fine - Multiple fallback attempts - High-value fallback transactions ### Fallback Liability - **Proper fallback documented:** Reduced liability (depends on network) - **Forced fallback without chip attempts:** Full merchant liability - **Pattern of fallbacks:** May indicate fraud or terminal issues --- ## Terminal Configuration ### EMV Certification Requirements | Requirement | Purpose | |-------------|---------| | EMV L1 | Physical contact interface | | EMV L2 | Application layer protocol | | EMV L3 | Payment brand certification | | Contactless L1/L2/L3 | NFC interface certification | ### Terminal Checklist - [ ] Chip reader functional - [ ] Contactless reader enabled - [ ] Proper fallback configured - [ ] PIN pad working - [ ] Certification current - [ ] Software up to date ### Common Terminal Issues | Issue | Impact | Fix | |-------|--------|-----| | Chip reader dirty | Failed reads, fallback | Clean regularly | | NFC disabled | No contactless | Enable in settings | | Old firmware | Security gaps | Update software | | PIN pad malfunction | No PIN verification | Repair/replace | --- ## Fraud Prevention Impact ### EMV Effect on Fraud | Fraud Type | Before EMV | After EMV | |------------|------------|-----------| | Counterfeit (CP) | High | Down 75%+ | | Lost/stolen (CP) | Moderate | Unchanged (need PIN) | | Card-not-present | Moderate | Up (fraud migration) | ### Fraud Migration EMV reduced card-present fraud but pushed fraudsters to: - Card-not-present (online) - See [CNP fraud prevention](/docs/fraud/prevention) - [Account takeover](/docs/fraud/types/account-takeover) - [Application fraud](/docs/fraud/types/application-fraud) - Markets without EMV --- ## Apple Pay / Google Pay ### Additional Security Beyond EMV, mobile wallets add: | Feature | Security Benefit | |---------|------------------| | Device binding | Token only works on that device | | Biometric auth | Face ID, fingerprint required | | No card number | Token replaces PAN | | Transaction limit | Can be unlimited with biometric | ### Fraud Rates Mobile wallet transactions typically see: - 50%+ lower fraud than raw cards - Higher approval rates - Fewer false declines ### Merchant Considerations - Accept Apple Pay / Google Pay (no additional cost) - Ensure NFC is enabled on terminals - Train staff on tap-to-pay - Update signage to show acceptance --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Ensure all terminals are EMV-enabled; accept contactless; minimize fallback | | **$100k-$1M/mo** | Monitor fallback rate; track counterfeit chargebacks; terminal maintenance schedule | | **Over $1M/mo** | Terminal fleet management; fallback analysis by location; contactless adoption metrics | --- ## Where This Breaks - **Swipe-only terminals still in use** - Automatic liability for chip card fraud - **Forced fallback by staff** - Creates liability, may indicate collusion - **Disabled contactless** - Missing easy, secure payment option - **Outdated firmware** - Security vulnerabilities - **No PIN preference** - Lost/stolen cards easier to use --- ## Test to Run 1. **Audit all terminals** - Confirm EMV and contactless enabled 2. **Track fallback rate** - Should be under 2% of chip card transactions 3. **Check contactless adoption** - What % of transactions? 4. **Review counterfeit chargebacks** - Are you seeing 10.1/10.2 codes? 5. **Staff observation** - Are proper procedures followed? **Success criteria:** Zero non-EMV terminals, fallback under 2%, no terminal-related chargebacks --- ## Next Steps **Setting up EMV terminals?** 1. [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Hardware selection guide 2. [Terminal Operations](/docs/operations/terminal-operations) - Deployment and management 3. [EMV Liability](/docs/fraud/reference/emv-liability) - Liability shift rules **Optimizing contactless acceptance?** 1. [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Apple Pay, Google Pay integration 2. [Authorization Decisioning](/docs/fraud/detection/authorization-decisioning) - Approval optimization 3. [Auth Optimization](/docs/payments/auth-optimization) - Maximize contactless approvals **Reducing card-present fraud?** 1. [Card-Present Fraud](/docs/fraud/card-present-fraud) - Fraud patterns and prevention 2. [Third-Party Fraud](/docs/fraud/types/third-party) - Stolen card prevention 3. [Terminal Security](/docs/fraud/terminal-security) - Physical security controls ## Related - [Card-Present Fraud](/docs/fraud/types) - Fraud types overview - [Third-Party Fraud](/docs/fraud/types/third-party) - Stolen card usage - [Authorization & Capture](/docs/payments/auth-and-capture) - How card payments work - [Authorization Decisioning](/docs/fraud/detection/authorization-decisioning) - How issuers approve/decline - [Decline Codes](/docs/reference/decline-codes) - Understanding decline reasons - [Terminal Security](/docs/operations) - Operations overview - [Visa 10.1 - EMV Counterfeit](/docs/reference/reason-codes/visa/10-1-emv-counterfeit) - [Visa 10.2 - EMV Non-Counterfeit](/docs/reference/reason-codes/visa/10-2-emv-non-counterfeit) - [Mastercard 4870 - Chip Liability](/docs/reference/reason-codes/mastercard/chip-liability) - [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Apple Pay, Google Pay security - [Card Payments](/docs/payments/payment-methods/cards) - Card fundamentals - [Chargeback Prevention](/docs/chargebacks/prevention) - Preventing disputes --- ## KYC & KYB for Fraud Prevention Source: https://paymentsandrisk.com/docs/fraud/prevention/kyc-kyb # KYC & KYB for Fraud Prevention :::info[TL;DR] - Most merchants under $1M/year don't need dedicated KYC tools. Your processor's built-in fraud tools and [3DS](/docs/fraud/prevention/3ds) handle it. - **Already on Stripe?** [Stripe Identity](https://stripe.com/identity) is your easiest on-ramp - first 50 verifications free, then $1.50/verification, no new vendor relationship. - **Passive KYC** ($0.02-0.50/check) uses data signals - phone, email, SSN, device. Start here when you outgrow processor tools. - **Documentary KYC** ($0.80-5.00/check) adds ID scan + selfie + liveness. Step up to this for high-risk cases only. - **KYB** (Know Your Business) matters if you onboard sellers, sub-merchants, or B2B vendors. - Build proportionally: verify at the level your risk requires, not the level your vendor sells. ::: KYC verifies a person. KYB verifies a business. Most merchants under $1M a year need neither as a separate tool. ## KYC vs. KYB: What's the Difference Most merchants hear "KYC" and think compliance paperwork for banks. That's not the useful version. Someone creates a fake account on your site. They abuse a promo, test stolen cards, or list prohibited goods on your marketplace. That's the problem KYC solves. It's your first line of defense against [fake account signups](/docs/fraud/types/application-fraud), [synthetic identities](/docs/fraud/types/synthetic-identity), and onboarding-stage losses. | | **KYC** (Know Your Customer) | **KYB** (Know Your Business) | |---|---|---| | **Who** | Individual customers or account holders | Businesses, sellers, sub-merchants | | **What you verify** | Name, DOB, address, SSN/ID, face match | Business registration, beneficial owners, EIN, operating status | | **When** | Account opening, high-value transactions, step-up triggers | Seller onboarding, sub-merchant boarding, B2B vendor approval | | **Why (fraud angle)** | Stop synthetic identities, stolen credentials, underage users | Stop shell companies, money laundering fronts, banned merchants | | **Typical cost** | $0.02-5.00/check depending on depth | $2-15/check (more data sources, manual review often needed) | | **Who needs it** | Fintechs (always), marketplaces (for buyers), high-risk e-commerce | Marketplaces, payment facilitators, B2B platforms | **Compliance and fraud are two different reasons to do this.** AML rules require KYC for financial institutions (see [AML basics](/docs/compliance/aml-basics)). You may not be regulated at all. KYC can still pay for itself. You block the bad actors at the door instead of eating chargebacks downstream. ## What You're Defending Against Identity fraud isn't one problem. It's a stack of attacks, each aimed at a different layer of your verification. Which attacks you're exposed to decides which tools you need. | Attack | What Happens | Who's Exposed | What Catches It | |---|---|---|---| | **Fake account signups** | Bots or humans create accounts with throwaway emails and prepaid phones to abuse promos, test stolen cards, or commit [refund fraud](/docs/fraud/types/refund-fraud). | Everyone with public signup flows | Email/phone verification, device fingerprinting, rate limiting | | **Synthetic identities** | Fabricated identities built from a mix of real and fake data (real SSN + fake name). Pass basic checks because parts are real. Build credit, then cash out. | Fintechs, lenders, BNPL, any business extending credit | Synthetic fraud scoring (Socure, SentiLink), multi-signal passive KYC | | **Stolen identities** | A real person's complete identity used by someone else. Obtained from breaches, phishing, or dark web. Passes database checks because data is accurate. | Everyone, but especially high-value account creation | Bank account verification (Plaid), carrier tenure checks (Prove), documentary step-up | | **Forged/deepfake documents** | Fake government IDs generated with AI, or deepfake selfies used to pass biometric verification. Injection attacks feed fake video directly into the verification pipeline. | Anyone using documentary verification | Liveness detection, injection attack detection (iProov, Jumio), document forensics | | **Shell company onboarding** | Fraudulent businesses created to launder money, sell prohibited goods, or commit bust-out fraud on your marketplace. | Marketplaces, payment facilitators, B2B platforms | KYB verification (Middesk, Persona), beneficial ownership checks | | **Credential sharing** | A real person willingly passes verification on behalf of a fraudster. Everything checks out technically. | Account-based businesses, fintechs | Behavioral analytics, ongoing monitoring, velocity checks | **What that means for you.** Most SMB e-commerce merchants are mostly dealing with two things: fake account signups and stolen card data. Processor tools, [3DS](/docs/fraud/prevention/3ds) and basic email/phone verification handle both. You only need a dedicated KYC vendor when you start seeing synthetic identities, a regulator, or seller fraud on your marketplace. Want the full technical breakdown of each attack and who defends against it? See [Identity Verification: What It's Up Against](/docs/fraud/detection/identity-verification#what-identity-verification-is-up-against). ## When You Need KYC (and When You Don't) Not every merchant needs dedicated KYC tools. Here's when you do and don't: | Business Type | Volume | KYC Recommendation | |---|---|---| | Standard e-commerce (physical goods) | Under $1M | **No dedicated KYC.** Processor tools + [3DS](/docs/fraud/prevention/3ds) + [AVS/CVV](/docs/fraud/prevention/avs-cvv) are enough. | | Standard e-commerce | $1M-$10M | **Maybe.** Only if you see repeat fake account patterns or high first-order fraud. Try Stripe Identity first if you're on Stripe, otherwise start with passive checks. | | Digital goods, gift cards, crypto | Any | **Yes.** High-risk categories attract fraud. At minimum, passive KYC on new accounts. | | Subscription/SaaS | Under $5M | **Light.** Email + phone verification at signup. Step up for plan upgrades or payment method changes. | | Fintech, lending, BNPL | Any | **Required.** Regulatory obligation plus high fraud exposure. Full KYC waterfall. | | Marketplace (buyer side) | Any | **Light.** Passive signals at registration. Step up for high-value first purchases. | | Marketplace (seller side) | Any | **KYB required.** You're liable for seller behavior. Verify business identity before they can list or receive payouts. | | Payment facilitator | Any | **KYB required.** Network rules mandate sub-merchant due diligence. | :::tip[Already on Stripe?] **Stripe Identity** is the fastest route to documentary verification if you're already on Stripe. First 50 verifications free, then $1.50/verification (plus $0.50 for optional SSN lookup). No new vendor, no separate integration. It does ID document capture, selfie matching and liveness detection. Same dashboard you already use. On Stripe and thinking about documentary KYC? Start here, before you look at standalone vendors. ::: ### The ROI Math KYC pays when the fraud you stop beats what you spend. Your costs are the verification fees plus the customers you lose to friction. **Example:** You process 10,000 new accounts/month. Fraud rate on new accounts is 2%. Average fraud loss is $150. Monthly fraud cost: 200 accounts x $150 = $30,000. - Passive KYC at $0.15/check = $1,500/month. If it catches 40% of fraud = $12,000 saved. **Net benefit: $10,500/month.** - Documentary KYC on all accounts at $2.00/check = $20,000/month plus 10% abandonment (~$X in lost revenue). Often not worth it at this stage. - Documentary KYC on flagged accounts only (top 10% risk) at $2.00/check = $2,000/month. If it catches an additional 30% = $9,000 saved. **Net benefit: $7,000/month.** The answer is almost always the same. Passive KYC on everyone. Documentary KYC on the high-risk subset. ## Passive KYC: Data-First Verification Passive KYC verifies identity without asking the customer to do anything extra. They enter their normal signup information and that's it. No document uploads, no selfies, no added friction. You send the data to a verification API. Back comes a risk score, or a pass/fail. ### Signal Types | Signal | What It Checks | Fraud It Catches | Cost Range | |---|---|---|---| | **SSN/Identity match** | Does the SSN match the name + DOB + address? Was the SSN issued to a living person? | Synthetic identity, stolen identity, deceased SSN usage | $0.05-0.30 | | **Identity correlation** | Does this phone/email/address actually **belong to this person**, not just "exist"? | Stolen identities (valid elements that don't belong to the same person) | Typically bundled with element-level checks | | **Phone/carrier verification** | Line type (postpaid, prepaid, VoIP), carrier tenure, port history, SIM swap detection | Burner phones, SIM swap, VoIP fraud | $0.05-0.25 | | **Email risk scoring** | Email age, domain reputation, deliverability, social presence, gibberish detection | Disposable emails, bot signups, auto-generated accounts | $0.05-0.15 | | **Device intelligence** | Device fingerprint, emulator detection, proxy/VPN, behavioral analytics | Device farms, spoofing, scripted applications | $0.01-0.10 | | **Synthetic fraud scoring** | Probabilistic model combining credit file velocity, inquiry patterns, SSN analysis, name gibberish detection | [Synthetic identity](/docs/fraud/types/synthetic-identity) | $0.02-0.15 | | **Address verification** | Is this a real address? Residential or commercial? Correctional facility? PO box? Does the applicant actually live here? | Fake addresses, drop shipping, addresses tied to fraud rings | $0.01-0.05 | | **Deceased check** | Is the SSN/identity associated with a deceased person? | Synthetic identities built on deceased persons' data | $0.02-0.10 | | **Bank account verification** | Does this person own this bank account? What's the account history? | Stolen bank credentials, fabricated identities | $1.00-3.00 | ### How Passive KYC Actually Works Three things happen behind the vendor's API: **1. Entity resolution (identity matching).** The vendor matches the PII you sent against known records. This isn't an exact-match lookup. It uses fuzzy matching on names (nicknames, typos, hyphens), address normalization (St. = Street, Apt = Apartment), and weighted scoring across every element. You get back the best-matched identity and a confidence score. **2. Element-level risk scoring.** Each element gets scored on its own. Is this email deliverable? Is this phone prepaid? Was this address recently associated with fraud? Pair a high-risk phone with a low-risk email and a medium-risk address. That combination is the risk profile. **3. Correlation scoring.** This is what separates real KYC from basic data checks. It measures whether the elements **belong to the same person**. A stolen identity can have a valid SSN, a valid phone and a valid email. But the SSN belongs to one person, the phone to another, the email to a third. Correlation scoring catches that. It checks name-to-phone, name-to-email and name-to-address across multiple data sources. **Where the data comes from:** credit bureaus, alternative credit headers (utility and telecom records), government databases (SSA, IRS, DMV), deceased databases, educational institution records, and banking data with consent. More sources generally means better accuracy. It also means a higher cost per check. Ask every vendor what sources they use. It's the biggest thing separating a $0.05 check from a $0.50 check. ### Passive KYC Vendors | Vendor | Strength | Coverage | Est. Cost/Check | Notes | |---|---|---|---|---| | **Socure** | Synthetic fraud detection, multi-signal scoring | US-centric | $0.10-0.50+ | Strongest synthetic ID model in the market. Used by 4 of top 5 US banks. | | **SentiLink** | Synthetic ID scoring specialist | US only | $0.02-0.15 | Does one thing extremely well. Often used alongside other vendors. | | **Prove** | Phone-centric identity (carrier signals, SIM tenure, number history) | Global | $0.05-0.25 | Zero-friction - customer doesn't do anything beyond entering their phone number. | | **Ekata** (Mastercard) | Lightweight API checks - phone, email, address, IP, identity | Global | $0.05-0.30 | Good for adding identity signals without a heavy integration. Acquired by Mastercard in 2021. | | **Trulioo** | Global identity verification (KYC + KYB + AML) | Global (195+ countries) | $0.50-2.00+ | Strong international coverage. Good for cross-border merchants. | | **LexisNexis** | Largest identity data network (Emailage, ThreatMetrix, ID Analytics) | Global | $3.00-8.00+ | Enterprise pricing. Most comprehensive data but expensive. Best when you need the full stack. | ### Plaid: Bank + Identity Combined Plaid gets its own callout. It does something the pure identity vendors don't. A customer links their bank account and you get: - **Account ownership verification** - Is this person's name on the bank account? - **Account history** - How old is the account? What's the balance pattern? - **Identity data** - Name, address, phone, email from the bank's records - **Income signals** - Transaction patterns that indicate real economic activity That's powerful, because **bank data is hard to fake**. You can build a synthetic identity on a fabricated SSN and a burner phone. You can't easily fake a bank account with years of transaction history. The signal quality beats any database check. **The tradeoff:** Plaid charges a ~$500/month platform fee, plus per-verification costs ($1-5+ for a full Identity + Auth flow). The customer has to sit through a bank-linking flow too. That's friction. Best when you already need bank connectivity for ACH or balance checks, and want to layer identity on top. | Use Case | Plaid Worth It? | |---|---| | You already use Plaid for ACH | Yes - add Identity for minimal incremental cost | | High-value accounts (lending, investing) | Yes - bank signal quality justifies friction | | Standard e-commerce checkout | Probably not - too much friction for a purchase | | Marketplace seller onboarding | Maybe - depends on payout method | ## Documentary Verification: ID + Selfie Passive checks aren't always enough. Sometimes your risk model flags someone. Then you step up to documentary verification. The customer uploads a government ID (passport, driver's license) and takes a selfie. The system checks the document is real, unaltered, and matches the person holding it. ### When to Use Documentary Verification - Passive KYC returned an unclear or high-risk result - First transaction exceeds your risk threshold - Account change on a high-value account (new device, new address) - Regulatory requirement (fintech, lending, crypto) - Manual review queue - documentary verification can resolve cases faster than analyst investigation ### The Friction Cost Documentary verification adds real friction. Industry benchmarks: | Metric | Typical Range | |---|---| | Drop-off rate | 5-15% of users abandon during document upload (varies widely by implementation) | | Completion time | 30-90 seconds for document + selfie (some vendors under 10 seconds) | | Auto-approval rate | 70-90% (rest go to manual review or retry; top vendors exceed 90%) | | False rejection rate | 1-5% (real customers incorrectly rejected; leading vendors target under 2%) | That's why you don't run it on every customer. The ROI works when the fraud risk beats the conversion loss. ### Documentary Verification Vendors | Vendor | Est. Cost/Check | Self-Serve? | Best For | Notable | |---|---|---|---|---| | **Stripe Identity** | $1.50/verification (first 50 free) | Yes | Stripe merchants wanting zero new vendors | Built into Stripe. ID scan + selfie + liveness. No separate integration needed. | | **Veriff** | $0.80-1.89 | Yes (published pricing) | SMBs wanting transparent pricing | Most transparent pricing in the market. Video-based verification option. | | **Sumsub** | $1.35+ | Yes (Basic plan) | All-in-one KYC/KYB/AML | 2025 Gartner Leader. 220+ countries. Also offers no-code verification links (no engineering needed). | | **Persona** | $1.50+ (Essential plan) | Yes | Developers, custom workflows | 2025 Gartner Leader. Strong orchestration layer. Also does KYB. | | **Jumio** | $1-5+ | No | Global document coverage | 5,000+ document types across 200+ countries. Enterprise-focused. | | **Onfido** (now Entrust) | $0.50-4+ | No | Fintech, workflow builder | Acquired by Entrust in 2024. Strong AI-based document analysis. | | **Incode** | $1-4+ | No | Latin America, speed | 2025 Gartner Leader. 1.5-second average verification time. | | **Mitek** | $1-4+ | No | Enterprise, strong growth | Named market leader by Datos Insights (Jan 2026). MiPass 4D biometric (face + voice + liveness). | | **Au10tix** | $1-3+ | No | Speed, consortium attack detection | 4-8 second fully automated verification. Consortium of 60+ companies detects coordinated attacks. | | **iDenfy** | $0.50-2+ | Yes | Mid-market, competitive pricing | 3,000+ document types. Includes KYB and AML screening. | | **iProov** | $0.50-2+ | No | Deepfake/liveness specialist | Biometric-only (no document verification). Best injection attack detection in market. | ### The Deepfake Threat AI-generated deepfakes are the fastest-growing attack vector against documentary verification: - US lenders faced $3.3B in exposure to synthetic identity fraud in 2024 (TransUnion) - Injection attacks (feeding fake video directly into the verification pipeline) are up 40% year-over-year (Entrust 2026 Identity Fraud Report) - Roughly 1 in 20 IDV attempts in financial services is fraudulent (Veriff, 2025) - Injection attacks now outnumber presentation attacks (holding up a screen) and bypass basic liveness checks entirely (iProov) **Ask about this on the call.** Say the words "injection attack detection", not just presentation attack detection. Presentation attacks are photo and video replay. iProov and Jumio have both invested heavily here. Cheaper vendors may only catch the presentation kind. ## KYB: Verifying Businesses Do you onboard sellers, sub-merchants or B2B vendors? Then KYB isn't optional. It's how you keep money laundering, fraud and prohibited goods off your platform. ### When You Need KYB | Scenario | KYB Requirement | |---|---| | Marketplace seller onboarding | **Required.** You're liable for seller behavior under network rules. | | Payment facilitator sub-merchants | **Required.** Visa/Mastercard mandate sub-merchant due diligence. | | B2B vendor approval | **Recommended.** Verify legitimacy before extending terms or access. | | Affiliate/partner onboarding | **Light check.** Business registration + basic identity of owner. | ### What to Verify | Check | Why | How | |---|---|---| | **Business registration** | Is this a real, active company? | Secretary of State records, commercial databases | | **Beneficial ownership** | Who actually controls this business? | UBO verification (25%+ owners + control person) | | **EIN/Tax ID** | Does the tax ID match the business? | IRS verification, commercial databases | | **Operating history** | How long has this business existed? | Formation date, web presence, transaction history | | **Sanctions/watchlist** | Is this business or its owners on any lists? | OFAC, PEP, adverse media screening | | **Industry/MCC check** | Is this a prohibited or high-risk business type? | Self-reported + verification against business description | ### KYB Tools | Vendor | Strength | Est. Cost/Check | Notes | |---|---|---|---| | **Middesk** | Business verification specialist | $5-15+ | Purpose-built for KYB. Checks registration, EIN, Secretary of State, liens, bankruptcies. | | **Persona** | KYC + KYB in one platform | $3-10+ | Flexible workflows covering both individual and business verification. | | **Alloy** | Orchestration + KYB | $2-8+ | Combines multiple data sources into unified decisioning. Strong in fintech. | | **Sardine** | Fraud + compliance + KYB | Bundled | KYB is part of broader fraud/compliance platform. Best when you need the full stack. | ### Manual vs. Automated KYB | Volume | Approach | |---|---| | Under 50 sellers/month | Manual review is fine. Pull Secretary of State records yourself. | | 50-500 sellers/month | Automate the standard checks, manual review for edge cases. | | Over 500 sellers/month | You need automated KYB. Manual doesn't scale. | ## Building a Proportional Program The biggest mistake here is over-building. You don't need enterprise-grade identity verification at $3M in annual volume. Build for where you're at today. Not for three years out. ### Verification Waterfall Start with the cheapest, lowest-friction checks. Only step up when the signal warrants it. ```mermaid flowchart TD A[New Account/Transaction] --> B{Risk Score} B -->|Low risk| C[Passive KYC onlyEmail + phone + device] B -->|Medium risk| D[Enhanced passiveSSN match + carrier check] B -->|High risk| E[Documentary verificationID + selfie + liveness] C --> F{Pass?} F -->|Yes| G[Approve] F -->|No/Unclear| D D --> H{Pass?} H -->|Yes| G H -->|No/Unclear| E E --> I{Pass?} I -->|Yes| G I -->|Fail| J[Manual Review or Decline] style A fill:#6366f1,color:#fff style G fill:#10b981,color:#fff style J fill:#ef4444,color:#fff ``` ### By Business Stage | Stage | What to Use | Estimated Monthly Cost | |---|---|---| | **Under $500K/year** | Processor tools + email/phone verification. No dedicated KYC vendor. | $0 (included in processor) | | **$500K-$2M/year** | If on Stripe, try Stripe Identity for documentary step-up on high-risk accounts (first 50 free). Otherwise, add passive KYC (Prove or Ekata for lightweight checks). | $0-500/month | | **$2M-$10M/year** | Passive KYC on all new accounts + documentary step-up for flagged accounts. Consider Socure or SentiLink for synthetic fraud scoring. Sumsub or Veriff for documentary. | $500-3,000/month | | **$10M+ /year** | Full KYC waterfall. Dedicated vendor relationship. Possibly Plaid for bank+ID if ACH is part of your model. KYB if you have sellers. | $3,000-15,000+/month | ### Integration Approach 1. **Start with one vendor.** Don't build a multi-vendor stack until you've exhausted the first one. 2. **Use progressive onboarding.** Collect name, email and phone first. Run passive checks on that. Ask for SSN, ID or selfie only when risk demands it. That keeps friction off your good customers. Verification is a conversation, not a gate. 3. **Shadow mode first.** Run the checks in parallel for 2-4 weeks, blocking nobody. Measure what it would have caught. 4. **Set thresholds before you launch.** Decide your pass/fail/review cutoffs before seeing results. Otherwise you'll rationalize whatever happens. 5. **Measure abandonment.** Track signup completion before and after KYC. If abandonment spikes more than fraud drops, you've over-verified. 6. **Build escalation paths, not dead ends.** A customer fails passive verification. Offer documentary as a step-up, don't decline them. This matters most for thin-file people: young adults, recent immigrants. They can fail data-based checks and still pass documentary easily. 7. **Re-evaluate quarterly.** Your fraud mix changes. Your KYC program should too. ## Common Mistakes | Mistake | Why It's Wrong | What to Do Instead | |---|---|---| | **Verifying every customer with documentary KYC** | 5-15% abandonment on customers who were never going to defraud you | Passive first, documentary only on high-risk | | **Buying enterprise KYC at SMB volume** | LexisNexis at $3-8/check when you process 500 accounts/month is $1,500-4,000/month for a problem that costs you less | Start with Prove ($0.05-0.25) or Ekata ($0.05-0.30) | | **Using KBA as primary verification** | Knowledge-based authentication is broken. Data breaches compromised most KBA answers years ago. | Use KBA as a secondary signal at most | | **Skipping ongoing monitoring** | Identity verified at onboarding doesn't mean the account stays clean | Periodic re-verification on high-risk accounts, monitor for behavior changes | | **Ignoring KYB for marketplace sellers** | You're liable for seller fraud and prohibited goods. Network rules require sub-merchant due diligence. | KYB before first listing goes live | | **Building a multi-vendor stack too early** | Three vendors at $2M volume = expensive plumbing, not better fraud detection | One vendor, tuned well, beats three vendors poorly integrated | | **Not measuring friction impact** | You blocked $5K in fraud but lost $20K in abandoned signups | Always A/B test KYC flows and track conversion | | **Ignoring false rejections on thin-file populations** | Young adults, recent immigrants, and people without credit history fail passive checks at higher rates - you're rejecting real customers | Build documentary step-up paths so thin-file customers can verify via ID + selfie instead of getting declined | | **Checking elements without correlation** | "Does this phone exist?" is a different question from "Does this phone belong to this person?" Element-level checks alone miss stolen-identity fraud where every element is valid but belongs to different people | Choose vendors that provide identity correlation (name-to-phone, name-to-email, name-to-address), not just element-level validation | ## Next Steps **Starting from zero?** 1. [Measure your current fraud exposure](/docs/fraud/metrics) - Know what KYC needs to solve 2. [Understand identity verification methods](/docs/fraud/detection/identity-verification) - Passive, documentary, biometric 3. [Check if you have regulatory requirements](/docs/compliance/aml-basics) - AML/BSA obligations **Adding KYC to an existing fraud program?** 1. [Design your verification waterfall](#verification-waterfall) - Least to most friction 2. [Pick your stage](#by-business-stage) - Don't over-build 3. [Evaluate vendors](/docs/fraud/vendors/landscape#identity-verification) - Compare options **Need KYB for marketplace/platform?** 1. [Determine what to verify](#what-to-verify) - Registration, UBO, sanctions 2. [Choose manual vs. automated](#manual-vs-automated-kyb) - Based on volume 3. [Select a KYB vendor](#kyb-tools) - Middesk, Persona, Alloy, or Sardine --- ## See Also - [Identity Verification](/docs/fraud/detection/identity-verification) - Methods, vendor comparison, and attack vectors - [Synthetic Identity Fraud](/docs/fraud/types/synthetic-identity) - What KYC catches - [Account Fraud](/docs/fraud/types/application-fraud) - Fake signups, multi-accounting, onboarding-stage fraud - [AML Basics](/docs/compliance/aml-basics) - Regulatory KYC/CDD/EDD requirements - [Data Enrichment](/docs/fraud/detection/data-enrichment) - Lightweight email, phone, IP signals (cheaper than full KYC) - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Step-up triggers for verification - [Fraud Vendors](/docs/fraud/vendors/landscape) - Full vendor landscape - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device-based identity signals - [3D Secure](/docs/fraud/prevention/3ds) - Authentication as fraud prevention --- ## Risk Scoring Source: https://paymentsandrisk.com/docs/fraud/prevention/risk-scoring # Risk Scoring :::info[TL;DR] - **Risk score**: a 0-100 number for how likely fraud is. Use it to split traffic into auto-approve, review and auto-decline - **Rules**: email domain, velocity, geo mismatch. Transparent, fast to deploy, catches known patterns - **ML**: complex patterns, novel fraud. Needs data science people and labeled training data - **Best approach**: combine both. [Rules](/docs/fraud/detection/rules-vs-ml) for known fraud, ML for the subtle stuff - **Threshold tuning**: run A/B tests. Price a false positive against a fraud loss. Adjust quarterly ::: A risk score is just a number. The question is whether it helps you decide better. Your thresholds are bets. You're trading blocked good customers for blocked fraud. The "right" threshold depends on your margins, your fraud rate, and how many complaints you can stomach. :::tip[Experiment to Run: Score Threshold Sweep] **Run 3 cutoffs in parallel on small slices of traffic:** - Segment A: Score under 30 auto-approve, 30-60 review, over 60 auto-block - Segment B: Score under 40 auto-approve, 40-70 review, over 70 auto-block - Segment C: Score under 50 auto-approve, 50-80 review, over 80 auto-block **Metrics:** Fraud loss + review cost + estimated false positive cost (use average order value ร— block rate ร— estimated good customer %) **Run length:** 4 weeks. Chargebacks need time to show up **Decision:** Pick the cutoff with lowest total cost. Probably not the tightest one. ::: ## What Is a Risk Score? A risk score is a number on each transaction. It says how likely fraud is. Higher score, higher risk. ```mermaid flowchart TD A[TransactionReceived] --> B[CollectSignals] B --> C[RulesEngine] B --> D[MLModel] C --> E[RulesScore] D --> F[MLScore] E --> G[CombinedRisk Score] F --> G G --> H{ScoreLevel?} H -->|0-30| I[AutoApprove] H -->|31-70| J[ManualReview] H -->|71-100| K[AutoDecline] J --> L{ReviewerDecision} L -->|Approve| I L -->|Decline| K style I fill:#22c55e,color:#fff style J fill:#f59e0b,color:#fff style K fill:#ef4444,color:#fff ``` **Common scales:** - 0-100 (higher = riskier) - 0-1000 (more granular) - 0-1 probability (true probability) **How it's used:** ``` Score 0-30: Auto-approve Score 31-70: Manual review Score 71-100: Auto-decline ``` The thresholds depend on your risk tolerance, margins and review capacity. They aren't magic numbers. Every one is a trade-off between catching fraud and wrongly declining good customers. ## Rules-Based Scoring A rule is an explicit condition that moves a transaction's score up or down. ### How Rules Work Each rule checks a condition, then nudges the score: ``` IF email_domain = "tempmail.com" THEN +30 IF shipping_country != billing_country THEN +15 IF customer_has_previous_orders > 5 THEN -10 IF device_seen_on_fraud_before = true THEN +50 IF amount > $500 THEN +10 ``` Final score = base score + sum of all triggered rules. ### Types of Rules **Identity rules:** - Email validity: deliverable, disposable domain, recently created. - Phone number validation against the carrier. - Name consistency across the data you've got. **Transaction rules:** - Order amount, since high value means higher risk. - Product category, since some categories run hot. - Shipping method, since expedited is riskier. - Billing and shipping address mismatch. **[Behavioral rules](/docs/fraud/detection/behavioral-analytics):** - Time to checkout, since too fast means bot. - Session behavior: copy-paste against actual typing. - Failed attempts before one finally succeeds. **[Velocity rules](/docs/fraud/detection/velocity-rules):** - Orders per IP per hour. - Cards per email per day. - Shipping addresses per card per week. **[Device/network rules](/docs/fraud/detection/device-fingerprinting):** - Proxy or VPN on the session. - [Device fingerprint](/docs/fraud/detection/device-fingerprinting) seen on fraud before. - Geolocation against billing country, the thing [AVS](/docs/fraud/prevention/avs-cvv) checks. ### Rules: Pros and Cons **Pros:** - Transparent, so you know why a transaction flagged. - Controllable: you can adjust for a new pattern today. - Explainable enough to satisfy customers, banks and auditors. - No training data required. **Cons:** - Reactive: you write the rule after you've seen the fraud. - Brittle, because fraudsters learn your rules and adapt. - High maintenance, because rule sets don't stay small. - Blind to the subtle correlations a model would catch. ## Machine Learning Scoring ML models read your transaction history to find patterns that predict fraud. Including patterns nobody could write as a rule. ### How ML Scoring Works 1. **Training:** Model is fed historical transactions labeled as fraud/legitimate 2. **Learning:** Model identifies features and patterns correlated with fraud 3. **Scoring:** For new transactions, model outputs fraud probability 4. **Feedback loop:** New fraud outcomes are fed back to improve the model ### Types of ML Models **Supervised learning:** - Learns from labeled examples: this was fraud, this wasn't. - The most common approach for fraud scoring. - It won't work without clean labeled history. **Unsupervised learning:** - Finds anomalies without any labels at all. - Useful for catching brand new fraud types. - Higher false positive rate than supervised. **Neural networks:** - Finds complex, non-linear patterns nothing else sees. - Black box, so explaining one score is harder. - It doesn't work without a lot of data. ### ML: Pros and Cons **Pros:** - Adaptive, because it learns new fraud patterns on its own. - Scalable to millions of transactions with no rule updates. - It catches correlations a person would never spot. **Cons:** - Black box, so you can't explain one decision easily. - Data hungry, and it won't train without labeled history. - Cold start, so it's poor until the data arrives. - It'll learn the biases in your history too. ## Combining Rules and ML The systems that work best run both: ``` Transaction arrives โ†“ Rules evaluate (known patterns) โ†“ ML model evaluates (complex patterns) โ†“ Scores combined โ†“ Decision + explanation ``` **Why both?** - Rules catch known, obvious fraud instantly. - ML catches emerging patterns and subtle signals. - Rules explain what the model just flagged. - ML cuts down your rule maintenance load. ### Cold Start Strategy When you're launching, or short on data: 1. **Lean on rules at launch.** They work with no training data. 2. **Give ML more weight** as labeled outcomes pile up. 3. **Don't switch rules off when ML arrives.** Feed rule hits to the model as labels. 4. **Push chargeback outcomes back in.** That's how the model improves. ### Example Combined System ``` Rule: Shipping to known fraud address โ†’ +70 points Rule: Email domain is disposable โ†’ +20 points Rule: Customer has 3+ successful orders โ†’ -15 points ML score: 0.35 (35% fraud probability) โ†’ +35 points ___________ Final score: โ†’ 110 points โ†’ DECLINE ``` ## Setting Thresholds Your threshold strategy depends on: | Factor | Lower Thresholds (stricter) | Higher Thresholds (looser) | |--------|----------------------------|---------------------------| | Margin | Low margin (can't absorb fraud) | High margin (can absorb some fraud) | | Product | Physical goods (lost forever) | Digital (can revoke access) | | [Chargeback](/docs/chargebacks) ratio | Near [network thresholds](/docs/chargebacks/reference/network-programs) | Comfortable buffer | | Customer experience | Less important | Critical to business | | Review capacity | Large review team | Limited/no review team | ### The Trade-Off Curve Your thresholds pick a point on the ROC curve. That's Receiver Operating Characteristic. - **Lower threshold** = catch more fraud, decline more good customers - **Higher threshold** = approve more good customers, let through more fraud There's no "correct" threshold. It depends on what your business can tolerate. AUC, precision, recall and F1 help you find the balance. The call is still a business call. ### Three-Tier Strategy **Tier 1: Auto-approve (low scores)** - Fast for the customer, no manual work for you. - You accept some fraud slipping through. **Tier 2: Manual review (middle scores)** - A human takes the ambiguous ones. - You can ask for extra verification. - It costs real money per order reviewed. **Tier 3: Auto-decline (high scores)** - Blocks the obvious fraud outright. - It'll cost you some good customers too. - Offer an alternative payment method instead. ### Finding Your Thresholds Those "approve below 40, decline above 70" recommendations are someone else's guess. Here's how to find yours: **1. Calculate your cost of false positive:** ``` Average order value ร— Gross margin ร— Probability customer never returns ``` If your AOV is $100, margin is 30%, and 50% of blocked customers never return: $100 ร— 0.3 ร— 0.5 = $15 per false positive **2. Calculate your cost of fraud:** ``` Average fraud amount + Chargeback fee + Operational cost ``` If average fraud is $150, CB fee is $25, ops cost is $10: $185 per fraud **3. Find the break-even:** At what threshold does the cost of false positives equal the cost of fraud prevented? **4. Test your hypothesis:** Set thresholds based on your calculation. Run for 30 days. Measure actual costs. Adjust. :::warning[Where This Can Fool You] - **Score calibration:** A score of 80 should mean 80% of those transactions are fraud. Check if yours does. Many vendor scores aren't well-calibrated. - **Score drift:** Model performance degrades over time. Re-test quarterly. - **Feedback loops:** never tell the model what was actually fraud and it goes stale. Make sure chargeback outcomes flow back. ::: ## Key Metrics **Fraud detection rate (True Positive Rate / Recall):** What percentage of actual fraud did you catch? ``` Fraud detected / Total fraud ร— 100 ``` **False positive rate:** What percentage of good transactions were wrongly declined? ``` Good transactions declined / Total good transactions ร— 100 ``` **Precision:** Of transactions you flagged as fraud, how many actually were? ``` True fraud flagged / All transactions flagged ร— 100 ``` **Review rate:** What percentage of transactions go to manual review? ``` Transactions in review / Total transactions ร— 100 ``` Ideal: high detection, low false positives, a review rate you can staff. ## Building vs. Buying **Build your own:** - Full control of the rules and the models. - You can tune for your own fraud patterns. - You need data science people on staff. - You'll own the maintenance forever. **Buy a solution:** - Faster to stand up. - The vendor sees fraud across many merchants. - Less control of the scoring logic. - A per-transaction cost that scales. **Hybrid:** - Vendor for the ML and consortium data. - Your own rules layered on top. - The right answer for most merchants. ## Vendor Landscape **Note:** this space moves fast. Judge vendors on your own stack, geography and risk profile. | Category | Examples | |----------|----------| | Standalone fraud platforms | Forter, Riskified, Signifyd, SEON | | Processor-integrated | Stripe Radar, Adyen Risk, Checkout.com FDP | | Identity/device | Kount, ThreatMetrix, BioCatch | | Rules engines | Splunk, Datadog (DIY) | ## Do You Need ML Scoring? Most SMBs don't need a dedicated ML scoring engine. Here's a quick decision framework: | Your Situation | Do You Need ML? | Why | |----------------|-----------------|-----| | **Under $1M/month** | **No.** | If you're on Stripe, Radar IS your ML - it's included free. Adyen's RevenueProtect and Shopify's built-in tools also use ML under the hood. You already have it. | | **$1M-$5M/month, 10+ manual rules, 2+ hours/week maintaining them** | **Maybe.** | When your rule set gets unwieldy and you're spending more time tuning rules than running your business, a dedicated scoring tool can automate what rules can't catch. | | **Over $5M/month or seeing fraud patterns your rules consistently miss** | **Yes.** | At this volume, novel fraud patterns slip past static rules. ML adapts to patterns you haven't written rules for yet. | :::tip[The Practical Answer] You don't have to choose between rules and ML. Start with rules. They're free in Stripe Radar, Adyen and most processor tools. When rules plateau, add ML. Plateau means you keep adding rules and fraud still gets through. That usually happens between $2M and $5M a month, not before. ::: ## Next Steps **Just getting started with scoring?** 1. Use your processor's built-in scoring โ†’ Stripe Radar, Adyen Risk, etc. 2. Define three buckets โ†’ Auto-approve, review, auto-decline 3. Track your false positive rate โ†’ Customer complaints are the signal **Tuning your thresholds?** 1. Run the threshold sweep experiment (see top of page) โ†’ Data beats intuition 2. Segment by transaction type โ†’ Different thresholds for different products 3. Track fraud rate AND false positive rate โ†’ Optimize the tradeoff, not just one metric **Building custom scoring?** 1. [Review rules vs. ML tradeoffs](/docs/fraud/detection/rules-vs-ml) โ†’ Know when to use which 2. Start with rules on known patterns โ†’ ML for novel detection 3. Invest in feature engineering โ†’ Good features beat complex models --- ## See Also - [Fraud Model Feedback](/docs/fraud/detection/fraud-model-feedback) - How ML learns from your data, score drift, monitoring - [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Starter rules, allow/block lists, rule lifecycle - [Rules vs ML](/docs/fraud/detection/rules-vs-ml) - Choosing detection approaches - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Detecting abuse patterns - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP, email, phone signals that feed scores - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Tracking devices across sessions - [Behavioral Analytics](/docs/fraud/detection/behavioral-analytics) - How users interact - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address and card verification - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and liability shift - [Manual Review](/docs/fraud/detection/manual-review) - Human investigation process - [Fraud Metrics](/docs/fraud/metrics) - Measuring detection performance - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Processor-level rules - [Fraud Vendors](/docs/fraud/vendors/landscape) - Third-party scoring tools - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence playbook - [Experimentation](/docs/reference/experimentation) - Testing score thresholds --- ## Processor Rules Configuration Source: https://paymentsandrisk.com/docs/fraud/processor-rules-configuration # Processor Rules Configuration :::info[TL;DR] - Default processor fraud rules are tuned for average merchants - they'll over-block some of your good customers and under-block some fraud patterns specific to your business - Start with a rules audit: what percent of blocked transactions are legitimate? Above 1-2% of total transactions, you're losing more to false positives than to fraud - Build rules in shadow mode first (log the decision, don't enforce it) before flipping them live - one bad rule can tank auth rates overnight - Review rules monthly against your actual false positive and catch data. What worked at $100K/month won't hold at $500K/month ::: Processor rules configuration is the process of customizing the fraud block, allow, review, and 3DS rules built into tools like Stripe Radar, Braintree Fraud Protection, and Adyen RevenueProtect. Default settings are tuned for average merchants, which means they block too much good revenue or let too much [fraud](/docs/fraud/types/third-party) through for your specific business. This page covers how to configure each major processor's fraud tools, build custom rules, and tune them monthly using false positive and fraud catch data. ## What Matters 1. **Defaults are conservative.** Processors don't want [fraud](/docs/fraud) on their platform, so they block aggressively. 2. **[False positives](/docs/fraud/prevention/risk-scoring#the-trade-off-curve) cost more than you think.** Every blocked good customer is lost revenue plus the acquisition cost you've already paid. See [economics of fraud](/docs/fraud/fundamentals/economics). 3. **Custom rules beat default [ML](/docs/fraud/detection/rules-vs-ml) for your edge cases.** Processors see patterns across merchants, but they don't know your business. 4. **[3DS](/docs/fraud/prevention/3ds) can shift liability.** Use it strategically, not everywhere. See [first-time 3DS setup](/docs/playbooks/first-time-3ds-setup). 5. **Monitor and tune continuously.** One-time setup doesn't work. Track your [fraud metrics](/docs/fraud/metrics). --- ## Understanding Processor Fraud Tools ### What Processors Offer | Processor | Fraud Tool | Included? | ML Scoring? | |-----------|------------|-----------|-------------| | **Stripe** | Radar | Radar Lite included, Standard / Plus / Pro are paid tiers | Yes | | **Braintree** | Fraud Protection | Basic included, Advanced extra | Yes | | **Adyen** | RevenueProtect | Included | Yes | | **Square** | Basic built-in | Included | Limited | | **PayPal** | Built-in screening | Included | Yes | | **Authorize.net** | Advanced Fraud Detection Suite | Extra cost | Limited | ### What the ML Does Processor [ML models](/docs/fraud/detection/rules-vs-ml) score transactions based on: - [Device fingerprint](/docs/fraud/detection/device-fingerprinting) - IP geolocation and [velocity](/docs/fraud/detection/velocity-rules) - Card metadata (issuer, country, [BIN](/docs/reference/glossary)) - Email patterns (see [identity verification](/docs/fraud/detection/identity-verification)) - [Behavioral signals](/docs/fraud/detection/behavioral-analytics) - Cross-merchant data (what they've seen from this card elsewhere) The score is typically 0-100 (higher = riskier) or a risk level (high/medium/low). See [risk scoring](/docs/fraud/prevention/risk-scoring) for threshold strategies. ### What You Control | Control Type | Examples | Learn More | |--------------|----------|------------| | **Block rules** | Block if IP country != billing country | [Velocity rules](/docs/fraud/detection/velocity-rules) | | **Allow rules** | Allow if customer has 3+ prior orders | [Risk scoring](/docs/fraud/prevention/risk-scoring) | | **Review rules** | Review if [risk score](/docs/fraud/prevention/risk-scoring) > 75 | [Manual review](/docs/fraud/detection/manual-review) | | **[3DS](/docs/fraud/prevention/3ds) rules** | Require 3DS if order > $500 | [3DS setup](/docs/playbooks/first-time-3ds-setup) | | **[Velocity](/docs/fraud/detection/velocity-rules) limits** | Block if > 3 transactions from this card in 1 hour | [Card testing](/docs/fraud/types/card-testing) | --- ## Stripe Radar Configuration Stripe's Radar is the most commonly used processor fraud tool for SMBs. ### Default Behavior Radar blocks transactions when its ML model predicts high fraud risk. You don't control the ML, but you control rules that run on top of it. ### Radar Rule Types | Type | What It Does | When Triggered | |------|--------------|----------------| | **Block** | Declines transaction immediately | Before auth | | **Allow** | Bypasses other rules | Before other rules | | **Review** | Marks for manual review | After auth | | **3DS** | Requires 3D Secure | Before auth | ### Useful Starter Rules **Block rules:** ``` # Block mismatched countries Block if :ip_country: != :card_country: # Block high velocity Block if :total_charges_per_card_number_hourly: > 3 # Block risky email patterns Block if :email_domain: in ('tempmail.com', 'guerrillamail.com') ``` **Allow rules:** ``` # Allow existing customers Allow if :customer_id: != null AND :total_charges_per_customer_id_all_time: >= 3 # Allow repeat cards Allow if :total_charges_per_card_number_all_time: >= 2 ``` **3DS rules:** ``` # 3DS for high-value Request 3D Secure if :amount_in_usd: > 500 # 3DS for high risk Request 3D Secure if :risk_score: > 65 ``` ### The Paid Radar Tiers :::warning["Radar for Fraud Teams" is not a product you can buy] A product called Radar for Fraud Teams still gets quoted at $0.02 per screened transaction, $0.07 on Connect platforms. That name appears nowhere on Stripe's Radar page, pricing page or docs as of 4 August 2026, and neither does the $0.02 figure. Wherever you find it, it's pricing a discontinued SKU. Source: [stripe.com/radar](https://stripe.com/radar) and [stripe.com/radar/pricing](https://stripe.com/radar/pricing), verified 2026-08-04. ::: Stripe now sells Radar in four tiers: **Lite, Standard, Plus and Pro**. Radar Lite is included with Stripe Payments at no extra charge. Standard, Plus and Pro are monthly subscriptions, each with a fixed fee that includes a set allowance of screens per transaction, per active account, and per customer, with a pay-as-you-go option if you'd rather pay per screen. **What they cost.** US list, read 4 August 2026: | Tier | For your business | Platforms and marketplaces | |---|---|---| | **Standard** | From $10/mo | From $20/mo | | **Plus** | From $14/mo | From $44/mo | | **Pro** | From $20/mo | From $70/mo | Each tier includes a screen allowance. Past it you're on pay-as-you-go, which starts at **$0.05 per screened transaction**. You can take pay-as-you-go on its own instead if your volume is low or unpredictable. What the paid tiers add over Lite: - Custom rule builder with more attributes - Manual review queue - Block and allow lists - Advanced analytics Worth pricing if you're over $500k/mo or have complex fraud patterns. :::note[Ask Your Dev] "Which Radar tier are we on: Lite, Standard, Plus or Pro? What Radar rules do we currently have, and what does the subscription cost us per month?" ::: --- ## Braintree Configuration Braintree's fraud tools are part of Braintree Gateway. ### Basic Fraud Protection Included with Braintree: - [AVS](/docs/fraud/prevention/avs-cvv) mismatch blocking - [CVV](/docs/fraud/prevention/avs-cvv) mismatch blocking - Duplicate transaction detection - [Risk threshold](/docs/fraud/prevention/risk-scoring) configuration ### Advanced Fraud Protection Paid add-on with: - [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) - [ML risk scoring](/docs/fraud/detection/rules-vs-ml) - Custom [velocity rules](/docs/fraud/detection/velocity-rules) - Kount integration option (see [fraud vendors](/docs/fraud/vendors)) ### Key Settings to Configure | Setting | Recommendation | |---------|----------------| | **AVS response handling** | Block on full mismatch, allow partial | | **CVV response handling** | Block on mismatch | | **Risk threshold** | Start at "Approve" for low/medium, "Review" for high | | **Duplicate transaction window** | 30 seconds | ### Braintree Custom Rules Via Control Panel > Fraud Management: ``` # Example: Block international for domestic business Rule: Card Country NOT equals US Action: Decline # Example: Review high-value Rule: Transaction Amount greater than 1000 Action: Review ``` --- ## Adyen RevenueProtect Configuration Adyen's fraud tool is included but needs configuration. ### Risk Profiles Adyen uses "Risk Profiles" that group settings by business type: - E-commerce - Retail - Subscription - Digital goods Start with the profile matching your business, then customize. ### Key Configuration Areas | Area | What to Set | |------|-------------| | **Risk scoring** | Set thresholds for accept/review/block | | **Velocity checks** | Transactions per card/email/IP per hour/day | | **AVS/CVV handling** | Decline vs. review on mismatch | | **3DS triggers** | Amount thresholds, risk levels | | **Block/Allow lists** | Cards, emails, IPs | ### Adyen RevenueProtect Rules Via Customer Area > Risk: 1. Select profile 2. Add rules in order (first match wins) 3. Test with simulation before live --- ## 3DS Configuration Strategy 3D Secure adds an authentication step. Configure it strategically. ### When to Require 3DS | Trigger | Why | |---------|-----| | High transaction amount (> $500) | High value = higher risk tolerance | | High-risk score | Adds friction only for risky transactions | | International transactions | Cross-border fraud is higher | | First transaction with new card | No history to trust | | Mismatched shipping/billing | Common fraud signal | ### When to Skip 3DS | Trigger | Why | |---------|-----| | Returning customer with history | Trust is established | | Low-value transaction ( 500 Request 3D Secure if :risk_score: > 65 ``` **Braintree:** ``` 3DS Required when: Amount > 500 AND Risk = High 3DS Optional when: Amount > 200 AND Customer new ``` ### 3DS1 vs 3DS2 If you're still on 3DS1, upgrade. 3DS2 supports frictionless authentication (no customer challenge for low-risk), which dramatically reduces conversion impact. :::note[Ask Your Dev] "Are we on 3DS1 or 3DS2? What's our frictionless rate?" ::: --- ## Common Mistakes ### Mistake 1: Never Touching Defaults Default settings are calibrated for the average merchant. If you're higher-risk, you'll get more fraud. If you're lower-risk, you'll block good customers. **Fix:** Review and customize within 30 days of launch. ### Mistake 2: Blocking Too Aggressively Overly strict rules block good customers. A blocked good customer costs you: - The transaction revenue - Future LTV - Acquisition cost wasted - Potential bad review **Fix:** Start with review instead of block. Analyze what you're blocking. ### Mistake 3: Not Monitoring Rule Performance A rule that worked in January may hurt in July. Traffic patterns change. **Fix:** Monthly review of: - Rule trigger rates - False positive estimates - Fraud that got through ### Mistake 4: One-Size-Fits-All 3DS Requiring 3DS on everything kills conversion. Skipping 3DS on everything invites fraud. **Fix:** Risk-based 3DS triggers. ### Mistake 5: No Allow Rules for Good Customers If a repeat customer triggers a risk rule, they shouldn't be blocked. **Fix:** Allow rules for trusted customers before block rules. --- ## Rule Tuning Process ### Monthly Review 1. **Pull fraud losses** - What got through that shouldn't have? 2. **Pull block rates** - What are we blocking? 3. **Sample blocked transactions** - Were they actually fraud? 4. **Calculate false positive rate** - Blocked good / Total blocked 5. **Adjust rules** - Tighten where fraud is high, loosen where false positives are high ### Tuning Example **Problem:** Rule "Block if IP country != card country" is blocking 5% of transactions. **Analysis:** - Pull sample of 50 blocked transactions - Contact 10 customers from blocked list - 8 of 10 were legitimate (travelers, VPN users) - False positive rate: 80% **Solution:** move it from Block to Review, add an exception for known VPN ASNs, or make it a 3DS trigger instead. Blocking isn't your only option. --- ## Test to Run **2-week fraud rules audit:** **Week 1: Discovery** - Document all current rules - Pull rule trigger rates for past 30 days - Pull fraud losses for past 30 days - Identify top 5 rules by trigger volume **Week 2: Optimization** - Sample blocked transactions for false positive analysis - Add allow rules for repeat customers - Convert highest-FP block rules to review - Add 3DS for high-risk instead of block **Success criteria:** False positive rate decreases. Fraud rate doesn't increase. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Use processor defaults, add basic velocity rules, require 3DS over $500. Review isn't worth your time at this volume. | | **$100k-$1M/mo** | Custom rules for your top fraud patterns. Monthly rule review. Price a paid Radar tier (Standard, Plus or Pro) or an equivalent from your processor. | | **Over $1M/mo** | Dedicated fraud rules person or vendor. Real-time monitoring. A/B testing of rule changes. Multi-layer fraud stack. | --- ## Where This Breaks 1. **High-risk categories with sophisticated fraud.** Gift cards, electronics resale, cryptocurrency. Processor tools alone won't cut it. You need specialized fraud vendors. 2. **Marketplaces and platforms.** Fraud comes from sellers as well as buyers, and processor tools only see the buyer side. That's why you need platform-level detection. 3. **International with local payment methods.** Processor tools are optimized for cards. Local methods (iDEAL, Boleto, etc.) need different fraud approaches. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Block rate** | How much you're declining | 80% | ### Rule Performance Dashboard Track for each rule: - Trigger count (how often it fires) - Block/review/allow breakdown - Fraud caught (confirmed fraud among blocked) - False positives (legitimate among blocked) - Revenue impact ### Processor Rule Performance Analysis Build a monthly rule effectiveness report: | Rule | Triggers | Blocks | Reviews | Fraud Caught | False Positives | FP Rate | |------|----------|--------|---------|--------------|-----------------|---------| | High amount | 500 | 100 | 400 | 25 | 75 | 75% | | IP mismatch | 300 | 50 | 250 | 20 | 30 | 60% | | Velocity | 200 | 100 | 100 | 80 | 20 | 20% | **Analysis questions:** 1. Which rules have highest FP rate? โ†’ Candidates for loosening 2. Which rules catch the most fraud? โ†’ Keep tight 3. Which rules have low trigger rates? โ†’ Maybe unnecessary 4. What fraud gets through? โ†’ Need new rules ### Rule ROI Calculation For each rule, calculate: ``` Rule Value = (Fraud Blocked ร— Avg Fraud Loss) - (False Positives ร— Avg LTV Lost) ``` **Example: High-amount block rule** - Fraud blocked: 25 transactions ร— $200 avg = $5,000 saved - False positives: 75 transactions ร— $500 LTV = $37,500 lost - **Rule ROI: -$32,500** โ†’ This rule is losing money ### Optimization Priorities | FP Rate | Fraud Catch Rate | Action | |---------|------------------|--------| | High | High | Convert to review, investigate each | | High | Low | Remove or significantly loosen | | Low | High | Keep as-is, maybe tighten | | Low | Low | Remove, not adding value | ### A/B Testing Rules For rule changes: 1. **Split traffic** - 10% gets new rule, 90% keeps old 2. **Run for 2 weeks** - Need enough volume 3. **Compare outcomes** - Fraud rate, block rate, revenue 4. **Validate significance** - Is the difference real? 5. **Roll out or revert** - Based on data --- ## Next Steps **Setting up processor rules?** 1. [Understand what processors offer](#understanding-processor-fraud-tools) - ML and rule options 2. [Configure Stripe Radar](#stripe-radar-configuration) - Block, allow, review, 3DS 3. [Set 3DS strategy](#3ds-configuration-strategy) - When to require, when to skip **Tuning existing rules?** 1. [Follow monthly review process](#monthly-review) - Pull fraud, blocks, samples 2. [Avoid common mistakes](#common-mistakes) - Never touching defaults, blocking too aggressively 3. [Calculate rule ROI](#rule-roi-calculation) - Fraud saved vs LTV lost **Advanced optimization?** 1. [Build rule performance dashboard](#rule-performance-dashboard) - Track each rule 2. [A/B test rule changes](#ab-testing-rules) - Split traffic validation 3. [Set optimization priorities](#optimization-priorities) - FP rate vs catch rate --- ## Related Pages - [Fraud Prevention](/docs/fraud/prevention) - Prevention strategies - [3DS Optimization](/docs/fraud/prevention/3ds) - Authentication tuning - [Auth Optimization](/docs/payments/auth-optimization) - Approval rates - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate-based detection - [Fraud Vendors](/docs/fraud/vendors) - Third-party tools - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Score thresholds - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP, email, phone signals to supplement processor rules - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Digital identity - [Manual Review](/docs/fraud/detection/manual-review) - Review queues - [Checkout Conversion](/docs/payments/checkout-conversion) - Friction balance - [Fraud Metrics](/docs/fraud/metrics) - Measuring effectiveness - [Experimentation](/docs/reference/experimentation) - Testing rules --- ## EMV Liability Shift Source: https://paymentsandrisk.com/docs/fraud/reference/emv-liability # EMV Liability Shift :::info[TL;DR] - The rule is simple: the party with weaker technology bears the fraud loss - if your terminal doesn't support chip and a chip card is used fraudulently, you pay - The shift covers counterfeit fraud only - lost/stolen card fraud liability is separate and depends on whether PIN verification was used - Chip-and-PIN offers better protection than chip-and-signature for lost/stolen scenarios; contactless NFC transactions are generally treated as chip-equivalent - ATM liability shifted in 2017; most US terminals have completed the upgrade, but check your terminal's certification status if you're on older hardware ::: EMV chip technology shifted counterfeit fraud liability. The party with weaker security pays for fraud. If your terminal doesn't support chip and a chip card is used fraudulently, you're liable. Understanding liability shift helps you make informed decisions about terminal upgrades and transaction handling. ## How Liability Shift Works ### The Basic Rule **Liability falls on the party with less secure technology.** | Merchant Has | Card Has | Liability | |--------------|----------|-----------| | Chip terminal | Chip | Issuer | | Chip terminal | No chip (mag-stripe) | Issuer | | No chip terminal | Chip | **Merchant** | | No chip terminal | No chip | Issuer | ### Pre-EMV (Before October 2015) Before liability shift: - Issuer liable for most card-present fraud - Merchant could swipe any card - Counterfeit cards worked at any terminal ### Post-EMV (After October 2015) After liability shift: - If merchant could have used chip but didn't โ†’ merchant liable - If issuer could have issued chip but didn't โ†’ issuer liable - Counterfeit chip cards much harder to create --- ## What "Chip Terminal" Really Means Having a terminal with a chip slot isn't enough. To get liability shift: ### Requirements | Requirement | Why It Matters | |-------------|----------------| | **EMV-capable terminal** | Hardware must support chip | | **EMV enabled** | Chip must be activated, not disabled | | **EMV certification** | Terminal must be certified by networks | | **Chip used on transaction** | Must actually dip/tap, not swipe | ### Common Mistakes | Mistake | Result | |---------|--------| | Chip terminal but EMV not enabled | No liability shift | | Customer swipes chip card | No liability shift | | Fallback to swipe after chip error | Partial protection (varies) | | Keyed entry | No liability shift | --- ## Transaction Types and Liability ### Chip Dip (Contact EMV) - Card inserted into chip slot - Most secure for card-present - Full liability shift to issuer for counterfeit ### Contactless (Tap) - Card or device tapped on terminal - Uses EMV technology - Liability shift applies - Includes Apple Pay, Google Pay (tokenized) ### Swipe (Mag-Stripe) - Magnetic stripe read - No liability shift if chip card - Acceptable for non-chip cards - Falling back to swipe loses protection ### Keyed (Manual Entry) - Numbers typed manually - No chip or swipe - **Never gets liability shift** - Highest risk transaction type --- ## Fallback Transactions When chip fails and you fall back to swipe: ### What Causes Fallback | Cause | Frequency | |-------|-----------| | Dirty/damaged chip | Common | | Terminal chip reader issue | Common | | Card chip malfunction | Occasional | | Fraud attempt (manipulated card) | Rare | ### Fallback Liability Rules | Scenario | Liability | |----------|-----------| | **First fallback** | Often protected (varies by network) | | **Repeated fallback same card** | Loses protection | | **Fallback after chip read failed** | Some protection | | **Fallback without attempting chip** | No protection | ### Fallback Best Practices 1. **Always attempt chip first** 2. **Re-insert chip if first attempt fails** 3. **Clean chip reader regularly** 4. **Request different card if repeated failure** 5. **Document fallback reasons** --- ## Reason Codes for Liability Shift Disputes ### Visa | Code | Name | When Used | |------|------|-----------| | **10.5** | Visa Fraud Monitoring Program | High fraud merchant | **Note:** Visa consolidated fraud codes. EMV liability disputes filed under fraud category with specific data elements indicating liability shift claim. ### Mastercard | Code | Name | When Used | |------|------|-----------| | **4870** | Chip Liability Shift - Counterfeit | Chip card used at non-chip terminal | | **4871** | Chip Liability Shift - Lost/Stolen | Chip card lost/stolen, used at non-chip terminal | ### Amex | Code | Name | When Used | |------|------|-----------| | **F30** | EMV Counterfeit | Counterfeit chip card | | **F31** | EMV Lost/Stolen/NRI | Lost, stolen, or never received | ### Discover | Code | Name | When Used | |------|------|-----------| | **UA05** | Fraud - Chip Card | EMV counterfeit | | **UA06** | Fraud - Chip Card Lost/Stolen | EMV lost/stolen | --- ## Fighting EMV Liability Chargebacks ### When You Can Win | Scenario | Defense | |----------|---------| | **Chip was actually used** | Provide chip transaction receipt showing EMV data | | **Terminal is certified** | Provide EMV certification documentation | | **Card wasn't chip-enabled** | BIN data showing non-chip card | | **Technical malfunction documented** | Terminal logs showing forced fallback | ### When You'll Likely Lose | Scenario | Why | |----------|-----| | **Swiped a chip card** | Didn't use available technology | | **Keyed a transaction** | No verification at all | | **EMV not enabled** | Configuration issue = your fault | | **Repeated fallback** | Pattern suggests avoidance | ### Evidence to Collect | Evidence | Purpose | |----------|---------| | **Transaction receipt** | Shows entry method (chip/swipe/keyed) | | **Terminal certification docs** | Proves EMV capability | | **Terminal batch report** | Shows transaction details | | **Chip data (ARQC/TC)** | Cryptographic proof of chip use | --- ## Contactless and Mobile Wallet Liability ### Mobile Wallets (Apple Pay, Google Pay) | Factor | Liability Implication | |--------|----------------------| | **Tokenized** | Token represents card, not actual number | | **Device authentication** | Biometric or PIN on device | | **Liability** | Generally shifts to issuer | Mobile wallet transactions typically provide strong liability protection because: - Token is device-bound - Requires device authentication - Transaction includes device data ### Contactless Cards | Factor | Liability Implication | |--------|----------------------| | **EMV contactless** | Uses chip technology wirelessly | | **Liability shift** | Yes, same as chip dip | | **Fraud rate** | Generally low | --- ## Special Cases ### Card-Present but Keyed Sometimes you have the card but can't dip/swipe: - Damaged chip and mag-stripe - Reader malfunction - Phone order with card in hand **Liability:** Still yours. Network rules don't care why you keyed. **Best practice:** If chip and swipe both fail, request different payment method or decline transaction. ### Hotel and Rental Pre-Authorization | Scenario | Liability | |----------|-----------| | **Initial auth (check-in)** | Chip used = protected | | **Incremental auth** | May not require card-present | | **Final capture** | Based on original auth | Hotels and rentals have special rules allowing delayed/incremental charges. Liability depends on original authorization method. ### Recurring Transactions | Scenario | Liability | |----------|-----------| | **Initial chip transaction** | Protected | | **Subsequent recurring** | MIT (merchant-initiated) rules apply | | **Stored credential** | Based on original capture method | Recurring billing after initial chip transaction generally maintains protection, but rules are complex. Check with your processor. --- ## Terminal Compliance ### EMV Certification Process | Step | Description | |------|-------------| | **1. Hardware** | Terminal must support EMV | | **2. Software** | EMV application loaded | | **3. L2 certification** | Network-specific testing | | **4. L3 certification** | Processor/acquirer testing | | **5. Deployment** | Activated in production | ### Maintaining Compliance | Action | Frequency | |--------|-----------| | **Firmware updates** | As released | | **Certification renewals** | Per network requirements | | **Security patches** | Immediately | | **Reader cleaning** | Weekly minimum | ### Terminal Inspection Checklist - [ ] Chip slot clean and unobstructed - [ ] No overlays on chip slot or PIN pad - [ ] Tamper-evident seals intact - [ ] Firmware current - [ ] EMV enabled (not bypassed) --- ## Regional and Network Variations ### Visa - Liability shift effective October 2015 (US) - Gas stations extended to April 2021 - Specific rules for quick service restaurants ### Mastercard - Similar timeline to Visa - Specific rules for certain MCCs - Standin processing rules ### American Express - Liability shift effective October 2015 - SafeKey (3DS) for CNP liability - Different rules for OptBlue merchants ### Discover - ProtectBuy for authentication - Similar chip liability rules - Smaller issuer base --- ## Future: Tap-to-Phone Emerging technology allows phones to act as terminals: | Factor | Status | |--------|--------| | **Technology** | Phone accepts contactless payments | | **Certification** | Network programs exist (Visa Tap to Phone, etc.) | | **Liability shift** | Generally applies | | **Security** | Software-based security model | Watch this space for evolving rules. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $50k/mo CP** | Ensure terminals are EMV-enabled. Don't overthink. | | **$50k-$250k/mo CP** | Monitor fallback rates. Clean readers regularly. | | **$250k-$1M/mo CP** | Track liability shift chargebacks. Investigate patterns. | | **Over $1M/mo CP** | Dedicated terminal management. Regular certification audits. | --- ## Where This Breaks 1. **Assuming chip = protected.** Terminal must be certified AND EMV enabled AND chip actually used. Check all boxes. 2. **Ignoring fallback rates.** High fallback rates signal terminal issues and potential liability gaps. Monitor and fix. 3. **Keyed transactions for "convenience."** Every keyed transaction is liability exposure. Minimize ruthlessly. --- ## Next Steps **Understanding liability shift?** 1. [Card-Present Fraud](/docs/fraud/card-present-fraud) - CP fraud types and prevention 2. [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Operational guide for chip payments 3. [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Terminal selection **Fighting EMV chargebacks?** 1. [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Understand dispute timelines 2. [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Build your defense 3. [Representment](/docs/chargebacks/representment) - Response strategies **Optimizing terminal operations?** 1. [Terminal Operations](/docs/operations/terminal-operations) - Managing terminal fleet 2. [Terminal Security](/docs/fraud/terminal-security) - Physical security controls 3. [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Contactless wallet benefits ## Related Pages - [Card-Present Fraud](/docs/fraud/card-present-fraud) - CP fraud types and prevention - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Choosing terminals - [Terminal Operations](/docs/operations/terminal-operations) - Managing terminal fleet --- ## Terminal Security Source: https://paymentsandrisk.com/docs/fraud/terminal-security # Terminal Security :::info[TL;DR] - Daily terminal inspections are the single most effective thing you can do. Skimming devices go on and come off within 24-48 hours. A daily check catches them - Two attack vectors matter most. Physical security covers one: locked mounts, tamper-evident seals. Network segmentation covers the other, with terminals on their own VLAN - P2PE-validated terminals drop your PCI scope to SAQ P2PE. That's a big compliance win, and it's worth the hardware cost if you're Level 1, or if PCI is eating real time - Employee theft is uncommon, and it's the easiest of these to catch because the pattern shows up in your own reports. Limit keyed-entry permissions and audit high-value transactions separately ::: Someone wants the card data moving through your terminal, and they can get at it physically with a skimmer, a shimmer, or a swapped terminal. The other route is your network, where POS malware and stolen credentials do the same job. Most of it's preventable. Daily inspections, a segmented network, trained staff. If you only ever do one of those, do the inspection. This page covers the threats, the checklists, and the response. ## The Threat Landscape ```mermaid flowchart TD subgraph Physical["Physical Attacks"] P1[Skimmers] P2[Shimmers] P3[Overlay devices] P4[Terminal swap] end subgraph Network["Network Attacks"] N1[POS malware] N2[Man-in-the-middle] N3[Credential theft] end subgraph Internal["Internal Threats"] I1[Employee tampering] I2[Social engineering] end Physical --> D[Card DataCompromise] Network --> D Internal --> D style D fill:#ef4444,color:#fff ``` ### Attack Types by Frequency | Attack | How Common | Detection Difficulty | Typical Loss | |--------|------------|---------------------|--------------| | **Skimmers/overlays** | Common | Medium (visual inspection) | High | | **POS malware** | Common | Hard (no visible signs) | Very High | | **Employee theft** | Uncommon | Easy (patterns visible) | Medium | | **Terminal swap** | Rare | Medium | High | | **Shimmers** | Growing | Hard (hidden inside) | High | --- ## Physical Attacks ### Skimmers **The attack:** A device sits over or near the card slot and captures magnetic stripe data on every swipe. **Types:** | Type | Where Installed | What It Captures | |------|-----------------|------------------| | **Overlay skimmer** | Over card slot | Mag stripe data | | **Pinhole camera** | Near keypad | PIN entry | | **Keypad overlay** | Over keypad | PIN entry | | **Internal skimmer** | Inside terminal | Mag stripe data | **Detection:** ``` Daily terminal inspection: โ–ก Wiggle the card slot - is it loose or different? โ–ก Check for unusual bumps or additions โ–ก Compare to a known-good terminal photo โ–ก Look for tiny holes (camera placement) โ–ก Feel the keypad - does it seem thicker? โ–ก Check for anything blocking the tamper labels ``` ### Shimmers **The attack:** Paper-thin devices go INTO the chip slot, where they intercept chip card data. **Why they're dangerous:** - Not visible from outside - Can capture chip data - Only detected by card reading issues **Detection:** - Cards feel tight or don't insert smoothly - Increased chip read failures - Look inside slot with flashlight ### Terminal Swap **The attack:** An attacker swaps your terminal for a modified one that looks identical, isn't, and captures everything. **Prevention:** - Secure terminals physically (bolts, cables) - Serial number inventory - Tamper-evident seals - Regular serial number verification --- ## POS Malware POS malware reads card data out of terminal memory, before encryption ever touches it. ### How It Works ```mermaid flowchart LR A[Card swiped] --> B[Data in memorybriefly unencrypted] B --> C[Malware captures] C --> D[Exfiltrates data] B --> E[Normal processing] style C fill:#ef4444,color:#fff ``` **The vulnerability window:** The card gets swiped, and for a moment the data sits unencrypted in terminal memory before it moves on to the processor. Malware grabs it in that gap. ### Common POS Malware Families | Malware | How It Spreads | What It Does | |---------|----------------|--------------| | **Backoff** | Remote access exploit | Memory scraping | | **PoSeidon** | Phishing, weak RDP | Memory scraping + keylogging | | **RawPOS** | Supply chain, infected updates | Memory scraping | | **TreasureHunter** | Phishing | Memory scraping, exfiltration | ### How Malware Gets In | Vector | How to Prevent | |--------|----------------| | **Weak remote access** | Disable RDP, use VPN, strong auth | | **Phishing** | Employee training, email filtering | | **Supply chain** | Verify software sources, signed updates | | **Weak passwords** | Strong credentials, no defaults | | **Unpatched systems** | Regular patching | --- ## Prevention: Network Security ### Segment Your Payment Network **Payment terminals should be on their own network segment:** ``` Internet | [Firewall] | โ”œโ”€โ”€ Corporate network (workstations, email) โ””โ”€โ”€ Payment network (terminals only) | [Payment terminals] ``` **Why this matters:** - Malware on a workstation can't reach terminals - Limits lateral movement - Easier to monitor ### Terminal Network Rules ``` Payment network segment rules: โ–ก No internet access except to processor IPs โ–ก No inbound connections from corporate network โ–ก No peer-to-peer between terminals (usually) โ–ก Logging all traffic in and out โ–ก Whitelist only necessary ports (usually 443) ``` ### Secure Remote Access If terminals need remote management: | Do | Don't | |----|-------| | VPN with MFA | Direct RDP exposure | | Whitelisted IPs | "Open to internet" | | Session recording | Unmonitored access | | Individual accounts | Shared credentials | --- ## Prevention: Physical Security ### Terminal Placement | Placement | Risk Level | Why | |-----------|------------|-----| | Fixed, visible counter | Low | Staff can monitor | | Fixed, low visibility | Medium | Harder to watch | | Mobile (customer hands) | Medium | Out of sight briefly | | Unattended (kiosk) | High | No supervision | ### Physical Controls ``` Physical security checklist: โ–ก Terminals bolted or cabled to counter โ–ก Tamper-evident seals on terminal housing โ–ก Serial number documented and verified โ–ก Daily visual inspection (opening, closing) โ–ก Surveillance camera covering terminal โ–ก Staff trained on what to look for ``` ### Tamper Detection Most modern terminals have tamper detection: - Opens housing = terminal bricks - Movement detection alerts - Mesh protecting internals **Check:** Is your terminal's tamper detection enabled and monitored? --- ## E2EE vs. P2PE Both encrypt card data at the terminal. The difference is validation and scope reduction. ### E2EE (End-to-End Encryption) **How it works:** The terminal encrypts the card data before it ever hits your network. You can't decrypt it. **Limitation:** Not validated by PCI SSC. Doesn't automatically reduce PCI scope. ### P2PE (Point-to-Point Encryption) **How it works:** E2EE, validated by the PCI Security Standards Council. **Benefit:** A validated P2PE solution cuts your PCI scope hard. SAQ P2PE instead of SAQ D. ### Comparison | Factor | E2EE | P2PE (validated) | |--------|------|------------------| | Encryption at terminal | Yes | Yes | | You can decrypt | No | No | | PCI SSC validated | No | Yes | | Scope reduction | Maybe | Guaranteed | | Cost | Lower | Higher | | Device options | More | Fewer | **Recommendation:** P2PE validation is worth the premium if you're Level 1. Same if PCI is eating real time. See [E2EE vs P2PE](/docs/payments/reference/e2ee-vs-p2pe) for detailed comparison. --- ## Employee Training Your staff are your first line of defense. They're also the threat. That's why keyed-entry permissions get limited and high-value transactions get audited separately. ### What Staff Should Know ``` Staff training checklist: โ–ก How to inspect terminals (daily) โ–ก What skimmers and overlays look like โ–ก Who to report suspicious activity to โ–ก Never let unknown technicians access terminals โ–ก Verify technician identity (call company directly) โ–ก Don't plug unknown USB devices into POS systems โ–ก Report unusual terminal behavior ``` ### Social Engineering Red Flags | Scenario | Red Flag | |----------|----------| | "I'm from [processor], here to update your terminal" | Unscheduled visit | | "I need to install this update on your register" | Unknown software | | "Give me your terminal to check something" | Taking terminal away | | "I need your admin password to fix an issue" | Password request | **Rule:** Verify every technician by calling your processor or vendor directly. Use a number you already have, not the one they hand you. --- ## Incident Response ### Signs of Compromise | Signal | What It Might Mean | |--------|-------------------| | Cards getting declined that usually work | Terminal issue or tampering | | Customer complaints of fraud after visiting | Card data stolen at your location | | Card brand notification of fraud cluster | Common Point of Purchase (CPP) identified | | Terminal behaving strangely | Possible malware | | Unknown network traffic from payment segment | Exfiltration attempt | ### If You Suspect Compromise ``` Immediate actions: โ–ก Stop using the suspected terminal โ–ก Preserve evidence (don't wipe or reset) โ–ก Document everything observed โ–ก Contact your processor โ–ก Check other terminals for similar issues โ–ก Review recent transactions for patterns โ–ก Start Breach Response if confirmed ``` See [Breach Response Playbook](/docs/playbooks/breach-response) for full incident response. --- ## Terminal Inspection Checklist Use this daily (opening and closing): ``` Visual Inspection: โ–ก Terminal looks same as yesterday? โ–ก No new devices attached? โ–ก Card slot feels normal? โ–ก Keypad feels normal thickness? โ–ก No unusual holes or additions? โ–ก Tamper seals intact? โ–ก Serial number matches inventory? โ–ก Cable connections secure? Functional Check: โ–ก Terminal powers on normally? โ–ก Test transaction works? โ–ก No unusual screens or messages? โ–ก Receipts printing correctly? ``` **Tip:** Photograph your terminals and keep the photos somewhere secure. --- ## Test to Run **Terminal security audit (monthly):** ``` Network: โ–ก Are terminals on segmented network? โ–ก What IPs can terminals reach? โ–ก Is remote access secured (VPN, MFA)? โ–ก When was terminal software last updated? Physical: โ–ก Are terminals physically secured? โ–ก Are tamper seals in place and intact? โ–ก Serial numbers match inventory? โ–ก Staff trained on inspection? Encryption: โ–ก What encryption method (E2EE, P2PE)? โ–ก Is it working (test transaction)? โ–ก When were encryption keys last rotated? ``` --- ## Scale Callout | Business Type | Focus | |---------------|-------| | **Single location, staffed** | Daily inspection, basic network hygiene | | **Multiple locations** | Centralized monitoring, regular audits, standardized config | | **Unattended terminals (kiosks)** | Heavy physical security, cameras, more frequent inspection | | **High-value transactions** | P2PE, network segmentation, enhanced monitoring | | **Franchise/distributed** | Training consistency, compliance verification, audit program | --- ## Where This Breaks 1. **Unattended terminals.** Kiosks and unattended payment points are high-risk. Physical security, cameras, and frequent inspection are essential. 2. **Third-party access.** Technicians, cleaners, and delivery people can all access terminals. Verify identities and supervise access. 3. **Old terminals.** Legacy terminals may lack tamper detection, encryption, or security updates. Replacing them is cheaper than the breach. 4. **Franchisee compliance.** A franchisor owns the brand risk. Your franchisees' terminal security is part of it, so audit and enforce. --- ## Next Steps **Basic security?** 1. Implement daily inspection โ†’ Use the checklist above 2. Segment your network โ†’ Isolate payment systems 3. Train your staff โ†’ What to look for, who to call **Upgrading security?** 1. Evaluate P2PE โ†’ [E2EE vs P2PE](/docs/payments/reference/e2ee-vs-p2pe) 2. Add monitoring โ†’ Network traffic, terminal health 3. Regular audits โ†’ Monthly using the checklist **Had an incident?** 1. Start breach response โ†’ [Breach Response Playbook](/docs/playbooks/breach-response) 2. Preserve evidence โ†’ Don't reset or wipe 3. Contact processor โ†’ They'll guide investigation --- ## See Also - [Card-Present Fraud](/docs/fraud/card-present-fraud) - CP fraud patterns - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Choosing terminals - [E2EE vs P2PE](/docs/payments/reference/e2ee-vs-p2pe) - Encryption comparison - [PCI DSS Compliance](/docs/compliance/pci-dss) - Compliance requirements - [Breach Response Playbook](/docs/playbooks/breach-response) - Incident response - [Terminal Operations](/docs/operations/terminal-operations) - Day-to-day terminal management - [Processor Management](/docs/operations/processor-management) - Working with your processor --- ## Account Takeover (ATO) Source: https://paymentsandrisk.com/docs/fraud/types/account-takeover # Account Takeover (ATO) :::info[TL;DR] - **Account takeover (ATO)** = Unauthorized access to a legitimate customer's account - Attack vectors: credential stuffing, phishing, SIM swapping, session hijacking - Detect via impossible travel, new device + password change, sudden behavior shift - Prevent with [MFA](/docs/fraud/detection/identity-verification), [device fingerprinting](/docs/fraud/detection/device-fingerprinting), breached password checks - Different from [credential sharing](#ato-vs-credential-sharing) (customer gave access) and account selling ::: When fraudsters gain control of legitimate customer accounts. The account owner is a victim here, not a [friendly fraud](/docs/fraud/types/friendly-fraud) case. ## Definition Account takeover occurs when an unauthorized party gains access to and control of a legitimate user's account, typically through stolen credentials, social engineering, or technical exploits. ## Attack Vectors ### Credential-Based | Method | Description | |--------|-------------| | **Credential stuffing** | Automated login attempts using breached credentials | | **Phishing** | Deceptive emails/sites capturing credentials | | **Password spraying** | Common passwords across many accounts | | **Brute force** | Systematic password guessing | ### Social Engineering | Method | Description | |--------|-------------| | **Vishing** | Phone calls impersonating support | | **SIM swapping** | Taking over victim's phone number | | **Support manipulation** | Tricking agents into account access | | **Social media mining** | Gathering info for security questions | ### Technical Exploits | Method | Description | |--------|-------------| | **Session hijacking** | Stealing active session tokens | | **Malware** | Keyloggers, info stealers | | **Man-in-the-middle** | Intercepting communications | ## The ATO Timeline ```mermaid flowchart TD A[1. Credential acquisition\nbreach, phishing, etc.] --> B[2. Account access\nsuccessful login] B --> C[3. Account changes\nemail, phone, password, address] C --> D[4. Monetization\npurchases, transfers, fraud] D --> E[5. Lockout\nvictim can no longer access] ``` ## Detection Indicators ### Login Anomalies | Signal | Risk Level | |--------|------------| | New device + new location | ๐Ÿ”ด High | | Impossible travel (login from distant locations in short time) | ๐Ÿ”ด High | | Login from known proxy/VPN | โš ๏ธ Medium | | Login at unusual time | โš ๏ธ Medium | | Failed attempts followed by success | โš ๏ธ Medium | ### Account Change Anomalies | Signal | Risk Level | |--------|------------| | Password change + email change | ๐Ÿ”ด High | | Phone number change | โš ๏ธ Medium | | New shipping address added immediately before purchase | ๐Ÿ”ด High | | Payment method added from different IP | ๐Ÿ”ด High | ### Transaction Anomalies | Signal | Risk Level | |--------|------------| | First transaction in months + high value | ๐Ÿ”ด High | | Purchase category differs from history | โš ๏ธ Medium | | Rapid successive transactions | ๐Ÿ”ด High ([velocity](/docs/fraud/detection/velocity-rules)) | | Gift card purchases (unusual for customer) | ๐Ÿ”ด High (high-risk [MCC](/docs/reference/mcc-codes)) | ## Prevention Stack ### Layer 1: Credential Protection | Control | Implementation | |---------|----------------| | Strong passwords | Minimum length, complexity, breached password checking | | [MFA](/docs/fraud/detection/identity-verification) | TOTP preferred over SMS | | Password manager support | Allow long, complex passwords | | Credential stuffing protection | Rate limiting, CAPTCHA | ### Layer 2: Access Monitoring | Control | Implementation | |---------|----------------| | Login anomaly detection | New device, new location, impossible travel | | Session monitoring | Duration, activity patterns | | [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) | Track known vs. new devices | | [Behavioral analytics](/docs/fraud/detection/behavioral-analytics) | Typing patterns, navigation | ### Layer 3: Response Capabilities | Control | Implementation | |---------|----------------| | Account lockout | After suspicious activity | | Step-up authentication | Re-verify on high-risk actions | | Customer notification | Alert to unusual activity | | Quick recovery | Verified customer can regain access | --- ## Authentication Best Practices ### MFA Hierarchy | Method | Security Level | User Experience | |--------|----------------|-----------------| | Hardware keys (FIDO2) | Highest | Complex setup | | Authenticator apps | High | Moderate setup | | Push notifications | Medium | Easy | | SMS OTP | Medium | Easy but vulnerable to [SIM swapping](#social-engineering) | | Email OTP | Lower | Easy but vulnerable | ### Session Management Checklist - Reasonable timeout (15-60 min idle) - Absolute timeout (8-24 hours) - Secure cookie flags (HttpOnly, Secure, SameSite) - Session binding (device, IP where appropriate) - Single session option (one device at a time) - Session revocation capability --- ## ATO Response Playbook ### Immediate Response (0-1 hour) 1. Lock affected account(s) 2. Invalidate all sessions 3. Notify customer via verified channel 4. Preserve evidence 5. Block attacker identifiers (IP, device) ### Short-Term (1-24 hours) 1. Assess scope (other accounts affected?) 2. Reverse unauthorized transactions (see [refund strategy](/docs/chargebacks/refund-strategy)) 3. Reset credentials via secure process 4. Provide customer guidance ### Long-Term 1. Analyze attack vector 2. Strengthen controls (see [fraud prevention](/docs/fraud/prevention)) 3. Update [velocity rules](/docs/fraud/detection/velocity-rules) 4. Document findings for future prevention ## ATO vs. Credential Sharing :::note[Gray Area] Distinguish between: - **ATO (fraud)**: Unauthorized access, victim unaware - **Credential sharing**: Customer gave credentials to someone - **Account selling**: Customer sold access intentionally Response differs significantly based on the scenario. ::: ## Next Steps **Setting up ATO protection?** 1. [Implement MFA](/docs/fraud/detection/identity-verification) - Start with authenticator apps 2. [Add device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Track known devices 3. [Set up behavioral analytics](/docs/fraud/detection/behavioral-analytics) - Detect anomalies **Responding to ATO attack?** 1. [Follow the response playbook](#ato-response-playbook) - Immediate lockdown 2. [Review velocity rules](/docs/fraud/detection/velocity-rules) - Catch patterns 3. [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Link related accounts **Preventing credential attacks?** 1. [Add breached password checking](#layer-1-credential-protection) - Block known compromised passwords 2. [Implement rate limiting](#credential-based) - Stop credential stuffing 3. [Train on social engineering](#social-engineering) - Protect support channels --- ## See Also - [Third-Party Fraud](/docs/fraud/types/third-party) - Other unauthorized use patterns - [Data Enrichment](/docs/fraud/detection/data-enrichment) - SIM swap detection, phone port history, email age - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Tracking devices across sessions - [Identity Verification](/docs/fraud/detection/identity-verification) - Confirming customer identity - [Behavioral Analytics](/docs/fraud/detection/behavioral-analytics) - Detecting behavior anomalies - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern-based detection - [Evidence Framework](/docs/fraud/detection/evidence-framework) - Tier 1/Tier 2 indicators - [Chargebacks from ATO](/docs/chargebacks) - Handling disputes from account takeover - [3D Secure](/docs/fraud/prevention/3ds) - Step-up authentication for suspicious activity - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining fraud signals - [Manual Review](/docs/fraud/detection/manual-review) - ATO case investigation - [Survive Fraud Attack](/docs/playbooks/survive-fraud-attack) - Emergency response - [Card Testing](./card-testing.md) - Related attack pattern - [Business Banking ATO](/docs/fraud/types/business-banking-ato) - When attackers target your business bank account (different attack surface, fewer protections) --- ## ACH Fraud Source: https://paymentsandrisk.com/docs/fraud/types/ach-fraud # ACH Fraud :::info[TL;DR] - **ACH fraud** = Unauthorized bank debits or fraudulent payment redirects - Different from card fraud: returns happen days later, liability rules differ, no chargeback system - **BEC (Business Email Compromise)** is the biggest ACH threat: $2.9B lost in 2023 - Verification tools (Plaid, MX) help but don't eliminate risk - Return windows: 60 days for unauthorized consumer (R10), 2 banking days for corporate unauthorized (R29) - Prevention: verify bank ownership, validate payee identity, implement dual authorization ::: ACH fraud works differently than card fraud. The timing is slower, the liability is murkier, and the biggest threat doesn't even touch your payment system. ## ACH vs. Card Fraud ```mermaid flowchart LR subgraph Card["Card Fraud"] C1[Transaction] --> C2[Instant declineor approval] C2 --> C3[Chargeback in30-120 days] end subgraph ACH["ACH Fraud"] A1[Transaction] --> A2[Settlement in1-3 days] A2 --> A3[Return possible2-60+ days] end style C2 fill:#22c55e,color:#fff style A2 fill:#f59e0b,color:#fff ``` | Factor | Card Fraud | ACH Fraud | |--------|------------|-----------| | Real-time authorization | Yes | No | | Instant decline possible | Yes | No (settles first) | | Dispute timeline | 60-120 days | 2-60 days | | Liability framework | Clear (network rules) | Murky (Reg E, UCC, NACHA) | | Fraud detection tools | Mature | Limited | | Liability shift available | Yes (3DS) | No | --- ## Types of ACH Fraud ### 1. Business Email Compromise (BEC) **The biggest ACH threat.** $2.9 billion in losses in 2023 (FBI IC3 report). BEC doesn't hack your payment system. It tricks your employees into making legitimate-looking payments to fraudsters. | BEC Variant | How It Works | |-------------|--------------| | **Invoice fraud** | Fake or modified vendor invoice with fraudster's bank details | | **CEO impersonation** | "Urgent" email from "CEO" requesting wire/ACH payment | | **Vendor impersonation** | Email from compromised vendor requesting updated bank info | | **Payroll redirect** | Employee "requests" direct deposit change to fraudster account | | **Lawyer impersonation** | Fake attorney requesting payment for confidential matter | **Detection signals:** - Email domain slightly off (acme-inc.com vs. acmeinc.com) - Urgency pressure ("must send today") - Request to bypass normal approval process - New or changed bank account details - Request to keep transaction confidential **Prevention:** - Verify bank changes by phone (using known number, not email signature) - Dual authorization for payments above threshold - Payment verification callbacks for new vendors - Email security (DMARC, SPF, DKIM) - Employee training on BEC tactics ### 2. Unauthorized Account Debits Someone debits a bank account without authorization. The account holder files a return. | Scenario | How It Happens | |----------|----------------| | Stolen account credentials | Fraudster obtains routing/account numbers | | Account takeover | Fraudster takes over victim's account, initiates ACH | | Subscription abuse | Company continues billing after cancellation | | Identity theft | Fraudster opens account in victim's name | **Return codes you'll see:** - R10: Customer advises unauthorized (consumer) - R29: Corporate customer advises not authorized - R07: Authorization revoked ### 3. Return Manipulation Legitimate customer initiates payment, then claims unauthorized to get money back. This is ACH's version of "[friendly fraud](/docs/fraud/types/friendly-fraud)": - Customer authorized the payment - Customer received goods/services - Customer claims "unauthorized" to reverse payment **Challenge:** proving authorization is harder for ACH than cards. There's no 3DS, no CVV, no signature. ### 4. Push Payment Fraud Victim is tricked into sending money to fraudster's account. Unlike unauthorized debits (pulls), push payments are initiated by the victim, so they're nearly impossible to recover. | Scenario | Example | |----------|---------| | Romance scam | Victim sends money to fake romantic interest | | Investment scam | Victim invests in fake opportunity | | Overpayment scam | Victim "refunds" overpayment from fake check | **Your exposure:** If you're a platform facilitating person-to-person transfers, push payment fraud can hit your reputation and create regulatory scrutiny. --- ## ACH Return Codes That Signal Fraud | Return Code | Meaning | Fraud Signal? | |-------------|---------|---------------| | **R01** | Insufficient funds | Usually not fraud | | **R02** | Account closed | Could be stolen account | | **R03** | No account / unable to locate | Fake account number | | **R04** | Invalid account number | Typo or fake | | **R07** | Authorization revoked | Customer cancellation | | **R08** | Payment stopped | Customer dispute | | **R10** | Customer advises unauthorized | **Fraud or friendly fraud** | | **R11** | Check truncation entry return | Error | | **R29** | Corporate unauthorized | **Fraud or friendly fraud** | ### R10 Deep Dive R10 (Customer Advises Not Authorized) is the ACH equivalent of a fraud chargeback. **Timeline:** - Consumer can claim unauthorized for 60 days after statement - Bank must resolve within 10 business days or provisionally credit and extend investigation to 45 days - You see the return 2-3 days after bank initiates **Your options:** - Accept the return - Provide evidence of authorization (difficult without proper documentation) - Pursue customer directly (collections, legal) **Prevention:** Verify bank account ownership before debiting. --- ## ACH Verification Tools ### Bank Account Verification Tools that confirm account ownership: | Tool | What It Does | Limitations | |------|--------------|-------------| | **Plaid** | Links to bank, verifies ownership | Customer must authenticate | | **MX** | Similar account linking | Customer must authenticate | | **Yodlee** | Account aggregation | Customer must authenticate | | **Micro-deposits** | Deposits 2 small amounts, customer verifies | Slow (2-3 days), can be gamed | | **Prenotes** | Zero-dollar test transaction | Only checks account exists, not ownership | ### What Verification Does and Doesn't Prove | Verification Type | Proves | Doesn't Prove | |-------------------|--------|---------------| | Plaid/MX account link | Account exists, customer can log in | Customer owns account (could be ATO) | | Micro-deposit verification | Account exists, someone can see deposits | Account ownership | | Name match | Name on account | Account wasn't compromised | | Balance check | Funds available | Funds will still be there tomorrow | :::warning[Verification Limits] No verification tool prevents BEC. The accounts are legitimate and verified, they just belong to the fraudster. Verification confirms the account is real, it doesn't confirm the payee is. ::: --- ## Timing Windows and Liability ### Consumer ACH (Reg E) | Timeframe | Consumer Liability | |-----------|-------------------| | Report within 2 business days | Max $50 | | Report within 60 days | Max $500 | | After 60 days | Unlimited (depends on bank) | **For merchants:** This means a consumer can claim unauthorized up to 60 days later and you'll see an R10 return. ### Corporate ACH (UCC) Corporate accounts have different rules: - No Reg E protection - Must report unauthorized within 2 banking days of settlement (per Nacha R29 rules); individual bank agreements may impose tighter windows - Bank agreements vary significantly **For merchants:** Corporate returns are faster (R29), but corporate claims of unauthorized are rarer. ### Same-Day ACH Same-day ACH (SDA) speeds up settlement but also speeds up fraud: - Funds move same day - Less time to catch fraudulent transactions - Returns still take 2+ days --- ## Prevention Strategies ### For Inbound Payments (Customers Paying You) | Strategy | What It Does | |----------|--------------| | **Bank account verification** | Confirm account exists and customer can access | | **Name matching** | Check name on account matches customer name | | **First-payment holds** | Hold funds for 3-5 days on new accounts | | **Balance verification** | Confirm funds available before shipping | | **Velocity limits** | Limit new account payment amounts | ### For Outbound Payments (You Paying Others) | Strategy | What It Does | |----------|--------------| | **Dual authorization** | Two approvers for payments above threshold | | **Callback verification** | Call vendor to verify bank changes (use known number) | | **Payment delay** | 24-48 hour hold on new payee payments | | **Email security** | DMARC, SPF, DKIM to prevent spoofing | | **Training** | Employees trained on BEC tactics | ### BEC-Specific Controls ``` โ–ก All bank account changes require phone verification โ–ก Dual authorization for payments > $X โ–ก 24-hour delay on payments to new accounts โ–ก Vendor management database (no ad-hoc payments) โ–ก Email security configured and monitored โ–ก Regular BEC awareness training โ–ก Clear escalation path for suspicious requests ``` --- ## Responding to ACH Fraud ### When You Receive an R10/R29 Return ``` โ–ก Identify the transaction and customer โ–ก Review authorization evidence โ–ก Check for pattern (same customer, same behavior) โ–ก Decide: accept return or dispute โ–ก If disputing: contact your bank with evidence โ–ก If accepting: blacklist customer, consider collections ``` ### When You Discover BEC ``` โ–ก Immediately contact your bank โ–ก Request wire recall or ACH return (time-sensitive) โ–ก Document everything (emails, approvals, timeline) โ–ก Report to FBI IC3 (ic3.gov) โ–ก Engage legal if significant amount โ–ก Review and strengthen controls ``` ### Recovery Options | Situation | Recovery Chance | |-----------|-----------------| | Caught within hours | Medium (wire recall may work) | | Caught within 1-2 days | Low (funds often moved) | | Caught after settlement | Very low | | Fraudster's account still has funds | Better (legal action) | --- ## Test to Run **ACH fraud prevention audit:** ``` Inbound payments: โ–ก How do we verify bank account ownership? โ–ก Do we hold first ACH payments from new customers? โ–ก What's our R10 rate? Is it trending up? Outbound payments: โ–ก Who can add new payees? โ–ก How do we verify bank account changes? โ–ก Do we have dual authorization for large payments? โ–ก When did we last train staff on BEC? Record answers. If you can't answer these, you have gaps. ``` --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo ACH** | Basic verification (Plaid or micro-deposits). Manual review of returns. | | **$100k-$1M/mo ACH** | Automated verification. First-payment holds. R10 monitoring. | | **Over $1M/mo ACH** | Full verification stack. Balance checks. Velocity limits. Real-time return monitoring. | | **B2B outbound payments** | BEC controls are critical. Dual auth. Callback verification. | --- ## Where This Breaks 1. **BEC bypasses payment controls.** BEC tricks employees into making legitimate payments. Your payment fraud detection won't catch it because the payment itself is authorized. 2. **Verification doesn't prove payee identity.** Verifying a bank account confirms the account is real. It doesn't confirm the payee is who they claim to be. 3. **Same-day ACH reduces detection time.** Faster settlement means less time to catch fraud before funds move. 4. **Corporate accounts have weaker protection.** No Reg E means fewer consumer protections, so corporate fraud is harder to claw back. You're on your own more than you think. --- ## Next Steps **Accepting ACH payments?** 1. Implement bank verification โ†’ Plaid, MX, or micro-deposits 2. Hold first payments โ†’ 3-5 day hold on new accounts 3. Monitor R10 returns โ†’ Track rate and investigate spikes **Making ACH payments?** 1. Implement dual authorization โ†’ Two approvers above threshold 2. Verify bank changes by phone โ†’ Never trust email alone 3. Train on BEC โ†’ Quarterly awareness training **Had an ACH fraud incident?** 1. Contact bank immediately โ†’ Speed matters for recovery 2. Report to FBI IC3 โ†’ ic3.gov 3. Review controls โ†’ What would have prevented this? --- ## Related Topics - [ACH Operations](/docs/operations/ach-operations) - ACH processing operations - [ACH Return Codes](/docs/reference/return-codes/ach) - Full return code reference - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - Payment method overview - [BEC & Phishing](/docs/fraud/types/bec-phishing) - Email-based fraud - [Third-Party Fraud](/docs/fraud/types/third-party) - Stolen credentials fraud - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - False claims of unauthorized - [Settlement & Reconciliation](/docs/payments/settlement) - ACH timing - [Holds and Reserves](/docs/operations/holds-and-reserves) - Managing ACH risk - [Outbound ACH Fraud](/docs/fraud/types/outbound-ach-fraud) - Supplier payment fraud and ACH origination risks --- ## Account Fraud Source: https://paymentsandrisk.com/docs/fraud/types/application-fraud # Account Fraud :::info[TL;DR] - **Account fraud** = Fake or malicious accounts created on your platform - Types: Bot signups, referral abuse, multi-accounting, fake reviews - It's infrastructure for the fraud that comes next, not the loss itself - Detect via: Device fingerprinting, email analysis, behavioral patterns - Prevent with: CAPTCHA, email verification, phone verification, rate limiting ::: Someone signs up who isn't a customer. They're building for later. ## Definition Account fraud is **fake or abusive accounts** on your site or app. They don't cost you anything directly, and that's the trap: they enable [promo abuse](./promo-abuse.md), [refund fraud](./refund-fraud.md), fake reviews and [organized attacks](./bust-out.md). ## Why Fake Accounts Matter | They Enable | How | |-------------|-----| | [Promo abuse](./promo-abuse.md) | New account = new discount | | [Referral fraud](./promo-abuse.md) | Self-refer across accounts | | Velocity evasion | Spread activity across accounts | | [Card testing](./card-testing.md) | Disposable accounts for testing | | Fake reviews | Boost or attack products | | Resale fraud | Bulk buying limited items | ## Common Patterns ### Bot Signups Automated signups at scale. You'll see hundreds in an hour: - Hundreds of accounts in hours - Similar registration patterns - Disposable email domains - Generic or random usernames ### Referral Fraud Gaming referral programs: - Self-referral across accounts - "Referral farms" with fake accounts - Quick signup โ†’ claim reward โ†’ abandon ### Multi-Accounting One person, multiple identities: - Evade account-level limits - Stack promotions - Bypass bans or restrictions - Separate fraud activity from "real" account ### Fake Review Fraud Social proof that isn't. - Paid review rings - Competitor sabotage - Boosting new products artificially ## Detection Signals ### Registration Red Flags | Signal | Risk Level | |--------|------------| | Disposable email domain | High | | Email pattern matches prior fraud | High | | [Device](/docs/fraud/detection/device-fingerprinting) seen on multiple accounts | Critical | | Registration velocity (time to complete) | Medium | | Phone number from VoIP provider | Medium | | Similar usernames/passwords | High | ### Email Analysis | Pattern | What It Suggests | |---------|------------------| | john+1@gmail, john+2@gmail | Multi-accounting | | Random string @domain.com | Bot-generated | | Domain age < 30 days | Recently created for fraud | | Known disposable domain | Temporary account | | Email never used elsewhere | Fabricated for this account | ### Device Signals [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) reveals: - Same device across multiple accounts - Emulator or automation tools - VPN/proxy usage - Device recently associated with fraud ### Behavioral Indicators | Behavior | Risk | |----------|------| | No browsing before checkout | Scripted behavior | | Immediate promo redemption | Promo farming | | Referral link used instantly | Self-referral | | Never returns after signup | Throwaway account | | Review posted without purchase | Fake review ring | ## Prevention Strategies ### At Registration | Control | What It Stops | |---------|---------------| | CAPTCHA | Bot signups | | Email verification | Disposable emails | | Phone verification | Multi-accounting | | Rate limiting | Mass registration | | [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) | Repeat registrations | ### Email Verification Best Practices | Level | Method | Stops | |-------|--------|-------| | Basic | Send confirmation link | Fake emails | | Medium | Check domain reputation | Disposable domains | | Strong | Email risk scoring | Fraud-associated emails | ### Phone Verification | Check | Why | |-------|-----| | SMS verification | Ties to real phone | | VoIP detection | Block virtual numbers | | Phone line type | Mobile vs. landline vs. VoIP | | Phone velocity | Same number, many accounts | ### Device Controls | Control | What It Catches | |---------|-----------------| | Device fingerprinting | Same device, different accounts | | Emulator detection | Automated fraud tools | | VPN detection | Hidden location | | Device reputation | Known fraud devices | ## Account Linking Here's what links accounts back together: | Attribute | What It Links | |-----------|---------------| | Device fingerprint | Same device = same person | | IP address | Same network (less reliable) | | Payment method | Same card across accounts | | Shipping address | Same destination | | Behavioral patterns | Similar navigation, timing | ## Response Playbook ### Confirmed Fake Account 1. **Block the account** - Prevent further activity 2. **Revoke benefits** - Cancel promos, referral rewards 3. **Blacklist identifiers** - Device, email, phone 4. **Check for linked accounts** - Find the network 5. **Update rules** - Close the registration gap ### Mass Signup Attack 1. **Enable rate limiting** - Slow the attack 2. **Add friction** - CAPTCHA, phone verification 3. **Review recent signups** - Find and remove fakes 4. **Block infrastructure** - IPs, devices, email patterns ## Prevention Checklist - [ ] CAPTCHA on registration - [ ] Email verification required - [ ] Disposable email domains blocked - [ ] Device fingerprinting enabled - [ ] Rate limiting on signup endpoints - [ ] Phone verification for high-value actions - [ ] VoIP/virtual number detection - [ ] Account linking across devices - [ ] Promo redemption limits per device ## Next Steps **Preventing fake accounts?** 1. [Add device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Catch repeat registrations 2. [Implement email verification](#email-verification-best-practices) - Block disposables 3. [Set up rate limiting](#at-registration) - Stop mass signups **Detecting fake accounts?** 1. [Check registration signals](#registration-red-flags) - Score risk at signup 2. [Analyze email patterns](#email-analysis) - Catch multi-accounting 3. [Link accounts](#account-linking) - Find networks **Responding to fake accounts?** 1. [Follow response playbook](#response-playbook) - Block and revoke 2. [Find linked accounts](#account-linking) - Catch the full network 3. [Update prevention](#prevention-checklist) - Close gaps --- ## Related Topics - [KYC & KYB for Fraud Prevention](/docs/fraud/prevention/kyc-kyb) - When and how to verify identity at onboarding - [Identity Verification](/docs/fraud/detection/identity-verification) - Passive and documentary verification methods - [Promo Abuse](./promo-abuse.md) - What fake accounts enable - [Fraud Rings](./bust-out.md) - Organized multi-accounting - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Linking accounts by device - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Detecting signup patterns - [Card Testing](./card-testing.md) - Often uses fake accounts - [Refund Fraud](./refund-fraud.md) - Another fake account use case - [Account Takeover](./account-takeover.md) - When real accounts are hijacked - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Scoring at registration --- ## BEC & Phishing Attacks on Merchants Source: https://paymentsandrisk.com/docs/fraud/types/bec-phishing # BEC & Phishing Attacks on Merchants :::info[TL;DR] - BEC (Business Email Compromise) targets your employees, not your customers - attackers impersonate executives or vendors to redirect wire payments, with average losses of $137,000 per incident - The four attack types are vendor invoice fraud, CEO impersonation, payroll redirect, and credential phishing - all exploit process gaps, not technology vulnerabilities - Prevention is procedural: require out-of-band verification (phone call to known number) for any payment change or new vendor setup request received via email - Wire transfers are the primary target because they're irrevocable; ACH recall requests are more likely to succeed within 24 hours, but return is voluntary on the receiving bank's part - attackers know this and specifically request wire transfers ::: BEC (business email compromise) is fraud that targets your employees and vendors, not your customers. Attackers impersonate executives or suppliers to redirect payments to their accounts. The average loss is $137,000 per vendor invoice incident. Total reported losses came to $2.9 billion in 2023. Four attacks do most of that damage: vendor invoice fraud, CEO impersonation, payroll redirect, and credential phishing. Every one of them is a process problem, not a tooling problem. :::info[CP vs CNP] BEC and phishing aren't channel-specific. They hit your back office whether you're CP or CNP. Wire fraud, payroll redirect, and vendor impersonation work the same in a retail store or an e-commerce site. ::: ## What Makes BEC Different | Traditional Payment Fraud | BEC/Phishing | |--------------------------|--------------| | Fraudster uses stolen card | Fraudster impersonates trusted party | | Hits your checkout | Hits your email/phone | | Blocked by fraud rules | Bypasses fraud rules entirely | | Customer disputes afterward | You authorize the payment yourself | | Chargeback possible | Wire is irrevocable | **The key difference:** In BEC, *you* authorize the payment. There's no chargeback, no dispute, no fraud rule that fires. You sent a fraudster the money yourself, and it's gone. --- ## The Attack Types ### 1. Vendor Invoice Fraud This one rides on a vendor you already pay: 1. A fraudster maps your vendors: breach, social engineering, public info 2. They build an invoice that looks like the vendor's 3. It carries "updated banking information" for the payment 4. You pay it, and the money's gone 5. The real vendor calls later asking where payment went **Red flags:** - "Updated bank account" or "new payment details" - Urgency: "Please update before next payment run" - Email address slightly off (vendorname@vendor-inc.com vs vendor@vendor.com) - Invoice format differs from usual - Request to not call usual contact to verify **Scale callout:** At $500K+ in vendor payments monthly, you're a target. The more vendors you pay, the larger your attack surface. ### 2. CEO/Executive Impersonation This one runs on rank and hurry, not technology: 1. A fraudster reads your execs off LinkedIn, your site, press 2. They spoof the email, or take the account outright 3. Finance gets an urgent note: "Wire $47,000 to this account for confidential acquisition" 4. It's urgent, it's secret, and it skips the usual process 5. The employee pays rather than look slow to the CEO **Common scenarios:** - Fake M&A deals ("confidential, don't discuss with team") - Emergency vendor payments ("need this today") - Gift card requests ("buy $2,000 in gift cards for client appreciation, send codes to me") - Payroll adjustments ("add this contractor to next payroll run") **Red flags:** - Request to bypass normal approval process - Unusual urgency - Request for gift cards (always a scam) - Emphasis on secrecy - Sender is traveling or "in meetings all day" ### 3. Employee Payroll Redirect This one is small money, which is exactly why it gets missed: 1. A fraudster emails HR pretending to be your employee 2. They ask payroll to point the direct deposit somewhere new 3. The next paycheck lands in the fraudster's account 4. The real employee asks where the money went **Red flags:** - Email-only request (no phone confirmation) - New email address or slightly altered sender - Request shortly before payroll run - Employee recently promoted or transferred (more plausible reason for changes) ### 4. Credential Phishing Credential phishing doesn't take money, it takes the keys: 1. An employee gets an email that looks like it's from your processor, bank, or an internal system 2. The link goes to a login page that looks right 3. The employee types the password in 4. The fraudster is now inside your payment systems **Targets:** - Processor admin portals - Banking platforms - Accounting software (QuickBooks, NetSuite) - Internal expense systems - Payroll platforms **Red flags:** - Unexpected login prompts - URL doesn't match legitimate domain (paypa1.com, stripe-login.net) - Request to re-enter credentials for "security verification" - Threats of account suspension --- ## The Numbers | Attack Type | Estimated Average Loss | Recovery Rate | |-------------|----------------------|---------------| | Vendor invoice fraud | $125,000 | 30% | | CEO fraud | $75,000 | 25% | | Payroll redirect | $8,000 | 40% | | Credential phishing | Varies | N/A (data theft) | _Per-subtype loss figures are industry estimates from multiple sources. The FBI IC3 reports an overall average of $137,000 per BEC incident but doesn't break down by subtype._ **FBI IC3 2023 data:** BEC caused $2.9 billion in reported losses. That made it the second-highest-loss category of internet crime, behind investment fraud at $4.57 billion. The real number is higher, because many attacks never get reported. --- ## Prevention Framework ### Layer 1: Process Controls | Control | What It Does | |---------|--------------| | **Dual approval for wires** | Two people must approve wire transfers | | **Callback verification** | Call vendor at known number (not from email) before changing payment details | | **Out-of-band confirmation** | Verify unusual requests via different channel (call, Slack, in-person) | | **Payment change freeze** | 48-hour delay on banking detail changes | | **No gift card policy** | Never buy gift cards for "business purposes" via email request | ### Layer 2: Technical Controls | Control | What It Does | |---------|--------------| | **Email authentication (DMARC/DKIM/SPF)** | Harder to spoof your domain | | **External email banners** | "[EXTERNAL]" warning on emails from outside organization | | **Link protection** | Rewrite URLs to check reputation | | **MFA on all financial systems** | Stolen password alone isn't enough | | **Conditional access** | Block logins from unusual locations/devices | ### Layer 3: Training | Focus Area | Key Points | |------------|------------| | **Recognize urgency manipulation** | Legitimate requests can wait for verification | | **Verify before trusting** | Call known numbers, not numbers from the suspicious email | | **Report, don't ignore** | Better to report a legitimate email than miss an attack | | **Gift cards = fraud** | No legitimate business request involves gift card codes via email | --- ## Test to Run **30-day exercise:** 1. **Audit your wire process** - How many approvals, who can give them, and what gets verified? 2. **Review vendor payment changes** - Pull the last 6 months and look for callbacks 3. **Check email security** - Is DMARC enforced, and are external banners on? 4. **Run a phishing test** - Send finance a simulated phish and count the clicks **Success criteria:** zero single-approval wires, 100% callback verification on payment changes, and under a 10% phishing click rate. --- ## Response Playbook ### If You Sent a Wire **First 30 minutes are critical.** Wire recovery success drops sharply after the first hour. 1. **Call your bank immediately** (not email, not chat - phone) 2. Ask them to recall the wire 3. Give them the receiving account details from the wire 4. File the FBI IC3 complaint at ic3.gov 5. Call local law enforcement, get a report number 6. Write down every step and the time **Recovery odds:** - Within 24 hours: 30-40% partial recovery - Within 72 hours: 10-20% - After 1 week: under 5% ### If Credentials Were Compromised 1. Reset every affected password, starting with the money systems 2. Revoke active sessions on all of those accounts 3. Turn on MFA anywhere it wasn't already on 4. Read the access logs for anything you can't explain 5. Check for new users, payment changes, or transactions you didn't make 6. Tell any vendor or customer whose data was exposed --- ## Where This Breaks **Remote/distributed teams:** Harder to verify in person. "Just call them" doesn't work when you've never met the person. Build verification processes that work remotely. **High employee turnover:** New employees don't know what's normal. Onboarding must include security training and clear escalation paths. **Vendor-heavy operations:** More vendors = more attack surface. The plumber who invoices you once doesn't have sophisticated security. Fraudsters know this. **Executive override culture:** If executives routinely bypass approval processes, employees learn to comply with "urgent" requests. Culture must support verification. --- ## Scale Callout | Business Size | Focus | |---------------|-------| | **Under $1M revenue** | Basic controls: dual approval on wires, external email banners, no gift card policy | | **$1M-$10M revenue** | Add callback verification, DMARC enforcement, phishing training | | **Over $10M revenue** | Dedicated security awareness program, regular phishing simulations, vendor security assessments | --- ## Next Steps **Setting up defenses?** 1. Implement dual approval for all wire transfers - Single point of failure is unacceptable 2. Add external email banners - Simple, immediate impact 3. Train finance team on verification - Callbacks to known numbers **Already been targeted?** 1. Review the attack for lessons - What failed? 2. Update processes - Close the gap that was exploited 3. Share anonymized details with industry peers - They're targets too **Building security culture?** 1. Run phishing simulations - Measure, don't assume 2. Reward reporting - Make "I almost fell for this" a positive 3. No blame for verification delays - Better slow and safe than fast and defrauded --- ## Related Resources - [Wire Transfers](/docs/payments/payment-methods/alternative-methods#wire-transfers) - Wire fraud context - [Account Takeover](/docs/fraud/types/account-takeover) - Related attack pattern - [Fraud Types](/docs/fraud/types) - Full fraud taxonomy - [PCI DSS](/docs/compliance/pci-dss) - Data security requirements - [Identity Verification](/docs/fraud/detection/identity-verification) - Verifying who you're dealing with - [Vendor Management](/docs/operations/who-owns-what) - Operational controls - [Survive Fraud Attack](/docs/playbooks/survive-fraud-attack) - Emergency response - [Payroll & Tax Fraud](/docs/fraud/types/payroll-tax-fraud) - W2 theft, payroll processor ATO, and tax fraud beyond BEC redirect - [Outbound ACH Fraud](/docs/fraud/types/outbound-ach-fraud) - Supplier payment fraud and ACH origination risks - [Business Banking ATO](/docs/fraud/types/business-banking-ato) - When attackers target your bank account directly --- ## Business Banking Account Takeover Source: https://paymentsandrisk.com/docs/fraud/types/business-banking-ato # Business Banking Account Takeover :::info[TL;DR] - Business banking ATO means someone gets into **your** bank account, not your customer's. - Business accounts carry far fewer protections. Reg E gives a consumer 60 days to dispute. UCC 4A gives a business as little as 24 hours on ACH, and zero recourse on wires if the bank used "commercially reasonable security". - Recovery is limited and time-sensitive. Wires are measured in hours, not days. - Prevention is everything. MFA, dual authorization on transfers, dedicated banking devices, and real-time alerts are non-negotiable. ::: The [ATO page](/docs/fraud/types/account-takeover) covers someone taking over your customer's account. Credential stuffing, device fingerprinting, session hijacking. That matters, but it isn't the only ATO risk you carry. This page is about someone getting into **your** bank account. Your operating account. The one that pays vendors, takes processor settlements, and funds payroll. Different attack surface. Different controls. And far fewer legal protections. ## How This Differs from Customer ATO Most fraud content treats ATO as a customer problem. This one is a different animal. | Dimension | Customer ATO | Business Banking ATO | |-----------|-------------|----------------------| | **Target** | Customer's account on your platform | Your business bank account | | **Attacker goal** | Make purchases, steal stored value | Wire transfers, ACH debits, drain operating funds | | **Your liability** | Limited - customer bears dispute burden | Full - you absorb the loss | | **Recovery options** | Chargeback, Reg E dispute, account freeze | Wire recall (hours), ACH return (1 business day for corporate), or nothing | | **Detection** | Your fraud rules, device fingerprinting | Bank alerts, balance monitoring, transaction review | | **Legal framework** | Reg E - 60-day dispute window, bank bears burden | UCC 4A - "commercially reasonable security" standard, burden on you | | **Typical loss** | Average order value | Tens or hundreds of thousands of dollars | The worst part: your fraud tools probably catch a customer takeover. They aren't even in the picture when it's your own bank account. This one hits the back office. --- ## Attack Vectors ```mermaid flowchart TD A["Credential Compromise"] --> F["Bank Account Access"] B["Session Hijacking"] --> F C["Social Engineering the Bank"] --> F D["Insider Threat"] --> F E["Shared Login Exploitation"] --> F F --> G["Initiate Wire Transfer"] F --> H["Add New ACH Payee"] F --> I["Change Processor Payout Destination"] F --> J["Order Checks / New Debit Card"] G --> K["Funds Gone"] H --> K I --> K J --> K style F fill:#dc2626,color:#fff style K fill:#7c2d12,color:#fff ``` ### Credential Compromise The most common vector. Your CFO reuses one password across LinkedIn and your bank portal. LinkedIn gets breached. The attacker tries those credentials at every major bank, and they're in. This isn't hypothetical. Credential stuffing hits banking portals constantly. Password reuse is the number one risk. Period. ### Session Hijacking The attacker steals a live banking session token. Malware, a compromised browser extension, or a man-in-the-browser attack. The session is already authenticated, so MFA does nothing after login. They ride your session and move money while the real user still looks logged in. ### Social Engineering the Bank The attacker calls your bank pretending to be you. They have your EIN and account number, off a stolen check or statement. They have enough personal detail to pass verification. Then they reset a password, add an authorized user, or wire money by phone. Large banks verify harder. Community banks and smaller institutions stay vulnerable. ### Insider Threats A departing employee who still has banking credentials. A bookkeeper with full transfer authority and no oversight. An IT admin who can read stored banking passwords. Insiders aren't always malicious. Sometimes it's a compromised laptop handing an outsider the saved credentials. ### Shared Logins "Everyone in accounting uses the same bank login." That's shockingly common in small businesses. Three people on one credential means you can't audit who did what. You can't revoke one person without resetting everybody. And the password ends up in a shared doc or an email. --- ## Why Business Accounts Have Fewer Protections This is the part most business owners don't know until it's too late. ### Reg E vs. UCC Article 4A Consumer accounts get **Regulation E**, from the Electronic Fund Transfer Act. Drain a consumer checking account and the bank usually eats the loss. The consumer has to report it within 60 days. Business accounts run on **UCC Article 4A**. The standard is completely different. Did your bank offer "commercially reasonable security procedures"? MFA, token-based authentication, callback verification. If it did, and you skipped them or your own negligence broke them, the bank isn't liable. Bank offered MFA and you never enabled it? You lose. Bank offered dual authorization and you declined? You lose. Employee fell for a phishing email? You very likely lose. ### Wire Irrevocability Consumer wires have some clawback options. Business wires are effectively irrevocable once they clear. Domestic wires can clear in hours. Fedwire clears the same business day. An international wire into a non-cooperative jurisdiction can be gone in minutes. ### ACH Dispute Windows | Account Type | Unauthorized Return Window | Fraud Dispute Window | |-------------|---------------------------|---------------------| | Consumer (Reg E) | 60 days from statement | Extended protections | | Business (UCC 4A) | 2 banking days from settlement (Nacha R29) | "Commercially reasonable" standard applies | Two banking days from settlement. Miss an unauthorized ACH debit past that and your Nacha return right may be gone. Individual bank agreements often set tighter windows. ### The "Commercially Reasonable Security" Standard Courts read it as one question. Did the bank offer security appropriate to the account size and transaction types? If it did, and you didn't use it, the loss is yours. Same answer if your employees worked around it. Banks document everything they offer you. Decline a security feature and that's evidence against you later. --- ## Prevention Controls Prevention isn't optional here. Recovery is unreliable at best. Four layers of control. ### Authentication | Control | Why It Matters | |---------|---------------| | **MFA on every banking login** | Non-negotiable. Hardware keys (FIDO2) or authenticator apps - never SMS alone | | **Unique credentials per user** | Every person who accesses the bank account gets their own login. No sharing. | | **IP allowlisting** | If your bank supports it, restrict login to your office IP and VPN. Blocks attacks from anywhere else. | | **No saved passwords in browsers** | Use a password manager. Browser-stored credentials are trivially extractable by malware. | ### Authorization | Control | Why It Matters | |---------|---------------| | **Dual authorization on transfers** | Two different people must approve any wire or ACH transfer above a threshold (many businesses use $5,000) | | **Daily transfer limits** | Cap single-day outbound transfers. If compromised, limits the damage. | | **Positive pay for checks** | Bank matches presented checks against your issued check register. Rejects mismatches. | | **Payee allowlisting** | Pre-approve ACH destinations. New payees require out-of-band approval. | ### Monitoring | Control | Why It Matters | |---------|---------------| | **Real-time alerts on all transfers** | Email and SMS for every wire, ACH, and check over $0. Not $1,000 - every dollar. | | **Daily balance verification** | Someone reviews the balance and recent transactions every single business day. Catches unauthorized activity within the 1-day window. | | **Login alerts** | Get notified of every login, failed or successful. Unknown login = immediate lockdown. | | **Statement review within 24 hours** | Don't let statements sit. Review them the day they post. | ### Operational | Control | Why It Matters | |---------|---------------| | **Dedicated banking device** | One computer or browser profile used only for banking. No email, no web browsing, no downloads. Eliminates drive-by malware and phishing vectors. | | **Immediate credential revocation** | The moment an employee with banking access leaves the company (or gives notice), their access is revoked. Not tomorrow - today. | | **Quarterly access review** | Who has access? Do they still need it? Review every 90 days. | | **Separation of duties** | The person who initiates a transfer should not be the person who approves it. | --- ## Fintech Banking Specifics Bank with Mercury, Relay, Bluevine, Brex or similar and the risk profile shifts. **Everything is digital, and everything leans on MFA.** No branch to walk into. No banker to call. No physical fallback. Compromise the MFA and they own the account, with nothing in person to stop them. | Fintech Risk | Mitigation | |-------------|-----------| | **All-digital access** | MFA is your only gate - use hardware keys, not SMS | | **API key exposure** | If you use banking APIs (for accounting sync, etc.), rotate keys quarterly. A leaked API key is a direct path to your funds. | | **No branch fallback** | Compromised account recovery relies entirely on email/phone support, which may be slow | | **Integration tokens** | Third-party integrations (QuickBooks, payroll providers) that connect to your bank account create additional access paths. Audit which integrations have access. | | **Session persistence** | Many fintech platforms maintain long-lived sessions. Set the shortest session timeout your workflow allows. | **One advantage:** fintechs log better and alert faster than traditional banks. Use it. Turn on every alert they offer. --- ## If You've Been Compromised Time is the only thing that matters. Every minute counts. ### First 30 Minutes 1. **Call your bank immediately** - phone, not email, not chat. Say the business account is compromised. Ask for an emergency freeze on all outbound transfers. 2. **Request wire recall** - if a wire went out, the recall has to happen within hours. Once it settles at the receiving bank, your odds are near zero. 3. **Freeze all ACH origination** - stop any pending ACH debits or credits from processing. 4. **Lock online banking access** - have the bank disable online and mobile access while you assess. ### First 24 Hours 5. **Change all credentials** - every user's password, every API key, every integration token. Assume everything is compromised. 6. **Check your processor payout destination** - attackers change where your processor sends settlements. Log in and verify the bank account on file. That one can bleed you for days before you notice. 7. **Review all recent transactions** - go back 30 days. Look for small test transfers that came before the big one. 8. **File an FBI IC3 report** at [ic3.gov](https://ic3.gov) - law enforcement recovery needs it. 9. **Notify your insurance carrier** - cyber policy or crime policy, report it immediately. ### Recovery Reality Be honest with yourself about the odds: | Transfer Type | Recovery Odds (within 24 hours) | Recovery Odds (after 72 hours) | |--------------|--------------------------------|-------------------------------| | Domestic wire | 30-40% | Under 10% | | International wire | Under 15% | Near zero | | ACH (within return window) | 60-70% | Depends on timing | | ACH (past return window) | Under 5% | Near zero | --- ## Next Steps **Securing your business banking today?** 1. [Enable MFA and dual authorization](#authentication) - These two controls block most attacks 2. [Set up real-time alerts](#monitoring) - Know about every transfer the moment it happens 3. [Review your current access list](#operational) - Remove anyone who doesn't need it **Worried about the broader attack surface?** 1. [BEC & Phishing](/docs/fraud/types/bec-phishing) - The most common entry point for business banking compromise 2. [SMB Banking Integration](/docs/payments/smb-banking-integration) - How your bank account connects to your payment stack 3. [Who Owns What](/docs/operations/who-owns-what) - Map your vendor and access relationships **Already been compromised?** 1. [Follow the immediate response steps](#first-30-minutes) - Every minute matters 2. [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) - Full emergency playbook 3. [ACH Fraud](/docs/fraud/types/ach-fraud) - If ACH was the vector, understand your return options --- ## Related Pages - [Account Takeover (ATO)](/docs/fraud/types/account-takeover) - Customer-facing ATO: different target, different controls - [BEC & Phishing](/docs/fraud/types/bec-phishing) - Business email compromise as an attack entry point - [ACH Fraud](/docs/fraud/types/ach-fraud) - ACH-specific fraud vectors and return windows - [SMB Banking Integration](/docs/payments/smb-banking-integration) - How your bank account connects to payments - [Who Owns What](/docs/operations/who-owns-what) - Mapping access and vendor relationships - [Fraud Types Overview](/docs/fraud/types) - Full fraud taxonomy - [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) - Emergency response playbook - [Identity Verification](/docs/fraud/detection/identity-verification) - Authentication and verification methods --- ## Fraud Rings Source: https://paymentsandrisk.com/docs/fraud/types/bust-out # Fraud Rings & Organized Fraud :::info[TL;DR] - **Fraud rings** = Organized groups systematically targeting merchants - More sophisticated than individual fraudsters. They share tactics, tools, and stolen data - Patterns: Same device across accounts, coordinated timing, drop address networks - Detect via: Cross-account linking, velocity spikes, address/device clustering - Prevent with [device fingerprinting](/docs/fraud/detection/device-fingerprinting), consortium data, behavioral analysis ::: When fraud becomes a coordinated operation, not a solo act. ## Definition A fraud ring is an **organized group** that systematically commits fraud across multiple accounts, often at multiple merchants. They're more dangerous than individual fraudsters because they share resources, refine techniques, and operate at scale. ## How Fraud Rings Operate ### The Build-Up Pattern Some sophisticated rings use a "trust building" approach: ```mermaid flowchart LR A[PHASE 1Small Orders] --> B[PHASE 2Build History] --> C[PHASE 3Large Fraud] --> D[PHASE 4Disappear] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#ef4444,color:#fff ``` | Phase | What They Do | Your View | |-------|-------------|-----------| | Small orders | Place low-value orders, pay normally | "Good customer" | | Build history | Establish pattern of successful orders | "Repeat buyer" | | Large fraud | Big order, dispute, or resale scheme | "Trusted customer gone bad" | | Disappear | Abandon account, repeat elsewhere | "Why didn't we see it?" | ### The Blitz Pattern Other rings skip the build-up and attack quickly: | Pattern | Description | |---------|-------------| | Mass account creation | Hundreds of accounts in days | | Rapid carding | Burn through stolen cards fast | | Hit and run | Large orders, immediate disputes | | Promo abuse | Drain promotions across accounts | ## Detection Signals ### Cross-Account Indicators | Signal | What It Means | |--------|---------------| | Same [device fingerprint](/docs/fraud/detection/device-fingerprinting) across accounts | One person, many accounts | | Same payment method, different accounts | Card cycling | | Shipping address clustering | Drop address network | | Similar account creation patterns | Bot or scripted signup | | Linked email domains | disposable-email-domain.com | ### Behavioral Patterns | Signal | Risk Level | |--------|------------| | Multiple accounts same device within 24h | Critical | | Accounts created just before promo launch | High | | Sudden shift from small to large orders | High | | Coordinated order timing across accounts | High | | All orders go to forwarding services | High | ### Velocity Spikes | Pattern | What to Look For | |---------|------------------| | Order velocity | 10x normal from same device/address | | Failed auth velocity | Many declines, then success | | Refund velocity | Sudden spike in refund requests | | Dispute velocity | Multiple disputes filed same day | ## Fraud Ring Tactics ### Drop Address Networks Rings use address infrastructure: - **Reshipping mules**: Recruited people (often victims of job scams) who receive and forward packages - **Vacant properties**: Temporarily vacant homes - **Rental mailboxes**: Commercial mail services - **Package forwarding**: Services that consolidate and reship ### Multi-Accounting One person, many identities: - Fake accounts for new-customer discounts - Different "identities" for velocity limits - Separate accounts for different stolen cards - Throwaway accounts for fraud, "main" account stays clean ### Payment Method Rotation | Tactic | Purpose | |--------|---------| | Rotate stolen cards | Avoid velocity limits per card | | Mix real + stolen cards | Blend fraud with legitimate | | Use different BINs | Avoid BIN-based blocking | | Virtual cards from dumps | Clean-looking payment methods | ## Prevention Strategies ### 1. Device Intelligence [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) is your best defense: | Capability | What It Catches | |------------|-----------------| | Cross-account linking | Same device = same person | | Device reputation | Known fraudster devices | | Emulator detection | Automated attacks | | VPN/proxy detection | Hidden location | ### 2. Address Intelligence | Check | Why | |-------|-----| | Address velocity | Too many orders to same address | | Known reshipping addresses | Database of mule addresses | | Address-to-identity match | Does this address fit this person? | | Commercial mail receiving agents | Flag forwarding services | ### 3. Velocity Controls Set [velocity rules](/docs/fraud/detection/velocity-rules) at multiple levels: ``` ALERT IF: orders_per_device_24h > 5 ALERT IF: unique_cards_per_account_7d > 3 ALERT IF: orders_to_address_24h > 3 AND address_age_days 2 ``` ### 4. Consortium Data Share and receive fraud data: - Report confirmed fraud to networks - Check incoming orders against fraud databases - Share device fingerprints with fraud consortiums - Benefit from other merchants' catches ## Fighting Ring-Based Chargebacks Rings often generate chargebacks. Your response: | Evidence | What It Shows | |----------|---------------| | Account cluster analysis | Multiple accounts linked to same actor | | Device consistency across disputes | Same fraudster across cases | | Behavior pattern matches | Professional fraud indicators | | Address intelligence | Drop address network usage | Build a case showing **organized fraud, not legitimate disputes**. ## Response Playbook When you identify a fraud ring: 1. **Map the network** - Find all linked accounts, devices, addresses 2. **Block the infrastructure** - Blacklist devices, emails, addresses 3. **Cancel pending orders** - Stop shipments in progress 4. **Document for representment** - Prepare evidence for disputes 5. **Report to consortium** - Help other merchants 6. **Update velocity rules** - Close the gap they exploited ## Prevention Checklist - [ ] Device fingerprinting enabled - [ ] Cross-account linking active - [ ] Address velocity monitoring - [ ] Known drop address database - [ ] Multi-account detection rules - [ ] Promo abuse controls - [ ] Consortium data sharing - [ ] Regular rule tuning ## Next Steps **Detecting fraud rings?** 1. [Implement device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Cross-account linking 2. [Set up velocity rules](/docs/fraud/detection/velocity-rules) - Pattern detection 3. [Enable behavioral analytics](/docs/fraud/detection/behavioral-analytics) - Anomaly detection **Blocking fraud rings?** 1. [Check address intelligence](#2-address-intelligence) - Catch drop addresses 2. [Map linked accounts](#cross-account-indicators) - Find the network 3. [Update blocklists](#response-playbook) - Stop the infrastructure **Fighting ring-based disputes?** 1. [Document network evidence](#fighting-ring-based-chargebacks) - Show organized fraud 2. [Gather device data](/docs/fraud/detection/device-fingerprinting) - Prove linkage 3. [Submit compelling evidence](/docs/chargebacks/representment/compelling-evidence) - Make your case --- ## Related Topics - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Tracking fraudsters across accounts - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern-based detection - [Card Testing](./card-testing.md) - Often a ring indicator - [Promo Abuse](./promo-abuse.md) - Common ring target - [Third-Party Fraud](./third-party.md) - Stolen cards used by rings - [Account Takeover](./account-takeover.md) - Another ring tactic - [Behavioral Analytics](/docs/fraud/detection/behavioral-analytics) - Anomaly detection - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining signals - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting ring disputes --- ## Card Testing Source: https://paymentsandrisk.com/docs/fraud/types/card-testing # Card Testing :::info[TL;DR] - **Card testing (carding)** = Small transactions to verify stolen card credentials - Targets: donation pages, subscription services, digital goods, small merchants - Detect via: multiple small amounts same IP, sequential card numbers, high decline rates - Prevent with [velocity rules](/docs/fraud/detection/velocity-rules), CAPTCHA, minimum amounts, [3D Secure](/docs/fraud/prevention/3ds) - Impact: authorization fees, processor reviews, network fines, later chargebacks ::: Card testing (or **carding**) is when fraudsters run small $0.50-$5.00 transactions to find out which stolen card numbers still work. They pick donation pages, subscription services and small merchants because those usually don't have velocity controls. You'll see it as a burst of small charges from one IP, and you'll stop it with velocity rules, CAPTCHA and a minimum order amount. ## How Card Testing Works ```mermaid flowchart TD A[1. Fraudster obtains card list\nbreach, purchase, skimming] --> B[2. Tests cards with small transactions\n$0.50-$5.00] B --> C[3. Valid cards separated from invalid] C --> D[4. Valid cards used for larger fraud] C --> E[5. Valid cards resold at premium] ``` ## Common Testing Targets | Target | Why Chosen | |--------|------------| | Donation pages | Low friction, often no [AVS](/docs/fraud/prevention/avs-cvv) verification | | [Subscription](/docs/payments/subscriptions-recurring) services | Small recurring amounts look legitimate | | Digital goods | Instant delivery, no shipping verification | | Small merchants | Less sophisticated [fraud detection](/docs/fraud/detection) | | Account funding | Test via adding payment method | ## Detection Signals ### Transaction-Level | Signal | Risk Level | |--------|------------| | Multiple small amounts, same IP | ๐Ÿ”ด High | | Sequential card numbers | ๐Ÿ”ด High | | High decline rate from same device | ๐Ÿ”ด High | | Round dollar amounts ($1, $2, $5) | โš ๏ธ Medium | | Multiple cards, same shipping address | ๐Ÿ”ด High | ### Velocity Patterns | Pattern | Threshold Example | |---------|-------------------| | Transactions per IP per hour | >10 | | Unique cards per IP per hour | >5 | | Declines per IP per hour | >3 | | Transactions per device per hour | >10 | ## Impact Beyond Direct Loss The test transactions aren't the expensive part. Here's what else it costs you: 1. **[Authorization](/docs/payments/auth-and-capture) fees** - You're billed for every [decline](/docs/reference/decline-codes) 2. **[Processor](/docs/operations/processor-management) attention** - High decline rates trigger reviews 3. **Network fines** - [Fraud ratio](/docs/fraud/metrics) penalties (see [network programs](/docs/chargebacks/reference/network-programs)) 4. **System load** - Bot traffic strains infrastructure 5. **[Chargebacks](/docs/chargebacks) later** - Validated cards used elsewhere come back to you ## Prevention Strategies ### Technical Controls 1. **CAPTCHA** - On payment pages, especially donations 2. **Rate limiting** - By IP, [device](/docs/fraud/detection/device-fingerprinting), session 3. **[Velocity rules](/docs/fraud/detection/velocity-rules)** - Block on pattern detection 4. **BIN-level blocking** - High-fraud BINs 5. **[Device fingerprinting](/docs/fraud/detection/device-fingerprinting)** - Identify repeat offenders ### Transaction Rules 1. **Minimum amount** - $5+ reduces testing value 2. **[AVS](/docs/fraud/prevention/avs-cvv) requirement** - Address verification 3. **[CVV](/docs/fraud/prevention/avs-cvv) requirement** - Harder for card list fraud 4. **[3D Secure](/docs/fraud/prevention/3ds)** - Shift liability, add friction ### Monitoring 1. **Real-time dashboards** - Spot attacks quickly 2. **Decline spike alerts** - Abnormal decline rates 3. **IP reputation feeds** - Known bad actors ## Response Playbook When you're under attack: 1. **Immediate:** Enable CAPTCHA, tighten velocity rules 2. **Short-term:** Block offending IPs/devices 3. **Analysis:** Find the hole they're using 4. **Long-term:** Implement permanent controls ## Next Steps **Under card testing attack now?** 1. [Follow response playbook](#response-playbook) - Immediate actions 2. [Enable CAPTCHA](#technical-controls) - Add friction 3. [Tighten velocity rules](/docs/fraud/detection/velocity-rules) - Block patterns **Preventing card testing?** 1. [Implement velocity limits](#velocity-patterns) - Set thresholds 2. [Add device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Track offenders 3. [Require CVV/AVS](/docs/fraud/prevention/avs-cvv) - Verification signals **Measuring card testing impact?** 1. [Track authorization fees](#impact-beyond-direct-loss) - Know your costs 2. [Monitor decline rates](/docs/reference/decline-codes) - Spot attacks early 3. [Check fraud metrics](/docs/fraud/metrics) - Network ratio impact --- ## Related Topics - [Third-Party Fraud](./third-party.md) - Fraud using stolen credentials - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Primary defense against card testing - [Data Enrichment](/docs/fraud/detection/data-enrichment) - Datacenter IP and bot detection signals - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Track repeat offenders - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification signals - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and liability shift - [Decline Codes](/docs/reference/decline-codes) - Understanding test failures - [Network Programs](/docs/chargebacks/reference/network-programs) - Fraud ratio thresholds - [Fraud Metrics](/docs/fraud/metrics) - Measuring card testing impact - [Survive Fraud Attack](/docs/playbooks/survive-fraud-attack) - Attack response playbook - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Setting up blocking rules - [Account Takeover](./account-takeover.md) - Related attack pattern - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining signals --- ## First-Party Fraud Source: https://paymentsandrisk.com/docs/fraud/types/first-party # First-Party Fraud :::info[TL;DR] - **First-party fraud** = Your customer is **lying**, using their own real identity. They aren't hiding who they are - **Umbrella category** that includes: [friendly fraud](./friendly-fraud.md) (chargeback abuse), [refund fraud](./refund-fraud.md), and [promo abuse](./promo-abuse.md) - No stolen identity. The person is who they claim to be - Hardest to detect because the customer looks legitimate - Prevention: Clear policies, evidence collection, behavioral patterns - **We mean the payments definition**, not the lending one. See [why definitions don't match](/docs/reference/fraud-classification) ::: When your customer is the fraudster. This is the umbrella category for fraud where the customer uses their own real identity, including [friendly fraud](./friendly-fraud.md), [refund fraud](./refund-fraud.md), and [promo abuse](./promo-abuse.md). ## Definition First-party fraud occurs when a customer uses **their own real identity** and lies. No stolen card, no fake identity, just a real customer making a false claim. The lie takes two shapes. Lying about facts, like inflating income on an application. Or lying about an event, like denying a purchase they made. Both are first party. [The full definition and how others differ](/docs/reference/fraud-classification). :::info[Key Distinction] Unlike [third-party fraud](./third-party.md), there's no victim cardholder. The fraudster IS the cardholder. This makes it harder to detect and harder to fight. ::: ## Types of First-Party Fraud ### Friendly Fraud (Chargeback Abuse) The most common type. Customer makes a legitimate purchase, then disputes it. | Pattern | Description | |---------|-------------| | "I didn't order this" | Claims they never made the purchase | | "It never arrived" | Claims non-delivery despite proof | | "It wasn't as described" | Exaggerates quality issues | | Family fraud | Claims family member used card without permission. [Which class this really is](/docs/reference/fraud-classification#worked-example-my-family-member-used-my-card) depends on whether they handed the card over | **See [Friendly Fraud](./friendly-fraud.md) for detailed coverage.** ### Refund Fraud Customer exploits your return and refund policies. | Pattern | Description | |---------|-------------| | Wardrobing | Wear/use item, then return it | | Empty box returns | Return empty or wrong item | | Receipt manipulation | Use old receipts for new "returns" | | Double-dipping | Get refund AND chargeback | **See [Refund Fraud](./refund-fraud.md) for detailed coverage.** ### Promotion Abuse Customer exploits discounts, coupons, and referral programs. | Pattern | Description | |---------|-------------| | Multi-accounting | Create fake accounts for new-customer discounts | | Referral fraud | Self-refer with multiple accounts | | Coupon stacking | Combine offers in unintended ways | | Free trial abuse | Cycle through trials with new accounts | **See [Promo Abuse](./promo-abuse.md) for detailed coverage.** ## Detection Signals First-party fraudsters look like legitimate customers, but patterns emerge: ### Behavioral Red Flags | Signal | Why It Matters | |--------|----------------| | High dispute rate on account | Pattern of chargeback abuse | | Returns >30% of purchases | Excessive return behavior | | Multiple accounts same device | Multi-accounting for promos | | Claims "not received" despite signature | Delivery fraud pattern | | Disputes only high-value orders | Strategic abuse | ### Velocity Indicators | Pattern | Description | |--------|-------------| | Disputes within days of delivery | Didn't even try the product | | Surge in refund requests | Testing return policy | | Multiple promos same payment method | Promo stacking attempt | ## Prevention Strategies ### Clear Policies 1. **Explicit return policy** - No surprises, clear timeframes 2. **Documented terms** - Screenshot at checkout 3. **Refund caps** - Limit total refunds per customer 4. **Promo rules** - One per customer, verification required ### Evidence Collection For every order, collect: - IP address and [device fingerprint](/docs/fraud/detection/device-fingerprinting) - Delivery confirmation with photo/signature - Customer communication history - Account creation and login timestamps ### Behavioral Monitoring | What to Track | Why | |--------------|-----| | Dispute history | Flag repeat offenders | | Refund rate by customer | Catch serial returners | | Account age vs. dispute rate | New accounts disputing quickly | | Promo usage patterns | Multi-account abuse | ## Fighting First-Party Fraud Chargebacks Unlike [third-party fraud](./third-party.md), you CAN fight these: | Evidence Type | What It Proves | |---------------|---------------| | Delivery confirmation | Item was received | | [Device fingerprint match](/docs/fraud/detection/device-fingerprinting) | Same device as prior orders | | Customer communication | They acknowledged receipt | | Return history | Pattern of abuse | | [CE 3.0](/docs/chargebacks/representment/compelling-evidence) match | Prior undisputed transactions | **Win rates for first-party fraud are higher than third-party because you can prove the customer received and used the goods.** ## Response Playbook When first-party fraud is confirmed: 1. **Block the customer** - No more orders from this account 2. **Blacklist identifiers** - Email, phone, device, address 3. **Document everything** - For future representment 4. **Review policies** - Close any loopholes exploited 5. **Report to consortium** - Share with fraud networks if available ## Next Steps **Preventing first-party fraud?** 1. [Implement device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Track across accounts 2. [Set up velocity rules](/docs/fraud/detection/velocity-rules) - Catch patterns 3. [Strengthen return policies](./refund-fraud.md) - Close loopholes **Fighting chargeback abuse?** 1. [Review compelling evidence](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 requirements 2. [Check friendly fraud tactics](./friendly-fraud.md) - Specific strategies 3. [Collect proper evidence](#evidence-collection) - Before you need it **Stopping promo abuse?** 1. [Review promo abuse patterns](./promo-abuse.md) - Detection tactics 2. [Implement account linking](/docs/fraud/detection/device-fingerprinting) - Same device = same person 3. [Set redemption limits](./promo-abuse.md) - Cap per customer --- ## Related Topics - [Friendly Fraud](./friendly-fraud.md) - Chargeback abuse in detail - [Refund Fraud](./refund-fraud.md) - Return and refund exploitation - [Promo Abuse](./promo-abuse.md) - Promotion and coupon fraud - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Tracking fraudsters across accounts - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern detection - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting chargebacks - [Third-Party Fraud](./third-party.md) - Stolen card fraud (different problem) - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining fraud signals --- ## Friendly Fraud Source: https://paymentsandrisk.com/docs/fraud/types/friendly-fraud # Friendly Fraud :::info[TL;DR] - **Friendly fraud** = Legitimate cardholder disputing a valid transaction they actually made - 60-80% of chargebacks are friendly fraud, not true fraud - Win with [Compelling Evidence 3.0](/docs/chargebacks/representment/compelling-evidence): device match, IP geolocation, post-purchase login - Prevent with clear [descriptors](/docs/chargebacks/prevention/descriptors-and-comms), easy refunds, and purchase confirmations - A subset of [first-party fraud](./first-party.md) (customer = fraudster). Different from [third-party fraud](./third-party.md) (stolen identity) - Some sources call this **first-party fraud** or **first-party misuse**. [Why the terms differ](/docs/reference/fraud-classification) ::: :::warning[Before You Buy Fraud Tools] Friendly fraud is >50% of SMB chargebacks, but the solution is usually **operational, not technical**. Ask yourself: "Do I have a fraud problem, or a policy problem?" If customers dispute because they can't find how to cancel, your billing descriptor is confusing, or your refund process is slow, fix those first. They're free and more effective than any fraud tool. See [Refund Policy](/docs/chargebacks/refund-policy) and [Descriptors](/docs/chargebacks/prevention/descriptors-and-comms). ::: Friendly fraud is a real cardholder disputing a purchase they actually made, and it's 60 to 80% of all chargebacks. ## What Friendly Fraud Actually Looks Like If you're not sure whether you're dealing with friendly fraud, here are the most common scenarios SMBs encounter: **Scenario 1 - Digital goods abuse:** Customer buys a course or digital product, accesses it 10 times over 60 days, then disputes as "unauthorized." They got the value and want their money back too. **Scenario 2 - Subscription amnesia:** Customer signs up for a subscription, forgets about it, sees the charge 3 months later on their statement, and disputes instead of contacting you. **Scenario 3 - Delivery lie:** Physical item delivered with tracking confirmation, but customer claims "not received." Carrier shows delivered to their address. **The strongest signal:** The customer was silent for more than 7 days after delivery or access. If they didn't complain to you first, they're probably lying to their bank. Legitimate complaints go to the merchant. Fraudulent ones go straight to the issuer. :::tip[For SMBs Under $1M] For most SMBs under $1M, friendly fraud is 60-80% of all chargebacks. If that describes you, skip the third-party fraud tools and focus here. Your solution is operational - better [descriptors](/docs/chargebacks/prevention/descriptors-and-comms), easier refunds, clearer communication - not technical. ::: Your customer bought it. Used it. Then called their bank and said they didn't. ```mermaid flowchart TD A[CustomerPurchases] --> B[ReceivesProduct/Service] B --> C[Uses orKeeps Item] C --> D[Files Disputewith Bank] D --> E{MerchantEvidence?} E -->|Strong CE 3.0| F[WinRepresentment] E -->|Weak/None| G[LoseChargeback] F --> H[BlacklistRepeat Abusers] G --> I[Revenue+ Fees Lost] style F fill:#22c55e,color:#fff style G fill:#ef4444,color:#fff style H fill:#f59e0b,color:#fff ``` ## The Issuer's Reality When a cardholder calls their bank to dispute, I don't see your beautiful evidence PDF yet. I see a transaction line item and a frustrated customer on the phone. If your descriptor is vague ("PAY*ACME" instead of "ACME WIDGETS"), you've already lost ground. The agent has 3 minutes to handle this call. **The bank's incentive:** We want to keep the cardholder happy. They pay us interchange on every future purchase. You're a stranger who might never transact again. If you want to win a dispute, you have to make it impossible for me to side with my customer without breaking network rules. :::tip[Cross-Reference] See also [Fraud vs. Friendly Fraud](/docs/chargebacks/fraud-vs-friendly) in the Chargebacks section. ::: ## Why Customers Do This ### Intentional Abuse - Buyer's remorse disguised as fraud claim - "Cyber shoplifting" - get goods and money back - Exploiting merchant fear of [chargeback ratios](/docs/chargebacks/metrics) - Testing what they can get away with (see [refund fraud](./refund-fraud.md)) ### Unintentional/Gray Area - Forgot about [subscription](/docs/payments/subscriptions-recurring) renewal - Didn't recognize merchant name on statement (see [descriptors](/docs/chargebacks/prevention/descriptors-and-comms)) - Family member made purchase (but knew them) - Genuinely confused but not malicious ## Scale of the Problem | Statistic | Source | |-----------|--------| | 60-80% of chargebacks are friendly fraud | Industry estimates | | 40% of consumers who commit friendly fraud will do it again within 60 days | Chargebacks911 | | Average merchant loses 1.3-1.5% of revenue to all fraud types | Industry estimates | ## Detection Indicators ### Strong Signals (Tier 1 Indicators) Use these in your [evidence framework](/docs/fraud/detection/evidence-framework): | Indicator | Suggests Friendly Fraud | |-----------|------------------------| | Delivery confirmed to billing address | โœ… Strong ([CE 3.0](/docs/chargebacks/representment/compelling-evidence)) | | Digital product accessed post-purchase | โœ… Strong | | Customer contacted support before dispute | โœ… Strong | | [Device](/docs/fraud/detection/device-fingerprinting) matches prior purchases | โœ… Strong (CE 3.0) | | Customer logged in after purchase | โœ… Strong | ### Supporting Signals (Tier 2 Indicators) | Indicator | Notes | |-----------|-------| | Repeat customer | Established relationship | | Multiple prior successful transactions | Pattern of legitimate use (CE 3.0 requires 2+) | | IP matches billing location | Cardholder present (see [AVS](/docs/fraud/prevention/avs-cvv)) | | No [velocity](/docs/fraud/detection/velocity-rules) indicators | Not part of fraud attack | ## Fighting Friendly Fraud ### What I See on My Screen (Issuer Perspective) When representment comes in, I'm scanning for reasons to uphold your chargeback reversal. Here's what actually makes me pause: 1. **Visa CE 3.0 device match** - If the device that disputed is the same device that made 3+ prior purchases with no disputes, that's hard to ignore. 2. **IP geolocation to billing address** - Cardholder claims fraud, but IP was 2 miles from their billing address? That's awkward for them. 3. **Post-purchase login/access** - For digital goods: if they logged in and used the product after the purchase date, they're lying. 4. **Support ticket before dispute** - They contacted you about a problem, you offered a refund, they said "no thanks," then disputed? Document that. What doesn't help: 15-page PDFs, screenshots of your TOS, generic delivery confirmations. I have 4 minutes to review your case. ### Pre-Dispute Prevention 1. **Clear merchant descriptors** - "ACME INC" not "PAY*ACME". When the cardholder looks at their statement and doesn't recognize it, they call us. By then, you're already behind. 2. **Purchase confirmations** - Email/SMS with line items. Make it obvious what they bought. 3. **Delivery confirmation** - Photos work for physical goods. But Visa CE 3.0 credential matching is stronger than a photo. 4. **Easy refund path** - Every customer who gets a refund from you is a dispute you never see. ## Blacklisting Considerations :::warning[Balance Required] Blacklisting friendly fraud abusers protects you, but: - False positives damage customer relationships - May violate network rules if too aggressive - Document evidence before blacklisting ::: ### Blacklist Criteria Suggestions Consider blacklisting after: - 2+ lost disputes from same customer - Clear evidence of abuse pattern - Customer admitted abuse (support recordings) ## Next Steps **Seeing friendly fraud chargebacks?** 1. [Review Compelling Evidence 3.0](/docs/chargebacks/representment/compelling-evidence) - Know what wins disputes 2. [Check your descriptors](/docs/chargebacks/prevention/descriptors-and-comms) - Reduce "I don't recognize" claims 3. [Set up alerts](/docs/chargebacks/prevention/alerts) - Resolve before they become chargebacks **Want to prevent friendly fraud losses?** 1. [Defend against fraud losses](/docs/fraud/prevention/defending-against-fraud-losses) - Full strategy: 3DS, CE 3.0, evidence collection 2. [Implement device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Build CE 3.0 evidence 3. [Make refunds easy](/docs/chargebacks/refund-policy) - Refund is cheaper than chargeback **Ratio getting too high?** 1. [Follow the playbook](/docs/playbooks/reduce-chargebacks-fast) - Crisis response 2. [Understand network thresholds](/docs/chargebacks/reference/network-programs) - Know the limits 3. [Consider blacklisting repeat abusers](#blacklisting-considerations) - Protect yourself --- ## Related Topics - [What Is a Chargeback?](/docs/chargebacks) - Dispute basics - [First-Party Fraud](./first-party.md) - The umbrella category (friendly fraud is a subset) - [Third-Party Fraud](./third-party.md) - Stolen card/identity fraud - [Representment](/docs/chargebacks/representment) - How to fight disputes - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Visa CE 3.0 and Mastercard requirements - [Reduce Chargebacks Playbook](/docs/playbooks/reduce-chargebacks-fast) - Systematic reduction - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking friendly fraud impact - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device-based evidence - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Dispute timeline - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution - [Refund Fraud](./refund-fraud.md) - Related abuse patterns --- ## Outbound ACH & Supplier Payment Fraud Source: https://paymentsandrisk.com/docs/fraud/types/outbound-ach-fraud # Outbound ACH & Supplier Payment Fraud :::info[TL;DR] - **Inbound ACH** is customers paying you. **Outbound ACH** is you paying suppliers. Different risk, different controls, different liability - Outbound means your money already left. Recovery runs under 30%. After 24 hours a recall is a polite ask, not a demand - The top vector is a [BEC-driven vendor banking change](/docs/fraud/types/bec-phishing). Someone talks your AP team into swapping a vendor's bank details - Prevention is procedural, not technical. Dual authorization, out-of-band verification, segregation of duties, vendor file audits ::: Outbound ACH fraud is money you sent, landing in the wrong account. Usually because someone changed a vendor's bank details. Most ACH writing is about inbound. Customers paying you. Our [ACH operations](/docs/operations/ach-operations) and [ACH fraud](/docs/fraud/types/ach-fraud) pages do the same, and that's the right place to start. But you also send money out. Suppliers, contractors, landlords, payroll. That's a different risk entirely. The money flows away from you and the recovery window is brutally short. ## Inbound vs. Outbound ACH Risk On paper they're the same rail. The risk profiles aren't close. | Factor | Inbound ACH (Customer Pays You) | Outbound ACH (You Pay Suppliers) | |--------|--------------------------------|----------------------------------| | **Direction** | Money flows in | Money flows out | | **Who initiates** | You (or your processor) as ODFI | You as originator via your ODFI | | **Primary fraud type** | Unauthorized debits, return abuse | Payment redirection, insider theft | | **Your role when fraud hits** | Victim (you lose the goods/service) | Liable party (your money is gone) | | **Recovery window** | Returns come to you in 2-60 days | You have ~24 hours for a recall | | **Legal framework** | Reg E (consumer), UCC (business) | Nacha rules, UCC Article 4A | | **Detection** | R10/R29 return codes alert you | You discover it when vendor calls asking where payment is | | **Typical loss per incident** | Transaction amount | $10K-$125K+ (often larger payments) | The difference that matters: inbound fraud announces itself. A return code lands in your file. Outbound fraud tells you nothing. The money leaves, the fraudster moves it, and weeks later your real vendor asks where the payment went. --- ## Attack Vectors ### Vendor Banking Change Fraud This is the top vector, and it's a flavor of Business Email Compromise. The [BEC & Phishing](/docs/fraud/types/bec-phishing) page covers BEC in depth. There's no point repeating it here. Short version: a fraudster impersonates one of your vendors. Compromised email, or a spoofed domain. They ask you to update the banking details. AP updates the vendor master file. The next payment run pays the fraudster. **Why it works so well:** - Vendor banking changes are routine. They happen legitimately - AP processes dozens of invoices and nobody trained them to be suspicious - One successful change captures the next payment - The median loss is $125,000. That's FBI IC3 data For the full prevention set, see [BEC & Phishing](/docs/fraud/types/bec-phishing#prevention-framework). ### Payee Account Number Manipulation Someone changes the account or routing number in your AP system. Or edits the payment file on its way to the bank. **How it happens:** - **External access:** They get into QuickBooks or NetSuite and edit vendor records - **Batch file tampering:** They alter your Nacha file between creation and upload - **Man-in-the-middle:** They sit between you and the bank's ACH portal **Detection signals:** - Vendor record changes with no verified change request behind them - Routing numbers that don't match the vendor's known bank - Several vendors suddenly moving to the same receiving bank ### ACH Origination Abuse You send payment instructions through your ODFI. That makes you an originator. Abuse of that access is its own risk. **Scenarios:** - Someone uses your origination credentials to pull money from third parties - Fake entries added to a legitimate payment run - Credential theft on your bank's ACH origination portal **Your liability:** you own every transaction you send. Someone else uses your access? Nacha still puts the returns and the damages on you. ### Insider Threats Your AP clerk, bookkeeper or controller can already move money. That's the whole problem. **Common schemes:** - **Ghost vendors:** Fake vendor records, payments routed to a personal account - **Payment splitting:** A real vendor payment, plus a small second one to themselves - **Check-to-ACH conversion:** They convert a check to ACH and redirect it - **Overbilling collusion:** Employee and vendor inflate invoices and split the excess **Why it goes undetected:** the thief usually reconciles the accounts too. No segregation of duties, no second set of eyes. --- ## Prevention Controls It's procedural work, nearly all of it. No fraud score catches a clean-looking payment to a fraudster's account. | Control | What It Prevents | Implementation | |---------|-----------------|----------------| | **Dual authorization for new payees** | Ghost vendors, BEC | Two people must approve any new vendor in the master file | | **Dual authorization for banking changes** | BEC, account manipulation | Two people must approve any change to vendor bank details | | **Out-of-band verification** | BEC | Call vendor at a known phone number (not from the email) to confirm banking changes | | **Micro-deposit or API verification** | Wrong account, manipulation | Verify new bank details with test deposits or bank API before sending real payments | | **ACH Positive Pay** | Unauthorized origination | Bank-side control that matches outbound ACH against your authorized payee list | | **Segregation of duties** | Insider fraud | Person who enters payments is not the person who approves them | | **Vendor master file audits** | Ghost vendors, stale records | Quarterly review of all vendor records - flag dormant vendors, duplicate tax IDs, PO box-only addresses | | **Payment threshold alerts** | Large-dollar fraud | Automatic alerts for payments above a set threshold | ### The Non-Negotiable Three If you do nothing else, do these: 1. **Dual authorization on banking changes.** No single person gets to change where payments go. Period. 2. **Out-of-band verification for new bank details.** Call the vendor at a number you already had on file. Never use contact info from the email asking for the change. 3. **Segregation of duties.** Whoever enters the payment doesn't approve it. --- ## ACH Origination Compliance Originate ACH and the Nacha rules bind you. Whether you know it or not. ### Originator Responsibilities - **Authorization:** Every transaction needs one, on file - **Return liability:** Every return is yours, unauthorized ones included - **Data accuracy:** Account numbers, routing numbers and amounts must be right - **ODFI agreement:** Your bank's contract spells out your duties. Read it ### Entry Class Codes That Matter | SEC Code | Name | Use Case | |----------|------|----------| | **CCD** | Corporate Credit or Debit | Business-to-business payments (vendor, supplier) | | **PPD** | Prearranged Payment and Deposit | Payroll, employee reimbursements | | **CTX** | Corporate Trade Exchange | B2B with addenda records (remittance data) | **Why it matters:** the wrong SEC code is compliance exposure. CCD returns and PPD returns run on different clocks. An unauthorized CCD return is due the next business day. An unauthorized PPD return to a consumer-status account gets the longer Reg E window. ### Unauthorized Return Exposure A transaction comes back unauthorized. R29 corporate, R10 consumer. You're on the hook: - You have to accept the return - Your ODFI may charge you a fee - Repeat offenders lose origination privileges --- ## If Outbound ACH Goes Wrong ### The First 24 Hours Are Everything ACH recalls run on a tight clock. **Within 24 hours of settlement:** - Call your bank and request an indemnified recall - Your ODFI sends the request on to the receiving bank - That bank must reply within 10 banking days. Returning the money is voluntary **After 24 hours:** - Your recall is a request now, not a demand. They can decline - If the fraudster already moved the money, there's nothing to return - Recovery drops under 10% after 72 hours ### Response Checklist ``` Immediate (first hour): [ ] Call your bank - phone, not email [ ] Request ACH recall with transaction details [ ] Freeze any pending payments to the same account [ ] Preserve all evidence (emails, change requests, approvals) Within 24 hours: [ ] File FBI IC3 report at ic3.gov [ ] Notify your bank's fraud department formally [ ] Notify your cyber insurance carrier (if applicable) [ ] Begin internal investigation - who approved, what process was followed Within 1 week: [ ] Complete internal investigation [ ] Identify control failures [ ] Implement corrective controls [ ] Consider SAR filing if amount exceeds $5,000 ``` ### Recovery Odds | Timeline | Recovery Likelihood | |----------|-------------------| | Caught before settlement | High - payment can be reversed | | Within 24 hours of settlement | Medium - recall request has teeth | | 24-72 hours after settlement | Low - funds likely moved | | After 72 hours | Very low - legal action is your remaining option | Most outbound ACH fraud surfaces days or weeks late. The real vendor calls asking where their payment is. By then the money's gone. --- ## Next Steps **Setting up outbound ACH controls?** 1. Put dual authorization on vendor banking changes. Highest-ROI control you have 2. Write the out-of-band verification procedure. See the [BEC prevention framework](/docs/fraud/types/bec-phishing#prevention-framework) 3. Ask your bank about ACH Positive Pay. It matches payments to your approved payee list **Already sending outbound ACH and worried about gaps?** 1. Audit the vendor master file. Dormant vendors, duplicate tax IDs, PO box addresses 2. Check who can change vendor bank details. [Segregation of duties matters](/docs/fraud/types/bec-phishing#layer-1-process-controls) 3. Read your ACH origination agreement. Know what you signed **Dealing with a suspected outbound fraud incident?** 1. Call your bank and request a recall. Every hour counts 2. File with FBI IC3 at ic3.gov, even if recovery looks hopeless 3. Work the [BEC response playbook](/docs/fraud/types/bec-phishing#response-playbook) --- ## Related Pages - [ACH Operations](/docs/operations/ach-operations) - Inbound processing and return management - [ACH Fraud](/docs/fraud/types/ach-fraud) - Inbound fraud, return codes, verification tools - [BEC & Phishing](/docs/fraud/types/bec-phishing) - The top vector for outbound payment fraud - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - ACH, wire and RTP as payment methods - [ACH Return Codes](/docs/reference/return-codes/ach) - The full code reference - [Business Banking ATO](/docs/fraud/types/business-banking-ato) - When they take your banking logins - [Payout Strategy](/docs/operations/payout-strategy) - Outbound payment timing and risk - [Vendor Management](/docs/operations/who-owns-what) - Operational controls for vendor relationships --- ## Payroll & Tax Fraud Source: https://paymentsandrisk.com/docs/fraud/types/payroll-tax-fraud # Payroll & Tax Fraud :::info[TL;DR] - Payroll fraud is much more than the BEC redirect scam. It covers processor account takeover, W2 theft, ghost employees, 1099 manipulation and withholding fraud - One W2 breach exposes every employee's SSN, address and income. That's enough to file fake tax returns at scale - Payroll processor ATO is the worst of them. Someone gets your Gusto or ADP admin login. Now they hold your banking, your tax data and everyone's PII - Prevention is MFA, separation of duties, dual approval on bank changes and a quarterly audit. Most SMBs run none of it ::: Payroll fraud is theft that runs through your payroll system. Redirected deposits, stolen W2 files, invented employees, tampered withholding. Ask an SMB about payroll fraud and you'll hear about the direct deposit redirect. Someone impersonates an employee and HR changes the bank account. That's real, and it's covered on the [BEC & Phishing](/docs/fraud/types/bec-phishing#3-employee-payroll-redirect) page. The rest of the landscape is bigger, and it hurts more. Take over a payroll admin account and you don't redirect one paycheck. You get every employee's SSN. You get every bank account on file. You can invent people and pay them. This page is about the attacks nobody's watching for. ## How This Differs from BEC Payroll Redirect The BEC redirect is one social engineering trick. It's the tip. Here's the rest of the iceberg: | Attack | Vector | Target | Impact | Detection Difficulty | |--------|--------|--------|--------|---------------------| | **BEC payroll redirect** | Email impersonation of employee | HR/payroll staff | Single paycheck redirected ($3K-$15K) | Low - employee reports missing pay | | **Payroll processor ATO** | Credential theft/phishing of admin | Gusto/ADP/Paychex account | Full access to all employee data, banking, tax info | Medium - changes may look legitimate | | **W2 data theft** | Platform breach or insider access | Employee tax records | Mass identity theft, fraudulent tax returns | High - often not detected until tax season | | **Ghost employee scheme** | Insider creates fictitious workers | Payroll itself | Ongoing theft per pay period | High - requires payroll-to-HR reconciliation | | **1099 manipulation** | Insider or ATO | Contractor payments | Diverted payments, false deductions | High - contractors may not notice for months | | **Tax withholding fraud** | ATO or insider | Withholding settings | Redirected tax payments, employee tax debt | Very high - surfaces at year-end filing | **Key distinction:** the BEC redirect works on your people, while everything on this page works on your systems and your platform access. Different problem, different defenses. --- ## Payroll Processor Account Takeover This is the worst one. Someone gets into your admin account on Gusto, ADP or Paychex, and they hold the keys to everything. ### How They Get In - **Credential phishing** - A fake login page. Most common by far - **Credential stuffing** - Your admin reused a breached password - **Session hijacking** - Malware on the laptop grabs a live session - **Calling the vendor** - They phone ADP support pretending to be you ### What They Do Once In With admin access they can: 1. **Change employee bank accounts** - Several deposits redirected at once 2. **Add ghost employees** - Fake workers, paid to accounts they own 3. **Export W2 data** - Every SSN and income figure you've ever filed 4. **Modify withholding** - Bigger take-home pay on the checks they're stealing 5. **Change company banking** - Your funding account, not an employee's 6. **Add themselves as admin** - A backdoor that outlives the password reset **Why this beats BEC:** a redirect gets one paycheck, while processor ATO gets everything. And the access can sit there for weeks. ### Real-World Pattern The typical attack plays out over 3-7 days: - **Day 1**: They get in and export the employee file - **Day 2-3**: Small test changes. One bank account, one withholding - **Day 4-5**: Nobody noticed. Now come the ghost employees and the bulk bank changes - **Day 6-7**: Payroll runs. They cash out and leave a hidden admin behind --- ## W2 & Tax Data Theft W2 theft is seasonal. Attacks spike January through April. That's filing season, and a stolen W2 turns into a refund check fast. ### Why W2 Data Is So Valuable A single W2 carries everything an identity thief needs: - Full legal name and SSN - Home address - Total income, so the fake return looks right - Employer EIN, which sells the fake return to the IRS **One breach, every employee.** A platform breach or a single insider export puts every name in the system at risk. Former staff too. ### How Stolen W2 Data Gets Used 1. **Fraudulent tax returns** - Filed before the real employee files. Average fake refund runs $5,000-$8,000 2. **Identity theft** - The SSN opens credit lines, loans and synthetic identities 3. **Sold on dark web** - $20-$50 a record. Fifty employees is $1,000-$2,500 on the spot ### Seasonal Defense Calendar | Month | Action | |-------|--------| | **November** | Audit payroll platform access; remove former employees and unnecessary admins | | **December** | Enable MFA on all payroll accounts; verify admin contact info | | **January** | Lock down W2 generation; restrict who can view/download | | **February-April** | Monitor for unusual data exports; watch for employee reports of rejected tax returns | | **Year-round** | Quarterly access reviews; log monitoring | Do the November row properly and the January row gets easier. Every account you remove before the W2 file exists is one that can't export it. --- ## Ghost Employee & 1099 Schemes Ghost employee fraud is almost always an insider. Someone with payroll access invents a worker, and the pay lands in an account they control. ### Ghost Employee Red Flags - No matching record in the HR system, payroll only - Same bank account used for two or more employees - Address matches another employee or the payroll admin - No benefits, no training records, no badge - Round-number salaries that don't match any pay grade - "Hired" by the same person who runs payroll ### 1099 Contractor Manipulation Fake contractors are harder to spot than ghost employees, because they skip onboarding entirely. - **Fake contractors** - Invented to siphon payments. The business names sound real - **Inflated invoices** - Real contractor, padded amount, kickback to the approver - **Duplicate payments** - Same invoice paid twice. The second one lands elsewhere ### Detection Approach | Check | Frequency | What You're Looking For | |-------|-----------|------------------------| | Payroll-to-HR reconciliation | Monthly | Employees on payroll but not in HR system | | Bank account duplication scan | Each pay run | Multiple employees sharing a bank account | | Address matching | Quarterly | Employee addresses matching admin or each other | | 1099 vendor verification | Quarterly | Contractors with no contract, no deliverables, no contact info | | Payroll variance analysis | Each pay run | Unexplained increases in total payroll amount | --- ## Tax Withholding Manipulation This is the quiet one. It can run a full tax year unnoticed. ### How It Works - **Reducing withholding** - Max exemptions on the W4. Bigger checks to steal - **Redirecting tax deposits** - Some platforms let you configure this by hand - **Changing contributions** - The 401(k) match, the HSA, any pre-tax deduction ### Why It's Hard to Detect A withholding change looks like normal self-service. Anyone can update a W4 any day of the year. You find out when: - Employees get surprise tax bills at year-end - Quarterly deposits don't match what you expected - Year-end W2 totals won't reconcile with payroll records None of those is a control. They're all after the fact. --- ## Prevention Controls Three of the controls below carry most of the weight for a small business: MFA on every payroll account, dual approval on bank account changes, and the payroll-to-HR reconciliation. MFA blocks the credential attacks, dual approval blocks the redirect, and the reconciliation is what surfaces a ghost. Do those three before you touch IP allowlisting or session timeouts. ### Platform Security | Control | Why It Matters | |---------|---------------| | **MFA on all payroll accounts** | Blocks credential stuffing and most phishing attacks | | **Role-based access** | Not everyone needs admin; most need view-only or self-service | | **IP allowlisting** | Restrict admin access to office network or VPN | | **Session timeout** | 15-minute idle timeout for payroll admin sessions | | **Audit logging** | Every change logged with who, what, when, and from where | ### Process Controls | Control | Why It Matters | |---------|---------------| | **Separation of duties** | Person who adds employees should not be the person who approves payroll | | **Dual approval for banking changes** | Any bank account change requires a second approver | | **48-hour lock before pay run** | No changes allowed within 48 hours of payroll processing | | **Quarterly payroll audit** | Reconcile payroll roster against HR records, verify all bank accounts | | **Annual W2 access review** | Restrict who can generate, view, or download W2s | ### Monitoring | Signal | Response | |--------|----------| | New admin account created | Verify immediately with company owner | | Bulk data export (W2s, employee list) | Confirm business purpose within 1 hour | | Multiple bank account changes before pay run | Hold payroll; verify each change | | New employee added without HR ticket | Freeze until HR confirms | | Withholding changes for multiple employees simultaneously | Review each change individually | --- ## If You're Compromised Found unauthorized access, or you suspect payroll fraud? Work these in order. ### Immediate (First 2 Hours) 1. **Lock the platform** - New admin passwords. Kill every live session. Disable anything suspicious 2. **Hold the next pay run** - Nothing goes out until you've checked every setting 3. **Preserve evidence** - Export the audit logs before you change anything. Note the timeline ### Within 24 Hours 4. **Notify affected employees** - Their SSN and bank details may be out. Be direct about what leaked 5. **Point them at IRS Form 14039**, the Identity Theft Affidavit - It flags the SSN, so fake returns get a second look 6. **File a police report** - Insurance and regulators both want one 7. **Notify your state Attorney General** - Most states set a 30-72 day clock. Check yours ### Within 72 Hours 8. **Contact the IRS** - If W2 data leaked, email dataloss@irs.gov. Subject line: "W2 Data Loss" 9. **Offer credit monitoring** - 12 to 24 months free is the norm 10. **Audit every payroll change** - Go back 90 days. Match each change to a real request ### Ongoing 11. **Rebuild platform security** - New admin accounts, MFA, IP limits, less access 12. **Document everything** - Law enforcement, insurance and lawyers all want the timeline 13. **Consider forensics** - A platform-level breach puts your provider in the room --- ## Next Steps **Securing your payroll platform?** 1. Turn on MFA for every payroll admin today. It blocks most ATO 2. Require two approvers for any bank account change 3. Book your first payroll-to-HR reconciliation. That's how ghosts surface **Worried about tax season exposure?** 1. Lock down W2 access before January. One named person generates and downloads 2. Read the [BEC & Phishing](/docs/fraud/types/bec-phishing) page for the email side 3. Set an alert on bulk data exports **Already dealing with a breach?** 1. Follow the [If You're Compromised](#if-youre-compromised) playbook above. Lockdown first 2. Read the [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) playbook next 3. Check [Business Banking ATO](/docs/fraud/types/business-banking-ato) if bank logins leaked too --- ## Related Pages - [BEC & Phishing](/docs/fraud/types/bec-phishing) - Payroll redirect by email impersonation - [Account Takeover](/docs/fraud/types/account-takeover) - ATO concepts, applied to payroll platforms - [Business Banking ATO](/docs/fraud/types/business-banking-ato) - When they go straight at your bank - [Fraud Types Overview](/docs/fraud/types) - The full taxonomy - [Who Owns What](/docs/operations/who-owns-what) - Roles and separation of duties - [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) - Emergency response - [Identity Verification](/docs/fraud/detection/identity-verification) - MFA and verification controls --- ## Promo Abuse Source: https://paymentsandrisk.com/docs/fraud/types/promo-abuse # Promo Abuse :::info[TL;DR] - **Promo abuse** = Exploiting promotional offers, referral programs, or discounts beyond intended terms - Common patterns: multi-accounting for new user discounts, self-referral, coupon stacking, loyalty point manipulation - Some segments report 20-30% of promo budgets lost to abuse (varies widely by industry) - Detect via [device fingerprinting](/docs/fraud/detection/device-fingerprinting): same device/payment method across "different" accounts - Prevent with delayed rewards, phone verification and clawbacks. You won't catch it at signup ::: Your promotional offers, worked in ways you didn't plan for. ## Definition Promo abuse (or **promotion abuse**) is when people push your offers and referral programs past what you intended. Some of it breaks the terms. Some of it's just reading them more carefully than you did, and that's on your program design. ## Common Abuse Patterns ### Multi-Accounting One person, several accounts. Your one-per-customer offer isn't one per customer: - New user discounts (repeated) - Free trials (repeated) - Referral bonuses (self-referral) - Limited-time offers (hoarding) ### Referral Fraud Your referral program, but the referrals aren't real: - Self-referral with fake accounts - Referral farms (organized fake signups) - Collusion (referrer pays referee split) - Bot-generated referrals ### Coupon Abuse | Type | Description | |------|-------------| | **Stacking** | Combining coupons not intended to stack | | **Sharing restricted codes** | Posting single-use codes publicly | | **Code generation** | Guessing/generating valid coupon codes | | **Expired code exploitation** | Technical bypass of expiration | ### Loyalty/Rewards Abuse | Type | Description | |------|-------------| | **Point manipulation** | Exploiting earning glitches | | **Transfer abuse** | Moving points to cash-out accounts | | **Return-and-keep points** | Return item, keep earned points | | **Status gaming** | Artificial activity for tier status | ## Scale of the Problem | Statistic | Source | |-----------|--------| | Some segments report 20-30% of promo budgets lost to abuse (varies widely) | Industry estimates | | Referral fraud accounts for 5-15% of referral payouts | Various | | Multi-accounting affects 10-15% of e-commerce promos | Industry data | ## Detection Signals ### Account-Level | Signal | Risk Level | |--------|------------| | Device fingerprint seen on multiple accounts | ๐Ÿ”ด High | | Same payment method across accounts | ๐Ÿ”ด High | | Similar email patterns (john1@, john2@, john3@) | โš ๏ธ Medium | | Same IP for new accounts | โš ๏ธ Medium | | Address variations (123 Main St, 123 Main Street) | โš ๏ธ Medium | ### Behavior-Level | Signal | Risk Level | |--------|------------| | Only transacts with promos/discounts | ๐Ÿ”ด High | | Refers many accounts that never purchase | ๐Ÿ”ด High | | Creates account, uses promo, disappears | โš ๏ธ Medium | | Attempts invalid/expired codes repeatedly | โš ๏ธ Medium | ## Prevention Strategies ### Technical Controls 1. **Device fingerprinting** - Link accounts by device 2. **Payment method linking** - One promo per payment method 3. **Phone verification** - Unique phone per account 4. **Address normalization** - Detect variations ### Program Design 1. **Delayed rewards** - Pay referral after first purchase/retention 2. **Minimum purchase requirements** - Prevent pure promo orders 3. **Caps per customer** - Explicit limits 4. **Tiered rewards** - Better rewards for better customers 5. **Clawback provisions** - Recover abuse-gained rewards ### Monitoring 1. **Promo redemption dashboards** - Spot unusual patterns 2. **Referral quality tracking** - Conversion rate of referrals 3. **Device cluster analysis** - Identify abuse rings ## Response Actions | Severity | Action | |----------|--------| | Suspected | Monitor, flag for review | | Confirmed (minor) | Revoke promo, warning | | Confirmed (major) | Account ban, clawback rewards | | Organized ring | Legal action, industry sharing | ## Related Topics - [First-Party Fraud](./first-party.md) - Similar customer abuse patterns - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Multi-account linking - [Refund Fraud](./refund-fraud.md) - Related abuse patterns - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate limiting detection - [Behavioral Analytics](/docs/fraud/detection/behavioral-analytics) - Behavior pattern analysis - [Identity Verification](/docs/fraud/detection/identity-verification) - Phone/account verification - [Card Testing](./card-testing.md) - Automated abuse patterns - [Fraud Metrics](/docs/fraud/metrics) - Measuring abuse impact - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Scoring abuse likelihood - [Manual Review](/docs/fraud/detection/manual-review) - Reviewing flagged abuse - [Evidence Framework](/docs/fraud/detection/evidence-framework) - Tier 1/Tier 2 indicators --- ## Refund Fraud Source: https://paymentsandrisk.com/docs/fraud/types/refund-fraud # Refund Fraud :::info[TL;DR] - **Refund fraud** = Exploiting return/refund policies to get money or goods without legitimate cause - Common schemes: wardrobing, empty box returns, not-received claims, double-dipping (refund + chargeback) - "Refund-as-a-service" criminal services now openly advertised - Detect via: high refund rate (>15%), weight mismatches, serial number changes - Related to [friendly fraud](./friendly-fraud.md) and [chargeback management](/docs/chargebacks) ::: Your return policy, turned into a payout. Most of it doesn't look like fraud when it lands. ## Definition Refund fraud is getting money or goods back on a claim that isn't true. Sometimes it's a used item returned as new, sometimes it's a package that did arrive, and after the fact you can't disprove either one. One refund looks like a bad day. The same name every month is a business. ## Common Schemes ### Return Fraud Variants | Type | Description | |------|-------------| | **Wardrobing** | Use item, return with tags still attached | | **Receipt fraud** | Use found/stolen receipts to return shoplifted goods | | **Price switching** | Swap tags, return at higher price | | **Empty box** | Return empty box or box with wrong item | | **Cross-retailer** | Buy at Store A, return at Store B | ### Refund Fraud Variants | Type | Description | |------|-------------| | **Double dipping** | Get refund from merchant AND [chargeback](/docs/chargebacks) | | **Did Not Receive (DNR)** | Claim package not delivered (see [13.1 reason code](/docs/reference/reason-codes/visa/13-1-not-received)) | | **Item Not As Described (INAD)** | Exaggerate issues for refund (see [13.3 reason code](/docs/reference/reason-codes/visa/13-3-not-as-described)) | | **Partial return** | Return only part of multi-item order | | **Refund-as-a-service** | Criminal services that process fraudulent refunds | ## "Refund-as-a-Service" Economy :::warning[Growing Threat] Professional refund fraud services offer: - Guaranteed refunds for a percentage fee (typically 25-40%) - Social engineering scripts - Fake tracking numbers - Claim processing for consumers They're advertised openly on social media and in forums. They aren't hiding. ::: ## Detection Signals ### Customer-Level | Signal | Risk Level | |--------|------------| | High refund rate (>15% of orders) | ๐Ÿ”ด High | | Multiple "not received" claims | ๐Ÿ”ด High | | Refund requested immediately after delivery | โš ๏ธ Medium | | Returns always at max allowed timeframe | โš ๏ธ Medium | | Returns of high-theft items (electronics, designer) | โš ๏ธ Medium | ### Transaction-Level | Signal | Risk Level | |--------|------------| | Weight difference (return vs. original) | ๐Ÿ”ด High | | Serial number mismatch | ๐Ÿ”ด High | | Item condition inconsistent with claim | โš ๏ธ Medium | | Photo evidence doesn't match claim | ๐Ÿ”ด High | None of these proves anything alone. Two on one customer, and you stop refunding on trust. ## Prevention Strategies ### Policy Design 1. **Receipt requirements** - Don't pay out until they show a receipt or order number 2. **Restocking fees** - A fee takes most of the wardrobing incentive away 3. **Time limits** - Shorter return windows give the pros less room 4. **Condition requirements** - Write down what "used" means before they argue it 5. **Refund method** - The money goes back the way it came in Ship the restocking fee first. It goes at the incentive instead of the effort, and effort is exactly what the refund-as-a-service operators sell. ### Operational Controls 1. **Verify delivery** - Photo, signature, or GPS at the door 2. **Weight checking** - Weigh what comes back against what you shipped 3. **Serial number tracking** - Record it going out, match it coming back 4. **Abuse tracking** - Flag the names that keep showing up 5. **Refund velocity limits** - Cap refunds per customer per period Weight checking and serial number tracking each produce a number you can put in front of the customer, and both cost you a scale and a spreadsheet. Do those before you buy anything. ### Technology 1. **Return probability scoring** - [ML](/docs/fraud/detection/rules-vs-ml) on how likely a return is 2. **Customer abuse scoring** - Score the lifetime behavior, not one order 3. **Network analysis** - Link related accounts (via [device fingerprinting](/docs/fraud/detection/device-fingerprinting)) Start with the policy. Tools won't save a return desk that pays anyone who asks. ## Next Steps **Detecting refund abuse?** 1. [Check customer-level signals](#customer-level) - High refund rates 2. [Verify transaction-level signals](#transaction-level) - Weight, serial mismatches 3. [Set up velocity limits](#operational-controls) - Caps per customer **Preventing refund fraud?** 1. [Review policy design](#policy-design) - Tighten return policies 2. [Implement operational controls](#operational-controls) - Weight checking, serial tracking 3. [Track abuse history](#technology) - Flag serial abusers **Fighting refund-related chargebacks?** 1. [Review compelling evidence](/docs/chargebacks/representment/compelling-evidence) - What wins 2. [Check refund strategy](/docs/chargebacks/refund-strategy) - When to refund vs fight 3. [Set up alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution --- ## Related Topics - [Friendly Fraud](./friendly-fraud.md) - Chargeback abuse - [Chargeback Management](/docs/chargebacks) - Full chargeback guide - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting refund-related disputes - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Detecting refund abuse patterns - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund vs. fight - [Reason Codes](/docs/reference/reason-codes) - Understanding dispute types - [Card-Present Fraud](/docs/fraud/card-present-fraud) - Employee refund schemes - [Representment](/docs/chargebacks/representment) - Fighting refund disputes - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Link serial abusers - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Pre-dispute resolution - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking refund-related disputes - [First-Party Fraud](./first-party.md) - Intentional abuse patterns --- ## Fake Identity Fraud Source: https://paymentsandrisk.com/docs/fraud/types/synthetic-identity # Fake Identity Fraud :::info[TL;DR] - **Fake identity fraud** = Orders placed using fabricated or mismatched identity information - For merchants: Focus on detecting fake personas at checkout, not building credit files - Detect via: Name/address mismatches, disposable contact info, suspicious account patterns - Prevent with: Identity verification, device fingerprinting, address validation - Often part of larger [fraud ring](./bust-out.md) operations - Also called **synthetic identity fraud**. The industry splits it into *manipulated* and *fabricated*. [What the terms mean](/docs/reference/fraud-classification) ::: When fraudsters create fake personas to commit fraud. ## Definition Fake identity fraud occurs when there is **no real person behind the identity**. It is built from real and fabricated pieces to place orders. Unlike [third-party fraud](./third-party.md) (stolen identity) or [first-party fraud](./first-party.md) (real identity abused), fake identity involves made-up customer personas. :::note[For Issuers vs. Merchants] Banks worry about "synthetic identities" built over years to get credit. Merchants see the simpler version: fake personas used for immediate fraud. ::: ## What Merchants Actually See ### Fabricated Customers | Element | Example | |---------|---------| | Fake name | Random combinations, celebrity names | | Mismatched info | Name doesn't match card, address doesn't match name | | Disposable contact | Burner phone, temporary email | | No digital footprint | Email/phone has no history | ### Common Patterns | Pattern | What's Happening | |---------|-----------------| | Name โ‰  cardholder name | Using someone else's payment | | Email created same day | Throwaway for this order | | Phone is VoIP | Untraceable number | | Address is commercial mailbox | Drop point for packages | | Account has no history | Created just for fraud | ## Why Fake Identities Get Used | Fraud Type | How Fake Identity Helps | |------------|------------------------| | [Third-party fraud](./third-party.md) | Hide real identity when using stolen card | | [Promo abuse](./promo-abuse.md) | Fake accounts for unlimited promos | | [Refund fraud](./refund-fraud.md) | Untraceable account for abuse | | Resale fraud | Buy limited items for resale | | [Fraud rings](./bust-out.md) | Scale operations with fake personas | ## Detection Signals ### Identity Mismatch Indicators | Signal | Risk Level | |--------|------------| | Name on order โ‰  name on card | High | | Billing name โ‰  shipping name | Medium | | Email name โ‰  account name | Medium | | Phone area code โ‰  address location | Low-Medium | ### Contact Information Red Flags | Signal | What It Suggests | |--------|------------------| | Disposable email domain | Throwaway identity | | Email created recently | Account for this fraud | | VoIP phone number | Untraceable contact | | Phone recently acquired | New burner phone | | No social/email footprint | Fabricated person | ### Account Behavior | Behavior | Risk | |----------|------| | New account + high-value order | Using fake identity for fraud | | Account info changed before order | Switching to fake details | | Multiple identity changes | Testing what works | | No order history, immediate large purchase | Fabricated customer | ## Prevention Strategies ### At Checkout | Check | What It Catches | |-------|-----------------| | Name match validation | Cardholder โ‰  customer | | Email domain check | Disposable emails | | Phone verification | Fake numbers | | [AVS](/docs/fraud/prevention/avs-cvv) | Address doesn't match card | ### Identity Verification | Level | Method | When to Use | |-------|--------|-------------| | Basic | Email confirmation | All orders | | Medium | Phone verification | High-value orders | | Strong | Document verification | Very high-value, suspicious orders | ### Behavioral Analysis [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) reveals: - Same device, multiple "identities" - Known fraud device - Automation/bot signals - Location inconsistencies ## Response Playbook When you suspect fake identity: 1. **Add friction** - Phone verification, email confirmation 2. **Verify card match** - Name on card matches order? 3. **Check device** - Same device, other accounts? 4. **Review history** - Any prior legitimate activity? 5. **Decline or delay** - Don't ship until verified ## Fake Identity vs. Other Fraud Types | Type | Identity | Payment | Your Focus | |------|----------|---------|------------| | [Third-party](./third-party.md) | Stolen real | Stolen | Payment verification, 3DS | | [First-party](./first-party.md) | Own real | Own | Policy abuse detection | | Fake identity | Fabricated | Mixed | Identity verification | ## Prevention Checklist - [ ] Name matching on card validation - [ ] Disposable email domain blocking - [ ] Phone verification for new accounts - [ ] VoIP detection enabled - [ ] Device fingerprinting active - [ ] [AVS/CVV](/docs/fraud/prevention/avs-cvv) verification - [ ] Velocity limits on new accounts - [ ] High-value order review queue ## Next Steps **Detecting fake identities?** 1. [Check identity signals](#detection-signals) - Score mismatches 2. [Review contact info](#contact-information-red-flags) - Disposable markers 3. [Link accounts](/docs/fraud/detection/device-fingerprinting) - Same device, different names **Preventing fake identity fraud?** 1. [Add identity checks](#at-checkout) - Name matching 2. [Verify contact info](#prevention-strategies) - Email and phone 3. [Use device intelligence](/docs/fraud/detection/device-fingerprinting) - Catch repeats **Related to larger fraud ring?** 1. [Check for patterns](./bust-out.md) - Organized activity 2. [Map linked accounts](./application-fraud.md) - Find the network 3. [Update blocklists](./bust-out.md#response-playbook) - Stop infrastructure --- ## Related Topics - [KYC & KYB for Fraud Prevention](/docs/fraud/prevention/kyc-kyb) - Building a proportional verification program - [Identity Verification](/docs/fraud/detection/identity-verification) - Passive and documentary verification methods - [Third-Party Fraud](./third-party.md) - Stolen identity vs. fake identity - [Account Fraud](./application-fraud.md) - Fake accounts on your platform - [Fraud Rings](./bust-out.md) - Organized fake identity operations - [Data Enrichment](/docs/fraud/detection/data-enrichment) - Disposable email, VoIP phone, no social presence detection - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Linking fake identities - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Payment verification - [Promo Abuse](./promo-abuse.md) - Often uses fake identities - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Catching patterns --- ## Third-Party Fraud Source: https://paymentsandrisk.com/docs/fraud/types/third-party # Third-Party Fraud :::info[TL;DR] - **Third-party fraud** = Somebody who was **never given access** is using the card or identity - It was taken, not handed over. Stolen data, a breached account, a hijacked login - If the owner handed it over, however they were persuaded, that's [second party](/docs/reference/fraud-classification) instead - The cardholder is the victim. They didn't authorize anything - Different from [first-party fraud](./first-party.md), which includes [friendly fraud](./friendly-fraud.md) (the cardholder lying about a charge they made) - Definitions vary across the industry. See [why they don't match](/docs/reference/fraud-classification) - Detect via device signals, address mismatches, velocity patterns - Prevent with [3D Secure](/docs/fraud/prevention/3ds), [AVS/CVV](/docs/fraud/prevention/avs-cvv), [device fingerprinting](/docs/fraud/detection/device-fingerprinting) - **Get liability shift with 3DS.** Otherwise you eat the loss ::: When a criminal uses someone else's stolen payment credentials at your store. ## Definition Third-party fraud occurs when somebody who was **never given access** uses a card or identity. It was taken, not handed over. Stolen card data, a breached account, a hijacked login. If the cardholder handed their details over, even after being deceived, that's [second-party fraud](/docs/reference/fraud-classification) instead. The difference is whether a handover happened at all. :::warning[Your Liability] Without [3D Secure](/docs/fraud/prevention/3ds), **you bear the loss** when the cardholder disputes. The card was stolen, the cardholder is innocent, and you shipped goods to a fraudster. ::: ## How Stolen Cards Reach You ### Where Fraudsters Get Card Data | Source | What's Stolen | |--------|---------------| | Data breaches | Card numbers, CVVs, billing addresses | | Phishing | Full card details, passwords | | Skimming | Mag stripe data (card-present) | | Account takeover | Saved cards in compromised accounts | | [Card testing](./card-testing.md) | Validated stolen cards | | Dark web markets | Bulk card data for sale | ### Why Your Business Is Targeted | Factor | Why Fraudsters Like It | |--------|------------------------| | Digital goods | Instant delivery, no shipping address | | High-value items | Electronics, jewelry, gift cards | | Easy resale | Popular brands, liquid markets | | Weak fraud controls | No 3DS, no velocity limits | | Fast shipping | Less time for detection | ## Detection Signals ### High-Risk Indicators Use these in your [risk scoring](/docs/fraud/prevention/risk-scoring): | Signal | Risk Level | Why | |--------|------------|-----| | Shipping โ‰  billing address | Medium | Fraudster's address vs. victim's | | [AVS](/docs/fraud/prevention/avs-cvv) mismatch | Medium-High | Wrong billing address | | [CVV](/docs/fraud/prevention/avs-cvv) mismatch | High | Card not physically present | | New account + high-value order | High | Created just for fraud | | [Device](/docs/fraud/detection/device-fingerprinting) seen on prior fraud | Critical | Known fraudster device | | IP location โ‰  billing country | Medium | Geographic mismatch | | Multiple cards same device | High | Cycling through stolen cards | | Rush shipping selected | Medium | Wants goods before detection | ### Velocity Red Flags | Pattern | What It Means | |---------|---------------| | Multiple orders, different cards, same address | Drop address | | Multiple orders, same card, different addresses | Testing before big purchase | | Multiple failed transactions, then success | [Card testing](./card-testing.md) | | High-value order from new account | New account fraud | ## Prevention Strategies ### 1. Use 3D Secure **This is the most important defense.** [3D Secure](/docs/fraud/prevention/3ds) shifts liability to the issuer for fraud disputes. | Without 3DS | With 3DS | |-------------|----------| | You eat fraud losses | Issuer covers fraud losses | | Win rate: 15-25% | Liability shift: ~100% | | Fraudsters target you | Fraudsters avoid you | **See [3DS implementation guide](/docs/fraud/prevention/3ds) for setup.** ### 2. Verify Address and CVV | Check | What to Do | |-------|------------| | [AVS](/docs/fraud/prevention/avs-cvv) | Require match on street number + zip | | [CVV](/docs/fraud/prevention/avs-cvv) | Always require, decline on mismatch | | Shipping address | Flag if different from billing | ### 3. Device Intelligence [Device fingerprinting](/docs/fraud/detection/device-fingerprinting) catches: - Devices linked to prior fraud - VPN/proxy usage (hiding location) - Device age (just created = suspicious) - Multiple accounts same device ### 4. Velocity Controls [Set limits](/docs/fraud/detection/velocity-rules) on: - Orders per hour/day from same device - Cards used per account - Failed authorization attempts - Orders to same shipping address ## High-Risk Scenarios ### Shipping to Drop Addresses Fraudsters use: - Rented mailboxes - Vacant homes - Package forwarding services - "Reshipping mule" addresses (recruited victims) **Detection:** Address was never associated with the cardholder. ### Digital Goods Fraud Highest risk because: - Instant delivery (no time to detect) - No shipping address to verify - No tracking or signature - Easy resale (gift cards, game codes) **Prevention:** Higher 3DS trigger thresholds for digital goods. ### Gift Card Fraud Gift cards are "as good as cash": - Can be resold instantly - Untraceable once used - Often targets of [card testing](./card-testing.md) **Prevention:** Limit quantities, require 3DS, delay delivery. ## Responding to Third-Party Fraud ### When You Catch It Before Shipping 1. **Cancel the order** - Don't ship 2. **Refund if captured** - Avoid chargeback 3. **Blacklist device/email** - Prevent retry 4. **No customer contact** - Fraudster will lie ### When Cardholder Disputes Without 3DS, your options are limited: | Situation | What to Do | |-----------|------------| | Goods not yet shipped | Accept dispute, no fight | | Digital goods delivered | Fight with IP/device evidence (low win rate) | | Physical goods delivered | Fight with tracking + signature (still low win rate) | | 3DS was used | Liability shift: issuer covers | :::tip[Key Insight] With true third-party fraud, the cardholder really IS innocent. Fighting these disputes is often futile unless you have 3DS liability shift. Focus your energy on prevention. ::: ## Fighting Third-Party Chargebacks If you must fight (and you have evidence): | Evidence | What It Proves | |----------|---------------| | 3DS authentication | Liability shift (fight ends) | | [CE 3.0 device match](/docs/chargebacks/representment/compelling-evidence) | Same device as prior undisputed order | | Signed delivery confirmation | Someone at address received it | | IP + device consistency | Legitimate usage pattern | **Realistic win rates without 3DS: 15-25%** See [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) for details. ## Prevention Checklist - [ ] 3D Secure enabled on all transactions (or risk-based) - [ ] AVS verification required - [ ] CVV required, decline on mismatch - [ ] Device fingerprinting active - [ ] Velocity limits configured - [ ] High-risk products (gift cards, electronics) have extra scrutiny - [ ] Digital goods have higher friction - [ ] Address verification flags ship โ‰  bill ## Next Steps **Preventing third-party fraud?** 1. [Implement 3DS](/docs/fraud/prevention/3ds) - Get liability shift 2. [Add device fingerprinting](/docs/fraud/detection/device-fingerprinting) - Track fraudster devices 3. [Configure velocity rules](/docs/fraud/detection/velocity-rules) - Catch patterns **Detecting third-party fraud?** 1. [Review AVS/CVV settings](/docs/fraud/prevention/avs-cvv) - Baseline protection 2. [Check risk scoring](/docs/fraud/prevention/risk-scoring) - Combine signals 3. [Set up alerts](#high-risk-indicators) - Real-time detection **Fighting third-party chargebacks?** 1. [Check 3DS liability](/docs/fraud/prevention/3ds) - Were you protected? 2. [Review CE 3.0 evidence](/docs/chargebacks/representment/compelling-evidence) - What can you prove? 3. [Accept if true fraud](#responding-to-third-party-fraud) - Focus on prevention --- ## Related Topics - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift for CNP fraud - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address and card verification - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Tracking fraudster devices - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern-based detection - [Card Testing](./card-testing.md) - How stolen cards are validated - [Account Takeover](./account-takeover.md) - Compromised customer accounts - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting fraud chargebacks - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining fraud signals - [First-Party Fraud](./first-party.md) - Customer-initiated fraud (different problem) - [Friendly Fraud](./friendly-fraud.md) - Chargeback abuse (cardholder lying) --- ## Triangulation Fraud Source: https://paymentsandrisk.com/docs/fraud/types/triangulation # Triangulation Fraud :::info[TL;DR] - **Triangulation** = Fraudster runs fake store, takes real payment, fulfills order with stolen card from another retailer - The end customer receives real goods and doesn't know fraud occurred - Victim is the retailer + cardholder; fraudster keeps entire customer payment - Detect via: below-market pricing, different retailer packaging complaints, billing/shipping mismatches - Related to [third-party fraud](./third-party.md) and [card testing](./card-testing.md) ::: A three-party scheme using stolen cards to fulfill legitimate orders. ## Definition Triangulation fraud is a sophisticated scheme where a fraudster operates a fake or discount storefront, collects payment from legitimate customers, then fulfills orders using stolen credit cards from another retailer. ## How It Works ``` Customer Fraudster Retailer โ”‚ โ”‚ โ”‚ 1. Places order โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€>โ”‚ โ”‚ (pays $80) โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ 2. Places order โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€>โ”‚ โ”‚ (stolen card) โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ โ”‚<โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ 3. Ships item โ”€โ”€โ”‚ โ”‚ โ”‚ (to customer address) โ”‚ โ”‚<โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ 4. Receives โ”€โ”€โ”€โ”€โ”‚ โ”‚ โ”‚ item โ”‚ โ”‚ โ”‚ โ”‚ โ”‚ 5. Keeps $80 โ”‚ โ”‚ profit โ”‚ ``` ### The Fraudster's Profit Model - Sells at 10-30% below retail (to attract buyers) - Pays $0 for goods (stolen card) - Keeps entire payment from customer - Shipping goes directly to victim's address (harder to trace) ## Why It's Effective | Advantage | Description | |-----------|-------------| | Customer is happy | They receive real goods | | Customer is unwitting | Often no idea fraud occurred | | Hard to trace | Goods ship to legitimate addresses | | Scales easily | Can process high volume | | Multiple victims | Cardholder AND retailer suffer | ## Detection Signals ### For Retailers (Victim Side) | Signal | Risk Level | |--------|------------| | Multiple orders, different cards, similar shipping patterns | ๐Ÿ”ด High | | Orders from new customer with unusual ship-to patterns | โš ๏ธ Medium | | Billing/shipping mismatch (typical of triangulation) | โš ๏ธ Medium | | Order sources from discount/unknown marketplaces | โš ๏ธ Medium | ### For Platforms (Marketplace Side) | Signal | Risk Level | |--------|------------| | Seller with prices significantly below market | ๐Ÿ”ด High | | New seller with sudden high volume | ๐Ÿ”ด High | | Drop-shipping from other retailers | โš ๏ธ Medium | | Customer complaints of retailer packaging | ๐Ÿ”ด High | ## Prevention Strategies ### For Retailers 1. **Shipping analysis** - Unusual ship-to velocity patterns 2. **Device fingerprinting** - Link suspicious orders 3. **Network analysis** - Connect related orders/accounts 4. **Marketplace monitoring** - Watch for your products at steep discounts ### For Marketplaces 1. **Seller verification** - Identify and vet sellers 2. **Pricing anomaly detection** - Flag below-cost pricing 3. **Fulfillment verification** - Require inventory proof 4. **Customer feedback analysis** - "Came from [other retailer]" complaints ## Impact | Party | Harm | |-------|------| | **Cardholder** | Fraudulent charge on card | | **Retailer** | Chargeback + lost goods | | **Marketplace** | Reputation damage | | **Legitimate sellers** | Undercut on price | | **End customer** | May face investigation, confiscation | ## Related Topics - [Third-Party Fraud](./third-party.md) - Stolen card patterns - [Card Testing](./card-testing.md) - Card validation for schemes - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Linking suspicious orders - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern detection - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address mismatch detection - [Chargeback Prevention](/docs/chargebacks/prevention) - Preventing disputes - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - What happens after fraud - [Fraud Metrics](/docs/fraud/metrics) - Measuring fraud impact - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold consequences - [3D Secure](/docs/fraud/prevention/3ds) - Authentication protection - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Scoring suspicious orders --- ## Fraud Prevention Vendor Landscape Source: https://paymentsandrisk.com/docs/fraud/vendors/landscape # Fraud Prevention Vendor Landscape _Last verified 2 August 2026. No vendor paid to be here. Every figure is labeled with where it came from. [How these figures were checked](#how-these-figures-were-checked)._ :::info[TL;DR] - **Under $1M/year?** Your processor's built-in tools are enough. [What your processor already includes free](#what-your-processor-gives-you). - **$1M-$10M/year?** Add [chargeback alerts](#how-chargeback-alerts-fit-in) first, then consider a [dedicated fraud platform](#the-upgrade-path-sardine) or a [guarantee provider](#guarantee-comparison) depending on your fraud mix. - **Over $10M/year?** You need 3-5 layered tools. Use the [decision flowchart](#pick-your-path) to find your stack. - **Not sure what to buy?** Jump to [By Platform: What to Buy](#by-platform-what-to-buy) for platform-specific recommendations. ::: **Key Fact:** most merchants under $1M/year don't need a dedicated fraud platform. Processor-included tools plus chargeback alerts are enough until chargebacks consistently exceed 0.5%. That's Stripe Radar Lite, Square's ML, Adyen RevenueProtect. Neither Ethoca nor Verifi publishes a per-alert rate. So the alert number in your budget has to come from a reseller quote. See [what chargeback alerts cost](/docs/chargebacks/prevention/chargeback-alert-pricing). ## At a Glance: Top Fraud Vendors Compared {/* #vendor-comparison */} | Vendor | Owner | Best For | Pricing (checked 2026-08-02) | Guarantee? | Network scale (vendor's own claim) | |--------|-------|----------|------------------------------|-----------|-------------------| | **Processor built-in** (Stripe Radar Lite, Adyen RevenueProtect, Square, Shopify) | Your processor | Under $1M/year | **$0 for Stripe Radar Lite**, which Stripe states is included with Stripe Payments at no extra charge ([stripe.com/radar](https://stripe.com/radar)). Adyen publishes no price for RevenueProtect, and no rate card of any kind, so treat "included" as a contract term to confirm rather than a verified $0 | No | Your processor's merchant network | | **SEON** | Privately held | SMBs wanting a published price before a sales call | **Published: $699/mo Starter**, 2,500 fraud checks, 10 users, 50 rules. Premium is custom ([seon.io/pricing](https://seon.io/pricing/)) | No | "5,000+ global organizations" | | **Signifyd** | Privately held | Enterprise e-commerce | V **Model published, numbers not.** "A percentage of the order total when an order is approved," varying by products, vertical, volume and ticket. "No charge when an order is declined due to fraud" ([signifyd.com/pricing](https://www.signifyd.com/pricing/)). R Vendr median **$4,444/yr**, range $2,089-$48,889, no sample size disclosed. **The median is not credible for an enterprise contract** | Yes - 100% on approved orders | Commerce Network | | **Riskified** | Publicly traded (NYSE: RSKD) | Enterprise fashion, luxury, travel, digital goods | NP as a rate card. D **0.237% of GMV**: $88.3M revenue on $37.2B GMV, Q1 2026, released 2026-05-13. Q1 2025 was 0.241%. **Calculated here, not a Riskified disclosure** | Yes - 100% on approved orders | Enterprise merchant network | | **Forter** | Privately held | Enterprise e-commerce, no manual review | NP No model, no tiers, no rate card ([forter.com/pricing](https://www.forter.com/pricing/) is a contact form). R Vendr median **$8,000/yr**, range $6,000-$375,000, which contradicts the same page's own "mid-six figures or higher" for enterprise. Reported to structure contracts around approved volume or GMV | Yes - 100% on approved orders | Trusted Identities Network | | **ClearSale** | Publicly traded (B3: CLSA3) | LATAM and cross-border e-commerce | NP | Yes - on guaranteed orders | 1,500+ human analysts claimed | | **NoFraud** | Privately held | SMB e-commerce | NP | Yes - on approved orders | Proprietary network | | **Sift** | Sift Science, Inc. (private) | Marketplaces, digital goods, account fraud | NP Sift publishes no price and no billing unit. R Vendr median **$150,000/yr**, range $29,600-$600,000, **based on a stated 50 purchases**. Segments: $40K-$100K small/mid-market, $100K-$300K mid-to-enterprise, $300K+ large enterprise | No (scoring + workflows) | "1T+ annual events," "1.6B authentic digital citizens" | | **Sardine** | SardineAI Corp (private) | Fintech, banking, crypto, payments + compliance | NP Sardine publishes no price. R Vendr median **$95,333/yr**, range $15,000-$254,480. Model: a **minimum monthly commit you draw down from**, plus consumption rates, overages billed monthly | No (scoring + rules) | Cross-client device and behavioral consortium | | **Kount** | **Equifax** | Mid-market, gaming, digital goods | NP Equifax publishes no rate card. Kount's own site now forwards to [Equifax](https://www.equifax.com/business/identity-fraud/), and so does Midigator's, so both brands lead to the same place | No (scoring + rules) | No current figure. Kount's site is gone, so there's nothing left to check | | **Accertify** | **Formerly American Express. Carved out. Current owner not disclosed** ([accertify.com/about-us](https://www.accertify.com/about-us/)) | Enterprise - airlines, hospitality, travel | NP on price, model, volume minimum and contract term | No | Community Intelligence | | **Ravelin** | Privately held | Marketplaces, food delivery, travel | NP **at every tier.** Ravelin has a pricing page with no prices on it, and nobody credible reports a range | No | Proprietary network | | **Radial** | Managed-service provider | Retailers outsourcing fraud ops entirely | NP | Yes (as part of the managed service) | Radial analyst team | | **Ethoca** | **Mastercard** (2019) | Pre-dispute alerts, all card networks | NP from Mastercard, and **the absence is structural**. It licenses into a reseller channel and the reseller sets retail. Resellers publish: Chargeblast **$14**, Disputifier **$17-$27.50**, Chargeflow **$29** | N/A (prevents chargebacks, not fraud) | 5,000+ issuers claimed | | **Verifi** | **Visa** (2019) | Automated Visa dispute resolution | NP from Visa. Same reseller channel as Ethoca, so the retail price is the reseller's, not Visa's | N/A (prevents chargebacks, not fraud) | Visa network | > **How to read this.** V is a vendor figure. R comes from a named third party, so treat it as indicative. D is calculated from published figures. NP means the vendor doesn't publish it. > > **You now have three public anchors instead of one.** SEON's published $699 a month for 2,500 checks, which is about 28 cents a check at full allowance. Riskified's derived 0.237% of GMV, which is the only percentage benchmark in the guarantee market. And the published reseller alert prices of $14 to $29, which bracket what the networks won't quote. Use all three when a quote-only vendor names a number. > > Guarantee providers absorb your fraud chargebacks and charge a percentage of approved orders. That's Signifyd, Riskified, Forter, ClearSale and NoFraud. Signifyd is the only one that publishes even that much. Riskified is the only one whose filings let you compute it. Scoring providers (Sift, Sardine, Kount) hand you decisions and data. You keep the liability. Alert services (Ethoca, Verifi) don't prevent fraud at all. They prevent chargebacks, by letting you refund before the chargeback posts. Most merchants need alerts first and a platform later. ## Pick Your Path {/* #pick-your-path */} Not sure what you need? Follow the arrows: ```mermaid flowchart TD A["What is your annual volume?"] --> B["Under $1M"] A --> C["$1M - $10M"] A --> D["Over $10M"] B --> E{"Chargebacks above 0.5%?"} E -->|No| F["Processor tools are enough"] E -->|Yes| G["Add chargeback alerts via reseller"] C --> H{"What is your main problem?"} H -->|Chargebacks climbing| I["Alerts + tune processor rules"] H -->|Card testing or ATO| J["Sardine or Kount + alerts"] H -->|Want liability shift| K["Signifyd or Riskified"] D --> L{"Own fraud ops or shift liability?"} L -->|Own it| M["Sardine or Sift + alerts + identity enrichment"] L -->|Shift liability| N["Signifyd, Riskified, or Forter"] style F fill:#22c55e,color:#fff style G fill:#3b82f6,color:#fff style I fill:#3b82f6,color:#fff style J fill:#8b5cf6,color:#fff style K fill:#f59e0b,color:#fff style M fill:#8b5cf6,color:#fff style N fill:#f59e0b,color:#fff ``` ### What Should I Buy? (Scenario Guide) {/* #scenario-guide */} Find the scenario closest to your situation: | Your situation | What to do | What to buy | Setup effort | What it costs | |---|---|---|---|---| | **$500K Shopify store, chargebacks under 0.3%** | Nothing. Shopify's built-in fraud analysis is handling it. | Nothing new | None | $0 | | **$500K Shopify store, chargebacks above 0.5%** | Add chargeback alerts to deflect disputes before they post. | Ethoca + Verifi via reseller (Chargebacks911 or Chargeback Gurus) | Days, no code | Not published. Per-alert, quoted by the reseller. Get two quotes | | **$500K-$1M any platform, chargebacks 0.3-0.65%** | Tune your processor's built-in rules first. Fix your [billing descriptor](/docs/chargebacks/prevention/descriptors-and-comms). Add alerts only if chargebacks don't drop within 30 days. | Processor tools (free) + possibly alerts via reseller | Afternoon for rules, days for alerts | $0 for the rules. Alerts are quote-only | | **$500K-$1M any platform, chargebacks above 0.65%** | Add alerts immediately - you're near [monitoring program](/docs/compliance/network-rules/dispute-monitoring) thresholds. Tune processor rules aggressively. Do NOT buy a fraud platform yet - alerts and rule tuning solve most problems at this volume. | Alerts via reseller + processor rule tuning | Days | Not published. Reseller quote | | **$2M Stripe store, chargebacks at 0.7%** | Tune Stripe Radar rules and add chargeback alerts. | A paid Radar tier (Standard, Plus or Pro) + alerts via reseller | Afternoon for Radar, days for alerts | Radar paid tiers are a monthly subscription with an included screen allowance. Read the US price at [stripe.com/radar/pricing](https://stripe.com/radar/pricing) - see the note below | | **$2M WooCommerce, chargebacks at 0.9%** | Add alerts immediately. Evaluate a fraud platform if chargebacks don't drop within 60 days. | Alerts via reseller, then possibly Signifyd or ClearSale plugin | Days for alerts, 1-2 weeks for fraud platform | Both quote-only | | **$5M Stripe store, card testing attacks** | Add device intelligence and behavioral analysis to catch what Radar misses. | Sardine (SDK + API) or Kount (now Equifax) + alerts via reseller | 1-2 weeks (developer needed) | Neither publishes. Reported Sardine median $95,333/yr. Benchmarks: SEON's published $699/mo for 2,500 checks, and $14-$29 per alert from resellers | | **$5M WooCommerce, ATO attacks** | Add device intelligence and behavioral biometrics. | Sardine or Kount + alerts via reseller | 1-2 weeks (developer needed) | Same. Sardine bills on a **minimum monthly commit with drawdown**, so ask about annual true-up and rollover | | **$10M e-commerce, want someone else to own fraud losses** | Shift liability to a guarantee provider. They approve/decline orders and pay for fraud chargebacks. | Signifyd or Riskified + alerts via reseller | 1-2 weeks | A percentage of each approved order. Signifyd publishes the model but no percentages; Riskified publishes nothing. **Anchor on Riskified's derived 0.237% of GMV** from its own Q1 2026 results, then make them quote your vertical and average ticket as a percentage of approved GMV so the quotes are comparable | | **$15M e-commerce, have a fraud analyst on staff** | Build a tuned fraud stack you control. More work, but lower false positives and you keep borderline revenue. | Sardine or Sift + alerts + identity enrichment (Ekata) | 2-4 weeks | All quote-only | | **$50M+ enterprise, complex fraud patterns** | Layered stack with dedicated fraud team. | Fraud platform + alerts + device intelligence + identity + orchestration | 1-3 months | All quote-only. Budget from the quotes you get, not from this page | | **Any volume, dispute ratio approaching 0.65%** | Stop the bleeding immediately. You're near [monitoring program](/docs/compliance/network-rules/dispute-monitoring) thresholds. | Chargeback alerts (both networks) + Verifi RDR auto-refund rules | Days | Not published. RDR is billed per resolved case, CDRN and Ethoca per alert | :::note[Why so many cells say "quote-only"] One fraud vendor publishes a price: **SEON, $699 a month for 2,500 checks.** Signifyd publishes the shape of its deal but no percentages. Everyone else wants a sales call. So where there's no published rate, this column gives you the next best thing. A reported range, a derived benchmark, or a reseller's retail price. It always says which. [How we sourced each one](#how-these-figures-were-checked). ::: Fraud vendors split into ten categories by the job they do. They run from identity verification through to outsourced fraud operations. ## Vendor Categories at a Glance | Category | Primary Use Case | Key Vendors | Typical Pricing | |----------|------------------|-------------|----------------| | **Identity Verification** | KYC, onboarding, step-up auth | Socure, Onfido, Ekata, Veriff, iDenfy | $0.50-$5 per verification | | **Data Enrichment** | IP, email, phone signals for rules | MaxMind, IPQS, Emailage, Telesign, AtData (Experian) | Free tiers available. Paid from $99/month | | **Device Fingerprinting** | Account takeover, multi-accounting | ThreatMetrix, Iovation, Fingerprint, BioCatch, SEON | Per-session or per-transaction. SEON publishes $699/mo for 2,500 checks; the rest are quote-only | | **Consortium Data** | Cross-institution fraud signals | LexisNexis, FICO Falcon Network, Sift | Subscription + per-query | | **Enterprise Fraud Platform** | Case management, rules engine, ML | NICE Actimize, Feedzai, FICO, SAS, Sardine | Annual license + implementation | | **Network Tools** | Real-time authorization scoring | Visa VAA, Mastercard Decision Intelligence | Usually included via processor | | **Chargeback Alerts** | Pre-dispute alerts, enrichment | Ethoca, Verifi (RDR/CDRN) | Not published by either network. Priced per alert by resellers | | **Chargeback Management** | Representment, dispute ops | Chargebacks911, Chargeback Gurus, Chargeflow, Justt | Performance-based or retainer. Chargeflow publishes a 25% success fee | | **Merchant Fraud/Guarantee** | Order screening, liability shift | Signifyd, Riskified, Forter, ClearSale (Kount is scoring only - it doesn't offer a guarantee) | A percentage of each approved order. No vendor publishes the percentage | | **Managed Fraud Services** | Outsourced fraud operations | Radial | Custom managed-service pricing | The right combination depends on your [fraud mix](/docs/fraud/types) (ATO vs. first-party vs. third-party), transaction volume, and existing infrastructure. ```mermaid %%{init: {'themeVariables': {'quadrant1Fill': '#dcfce7', 'quadrant2Fill': '#fef3c7', 'quadrant3Fill': '#fee2e2', 'quadrant4Fill': '#dbeafe', 'quadrant1TextFill': '#1c1e21', 'quadrant2TextFill': '#1c1e21', 'quadrant3TextFill': '#1c1e21', 'quadrant4TextFill': '#1c1e21', 'quadrantPointTextFill': '#1c1e21', 'quadrantPointFill': '#1c1e21'}}}%% quadrantChart title Fraud Vendor Positioning x-axis "Lower Cost" --> "Higher Cost" y-axis "Less Control" --> "More Control" Stripe Radar: [0.15, 0.35] Shopify Built-in: [0.1, 0.15] Kount: [0.45, 0.55] Sardine: [0.5, 0.8] Sift: [0.55, 0.75] Signifyd: [0.65, 0.25] Riskified: [0.7, 0.2] Forter: [0.75, 0.3] NICE Actimize: [0.85, 0.9] Feedzai: [0.8, 0.85] ``` ## What Your Processor Already Gives You (and Where It Stops) {/* #what-your-processor-gives-you */} Stop. Before you buy anything, check what you're already paying for. Every major processor includes fraud tools at no extra cost. Most merchants under $1M/year need nothing beyond those plus [chargeback alerts](#how-chargeback-alerts-fit-in). | Processor | Custom rules? | Risk scores exposed? | Behavioral signals? | You've outgrown it when... | |---|---|---|---|---| | **Stripe Radar** | Yes, on the paid tiers (Standard, Plus, Pro) | Yes (0-99) | Limited | Card testing persists, need behavioral signals, multi-processor | | **Square** | No | No | No | Need any customization at all | | **Adyen RevenueProtect** | Yes (included) | Yes | Limited | Need deep device intel or cross-processor consortium | | **Shopify** | No | No (low/med/high only) | No | Chargeback rate exceeds 0.5% | | **Braintree** | Via Kount (Equifax) upgrade | Limited | No | Need advanced rules or review queues | Details on each: ### Stripe Radar **What you get free:** Radar Lite is included with Stripe Payments at no extra charge. That's ML risk scoring on every transaction, plus basic block/allow lists. Stripe.js collects device data, and everything scores in real time against Stripe's merchant network. **What the paid tiers add:** custom rules with if/then logic, manual review queues, and risk score thresholds for 3DS triggers. You also get advanced rule conditions like velocity and metadata matching, plus a risk insights dashboard. Stripe sells these as Standard, Plus and Pro. Each is a monthly subscription with a set number of screens included, counted per transaction, per active account and per customer. There's a pay-as-you-go alternative. :::warning["Radar for Fraud Teams" is not a product you can buy] The name appears nowhere on Stripe's Radar page, pricing page or docs as of 4 August 2026. The current tiers are Lite, Standard, Plus and Pro. Read a $0.02-per-transaction Radar figure anywhere and it describes something Stripe no longer sells. ::: **What the paid tiers cost.** US list, from [stripe.com/radar/pricing](https://stripe.com/radar/pricing) on 4 August 2026: | Tier | For your business | Platforms and marketplaces | |---|---|---| | **Standard** | From $10/mo | From $20/mo | | **Plus** | From $14/mo | From $44/mo | | **Pro** | From $20/mo | From $70/mo | Pay-as-you-go starts at **$0.05 per screened transaction** if your volume is low or spiky. Note the platform column: Standard doubles and Pro is three and a half times the single-merchant price, so budget from the right side of the table. Against the rest of this page, that's the number worth holding onto. **Radar Plus at $14/month is roughly 1/50th of SEON's $699 entry tier**, and Radar Lite is free. For a Stripe merchant, the question is rarely "Radar or a fraud platform" until Radar's ceiling actually binds - see what it can't do, below. **What Radar can't do:** - No behavioral biometrics. No typing patterns, no mouse dynamics. - No deep device intelligence, meaning 500+ signal fingerprinting. - No AML/KYC compliance. - Works on Stripe transactions only. It can't score orders from other processors. - Limited consortium depth against a dedicated fraud platform. **You've outgrown Radar when:** - Chargebacks keep climbing despite tuning rules. - You're seeing card testing that Radar's velocity rules don't catch. - You need behavioral signals to spot ATO or sophisticated bot attacks. - You process on multiple processors and need unified fraud scoring. ### Square **What you get:** Automatic ML-based fraud detection on all transactions. Zero setup required. **What Square can't do:** - No custom rules at all. You can't set thresholds or conditions. - No exposed risk scores. You can't see why a transaction was flagged. - No API access to fraud signals. - No manual review queue. - Very limited third-party fraud tool integrations. **You've outgrown Square when:** - You need any customization of fraud rules. - You want to know why transactions are being declined. - You need to feed fraud signals into other systems. - Your fraud patterns need more than automatic-only protection. ### Adyen RevenueProtect **What you get:** Risk scoring on every transaction and a basic rules engine. Then ShopperDNA device fingerprinting, velocity checks and referral lists. **What it costs:** Adyen doesn't publish a price for RevenueProtect. It doesn't publish an SMB rate card at all. The indicative figures it does show, it labels indicative. Plenty of people describe RevenueProtect as bundled with Adyen processing, resellers included. That claim appears nowhere on Adyen's own pricing page. Get it in writing before you count on $0. Source: [adyen.com/pricing](https://www.adyen.com/pricing), checked 2026-08-02. **What RevenueProtect can't do:** - The rules engine is less flexible than a dedicated fraud platform. - Limited behavioral biometrics. - The consortium is Adyen merchants only. - No guarantee model. You own all losses. **You've outgrown RevenueProtect when:** - You need behavioral biometrics or deep device intelligence. - Your fraud patterns need cross-processor consortium signals. - You want a guarantee to shift liability. ### Shopify **What you get:** Basic fraud analysis indicators on orders (low/medium/high risk flags). Shopify Flow for some automation. Shopify Protect covers eligible Shop Pay orders on select plans. **What Shopify can't do:** - No custom fraud rules. - No real-time scoring API. - The risk indicators are basic. It isn't a full scoring engine. - Shopify Protect covers Shop Pay and specific plan tiers only. **You've outgrown Shopify's built-in tools when:** - Your chargeback rate exceeds 0.5%. - You're seeing fraud patterns the basic indicators miss. - You need automated decisioning beyond Shopify Flow. ### Braintree (PayPal) **What you get:** Basic fraud tools included with processing. Kount-powered fraud detection available as an upgrade (Kount is owned by Equifax, integrated with Braintree via partnership). Risk data in transaction responses. **What a miss costs you:** Braintree charges **$15.00 per chargeback**. Nothing on the page says it's refunded if you win. Braintree's card rate is 2.89% + $0.29. Braintree pricing now lives on PayPal's site. Source: [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees), checked 2026-08-02. **What Braintree can't do:** - Advanced rules need the Kount upgrade, a separate product. - Limited behavioral signals. - The fraud tools sit second to payment processing. **You've outgrown Braintree's built-in tools when:** - You need advanced rules or ML scoring beyond the basics. - You're seeing fraud Braintree's automatic tools don't catch. - You want custom review queues or case management. For setup details on your processor's fraud rules, see [Processor Rules Configuration](/docs/fraud/processor-rules-configuration). Don't duplicate that work here. Go tune what you have first. :::tip[If Your Processor Tools Aren't Enough] Tuned your rules and chargebacks are still climbing? Seeing patterns your processor can't catch? Two paths. Add a [dedicated fraud platform](#the-upgrade-path-sardine) for deeper detection, or shift liability to a [guarantee provider](#guarantee-comparison). But get [chargeback alerts](#how-chargeback-alerts-fit-in) first. They're cheaper and faster to deploy. And they solve the most common SMB problem, which is ratio rather than fraud losses. ::: --- **Key Fact:** Radar Lite is included with Stripe Payments at no extra charge. Custom rules, review queues and 3DS control sit on the paid Radar tiers. Those are Standard, Plus and Pro, all monthly subscriptions with an included screen allowance. Guarantee providers like Signifyd and Riskified absorb 100% of fraud chargeback liability on orders they approve. Neither publishes what that costs. Signifyd publishes only the shape of the deal. A percentage of the order total on approved orders. Nothing when an order is declined for fraud. Sources: [stripe.com/radar](https://stripe.com/radar), [signifyd.com/pricing](https://www.signifyd.com/pricing/), checked 2026-08-02. ## Beyond Processor Tools: Dedicated Fraud Platforms {/* #the-upgrade-path-sardine */} When processor tools aren't enough, most merchants face a choice. Buy three separate tools, for device fingerprinting, behavioral biometrics and rules. Or find one platform that combines them. The three main platforms here are Sardine, Sift and Kount. Here's how they differ at a glance. Full [head-to-head below](#platform-head-to-head): | Capability | Sardine | Sift | Kount | |---|---|---|---| | Device intelligence | 500+ signals | Standard | Standard + Equifax identity | | Behavioral biometrics | Full (typing, mouse, touch) | Limited | None | | Rules engine | Yes | Yes (Workflows) | Yes (most configurable) | | AML/KYC compliance | Yes | No | No | | Content/promo abuse | No | Yes | Yes | | Consortium | Growing | "1T+ annual events" (Sift's figure) | Equifax consumer DB | Sardine gets a longer profile here for one reason. It's the only platform that folds device intelligence, behavioral biometrics and compliance into one SDK. That means fewer vendor contracts and one integration instead of three. It matters most for fintechs and merchants who need fraud and compliance together. If compliance isn't a concern, Kount gives you the most rule-building flexibility. Sift is strongest for marketplaces with content abuse problems. **What Sardine adds that processor tools don't:** - **500+ device signals.** It catches device spoofing, emulators, remote access tools and privacy browsers that slip past processor-level checks. - **Behavioral biometrics.** Typing cadence, mouse dynamics, touch pressure, scroll patterns. It catches ATO and bot attacks that look normal at the transaction level. - **Cross-client consortium.** Device and behavioral patterns across Sardine's customer network, not just your processor's merchants. - **AML/KYC compliance.** Anti-money laundering, sanctions screening and identity verification in the same platform. **How it layers with your processor:** Stripe Radar auto-declines clear fraud at score 90+. It auto-approves clean transactions under 20. Everything in between goes to Sardine for deeper analysis. Device spoofing, behavioral anomalies, synthetic identities, cross-merchant fraud rings. That keeps costs down, because you only send the uncertain transactions. **Setup:** JavaScript SDK + mobile SDKs + REST API. Days, not weeks. No hardware. **Pricing:** not published. Sardine publishes nothing. Ask whether the billing unit is a session, a device fingerprint or a decision. For a behavioral product the unit matters more than the rate. For full technical profiles of all three platforms, see the [vendor comparison below](#fraud-platform-comparison). --- ## How Chargeback Alerts Fit In {/* #how-chargeback-alerts-fit-in */} Chargeback alerts (Ethoca and Verifi) are **not fraud tools**. They don't prevent fraud. They prevent chargebacks. The distinction matters. Most SMBs buy a fraud platform when what they need is alerts. Three layers, three different jobs: ```mermaid flowchart LR subgraph prevent ["Prevention Layer"] direction LR T["Transaction"] --> P["Processor tools"] P --> F["Fraud platform"] F --> S["Order ships"] end subgraph alert ["Alert Layer"] direction LR D["Dispute filed"] --> AL["Chargeback alerts"] AL --> R["Refund before chargeback"] end subgraph recover ["Recovery Layer"] direction LR CB["Chargeback posts"] --> REP["Representment"] REP --> FIGHT["Fight the dispute"] end style S fill:#22c55e,color:#fff style R fill:#3b82f6,color:#fff style FIGHT fill:#f59e0b,color:#fff ``` **Prevention** (Radar, Sardine, Sift) stops fraud before you ship. **Alerts** (Ethoca, Verifi) stop chargebacks after the fraud happens but before the chargeback posts to your ratio. **Representment** (Chargebacks911, Gurus) fights chargebacks after they've already posted. ### Why You Should Add Alerts Before Buying a Fraud Platform If your main problem is chargeback ratio (not fraud losses), alerts are the faster, cheaper fix: - **No code changes.** Your reseller handles the integration. - **Live in days**, not weeks. - **Usually cheaper than a fraud platform.** Nobody publishes either number, so that's a structural argument rather than a verified one. Alerts bill per alert, so your cost scales with disputes. A fraud platform bills on your whole volume, so its cost scales with revenue. At a low dispute rate the maths favours alerts. Get both quotes before you take our word for it. - **Immediately deflects disputes** off your ratio, buying you time to fix root causes. A fraud platform prevents future fraud. Alerts stop today's disputes from becoming chargebacks. If your ratio is nearing 0.65%, you're at risk of a [monitoring program](/docs/compliance/network-rules/dispute-monitoring). Alerts are the emergency brake. ### How to Buy Alerts Don't go direct to Ethoca or Verifi. Buy through a reseller: - **Chargebacks911** and **Chargeback Gurus** bundle both Ethoca and Verifi into one service, covering Mastercard and Visa disputes. - Resellers handle the operational workflow. Matching alerts to orders, processing refunds, tracking outcomes. - Cost: not published. Neither Mastercard (Ethoca) nor Visa (Verifi) publishes a per-alert rate. Resellers quote individually. Get two quotes. Ask both whether they de-duplicate CDRN against Ethoca, so one dispute never bills twice. See [what chargeback alerts cost](/docs/chargebacks/prevention/chargeback-alert-pricing). - Setup: days. The reseller does the work. For detailed coverage of alert mechanics, see [Chargeback Alerts](/docs/chargebacks/prevention/alerts). For the full vendor comparison of Ethoca vs. Verifi vs. RDR vs. CDRN, see the [alert comparison below](#alert-comparison). --- ## By Platform: What to Buy {/* #by-platform-what-to-buy */} Your e-commerce platform determines which fraud tools integrate easily and which require custom development. :::warning[Under $500K/Month? Use Built-In Tools Only] Under $500K a month, don't add third-party fraud vendors. Your processor's built-in tools are enough. That's Stripe Radar, Adyen RevenueProtect, Shopify's fraud analysis, Square's automatic detection. At this volume a dedicated fraud platform will almost certainly cost more than your fraud losses. Focus on [billing descriptors](/docs/chargebacks/prevention/descriptors-and-comms) and [3DS on high-risk orders](/docs/fraud/prevention/3ds). Add [chargeback alerts](/docs/chargebacks/prevention/alerts) if your dispute ratio is climbing. ::: | Platform | Built-in fraud tools | Add alerts? | Need more fraud protection? | Setup effort | |---|---|---|---|---| | **Shopify** | Basic fraud analysis (free). Shopify Flow for some automation. Shopify Protect on eligible Shop Pay orders. | Yes, via reseller. No code needed. | Signifyd, Riskified, ClearSale have Shopify plugins (install in minutes). Sardine via API (developer needed). | Plugins: afternoon. API: 1-2 weeks. | | **WooCommerce** | None built-in. Depends on your payment gateway plugin. | Yes, via reseller. No code needed. | Kount, Signifyd, ClearSale have WooCommerce plugins. Sardine via API. | Plugins: afternoon. API: 1-2 weeks. | | **Stripe (direct API)** | Radar Lite free with Stripe Payments; custom rules on the paid Radar tiers. Strong rules engine. | Yes, via reseller. No code needed. | Sardine, Sift, Kount via API. Signifyd/Riskified via API. | Radar rules: afternoon. Third-party API: 1-2 weeks. | | **Square** | Automatic fraud detection. No customization. | Yes, via reseller. No code needed. | Limited options - most third-party fraud tools don't integrate directly with Square. Consider Signifyd. | Alerts: days. Third-party: evaluate carefully. | | **Adyen** | RevenueProtect (included). Solid rules engine, ShopperDNA device fingerprinting. | Yes, via reseller. No code needed. | Sardine, Forter, Riskified via API. | Alerts: days. Third-party API: 1-2 weeks. | | **BigCommerce** | Depends on your payment gateway. | Yes, via reseller. No code needed. | Signifyd, ClearSale have BigCommerce plugins. Others via API. | Plugins: afternoon. API: 1-2 weeks. | :::tip[Do You Need a Developer?] Chargeback alerts never need a developer. Your reseller handles setup. Platform plugins (Shopify, WooCommerce, BigCommerce) are self-service. API integrations (Sardine, Sift, Kount) need a developer for 1-2 weeks. No developer? Stick with platform plugins, or guarantee providers with a pre-built integration for your platform. ::: --- ## Recommended Stack by Volume {/* #recommended-stack-by-volume */} Most merchants don't need one vendor from every category. Here's a practical stack at different volumes, with names attached: | Annual Volume | What to Buy | Setup Effort | Developer Needed? | What It Costs | |---|---|---|---|---| | **Under $1M** | Processor built-in tools only (Stripe Radar Lite, Square, Adyen RevenueProtect) | Already done | No | **$0 for Stripe Radar Lite and Square's automatic screening**, both stated by the vendor. Adyen publishes no price for RevenueProtect - confirm it in your contract | | **$1M-$5M** | Processor tools + chargeback alerts (Ethoca + Verifi via Chargebacks911 or Chargeback Gurus) | Days | No | Per alert, quoted by the reseller. Not published by either network | | **$5M-$20M** | Processor tools + alerts + Sardine or Kount (if you want control) OR Signifyd or Riskified (if you want a guarantee) | 1-2 weeks | Yes for fraud platform, no for guarantee plugin | Quote-only. Platform: per API call or per transaction. Guarantee: a percentage of each approved order | | **$20M-$100M** | Signifyd/Riskified (guarantee) OR Sardine/Sift (platform) + alerts + Ekata or Iovation (identity enrichment) | 2-4 weeks | Yes | Quote-only across the stack | | **$100M+** | Layered stack: fraud platform + alerts + device intelligence + identity enrichment + possibly orchestration layer | 1-3 months | Yes (dedicated team) | Quote-only. At this size you're negotiating, not shopping a rate card | **Choosing between a fraud platform and a guarantee provider:** | | **Fraud Platform** (Sardine, Sift, Kount) | **Guarantee Provider** (Signifyd, Riskified, Forter) | |---|---|---| | **Who decides** | You set the rules and thresholds | The vendor decides for you | | **Who owns losses** | You | The vendor (on guaranteed orders) | | **Customization** | High - you control the logic | Low - the vendor controls the logic | | **False positives** | Under your control | Under their control (they tend to be conservative) | | **Best when** | You have a fraud analyst or someone managing rules | You want to shift liability and don't want to manage fraud ops | | **Revenue risk** | Lower false positive rate (you approve borderline orders) | Higher false positive rate (vendor declines borderline orders to protect their guarantee) | Don't buy tools you don't need yet. Every vendor here will sell to you happily, whether or not you'll get value from it. --- ## Vendor Comparison in Detail {/* #vendor-comparison-detail */} This section puts specific vendors side by side. How they integrate, what data they collect, how they decide, and what setup takes. They're grouped by what they do. ### Processor Built-in Tools (Start Here) {/* #processor-built-in-comparison */} These come with your payment processor at no extra cost, or close to it. No separate contract, no separate integration. | | **Stripe Radar** | **Square** | |---|---|---| | **Integration** | Automatic if on Stripe. Stripe.js collects device data at checkout. | Automatic on all Square products. No setup. | | **SDKs** | Web (Stripe.js), iOS (Stripe SDK), Android (Stripe SDK) | Square Web Payments SDK, Square iOS/Android SDKs | | **Data collected** | Device fingerprint, IP address, email, billing/shipping address, card metadata, transaction velocity, behavioral signals from Stripe.js | Transaction data, card metadata, device info from Square hardware/apps | | **Decision method** | ML risk score (0-99) on every charge + customizable rules engine | ML-based automatic scoring. No exposed score. | | **Customization** | High. Custom rules (if/then logic), block/allow lists, 3DS triggers, manual review queues, risk score thresholds. The paid Radar tiers add advanced rules. | Minimal. No custom rules, no exposed scores. Automatic only. | | **Consortium data** | Stripe's network of millions of merchants globally | Square's merchant network | | **Response time** | Real-time (every transaction scored at authorization) | Real-time | | **Fraud types** | CNP fraud, stolen cards, card testing | CNP fraud, card-present counterfeit | | **Pricing** | Radar Lite included with Stripe Payments at no extra charge. Standard, Plus and Pro are monthly subscriptions with an included screen allowance, or pay-as-you-go per screen. US tier prices not verified - read [stripe.com/radar/pricing](https://stripe.com/radar/pricing). Checked 2026-08-02. | Included with Square at no extra charge. Square's per-dispute chargeback fee is also **$0**: "There are no fees for dispute management services for chargebacks." | | **Best for** | Stripe merchants at any volume wanting configurable fraud rules | Square merchants wanting zero-config protection | | **Not for** | Non-Stripe merchants. Can't use Radar with another processor. | Merchants needing custom rules or advanced fraud ops | :::tip[When to Move Beyond Processor Tools] Your processor tools stop being enough on three signals. Your chargeback ratio is climbing despite using them. You're seeing patterns they don't catch, like card testing or ATO. Or you need a chargeback guarantee to shift liability. If none of those apply, stay here. ::: --- ### Fraud Scoring and Decision Platforms {/* #fraud-platform-comparison */} These screen transactions and accounts using ML, rules engines, device intelligence and consortium data. They help you decide whether to approve, decline or review. Some are full decision engines. Others are enrichment layers that feed signals into your existing stack. #### Sardine {/* #sardine */} **What it is:** AI-native fraud and compliance platform. It folds device intelligence, behavioral biometrics and a rules engine into one SDK. AML and KYC are covered too. **How it works:** you embed Sardine's SDK in your web or mobile app. As a user moves around your site, the SDK passively collects 500+ device signals and behavioral biometrics. Typing cadence, mouse movements, touch pressure, scroll patterns, copy-paste behavior. None of it adds friction. When a transaction or account event happens, you send it to Sardine's API. Sardine returns a risk score combining device intelligence, behavioral analysis and its cross-client consortium data. You can also build rules in Sardine's dashboard. Those auto-approve, auto-decline or route to review on score thresholds and custom conditions. | | | |---|---| | **Integration** | JavaScript SDK (web) + mobile SDKs + REST API for transaction/account events | | **SDKs** | Web (JavaScript), iOS (Swift), Android (Kotlin). Server-side API for event submission. | | **Data collected** | Device fingerprint (500+ signals: hardware, OS, browser, screen, fonts, WebGL, audio context), behavioral biometrics (typing speed, mouse dynamics, touch gestures, device tilt, scroll behavior), IP/network analysis, session replay data. You also send transaction and identity data via API. | | **Decision method** | ML scoring + configurable rules engine. Returns risk score + individual signal scores. You can build rules on top of scores in the dashboard. | | **Customization** | Full rules engine with if/then logic, custom thresholds, workflow routing. Can create rules combining Sardine signals with your own data. | | **Consortium data** | Cross-client device and behavioral consortium from Sardine's customer network | | **Also does** | AML transaction monitoring, KYC/KYB identity verification, sanctions screening, SAR filing workflows | | **Response time** | Real-time (sub-second API response) | | **Fraud types** | Account takeover, synthetic identity, card testing, bot attacks, new account fraud, payment fraud, money laundering | | **Pricing** | NOT PUBLISHED on vendor price. Nothing appears anywhere on [sardine.ai](https://www.sardine.ai/). REPORTED by [Vendr](https://www.vendr.com/marketplace/sardine) (SaaS buying and negotiation platform, no sample size disclosed): median contract **$95,333/year**, range $15,000-$254,480. The model description is the more valuable part: "you pay a minimum monthly commit, and draw down from that amount each month. Monthly costs include platform access fees, support, and rates for various products charged on consumption. Overages are charged monthly." **Ask for:** whether you're billed per session, per device fingerprint, or per decision, because for a behavioral product the unit matters more than the rate. Then ask for **annual rather than monthly true-up**, and **whether unused commit rolls forward**. A drawdown model with monthly overages can charge a seasonal business twice: unused commit in quiet months and overages at peak. | | **Best for** | Fintechs, crypto/web3, neobanks, BNPL, lending platforms, any business that handles money movement and needs fraud + compliance in one tool. Sardine's own customer list leans bank and fintech (Nubank, LHV, Modulr, bunq) more than merchant, which is worth weighing against a merchant-native tool like Signifyd. | | **Not for** | Simple DTC e-commerce under $1M. The compliance features are overkill if you just need basic transaction screening. | #### Sift {/* #sift */} **What it is:** Real-time ML platform built on a large merchant consortium. It covers payment fraud, account takeover, content abuse and promotional abuse. :::note[Sift's "34,000+ sites" figure has no source] That number appears nowhere on sift.com as of 2 August 2026. What Sift publishes now is "1T+ annual events" and "1.6B authentic digital citizens." See a site count in a comparison table? Ask where it came from. The vendor stopped saying it. Source: [sift.com](https://sift.com/), checked 2026-08-02. ::: **How it works:** you put Sift's JavaScript snippet on your site. Then you send events to Sift's REST API through their server-side libraries. Transactions, account actions, content posts. Sift returns a risk score, 0-100, for each event. You configure Workflows in Sift's console. That's automated decision logic combining Sift scores with your custom rules to approve, block or queue for review. Sift learns from your feedback. Tag transactions as fraud or legitimate and it retrains the model on your patterns. | | | |---|---| | **Integration** | JavaScript snippet (web) + mobile SDKs + server-side event API | | **SDKs** | Web (JavaScript), iOS, Android. Server-side libraries: Python, Ruby, Java, PHP, Node.js | | **Data collected** | Device fingerprint (browser, OS, hardware signals), IP geolocation, session behavior (pages viewed, time on site), email/phone metadata. You send transaction details, account data, and content data via API events. | | **Decision method** | ML scoring (Sift Score 0-100) + Workflows (configurable decision automation). Scores update in real-time based on new signals. | | **Customization** | Workflows let you build if/then decision trees combining Sift scores with custom fields. Custom event types beyond the built-in ones. Score thresholds for auto-approve/auto-decline. | | **Consortium data** | Sift Digital Trust Network. Sift's own published figures are "1T+ annual events" and "1.6B authentic digital citizens" (checked 2026-08-02). Cross-merchant signals for devices, emails, payment methods. | | **Also does** | Content abuse (fake reviews, spam, scam listings), account takeover detection, promo/coupon abuse, account creation fraud | | **Response time** | Real-time (sub-second scoring) | | **Fraud types** | Payment fraud, ATO, card testing, content abuse, promo abuse, fake accounts | | **Pricing** | NOT PUBLISHED on vendor price. Sift publishes no rate, no billing unit, and no pricing page at all. REPORTED by [Vendr](https://www.vendr.com/marketplace/sift-science) (SaaS buying and negotiation platform, **based on a stated 50 purchases with average savings of 16%**, the only sample size Vendr discloses for any vendor here): median contract **$150,000/year**, range $29,600-$600,000. Segments: **$40,000-$100,000** for small and mid-market at 100K-500K events/month on a single module; **$100,000-$300,000** mid-to-enterprise at 500K-2M events/month; **$300,000+** large enterprise above 2M events/month. Cost drivers reported as API call volume, feature modules and deployment complexity. Also reported: overage fees **20-50% above base rate**, professional services $5,000-$20,000+, premium support at a 10-20% premium, annual escalation 3-7%. **Ask for:** the billing unit, the rate, which event types are billable, and whether page views count. Then **get the overage rate in writing before signing** - at a reported 20-50% above base it is the most common unpleasant surprise - and cap the annual escalator at CPI or 3%. Ask for the rate expressed as a percentage of GMV so it benchmarks against Riskified's 0.237%. | | **Best for** | Marketplaces, platforms with content + payment fraud, businesses needing to track fraud across the full user journey (not just checkout) | | **Not for** | Merchants wanting a guarantee model (Sift doesn't offer one - you own the losses). Also expensive for very high-volume, low-margin businesses. | #### Kount (Equifax) {/* #kount */} **What it is:** Device intelligence + identity verification + highly configurable rules engine. Acquired by Equifax in 2021, giving it access to Equifax's consumer identity data. :::warning[Kount is being absorbed into Equifax] This is more than an ownership footnote. As of 2 August 2026, **Kount's own site forwards to [Equifax](https://www.equifax.com/business/identity-fraud/)**. Kount no longer has a site of its own. Equifax hasn't settled on one name for it either. Kount, Kount 360 and Equifax Identity and Fraud are all in use. Evaluating Kount means evaluating an Equifax product line mid-rebrand. **Ask for:** the current product name, and whether it's still sold standalone. Whether the Midigator chargeback automation Kount absorbed is still available, and under what name. Whether pricing is per transaction or a platform subscription. And what happens to your contract if the brand is retired. Sources: [kount.com](https://kount.com/) checked 2026-08-02. ::: **How it works:** you embed Kount's Device Data Collector JavaScript tag on your checkout page. The DDC collects device fingerprint data and sends it to Kount before the transaction completes. When the transaction fires, you send transaction details to Kount's API. Kount returns an Omniscore. That's a risk rating built on its ML models, device intelligence and Equifax identity data. You build custom rules in Kount's Command console. It's a visual rules editor where you define conditions and actions: approve, decline, review. Kount also gives you a case management queue for manual review. | | | |---|---| | **Integration** | JavaScript tag (Device Data Collector) + REST API for transactions | | **SDKs** | Web (JavaScript DDC), iOS SDK, Android SDK. Server-side integration via REST API. | | **Data collected** | Device fingerprint (browser, OS, hardware, plugins, timezone, language, screen resolution), IP geolocation, proxy/VPN detection. Via API: transaction details, billing/shipping addresses, email, phone. Enriched with Equifax consumer identity data. | | **Decision method** | Omniscore (ML risk score) + visual rules engine (Command console). Rules can reference Omniscore, device data, Equifax signals, velocity counters, and custom fields. | | **Customization** | Extensive. Visual rules builder with if/then logic, custom variables, velocity rules, time-based conditions. Manual review queues with custom workflows. Virtual analyst for automated decisioning. Most configurable of the merchant platforms. | | **Consortium data** | Kount's merchant network + Equifax consumer identity database | | **Response time** | Real-time (sub-second) | | **Fraud types** | CNP fraud, card testing, ATO, bot attacks, new account fraud, promo abuse | | **Pricing** | NOT PUBLISHED **on price and on the billing unit.** Midigator's site forwards to Kount's, and Kount's forwards to Equifax. Equifax publishes no rate card. **Ask for:** whether billing is per transaction or a subscription, the rate at your volume, the minimum commitment, and whether Equifax bundling changes it. If you hold legacy Kount or Midigator paper, the contractual questions matter more than the rate right now: **which Equifax entity holds your agreement, whether your specific module survives the absorption, and whether Equifax's standard data terms now apply.** | | **Best for** | Merchants wanting hands-on control over fraud rules. Gaming, digital goods, ticketing. Teams with a fraud analyst who wants to tune rules, not trust a black box. | | **Not for** | Merchants wanting a hands-off guarantee model. Steeper learning curve than guarantee providers - you need someone managing the rules. | #### FICO Falcon {/* #fico-falcon */} **What it is:** Enterprise fraud management platform for card issuers. 30+ years in market, protects billions of card accounts globally. The industry standard for issuer-side card fraud detection. **How it works:** Falcon sits in the authorization stream, between the card network and the issuer. A cardholder makes a purchase. The authorization request passes through Falcon before the issuer approves or declines. Falcon scores the transaction in real time. Its patented neural network models train on the Falcon Intelligence Network. That's consortium data from participating issuers worldwide. The score and its reason codes go back to the issuer's authorization system. Rules there decide whether to approve, decline or trigger step-up authentication. Falcon also gives analysts case management for flagged transactions, plus a rules engine for issuer-specific policies. | | | |---|---| | **Integration** | Processor-level integration in the authorization stream. Not a merchant-facing SDK. Deployed on-premises or cloud-hosted by FICO. | | **SDKs** | None for merchants. Integration is between issuer processors (e.g., FIS, Fiserv, TSYS) and FICO infrastructure. | | **Data collected** | Transaction data from authorization messages (amount, MCC, merchant, location, time, card-present vs. card-not-present), cardholder history, Falcon Intelligence Network consortium data. Does not collect device or behavioral data directly. | | **Decision method** | Patented neural network models continuously retrained on consortium data. Real-time transaction scoring + rules engine. Models are specific to card fraud patterns (not general ML). | | **Customization** | Rules engine for issuer-specific policies. Model tuning with FICO professional services. Strategy management for approval/decline/review thresholds. | | **Consortium data** | Falcon Intelligence Network - one of the largest in payments. Hundreds of billions of tagged transactions from thousands of issuers globally. | | **Response time** | Sub-millisecond scoring (must fit within authorization latency requirements) | | **Fraud types** | Card-not-present fraud, card-present counterfeit/lost-stolen, card testing, account takeover (at the issuer level) | | **Pricing** | **Not published.** Annual license plus implementation, negotiated per card portfolio. FICO publishes no figure and no tier. | | **Best for** | Card issuers (banks, credit unions) and issuer-processors | | **Not for** | Merchants. If you're a merchant, Falcon protects you indirectly (your customers' banks use it to approve/decline), but you don't buy or integrate Falcon. | #### Iovation (TransUnion TruValidate) {/* #iovation */} **What it is:** Device reputation network tracking 6B+ recognized devices globally. Now part of TransUnion's TruValidate identity and fraud suite. Primarily a device intelligence layer, not a full decisioning platform. **How it works:** you embed Iovation's JavaScript tag or mobile SDK on your site or app. When a user visits, the tag collects device attributes and generates a device hash. That hash gets checked against Iovation's device reputation database. That database is a global network of device histories. Iovation's own customers contribute it: banks, lenders, e-commerce, gaming companies. The API tells you three things. Whether the device has been seen before, its reputation score, and whether it's linked to known fraud. You also get proxy and VPN detection, plus anomalies like jailbreak, emulator or location spoofing. You then use those signals in your own rules engine or fraud platform. | | | |---|---| | **Integration** | JavaScript tag (web) + mobile SDKs + REST API for device lookups | | **SDKs** | Web (JavaScript), iOS, Android | | **Data collected** | Device fingerprint (hardware model, OS version, browser, screen resolution, timezone, language, installed plugins/fonts, WebGL renderer), IP analysis (proxy, VPN, Tor detection), device jailbreak/root detection, emulator detection, location spoofing detection | | **Decision method** | Device reputation scoring based on global network history. Returns reputation signals, not approve/decline decisions. You need your own rules or another vendor to act on the signals. | | **Customization** | You configure how to use the signals in your own system. Iovation provides the data; you provide the logic. Some rule-building capability within TruValidate. | | **Consortium data** | 6B+ recognized devices. Cross-industry device reputation from banks, lenders, gaming companies, e-commerce merchants. One of the largest device networks. | | **Also does** | Part of TransUnion TruValidate, which includes identity verification, document verification, and consumer credit data. Can be bundled. | | **Response time** | Real-time (sub-second device lookup) | | **Fraud types** | Device-level fraud: multi-accounting, account creation fraud, fraud rings using shared devices, device spoofing. Supplements but does not replace transaction-level fraud scoring. | | **Pricing** | Not published. TransUnion doesn't publish a TruValidate rate card, and this vendor wasn't part of the 2 August 2026 verification pass. **Ask for:** the per-lookup rate, whether unmatched lookups bill, and the minimum commitment. | | **Best for** | Adding a device intelligence layer to your existing fraud stack. Account creation flows. Login protection. Supplement to a transaction scoring tool. | | **Not for** | Standalone fraud solution. Iovation tells you about the device; it doesn't tell you about the transaction. You need to pair it with a decisioning platform or rules engine. | #### Ekata (Mastercard) {/* #ekata */} **What it is:** Identity verification APIs. They validate phone numbers, emails, physical addresses and IPs against authoritative data sources. Acquired by Mastercard in 2021. **How it works:** Ekata is a data enrichment API, not a screening tool with its own UI. A customer enters their information at checkout or signup. You send their email, phone, name, address and IP to Ekata's API. Ekata returns identity signals. Is this email address real? How old is it? Does the phone number belong to the person with this name? Is the IP consistent with the billing address? Does the phone, email, address and name combination look legitimate? You then use those signals in your own rules engine or fraud platform to inform the decision. | | | |---|---| | **Integration** | REST API only. No client-side SDK or JavaScript tag. Server-to-server calls. | | **SDKs** | None. API-only. Server-side HTTP calls from your backend. | | **Data collected** | Ekata does not collect data from your users directly. You send identity data to Ekata (email, phone, name, address, IP), and Ekata returns validation results from its proprietary data sources. | | **Decision method** | Identity risk scores + individual field validation results. Ekata does not make approve/decline decisions. It returns signals like "email is valid, 3 years old, matches name" or "phone number is a VoIP number registered 2 days ago." You build rules on these signals. | | **Customization** | N/A for the API itself - it returns data, not decisions. Your customization happens in whatever system consumes Ekata's output. | | **Consortium data** | Mastercard's identity data + Ekata's proprietary identity graph built from billions of identity data points | | **Response time** | Real-time (sub-second API response) | | **Available APIs** | Transaction Risk API (email, phone, address, IP validation), Identity Check API (name-to-phone/email matching), Address Risk API, Phone Intelligence API, Email Intelligence API, IP Risk API | | **Fraud types** | Synthetic identity detection, identity spoofing, account creation with fake credentials. Does not detect transaction-level patterns on its own. | | **Pricing** | **Not published.** Billed per query, quoted by Mastercard. **Ask for:** the per-query rate for each API you'll call, since Transaction Risk and Identity Check price differently, and whether unmatched lookups still bill. | | **Best for** | Enriching fraud decisions with identity validation. Adding identity signals to an existing fraud platform (Sift, Kount, custom rules). Step-up verification at signup or high-value transactions. | | **Not for** | Standalone fraud solution. Ekata provides data; you need another system to make decisions with it. | --- ### Chargeback Guarantee Providers {/* #guarantee-comparison */} These vendors approve or decline your orders. If they approve one and it becomes a fraud chargeback, they reimburse you. You pay a percentage of approved sales for this liability shift. The vendor makes the approve/decline decision - not you. | | **Signifyd** | **Riskified** | **Forter** | **ClearSale** | **Radial** | |---|---|---|---|---|---| | **Founded** | 2011 (San Jose, CA) | 2013 (Tel Aviv). Public: NYSE RSKD | 2013 (Tel Aviv / New York) | 2001 (Sao Paulo, Brazil). Public: B3 CLSA3 | N/A (managed service provider) | | **Integration** | JS device fingerprint + REST API | JS beacon + REST API | JS snippet + REST API | JS tag + REST API or platform plugin | Full managed service | | **SDKs / Platform plugins** | JavaScript, Shopify, Salesforce Commerce, BigCommerce, Magento, SAP, custom API | JavaScript, Shopify, Magento, BigCommerce, WooCommerce, custom API | JavaScript, Shopify, Salesforce Commerce, Magento, custom API. Pre-built processor connections (Adyen, Stripe, Braintree). | JavaScript, Shopify, Magento, WooCommerce, BigCommerce, VTEX, Salesforce Commerce | Varies by implementation | | **Data collected** | Device fingerprint, transaction data, shipping/billing, email, phone, order history. Score (0-1000) considers 100+ signals from order data + Commerce Network. | Device fingerprint, behavioral biometrics (mouse movements, typing patterns via JS beacon), transaction data, account history | Device fingerprint, behavioral biometrics, identity signals, transaction data. Builds persistent buyer profiles across merchants. | Device fingerprint, transaction data, customer data. CPF (Brazilian ID) validation for LATAM. | Depends on implementation | | **Decision method** | ML scoring across Commerce Network + auto-approve/decline. Score mapped to ACCEPT, REJECT, or HOLD. | ML models + proprietary network intelligence. Reports 95-98% approval rates for many merchants. | Trusted Identities Network (cross-merchant identity graph) + ML. Binary approve/decline only - no review queue. | ML scoring + **1,500+ human fraud analysts** for uncertain cases. Claims 99%+ approval rates due to human review layer. | ML tools + human fraud analyst team | | **Decision speed** | Real-time (sub-second at checkout). Pre-auth or post-auth modes. | Real-time (sub-second) | Real-time, sub-400ms. No manual review - fully automated. | ML decisions in real-time; human-reviewed orders: minutes to hours | Varies. Managed service, not pure automation. | | **Guarantee terms** | 100% financial guarantee on approved orders. Signifyd pays the chargeback amount + chargeback fee. Covers unauthorized transaction + INR on qualifying orders. | 100% guarantee on approved orders. Includes Dispute Resolve (representment on guaranteed chargebacks). Covers unauthorized + INR with tracking. | 100% guarantee on approved orders. Covers unauthorized + INR on qualifying orders. Forter handles representment. | 100% guarantee on approved orders (Total Guaranteed Protection product). Also offers non-guarantee tier (Total Protection) at lower cost. | Guarantee available as part of managed service | | **Customization** | Policies and thresholds configurable. Signifyd makes final guarantee decisions. Pre-auth, post-auth, or shadow mode options. | Limited for guarantee orders. Riskified makes the call. | Limited. Forter makes the call for guarantee. No review queue by design. | Limited. ClearSale makes the call. LATAM/cross-border expertise is a differentiator. | High (managed service is tailored to your business) | | **Also offers** | Abuse Prevention (policy, return, promo abuse), Payments Optimization, Account Protection, Checkout Optimization | Auth Rate Enhance, Policy Protect (return/promo/reseller abuse), Account Secure (ATO), PSD2 Optimization | Abuse Prevention, Identity Protection (ATO, fake accounts), Payment Optimization, Trusted Conversions | Chargeback Insurance (standalone), Application Fraud prevention | Full outsourced fraud operations (analysts + technology), order management, fulfillment, customer care | | **Pricing (checked 2026-08-02)** | V **Model published, numbers not.** Signifyd's own words: "Signifyd charges a percentage of the order total when an order is approved," varying by products purchased, vertical, order volume and average ticket. And: "There is no charge when an order is declined due to fraud." No percentages anywhere ([signifyd.com/pricing](https://www.signifyd.com/pricing/)). Free to install on Shopify with a 14-day trial, charges billed separately. R Vendr median **$4,444/yr**, range $2,089-$48,889, **no sample size** | NP as a rate card ([riskified.com/pricing](https://www.riskified.com/pricing/) is a contact form). D **0.237% of GMV**, from $88.3M revenue on $37.2B GMV, Q1 2026 released 2026-05-13. FY2026 guidance $376M-$384M revenue | NP No model, no tiers, no rate card ([forter.com/pricing](https://www.forter.com/pricing/)). R Vendr median **$8,000/yr**, range $6,000-$375,000, **contradicted by the same page's** "mid-market low to mid-five figures, enterprise mid-six figures or higher". Reported: multi-year discounts 10-20%, implementation fees low-to-mid five figures, annual escalation 3-7% | NP Contact sales | NP Custom managed-service pricing | | **Ask for** | Whether you're buying **fraud-only protection or total chargeback liability shift** - wildly different products sold under one name. The percentage for your vertical and average ticket. How friendly-fraud and item-not-received disputes are treated. Whether any part of the fee is at risk against an approval-rate SLA | The percentage of approved GMV, guarantee scope, and the exact liability transfer terms. **Bring the 0.237% derived benchmark to a renewal**: take rate is drifting down year on year, 0.241% to 0.237%, while gross margin improves 49% to 52% | The rate **as a percentage of approved GMV**, so it benchmarks against 0.237%. Negotiate the implementation fee, reported as the most discountable line. Cap the 3-7% escalator. Ignore the "72% chargeback reduction" and "46% false decline reduction" marketing claims: no methodology, sample or period is published | Guarantee tier vs non-guarantee tier pricing, and what human review does to decision latency | Which functions are in scope, and what happens to the guarantee if you insource part of it | | **Best for** | Enterprise retail ($10M+). Apparel, electronics, home goods. | Mid-to-enterprise e-commerce ($5M+). Strong account management. Fashion and luxury verticals. | Enterprise e-commerce. Merchants who want zero manual review overhead. Luxury and high-value retail. | International/cross-border e-commerce. LATAM markets. Merchants prioritizing highest possible approval rates. | Retailers wanting to outsource their entire fraud operation - no internal fraud team needed. | | **Not for** | Low-margin businesses where guarantee cost exceeds fraud savings | Merchants wanting full control over approve/decline decisions | Merchants wanting configurable rules or a manual review queue | Merchants needing instant decisions on every order (human review adds delay) | Merchants who want self-service tools and full control | :::warning[The Guarantee Tradeoff] Guarantee providers make money by being conservative. They decline borderline orders you might have approved. Before you celebrate the guarantee, do the sum. How much revenue are you losing to their false positives? A 0.5% fraud rate with 2% false positives can cost more than a 0.8% rate with 0.3%. Ask every guarantee vendor for their **decline rate** on your traffic during a pilot. ::: **How guarantee providers actually work (the data flow):** 1. Customer reaches your checkout page 2. The vendor's JavaScript collects device and behavioral data from the browser 3. Customer submits the order 4. Your server sends order details (items, amounts, addresses, email, phone) to the vendor's API 5. The vendor's ML model scores the order using device data + transaction data + their merchant network consortium 6. The vendor returns approve, decline, or review (some vendors auto-decide; ClearSale may send to human review) 7. If approved and you ship, and the customer later files a fraud chargeback, the vendor reimburses you 8. If declined, you can either cancel the order or override the decline (but you lose the guarantee on overridden orders) --- ### Chargeback Alerts and Prevention {/* #alert-comparison */} These stop disputes before they become chargebacks. A cardholder complains to their bank. You get notified. You can refund before the chargeback is filed. That keeps the dispute off your chargeback ratio. These aren't fraud detection tools. They don't prevent fraud. They prevent the chargeback. | | **Ethoca** | **Verifi RDR** | **Verifi CDRN** | **Order Insight** | **Consumer Clarity** | |---|---|---|---|---|---| | **Owner** | Mastercard (acquired 2019). Founded 2005 (Toronto). | Visa (acquired 2019). Founded 2005 (Los Angeles). | Visa | Visa | Mastercard | | **How it works** | When a cardholder disputes with their issuer, Ethoca notifies you. You have 24-72 hours to refund and prevent the chargeback from posting. Also offers Fraud Insights - confirmed fraud data from issuers fed back to merchants for model training. | You pre-set rules (amount thresholds, reason codes, transaction age, MCC). When a dispute matches your rules, it's auto-resolved before the chargeback is filed. No manual intervention needed. | Manual alerts similar to Ethoca. You receive notification and have 72 hours to decide whether to refund. Being integrated into Visa Resolve Online. | Sends your transaction details (order details, shipping info, delivery confirmation, digital receipt) to the issuer so the cardholder can recognize the charge before disputing. | Sends merchant logos, itemized receipts, and location data to issuers. Helps cardholders recognize charges in their banking app before they call to dispute. | | **Integration** | Portal access or API. Most merchants use a reseller (Chargebacks911, Chargeback Gurus, Chargeblast). | Rules configured via Visa or reseller portal. Stripe has a built-in RDR toggle. | Portal or API via reseller | API integration to send order details (items, shipping, tracking, customer comms, merchant contact info) | API integration to send order details | | **Automation** | Manual - you must act on each alert (refund or ignore) | Fully automated once rules are set | Manual - you review each alert and decide | Automated (data flows to issuer without merchant action per-transaction) | Automated | | **Network coverage** | All card networks (not just Mastercard). 5,000+ issuers globally. | Visa only (primary) | Visa + some Discover | Visa only | Mastercard only | | **Response window** | 24-72 hours | Instant (automated) | 72 hours | N/A (preventive, not reactive) | N/A (preventive, not reactive) | | **Your cost per event** | NP from Mastercard. **Resellers publish**: Chargeblast **$14** per chargeback stopped, Disputifier **$17-$27.50** per alert, Chargeflow **$29** per deflected chargeback | NP from Visa. Billed per resolved case by a reseller. Budget 1-2 weeks to enable, because RDR routes through your acquirer | NP from Visa. Same reseller prices as Ethoca above; most resellers bundle both | NP Often free or low-cost, via Visa or a reseller. 1-2 weeks to enable | NP Often free or low-cost, via Mastercard or a reseller | **The network absence is structural, and that's itself the answer.** Neither Visa nor Mastercard sells a retail per-alert price to most merchants. They license into a reseller and acquirer channel, and the reseller sets retail. That's why Chargeblast publishes $14 and Chargeflow $29 for substantially the same Ethoca and CDRN feed. **You're not negotiating with the network. You're negotiating the reseller's margin.** Three things to get in writing from any reseller, none of which is published: 1. **The de-duplication rule.** If one transaction fires both an Ethoca and a CDRN alert, does it bill once or twice? Chargeflow is the only provider publishing a stance, a "Zero Duplication Guarantee". A marketing guarantee isn't a contract term until it's in your agreement. Disputifier's "never pay for any alerts with issues" is vague, and it's **not** the same thing. 2. **Which of the four programmes is included** at the quoted price. Ethoca, CDRN, RDR, Order Insight. A price covering only Ethoca isn't comparable to one covering all four. 3. **The setup fee and monthly minimum.** None of the resellers publishes either. *Reseller prices from the [Chargeblast](https://apps.shopify.com/chargeblast), [Disputifier](https://apps.shopify.com/disputifier) and [Chargeflow](https://apps.shopify.com/chargeflow) Shopify App Store listings and from [chargeflow.io/pricing](https://www.chargeflow.io/pricing) and [disputifier.com/pricing](https://www.disputifier.com/pricing), all checked 2026-08-02. Chargeblast's own pricing page never resolved, so its Shopify listing is the only readable source. Shopify makes developers declare their charges. That's why any of these numbers are public. Note too that Disputifier's own pricing page says only "custom volume-based pricing" for alerts. Its Shopify listing publishes the $17-$27.50 range.* | **What you lose** | The sale (you refund), but you avoid the chargeback fee and ratio impact | The sale (auto-refunded), but no chargeback fee or ratio impact | The sale (if you choose to refund) | Nothing - prevents the dispute from being filed in the first place | Nothing - prevents the dispute from being filed | | **Best for** | Non-US merchants, Mastercard-heavy volume. High-risk verticals (digital goods, subscriptions, travel). Combined with Verifi RDR for maximum coverage. | Any Visa merchant wanting automated dispute deflection. Approaching 0.9% chargeback threshold. High Visa volume. | Merchants wanting to review each dispute before refunding. Being supplanted by RDR for many use cases. | Reducing "I don't recognize this" disputes | Same as Order Insight but for Mastercard | :::tip[Alert Strategy] Most merchants should use both Ethoca and Verifi together to cover both Mastercard and Visa disputes. Buy through a reseller (like Chargebacks911 or Chargeback Gurus) rather than going direct - resellers often bundle both networks and handle the operational workflow for you. ::: **How alert services actually work (the data flow):** 1. Customer calls their bank and says "I don't recognize this charge" or "I didn't make this purchase" 2. Before the bank files a formal chargeback, Ethoca or Verifi notifies you (the merchant) 3. **Ethoca path:** You see the alert in your portal or receive it via API. You have 24-72 hours to refund. If you refund, the dispute never becomes a chargeback. If you don't respond, the bank files the chargeback normally. 4. **Verifi RDR path:** Your pre-set rules evaluate the dispute automatically. If the dispute matches (e.g., amount under your threshold), it's auto-refunded and resolved. No manual action needed. 5. Either way, a refund costs you the sale price. A chargeback costs you the sale price, plus your processor's dispute fee, plus the hit to your dispute ratio (which can trigger [monitoring programs](/docs/compliance/network-rules/dispute-monitoring) above 0.65%). **What your processor actually charges for a dispute**, read off each vendor's own fee page on 2026-08-02: | Processor | Dispute cost | Refunded if you win? | Source | |---|---|---|---| | **Helcim** | **$0** if the case resolves in your favour, $15 if you lose | Yes, entirely. The only win-is-free policy here | [helcim.com/pricing](https://www.helcim.com/pricing/) | | **Stripe** | **$15 to receive the dispute, plus $15 to counter it** | Partly. The $15 received fee is never returned. The $15 countered fee comes back only on an outright win. On a partial win you get neither back, so fighting and partly winning costs you $30 | [support.stripe.com](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) | | **Braintree** | **$15.00** | Not stated | [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | | **PayPal**, standard | **$15.00** on PayPal-account and Guest Checkout disputes, or **$20.00** on card chargebacks. The two attach to different channels and never both apply | The $15 isn't charged for disputes "Decided in your favor by PayPal or your issuer". The $20 is charged "regardless of whether the buyer is successful" | [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) | | **PayPal**, high volume | **$30.00**, once your dispute ratio hits 1.5% with more than 100 sales in the prior three full calendar months | **No.** The win exemption is absent from this tier | [PayPal User Agreement](https://www.paypal.com/us/legalhub/paypal/useragreement-full) | | **Stax** | Chargeback protection is an optional add-on at **$25 per chargeback** | N/A - it's insurance, not a fee | [staxpayments.com/pricing](https://staxpayments.com/pricing/) | | **Moneris** (CAD) | **CA$25.00**, plus a separate **CA$80.00** authorization chargeback handling fee | Not stated | [moneris.com/en/pricing](https://www.moneris.com/en/pricing) | | **Square** | **$0.** "There are no fees for dispute management services for chargebacks - we cover the fee for every dispute that we work together to challenge" | Nothing to refund. The Payment Terms separately reserve the right to recover network fines, which are not a dispute fee | [squareup.com/help](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough) | | **Authorize.net** | **$0.00** on card chargebacks, **$25.00** on eCheck.Net | Nothing to refund on cards. Gateway fee only, so your merchant account bills its own on top | [authorize.net/pricing](https://www.authorize.net/en-us/sign-up/pricing.html) | | **Shopify Payments** | **$15.00** in the US | **Yes.** "If you win the chargeback, then the fee is returned to you" | [help.shopify.com](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process) | | **Toast** | **$15.00** per chargeback notification | **No.** "Regardless of whether you dispute the chargeback, and regardless of whether you win or lose" | [support.toasttab.com](https://support.toasttab.com/en/article/Chargeback-FAQ) | | **Adyen, Clover, Worldpay, Global Payments** | **Not published** | Unknown | Checked each vendor's own pricing and help pages | The whole published US span is **$0 to $30**. Nothing on that table reaches the $100 that circulates in vendor content. [That $100 traces to one undated sentence in Adyen's own marketing article](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated), not to any fee schedule. Stripe's structure punishes fighting. Represent a dispute, win part of it, and you're out $30 either way. So the arithmetic on whether to fight is worse than the headline $15 suggests. PayPal's ordinary tier is the opposite. A wallet dispute you win costs nothing. That reverses above a 1.5% dispute ratio, where every dispute costs $30, wins included. If dispute economics drive your processor choice, two policies are worth knowing. Square's flat $0, and Helcim's $0-if-you-win. --- ### Chargeback Management and Representment {/* #representment-comparison */} These vendors fight chargebacks after they're filed. They compile evidence, submit compelling evidence packages, and handle representment on your behalf. Many also bundle alert services (Ethoca/Verifi). #### Full-Service and Analytics Platforms | | **Chargebacks911** | **Chargeback Gurus** | |---|---|---| | **Founded** | 2011 (Tampa, FL) | 2014 (McKinney, TX) | | **What it is** | Full-service chargeback company. Prevention (alerts) + representment + root cause consulting. Core technology: Intelligent Source Detection (ISD) - identifies whether each chargeback is true fraud, friendly fraud, or merchant error. | Full-service prevention + representment + consulting. Boutique, consultative approach. | | **How it works** | You give them access to your payment data (processor integration). They manage your Ethoca/Verifi alerts, compile evidence for representment, submit disputes on your behalf, and provide root cause analysis via ISD. Fully outsourced. | Same model - processor integration, alert management, representment, and consulting. More hands-on advisory relationship. They actively help you fix the root causes of your disputes. | | **Integration** | Connects to your processor (Stripe, Braintree, Adyen, etc.) via API or portal credentials | Connects to your processor via API or portal credentials | | **Alert bundling** | Yes - bundles Ethoca + Verifi (RDR/CDRN) into their service. Single integration for both networks. | Yes - bundles Ethoca + Verifi. Handles alert response workflow for you. | | **Representment** | Full-service. They compile evidence, write response letters, submit to all networks (Visa, Mastercard, Amex, Discover), track outcomes. Win rate tracking and analytics included. | Full-service. Same evidence compilation and submission. Known for strong evidence quality in travel/hospitality. | | **Analytics** | Reporting and ISD root cause analysis included. Also offers False Positive Reduction (FPR) to reduce false declines from your fraud filters. | Root cause consulting is a core differentiator | | **Pricing** | Not published. Performance-based (a share of recovered revenue) or hybrid. Alert management billed per alert. Consulting on retainer or per project. | Not published. Performance-based or monthly retainer | | **Best for** | Merchants wanting fully outsourced dispute management. High-volume businesses (500+ disputes/month). | Travel, hospitality, subscription businesses. Merchants wanting strategic guidance, not just dispute fighting. | | **Not for** | Merchants with fewer than 50 disputes/month (cost won't justify the service) | Merchants wanting pure automation with no consulting relationship | | **Watch out for** | Settled with FTC and Florida AG in 2023 over deceptive representment practices (fabricated evidence submission and sham microtransactions to deflate chargeback ratios). Now operating under consent order. Verify current compliance during evaluation. | Smaller team - personalized service is a pro, but capacity may be limited for very high volume | :::warning[Midigator no longer exists as a vendor you can buy from] Midigator used to appear here as a third option, described as a Mitek company. Both halves of that were wrong. Midigator was acquired by **Equifax** in 2022 and folded into Kount, not Mitek. As of 2 August 2026, **Midigator's site forwards to Kount's**, and Kount's forwards to **[Equifax](https://www.equifax.com/business/identity-fraud/)**. That chain is the vendor's own confirmation that the brand is retired. There's nothing left to evaluate under the name. **If you're shopping:** Equifax's identity and fraud line now covers the analytics-led, self-service slot Midigator used to fill. So does [Chargeflow](#ai-automated-representment), if you want automation with published pricing. **If you already have a Midigator contract:** ask Equifax which entity your agreement now sits with. Ask whether the product is still developed. And ask what the migration path and exit terms are. Sources: midigator.com and kount.com redirect chains observed 2026-08-02. ::: #### AI-Automated Representment These newer vendors automate representment with AI. They connect to your data sources, build the evidence package and submit it. No manual work. | | **Chargeflow** | **Justt** | |---|---|---| | **Founded** | 2020 (Tel Aviv, Israel) | 2020 (Tel Aviv, Israel) | | **What it is** | AI-driven automated representment. Shopify-first. Connects to your e-commerce platform and payment processor, auto-detects chargebacks, generates tailored evidence packages, and submits representment. | AI-driven automated representment with a human expert review layer. Connects to your processor and platform, auto-compiles evidence, then human experts review and enhance before submission. | | **Integrations** | Shopify, Stripe, PayPal, Braintree, WooCommerce | Stripe, PayPal, Adyen, Braintree, and others | | **Automation level** | Fully automated - AI pulls order data, shipping info, and customer communications, then submits without manual merchant action | AI-powered evidence collection + human expert review for complex disputes | | **Pricing** | 25% success fee on recovered chargebacks. No monthly fee. No setup fee. Free plan available for basic analytics and dispute tracking. | Pay-for-success model (fee on recovered chargebacks). No upfront costs. Contact for specific rates. | | **Best for** | Shopify merchants wanting hands-off representment with zero upfront cost | Merchants wanting AI automation with a human quality layer for complex disputes | | **Not for** | Merchants wanting root cause consulting or prevention strategy | Merchants wanting deep analytics or prevention consulting | #### Alert Aggregation | | **Chargeblast** | |---|---| | **What it is** | Simple chargeback alert aggregation. Bundles Ethoca + Verifi CDRN alerts into a single platform with easy onboarding. Focused on simplicity - no representment, no consulting, just alert coverage. | | **How it works** | Aggregates alerts from both networks. Automated refund processing on alerts. Dashboard for alert tracking. Simple API or dashboard-only options. | | **Integration** | Simple API or dashboard-only. Fast onboarding. | | **Best for** | Merchants who want alert coverage without the complexity of a full-service chargeback management vendor. Quick setup, minimal overhead. | | **Not for** | Merchants who need representment, root cause analysis, or consulting. Chargeblast is alerts only. | :::note[Build In-House or Outsource?] Under 50 disputes a month, you can probably handle representment yourself with your processor's tools. Over 50/month, the operational burden justifies a vendor. Over 200/month, you should either outsource or hire a dedicated dispute analyst. ::: --- ### Head-to-Head: Signifyd vs Riskified vs ClearSale {/* #guarantee-head-to-head */} The most common guarantee provider decision. All three guarantee approved orders. They differ on how they decide, who they're built for, and what else they offer. | | **Signifyd** | **Riskified** | **ClearSale** | |---|---|---|---| | **Founded** | 2011 (San Jose, CA) | 2013 (Tel Aviv). NYSE: RSKD | 2001 (Sao Paulo, Brazil). B3: CLSA3 | | **Minimum volume** | Not published. Positions itself as "the #1 choice for enterprise ecommerce retailers" | Not published. Enterprise positioning: retail, luxury fashion, travel, digital goods | Not published. Works further down-market than the other two | | **Pricing (checked 2026-08-02)** | Model published, numbers not: a percentage of the order total on approved orders, nothing charged when an order is declined for fraud | Not published. Contact form only | Not published | | **Decision speed** | Real-time (sub-second). Pre-auth or post-auth modes available. | Real-time (sub-second) | ML is real-time; uncertain orders go to 1,500+ human analysts (minutes to hours) | | **Approval rate tendency** | High, but conservative on borderline orders. Score range: 0-1000. | Reports 95-98% approval rates. Strong account management to tune rates. | Claims 99%+ approval rates - human review catches what ML alone would decline | | **Platform plugins** | Shopify, Salesforce Commerce, BigCommerce, Magento, SAP | Shopify, Magento, BigCommerce, WooCommerce | Shopify, Magento, WooCommerce, BigCommerce, VTEX, Salesforce Commerce | | **Extras** | Abuse Prevention (policy, return, promo), Payments Optimization, Account Protection, Checkout Optimization | Auth Rate Enhance, Policy Protect (return/promo/reseller abuse), Account Secure (ATO), PSD2 Optimization, Dispute Resolve | Chargeback Insurance (standalone tier), Application Fraud, LATAM payment methods (boleto, PIX) | | **Best for** | Enterprise retail ($10M+). Apparel, electronics, home goods. | Mid-to-enterprise e-commerce ($5M+). Merchants who want active account management. Fashion and luxury. | International/cross-border e-commerce. LATAM markets. Merchants who prioritize high approval rates over instant decisions. | ### Head-to-Head: Sift vs Kount vs Sardine {/* #platform-head-to-head */} The most common fraud platform decision. All three let you control fraud rules. They differ on the signals they use and what else they cover. | | **Sift** | **Kount** | **Sardine** | |---|---|---|---| | **Founded / owner** | 2011 (San Francisco). Sift Science, Inc., privately held | 2007 (Boise, ID). **Equifax** since 2021, and kount.com now redirects to Equifax - you're buying an Equifax product line | 2020 (San Francisco). SardineAI Corp, privately held. Founded by a former Coinbase Head of Risk | | **Integration effort** | JS snippet + server-side event API. Server SDKs in Python, Ruby, Java, PHP. Moderate. | JS tag (Device Data Collector) + REST API. Moderate. | JS SDK + mobile SDKs (iOS/Swift, Android/Kotlin, React Native) + REST API. Moderate. | | **Device intelligence** | Standard browser/OS/IP fingerprinting via sift.js | 200+ device attributes via DDC. Persistent device ID across sessions. + Equifax consumer identity data | 500+ device signals (hardware, OS, browser, WebGL, audio context, fonts). Deepest fingerprinting of the three. | | **Behavioral biometrics** | Limited (session behavior, pages viewed) | None built-in | Full behavioral biometrics (typing speed/rhythm/pressure, mouse dynamics, touch gestures, device tilt, scroll behavior, copy-paste detection) | | **Scoring** | Sift Score 0-100 per abuse type. 16,000+ feature signals. Ensemble of ML models. | Omniscore 0-99. ML trained on Identity Trust Global Network data. | ML risk score + individual signal scores. Combines device, behavioral, and consortium signals. | | **Rules engine** | Workflows with if/then logic, custom fields, A/B testing (shadow mode), performance metrics | Visual rules builder (Command console) with 200+ data attributes. Velocity, threshold, list, persona, geographic, and device rules. Most configurable of the three. | Visual rule builder with AND/OR logic, velocity rules, list management, shadow mode, rule performance analytics | | **AML/compliance** | No | No | Yes - AML transaction monitoring, KYC/KYB, sanctions screening (OFAC, EU, UN, PEP), adverse media screening, SAR/CTR filing | | **Consortium size** | "1T+ annual events," "1.6B authentic digital citizens" (Sift's current published figures). The 34,000-sites number is retired | Not verifiable. Kount's own site now redirects to Equifax, so its network figures can't be re-checked at source. Ask Equifax | Cross-client device and behavioral consortium (growing). No figure published | | **Also does** | Content abuse (spam, scams, fake reviews), promo abuse, PSP merchant risk monitoring, dispute management | Account takeover protection (Kount Control), processor/ISO-level fraud (Kount Central) | Document verification (ID, passport), liveness detection, case management with SAR filing | | **Pricing (checked 2026-08-02)** | Not published, and neither is the billing unit. Commonly described as per event rather than per transaction. Ask, because page views and account events would count | Not published, and neither is the billing unit. Ask whether it's per transaction or a platform subscription, and whether Equifax bundling changes it | Not published. Ask whether the unit is a session, a device, or a decision | | **Best for** | Marketplaces and platforms with content + payment fraud. Businesses tracking fraud across the full user journey (not just checkout). | Merchants wanting hands-on rule control. Gaming, digital goods, ticketing. Teams with a fraud analyst who wants to tune rules. | Fintechs, crypto/web3, neobanks, BNPL, platforms handling money movement. Anyone needing fraud + compliance in one tool or seeing sophisticated device spoofing/ATO. | --- ## Identity Verification Identity verification vendors split two ways. **Passive** is data checks, with no customer friction. **Documentary** is ID scan plus selfie plus liveness. Start passive. Step up to documentary only for high-risk cases. For a full guide on building a verification program, see [KYC & KYB for Fraud Prevention](/docs/fraud/prevention/kyc-kyb). :::note[About the per-check prices below] These ranges are indicative. They weren't re-checked in the 2 August 2026 pass. Most IDV vendors don't publish rates at all. Only a handful publish one without a sales call. Veriff, Sumsub, Persona, iDenfy and Stripe Identity. Treat everything else here as a starting point for a quote, not a rate card. Ask three things. The per-check rate at your expected volume. The minimum commitment. Whether failed or inconclusive checks still bill. ::: ### Passive Verification These vendors verify identity from data signals. No document uploads, no selfies, no added friction. #### Socure Socure is one of the strongest passive identity platforms in the US market. It says 4 of the top 5 US banks use it. That's a vendor claim, not verified here. It scores several signals at once: SSN, phone, email, device and address. Synthetic identity detection is its strength. - **Best for:** US-focused businesses with synthetic fraud exposure. - **Cost:** $0.10-0.50+ per check. - **Coverage:** US-centric (international coverage is thinner). - **Standout:** The synthetic fraud scoring model. Nobody else here matches it. Socure also does documentary verification. #### SentiLink SentiLink is a synthetic identity scoring specialist. It does one thing - detect [synthetic identities](/docs/fraud/types/synthetic-identity) - and does it extremely well. Most people run it alongside other vendors, as a focused synthetic fraud layer. - **Best for:** Adding synthetic ID detection to an existing stack. - **Cost:** $0.02-0.15 per check. - **Coverage:** US only. - **Standout:** Purpose-built for synthetic fraud. Lightweight integration, fast API. #### Prove Prove verifies identity through phone-centric signals: carrier data, SIM tenure, number history, line type. The customer enters their phone number and that's it - zero friction. - **Best for:** Zero-friction verification, mobile-first flows. - **Cost:** $0.05-0.25 per check. - **Coverage:** Global (carrier data depth varies by country). - **Standout:** Phone number as identity anchor. Detects SIM swaps, burner phones, VoIP. #### Ekata (Mastercard) Ekata is profiled in full under the fraud platforms above. See [Ekata](#ekata) for what it collects and what to ask about pricing. Short version: lightweight phone, email, address and IP checks over a REST API. Mastercard has owned it since 2021. Pricing is per query and not published. #### Trulioo Trulioo covers KYC, KYB and AML across 195+ countries. It suits merchants with international customers who'd otherwise stitch together regional vendors. - **Best for:** Cross-border merchants needing global coverage. - **Cost:** $0.50-2.00+ per check. - **Coverage:** 195+ countries. - **Standout:** Breadth of global data sources. Combined KYC + KYB + AML. #### LexisNexis LexisNexis runs the largest identity data network in the market. Four products feed it. Emailage for email risk, ThreatMetrix for device, ID Analytics for identity risk and BehavioSec for behavioral biometrics. - **Best for:** Enterprise with budget for the full stack. - **Cost:** $3.00-8.00+ per check. - **Coverage:** Global (strongest in US, UK, EU). - **Standout:** Most comprehensive data, but enterprise pricing. Consortium of tens of billions of transactions. ### Processor-Native: Stripe Identity If you're already on Stripe, start here. Stripe Identity does document capture, selfie matching and liveness detection, all in your existing dashboard. The first 50 verifications are free, then you pay per use. No new vendor, no separate contract. - **Best for:** Stripe merchants who need occasional documentary verification without a dedicated vendor. - **Cost:** Pay-per-use (first 50 free). - **Coverage:** 100+ countries. - **Standout:** Zero integration effort if you're already on Stripe. Same dashboard, same billing. ### Documentary Verification These vendors check government-issued ID documents. They match faces by selfie and test liveness to stop spoofing. #### Sumsub Sumsub sits furthest right in the 2025 Gartner Magic Quadrant for Identity Verification, a Leader on both axes. It's an all-in-one platform: KYC, KYB, AML screening and transaction monitoring. Its no-code "Unilink" option generates verification links with no engineering work at all. - **Best for:** Businesses wanting one platform for KYC + KYB + AML. - **Cost:** $1.35+ per check (Basic plan at $149/month minimum). - **Coverage:** 220+ countries. - **Standout:** No-code verification links (no integration needed). All-in-one compliance platform. 2025 Gartner Leader. #### Veriff Veriff is one of the few identity vendors that publishes rates. They start at $0.80 a check. Offers video-based verification as an option for higher-assurance use cases. ISO 27001 and SOC 2 certified. These rates weren't part of the 2 August 2026 pass - see the [note above](#identity-verification). - **Best for:** SMBs wanting transparent, predictable pricing. - **Cost:** $0.80-1.89 per check (published). - **Coverage:** 230+ countries and territories. - **Standout:** Published pricing (rare in this market). Self-serve signup. #### Persona Persona pairs documentary verification with a strong orchestration layer. You can build multi-step flows: passive check, then document, then liveness, then KYB. The APIs are clear and developer-friendly. - **Best for:** Developers building custom verification workflows. - **Cost:** $1.50+ per check (Essential plan). - **Coverage:** Global. - **Standout:** Flexible workflow builder. Also handles KYB for marketplace/platform use cases. #### Jumio Jumio has the widest document coverage in the market. That's 5,000+ document types across 200+ countries. It's enterprise-focused, with strong adoption in regulated industries. - **Best for:** Global businesses needing broad document coverage. - **Cost:** $1-5+ per check (enterprise pricing). - **Coverage:** Global (broadest document library). - **Standout:** 5,000+ document types. Strong injection attack detection. #### Onfido (Entrust) Entrust acquired Onfido in April 2024. That brought certificate authority and digital credential infrastructure with it. Document analysis is strong AI-based, and there's a workflow builder for multi-step flows. - **Best for:** Fintech, regulated industries. - **Cost:** $0.50-4+ per check. - **Coverage:** Global (varies by region). - **Standout:** Entrust acquisition adds digital credential and certificate authority capabilities. #### Incode Incode is the fastest here for documentary verification. It averages 1.5 seconds a check. Coverage is strongest in Latin America, and the global footprint is growing. - **Best for:** Latin America, speed-sensitive flows. - **Cost:** $1-4+ per check. - **Coverage:** Global (strongest LatAm coverage). - **Standout:** 1.5-second average verification. Purpose-built for mobile-first UX. #### iDenfy iDenfy supports 3,000+ ID document types from 190+ countries. Facial recognition and liveness detection are included. It does KYB and AML screening too. - **Best for:** Mid-market, competitive pricing, combined IDV + KYB. - **Cost:** $0.50-2+ per check. - **Coverage:** 190+ countries. - **Standout:** KYB and AML screening bundled. No device fingerprinting - pair with a device intelligence vendor if needed. #### Mitek Datos Insights named Mitek a market leader in January 2026, on 30% year-over-year growth. MiPass 4D rolls face match, liveness, voice match and voice liveness into one biometric. Digital Fraud Defender adds deepfake detection. - **Best for:** Enterprise, regulated industries. - **Cost:** $1-4+ per check. - **Coverage:** Global. - **Standout:** MiPass 4D biometric (face + voice + liveness). Datos Insights leader. Strong growth trajectory. #### Au10tix Au10tix runs a fully automated, 100% AI-driven pipeline. It averages 4-8 seconds a check. A consortium of 60+ companies feeds it. That's how it catches organized mass attacks and fraud rings in real time. - **Best for:** High-volume businesses needing speed and consortium-based attack detection. - **Cost:** $1-3+ per check. - **Coverage:** Global. - **Standout:** 4-8 second verification. Consortium detects coordinated attacks that single-merchant tools miss. 2025 FinTech Breakthrough Award. ### Biometric / Liveness Specialists #### iProov iProov does liveness detection and deepfake prevention. It doesn't verify documents at all. It only confirms the person in front of the camera is real and present. Its injection attack detection is the strongest here, and governments and major banks use it. - **Best for:** Adding deepfake/liveness defense to an existing IDV stack. - **Cost:** $0.50-2+ per check. - **Coverage:** Global. - **Standout:** Best injection attack detection in the market. Used by UK Home Office, US DHS. ### Combined: Plaid Identity Plaid's identity verification works differently from pure IDV vendors. Your customer links their bank account. You get ownership verification, account history and identity data straight from the bank's records. Bank data is hard to fake. You can build a synthetic identity on a fabricated SSN. Faking years of real transaction history is another matter. - **Best for:** Businesses already using Plaid for bank connectivity who want identity signals layered on. - **Cost:** ~$500/month platform fee + $1-5+ per check. - **Coverage:** US, Canada (expanding). - **Standout:** Strongest identity signal in the market (bank-verified), but highest friction and cost. See [detailed analysis](/docs/fraud/prevention/kyc-kyb#plaid-bank--identity-combined). ### Key Selection Criteria When evaluating IDV vendors, focus on these questions: - **Passive or documentary?** Start passive. Add documentary as step-up. See [the core split](/docs/fraud/detection/identity-verification#passive-vs-documentary-the-core-split). - **Document coverage:** Does the vendor support ID types for your customer base? - **Deepfake defense:** Does it detect injection attacks, not just presentation attacks (photos/videos)? - **Pricing model:** Per-check vs. platform fee? Published vs. "call us"? - **Self-serve?** Can you sign up and test without a sales call? Stripe Identity, Veriff, Sumsub, Persona and iDenfy: yes. Jumio, LexisNexis and Mitek: no. - **Integration complexity:** Simple REST API vs. full SDK? Mobile SDKs available? - **Pass rates vs. manual review:** What percentage auto-approves vs. needs human review? ## Device Fingerprinting & Intelligence Device fingerprinting gives every device that touches your platform a unique ID. That's how you spot a returning fraudster, someone running ten accounts, or an account takeover. It works even when every other identifier has changed. ### ThreatMetrix (LexisNexis Risk Solutions) LexisNexis bought ThreatMetrix in 2018. It fingerprints both hardware and software. Behind it sits consortium data from tens of billions of transactions across the LexisNexis network. Key strengths: - Enterprise-focused with on-premises support options. - Integrates with other LexisNexis products (Emailage, BehavioSec). - Massive consortium data network. - Strong for large financial institutions. Best for: Large FIs already using the LexisNexis stack ### SEON SEON takes a modular approach: use only what you need. It enriches email, phone and IP data. It also profiles social media for identity signals. **SEON is the only fraud vendor here that publishes a real entry price.** VENDOR: Starter is **$699 per month** and includes 2,500 fraud checks, 10 users and 50 custom rules. Starter **excludes** case management, AML compliance, managed risk services and 24/7 support. Premium is "custom pricing for your needs." That buys unlimited API calls, users and rules. It adds case management, AML compliance, managed risk services, 24/7 support and a dedicated implementation team. Both include platform and API access plus implementation assistance. Free trial on request, no free tier. Source: [seon.io/pricing](https://seon.io/pricing/), checked 2026-08-02. DERIVED: $699 / 2,500 = **about 28 cents per check** at the plan cap. That's arithmetic on published numbers rather than a SEON figure, and it only holds at full allowance. A merchant running 800 checks a month effectively pays about **87 cents each**. REPORTED by [Vendr](https://www.vendr.com/marketplace/seon) (SaaS buying and negotiation platform, no sample size disclosed): median contract **$56,900/year**, range $3,900-$1,146,838, with negotiated discounts of roughly 10-17% achieved through annual commitment and growth projections. The bottom of that range sits close to Starter annualized at $8,388. That's a reasonable consistency check on the source. :::warning[The single biggest unpublished risk in a SEON contract] **No overage rate is published anywhere.** Nothing on SEON's pricing page states what happens at check 2,501. There's also no published contract length and no published annual-versus-monthly discount. Get the overage rate in writing before signing, and ask whether unused checks roll forward. Those two answers matter more than the $699 for any business with variable volume. ::: Hold on to that 28 cents. Every other vendor makes you sit through a sales call before you learn anything about cost. This is the only public number you can judge their quotes against. If one comes back at several times that for comparable screening, make them explain what you're buying. Key strengths: - Transparent, explainable risk scoring. - Published pricing, which almost nobody else in this market offers. - Fast API integration. - Social media footprint analysis. Best for: fintechs and mid-market that want flexibility. Also any SMB that wants a price before talking to a salesperson ### IPQS (IPQualityScore) IPQS scans 300+ device data points. It's strong on bots, GPS spoofing and emulators. Key strengths: - Extensive device data collection. - Strong bot and automation detection. - Fraud network detection. - Competitive pricing at volume. Best for: High-volume screening with bot concerns ### Fingerprint (formerly FingerprintJS) Fingerprint has an open-source core with a commercial tier on top. It focuses on browser fingerprinting and claims 99.5% identification accuracy. Key strengths: - Lightweight JavaScript implementation. - Developer-friendly documentation and APIs. - Transparent about methodology. - Open-source option for evaluation. Best for: Developers wanting control and transparency ### BioCatch BioCatch leads in behavioral biometrics. It reads mouse movement, keystrokes and how someone navigates, then authenticates continuously. Key strengths: - Runs silently without user friction. - Continuous authentication (not just point-in-time). - Strong for account takeover detection. - Detects remote access tools and social engineering. Best for: FIs prioritizing ATO prevention :::tip[Technical Considerations] - **SDK vs JavaScript**: Mobile apps need SDKs; web can use JS tags. - **Cookie-less tracking**: Important as browsers phase out third-party cookies. - **Cross-browser persistence**: Can you identify the same device across Chrome/Safari/Firefox? - **Latency requirements**: Real-time auth needs sub-50ms; batch can tolerate more. ::: > **Ready to evaluate?** The [Vendor Selection Guide](/docs/fraud/vendors/selection-guide) has the RFP questions and how to structure a POC. It also covers testing vendor claims against your own data. The sections below cover consortium data, enterprise platforms and network tools. ## Consortium Data Networks Consortium networks pool fraud signals across their members. That surfaces patterns no single company could see on its own. ### LexisNexis Digital Identity Network LexisNexis runs one of the largest global consortiums, with thousands of financial institutions in it. The platform was assembled by acquisition. Emailage covers email risk, ThreatMetrix device, BehavioSec behavior and ID Analytics identity risk. Key strengths: - Cross-industry fraud signals. - Strong in North America and Europe. - Multiple data types (device, email, phone, identity). - Continuous model updates from consortium learnings. ### FICO Falcon Intelligence Network FICO's Falcon Intelligence Network analyzes hundreds of billions of transactions annually. Tagged fraud data is shared across participating issuers, powering FICO Falcon Fraud Manager models. Key strengths: - Focused on card fraud patterns. - Deep integration with Falcon platform. - Continuous model updates based on consortium data. - Decades of issuer relationships. ### Sift Digital Trust Network Sift's consortium leans merchant-side. It publishes "1T+ annual events" and "1.6B authentic digital citizens." There's no site count any more. Treat any you see quoted elsewhere as stale ([sift.com](https://sift.com/)). Key strengths: - Strong for e-commerce and marketplace fraud. - Real-time signals across the network. - Content and payment fraud coverage. - Good for merchants with similar customer bases. ### ActimizeWatch (NICE Actimize) ActimizeWatch spots patterns across institutions. It reads transaction data from every financial services firm in the network. Key strengths: - Part of broader Actimize AML/fraud platform. - Focus on financial institution patterns. - Integrated with case management workflow. :::note[Issuer Consideration] Your processor probably already feeds transaction data into a consortium or two. The question is whether you get the signals back, and whether you act on them. Ask your processor which consortium scores or flags reach your authorization stream. ::: ## Enterprise Fraud Management Platforms Enterprise fraud management platforms bundle the full stack. Real-time scoring, rules engines, case management and reporting. Most now fold in AML too. ### FICO Falcon Fraud Manager Profiled in full above. See [FICO Falcon](#fico-falcon) for how it sits in the authorization stream and why merchants can't buy it. Pricing isn't published. It's an annual license plus implementation, negotiated per card portfolio. ### NICE Actimize NICE Actimize ties AML and fraud together well. X-Sight is the platform for large financial institutions, Xceed for SMBs. Key strengths: - Unified fraud + AML platform. - AI-powered investigation automation (2024). - Full case management and SAR filing. - ActimizeWatch consortium intelligence. Best for: FIs wanting unified fraud + AML ### Feedzai Feedzai is AI-native and single-platform. Its RiskOps product covers fraud, AML and case management. Key strengths: - Modern AI architecture. - Emphasizes model explainability (TRUST Framework). - Selected for ECB digital euro fraud prevention pilot. - Strong in Europe, growing in North America. Best for: FIs prioritizing modern AI architecture ### SAS Fraud Management SAS brings deep analytics heritage with highly customizable rules and models. Key strengths: - Strong data integration capabilities. - Enterprise-grade scalability. - Highly customizable. - Good for organizations with strong analytics teams. Best for: Organizations with strong analytics teams wanting customization :::info[Industry Recognition] Forrester and Chartis both put FICO, Feedzai, LexisNexis, NICE Actimize and SAS in the top enterprise segment. The exact ranking moves by wave, region and criteria. Ask for the latest report when you evaluate. ::: > **Merchant, not an issuer?** Skip the enterprise platforms and network tools below. Go to [Merchant-Focused Solutions](#merchant-focused-solutions) for guarantees and order screening, or straight to the [Vendor Selection Guide](/docs/fraud/vendors/selection-guide). ## Card Network Fraud Tools Visa and Mastercard both ship fraud detection tools. Your processor fee often already covers them, and most issuers underuse them. They see patterns across the whole network that no single issuer could. ### Visa Tools #### Visa Advanced Authorization (VAA) VAA returns a real-time risk score with every VisaNet authorization. Most Visa issuers can get it through their processor. Key capabilities: - Trained on global Visa transaction patterns. - Score can be used in authorization rules or case prioritization. - Often included in processor fees. Check if you're using it. - No additional integration if already on VisaNet. #### Verifi RDR, Verifi CDRN, and Order Insight All three sit side by side in the [alert comparison table](#alert-comparison) above, with response windows and costs. The short version. RDR refunds qualifying disputes automatically, before a chargeback is filed. CDRN sends you an alert instead and gives you about 72 hours to decide. Order Insight does something different again. It pushes your order detail to the issuer. The cardholder recognizes the charge and never disputes at all. ### Mastercard Tools #### Decision Intelligence (DI) DI scores authorizations in real time. It's trained on global Mastercard transaction patterns and reads cardholder behavior. Key capabilities: - Available through processors. - Network-wide visibility on spending patterns. - Complements issuer-specific models. #### Decision Intelligence Pro (2024) This is the GenAI version of Decision Intelligence. It uses recurrent neural networks to read entity relationships. Key capabilities: - Mastercard reports up to ~20% improvement in fraud detection at comparable false-positive rates. - Analyzes historical spending patterns and merchant relationships. - Sub-50ms decisioning. - Uses generative AI for pattern recognition. #### Transaction Fraud Monitoring (TFM) TFM is for acquirers, not issuers. It returns pre-authorization risk scores so acquirers can spot risky merchants and transactions. #### Ethoca Alerts and Consumer Clarity Both are covered in the [alert comparison table](#alert-comparison) above. Ethoca is the alert. You get 24 to 72 hours, you decide each case, and coverage is strongest outside the US. Consumer Clarity is the enrichment product. It puts your logo and an itemized receipt in the cardholder's banking app, before they call. #### Mastercard Threat Intelligence (2025) Mastercard's newest product merges cyber and payment fraud signals. It folds in threat intelligence from Recorded Future, acquired in 2024. Key capabilities: - Card testing detection with real-time alerts. - Digital skimming intelligence. - Merchant threat intelligence. - Payment ecosystem threat reports. :::tip[For Issuers] Start by auditing what network tools you're already paying for through your processor. Plenty of issuers already get VAA or DI scores. Most never feed them into authorization rules or case management. It's usually the cheapest fraud reduction available. ::: ## Merchant-Focused Solutions This guide is written for issuers. Merchant-side tools still matter to you. They shape the dispute patterns you'll see. ### Chargeback Guarantee Providers Signifyd, Riskified, Forter, ClearSale and Radial are compared in full in the [guarantee comparison](#guarantee-comparison) above. That covers what each one publishes about pricing, and what to ask when they don't. Kount is now an Equifax product line, profiled under [Kount](#kount). The short version for issuers. These vendors sit between the cardholder and the merchant's decision to ship. They take on the merchant's fraud chargeback liability on orders they approve. Only Signifyd publishes even the shape of its pricing. Watch the incentive. Theirs is to decline borderline orders. That's the mirror image of an issuer over-declining. ## Market Dynamics & Trends (2024-2025) The fraud prevention market is evolving rapidly. Key trends affecting vendor selection: ### GenAI Adoption - Mastercard Decision Intelligence Pro uses generative AI. - NICE Actimize launched AI-Powered Fraud Investigations (Sept 2024). - Vendors adding GenAI for alert summarization, case drafting, SAR generation. - Caution: GenAI also enables more sophisticated fraud (deepfakes, synthetic identities). ### Deepfake & Synthetic Identity Threats - iProov reported 704% increase in deepfake face swaps (2024). - Driving investment in advanced liveness detection. - Behavioral biometrics gaining importance. - Document verification alone no longer sufficient. ### Market Consolidation - LexisNexis continues acquisition strategy: Emailage, ThreatMetrix, BehavioSec, ID Analytics all now integrated. - **Equifax acquired Kount, then absorbed the brand.** Kount's site now forwards to Equifax. Kount had already absorbed Midigator, which Equifax acquired in 2022, and Midigator's site lands in the same place. Two vendor brands merchants were told to shortlist have quietly become one Equifax product line. - **Accertify is no longer an American Express company.** Accertify's own about-us page describes "the successful carve-out of Accertify from American Express" as completed and names no new owner ([accertify.com/about-us](https://www.accertify.com/about-us/), checked 2026-08-02). Anywhere you read "Accertify, an American Express company," that's out of date. - Mastercard acquired Ethoca (2019) and Recorded Future (2024). - Visa acquired Verifi (2019). - Trend toward integrated platforms vs. point solutions. The practical lesson for a buyer: check the vendor's own domain before you shortlist. A 301 redirect is the cheapest, most reliable ownership signal there is,. ### First-Party Fraud Focus - Mastercard First-Party Trust program. - Enhanced compelling evidence requirements (Visa CE 3.0). - Growing recognition that "friendly fraud" is a major loss driver. - Vendors adding return abuse and policy abuse detection. ### Regulatory Pressure - Model governance and explainability requirements increasing. - Fair lending considerations for fraud models. - CFPB BNPL interpretive rule extends Reg Z-style protections. - APP fraud reimbursement rules (UK, expanding). ## How these figures were checked _Last verified: 2 August 2026. Every figure carries a source tier. VENDOR is from the vendor's own site. REPORTED comes from a named third party, with its date and source type stated. DERIVED is calculated from published figures. NOT PUBLISHED means the vendor doesn't publish it. [The system and why we use it](/docs/payments/reference/cost-model-assumptions#how-we-tier-every-figure). Claims about network size, approval rates and win rates are vendor marketing, not verified fact._ :::note[Why there are reported contract ranges here at all] Exactly one vendor on this page publishes a price. Leaving every other cell blank is the honest-looking option, and it's the wrong one. Blanks leave a merchant with no way to build a budget. They also reward the vendors that publish least. So reported contract ranges are in, labeled, with sources named. The main one is **Vendr**, a SaaS buying and negotiation platform. It publishes medians from deals it has worked on. Two caveats. **Vendr sells negotiation services**, so its discount claims read as achievable rather than typical. And it discloses a sample size for exactly one vendor. Sift's median rests on a stated 50 purchases. The Signifyd, Forter, SEON and Sardine medians carry no sample size at all. Two of them contradict Vendr's own segment descriptions on the same page. There's one real public percentage benchmark now. **Riskified's revenue over GMV works out to 0.237%**, derived from its own Q1 2026 results. Use it as the anchor when any guarantee vendor quotes you. ::: ## Next Steps **Evaluating vendors by category?** 1. [Review identity verification vendors](#identity-verification) - Socure, Onfido, Veriff 2. [Explore device fingerprinting](#device-fingerprinting--intelligence) - ThreatMetrix, SEON, BioCatch 3. [Understand consortium data](#consortium-data-networks) - LexisNexis, FICO, Sift **Issuers: Using network tools?** 1. [Audit Visa tools](#visa-tools) - VAA, Verifi RDR, Order Insight 2. [Check Mastercard tools](#mastercard-tools) - Decision Intelligence, Ethoca 3. [Ask processor what's included](#card-network-fraud-tools) - Often bundled but unused **Merchants: Building fraud stack?** 1. [Start with chargeback guarantees](#chargeback-guarantee-providers) - Signifyd, Riskified 2. [Follow selection guide](/docs/fraud/vendors/selection-guide) - Evaluation process 3. [Layer complementary solutions](#vendor-categories-at-a-glance) - 3-5 tools typical --- ## See Also - [Vendor Selection Guide](/docs/fraud/vendors/selection-guide) - RFP questions, POC best practices - [Chargeback Vendors](/docs/chargebacks/vendors) - Alert providers, representment services - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Ethoca, Verifi details - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - How risk scoring works - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP, email, phone enrichment APIs - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device intelligence - [Identity Verification](/docs/fraud/detection/identity-verification) - Document and biometric checks - [Behavioral Analytics](/docs/fraud/detection/behavioral-analytics) - User behavior analysis - [Issuer Perspective](/docs/fraud/issuer-perspective) - How issuers think about fraud - [Authorization Decisioning](/docs/fraud/detection/authorization-decisioning) - Real-time auth decisions - [Account Takeover](/docs/fraud/types/account-takeover) - ATO fraud patterns - [Synthetic Identity](/docs/fraud/types/synthetic-identity) - Fabricated identity detection - [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM programs {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"What fraud prevention tools do I need for my business?","acceptedAnswer":{"@type":"Answer","text":"Under $1M/year in revenue, your processor's built-in tools are usually sufficient. Stripe states that Radar Lite is included with Stripe Payments at no extra charge, and Square and Shopify include basic fraud screening at no stated extra charge. Adyen publishes no price for RevenueProtect and no rate card at all, so confirm what it costs in your contract rather than assuming zero. Between $1-10M, add chargeback alerts (Ethoca or Verifi, bought through a reseller) and then consider a dedicated fraud platform. Above $10M, you need 3-5 layered tools including fraud scoring, device fingerprinting, alerts, and selective 3D Secure. Verified 2 August 2026."}},{"@type":"Question","name":"How much do fraud prevention vendors cost?","acceptedAnswer":{"@type":"Answer","text":"Almost none of them publish a price. As of 2 August 2026, SEON is the only fraud vendor that does: $699 per month for a Starter plan including 2,500 fraud checks, which is roughly 28 cents a check. Signifyd publishes its pricing model but no numbers, describing it as a percentage of the order total on approved orders with no charge when an order is declined for fraud. Sift, Sardine, Forter, Riskified, Kount, ClearSale and both chargeback alert networks publish nothing and require a sales conversation. Stripe Radar Lite is free with Stripe Payments; the paid Radar tiers are monthly subscriptions with an included screen allowance."}},{"@type":"Question","name":"What is the difference between Signifyd, Riskified, and Forter?","acceptedAnswer":{"@type":"Answer","text":"All three offer chargeback guarantees where they absorb fraud losses on orders they approve, and all three price as a percentage of approved order value. Signifyd (founded 2011, San Jose) targets enterprise retail with its Commerce Network and is the only one of the three to publish its pricing model: a percentage of the order total when an order is approved, and no charge when an order is declined due to fraud. Riskified (NYSE: RSKD, founded 2013) focuses on enterprise fashion, luxury and travel and publishes no pricing at all. Forter (founded 2013) gives binary approve/decline decisions in under 400ms with no manual review queue, and publishes no pricing model, tiers or rate card."}},{"@type":"Question","name":"What is the difference between Sift, Sardine, and Kount?","acceptedAnswer":{"@type":"Answer","text":"These are scoring-based fraud platforms with no chargeback guarantee, and none of them publishes pricing. Sift (founded 2011) runs the Digital Trust Network and publishes network figures of 1T+ annual events and 1.6B authentic digital citizens; it does not publish its billing unit either, and is commonly described as billing per event rather than per transaction, so ask whether page views and account events are billable. Sardine (founded 2020) combines behavioral biometrics with 500+ device signals and adds AML and KYC; it publishes no price, so ask whether you are billed per session, per device fingerprint or per decision. Kount is now an Equifax product line rather than a standalone vendor: Kount's site forwards to Equifax, and neither the rate nor the billing unit is published, so ask whether it is per transaction or a platform subscription."}},{"@type":"Question","name":"Who owns Midigator and Kount?","acceptedAnswer":{"@type":"Answer","text":"Both are Equifax. Midigator was acquired by Equifax in 2022 and folded into Kount, and it is not a Mitek company. As of 2 August 2026 Midigator's site forwards to Kount's and Kount's forwards to Equifax, so neither brand survives on its own. Accertify is a separate correction: it is no longer owned by American Express. Accertify's own about-us page describes the carve-out from American Express as completed and does not name a current owner."}}]})} --- ## Vendor Selection Guide Source: https://paymentsandrisk.com/docs/fraud/vendors/selection-guide # Vendor Selection Guide :::info[TL;DR] - **The only test that matters:** Run the vendor on YOUR traffic in shadow mode. If it doesn't catch fraud you're actually seeing, it won't help you. - **Before you buy anything:** Pull your last 50 chargebacks. If most aren't true fraud (stolen cards), a fraud tool won't fix your problem. You may need better [billing descriptors](/docs/chargebacks/prevention/descriptors-and-comms) or [refund policies](/docs/chargebacks/refund-policy) instead. - **SMBs:** [2-week test](#the-2-week-test) with a kill-switch date. No multi-month evaluations needed. - **Enterprise:** [Structured 4-round process](#structured-evaluation-process) with proof-of-value on live traffic. ::: Test the vendor on your own traffic before you sign anything, and confirm first that fraud is the real problem. Most of what follows is how to do those two things without spending three months on it. ## Start Here: Do You Actually Need a Vendor? {/* #start-here */} | Your situation | What to do | |---------------|-----------| | Chargeback ratio under 0.3%, no specific fraud pattern | You don't need a vendor yet. [Configure your processor's built-in rules](/docs/fraud/processor-rules-configuration) and revisit when something changes. | | Chargeback ratio 0.3%-0.65%, seeing specific fraud patterns | Run the [2-week test](#the-2-week-test) below with one vendor. | | Chargeback ratio above 0.65% or under active fraud attack | You need help now. Start with [chargeback alerts](/docs/chargebacks/prevention/alerts) (same-day impact) while evaluating a fraud tool. | | Dedicated fraud team, $10M+ volume | Follow the [enterprise evaluation process](#the-enterprise-approach-over-10m). | The 0.65% line in that table is an internal warning marker, not a network one. Visa enforces through VAMP and Mastercard through ECM, both of which start higher. See [dispute monitoring thresholds](/docs/compliance/network-rules/dispute-monitoring) for the current numbers. ## The SMB Approach (Under $10M) Under $10M in annual volume, you don't need a formal evaluation process. You need to answer three questions: 1. **What specific problem am I solving?** (Not "fraud" in general. Be specific: chargebacks approaching 0.65%? Card testing attacks? High false positive rate?) 2. **What does "working" look like?** (Chargeback ratio drops below 0.5%? Manual review queue shrinks by half? Specific fraud type stops?) 3. **How will I know if it isn't working?** (Set a deadline. If the tool hasn't moved your key metric in 30 days, kill it.) ### The 2-Week Test For most SMBs, this is the entire evaluation process: **Week 1:** - Sign up for trial or request demo access - Connect the tool (most modern tools take hours, not weeks) - Run in shadow mode (flag, don't block) - Check what it flags. Do those transactions look risky to you? **Week 2:** - Turn on blocking for one segment (high-risk orders, new customers, orders over $X) - Watch your false positive rate (customer complaints, support tickets) - Check: Are you blocking real fraud or annoying good customers? **Decision:** - If it caught fraud you'd have missed and the false positives are tolerable: keep it - If it blocks good customers or misses obvious fraud: kill it - If you can't tell either way: you lack the volume for this tool :::tip[The Only Question That Matters] Pull your last 50 chargebacks. Put them in front of the vendor during the demo and ask: "Which of these would you have caught?" If they can't answer specifically, the product is a black box. ::: ## Every Vendor Claims They Stop Fraud They all have impressive numbers. "95% detection rate." "Blocked $X million in fraud." "Trusted by [big logos]." None of it tells you whether the tool will work on YOUR traffic. What works for one merchant wrecks another. A tool tuned for high-volume commodity e-commerce will over-decline a luxury brand. A tool trained on US fraud patterns will false-positive your international customers. A consortium that flagged someone for disputing a scammy merchant will block them from your legitimate store. **You can't trust any tool blindly. You have to test it on your own orders.** ### Test By NOT Taking Action The best way to evaluate a fraud tool is to ignore some of what it tells you. Don't act on everything it flags. **Experiment 1: Split your flagged transactions** - 50% of flagged orders: follow the tool's recommendation (decline, void, or refund) - 50% of flagged orders: let them through anyway - Wait 60 days. Compare chargeback rates between the two groups. If the tool is accurate, the "let through" group comes back with higher chargebacks. If the two rates look similar, the tool is selling you false positives. **Experiment 2: Vary your thresholds** - Score 80+: Block and measure what happens - Score 60-79: Let through and track outcomes - Score 40-59: Let through and track outcomes You will find where the tool's accuracy actually lives. Usually a narrower band than the vendor claims. **Experiment 3: Do nothing on some cases** - Pick a random sample of "high risk" flagged orders - No decline. No preemptive refund. No void. - Wait and see whether the chargebacks show up This tells you the real false positive rate, not the vendor's claimed rate. ### Talk to Your Customers This is the feedback loop most merchants skip. When a tool flags a transaction, you have options beyond "block" or "approve": - Call the customer - Email asking a clarifying question - Request additional verification **What comes back:** "I ordered this for my daughter at college. The different shipping address is her dorm." "Yes, I used my work VPN. That's why my IP looks weird." "I disputed that charge at [other merchant] because they never shipped my order. I'm not a fraudster." That last one is important. **Consortium data and denylists are full of legitimate customers.** Someone who filed a valid dispute against a bad merchant is now flagged in shared databases. Someone whose card was stolen and used by a fraudster is now associated with fraud. Someone who had a billing dispute with their cable company is now "high risk." Trust denylist data blindly and you're blocking good customers over something that happened at a different merchant. ### Build Feedback Loops The tool doesn't know whether it was right. You have to tell it. **What to track:** - Every transaction the tool flagged as high risk - What action you took (blocked, approved, reviewed) - What actually happened (chargeback, no chargeback, customer complaint) **What to do with that data:** - Calculate the tool's real false positive rate on YOUR traffic - Identify patterns where the tool is wrong (certain products, customer types, geographies) - Share outcomes with the vendor so they can tune the model If you don't build the feedback loop, you're flying blind. You'll never know whether the tool is helping or hurting. ### Different Business Models, Different Results A "risky" customer for one merchant is a great customer for another. - International shipping? Risky for some, normal for others. - High-value first order? Suspicious for commodity goods, expected for luxury. - Multiple failed payment attempts? Could be fraud, could be a card limit issue. - New email address? Suspicious for some, but some customers create new emails for every merchant. The vendor's model was trained on aggregate data. Your business isn't aggregate. Test everything against your own customers before you trust it. :::warning[Consortium Data Isn't Truth] When a vendor says "this customer is in our fraud consortium," ask: Why? What did they do? At what merchant? A customer who disputed a legitimate fraud at a sketchy merchant is now "high risk" in shared databases. A customer whose card was compromised is now associated with fraud. A customer who had a billing dispute is now flagged. Denylists are useful signals, not verdicts. Treat them as one input, not a decision. ::: ### What to Ask in a 30-Minute Demo Skip the slides. Ask these questions: 1. **"Show me your dashboard. Walk me through a flagged transaction."** (Confusing after 5 minutes means confusing forever.) 2. **"What data do you need from me to work?"** (Some tools need deep integration. Others run off a processor connection alone. Know which one this is.) 3. **"What's your pricing at my volume?"** (Get a real number, not "it depends.") Expect resistance, because almost nobody in this market publishes rates. Sift, Sardine, Forter, Riskified and Kount were all checked on 2 August 2026 and none of them publishes a price. Signifyd publishes the model without the numbers: a percentage of the order total on approved orders, nothing charged when an order is declined for fraud. The one vendor with public pricing is SEON, at $699/month for 2,500 fraud checks, or roughly 28 cents a check ([seon.io/pricing](https://seon.io/pricing/)). Quote that number back at anyone who won't give you one, and ask what you get for the difference. 4. **"Can I run in shadow mode first?"** (If no, walk away. Any vendor worth buying lets you test without going live.) 5. **"What happens if I want to leave?"** (Data portability, contract terms, exit process. Ask before you sign.) ### Red Flags Walk away if you see any of these: - Won't let you test on your actual data - No customers at your size or in your industry - Won't put the price in writing before a pilot. A custom quote is normal in fraud tooling; refusing to write the quote down isn't - High-pressure tactics ("this pricing expires Friday") - Can't explain why a transaction was flagged - Requires an annual contract with no exit clause - Volume minimums you can't hit - Quotes you a brand that has been absorbed. Check the vendor's own domain first: as of 2 August 2026, midigator.com and kount.com both redirect into Equifax, and Accertify's own site describes its carve-out from American Express as completed ### When to Skip Vendors Entirely Under $1M in annual volume, you don't need a dedicated fraud vendor. Your processor's built-in tools - Stripe Radar, Adyen Risk - are almost always enough. Signs you might actually need a vendor: - Chargeback ratio approaching 0.65% - A specific fraud pattern your processor keeps missing - Manual review queue is drowning your team - You have a fraud analyst who needs better tools Signs you do NOT need a vendor yet: - "Fraud feels like a problem" but you haven't quantified it - You want to be "proactive" about fraud - A vendor reached out with a scary pitch - Your chargeback ratio is under 0.3% --- ## The Enterprise Approach (Over $10M) If you have a dedicated fraud team, a procurement process and the volume to justify a formal evaluation, here is how larger organizations run vendor selection. ### What is an RFP? RFP stands for Request for Proposal. A formal document you send to several vendors, describing what you need and asking them to write back with how they would meet it and at what price. Most SMBs will never issue one. The RFP is a procurement tool for organizations that need to: - Compare 5+ vendors systematically - Document the selection process for compliance or audit - Negotiate enterprise contracts with legal review - Justify the selection to a board or executive team If none of those apply to you, skip the RFP and use the SMB approach above. ### Structured Evaluation Process For teams that need formal documentation: **Round 1: Requirements and Shortlist (1-2 weeks)** - Document your specific problem, baseline metrics, and success criteria - Send requirements to 5-8 vendors - Shortlist to 3-4 based on responses **Round 2: Demos and Technical Review (2-3 weeks)** - Structured demos against your use cases - Technical architecture review - Meet the team that will actually work your account **Round 3: Proof of Value (4-8 weeks)** - Run vendor in shadow mode on live traffic - Compare vendor decisions against your outcomes - Measure detection rate and false positive rate **Round 4: Commercial Negotiation (2-4 weeks)** - Finalize pricing based on POV results - Negotiate contract terms - Reference checks ### POC vs POV vs Pilot These three get thrown around interchangeably. They aren't the same thing: | Term | What It Is | When to Use | |------|-----------|-------------| | **POC** (Proof of Concept) | Vendor analyzes your historical data offline. Shows what they "would have" caught. | Quick filtering. Low effort but also low signal. | | **POV** (Proof of Value) | Vendor runs on live traffic in shadow mode. You compare their decisions to your outcomes. | Validating performance before commitment. Best signal for most evaluations. | | **Pilot** | Vendor is live in production, making real decisions. | Final validation. Requires contract negotiation upfront. | **Recommendation:** skip the POC. Cherry-picking results out of historical data is too easy. POV on live traffic is the one that gives you real signal. ### Evaluation Criteria | Criterion | Weight | What to Measure | |-----------|--------|-----------------| | Detection Accuracy | 25% | What percentage of known fraud did they catch? | | False Positive Rate | 25% | What percentage of good transactions did they block? | | Integration Effort | 20% | How long to implement? What resources required? | | Total Cost | 15% | Per-transaction cost, implementation fees, ongoing support | | Support Quality | 10% | Responsiveness, expertise, account management | | Contract Terms | 5% | Exit provisions, data portability, price escalation | Adjust the weights to your situation. If integration effort is your real constraint, weight it higher. If accuracy matters more than price, weight cost lower. ### Contract Negotiation Points Things to negotiate before signing: - **Performance guarantees:** Can they commit to a detection rate? What happens if they miss? - **Pilot pricing:** Lock in pricing from pilot through production - **Exit terms:** What happens to your data? How long to transition out? - **Price escalation:** What triggers increases? Cap annual increases. - **SLA credits:** Real credits for downtime, not just apologies ### Implementation Planning For enterprise implementations: - **Assign an owner:** One person accountable for success - **Phase the rollout:** Shadow mode โ†’ 10% of traffic โ†’ 50% โ†’ 100% - **Run parallel:** Keep old system running until new system is proven - **Plan for tuning:** Launch is the beginning, not the end. Budget time for ongoing optimization. - **Set review cadence:** Weekly during implementation, monthly after launch --- ## Fraud Profile by Business Type Two businesses the same size can face completely different fraud. Work out what you're actually fighting before you buy anything. | Business Type | Primary Fraud | Secondary Fraud | Buy First | ROI Breakeven | |---------------|--------------|-----------------|-----------|---------------| | **E-commerce (physical goods)** | Third-party fraud (stolen cards) | Friendly fraud (INR, SNAD claims) | [Chargeback alerts](/docs/chargebacks/prevention/alerts), then tune processor rules | ~$500K/yr revenue | | **SaaS / Subscriptions** | Friendly fraud (60-80% of disputes) | [Card testing](/docs/fraud/types/card-testing) on trial signups | Better [billing descriptors](/docs/chargebacks/prevention/descriptors-and-comms) + clear refund policy | ~$200K/yr revenue | | **Digital goods / Gaming** | Third-party fraud + instant resale | Card testing, [promo abuse](/docs/fraud/types/promo-abuse) | Fraud platform (Sardine, Kount, Sift) | ~$300K/yr revenue | | **Service businesses** | [Friendly fraud](/docs/fraud/types/friendly-fraud) (90%+ of disputes) | Rare third-party fraud | Better contracts + communication + [documentation habits](/docs/chargebacks/representment/service-businesses) | Rarely worth a tool | | **Marketplaces** | Seller fraud + buyer fraud | [Account takeover](/docs/fraud/types/account-takeover) | Fraud platform + identity verification | ~$1M/yr GMV | | **B2B / Invoice** | [BEC / wire fraud](/docs/fraud/types/bec-phishing) | Fake invoice schemes | Process controls (dual auth, verification), not software | N/A - process, not tools | **How to read this table:** - **Primary fraud** is what actually hurts you. Most of your losses come from that one column. - **Buy First** is the highest-impact move for your business type. Half of them are process changes, not purchases. - **ROI Breakeven** is roughly the annual revenue where a dedicated tool starts paying for itself. Below it, your processor's built-in tools are enough. Service businesses and B2B companies almost never need fraud detection software. Their fraud problems are operational - vague contracts, thin documentation, BEC aimed at accounts payable - and the fixes are process. If customers dispute because they didn't understand the scope of work, a fraud scoring tool is an expensive way to not solve that. **If you're a marketplace:** you have the hardest version of this, fighting fraud on both sides of the transaction. Buyer fraud looks like e-commerce fraud. Seller fraud looks like application fraud and [synthetic identity](/docs/fraud/types/synthetic-identity). Expect to need a dedicated platform earlier than the table suggests. --- ## The Question That Matters Most Before you evaluate any vendor, answer this honestly: **Do you actually know why you're getting chargebacks?** Pull your last 50 disputes. Categorize them: - True fraud (stolen cards) - Friendly fraud (customer lying) - Service issues (product problems, shipping delays) - Billing confusion (didn't recognize the charge) If most of them aren't true fraud, a fraud tool won't fix your problem. You might need: - Better billing descriptors (for recognition issues) - Better customer service (for service issues) - Better fulfillment (for shipping issues) - Better product (for quality issues) Fraud tools solve fraud problems. Make sure you actually have a fraud problem. --- ## Next Steps **SMB evaluating vendors?** 1. [Answer the three questions](#the-smb-approach-under-10m) - Problem, success, failure 2. [Run the 2-week test](#the-2-week-test) - Shadow mode then limited rollout 3. [Know when to skip vendors](#when-to-skip-vendors-entirely) - Under $1M may not need **Enterprise running formal evaluation?** 1. [Follow structured process](#structured-evaluation-process) - Rounds 1-4 2. [Understand POC vs POV vs Pilot](#poc-vs-pov-vs-pilot) - Which to use 3. [Negotiate contract terms](#contract-negotiation-points) - Performance guarantees, exit **Testing vendor claims?** 1. [Design experiments](#test-by-not-taking-action) - Split flagged transactions 2. [Build feedback loops](#build-feedback-loops) - Track outcomes 3. [Ask the right demo questions](#what-to-ask-in-a-30-minute-demo) - Force specifics --- ## Related - [Fraud Vendors Overview](/docs/fraud/vendors) for who to evaluate - [Data Enrichment](/docs/fraud/detection/data-enrichment) for standalone IP, email, phone APIs - [Chargeback Vendors](/docs/chargebacks/vendors) for dispute-specific tools - [Risk Scoring](/docs/fraud/prevention/risk-scoring) for understanding what vendors are doing under the hood --- # Compliance ## Consumer Protection Source: https://paymentsandrisk.com/docs/compliance/consumer-protection # Consumer Protection :::info[TL;DR] - **Reg E** covers debit, ACH and EFT. Tiered liability, and a clock on error resolution - **Reg Z** covers credit cards. Billing disputes, $50 maximum liability, merchandise protection - **FCBA** sits inside Reg Z. It's where the formal billing-error procedure comes from - These are bank rules. You don't comply with them, you use them to predict a dispute ::: These rules bind banks, not you. Learn them anyway: they tell you how a dispute will go. :::warning[These Are Bank Rules, Not Your Rules] Reg E and Reg Z constrain banks and issuers, not merchants. You don't have to "comply" with them. But they set the timelines issuers follow, and they decide which of your evidence matters. ::: ## Overview Federal regulations protect consumers in payment transactions. Merchants don't administer them; that's the issuer's job. Knowing them still explains four things: - Why dispute rights exist and how they differ by payment method - Why issuers have specific response timelines - What documentation helps or hurts in disputes - Why credit disputes differ from debit disputes ## Key Regulations ### Regulation E (Electronic Fund Transfer Act) **Covers:** Debit cards, ATM transactions, ACH transfers, P2P payments (when bank-funded), payroll cards **Key provisions:** - **Liability tiers**: $0 โ†’ $50 โ†’ $500 โ†’ unlimited based on reporting speed - **Resolution timeline**: 10-45 days (90 days for certain transactions) - **Provisional credit**: Required if investigation extends beyond 10 days - **Scope**: Covers unauthorized transactions, NOT merchandise disputes [Full Regulation E Guide โ†’](/docs/compliance/consumer-protection/reg-e) ### Regulation Z (Truth in Lending Act) **Covers:** Credit cards, charge cards, HELOCs (BNPL coverage unsettled - 2024 CFPB rule was revoked in 2025) **Key provisions:** - **Maximum liability**: $50 statutory (most issuers offer $0) - **Written notice**: Required within 60 days of statement - **Resolution timeline**: 30-day acknowledgment + 2 billing cycles (max 90 days) - **Scope**: Covers billing errors AND merchandise disputes - **Collection pause**: the issuer can't collect on the disputed amount while it investigates [Full Regulation Z Guide โ†’](/docs/compliance/consumer-protection/reg-z) ### Fair Credit Billing Act (FCBA) The FCBA amended TILA in 1974. Regulation Z implements it. What it covers: - Formal billing error procedures - A ban on adverse credit reporting mid-dispute - Acknowledgment and investigation requirements - The consumer's right to withhold the disputed amount The FCBA is why credit cards have formal written dispute procedures. Network documentation rarely names it. It's under every credit dispute anyway. ## Why Merchants Should Understand ### Anticipate Dispute Outcomes Reg Z covers merchandise disputes. Reg E doesn't. So quality and non-delivery are valid credit dispute reasons. Debit disputes stop at unauthorized transactions. "I didn't receive my order" works on credit, not debit. ### Prepare Better Evidence Issuers have to "investigate". That tells you what to send with a representment. What they must consider shapes what you document. ### Set Customer Expectations Give a frustrated customer a realistic timeline. Point them at the right channel. Fix it before it becomes a dispute. ### Evaluate Payment Method Risk Credit is safer for the consumer: a fixed $50, against escalating debit liability. Some people reach for credit on big purchases for that reason. So your dispute pattern differs by payment method. ## Comparison Table | Aspect | Reg E (Debit) | Reg Z (Credit) | |--------|---------------|----------------| | **Consumer liability max** | $50 โ†’ $500 โ†’ unlimited | $50 statutory; $0 in practice | | **Reporting deadline** | 60 days from statement | 60 days from statement | | **Notice format** | Oral or written | Written only | | **Investigation period** | 10-45 days (or 90) | 2 billing cycles (max 90 days) | | **Provisional credit** | Required if investigation extended | Not required | | **Merchandise disputes** | Not covered | Covered (with conditions) | | **Collection during dispute** | Consumer funds already gone | Cannot collect on disputed amount | ## Popular in This Section - **[Regulation E Guide](/docs/compliance/consumer-protection/reg-e)** - Debit/ACH liability and disputes - **[Regulation Z Guide](/docs/compliance/consumer-protection/reg-z)** - Credit card billing disputes ## Next Steps **New to consumer protection regulations?** 1. [Start with Reg E](/docs/compliance/consumer-protection/reg-e) - Debit/ACH liability and disputes 2. [Then review Reg Z](/docs/compliance/consumer-protection/reg-z) - Credit card billing disputes **Understanding dispute flows?** 1. [Learn the chargeback lifecycle](/docs/chargebacks/lifecycle) - Full dispute process 2. [Understand issuer-side handling](/docs/chargebacks/issuer-side) - How issuers process disputes **Building your compliance program?** 1. [Review network rules](/docs/compliance/network-rules) - VAMP, ECM thresholds 2. [Understand PCI DSS](/docs/compliance/pci-dss) - Data security requirements --- ## Related Compliance Topics - [PCI DSS Compliance](/docs/compliance/pci-dss) - Data security requirements - [AML Basics](/docs/compliance/aml-basics) - Anti-money laundering - [Issuer-Side Chargebacks](/docs/chargebacks/issuer-side) - How issuers handle disputes - [Issuer Perspective](/docs/fraud/issuer-perspective) - How issuers think about fraud - [Network Rules](/docs/compliance/network-rules) - Card network regulations - [Subscription Compliance](/docs/compliance/subscriptions) - Recurring billing rules - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [ACH Operations](/docs/operations/ach-operations) - Bank transfer handling - [Cards](/docs/payments/payment-methods/cards) - Card payment types --- ## Compliance Overview Source: https://paymentsandrisk.com/docs/compliance # Compliance :::info[TL;DR] - The rules you have to follow. Break them and you get fined, terminated, or both - At SMB scale it's three things: PCI, consumer protection law around refunds and subscriptions, and your card network's rules - Start with [Compliance Basics for SMBs](/docs/compliance/compliance-basics) for the short version, then come back for the detail ::: Nobody reads compliance pages for fun. You're here because a processor asked you for something, or you're about to build something and you don't want to build it twice. --- ## Pick Your Mode :::tip[New to Compliance?] Start with [Compliance Basics for SMBs](/docs/compliance/compliance-basics) - the 3-thing checklist that covers what actually matters at your size. ::: [ ๐Ÿ”ง Operator What to fix this week. PCI-DSS and subscription rules. ](/docs/compliance/pci-dss) [ ๐Ÿ“Š Analyst Thresholds and monitoring. Network program tracking. ](/docs/compliance/metrics) [ ๐Ÿ“š Reference Rules and requirements. Network rules, consumer protection. ](/docs/compliance/network-rules) Popular [ ๐Ÿ”’ PCI-DSS Start Here Cardholder data security requirements ](/docs/compliance/pci-dss) [ ๐Ÿ“Š Dispute Monitoring Popular VAMP, ECM, BRAM thresholds ](/docs/compliance/network-rules/dispute-monitoring) [ ๐Ÿ” Subscription Rules Recurring billing compliance ](/docs/compliance/subscriptions) [ ๐Ÿ›๏ธ Reg E Debit card dispute requirements ](/docs/compliance/consumer-protection/reg-e) [ ๐Ÿ“‹ Network Rules Visa and Mastercard mandates ](/docs/compliance/network-rules) --- :::tip[If You Only Have 2 Hours This Week] 1. Check your chargeback ratio. If it's above 0.65%, act now. Visa's own first line is 0.5% non-compliant, and most processors act at around 0.9%. 2. Got subscriptions? Check that cancelling takes fewer than 3 clicks, and that renewal emails go out 7+ days ahead. 3. If you touch card numbers directly: confirm your SAQ is current and your PCI scan passed. That's it. Deep compliance audits can wait until something flags. ::: :::info[Scale Matters] **Under $100K/month:** Complete your PCI SAQ annually and keep your chargeback ratio under 0.65%. If you're on hosted checkout, that's 90% of your compliance burden covered. **$100K-$1M/month:** If you bill recurring, subscription rules matter now. Review your cancellation flow and your renewal notices. Threshold monitoring turns into a weekly job. **Over $1M/month:** Formal compliance review annually. Know your PCI level, your acquirer's expectations, and whether PSD2/SCA affects your EU sales. **Over $10M/month:** Dedicated compliance function or outside counsel. Multiple network programs to track, potential for direct network relationships, and regulatory exposure across jurisdictions. ::: --- What Gets People in Trouble In order of how often I see it: 1๏ธโƒฃ Chargeback Thresholds Cross ~0.9% and your processor flags you; Visa VAMP triggers at 1.5% (2.2% in CEMEA), Mastercard ECM at 1.5% 2๏ธโƒฃ Subscription Billing Violations Unclear cancellation, wrong renewal notices, failure to disclose terms 3๏ธโƒฃ PCI Scope Creep Accidentally handling card data you didn't need to 4๏ธโƒฃ Reg E Timing Violations Missing the 10-day provisional credit deadline (issuers) --- By Domain [ ๐Ÿ“ก Network Rules VAMP, ECM, BRAM, MATCH โ€ข Acquirers, merchants ](/docs/compliance/network-rules) [ ๐Ÿ›๏ธ Consumer Protection Reg E, Reg Z, FCBA โ€ข Issuers ](/docs/compliance/consumer-protection) [ ๐Ÿ”’ PCI DSS Cardholder data security โ€ข Everyone touching cards ](/docs/compliance/pci-dss) [ ๐Ÿ‡ช๐Ÿ‡บ PSD2 & SCA European authentication requirements โ€ข US merchants selling to EU ](/docs/compliance/psd2-sca) [ ๐Ÿ” AML/KYC Customer verification, SAR filing โ€ข Banks, fintechs ](/docs/compliance/aml-basics) [ ๐Ÿ” Subscriptions Recurring billing rules โ€ข Subscription merchants ](/docs/compliance/subscriptions) --- --- --- :::note[Tax Is Not Covered Here] Sales tax and VAT compliance is jurisdictional chaos. This site doesn't provide tax guidance. **What you need to know:** - **Nexus matters.** You owe tax where you've got a presence, physical or economic - **Economic thresholds.** Plenty of states trigger nexus at $100K+ sales - **When to automate.** Multi-state or international, look at Avalara, TaxJar, or processor-native tools like Stripe Tax - **Talk to your accountant.** Before you decide anything on tax, get real advice This is a payments site, not a tax site. It's here because checkout and invoicing touch tax whether you want them to or not. ::: --- ## Next Steps New to compliance? [PCI-DSS](/docs/compliance/pci-dss) - Start here if you touch cards [Network Rules](/docs/compliance/network-rules) - Monitoring programs [Subscription Rules](/docs/compliance/subscriptions) - If recurring billing Approaching thresholds? [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring) - Know your numbers [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency [Chargeback Prevention](/docs/chargebacks/prevention) - Long-term --- ## See Also [๐Ÿ›ก๏ธ Chargeback Prevention](/docs/chargebacks/prevention) [๐Ÿ” Fraud Prevention](/docs/fraud/prevention) [๐Ÿ“Š Network Programs](/docs/chargebacks/reference/network-programs) [๐Ÿ”’ 3D Secure](/docs/fraud/prevention/3ds) - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Fraud Metrics](/docs/fraud/metrics) - Measuring fraud performance - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Transaction scoring - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring billing rules - [Holds and Reserves](/docs/operations/holds-and-reserves) - Program consequences - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency response - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis playbook --- ## Network Rules Source: https://paymentsandrisk.com/docs/compliance/network-rules # Network Rules :::info[TL;DR] - Three kinds of program: monitoring (VAMP, ECM/HECM), high-risk registration (VIRP, MRP), terminated-merchant lists (MATCH, VMSS) - You never deal with the network. Your acquirer does, and it passes the fines to you - MATCH is the one that ends businesses. Five years on the list - Most acquirers won't board you while you're on it - Rules update twice a year, effective April and October - Neither network publishes its numbers. Every figure here came out through an acquirer - Get your acquirer to put your limits in writing before you need them ::: Nobody sends you the rulebook when you open a merchant account. You find out these programs exist when a fee lands on a statement. Or when an underwriter says they can't board you and won't say why. This section is the map. Which programs exist, what each one measures, and which ones can put you out of business. ## Network Compliance Overview Visa and Mastercard aren't your regulator. They just write the rules everyone downstream has to follow. How transactions get processed, how disputes work, how fraud gets handled. Updates land twice a year, normally effective April and October. They reach you through your acquirer or not at all. Merchants are governed through their acquirer. Issuers are governed directly. When something goes wrong the money flows the same way. The network bills the acquirer. The acquirer bills you, usually with a markup. You rarely get told what the underlying fee was. Serious violations end in a MATCH listing. That shuts a merchant out of card processing almost completely. For a member bank it's expulsion. ## Key Programs by Network ### Visa Programs | Program | Purpose | Primary Audience | |---------|---------|------------------| | **VAMP** | Consolidated fraud and dispute monitoring | Acquirers, Merchants | | **VIRP** | High-risk merchant registration | Acquirers | | **VMSS** | Terminated merchant database | Acquirers | | **Visa Secure** | 3DS liability shift rules | All parties | | **VIMP** | Issuer monitoring | Issuers | **VAMP (Visa Acquirer Monitoring Program):** The consolidated program that replaced VDMP and VFMP. It monitors fraud (TC40) and non-fraud disputes (TC15) as one combined ratio. So cleaning up chargebacks on their own won't move it. Effective April 2025, enforcement from October 2025. Merchant excessive is 1.5%, or 2.2% in CEMEA. It only bites once you're at 1,500 combined fraud reports and disputes. **VIRP (Visa Integrity Risk Program):** Registration and monitoring for high-risk merchants, in three tiers. Replaced GBPP in May 2023. If you're in a VIRP category you'll know. Registration costs money, and your acquirer will have told you. **VMSS (Visa Merchant Screening Service):** Visa's database of terminated merchants. Acquirers query it before boarding anyone. They add the merchants they terminate. It's the Visa equivalent of MATCH, and it's checked just as routinely. ### Mastercard Programs | Program | Purpose | Primary Audience | |---------|---------|------------------| | **ECP** | Excessive chargeback monitoring (ECM/HECM) | Acquirers, Merchants | | **EFM** | Excessive fraud merchant monitoring | Acquirers, Merchants | | **BRAM** | Illegal/brand-damaging activity | Acquirers | | **MRP** | High-risk merchant registration | Acquirers | | **MATCH** | Terminated merchant list | Acquirers | **ECP (Excessive Chargeback Program):** Two tiers. ECM is 100-299 chargebacks **and** a 1.50-2.99% ratio. HECM is 300+ **and** 3.00%+. Both halves have to be true at once. A tiny merchant with a horrible ratio sits outside it. So does a huge merchant with a horrible count. That surprises people every time. **EFM (Excessive Fraud Merchant):** Fraud monitoring for e-commerce specifically, with 3DS usage in the calculation. It runs separately from ECP. You can be clean on chargebacks and still land in EFM. **BRAM (Business Risk Assessment and Mitigation):** Not a ratio program. BRAM is about what you sell, not how badly it goes. Synthetic drugs, counterfeit goods, unlicensed gambling, the rest of the prohibited list. BRAM fines don't track your chargeback rate, and they arrive with no warning period. **MATCH (Member Alert to Control High-Risk):** Mastercard's database of terminated merchants. You stay on it five years. You generally aren't told when you're added. Most acquirers won't board a listed merchant at all. :::warning[GMAP is suspended, and the numbers you'll find online are dead] Mastercard's Global Merchant Audit Program has been suspended since 15 October 2020. The 3 February 2026 rulebook still marks it suspended. Its old 3%/5%/8% tiers circulate on chargeback vendor blogs as if they were live thresholds. They aren't. A separately reported GMAP carries a 1 April 2027 date. See [GMAP](/docs/chargebacks/reference/gmap) for what's actually in force. ::: ## Program Comparison | Area | Visa Program | Mastercard Program | |------|--------------|-------------------| | Chargeback/dispute monitoring | VAMP | ECP (ECM/HECM) | | Fraud monitoring | VAMP | EFM | | High-risk registration | VIRP | MRP | | Prohibited/brand-damaging activity | VIRP (integrity tiers) | BRAM | | Terminated merchant list | VMSS | MATCH | | Issuer monitoring | VIMP | Various | ## Section Contents ### [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring) Visa VAMP, Mastercard ECM/HECM, and the programs around them. Thresholds, fees, remediation, and what prevention tools do to the numbers. ### [Surcharging](/docs/compliance/network-rules/surcharging) Network limits on credit card surcharges. State law, disclosure rules, and the difference between a surcharge, a convenience fee and a cash discount. ## Resources ### Visa Documentation - **Visa Core Rules and Visa Product and Service Rules**: published twice yearly, 1,000+ pages, free to download - **Visa Business News**: bulletins with rule changes, acquirer-facing - **Visa Online**: member portal, and you won't have a login ### Mastercard Documentation - **Mastercard Rules**, **Security Rules and Procedures**, **Chargeback Guide**: all public PDFs, all worth searching before you accept a fee explanation - **Mastercard Connect**: member portal - **Global Operations Bulletins**: rule change announcements The public rulebooks are genuinely useful. Most merchants have never opened one. If your acquirer quotes you a rule, ask which document and which section. If they can't say, that's an answer too. :::tip[Stay current] Ask your acquirer to forward the Visa Business News and Mastercard Global Operations Bulletin items that hit your MCC. They already receive them. Most won't pass them on unless you ask. The April and October dates arrive whether you've read them or not. ::: --- :::warning[Verified August 2026, and none of it is officially published] The numeric thresholds here reached the public through acquirer channels. Visa and Mastercard don't publish them. Nothing here can be checked against a public document. Confirm your own limits with your acquirer in writing. Re-check after each April and October release. ::: ## Popular in This Section - **[Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring)** - VAMP, ECM/HECM thresholds and fees - **[Surcharging](/docs/compliance/network-rules/surcharging)** - Network limits on credit card surcharges ## Next Steps **New to network compliance?** 1. [Understand dispute monitoring programs](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM/HECM thresholds and fees 2. [Review chargeback metrics](/docs/chargebacks/metrics) - Track your ratios before problems start **Concerned about thresholds?** 1. [Implement chargeback prevention](/docs/chargebacks/prevention) - Reduce dispute counts 2. [Set up alerts](/docs/chargebacks/prevention/alerts) - Ethoca, RDR, CDRN tools **Already in a monitoring program?** 1. [Reduce chargebacks fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency response playbook 2. [Work with your processor](/docs/operations/processor-management) - Remediation plan support --- ## See Also - [Compliance Metrics](/docs/compliance/metrics) - How to monitor compliance status - [Chargeback Prevention](/docs/chargebacks/prevention) - Staying below thresholds - [Chargeback Vendors](/docs/chargebacks/vendors) - Tools for compliance - [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - VAMP, ECM detail - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Crisis response - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency playbook - [3D Secure](/docs/fraud/prevention/3ds) - Fraud prevention with liability shift - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Holds and Reserves](/docs/operations/holds-and-reserves) - Program consequences - [PCI DSS](/docs/compliance/pci-dss) - Data security requirements - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow --- ## Subscription Compliance Source: https://paymentsandrisk.com/docs/compliance/subscriptions # Subscription Compliance :::info[TL;DR] - **Three layers hit you at once**: network rules, federal law (ROSCA and the FTC Act), and state law. California's ARL is the strictest - **Four things you have to get right**: disclose before you take the card, capture express consent, let them cancel the way they signed up, warn them before you renew - **Get it wrong** and it's chargebacks, network fines, FTC penalties up to ~$53K a violation, and a letter from a state AG ::: You're getting hit from three directions at once. - **Card network rules.** Visa and Mastercard set the floor on stored credentials and recurring charges. That's consent capture, confirmation emails and cancellation. - **Federal law.** ROSCA (Restore Online Shoppers' Confidence Act) and the FTC Act cover deceptive enrollment and cancellation. - **State law.** California's Automatic Renewal Law is the strictest. 20+ states regulate auto-renewal in some form. The FTC's Click-to-Cancel Rule was finalized in October 2024. The 8th Circuit vacated it in July 2025, on procedural grounds. Don't relax. Enforcement carries on under ROSCA, and the rule still shows you how the FTC reads existing law. ## Regulatory Layers | Layer | Requirement Source | Key Focus Areas | |-------|-------------------|-----------------| | **Network Rules** | Visa, Mastercard mandates | Consent capture, receipts, cancellation | | **Federal Law** | ROSCA, FTC Act | Disclosure, consent, simple cancellation | | **State Laws** | CA ARL, NY, CO, others | Enhanced disclosure, online cancel, annual reminders | | **Industry Standards** | PCI DSS | Secure credential storage | ## Who This Applies To Anything that renews on its own: - Subscription box services - SaaS companies - Streaming services - Membership organizations - Gym and fitness memberships - News and magazine subscriptions - Free trial to paid conversion models - Any recurring billing arrangement ## Section Contents ### [Recurring Billing Requirements](/docs/compliance/subscriptions/recurring-billing) What you actually have to do: - Visa and Mastercard stored credential rules - Free trial conversion requirements - ROSCA obligations - California ARL requirements - Cancellation process requirements ### [Failed Payment Collection](/docs/compliance/subscriptions/failed-payment-collection) When to stop chasing a failed payment, what the FDCPA says, and when it's time to write it off: - Dunning vs collections vs charge-off - 90-day industry standard - Collections agency usage - Cost-benefit analysis by debt age - When to write off entirely ## Key Dates Timeline | Date | Event | |------|-------| | 2010 | ROSCA enacted | | 2018 | Visa/Mastercard stored credential mandate | | 2020 | Visa free trial rules enhanced | | 2022 | Mastercard subscription rules updated | | Oct 2024 | FTC Click-to-Cancel Rule finalized | | Jan 2025 | FTC Rule misrepresentation provisions effective | | July 2025 | FTC Rule vacated by 8th Circuit; CA ARL amendments effective | ## Quick Compliance Checklist ### Pre-Enrollment - [ ] Clear disclosure of all terms before collecting payment info - [ ] Price, frequency, and cancellation policy displayed prominently - [ ] Terms not buried in fine print or terms of service ### At Enrollment - [ ] Express consent captured (checkbox, not pre-checked) - [ ] Consent retained for 3+ years (California requirement) - [ ] Separate consent for subscription vs. one-time purchase ### Post-Enrollment - [ ] Confirmation sent immediately after enrollment - [ ] All subscription terms included in confirmation - [ ] Cancellation instructions provided ### Before Trial Conversion - [ ] Advance notice sent 7+ days before first paid charge - [ ] Specific amount and date included - [ ] Cancellation method clearly stated ### Ongoing - [ ] Easy cancellation (same method as signup) - [ ] Annual reminders (required by California for 12+ month terms) - [ ] Price change notifications in advance ## Enforcement Risk **FTC Enforcement:** - Up to ~$53,000 per violation (as of 2025 civil penalty adjustments) - Recent cases: Uber, Cleo AI, Care.com, Amazon (ongoing) **State Enforcement:** - California AG, district attorneys - Private plaintiff class actions common - Other state AGs increasingly active **Network Enforcement:** - Elevated chargebacks for subscription disputes - Potential VAMP/ECM enrollment - Merchant account termination risk --- :::warning[Last Verified: December 2024] These rules move fast. The Click-to-Cancel Rule's status can change again. California's ARL is strict and it gets enforced. Check the current text before you decide anything. ::: ## Popular in This Section - **[Recurring Billing Requirements](/docs/compliance/subscriptions/recurring-billing)** - Network, federal, and state compliance ## Next Steps **New to subscription compliance?** 1. [Read the recurring billing requirements](/docs/compliance/subscriptions/recurring-billing) - Detailed network and legal requirements 2. [Understand network rules](/docs/compliance/network-rules) - VAMP, ECM thresholds affecting subscriptions **Preventing subscription disputes?** 1. [Implement chargeback prevention](/docs/chargebacks/prevention) - Alerts and prevention tools 2. [Fix billing descriptors](/docs/chargebacks/prevention/descriptors-and-comms) - Reduce "I don't recognize" disputes **Fighting subscription chargebacks?** 1. [Build compelling evidence](/docs/chargebacks/representment/compelling-evidence) - Win subscription disputes 2. [Reduce chargebacks fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency response playbook --- ## See Also - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing subscription chargebacks - [Network Rules](/docs/compliance/network-rules) - VAMP, ECM thresholds - [Consumer Protection](/docs/compliance/consumer-protection) - Reg E, Reg Z basics - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Billing fundamentals - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting subscription disputes - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Billing clarity - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes - [Reason Codes](/docs/reference/reason-codes) - Subscription-related codes - [Promo Abuse](/docs/fraud/types/promo-abuse) - Trial abuse patterns - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM details - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency response --- ## AML Basics Source: https://paymentsandrisk.com/docs/compliance/aml-basics # AML Basics :::info[TL;DR] - The **Bank Secrecy Act** is the foundation of US AML. FinCEN enforces it. - **CIP** means verifying identity at account opening. Name, DOB, address, ID number. - **CDD** means knowing what the relationship is for, and watching it afterwards. - **SARs** go in within 30 days of detection. $5K+ with a suspect, $25K+ without. - **CTRs** are required for cash over $10,000 in a business day. You get 15 days to file. - Most merchants aren't directly covered by any of this. Your bank and your processor are. That's why their questions feel disproportionate to your size. ::: If you're a merchant, BSA/AML probably doesn't bind you. It binds banks, money services businesses, and the fintechs on top of them. You'll still collide with it constantly. The onboarding questionnaire. The reserve. The beneficial-ownership form nobody explained. The account frozen without warning. All of it traces back to somebody else's AML program. Knowing what that program has to do makes the questions predictable instead of arbitrary. ## What Is AML? Anti-money laundering is machinery that financial institutions are required to run. The job is to stop criminals pushing dirty money through the payment system and having it come out clean. In the US it's called BSA/AML. Add the counter-terrorist-financing piece and it's AML/CFT. The obligations land on regulated institutions, not their customers. But institutions push the work downstream. Your bank has to document what your business does. So you fill in the form. ### Key Regulatory Bodies | Agency | Role | |--------|------| | **FinCEN** | Primary BSA enforcement (Treasury Department) | | **OCC, FDIC, Federal Reserve** | Bank regulators with BSA examination authority | | **CFPB** | Consumer-facing enforcement | | **DOJ** | Criminal prosecution | ## The Bank Secrecy Act Framework The Bank Secrecy Act (1970) and its amendments establish requirements for: - **Recordkeeping** of certain transactions - **Reporting** suspicious and large cash transactions - **Compliance programs** at financial institutions - **Customer identification** and due diligence ### Key BSA Amendments | Legislation | Year | Key Additions | |-------------|------|---------------| | Money Laundering Control Act | 1986 | Made money laundering a federal crime | | USA PATRIOT Act | 2001 | Enhanced CIP/KYC, expanded covered entities | | CDD Final Rule | 2016/2018 | Beneficial ownership for legal entities | | Anti-Money Laundering Act | 2020 | Modernization, beneficial ownership to FinCEN | | Corporate Transparency Act | 2024 | Beneficial ownership reporting to FinCEN (domestic companies exempted in 2025) | ## Know Your Customer (KYC) KYC is proving who the customer is. Then working out what they'll use the account for. It's the first line against [synthetic identity fraud](/docs/fraud/types/synthetic-identity) and [application fraud](/docs/fraud/types/application-fraud). It's also why you got asked for a utility bill. See [identity verification](/docs/fraud/detection/identity-verification) for how it's implemented. ### Customer Identification Program (CIP) **Required information at account opening:** | Individual | Legal Entity | |------------|--------------| | Full legal name | Legal name | | Date of birth | Formation date/jurisdiction | | Residential address | Principal place of business | | ID number (SSN for US persons) | EIN or equivalent | | Government-issued ID | Formation documents | **Verification methods:** - **Documentary:** Government-issued ID, passport, articles of incorporation - **Non-documentary:** Third-party databases, credit bureaus, public records :::note[Timing] CIP has to be finished at or before account opening. Some institutions grant risk-based temporary access while verification finishes. That comes with extra controls attached. It's usually why a new account can take payments but can't yet withdraw. ::: ### Customer Due Diligence (CDD) Beyond basic identification: - Understand the **nature and purpose** of the relationship - Assign a **risk rating** based on customer profile - Collect **beneficial ownership** information (25%+ ownership or control) - Conduct **ongoing monitoring** of transactions ### Beneficial Ownership Requirements For legal entity customers, identify and verify: - **Beneficial owners**: Individuals with 25%+ ownership - **Control person**: CEO, CFO, managing member, general partner, or equivalent **Required information for each:** - Full legal name - Date of birth - Address - ID number (SSN or passport) **Exemptions:** - Regulated financial institutions - SEC-registered investment companies - Public companies (US exchanges) - Government entities - Certain pooled investment vehicles ### Corporate Transparency Act Impact The CTA took effect in 2024. It originally made companies report beneficial ownership straight to FinCEN. In March 2025 FinCEN exempted domestic companies. The rule now reaches foreign entities only. Filed a BOI report in 2024 as a US LLC? That's why the follow-up never came. It didn't get your bank off the hook. Institutions have their own CDD obligations. They can't lean on the FinCEN database alone. So they'll keep asking you for ownership information, whatever the CTA requires this year. ### Enhanced Due Diligence (EDD) Some customers get a heavier version of the same process. If you're in one of the categories below, expect onboarding to take weeks, not days. Expect to be asked where the money came from: - More thorough background research - Senior management approval for relationship - More frequent review and monitoring - Source of funds/wealth documentation **Higher-risk categories:** - Politically Exposed Persons (PEPs) - High-risk jurisdictions (FATF grey/black lists) - Cash-intensive businesses - Non-resident accounts - Correspondent banking relationships - Private banking - Virtual currency businesses ## Transaction Monitoring ### What to Monitor | Category | Examples | |----------|----------| | **Amounts/frequency** | Unusual transaction sizes, sudden volume changes | | **Geographic patterns** | High-risk countries, unexpected jurisdictions | | **Behavior changes** | Deviation from established patterns | | **Structuring** | Multiple transactions avoiding $10K threshold | | **Round-dollar transactions** | $9,999, $9,900 repeatedly | | **Rapid fund movement** | Money in and out quickly | ### Network-Specific Requirements **Mastercard monitoring (Rules Section 1.2.1.1):** - Cross-border activity - Cardholder and merchant monitoring based on risk - High-risk MCCs - Products facilitating fund movement (crypto, transfers, cash-out) - Activity changes over time **Mastercard ATM monitoring:** - Out-of-pattern withdrawal volume - Sequential high-volume withdrawals - Excessive at-limit transactions - Out-of-pattern deposits ### Card-Specific Red Flags | Pattern | What It May Indicate | |---------|---------------------| | **Bust-out** | Rapid credit build-up โ†’ max out โ†’ disappear | | **Card testing** | Multiple small transactions โ†’ large purchases | | **Cash-advance concentration** | Unusual reliance on cash advances | | **Geographic anomalies** | Transactions in unlikely locations | | **Velocity anomalies** | Too many transactions in short time | ### Building Effective Monitoring Rules A rule that fires on every third customer isn't a control. It's a queue nobody works. Design for a caseload your team can clear. **Rule design principles:** - Start from baseline behavior per customer segment, not from a round number. - Use statistical thresholds. "$9,500" is a guess. Two standard deviations off that segment's mean isn't. - Combine velocity and volume triggers. - Fire on combinations. One red flag shouldn't open a case on its own. - Tune on outcomes, quarterly. Write down what you changed. **Rule categories:** | Type | Example | |------|---------| | **Threshold-based** | Cash out >$5K in 24 hours | | **Pattern-based** | Round-dollar transactions repeatedly | | **Behavioral** | Deviation from 6-month average | | **Peer-based** | Activity unusual vs. similar customers | | **List-based** | Match against known bad actors | ### Alert Investigation Process ``` Alert generated โ†“ L1 review (triage) โ†“ L2 review (detailed) โ†“ Case escalation โ†“ SAR decision ``` ## Suspicious Activity Reports (SARs) ### When to File **For banks (thresholds vary by institution type):** | Situation | Threshold | |-----------|-----------| | Suspected violation with identifiable suspect | $5,000+ | | Suspected violation without identifiable suspect | $25,000+ | | Insider abuse | Any amount | | Money laundering or BSA violation | $5,000+ | **Note:** Money Services Businesses (MSBs) may have $2,000 threshold. ### SAR Filing Timeline | Event | Deadline | |-------|----------| | Detection | Start 30-day clock | | Initial SAR | 30 calendar days from detection | | Extension (if investigating) | Up to 60 days total | | Continuing activity | Risk-based follow-up | **Continuing Activity SARs:** the old convention was ~90 days. Current FinCEN guidance asks for risk-based timing instead of a fixed cadence. Plenty of institutions still run ~90 days as the default. It's defensible in an exam. ### SAR Confidentiality - **Cannot disclose** SAR filing to the subject - **No tipping off** the subject of investigation - **Safe harbor** for good-faith filings A bank closes your account and offers nothing beyond "a business decision." That's usually not evasion. It's the law. Nobody there is allowed to tell you a SAR exists. Pushing harder won't produce an answer. It won't get the account back either. ### What Goes in a SAR - Subject information (name, address, DOB, SSN, account numbers) - Suspicious activity description - Dates and amounts involved - Account information - **Narrative** explaining why activity is suspicious - Documentation references ## Currency Transaction Reports (CTRs) ### Requirement File a CTR for **cash transactions exceeding $10,000** in a single business day. ### Key Points - **Aggregate** multiple transactions by the same person. - **Structuring** means splitting deposits to stay under $10,000. It's a federal crime on its own. Clean money doesn't save you. - **15-day filing deadline.** - Applies to deposits, withdrawals, exchanges. A CTR isn't an accusation. It isn't a SAR either. It's a routine filing on a routine deposit. Deposit $12,000 of legitimate cash and one gets filed. Nothing happens to you. Splitting that deposit into two $6,000 trips is what creates the problem. ### Exemptions Certain customers may be exempt from CTR filing: - Domestic banks - Government entities - Listed public companies - Eligible non-listed businesses (requires risk assessment and documentation) ## AML Program Requirements ### Five Pillars Every covered institution has to run a program with all five. Four out of five is a finding. The one usually missing is independent testing: 1. **Written policies and procedures** 2. **Designated compliance officer** (BSA Officer with authority and resources) 3. **Ongoing training** for relevant personnel 4. **Independent testing** (regular audits) 5. **Risk assessment** (periodic evaluation) ### Mastercard Requirements (Rules Section 1.2) - Client identification and due diligence - Controls, resources, and monitoring systems - Regulatory recordkeeping and reporting - Risk assessment incorporating all products - Training for AML personnel - Independent audit processes ### Visa Requirements Visa's rules focus on data protection and risk, requiring members to: - Investigate suspected compromise, fraud, or money laundering - Report to Visa - Maintain security - Cooperate with investigations ## Sanctions Compliance ### Key Lists | List | Maintained By | |------|---------------| | **SDN List** | OFAC (US Treasury) | | **Restrictive Measures** | European Union | | **Consolidated List** | UN Security Council | ### Mastercard Requirements (Rules Section 1.2.2) - **Issuers**: Screen cardholders, service providers, agents - **Acquirers**: Screen merchants, service providers, agents - Screening at **onboarding and ongoing** - **No activity** with sanctioned persons, entities, or jurisdictions ## Recordkeeping Requirements | Record Type | Retention Period | |-------------|------------------| | Customer identification records | 5 years after account closure | | Transaction records | 5 years from transaction | | SAR filings and documentation | 5 years from filing | | CTR filings | 5 years from filing | | AML training records | 5 years | ## Consequences of Non-Compliance | Violation | Potential Consequence | |-----------|----------------------| | Failure to file SARs | Up to $1M civil penalty, criminal penalties | | Failure to maintain AML program | Enforcement actions, consent orders | | Willful BSA violations | Criminal prosecution, $250K fines, 5 years (up to $500K/10 years if combined with other violations) | | Repeat violations | License revocation, processing restrictions | | Network non-compliance | License suspension, termination | ### Recent Enforcement Examples | Institution | Year | Penalty | Issue | |-------------|------|---------|-------| | TD Bank | 2024 | $3B | BSA/AML failures | | Wells Fargo | 2023 | $97.8M | Sanctions compliance failures | | Bittrex | 2022 | $29M | Crypto SAR filing failures | | HSBC | 2012 | $1.9B | Insufficient AML controls | ## Practical Implementation Guidance ### Building an AML Program from Scratch **Phase 1 (Foundation):** - Appoint BSA Officer - Draft policies and procedures - Implement basic CIP/KYC - Establish CTR filing process **Phase 2 (Monitoring):** - Deploy transaction monitoring - Define initial rules based on product risk - Establish alert investigation workflows - Implement SAR process **Phase 3 (Optimization):** - Tune rules based on outcomes - Conduct first independent audit - Formalize training program - Establish ongoing risk assessment ### Common Implementation Mistakes - Leaning on the automated system without human review. Then in an exam, nobody can explain a single decision. - Investigators who were never trained on the typologies they're screening for. - Static rule sets that don't evolve. - Fraud and AML in separate silos, chasing the same customer from two directions. - Decisions made well and documented badly. In an exam that looks identical to decisions made badly. ### Coordinating AML with Fraud Prevention Fraud and AML look at the same transactions with different questions. Fraud asks whether the money is leaving the wrong way. AML asks where it came from. They investigate the same behavior. Both can close an account. At most companies they don't talk to each other. **Integration opportunities:** - Shared case management systems - Combined alerts for cross-functional review - Joint training on overlapping typologies - Coordinated customer communication ## Next Steps **Building an AML program?** 1. [Start with CIP/KYC](#customer-identification-program-cip) - Foundation requirements 2. [Define risk ratings](#customer-due-diligence-cdd) - Segment customers 3. [Set up transaction monitoring](#transaction-monitoring) - Build initial rules **Improving existing program?** 1. [Tune monitoring rules](#building-effective-monitoring-rules) - Reduce false positives 2. [Coordinate with fraud team](#coordinating-aml-with-fraud-prevention) - Share insights 3. [Prepare for independent testing](#five-pillars) - Audit readiness **Handling a suspicious activity case?** 1. [Review SAR requirements](#suspicious-activity-reports-sars) - Know thresholds 2. [Follow investigation process](#alert-investigation-process) - Document thoroughly 3. [Maintain confidentiality](#sar-confidentiality) - No tipping off --- ## See Also - [KYC & KYB for Fraud Prevention](/docs/fraud/prevention/kyc-kyb) - When merchants should verify identity (even without regulatory obligations) - [Why Issuers Decline and Dispute](/docs/fraud/issuer-perspective) - Understanding issuer behavior - [Synthetic Identity](/docs/fraud/types/synthetic-identity) - Fabricated identities - [Application Fraud](/docs/fraud/types/application-fraud) - Origination-stage fraud - [Fraud Rings](/docs/fraud/types/bust-out) - Organized fraud attacks - [Identity Verification](/docs/fraud/detection/identity-verification) - Document and biometric checks - [PCI DSS Compliance](/docs/compliance/pci-dss) - Payment security standards - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - Network requirements - [Regulation E](/docs/compliance/consumer-protection/reg-e) - Consumer protections --- ## Compliance Basics for SMBs Source: https://paymentsandrisk.com/docs/compliance/compliance-basics # Compliance Basics for SMBs :::info[TL;DR] - **Do now**: file your PCI SAQ every year. Keep the chargeback ratio under 0.65%. Use a billing descriptor people recognize. - **Do if you bill recurring**: a clear cancel flow, renewal notices seven days out, an easy opt-out. - **Can wait**: formal audits, AML/KYC programs, PSD2/SCA unless you sell into the EU. - **Most SMBs need three things**: the PCI questionnaire, chargeback monitoring, a clear refund policy. - **0.65% isn't the crisis point**, it's the early warning. Processors flag you around 0.9%, and Mastercard ECM starts at 1.5%. Act at 0.65% and you never get there. ::: Compliance sounds enormous, but at SMB size it's three things and the rest can wait. ## The 3-Thing Checklist If you do nothing else, do these three things: ### 1. Complete Your PCI Questionnaire **The SAQ** is an annual self-assessment questionnaire. It confirms you're handling card data safely. **What to do:** - Hosted checkout (Stripe Checkout, Square, Shopify Payments) puts you on **SAQ A**. That's the simplest one, 15-20 minutes. - Embed a payment form on your own site and you're probably on **SAQ A-EP**. Still manageable. - Touch card numbers directly and you're on **SAQ D**. Switch to hosted checkout instead. **Skip it:** your processor bills a PCI non-compliance fee, $10-150 a month. You're also on your own if you get breached. See [PCI DSS](/docs/compliance/pci-dss) for the full guide. ### 2. Monitor Your Chargeback Ratio **Your ratio** is the share of transactions that turn into chargebacks. Processors start watching at 0.65%, and usually act around 0.9%. **What to do:** - Check your ratio monthly: total chargebacks / total transactions - Set an internal alarm at 0.65% - If you're above 0.65%, start [reducing chargebacks](/docs/playbooks/reduce-chargebacks-fast) immediately :::tip[0.65% = Early Warning, Not Enforcement] 0.65% is where your processor starts watching. It's your cue to act, not the point where fines begin. Enforcement sits higher up. - **Visa VAMP** (live April 2025): merchant excessive is **1.5%**, since 1 April 2026, with 1,500+ disputes. CEMEA keeps 2.2%. The ratio counts fraud reports (TC40) and chargebacks (TC15). That makes it harder to stay under than the old program. Your processor's own line is usually around 0.9%. - **Mastercard ECM**: **100-299 chargebacks** and a **1.50-2.99%** ratio. Both, not either. Go past 299 and 3.00% together and it's HECM, where the fines double. Don't wait for enforcement. Fixing this at 0.65% is cheap. Fighting your way out of a monitoring program at 1%+ isn't. See [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) for the full breakdown. ::: **Skip it:** you land in a network monitoring program. VAMP per-dispute fees are reported at US$8 on CNP disputes, passed through by your acquirer. Visa doesn't publish that number itself. Mastercard ECM fines run from $1,000 to $100,000+ a month. Then comes [MATCH](/docs/chargebacks/match-tmf), which sticks for five years. See [Chargeback Ratio Crisis](/docs/chargebacks/zero-point-nine-panic) for emergency response. ### 3. Post a Clear Refund Policy **The policy** is a visible page telling customers how to get a refund, return something, or cancel. **What to do:** - Link your refund policy in your website footer, checkout page, and order confirmation emails - Make cancellation possible in 3 clicks or fewer - Include timeframes ("Refund within 30 days of purchase") **Skip it:** customers who can't find your refund process call their bank. That's a chargeback. See [Refund Policy Design](/docs/chargebacks/refund-policy) for templates. --- ## What Matters at Your Size | Your Monthly Volume | What to Focus On | What Can Wait | |---------------------|------------------|---------------| | **Under $10K** | PCI SAQ, clear refund policy, recognizable billing descriptor | Everything else | | **$10K-$50K** | Above + monthly chargeback monitoring, subscription compliance if applicable | Formal audits, international compliance | | **$50K-$100K** | Above + [chargeback alerts](/docs/chargebacks/prevention/alerts), dispute monitoring | AML/KYC, multi-network optimization | | **$100K-$500K** | Above + quarterly compliance review, network threshold tracking | Direct network relationships | | **Over $500K** | Formal compliance program, consider outside counsel | Nothing - everything matters now | --- ## Common Mistakes | Mistake | What Happens | Fix | |---------|-------------|-----| | Ignoring PCI SAQ | Non-compliance fee + breach liability | Complete SAQ A annually (15 min) | | No billing descriptor | Customers don't recognize charges, file chargebacks | Set descriptor to your business name | | Hard-to-cancel subscriptions | Chargebacks from frustrated customers | 3-click cancellation, pre-renewal emails | | No chargeback monitoring | Breach threshold without warning | Monthly ratio check, alert at 0.65% | | Ignoring processor emails | Escalation to monitoring program | Reply within 24 hours, always | --- ## Subscription Businesses: Extra Requirements Recurring billing adds obligations. ``` โ–ก Disclose recurring terms before first charge (amount, frequency, duration) โ–ก Send renewal/billing reminders 7+ days before each charge โ–ก Make cancellation available online (no phone-only cancellation) โ–ก Cancellation flow completes in 3 clicks or fewer โ–ก Send confirmation when customer cancels โ–ก Stop charging within 3 business days of cancellation ``` Break these and the chargebacks pile up fast, and regulators notice too. See [Subscription Rules](/docs/compliance/subscriptions) for the full requirements. --- ## When to Get Professional Help You need a compliance consultant or payment attorney when: - Your chargeback ratio is above 0.9% and climbing - You're entering a [network monitoring program](/docs/chargebacks/monitoring/thresholds) - You process over $500K/month - You're expanding internationally (PSD2/SCA requirements) - You receive a processor termination notice - You handle sensitive data beyond basic card processing This site and your processor's support team cover the rest. --- ## Next Steps **Just starting out?** 1. [Complete your PCI SAQ](/docs/compliance/pci-dss) (15-20 minutes) 2. Check your [billing descriptor](/docs/chargebacks/prevention/descriptors-and-comms) 3. Post a [refund policy](/docs/chargebacks/refund-policy) **Already processing?** 1. Calculate your [chargeback ratio](/docs/chargebacks/metrics) 2. Review your [subscription compliance](/docs/compliance/subscriptions) if applicable 3. Set up [chargeback alerts](/docs/chargebacks/prevention/alerts) --- ## See Also - [PCI DSS](/docs/compliance/pci-dss) - Cardholder data security requirements - [Network Rules](/docs/compliance/network-rules) - Visa and Mastercard mandates - [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM thresholds - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before they start - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency playbook - [MATCH List](/docs/chargebacks/match-tmf) - The merchant blacklist and how to avoid it --- ## Regulation E Source: https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-e # Regulation E :::info[TL;DR] - **Reg E** implements the EFTA of 1978 and covers debit, ATM, ACH, and bank-funded P2P - **Liability is tiered**: $0 before an unauthorized transfer, $50 if reported within 2 business days, $500 within 60 days of the statement, unlimited after that - **Provisional credit** within 10 business days, 20 for new accounts, if the bank hasn't finished investigating - **Investigation**: 10 business days standard, extendable to 45, or 90 for POS, foreign, and new-account transactions - You can't participate. Reg E is a fight between the cardholder and their bank, and you find out about it as a chargeback - There's no merchandise protection in Reg E at all. "It arrived broken" isn't a Reg E claim ::: A debit dispute doesn't feel like a credit card dispute to your customer. Their money is already gone. That changes how fast they escalate and how angry they'll be when they call you. It also changes what their bank is obliged to do. Reg E sets those obligations, and learning it lets you predict the bank's next move. ## What Is Regulation E? Regulation E (12 CFR Part 1005) implements the Electronic Fund Transfer Act of 1978. The CFPB enforces it. It sets out who owes what when an electronic fund transfer goes wrong. ### What Reg E Covers - **Debit card transactions** (signature and PIN) - **ATM withdrawals and deposits** - **ACH transfers** (direct deposit, bill pay, etc.) - **Preauthorized recurring debits** - **P2P payments** when bank-funded (Venmo, Zelle linked to bank account) - **Payroll cards** and **government benefit cards** ### What Reg E Does NOT Cover - Credit cards (governed by Reg Z) - Wire transfers - Check transactions - P2P payments funded by credit card (Reg Z applies) ### Why Reg E Matters for Card Programs Reg E binds the issuer, not you. It still shapes the debit disputes that reach you: - The bank is on a clock, so it pushes the dispute out to you fast - Provisional credit means the customer already has their money back, so they've got no reason to keep negotiating with you - The bank has to document its investigation, which is why you get a demand for records with a short deadline - None of it covers merchandise, so a "product never arrived" debit dispute arrives as a network chargeback instead ## Consumer Liability Tiers Reg Z caps credit card liability at a flat $50. Reg E doesn't. It escalates, and how far depends entirely on how fast the customer speaks up: | Reporting Timeline | Maximum Consumer Liability | |-------------------|---------------------------| | Before any unauthorized transfer | $0 | | Within 2 business days of learning of loss/theft | $50 | | After 2 business days but within 60 days of statement | $500 | | After 60 days from statement | Unlimited (for transfers after 60-day period) | ### Scenario Examples **Scenario 1:** Card goes missing Monday. Consumer reports Tuesday. $400 unauthorized charge happened Monday. - **Result:** $50 maximum liability (reported within 2 business days) **Scenario 2:** Statement shows suspicious activity on March 1. Consumer reports May 15. Fraudster was active throughout April. - **Result:** capped at $500 for transfers inside the 60-day window, unlimited for anything after it closes on April 30 :::note[What actually happens in practice] Most banks run zero liability policies well above the Reg E floor. Visa and Mastercard zero liability rules generally extend to debit. So your customer usually pays nothing regardless of these tiers. Reg E guarantees the minimum. What the bank offers is almost always better, and the customer never sees the difference. ::: ## Error Resolution Procedures ### Consumer's Obligation To invoke Reg E protections, the consumer must: - Notify the financial institution within **60 days** of the statement showing the error - Notification can be **oral or written** (unlike Reg Z, which requires written notice) - Provide: name, account number, description of error, and amount (if known) ### Bank's Investigation Timeline **Standard timeline:** - **10 business days** to investigate and determine error - Extendable to **45 calendar days** if provisional credit is issued **New accounts (first 30 days):** - **20 business days** to investigate - Extendable to **90 calendar days** with provisional credit **POS and foreign transactions:** - Extendable to **90 calendar days** with provisional credit ### Provisional Credit Requirements The bank gets 10 business days, or 20 for new accounts. Miss that and it has to: 1. **Provisionally credit** the disputed amount (including interest if applicable) 2. Give the consumer **full use** of the funds during investigation 3. Provide **written notice** of the provisional credit 4. Complete investigation within **45 days** (or 90 for POS/foreign/new accounts) ### If No Error Found If the bank determines no error occurred: - May **reverse the provisional credit** - Must give **at least 5 business days' notice** before debiting the account - Must provide **written explanation** of findings - Must provide **copies of documents** relied upon if consumer requests ## Preauthorized Transfers ### Consumer Rights for Recurring Debits Consumers have the right to stop preauthorized recurring payments: - Notify the bank **at least 3 business days** before the scheduled transfer - Notification can be **oral or written** - Bank may require written confirmation within 14 days of oral notice ### Merchant Considerations - The relevant ACH return codes are **R08** (Payment Stopped) and **R07** (Authorization Revoked) - Neither one is a dispute. It's a consumer right, there's nothing to represent, and arguing about it wastes a phone call - If you bill by ACH, have a card on file as a backup before you need it ## Error Types Covered by Reg E **Covered errors:** - Unauthorized EFT - Incorrect EFT (wrong amount, date, or recipient) - Computational error - Omission from statement - Receipt not received (ATM/terminal failure) - Request for documentation or clarification **NOT covered:** - Quality of goods or services disputes (no merchandise protection) - Authorized transfers the consumer regrets That's the big split from Reg Z. Reg E doesn't cover merchandise disputes at all. A debit customer with a broken product lands in the network chargeback system instead. The rules there are the network's, and you get to respond. ## Reg E vs. Reg Z Comparison | Aspect | Reg E (Debit/ACH) | Reg Z (Credit) | |--------|-------------------|----------------| | **Maximum liability** | $50 โ†’ $500 โ†’ unlimited | $50 (most offer $0) | | **Reporting deadline** | 60 days from statement | 60 days from statement | | **Notice format** | Oral or written | Written only | | **Investigation** | 10 days (extendable to 45-90) | 2 billing cycles (max 90 days) | | **Provisional credit** | Required if extended | Not required | | **Merchandise disputes** | Not covered | Covered | | **Funds during dispute** | Already debited | Cannot collect | ## Issuer Obligations None of this is your obligation. Read it anyway. The bank's demand for records comes straight out of this list, and knowing that tells you what to have ready. ### Required Disclosures (at account opening) - Summary of consumer liability limits - Types of EFTs available - Charges for EFTs - Right to documentation - Stop-payment procedures - Error resolution procedures - Telephone number and address for inquiries ### Periodic Statement Requirements - Amount and date of each EFT - Type of transfer - Third party name if applicable - Location or terminal ID - Fees charged - Opening and closing balances ### Investigation Documentation Banks must document: - Report date and method - Error description - Investigation steps taken - Decision rationale - Provisional credit actions - Final outcome ## Merchant Implications ### ACH Returns Reg E-related ACH return codes: | Code | Meaning | Merchant Impact | |------|---------|-----------------| | **R10** | Customer Advises Unauthorized | Consumer claims didn't authorize | | **R07** | Authorization Revoked | Consumer cancelled recurring | | **R08** | Payment Stopped | Consumer stopped specific payment | Watch the unauthorized rate specifically. NACHA's threshold for unauthorized returns (R05, R07, R10, R29) is **0.5%**. Cross it and your ODFI is on notice. Your origination can get suspended. Track it by code, weekly, not as one blended return rate. See [ACH return codes](/docs/reference/return-codes/ach) for the full set. ### Debit Card Chargebacks Two separate systems run at once and people conflate them. Network rules decide the chargeback mechanics and your representment rights. Reg E decides what the bank owes its own customer. They don't talk to each other. What that means for you: - The customer's money is already gone, so they're motivated in a way a credit customer isn't - Provisional credit puts it back within 10 business days, whatever you do - You still get representment rights under network rules. Use them - You can't influence the Reg E side. There's no merchant seat at that table ## P2P Payments and Reg E ### When Covered P2P payments fall under Reg E when: - Funded from a bank account or debit card - The provider is a financial institution (Venmo, PayPal, Cash App, Zelle linked to bank) ### When NOT Covered - Funded by credit card (Reg Z applies) - Funded by stored balance (may have limited protection) - Recipient authorized by sender, even if scammed ### The "Authorized Transaction" Problem This is the hardest conversation in consumer payments. If the consumer pressed send, Reg E treats the transfer as authorized. It doesn't matter that somebody lied to make them press it. Scam victims aren't covered: | Scenario | Reg E Protection? | |----------|-------------------| | Romance scam (consumer sends money) | **No** - Authorized by consumer | | Fraudster accesses app and sends | **Yes** - Unauthorized | | Pays for goods never delivered | **No** - Authorized, and no merchandise protection | :::note[Voluntary protections aren't rights] Plenty of P2P providers and networks reimburse beyond what Reg E requires. Zelle has expanded certain scam protections, for one. Those are policy choices, and a policy can be withdrawn on notice. Don't plan around them. ::: ## Payroll Cards and Government Benefit Cards ### Payroll Card Requirements - Employers cannot **require** employees to receive wages on payroll cards - At least **one free ATM withdrawal** per pay period - Full Reg E error resolution applies - Fee disclosures required before enrollment ### Government Benefit Cards Government benefit accounts sit under 12 CFR 1005.15. Additional requirements stack on top of the standard rules: - Additional fee restrictions - Minimum free cash access - Specific statement requirements ## Compliance Timeline Summary | Event | Deadline | |-------|----------| | Consumer reports error | Within 60 days of statement | | Bank investigation (standard) | 10 business days | | Bank investigation (new account) | 20 business days | | Bank investigation (extended) | 45 calendar days | | Bank investigation (POS/foreign/new) | 90 calendar days | | Provisional credit (if extending) | Within 10/20 business days | | Notice before reversing provisional credit | At least 5 business days | ## Where This Breaks **You answer the bank's letter.** A cardholder's bank sometimes contacts you directly about a debit dispute. Answer it if you like. It doesn't substitute for a network representment, and it doesn't stop the clock. File the representment through your processor either way. **You assume a reversed provisional credit means you won.** It doesn't. The bank reversing its own customer's credit is a Reg E outcome, not a chargeback outcome. Your chargeback runs on network rules. The cardholder's Reg E claim runs on federal ones. You can lose yours while they lose theirs, and neither result binds the other. **You keep re-presenting an ACH after R07.** R07 means the customer revoked authorization at their bank. There's nothing to argue. Re-debiting is what turns a return into a NACHA problem. Stop the mandate, then go collect another way. **You treat "I didn't get it" as a Reg E case.** Reg E has no merchandise protection. A debit customer's non-delivery complaint gets routed into the card networks instead. You'll see it as a normal reason code with normal evidence requirements. The compelling-evidence rules that apply are the network's, not the CFPB's. **Your descriptor doesn't match your brand.** Debit customers check balances more often than credit customers do. An unrecognized line item on a checking account gets reported as unauthorized much faster. So fix the descriptor first. See [descriptors and communications](/docs/chargebacks/prevention/descriptors-and-comms). ## Enforcement and Penalties ### CFPB Enforcement Authority The CFPB is the primary enforcer for Reg E at larger institutions. State regulators and the other federal banking agencies enforce it too. A bank too small for CFPB supervision still has somebody looking. ### Common Violation Types - Failing to provide provisional credit when required - Missing investigation deadlines - Inadequate error resolution procedures - Missing or incomplete disclosures - Improper liability allocation ### Consequences - Civil money penalties - Consumer restitution - Consent orders requiring remediation - Reputational harm ## Next Steps **Understanding debit/ACH disputes?** 1. [Review ACH return codes](/docs/reference/return-codes/ach) - Understand R10, R07, R08 patterns 2. [Learn about ACH operations](/docs/operations/ach-operations) - Bank payment management **Comparing payment protections?** 1. [Compare with Reg Z](/docs/compliance/consumer-protection/reg-z) - Credit card liability differences 2. [Read the consumer protection overview](/docs/compliance/consumer-protection) - Full regulatory landscape **Preventing unauthorized transaction disputes?** 1. [Understand third-party fraud](/docs/fraud/types/third-party) - Stolen credential patterns 2. [Learn about account takeover](/docs/fraud/types/account-takeover) - Hijacked account fraud 3. [Review issuer perspective](/docs/fraud/issuer-perspective) - How issuers handle fraud --- ## See Also - [Regulation Z](/docs/compliance/consumer-protection/reg-z) - Credit card protections - [Consumer Protection Overview](/docs/compliance/consumer-protection) - Regulatory landscape - [Issuer-Side Chargebacks](/docs/chargebacks/issuer-side) - How issuers handle disputes - [Issuer Perspective](/docs/fraud/issuer-perspective) - How issuers think about fraud - [Authorization Decisioning](/docs/fraud/detection/authorization-decisioning) - Issuer approval process - [ACH Return Codes](/docs/reference/return-codes/ach) - Understanding ACH returns - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Third-Party Fraud](/docs/fraud/types/third-party) - Unauthorized transaction fraud - [Account Takeover](/docs/fraud/types/account-takeover) - Hijacked account fraud - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [ACH Operations](/docs/operations/ach-operations) - Bank payment management --- ## Regulation Z Explained: Credit Card Dispute Rights & TILA Rules Source: https://paymentsandrisk.com/docs/compliance/consumer-protection/reg-z # Regulation Z :::info[TL;DR] - **Reg Z** implements TILA, governs credit card billing disputes, disclosures, and consumer protections - **Max liability**: $50 statutory; most issuers offer $0 - **Billing error disputes**: written notice within 60 days of statement - **Issuers**: acknowledge within 30 days, resolve within 2 billing cycles (max 90 days) - Unlike Reg E, **covers merchandise disputes** (with conditions) - **BNPL coverage** remains unsettled (2024 CFPB rule was revoked in 2025) ::: Reg Z is the federal rule behind credit card billing disputes. It sets the deadlines both you and the issuer have to meet. ## What Is Regulation Z? Regulation Z (12 CFR Part 1026) implements the Truth in Lending Act (TILA) of 1968. The Fair Credit Billing Act (FCBA) of 1974 expanded it. The CFPB has rulemaking authority. ### What Reg Z Covers - **Credit cards** (open-end credit) - **Charge cards** - **HELOCs** (Home Equity Lines of Credit) - **Closed-end credit** (mortgages, auto loans, personal loans) - **BNPL** (Buy Now, Pay Later) - coverage is unsettled, and the 2024 CFPB interpretive rule didn't survive 2025 ### Key Provisions - Standardized disclosures (APR, fees, terms) - Billing error resolution procedures - Limits on unauthorized use liability - Restrictions on certain issuer practices ## Consumer Liability for Unauthorized Use ### Statutory Maximum: $50 A consumer who reports unauthorized use promptly has a maximum liability of **$50**. **In practice:** - Most issuers offer **$0 liability** as a competitive feature - Visa and Mastercard zero liability policies exceed statutory requirements - The $50 is a regulatory floor, not what consumers typically pay ### No Time-Based Escalation Unlike Reg E, Reg Z liability doesn't move with how fast the consumer reports. Two days or 60 days, the maximum is still $50. That's a real difference between the two rules. Know which one you're under. :::tip[Key Difference from Reg E] Reg E (debit): $0 โ†’ $50 โ†’ $500 โ†’ unlimited based on reporting speed Reg Z (credit): $50 maximum regardless of timing It's why a large purchase feels safer on a credit card. ::: ## Billing Error Resolution ### What Qualifies as a Billing Error - **Unauthorized charges** (fraud, lost/stolen card) - **Incorrect charges** (wrong amount, date, or description) - **Goods not received** - **Goods not as described** - **Computational errors** - **Failure to credit** payments or returns - **Statements sent to wrong address** ### Consumer's Obligations To invoke billing error protections, the consumer must: 1. Send **written notice** (oral notice is insufficient, unlike Reg E) 2. To the **designated billing inquiry address** (not the payment address) 3. Within **60 days** of the statement containing the error 4. Include: name, account number, dollar amount, and explanation of why it's an error Written notice is the step consumers get wrong. Oral notice doesn't count. Neither does a letter to the payment address. ### Issuer's Obligations **Within 30 days:** Send written acknowledgment (unless the issue is resolved) **Within 2 billing cycles (max 90 days):** Complete investigation and either: - Correct the billing error and credit the account, OR - Send written explanation of why the charge is correct ### Protections During Investigation The issuer cannot: - Attempt to collect on the disputed amount - Report the disputed amount as delinquent to credit bureaus - Restrict or close the account solely because of the dispute - Include disputed amount in minimum payment calculation - Auto-debit the disputed amount if notified at least 3 business days before ### After Investigation **If error confirmed:** - Correct the account - Credit any finance charges related to the error - Send written notification **If no error found:** - Send written explanation - Provide copies of documents if consumer requests - Allow grace period to pay (same time as for original billing) ## Claims and Defenses (Section 1026.12(c)) Billing errors aren't the only route. Consumers can also assert claims and defenses against the card issuer over goods or services. That's the issuer carrying your failure. It's why they care about your dispute rate. ### Conditions To assert claims and defenses: 1. Consumer made **good-faith effort** to resolve with merchant 2. Transaction exceeds **$50** 3. Transaction occurred **in same state** as consumer's address OR **within 100 miles** ### Limitations - Consumer can't recover more than the amount still owed on that specific transaction - Geographic and dollar limits **don't apply** if: - Issuer and merchant are related entities - Issuer solicited the transaction (e.g., co-branded card promotions) - This creates a defense against collection, not an automatic refund :::note[In Practice] Many issuers extend chargeback rights regardless of geographic limits through network rules. The network chargeback process is easier than asserting Reg Z claims and defenses. That's the one you'll actually see. Reg Z is the floor underneath. It applies when the network process doesn't help. ::: ## Network Chargeback Rights vs. Reg Z Rights | Aspect | Reg Z Rights | Network Chargeback Rights | |--------|--------------|---------------------------| | **Scope** | Federal law, all credit cards | Network rules (Visa, MC, etc.) | | **Geographic limits** | 100 miles or same state | Generally none | | **Dollar threshold** | $50 minimum | Often none | | **Timeline** | 60 days from statement | Typically 120 days from transaction/delivery | | **Merchandise disputes** | Subject to conditions | Broader coverage | Most consumers experience network chargeback processes, which are generally more practical and have fewer restrictions. Reg Z is the baseline that can't be contracted away. So build your dispute process around the network rules, not around Reg Z. ## BNPL and Reg Z :::warning[Regulatory Status (2025)] In May 2024, the CFPB issued an interpretive rule classifying certain BNPL lenders as "card issuers" under Reg Z. It revoked that rule in April 2025. BNPL is unsettled and likely to move again. Don't rely on a specific BNPL obligation without checking current CFPB guidance. Right now there isn't one. ::: ### What Was Proposed (Now Revoked) The 2024 interpretive rule would have required BNPL lenders offering digital accounts to: - **Investigate billing errors** using Reg Z procedures - **Pause disputed payments** during investigation - **Provide refunds** if billing errors are confirmed - **Follow same timelines** as traditional credit card issuers ### Current State Without the interpretive rule, BNPL dispute processes depend on each provider's own policies. Reg Z still applies to BNPL products that meet TILA's definition of credit independently. That generally means more than 4 installments, or any finance charge imposed. ### What This Means for Merchants - BNPL dispute processes are provider-specific, and Klarna, Affirm and Afterpay don't share a rulebook - No uniform Reg Z-style chargeback process for BNPL currently exists - Merchants should review each BNPL provider's dispute policies individually - Future regulation may change this - monitor CFPB announcements ### Products That Remain Outside Reg Z - **4-or-fewer installments** with no finance charge (typical "pay in 4" products) - **Deferred interest** products if paid in full - **Layaway** (no credit extension until final payment) The typical "pay in 4" product sits outside Reg Z entirely, so your customer's recourse there is whatever the provider's own policy says. ## Credit CARD Act Provisions (2009) The CARD Act added significant consumer protections implemented through Reg Z: ### Rate Increase Protections - **45-day advance notice** of rate increases - **No increases in first year** (with limited exceptions) - Promotional rates must last **minimum 6 months** ### Payment Allocation - Payments above minimum applied to **highest-rate balance first** - Consumers can direct excess payments if they choose ### Statement Requirements - Clear **payoff timeframe** if only minimum payments made - Payoff time at **specific payment amounts** - **Same due date each month** ### Fee Restrictions - Penalty fees must be **reasonable and proportional** - Over-limit fees prohibited unless **consumer opts in** - No fees for **phone, mail, or electronic payments** ## Reg Z vs. Reg E Comparison | Aspect | Reg Z (Credit) | Reg E (Debit/ACH) | |--------|----------------|-------------------| | **Liability cap** | $50 (most offer $0) | $50 โ†’ $500 โ†’ unlimited | | **Notice format** | Written only | Oral or written | | **Notice deadline** | 60 days from statement | 60 days from statement | | **Acknowledgment** | Within 30 days | N/A | | **Investigation** | 2 billing cycles (max 90 days) | 10-45 days (or 90) | | **Provisional credit** | Not required | Required if extended | | **Merchandise disputes** | Covered | Not covered | | **Collection during dispute** | Prohibited on disputed amount | Funds already gone | | **Credit reporting during dispute** | Cannot report delinquent | N/A | The row that matters to you is merchandise disputes. Your credit customers have a federal route to complain about the product. Your debit customers don't. ## Key Timelines Summary | Event | Deadline | |-------|----------| | Consumer written notice | Within 60 days of statement | | Issuer acknowledgment | Within 30 days | | Issuer investigation | Within 2 billing cycles (max 90 days) | | Consumer can withhold payment | During investigation | | Written explanation if no error | With resolution | ## Issuer Compliance Considerations ### Required Practices - Designate billing inquiry address (and disclose it clearly) - Train staff on Reg Z procedures - Document investigations thoroughly - Avoid prohibited actions during disputes - Provide written explanations of findings - Maintain dispute records ### Common Compliance Failures **Investigation failures:** - Not completing within 2 billing cycles - Not pausing collection on disputed amount - Not providing written results - Inadequate documentation **Credit reporting failures:** - Reporting disputed amount as delinquent - Not coding disputes properly to credit bureaus - Not correcting after resolution **Consumer communication failures:** - Sending notices to wrong address - Missing 30-day acknowledgment - Inadequate explanation of findings ### Documentation Best Practices Maintain records of: - Date and content of consumer notice - Acknowledgment date and method - Investigation steps taken - Evidence reviewed - Decision rationale - Resolution letter - Any provisional credits ## Enforcement and Penalties ### CFPB Enforcement The CFPB is the primary Reg Z enforcer at larger institutions. **2024 Example:** $89 million penalty for Apple Card billing dispute mishandling ### Common Violations - Failure to investigate properly - Improper collection during disputes - Inaccurate credit reporting - Missing disclosure requirements ### Consequences - Civil money penalties - Consumer restitution - Consent orders - Reputational damage ## Practical Scenarios ### Scenario 1: Unauthorized Transaction **Situation:** Consumer sees $500 charge they didn't make. **Process:** 1. Consumer sends written notice within 60 days 2. Issuer acknowledges within 30 days 3. Issuer investigates (transaction data, merchant records, signatures) 4. During investigation: amount not in minimum payment, no late fees/interest on disputed amount 5. Within 2 billing cycles: credit account or explain why charge is valid 6. Consumer liability: max $50 (most issuers $0) ### Scenario 2: Merchandise Not Received **Situation:** Consumer paid $300 for item that never arrived. **Process:** 1. Consumer first attempts good-faith resolution with merchant 2. If unresolved, sends written billing error notice 3. Geographic limits apply (but most issuers waive via network rules) 4. Issuer investigates: delivery confirmation, tracking, merchant communication 5. No proof of delivery = credit account Delivery proof decides this one. If you can't produce it, the credit is going through. ### Scenario 3: Item Not as Described **Situation:** Consumer paid $150 for "new" electronics that arrived damaged/used. **Process:** 1. Consumer contacts merchant first 2. Documents issue (photos, correspondence) 3. Sends written billing error notice 4. Issuer investigates with evidence from both parties 5. Resolution based on condition vs. description evidence Photos and correspondence are the whole case here. Capture them at the time, not once the dispute lands. ### Scenario 4: BNPL Dispute :::warning[Regulatory Note] The 2024 CFPB interpretive rule that would have applied Reg Z procedures to BNPL disputes was revoked in 2025. What's below is what most BNPL providers offer voluntarily. It isn't a requirement. ::: **Situation:** Consumer used BNPL for $400 purchase, item is defective. **Process:** 1. Consumer contacts BNPL provider 2. Provider typically pauses disputed payments during investigation (voluntary, not Reg Z-mandated) 3. Investigation follows provider's own dispute policy 4. Resolution timeline varies by provider 5. If resolved in consumer's favor: refund payments made, cancel remaining balance ## Next Steps **Understanding credit card disputes?** 1. [Learn the chargeback lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow from issuer to merchant 2. [Review reason codes](/docs/reference/reason-codes) - Understand dispute categorization **Preparing for disputes?** 1. [Build compelling evidence](/docs/chargebacks/representment/compelling-evidence) - Win merchandise and fraud disputes 2. [Understand issuer perspective](/docs/chargebacks/issuer-side) - How issuers handle Reg Z disputes **Comparing payment methods?** 1. [Compare with Reg E](/docs/compliance/consumer-protection/reg-e) - Debit card liability differences 2. [Review BNPL economics](/docs/payments/reference/bnpl-economics) - BNPL dispute and cost details --- ## See Also - [Regulation E](/docs/compliance/consumer-protection/reg-e) - Debit card protections - [Consumer Protection Overview](/docs/compliance/consumer-protection) - Regulatory landscape - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Issuer-Side Chargebacks](/docs/chargebacks/issuer-side) - How issuers handle disputes - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM thresholds - [Representment](/docs/chargebacks/representment) - Fighting disputes - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Winning disputes - [Reason Codes](/docs/reference/reason-codes) - Understanding dispute types - [BNPL Economics](/docs/payments/reference/bnpl-economics) - Buy Now Pay Later details - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party dispute abuse - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates --- ## Compliance Metrics & Monitoring Source: https://paymentsandrisk.com/docs/compliance/metrics # Compliance Metrics & Monitoring :::info[TL;DR] - Three numbers decide whether a network program comes after you: chargeback ratio, fraud ratio, and enumeration ratio. - Visa and Mastercard don't calculate the chargeback ratio the same way. Mastercard divides this month's chargebacks by **last** month's transactions. Visa uses the same month for both. - Mastercard ECM is 100-299 chargebacks **and** a 1.50-2.99% ratio. Both halves have to be true, so one without the other tells you nothing. - Visa's VAMP merchant excessive line is 1.5%, or 2.2% in CEMEA. It only bites at 1,500 combined fraud reports and disputes. - Set your own alarms at half the network number. You want a month of runway, not a week. - Neither network publishes any of these figures. Every number below came through an acquirer, so confirm yours with yours. ::: You can't manage a ratio you see once a month, in an email, after the month closed. This page gets those three numbers onto your own dashboard daily, with an alarm that trips well before your acquirer's does. ## Core Compliance Metrics Three ratios drive every network monitoring program. Track one and ignore the rest, and the other two will blindside you. ### Chargeback Ratio Disputes divided by transactions. Your acquirer watches it. It triggers Mastercard's chargeback program. And it's one of two inputs to Visa's VAMP. **Formula:** ``` Chargeback Ratio = (Chargebacks in Month N) / (Transactions in Month N or N-1) ร— 100 ``` **Where the lines sit:** most acquirer contracts treat 0.9% as the concern threshold. That's the number that earns a warning email and a reserve conversation. Visa's own excessive line under VAMP sits higher, at 1.5%. Your contract is what terminates you, so 0.9% is the ceiling that actually matters. **Calculation differences:** - **Visa**: same-month transactions as the denominator - **Mastercard**: prior month (N-1) transactions as the denominator That gap isn't trivia. Growing volume makes Mastercard's prior-month denominator smaller than Visa's, so identical activity produces a worse Mastercard ratio. It bites hardest after a slow month. Cut spend in June and June's shrunken count becomes July's denominator. July's chargebacks are still arriving from May and June sales. The ratio jumps without a single extra chargeback. :::note[VAMP counts disputes too] Visa's VAMP folds fraud reports (TC40) and non-fraud disputes (TC15) into one ratio. A clean chargeback number on its own won't keep you out. See [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring). ::: ### Fraud Ratio Confirmed fraud divided by sales. The awkward part: you don't file it. Issuers do, through TC40 reports. So you can be in trouble on a number you never generated and can't see without asking. **Formula:** ``` Fraud Ratio = (Fraud Amount in Month) / (Sales Amount in Month) ร— 100 ``` **Target:** below 0.5% for most programs **Where the number comes from:** - TC40 reports (Visa) filed by issuers - Fraud-reason chargebacks (Mastercard) - Your own fraud detection system, which will disagree with both ### Enumeration Ratio Card testing. Somebody runs stolen numbers through your checkout to find the live ones. Every attempt lands on your account, not theirs. **Formula:** ``` Enumeration Ratio = (Enumerated Authorizations) / (All Authorizations) ร— 100 ``` Approvals and declines both count, on both sides of the line. A card-testing run is mostly declines. Measure it against settled transactions and you'd hide it. **Threshold:** VAMP enumeration needs **both** 300,000 enumerated authorizations **and** a 20% ratio in the same month. Under either number, you're outside the program. ### VAMP Ratio (Visa, 2025 onward) Visa's consolidated number, replacing the old VDMP and VFMP split. **Formula:** ``` VAMP Ratio = (TC40 Fraud Count + Non-Fraud Disputes TC15) / (Settled CNP Transactions) ``` :::warning[Double counting] Under VAMP a fraud dispute can count twice. Once when the issuer files the TC40 fraud notification. Again if a TC15 chargeback follows. Nobody nets them out for you. ::: **Thresholds:** merchant excessive is 1.5%, or 2.2% in CEMEA. It only applies once you hit 1,500 combined fraud reports and disputes in a month. Below that count, the ratio can't put you in the program. Details in [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring). ## Monitoring Dashboard Components ### What to Track **Daily/Weekly Views:** - Chargeback counts by day - Fraud amounts by day - Authorization decline rates - Alert volumes (Ethoca, Verifi) **Monthly Views:** - Chargeback ratio vs. threshold - Fraud ratio vs. threshold - VAMP ratio calculation - Trend comparison (current vs. prior 3 months) **Breakdown Dimensions:** - By reason code (identify root causes) - By merchant (for acquirers) - By BIN (for issuers) - By product type (credit vs. debit) - By channel (CNP vs. CP) ### Alert Thresholds Set your own alarms below the network's. By the time the network's number trips, you've already had the bad month. | Level | Trigger | Action | |-------|---------|--------| | Green | Below 50% of threshold | Normal monitoring | | Yellow | 50-75% of threshold | Increased scrutiny, root cause analysis | | Orange | 75-90% of threshold | Remediation planning, daily monitoring | | Red | 90%+ of threshold | Emergency response, network notification | ## Key Thresholds Reference :::note[Where these numbers come from] Neither Visa nor Mastercard publishes numeric thresholds. Every figure below reached the public through an acquirer. That's true here and on every other site you'll read them on. Treat them as well-sourced and unofficial. Confirm your own limits with your acquirer in writing before you build alerts on them. ::: | Program | Metric | Threshold | |---------|--------|-----------| | Visa VAMP (merchants, excessive) | VAMP ratio + count | 1.5% (2.2% in CEMEA) AND 1,500 combined fraud reports + disputes | | Visa VAMP (acquirers, above standard) | VAMP ratio | 0.5% | | Visa VAMP (acquirers, excessive) | VAMP ratio | 0.7% | | Visa VAMP (enumeration) | Count + ratio | 300,000 enumerated transactions AND 20% | | Mastercard ECM | CB count + ratio | 100-299 AND 1.50-2.99% | | Mastercard HECM | CB count + ratio | 300+ AND 3.00%+ | | Mastercard EFM | Transaction count + fraud amount + fraud ratio + 3DS coverage | 1,000+ Mastercard transactions AND $50K+ in fraud claims AND 0.50%+ fraud-to-sales AND 3DS under 50% in regulated markets (10% in non-regulated) | Every row that says AND means it. A merchant at 4% with 40 chargebacks isn't in ECM. Neither is one with 900 chargebacks at 0.4%. EFM is the strictest of the lot. It takes **four** conditions at once, not two. Most summaries print the money and the ratio and drop the other two. The transaction floor is what keeps small merchants out of it entirely. The 3DS test is the one you control directly: get your coverage above the line and you're out of scope no matter what the fraud number does. ## Early Warning Systems ### Proactive Monitoring **Set internal thresholds at 50% of network limits:** - Visa VAMP: alert at ~0.75% - Mastercard ECM: alert at ~0.75% and 50 chargebacks **Monitor velocity, not just absolute numbers:** - Week-over-week change percentage - Month-over-month trajectory - Seasonal adjustment factors **Flag anomalies:** - MIDs/BINs with sudden increases - New merchants with unusual patterns - Specific reason codes spiking ### Review Cadence | Situation | Review Frequency | |-----------|------------------| | Normal operations | Weekly compliance review | | Approaching 50% threshold | Twice-weekly review | | Approaching 75% threshold | Daily review | | Above 90% threshold | Multiple daily reviews | ## Issuer-Specific Metrics If you're a merchant, skip this section. It's written for card issuers, and none of it shows up on a merchant statement. ### Dispute Initiation Rate How often your cardholders dispute transactions. ``` Dispute Initiation Rate = (Disputes Initiated) / (Total Transactions) ร— 100 ``` Higher rates may indicate: - Fraud targeting your cards - Poor merchant partnerships - Cardholder education needs ### Fraud Loss Rate by BIN Split fraud losses by BIN to find the problem products. ``` Fraud Loss Rate = (Fraud Losses) / (Sales Volume) ร— 100 ``` ### TC40 Filing Compliance Issuers file TC40s for fraud claims. Those filings land on somebody else's ratio. Track: - Filing timeliness - Filing completeness - Filing accuracy ### Visa Issuer Monitoring Program (VIMP) - Monitors issuer-side fraud and dispute rates for CNP - Includes dispute-to-transaction and fraud-to-sales ratios - Regional minimum volume thresholds apply ## Acquirer/Merchant Metrics ### Portfolio-Level Monitoring For acquirers managing multiple merchants: | Metric | Calculation | Target | |--------|-------------|--------| | Portfolio VAMP ratio | Aggregate across all MIDs | Below 0.3%, well under the 0.5% above-standard line | | At-risk merchant count | MIDs above 75% threshold | Zero | | MATCH additions | New listings per quarter | Minimize | ### Individual Merchant Tracking | Metric | Frequency | Action Trigger | |--------|-----------|----------------| | Chargeback ratio | Daily | Above 0.5% | | Fraud ratio | Weekly | Above 0.25% | | VAMP ratio | Daily | Above 0.75% | ### BRAM/VIRP Status Track registration and compliance status for high-risk merchants: - Registration current? - Monitoring reports filed? - Any violations flagged? ## Reporting Cadence | Frequency | Report Type | Audience | Content | |-----------|-------------|----------|---------| | Daily | Alert/exception report | Operations | Threshold breaches, anomalies | | Weekly | Trend summary | Risk managers | Ratio trends, reason code analysis | | Monthly | Full compliance report | Leadership, regulators | All metrics, program status | | Quarterly | Program review | Board, examiners | Strategic view, remediation status | ### Monthly Report Components 1. **Executive Summary** - Overall compliance status (Green/Yellow/Red) - Key metric trends - Notable events 2. **Metric Detail** - Chargeback ratio with trend - Fraud ratio with trend - VAMP ratio calculation - Breakdown by segment 3. **Program Status** - Current network program enrollments - Remediation plan progress - Upcoming threshold changes 4. **Action Items** - Required responses - Recommended improvements - Timeline commitments ## Building Your Dashboard ### Essential Views **Real-Time (refreshed hourly):** - Current day chargeback count - Current day fraud alerts - Authorization decline rate **Daily Summary:** - Rolling 30-day chargeback ratio - Rolling 30-day fraud ratio - Comparison to same period prior month **Trend Analysis:** - 90-day trend chart - Projection to month-end - Threshold overlay ### Data Sources | Data Type | Source | Frequency | |-----------|--------|-----------| | Chargebacks | Processor reports, network files | Daily | | Transactions | Authorization logs | Real-time | | TC40s | Visa reporting | Daily | | Fraud claims | Internal systems | Real-time | | Alert resolutions | Ethoca, Verifi | Daily | ## Where This Breaks **You build the dashboard on your own transaction count.** Your gateway's count and your acquirer's settled count won't match. Refunds, partial captures, voids and declines all get treated differently. Build the ratio off the acquirer's settled count. Reconcile your gateway to that, not the other way round. **You use one denominator for both networks.** Mastercard's prior-month denominator and Visa's same-month denominator turn one month of activity into two different ratios. A single "chargeback ratio" tile is wrong for at least one network. Usually it's wrong low for Mastercard. **Chargebacks get counted on the date they're worked, not the date they're received.** Networks count by received date. Clear a backlog in one week and your internal number spikes in a month the network calls quiet. Or it stays flat in a month the network calls bad. **Fraud looks fine because you're measuring your own fraud.** Your ratio comes from TC40s that issuers filed, not from the fraud your rules caught. Ask your acquirer for the raw TC40 feed. If they can't provide it, that's a real gap in what you can see. Raise it before you need it. ## Next Steps **Setting up compliance monitoring?** 1. [Track core metrics](#core-compliance-metrics) - Chargeback, fraud, enumeration ratios 2. [Build your dashboard](#building-your-dashboard) - Real-time, daily, trend views 3. [Set alert thresholds](#alert-thresholds) - 50/75/90% of network limits **Approaching thresholds?** 1. [Check key thresholds](#key-thresholds-reference) - VAMP, ECM, EFM limits 2. [Increase review cadence](#review-cadence) - Daily at 75%, multiple daily at 90% 3. [Follow remediation playbook](/docs/playbooks/reduce-chargebacks-fast) - Emergency response **Building early warning systems?** 1. [Set internal alerts at 50%](#proactive-monitoring) - Catch problems early 2. [Monitor velocity not just absolutes](#proactive-monitoring) - WoW and MoM changes 3. [Establish reporting cadence](#reporting-cadence) - Weekly, monthly, quarterly --- :::info[Other Metrics Pages] Tracking compliance is just one piece. See also: [Payments Metrics](/docs/payments/metrics) ยท [Fraud Metrics](/docs/fraud/metrics) ยท [Chargeback Metrics](/docs/chargebacks/metrics) ยท [Operations Metrics](/docs/operations/metrics) ::: ## See Also - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM thresholds and remediation - [Fraud Metrics](/docs/fraud/metrics) - Fraud-specific KPIs - [Chargeback Metrics](/docs/chargebacks/metrics) - Chargeback-specific measurements - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing ratios proactively - [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - Network program detail - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Crisis response - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency playbook - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflection tools - [Benchmarks](/docs/reference/benchmarks) - Industry standards - [Processor Reporting Checklist](/docs/reference/processor-reporting-checklist) - Data requirements - [Alerts Configuration](/docs/operations/alerts-configuration) - Monitoring setup - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM details --- ## Dispute & Fraud Monitoring Programs Source: https://paymentsandrisk.com/docs/compliance/network-rules/dispute-monitoring # Dispute & Fraud Monitoring Programs :::info[TL;DR] - **Early warning is not enforcement.** Plenty of guides say "stay under 0.65%." That's a good internal target. It just isn't where the fines start; the numbers below are. - **Visa VAMP** (live April 2025): one ratio for fraud and disputes. Merchant excessive is 1.5% since 1 April 2026. CEMEA keeps 2.2%, and non-compliant sits at 0.5%. Acquirers are reported at 0.5% above-standard and 0.7% excessive. - **Mastercard ECM**: enforcement starts at **100-299 chargebacks AND a 1.50-2.99% ratio**. HECM starts at 300+ chargebacks and 3.00%+. - **Mastercard EFM**: the fraud-only program. You need 0.50%+ fraud-to-sales, $50K+ in fraud claims, and thin 3DS coverage. - **Consequences**: monthly fines that climb into six figures. A remediation plan due in 15 days. A MATCH listing that follows you five years. - **Prevention tools** (Ethoca, Verifi RDR/CDRN) can keep resolved disputes out of the ratio. ::: Both networks fine you when disputes or fraud stay high. These are the lines where that starts. :::tip[Want the short version?] See [Network Programs Reference](/docs/chargebacks/reference/network-programs) for thresholds, fees and safe zones. This page carries the full context. ::: ## Visa Acquirer Monitoring Program (VAMP) ### Background and Consolidation VAMP replaced two programs on 1 April 2025. VDMP covered disputes and VFMP covered fraud. Now it's one ratio, and fraud and non-fraud disputes both count. **Key Dates:** - **1 April 2025**: VAMP goes live and the advisory period begins. - **1 June 2025**: Visa revises the program after industry pushback. Fraud disputes join the numerator. Thresholds move up to compensate. The count minimum goes from 1,000 to 1,500. The step-down date slips from January to April 2026. Most stale pages predate this revision. - **1 October 2025**: the advisory period ends and fees begin, at the excessive level only. - **1 January 2026**: the acquirer above-standard tier starts being charged, at US$4 per dispute. - **1 April 2026**: merchant excessive drops from 2.2% to 1.5% in AP, Canada, the EU and the US. CEMEA keeps 2.2%. ### VAMP Ratio Calculation Visa combines issuer fraud reports (TC40) and dispute events (TC15) into one ratio. The denominator is card-not-present volume. **Components:** - **TC40**: issuer-reported fraud notifications - **TC15**: chargeback transaction codes, dispute conditions 10, 11, 12 and 13. Condition 10 is the fraud group. It joined the numerator in the June 2025 revision. Anything saying VAMP counts non-fraud disputes only predates that change - **Denominator**: settled CNP transactions **Fraud disputes count twice.** Once when the issuer files the TC40. Again if a TC15 chargeback follows. **Minimum volume:** about 1,500 applicable disputes before the program picks you up. :::note[Denominator Varies by Reporting View] Formulas and denominators vary by acquirer reporting system. Use your acquirer's definition when you build a dashboard. Don't assume one universal formula. ::: ### Threshold Overview (2025-2026) Since 1 April 2026 merchant excessive is 1.5%. The 2.2% figure still circulating applies to CEMEA only. Both acquirer portfolio lines, 0.5% and 0.7%, have run since 1 June 2025. | Who | Threshold | Notes | |-----|-----------|-------| | **Merchant - non-compliant** | 0.5% | The line you cross first. Early warning, not an automatic fee | | **Merchant - excessive** | 1.5% | Since 1 April 2026. 2.2% retained in CEMEA only | | **Acquirer - above standard** | 0.5% | Portfolio level, since 1 June 2025. The US$4 fee at this tier didn't start until 1 January 2026 | | **Acquirer - excessive** | 0.7% | Portfolio level, since 1 June 2025. It was 0.5% when VAMP went live in April 2025 | **Don't merge those two dates.** A threshold and a fee are separate events. Visa's own VAMP overview puts the acquirer lines at 50 bps above standard and 70 bps excessive, effective 1 June 2025. The 1 January 2026 date belongs only to the US$4 per-dispute charge at the above-standard tier. That charge came in seven months after the threshold it attaches to, and most summaries run the two together. The merchant thresholds are gated on your acquirer. Visa's own framing is conditional, and the merchant lines apply where the acquirer isn't already sitting in Above Standard or Excessive. The per-dispute charge at 0.5% only lands once the acquirer's portfolio has breached Excessive. Stripe's docs put the difference in one word: Visa *may* assess at non-compliant, and *assesses* at excessive. That doesn't make 0.5% safe to ignore. It's where your acquirer starts watching you. Their internal limit is usually tighter than Visa's anyway. Crossing 0.5% just isn't an automatic bill. Don't let anyone sell you a service on the claim that it is. :::warning[Verify Current Thresholds] Threshold numbers change, so confirm yours against Visa Core Rules or your acquirer's compliance docs. Regions differ, and LAC runs its own timeline. ::: ### Enumeration Ratio VAMP also monitors card testing/BIN attacks through the enumeration ratio. **Formula:** ``` Enumeration Ratio = Enumerated Authorizations / All Authorizations ``` Both halves count approvals and declines. That matters. A card-testing attack is mostly declines. A denominator built from settled transactions would never get near the threshold. **Threshold:** 20%, over a minimum of 300,000 enumerated authorizations. Detection runs on Visa's Account Attack Intelligence (VAAI) Score. ### Exclusions and Prevention Tool Impact RDR and CDRN can keep disputes out of VAMP ratios. Issuer fraud reports (TC40) often still count anyway, even on a resolved dispute. CE 3.0 can exclude some TC40/TC15 pairs from Visa's program metrics. Treatment depends on how the transaction qualifies. :::tip[Check Current Visa Guidance] How prevention tools hit VAMP keeps moving. Visa clarified TC40 treatment in March 2025. Verify the current exclusion rules before you rely on them. ::: ### VAMP Fee Structure Fees run per dispute or fraud event, once you're over the line. | Level | Per-Dispute Fee | |-------|-----------------| | Acquirer Above Standard (0.5% portfolio) | US$4, from 1 January 2026 | | Acquirer Excessive (0.7% portfolio), on disputes at merchants whose own ratio is 0.5% or higher | US$8 | | Merchant Excessive | US$8 per CNP dispute, passed through by the acquirer | These are flat amounts, not the vague ranges that usually get published. They come from Checkout.com's acquirer notice dated 12 June 2026, corroborated by Antom. Visa does **not** publish them. Visa's own one-page VAMP fact sheet gives the ratios and the count minimums and no fee figure at all. Core Rules 12.5.4 is headed "Dispute Monitoring Fees and Non-Compliance Assessments" and has nothing under it. Treat the amounts as reported, and confirm your own pass-through with your acquirer. **Key Program Features:** - Grace covers program months 1, 2 and 3. Fees start in program month 4. - Grace applies once per rolling 12 months, on a first identification. - Program months and calendar months aren't the same. You breach in one calendar month and the notice lands in the next, which is program month 1. - Fines compound monthly until you're compliant. - Fee amounts sit in Visa Core Rules and change. ### Remediation Requirements - Submit a remediation plan within 15 days of notification, then report progress monthly. - **Exit criteria**: below the excessive threshold for three straight months. ## Mastercard Excessive Chargeback Program (ECP) ### Program Structure (as of 2025) Two tiers. Both the count and the ratio have to be met. | Level | Chargeback Count | Chargeback Ratio | |-------|------------------|------------------| | **ECM** (Excessive Chargeback Merchant) | 100-299 | 1.5%-2.99% (150-299 bps) | | **HECM** (High Excessive Chargeback Merchant) | 300+ | 3.0%+ (300+ bps) | ### Ratio Calculation ``` Basis Points = (First Presentment Chargebacks in Month N) / (Transactions in Month N-1) ร— 10,000 ``` **Note:** Mastercard divides by the prior month's transactions. Visa uses the same month for both. ### ECM Fine Structure | Month in Program | Monthly Assessment | |------------------|-------------------| | 1 | $0 (warning) | | 2 | $1,000 | | 3 | $1,000 | | 4-6 | $5,000 | | 7-11 | $25,000 | | 12-18 | $50,000 | | 19+ | $100,000 | ECM carries no issuer recovery charge. That belongs to HECM, and it's in the next table. :::note[Fine Amounts Change] Mastercard sets these amounts and updates them. Confirm current assessments with your acquirer. ::: ### HECM Fine Structure | Month in Program | Monthly Assessment | Issuer Recovery Assessment | |------------------|-------------------|---------------------------| | 1 | $0 (warning) | No | | 2 | $1,000 | No | | 3 | $2,000 | No | | 4-6 | $10,000 | Yes | | 7-11 | $50,000 | Yes | | 12-18 | $100,000 | Yes | | 19+ | $200,000 | Yes | HECM escalates far faster than ECM. That's the point of the tier. The **Issuer Recovery Assessment** is a HECM charge, and only from program month 4. It doesn't apply to ECM. Mastercard collects it from your acquirer and remits it to the issuers that took the chargebacks. An issuer needs USD 20 owed before it sees a payment. Below that, the issuer with the biggest burden takes the whole amount, and a tie gets split evenly (Mastercard, _Security Rules and Procedures - Merchant Edition_, 3 February 2026, section 8.3.3). If your acquirer bills you an issuer recovery line, that tells you which tier you're in. It's HECM. Ask them to confirm. ### Exit Criteria - Below ECM thresholds for three straight months. That means under 100 chargebacks AND under a 1.5% ratio. - **Extension available**: fines pause for six months while you remediate. - Come in under the thresholds by the end and the accrued fines are forgiven. - Stay above them and the whole accrued balance falls due. ## Mastercard Excessive Fraud Merchant (EFM) ### Enrollment Criteria (as of 2025) You have to hit all four. - 1,000+ Mastercard transactions in the prior month - $50,000+ in fraud claims - 0.50%+ fraud-to-sales ratio - Under 50% 3DS usage in regulated markets, or 10% in non-regulated ### EFM Fine Structure The fine structure took effect 1 March 2020. It runs on the same month counter as ECM. | Month in Program | Monthly Assessment | |------------------|-------------------| | 1 | $0 (warning) | | 2 | $500 | | 3 | $1,000 | | 4-6 | $5,000 | | 7-11 | $25,000 | | 12-18 | $50,000 | | 19+ | $100,000 | **Exit:** below all thresholds for three straight months. :::warning[3DS Requirement] Mastercard treats 3DS as the main EFM defense. Regulated countries need 50%+ coverage. Non-regulated need 10%+, and data-only 3DS counts toward the threshold. ::: ## MATCH List (Terminated Merchant File) ### What is MATCH? MATCH is Mastercard's database of terminated merchants. Acquirers have to check it before they onboard anyone. The full name is Member Alert to Control High-risk Merchants. In practice it's the industry blacklist. **Key Characteristics:** - Entries sit for **5 years**, then purge automatically (section 11.10). - You can ask the listing acquirer to remove you. Mastercard says no lawyer is required (11.5.1). - Most acquirers won't touch a listed merchant, though the rules do permit it. - It hits every card brand, not just Mastercard. ### MATCH Reason Codes Eleven codes. Codes 02, 07 and 11 came out in the 11 February 2025 edition. Code 06 read "Reserved for Future Use" until then. Anything showing 14 codes is quoting an expired rulebook. | Code | Reason | Description | |------|--------|-------------| | 01 | Account Data Compromise | Cardholder data exposed, including Common Point of Purchase | | 03 | Transaction Laundering | Processing for another party, against the merchant agreement | | 04 | Excessive Chargebacks | Mastercard chargebacks over the previous three months above 1.5% of Mastercard sales transactions, **and** USD 5,000 or more in chargebacks | | 05 | Excessive Fraud | Fraud-to-sales dollar volume of 8% or more over the previous three months, **and** 10 or more fraudulent transactions, **and** USD 5,000 or more | | 06 | Coercion | Forced transactions | | 08 | Mastercard Questionable Merchant Audit Program | QMAP violation | | 09 | Liquidation/Insolvency | Merchant insolvent | | 10 | Violation of Standards | Network rules violation. No published number | | 12 | PCI Data Security Standard Noncompliance | Failed to maintain PCI compliance | | 13 | Illegal Transactions | Processed illegal activity | | 14 | Identity Theft | Merchant was identity theft victim | Source: Mastercard, _Security Rules and Procedures - Merchant Edition_, 3 February 2026, section 11.14.1, Table 11.4, p.155. For codes 04 and 05, every condition has to be met. Not any one of them. When an American Express acquirer reports you, code 04 carries no number at all and the call is entirely Amex's. Meeting the ratio doesn't list you. Termination does. Once the acquirer terminates while a code applies, the listing is mandatory within five calendar days (11.5). List a merchant sitting under the code 04 floor and the acquirer risks a noncompliance assessment (11.4, item 8). ### MATCH Consequences - Most acquirers won't onboard a MATCH-listed merchant. - High-risk processors might, at higher fees and with a reserve. - The listing hits **all card brands**, not just Mastercard. - You start the removal request with the listing acquirer. They have 30 calendar days to respond (11.4, item 1). They also have to hand over the listing ICA and reason code on request (item 10). Code 12 listings can go straight to Mastercard when the acquirer won't file (11.13). ## Visa Merchant Screening Service (VMSS) VMSS is Visa's shared screening database. That's the real counterpart to MATCH. Visa's **TMF** is something else. Under Core Rules 10.10.1.1 the Terminated Merchant File is a file the acquirer keeps on you: merchant agreement, deposit history, correspondence. - Acquirers have to query VMSS before onboarding. - Terminated merchants go in by close of business the day after notice of intent to terminate. That's tighter than Mastercard's five calendar days. - Visa publishes no numeric listing standard. Its stated reasons are qualitative, "excessive Counterfeit Transactions" and "an excessive number of Disputes due to the Merchant's business practices or procedures". Any page giving you a numeric TMF threshold invented it. - Visa's public rules don't state a retention period the way Mastercard's do. Ask your acquirer if you need one. ## High-Risk Merchant Programs ### VIRP (Visa Integrity Risk Program) VIRP replaced the Global Brand Protection Program in May 2023. It sorts high-risk merchants into three tiers. **Tier Structure:** - **Tier 1**: adult content, dating and escort, gambling, pharmaceuticals - **Tier 2**: cryptocurrency, cyberlockers, file sharing - **Tier 3**: other high-risk MCCs **Costs (as of 2024 Visa bulletins):** - Registration: on the order of $1,000 per acquirer - Transactions: a few basis points, plus per-transaction fees on MCCs 5967, 7273 and 7995 - Non-compliance: monthly assessments that get large if you stay unregistered :::note[Fee Amounts Subject to Change] Visa updates VIRP pricing by bulletin. Check current fees with your acquirer. ::: ### BRAM (Mastercard Business Risk Assessment and Mitigation) BRAM protects against illegal or brand-damaging transactions. **Prohibited Categories Include:** - Synthetic drugs - Illegal pharmaceuticals - Counterfeit goods - Unlicensed gambling - Child exploitation material - Piracy and IP theft **Requirements:** - Acquirers register with the Merchant Monitoring Program (MMP) - Reporting is monthly - **Fine mitigation of 75-100%** if you use a registered Merchant Monitoring Service Provider ## Remediation Strategies ### Immediate Actions 1. **Find the root cause.** True fraud, friendly fraud, or an operational mess. 2. **Turn on prevention alerts.** Ethoca and Verifi (RDR/CDRN). 3. **Look at your worst products.** Some of them are worth dropping. 4. **Audit support and refunds.** Easy refunds prevent disputes. ### Prevention Tools Impact (as of 2025) | Tool | VAMP Impact | ECM Impact | |------|-------------|------------| | RDR (Visa) | Can exclude associated TC15 disputes; TC40 usually still counted | N/A | | CDRN (Visa) | Can exclude associated TC15 if resolved | N/A | | CE 3.0 (Visa) | Can exclude both TC40 and TC15 for qualifying transactions | N/A | | Ethoca Alerts | Prevents chargeback if refunded before TC40 filed | Prevents if refunded | | Order Insight | Reduces disputes by providing transaction details to issuers | Reduces disputes | :::tip[Confirm Tool Behavior] How tools affect program ratios keeps changing. Confirm the current behavior with your acquirer. ::: ### Remediation Plan Components 1. **What you do and where you stand.** The business, the current ratios. 2. **Root cause.** Why the chargebacks or fraud are elevated. 3. **Specific actions with dates.** What you'll change and when. 4. **Timeline.** Where you expect the ratio to land. 5. **Backup plan.** For when the first one doesn't work. 6. **Reporting.** How you'll keep them updated. ## Issuer Considerations ### TC40 Filing Requirements - Issuers file a TC40 on every fraud claim, however small. - The TC40 still gets filed when an alert resolves the dispute, for VAMP purposes. - Skipping the filing creates its own compliance problem. ### Visa Issuer Monitoring Program (VIMP) - Watches issuer-side fraud and dispute rates on CNP - Metrics are dispute-to-transaction and fraud-to-sales - Minimum volume thresholds vary by region ### Consumer Clarity / Order Insight - Enrolled issuers show cardholders the transaction detail - That kills a lot of "I don't recognize this" disputes - Verifi runs it for Visa, Ethoca for Mastercard --- :::warning[Last verified: 1 August 2026] These thresholds move, and VAMP has already changed twice since April 2025. Neither Visa nor Mastercard publishes the numbers in a document you can read. Verify yours with your acquirer before you decide anything on them. ::: ## Next Steps **Understanding your risk?** 1. [Review chargeback metrics](/docs/chargebacks/metrics) - Calculate your current ratios 2. [Check compliance metrics](/docs/compliance/metrics) - Build monitoring dashboards **Implementing prevention?** 1. [Set up chargeback alerts](/docs/chargebacks/prevention/alerts) - Ethoca, Verifi RDR/CDRN 2. [Enable 3D Secure](/docs/fraud/prevention/3ds) - Liability shift and fraud reduction 3. [Evaluate vendors](/docs/chargebacks/vendors) - Prevention tool options **Already in a program?** 1. [Reduce chargebacks fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency response playbook 2. [Work with your processor](/docs/operations/processor-management) - Remediation plan support 3. [Understand holds and reserves](/docs/operations/holds-and-reserves) - Program consequences --- ## See Also - [Chargeback Prevention](/docs/chargebacks/prevention) - Alert networks and strategies - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Ethoca, Verifi details - [Chargeback Vendors](/docs/chargebacks/vendors) - Prevention tool options - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking your ratios - [Fraud Vendors](/docs/fraud/vendors/landscape) - Prevention vendors - [Fraud Prevention](/docs/fraud/prevention) - Reducing fraud before disputes - [3D Secure](/docs/fraud/prevention/3ds) - Authentication for liability shift - [Card Testing](/docs/fraud/types/card-testing) - Understanding enumeration attacks - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party dispute abuse - [Processor Management](/docs/operations/processor-management) - Working with processors on compliance - [Compliance Metrics](/docs/compliance/metrics) - Building monitoring dashboards - [Holds and Reserves](/docs/operations/holds-and-reserves) - Program consequences --- ## Charging Customers a Card Fee (Surcharging Rules) Source: https://paymentsandrisk.com/docs/compliance/network-rules/surcharging # Charging Customers a Card Fee (Surcharging Rules) :::info[TL;DR] - Most US states let you surcharge credit cards. **Connecticut, Maine, Massachusetts and Puerto Rico ban it outright.** California's pricing law killed it there too - Your cap is the **lower** of two numbers. The network limit, or your own merchant discount rate. Visa caps at 3%, Mastercard at 4%. Take both and 3% is your real ceiling - **Never surcharge debit or prepaid.** Not even when the cardholder picks "credit" at the terminal. It's the violation processors see most - Notify the networks and your acquirer **30 days before** you start. Then disclose at the door and at checkout. The receipt needs its own line too - A "free processing" pitch at 3.5-4% is a Visa violation - If your state bans it, use a cash discount instead. Same economics, none of the network paperwork ::: You want to stop eating 3% on card sales. You've been told you can just pass it to the customer. Sometimes you can. Three things decide it. Your state's law, the network caps, the disclosure rules. Not hard, just specific. Get one wrong and it's a fine instead. This page is the compliance side. For whether it's worth doing at all, see [Surcharging in Payments](/docs/payments/surcharging-compliance). ## What is Surcharging? A surcharge is a fee added for paying by credit card. It covers what the card costs you to accept. Network rules banned it outright until 2013. A class action settlement opened it up. That was In re Payment Card Interchange Fee and Merchant Discount Antitrust Litigation. State law still decides where you can do it. ### Related Concepts | Term | Definition | Key Difference | |------|------------|----------------| | **Surcharge** | Fee added for credit card payment | Added to base price | | **Convenience Fee** | Flat fee for alternate payment channel | For non-standard channels only | | **Cash Discount** | Lower price for paying with cash | Base price is credit price | | **Service Fee** | General fee not specific to payment | Not payment-method specific | The distinctions matter. Each one carries its own rules. Calling a surcharge a "convenience fee" doesn't change which rules apply. ## Network Surcharging Rules ### Visa Requirements **Cap:** 3% of transaction OR your merchant discount rate, whichever is lower **Advance Notice:** - Notify Visa and your acquirer 30 days before implementing - Register at www.visa.com/merchantsurcharging **Card Type Restrictions:** - Credit cards only - **Never surcharge debit or prepaid cards** (even if cardholder selects "credit" at point of sale) **Disclosure Requirements:** - Clear disclosure at store entrance or website homepage - Clear disclosure at point of sale before payment processed - Separate line item on receipt (not buried in subtotal) **Equal Treatment:** - Must surcharge Visa on same terms as equal-or-higher-cost competitors - Brand-level or product-level surcharging permitted **Non-Compliance Penalties:** - Visa enforcement actions can result in significant fines - Penalties run from tens of thousands to over a million dollars ### Mastercard Requirements **Cap:** 4%, or your merchant discount rate, whichever is lower. A 2024 settlement would have changed the surcharging terms. The court **rejected it in June 2024**. A later settlement reached in 2025 has preliminary approval only. It isn't in force either. Nothing's changed yet. Don't plan around either one. _Verified 1 August 2026._ **Advance Notice:** - Written notice to Mastercard and acquirer 30 days before start - Acquirer forwards notification to Mastercard **Card Type Restrictions:** - Credit cards only - **Never surcharge debit or prepaid cards** **Disclosure Requirements:** - Clear disclosure required at all customer touchpoints :::warning[Common Violations] Visa caps you at 3%. So a "free processing" program pitching 3.5-4% is pitching a violation. Most of them miss the disclosure requirements too. The fines land on you. Not on the reseller who sold it. ::: ## State-by-State Surcharging Status ### States Where Surcharging Is Banned Outright | State | Status | Notes | |-------|--------|-------| | **Connecticut** | Prohibited | No surcharges allowed | | **Maine** | Prohibited | No surcharges allowed (9-A M.R.S. 8-509) | | **Massachusetts** | Prohibited | No surcharges allowed | | **Puerto Rico** | Prohibited | Territory prohibition | :::warning[This list isn't complete, and it moves] Other states impose limits or sit in flux. Oklahoma is one. State surcharging law changes often. The table above was last checked against published state law in 2025. Check with local counsel before you switch a surcharge on. ::: ### States with Specific Restrictions | State | Restriction | Details | |-------|-------------|---------| | **Colorado** | 2% cap | Lower than network caps | | **New York** | Complex | Must display total credit card price; restricts how surcharges shown | | **New Jersey** | Cost limit | Cannot exceed actual processing cost | | **Nevada** | Cost limit | Cannot exceed actual processing cost | | **South Dakota** | Cost limit | Cannot exceed actual processing cost | | **Minnesota** | Disclosure rules | Mandatory fees must be in advertised price (Jan 2025) | | **California** | Effectively prohibited | SB 478 (July 2024) bans displaying prices below total cost; surcharging is no longer viable for most merchants | | **Texas** | Complex/Evolving | State law prohibits but federal courts ruled unconstitutional; AG says enforceable | **New York:** display the full credit card price up front. Most New York merchants switch to cash-discount presentation instead. It's the cleanest way to comply. **California:** SB 478 took effect 1 July 2024. It bans showing a price below the full cost, mandatory fees included. A surcharge is technically avoidable rather than mandatory. That distinction hasn't made surcharging workable here. Treat California as a no-surcharge state. **Texas:** unresolved. Federal courts ruled the prohibition unconstitutional. The state AG says it's still enforceable. Don't be the test case. Talk to local counsel first. ### States Where Surcharging is Generally Permitted The remaining ~40 states allow it. Network rules and the disclosure requirements still apply. Verify your own state before you switch anything on. These laws move. ## Implementation Requirements ### Before Surcharging 1. **Confirm state law allows surcharging** in all locations where you operate 2. **Determine your merchant discount rate (MDR)** for applicable cards 3. **Set surcharge at the lower of** MDR or network cap (3% for Visa) 4. **Notify Visa**: www.visa.com/merchantsurcharging 5. **Notify Mastercard**: Written notice to acquirer who forwards to Mastercard 6. **Wait 30 days** before implementing ### Disclosure Requirements | Touchpoint | Requirement | |------------|-------------| | **Entry point** | Sign at store entrance or website homepage | | **Point of sale** | Clear notice before payment is processed | | **Receipt** | Surcharge as separate line item | | **Online** | Visible before checkout completes | ### Signage Examples Visa publishes sample compliant signage at https://usa.visa.com/support/small-business/regulations-fees.html. **Sample In-Store Sign:** > "We impose a surcharge on credit card transactions that is not greater than our cost of acceptance. We do not surcharge debit cards." **Sample Online Disclosure:** > "A [X]% surcharge will be added to credit card transactions. This fee covers our cost of accepting credit cards. We never surcharge debit cards." ## Surcharging vs. Cash Discount Programs | Feature | Surcharging | Cash Discount | |---------|-------------|---------------| | Listed price | Base price (lower) | Credit card price (higher) | | Adjustment | Fee added for credit | Discount for cash | | Perception | Penalty for using card | Reward for using cash | | Disclosure | Network-mandated requirements | State consumer protection laws | | Debit cards | Cannot surcharge | Discount applies to cash only | | Network notification | Required 30 days in advance | Not required | ### New York Implications (Feb 2024) New York wants the full credit card price up front. Not a lower pre-surcharge subtotal. That breaks the usual model. **Common Approaches in NY:** - Use a cash-discount approach (list higher price, discount for cash) - Show only the final card price (no line-item surcharge) ## Convenience Fees Convenience fees are **not surcharges.** Different rules apply. ### Requirements - Must cover a **genuine alternate payment channel** - **Flat fee**, never a percentage - The channel has to differ from how you normally get paid - You can't charge one if cards are your only channel - You can't charge one if you're 100% card-absent ### Eligible Merchants Convenience fees usually fit: - Government agencies (paying taxes online when mail is standard) - Educational institutions (tuition payments) - Utility companies (bill payments) - Other merchants with primary non-card payment channel ### Example A utility normally takes payment by mail or in person. It can charge a convenience fee for phone or online. They're genuine alternate channels. A card-first retailer can't. There's no alternate channel to be convenient about. ## Issuer Perspective Issuers see surcharging in the cardholder base: **What you'll see:** - Cardholders steering away from the cards that get surcharged hardest - More "hidden fee" complaints - Some cardholders switching to debit, which can't be surcharged **What you can do:** Issuers can't stop a compliant surcharge. They can: - Educate cardholders about surcharge limits and rights - Provide information about disputing non-compliant surcharges - Monitor for reports of excessive or deceptive surcharging - Report non-compliant merchants to networks ## Compliance Monitoring ### For Acquirers - Ensure merchants have properly notified networks before surcharging - Monitor for excessive surcharge percentages (above caps) - Respond to cardholder complaints about surcharging - Visa runs mystery shopping audits, so assume the signage gets checked ### For Merchants **Documentation to Maintain:** - Your merchant discount rate (to prove the surcharge doesn't exceed it) - Network notification confirmations - Staff training records on disclosure requirements - Photos of compliant signage **Ongoing Compliance:** - Train staff on proper disclosure - Audit receipts for correct line-item display - Monitor customer complaints - Update signage if rates change ## Common Compliance Failures | Failure | Why It's a Problem | |---------|-------------------| | Surcharging debit cards | Never permitted, even if "credit" selected | | Exceeding network caps | 3% Visa max often violated | | No advance notice | Must notify networks 30 days prior | | Missing disclosures | Required at entry, POS, and receipt | | Surcharging in prohibited states | CT, ME, MA, PR outright bans | | Burying surcharge in total | Must be separate line item | :::tip[Before you switch this on] **Wondering whether surcharging is worth it at all?** See [Surcharging in Payments](/docs/payments/surcharging-compliance). It has the business case, the ROI math, and the implementation approach. **Just trying to cut processing costs?** Check whether you're overpaying first. On flat-rate pricing (2.9% + $0.30), moving to interchange-plus often saves more. And it costs your customers nothing. Start with [Understanding Your Costs](/docs/learning-pathways/reducing-costs/understanding-your-costs) and [Buying Payments](/docs/payments/buying-payments). ::: ## Next Steps **Evaluating surcharging?** 1. [Check state-by-state status](#state-by-state-surcharging-status) - Prohibited in CT, ME, MA, PR 2. [Understand network rules](#network-surcharging-rules) - Visa 3%, Mastercard 4% 3. [Compare to cash discount](#surcharging-vs-cash-discount-programs) - Different rules **Implementing surcharging?** 1. [Follow implementation requirements](#implementation-requirements) - Notify, wait, disclose 2. [Set up disclosures](#disclosure-requirements) - Entry, POS, receipt 3. [Avoid common failures](#common-compliance-failures) - Debit, caps, states **For acquirers and issuers?** 1. [Monitor compliance](#compliance-monitoring) - Acquirer responsibilities 2. [Understand issuer impact](#issuer-perspective) - Cardholder effects 3. [Track violation patterns](#common-compliance-failures) - What to watch for --- ## See Also **Network and compliance:** - [Network Rules Overview](/docs/compliance/network-rules) - Full network rule reference - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM thresholds - [Compliance Metrics](/docs/compliance/metrics) - Measuring compliance health **Cost and pricing:** - [Buying Payments](/docs/payments/buying-payments) - Choosing and negotiating with processors - [Understanding Your Costs](/docs/learning-pathways/reducing-costs/understanding-your-costs) - Interchange, markups, hidden fees - [Industry Benchmarks](/docs/reference/benchmarks) - What "normal" processing costs look like **External references:** - [Visa Merchant Surcharging](https://usa.visa.com/support/small-business/regulations-fees.html) - Registration and signage - [Mastercard Rules](https://www.mastercard.com/us/en/business/support/rules.html) - Mastercard compliance standards --- ## PCI DSS Compliance Source: https://paymentsandrisk.com/docs/compliance/pci-dss # PCI DSS Compliance :::info[TL;DR] - **Most small merchants qualify for SAQ A** (~22 controls). A hosted payment page or an iframe gets you there. On Stripe Checkout, Square or Shopify Payments, you're probably already close. - **Never see raw card numbers?** Your PCI burden is minimal. Tokenization is the single best thing you can do. - **The "$5,000-$100,000/month fine" isn't something you can verify.** Nobody publishes a schedule. The networks assess your *acquirer*. Your acquirer passes it on per your merchant agreement. The real exposure is breach liability, not a monthly invoice. - **Current standard**: PCI DSS 4.0.1. All future-dated requirements are now mandatory. ::: ## What Should I Do? {/* #what-should-i-do */} Most merchants searching "PCI compliance" want one of four things: **"I just need to know if I'm compliant"** 1. Check your [merchant level](#merchant-compliance-levels) (based on annual transaction volume) 2. Use the [SAQ flowchart](#which-saq-do-you-need) to find your questionnaire type 3. Most Level 4 merchants using hosted checkout = SAQ A = 22 controls. You're probably fine. **"I want to reduce my PCI burden"** 1. [Tokenization](#1-tokenization) removes stored card data from your systems 2. [Hosted payment pages](#4-outsourcing-payment-functions) keep raw card numbers off your servers entirely 3. [P2PE terminals](#2-point-to-point-encryption-p2pe) reduce in-store scope to ~33 controls **"I got a letter from my processor about PCI"** 1. Don't panic. Your processor or acquirer may require an annual [SAQ submission](#self-assessment-questionnaires-saqs) and [AOC](#attestation-of-compliance-aoc) 2. Determine your [SAQ type](#which-saq-do-you-need), complete it, and submit 3. If you need quarterly scans, engage an [Approved Scanning Vendor](#approved-scanning-vendors) **"I need PCI tools or a scanning vendor"** 1. Check what your [processor already provides](#processor-pci-tools) - you may not need anything extra 2. Need quarterly scans? See [Approved Scanning Vendors](#approved-scanning-vendors) 3. Need help completing your SAQ? See [PCI compliance platforms](#pci-compliance-platforms) 4. Need payment page monitoring (Req 6.4.3/11.6.1)? See [payment page security tools](#payment-page-security-tools) :::tip[The 80/20 on PCI] Use a hosted payment page so you never store card numbers yourself, and Stripe Checkout, Square and PayPal all qualify. Then your job is three things. Complete SAQ A once a year, don't do anything dumb with the card data you do see (like the last 4 digits), and keep your website secure. That covers most small merchants. ::: :::tip[Related Pages You'll Need] - **Using Stripe/Square/Shopify?** See your [processor's PCI tools](#processor-pci-tools) below. You may already be compliant. - **Got a PCI letter from your processor?** See [Processor Management](/docs/operations/processor-management) for how to respond. - **Worried about data breaches?** See the [Breach Response Playbook](/docs/playbooks/breach-response) for the step-by-step plan. - **Need the network security rules?** See [Network Rules](/docs/compliance/network-rules) for Visa and Mastercard requirements. ::: PCI DSS is the card industry's security standard, and most small merchants qualify for its shortest version. **Key Fact:** Most Level 4 merchants on hosted checkout qualify for SAQ A. That's 22 controls, not the 300+ of SAQ D. Stripe Checkout, Square and Shopify Payments all get you there. Never see raw card numbers? Your PCI burden is minimal. ## What Is PCI DSS? PCI DSS is a set of security requirements, and it applies to anyone who processes, stores or transmits card data. The **PCI Security Standards Council (PCI SSC)** wrote it, and Visa, Mastercard, American Express, Discover and JCB founded that council. The council maintains the standard, but the card brands enforce it. That split is the one thing worth remembering here, because no penalty ever arrives from the PCI SSC. It arrives through your acquirer. :::warning[Important Version Update] **PCI DSS 3.2.1 was retired on March 31, 2024.** The current standard is **PCI DSS 4.0.1**. Future-dated requirements in 4.0 became mandatory on **March 31, 2025**. ::: :::note[Going Deeper?] The rest of this page covers the full standard in detail. Need background first? - [How payments work](/docs/payments) covers data flows and infrastructure. - [Processor management](/docs/operations/processor-management) covers your processor relationship. - [Payment methods](/docs/payments/payment-methods) covers what you accept and how. ::: ## Which SAQ Do You Need? ```mermaid flowchart TD A[Do you store,process, or transmitcard data?] --> B{How do youaccept payments?} B -->|Fully outsourcedredirect/iframe| C[SAQ A~22 controls] B -->|Card-presentP2PE terminal| D[SAQ P2PE~33 controls] B -->|Card-presentstandalone terminal| E[SAQ B or B-IP~41 controls] B -->|E-commercedirect post| F[SAQ A-EP~140 controls] B -->|Store card dataor custom integration| G[SAQ D~300+ controls] style C fill:#22c55e,color:#fff style D fill:#22c55e,color:#fff style E fill:#f59e0b,color:#fff style F fill:#f59e0b,color:#fff style G fill:#ef4444,color:#fff ``` **Goal:** get to SAQ A or SAQ P2PE. They've got the fewest requirements and the lowest audit burden. ### SAQ Eligibility Checklists {/* #saq-checklists */} These checklists confirm which SAQ you're on. Every item must be true for that SAQ. #### SAQ A Checklist (easiest - ~22 controls) {/* #saq-a-checklist */} You're SAQ A if ALL of these are true: - [ ] **Card-not-present only** (e-commerce, mail order, telephone order) - [ ] **All payment processing is fully outsourced** to a PCI DSS validated third-party processor - [ ] **Your payment page is either:** - A full redirect to the processor (customer leaves your site to pay), OR - A processor-hosted iframe embedded in your page - [ ] **Your systems never store, process, or transmit cardholder data** in any form - [ ] **No electronic cardholder data** sits on your systems or premises - [ ] **You confirmed your integration method** with your processor, and they agree you qualify for SAQ A - [ ] **Your processor is PCI DSS compliant** and you hold their current AOC **Common platforms that typically qualify you for SAQ A:** | Platform | Integration Type | SAQ A? | Notes | |----------|-----------------|--------|-------| | **Stripe Checkout** | Full redirect | Yes | Customer goes to Stripe-hosted page | | **Stripe Elements** (iframe) | Processor iframe | Yes | Card fields are Stripe iframes; you never see PAN | | **Square Online** | Fully hosted | Yes | Square handles everything | | **Shopify Payments** | Fully hosted | Yes | Shopify is PCI Level 1; merchants inherit | | **PayPal Standard** | Full redirect | Yes | Customer goes to PayPal to pay | | **Adyen Drop-in** | Processor iframe | Yes | Adyen-hosted payment fields | | **Braintree Drop-in UI** | Processor iframe | Yes | PayPal/Braintree hosted fields | | **WooCommerce + Stripe** | Depends on plugin | Check | Must use Stripe Elements, not direct API | | **Custom Stripe API** (server-side) | Direct API | **No** | If your server touches raw card data, you're SAQ A-EP or D | :::warning[SAQ A Under PCI DSS 4.0] An iframe adds a condition to SAQ A. You confirm one of two things. - You comply with Req 6.4.3 (script inventory) and 11.6.1 (payment page change detection). - Or your processor confirms they handle both for you. **Full redirect** is the simplest path. The customer leaves your site entirely. Choosing between iframe and redirect? Redirect is easier. ::: #### SAQ A-EP Checklist (~140 controls) {/* #saq-a-ep-checklist */} You're SAQ A-EP if ALL of these are true: - [ ] **Card-not-present e-commerce only** - [ ] **All payment processing is outsourced** to a PCI DSS validated processor - [ ] **Your website delivers the payment page** to the customer's browser, but you don't receive cardholder data - [ ] **Your web server could affect the security of the transaction** (your JavaScript runs on the payment page, say) - [ ] **You never store, process, or transmit cardholder data electronically** on your systems - [ ] **Quarterly ASV scans** are passing for all internet-facing systems **When you're SAQ A-EP instead of SAQ A:** - Your JavaScript makes a direct-post API call to the processor. The card number goes browser to processor, but your scripts are in the path. - You serve the payment page from your servers, not a redirect. - Your checkout-page code could intercept card data, even though it doesn't. **Common example:** a custom React or Next.js checkout using Stripe.js. Your front-end code orchestrates the flow with `confirmCardPayment()` and the card data still goes straight to Stripe, but your scripts are in the path, so you're A-EP anyway. That's ~140 controls instead of ~22, plus quarterly ASV scans. Unless the custom checkout is earning that, go back to a hosted page. #### SAQ B / B-IP Checklist (card-present, ~41-82 controls) {/* #saq-b-checklist */} **SAQ B** (dial-out terminals, ~41 controls): - [ ] **Card-present only** using imprint machines or standalone dial-out terminals - [ ] Terminals are **not connected to the internet** - [ ] No electronic cardholder data storage **SAQ B-IP** (IP-connected terminals, ~82 controls): - [ ] **Card-present only** using standalone PTS-approved terminals - [ ] Terminals connect via IP but are **isolated from other systems** on your network - [ ] No electronic cardholder data storage on any system - [ ] Terminal vendor has confirmed PTS device validation #### SAQ C-VT Checklist (virtual terminal, ~79 controls) {/* #saq-c-vt-checklist */} - [ ] **You process cards only via a virtual terminal** on a browser (web-based, processor-provided) - [ ] **One transaction at a time**, manually entered - [ ] Virtual terminal is provided by your PCI DSS validated processor - [ ] **No electronic cardholder data storage** - [ ] Computer used for virtual terminal is **isolated** and not used for other internet browsing **Common use case:** phone orders. An agent types card details into the processor's web portal. #### SAQ P2PE Checklist (P2PE terminals, ~33 controls) {/* #saq-p2pe-checklist */} - [ ] **Card-present only** using a **PCI SSC-validated P2PE solution** (check the [PCI SSC P2PE list](https://www.pcisecuritystandards.org/assessors_and_solutions/point_to_point_encryption_solutions)) - [ ] **All payment terminals** are managed per the P2PE Instruction Manual (PIM) from the solution provider - [ ] **No electronic cardholder data storage** in unencrypted form - [ ] Your P2PE solution provider is listed on the PCI SSC website :::tip[P2PE vs E2EE] Your terminal vendor says "encrypted." Check the [PCI SSC validated P2PE list](https://www.pcisecuritystandards.org/assessors_and_solutions/point_to_point_encryption_solutions). Not on it? That's E2EE, not P2PE. E2EE doesn't automatically reduce your SAQ scope. See [E2EE vs P2PE](/docs/payments/reference/e2ee-vs-p2pe) for the full comparison. ::: #### SAQ D (everything else, 300+ controls) {/* #saq-d-checklist */} You're SAQ D if any of these are true: - You **store cardholder data** electronically (even encrypted) - You use a **custom payment integration** where your servers handle raw card data - You **don't fit** any other SAQ category - Your acquirer **designates** you as SAQ D **SAQ D is the catch-all.** If you're here, your first job is getting out. [Tokenization](#1-tokenization) and [outsourcing](#4-outsourcing-payment-functions) are the routes to SAQ A. ### Quick Reference: SAQ Comparison | SAQ | Controls | ASV Scan? | Pen Test? | Best For | |-----|----------|-----------|-----------|----------| | **A** | ~22 | No | No | E-commerce with hosted/redirect checkout | | **A-EP** | ~140 | Yes | No | E-commerce with direct-post integration | | **B** | ~41 | No | No | Dial-out terminals (no internet) | | **B-IP** | ~82 | Yes | No | IP-connected standalone terminals | | **C-VT** | ~79 | Yes | No | Web-based virtual terminal only | | **C** | ~160 | Yes | No | Payment apps connected to internet | | **P2PE** | ~33 | No | No | PCI-validated P2PE terminals | | **D** | 300+ | Yes | Yes (L1/L2) | Everything else; try to leave this category | ## Who Must Comply PCI DSS applies to anyone who stores, processes or transmits cardholder data (CHD). Same for sensitive authentication data (SAD): - **Merchants** accepting payment cards. - **Service providers** processing, storing or transmitting CHD for merchants. - **Issuers** and **acquirers**. - Anyone who could affect the security of CHD, even without handling it. :::note[Outsourcing Doesn't Eliminate Responsibility] Outsource all your payment processing and some requirements still apply. You still verify your provider's compliance. You still manage the relationship. ::: ## The 12 PCI DSS Requirements PCI DSS sits under six goals. Each one holds specific requirements: ### Build and Maintain a Secure Network and Systems **Requirement 1: Install and Maintain Network Security Controls** - Implement firewalls and network security controls - Maintain configuration standards for all system components - Restrict traffic to and from the cardholder data environment (CDE) - Review firewall rules at least every six months **Requirement 2: Apply Secure Configurations to All System Components** - Change all vendor-supplied default passwords and settings - Remove or disable unnecessary accounts and services - Implement only one primary function per server - Document security configuration standards ### Protect Account Data **Requirement 3: Protect Stored Account Data** - Minimize data storage. Only store what's necessary. - **Never store sensitive authentication data (SAD) after authorization** - Mask PAN when displayed (show first 6 and/or last 4 only) - Render PAN unreadable wherever stored (encryption, hashing, tokenization, truncation) **Requirement 4: Protect Cardholder Data in Transit** - Use strong cryptography when transmitting CHD over open networks - **TLS 1.2 or higher** required - Never send PAN via email, SMS, or chat ### Maintain a Vulnerability Management Program **Requirement 5: Protect All Systems and Networks from Malicious Software** - Deploy anti-malware on all systems commonly affected - Keep anti-malware mechanisms current - Ensure anti-malware runs actively and can't be turned off **Requirement 6: Develop and Maintain Secure Systems and Software** - Identify and address vulnerabilities through a risk-based process - Apply risk-based patching (e.g., critical patches within one month) - Follow secure software development lifecycle (SDLC) - **PCI DSS 4.0 adds Req 6.4.3**: Manage all payment page scripts (JavaScript, etc.) ### Implement Strong Access Control Measures **Requirement 7: Restrict Access to System Components and CHD by Business Need-to-Know** - Implement minimum privileges - Default deny: access only granted when explicitly needed - Document access control policies **Requirement 8: Identify Users and Authenticate Access** - Assign unique IDs to all users - **MFA required for all access into the CDE** (expanded in 4.0) - **12-character passwords** (8 only if the system can't support 12) - Lock accounts after 10 failed attempts **Requirement 9: Restrict Physical Access to Cardholder Data** - Implement entry controls to sensitive areas - Protect media containing CHD - Control physical access to systems in the CDE ### Regularly Monitor and Test Networks **Requirement 10: Log and Monitor All Access to System Components and CHD** - Implement audit trails for all access - Synchronize clocks across systems - Review logs daily - Retain audit logs for at least 12 months, with 3 months immediately available **Requirement 11: Test Security of Systems and Networks Regularly** - Conduct quarterly wireless testing - Perform quarterly vulnerability scans by an Approved Scanning Vendor (ASV) - Conduct annual penetration testing - Deploy intrusion detection/prevention systems (IDS/IPS) - **PCI DSS 4.0 adds Req 11.6.1**: Detect unauthorized payment page changes ### Maintain an Information Security Policy **Requirement 12: Support Information Security with Organizational Policies and Programs** - Conduct annual risk assessments - Maintain acceptable use policies - Implement security awareness training - Screen personnel before hiring - Maintain an incident response plan ## Merchant Compliance Levels Card networks assign you a level by annual transaction volume, and each level validates differently. Under 20,000 e-commerce transactions a year puts you in Level 4, which covers most small merchants. The other three blocks are context, not homework. ### Level 1 **Criteria:** - More than 6 million transactions annually (Visa/Mastercard) - OR any merchant that's had a data breach - OR designated by a card network **Validation Requirements:** - Annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA) or Internal Security Assessor (ISA) - Quarterly network scans by an ASV - Annual penetration test - Attestation of Compliance (AOC) ### Level 2 **Criteria:** - 1-6 million transactions annually **Validation Requirements:** - Annual Self-Assessment Questionnaire (SAQ) - May need QSA assessment for SAQ A, A-EP, or D (Mastercard requirement) - Quarterly ASV scans - AOC ### Level 3 **Criteria:** - 20,000-1 million e-commerce transactions annually **Validation Requirements:** - Annual SAQ - Quarterly ASV scans (if applicable) - AOC ### Level 4 **Criteria:** - Fewer than 20,000 e-commerce transactions annually - OR up to 1 million total transactions annually **Validation Requirements:** - SAQ recommended, though it isn't always enforced - Quarterly ASV scans (if applicable) - Mastercard often doesn't require direct validation :::warning[Network-Specific Rules] Mastercard runs Site Data Protection (SDP) and Visa runs Account Information Security (AIS), and both carry their own requirements. Your acquiring bank can add more on top, whatever your level. Verify with your acquirer. ::: ## Service Provider Compliance Levels ### Level 1 **Criteria:** - More than 300,000 transactions annually - OR designated by a card network **Validation Requirements:** - Annual ROC by QSA - Quarterly ASV scans - Annual penetration test - AOC ### Level 2 **Criteria:** - Fewer than 300,000 transactions annually **Validation Requirements:** - Annual SAQ D (Service Provider version) - Quarterly ASV scans - AOC ### Designated Entities Supplemental Validation (DESV) Large or high-risk service providers may have to complete DESV. That's a set of controls beyond standard PCI DSS. It includes: - More frequent penetration testing - Enhanced logging and monitoring - Additional governance requirements ## Self-Assessment Questionnaires (SAQs) An SAQ is how you validate your own compliance. Which one you use depends on how you're handling cardholder data. | SAQ | Description | Approx. Controls | Typical Use Case | |-----|-------------|------------------|------------------| | **A** | Card-not-present, all CHD outsourced | ~22 | Hosted payment pages, MOTO outsourced | | **A-EP** | E-commerce affecting payment page | ~140 | Iframes, JS affecting checkout | | **B** | Imprint-only or dial-out terminals | ~41 | Small retail dial-out | | **B-IP** | Standalone IP-connected PTS | ~82 | IP terminals, no CHD storage | | **C-VT** | Virtual terminal only | ~79 | Call centers, browser-based | | **C** | Payment apps connected to internet | ~160 | Small merchant POS | | **D** | All other / complex environments | 300+ | CHD storage, doesn't fit above | | **P2PE** | Validated P2PE terminals | ~33 | PCI-validated P2PE solution | *Note: Exact question counts change by version; these are ballpark figures.* ### Choosing Your SAQ Use this decision tree: 1. **Do you store cardholder data?** โ†’ SAQ D 2. **Is all processing outsourced?** โ†’ SAQ A or A-EP 3. **Do you use validated P2PE?** โ†’ SAQ P2PE 4. **Do you have IP-connected terminals?** โ†’ SAQ B-IP or C **Goal:** get to SAQ A instead of SAQ D. Redirect or hosted payment pages plus tokenization is the route. It cuts your compliance burden hard. :::tip[SAQ A Eligibility (v4.0 Updates)] For SAQ A under 4.0, an iframe needs one of two things: - You comply with Req 6.4.3 and 11.6.1 for payment page script management. - Or your processor confirms they manage both. Redirects are easier. The customer leaves your site entirely. The payment page isn't yours. ::: ## Scope Reduction Strategies The best PCI move is shrinking your scope, because fewer systems and processes fall under the requirements. For an online SMB only two of these four matter: tokenization and a hosted payment page. P2PE counts only if you take cards in person. Segmentation is a project for companies that already store card data, which you shouldn't be. ### 1. Tokenization **What it does:** swaps cardholder data for a token. The token has no exploitable value. **Benefits:** - Tokens aren't cardholder data, so they're out of scope. - Stored PAN leaves your environment. - Card-on-file works without storing actual cards. - SAQ D can become SAQ A. **Implementation:** - Use your processor's tokenization service. - Make sure tokens are non-reversible. - The token vault is your provider's job. --- #### Deep Dive: How Tokenization Works Tokenization is your most powerful scope reduction tool. Understand it and you'll implement it right. ##### Token Types | Token Type | Description | Use Case | |------------|-------------|----------| | **Payment token** | Replaces PAN for processing | Card-on-file, subscriptions | | **Network token** | Issued by card networks | Enhanced auth rates, lifecycle updates | | **Merchant token** | Processor-specific | Single processor environments | | **Multi-use token** | Same token across transactions | Repeat customers | | **Single-use token** | One transaction only | One-time payments, checkout | ##### Network Tokenization Benefits Network tokens do more than reduce PCI scope. Visa Token Service and Mastercard Digital Enablement Service both issue them: | Benefit | Why It Matters | |---------|----------------| | **Card lifecycle updates** | Automatic reissue when card expires | | **Higher auth rates** | Issuers trust tokenized transactions | | **Domain-specific** | Token only works for your merchant | | **Reduced false declines** | Better fraud signal for issuers | ##### Tokenization Implementation Checklist | Step | What to Do | |------|------------| | **1. Select token provider** | Processor's native tokenization or third-party | | **2. Determine token type** | Network tokens preferred if supported | | **3. Implement token creation** | At card capture point (checkout, add card) | | **4. Store tokens, not PANs** | Update database schema | | **5. Display handling** | Show last 4 for customer reference | | **6. Migration plan** | Convert existing stored cards to tokens | ##### Token Security Considerations | Do | Don't | |----|-------| | Store tokens in your database | Store PANs alongside tokens "just in case" | | Use processor's token vault | Build your own reversible tokenization | | Implement token rotation for high-value accounts | Use tokens that are mathematically reversible to PANs | | Log token usage | Log actual card numbers | ##### Token Format Examples ``` Original PAN: 4111 1111 1111 1111 Processor token: tok_1234567890abcdef Network token: 4000 0012 3456 7899 (looks like a card but isn't) Display format: โ€ขโ€ขโ€ขโ€ข โ€ขโ€ขโ€ขโ€ข โ€ขโ€ขโ€ขโ€ข 1111 ``` **Note:** network tokens look like card numbers on purpose. That's how they work with existing payment infrastructure. They're domain-restricted and useless outside your integration. --- ### 2. Point-to-Point Encryption (P2PE) **What it does:** encrypts card data at the terminal. It stays encrypted all the way to the decryption environment. **Benefits:** - Qualifies for SAQ P2PE (~33 controls). - Encrypted data is out of scope. - Your CDE shrinks a lot. **P2PE vs E2EE:** - **P2PE**: a PCI SSC-validated solution. Scope reduction is immediate. - **E2EE**: encryption at rest and in transit. Scope reduction needs acquirer approval. ### 3. Network Segmentation **What it does:** isolates the cardholder data environment from the rest of your network. **Benefits:** - Fewer in-scope systems. - Smaller attack surface. - Faster assessments. - Lower compliance costs. **Implementation:** - Use firewalls, VLANs, or physical separation. - Implement role-based access control. - Run segmentation testing (Req 11.4.5). - Document CDE boundaries clearly. ### 4. Outsourcing Payment Functions **Approaches:** - Hosted payment pages that redirect to the processor. - Secure iframes the processor controls. - Gateway API with tokenization, so you never touch raw card data. - Managed payment services. **Important:** outsourcing doesn't finish the job. - Verify your provider's AOC. - Include them in your service provider management program. - Know your residual responsibilities. ## Network-Specific Requirements ### Visa Requirements - **Account Information Security (AIS)**: the primary compliance program. - **Compromise Investigation**: you engage a PCI Forensic Investigator (PFI) after a suspected breach. - **Fraud Monitoring**: report fraud through the required channels. - **Terminated Merchant File (TMF)**: your acquirer's own file of terminated merchants. Visa's shared screening database is VMSS. Mastercard's is MATCH. All three get called "TMF" in conversation. ### Mastercard Requirements - **Site Data Protection (SDP)**: the primary compliance program. - **Level 1/2 service providers** may need DESV. - **Validation documents** go to your acquiring bank. - **Information Security Program**: required under Mastercard Rules Section 2.2.7. - **Third Party Processor (TPP)** registration requirements. ## Cardholder Data Defined Scoping starts with knowing what counts as cardholder data. ### Cardholder Data (CHD) | Element | Description | Notes | |---------|-------------|-------| | **PAN** | Primary Account Number (15-19 digits) | The defining element: if PAN is present, it's CHD | | **Cardholder Name** | Name on card | Only CHD when stored with PAN | | **Expiration Date** | Card validity period | Only CHD when stored with PAN | | **Service Code** | 3-digit code on magnetic stripe | Only CHD when stored with PAN | **Note on truncation:** a truncated PAN (first 6 + last 4) is still CHD. But permanently delete the middle digits and the full PAN is gone. ### Sensitive Authentication Data (SAD) **NEVER store SAD after authorization, even encrypted:** | Element | Description | |---------|-------------| | **Full track data** | Track 1 and Track 2 from magnetic stripe | | **CVV/CVC/CVV2/CID** | Card verification codes | | **PIN/PIN block** | Personal identification numbers | ### Data Rendering Methods When you can't avoid storing PAN, render it unreadable using: | Method | Description | |--------|-------------| | **Truncation** | Permanently remove middle digits (keep first 6 and/or last 4) | | **Tokenization** | Replace with non-reversible token | | **Strong hashing** | One-way cryptographic hash with salt | | **Encryption** | Strong encryption with proper key management (AES-256) | Of the four, only tokenization takes the data out of scope. The other three still leave cardholder data in your environment, and storing it electronically keeps you in SAQ D however well it's encrypted. ## Compliance Validation and Assessment ### Quarterly ASV Scans - External vulnerability scans run by an Approved Scanning Vendor. - Required for any internet-facing systems. - They have to pass, with no high or critical vulnerabilities. - Submit the passing scan reports with your SAQ or ROC. ### Annual Penetration Testing - Required for Level 1 and Level 2 merchants. - Test both internal and external networks. - Validate that network segmentation actually works. - PCI DSS 4.0 requires a defined methodology. ### Attestation of Compliance (AOC) - A formal attestation of your PCI DSS compliance status. - Signed by a QSA (for a ROC) or a merchant officer (for an SAQ). - It goes to your acquirer. - Business partners often ask for it too. ## PCI Compliance Tools and Vendors {/* #pci-tools-and-vendors */} You don't need to figure out PCI compliance alone. These are the categories that help, sorted by what you need. ### Approved Scanning Vendors (ASVs) {/* #approved-scanning-vendors */} ASVs run the **quarterly external vulnerability scans**. SAQ A-EP, B-IP, C-VT, C and D all require them. They scan your internet-facing systems and certify whether you pass. :::tip[Do You Need an ASV?] Check the [SAQ comparison table](#saq-checklists), and if it shows "ASV Scan: Yes" you need one. **SAQ A and SAQ P2PE don't require ASV scans**, so most small merchants can skip this line item entirely. ::: | ASV | Best For | Approx. Cost | Notes | |-----|----------|-------------|-------| | **SecurityMetrics** | SMBs, easy setup | $100-300/year | Popular with small merchants; includes SAQ wizard | | **Qualys** | Mid-market to enterprise | $500-2,000+/year | Comprehensive vulnerability management platform | | **Trustwave (Viking Cloud)** | Mid-market | $300-1,000/year | Also offers managed security services | | **Rapid7 InsightVM** | Enterprise, DevOps teams | $1,000+/year | Integrates with CI/CD pipelines | | **Tenable Nessus** | Enterprise, large networks | $1,000+/year | Deep vulnerability scanning beyond PCI | | **Intrust IT / ControlScan** | SMBs | $200-500/year | White-labeled by many processors | **How it works:** 1. Sign up with an ASV 2. Provide your external IP addresses and domains 3. ASV runs automated scans quarterly 4. Fix any high/critical vulnerabilities found 5. Get a passing scan report to submit with your SAQ If you do need scans, SecurityMetrics ($100-300/year) and ControlScan ($200-500) are the two priced for small merchants. Everything else in that table is built for enterprise networks you don't have. :::note[Your Processor May Provide This] Stripe, Square and Adyen include basic PCI tools in the merchant portal. Check there before you buy anything. Some acquirers bundle ASV scanning into merchant services too. ::: ### Qualified Security Assessors (QSAs) {/* #qualified-security-assessors */} The PCI SSC certifies QSAs to run on-site assessments. You need one if: - You're a **Level 1 merchant** (6M+ transactions/year). It's required for your annual ROC. - You're a **Level 1 service provider** (300K+ transactions/year). - Your acquirer **requires** a QSA assessment whatever your level. - You want an **expert review** of your posture. Optional for smaller merchants. | QSA Firm | Focus | Notes | |----------|-------|-------| | **Coalfire** | Enterprise, cloud-heavy environments | Strong in AWS/Azure PCI assessments | | **Trustwave** | Full-service, mid-market to enterprise | ASV + QSA + managed security under one roof | | **SecurityMetrics** | SMB to mid-market | Also offers ASV scans and compliance platforms | | **A-LIGN** | Mid-market, SOC 2 + PCI combos | Good if you need multiple compliance frameworks | | **Schellman** | Enterprise, complex environments | Known for thoroughness | | **Foregenix** | E-commerce and payments focused | PCI forensic investigator (PFI) as well | **Typical QSA engagement costs:** - Level 1 ROC assessment: $30,000-$100,000+ depending on scope. - Level 2 SAQ validation: $5,000-$20,000. - Gap analysis at any level: $5,000-$15,000. The [PCI SSC QSA directory](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors) lists all qualified firms. If you're Level 4 on hosted checkout, skip this section. Below Level 1 a QSA is optional unless your acquirer asks for one. The cheapest engagement above starts at $5,000 to be told what the SAQ A checklist already told you for free. ### PCI Compliance Platforms {/* #pci-compliance-platforms */} These platforms walk you through the SAQ. They track your compliance status. Most bundle ASV scanning. | Platform | Best For | What It Does | Approx. Cost | |----------|----------|-------------|-------------| | **SecurityMetrics** | SMBs | SAQ wizard + ASV scans + training | $100-500/year | | **Viking Cloud (Trustwave)** | SMBs to mid-market | Guided SAQ + ASV + policy templates | $200-800/year | | **Sprinto** | Startups, multi-framework | PCI + SOC 2 + ISO 27001 automation | $5,000+/year | | **Vanta** | Startups, multi-framework | Continuous compliance monitoring, PCI + SOC 2 | $5,000+/year | | **Drata** | Mid-market, multi-framework | Automated evidence collection, PCI + SOC 2 | $5,000+/year | | **PCI Pal** | Call centers | Descopes phone payments from PCI (DTMF masking) | Custom pricing | **For most SMBs:** SecurityMetrics or Viking Cloud is enough. They take the SAQ step by step, run your quarterly scans if you need them, and hand you the documentation your acquirer wants. **For startups needing multiple certifications:** Sprinto, Vanta or Drata put PCI, SOC 2 and ISO 27001 on one platform. Only worth it if you need more than PCI. ### Payment Page Security Tools (Req 6.4.3 / 11.6.1) {/* #payment-page-security-tools */} Req 6.4.3 makes you **manage and monitor every payment page script**, and Req 11.6.1 makes you **detect unauthorized changes** to payment page content. Both are in PCI DSS 4.0, and both target Magecart attacks, where an attacker injects JavaScript to skim card data. **Who needs this:** anyone with an e-commerce payment page, SAQ A-EP especially. SAQ A merchants on an iframe have to confirm who handles it, them or their processor. On a full redirect, it's mostly not your purchase. | Tool | What It Does | Best For | Notes | |------|-------------|----------|-------| | **Jscramble** | Client-side JavaScript protection, script inventory, tamper detection | Mid-market to enterprise | Purpose-built for PCI 4.0 6.4.3/11.6.1 | | **Source Defense** | Real-time payment page monitoring, script sandboxing | E-commerce merchants | Monitors third-party scripts on checkout pages | | **Cloudflare Page Shield** | Script monitoring, Magecart detection | Cloudflare customers | Included in Business/Enterprise plans; easy if you're already on Cloudflare | | **Akamai Page Integrity Manager** | Client-side detection and mitigation | Enterprise, Akamai customers | Part of Akamai's security suite | | **Imperva Client-Side Protection** | Script visibility, behavior analysis | Enterprise | Part of Imperva's WAF platform | | **Human Security** | Bot and client-side protection | Enterprise | Broader than just PCI; covers bot defense too | :::tip[The Simplest Path for SAQ A Merchants] On a **full redirect**, 6.4.3 and 11.6.1 are mostly your processor's problem. The payment page sits on their domain. Stripe Checkout and PayPal Standard both work this way. On an **iframe**, ask your processor for written confirmation that they handle 6.4.3/11.6.1 for it. Stripe Elements and Adyen Drop-in are iframes, and most major processors will confirm. If they won't, you're either buying one of the tools above or writing a Content Security Policy for your checkout page. At that point, take the redirect. ::: ### What Your Processor Already Gives You {/* #processor-pci-tools */} Check what your processor already gives you first: | Processor | Built-in PCI Help | Details | |-----------|------------------|---------| | **Stripe** | SAQ A auto-qualification, hosted checkout, PCI compliance dashboard | Stripe handles PCI for you if you use Checkout or Elements. They provide a pre-filled SAQ A in your dashboard. | | **Square** | Fully PCI compliant, no SAQ needed for most merchants | Square handles all PCI compliance for merchants using their hardware and software. | | **Shopify Payments** | PCI Level 1 certified, merchants covered | Shopify stores are PCI compliant by default. No separate SAQ needed. | | **Adyen** | PCI Level 1, Drop-in components | Provides compliance documentation and handles SAQ A eligibility through Drop-in/Components. | | **PayPal** | PCI Level 1, hosted checkout | Standard Checkout redirects mean SAQ A eligibility. PayPal provides compliance documentation. | | **Braintree** | PCI compliance included with hosted fields | Part of PayPal. Hosted Fields keep you at SAQ A. Provides compliance resources. | | **Worldpay (FIS)** | PCI portal, often bundles ASV scanning | Check your merchant portal - many Worldpay merchants get basic PCI tools included. | :::warning[Don't Double-Pay] If you're on Stripe, Square or Shopify and you never handle card data yourself, you probably don't need a separate ASV, compliance platform or QSA. Check your processor's PCI documentation before you buy anything, because plenty of merchants pay for tools they don't need. ::: **Key Fact:** the "$5,000 to $100,000 per month" PCI fine has no published source, and PCI SSC doesn't levy fines at all. What's real is breach liability, and you carry the full cost: an SMB breach runs $120,000-$1.24M all in once you count forensics, notification, legal and card replacement. Spend on scope, not on tools. The cheapest path is SAQ A via hosted checkout. ## Consequences of Non-Compliance | Consequence | Details | |-------------|---------| | **Monthly assessments** | Real, but not published by anyone. The network assesses your acquirer; your acquirer passes it through under your merchant agreement. Ask your acquirer what their pass-through actually is, because that number is in your contract and the internet's number isn't. | | **Increased transaction fees** | Higher interchange and assessment fees | | **Liability shift** | Merchant bears full liability for breach costs | | **MATCH listing** | Added to Mastercard terminated merchant file | | **Loss of card acceptance** | Processing privileges revoked | | **Brand damage** | Breach notification requirements, reputational harm | ## Common Compliance Pitfalls Most of these only bite merchants who store card data themselves. On a hosted page, scope is still the one to watch: a new sales channel or a third-party integration can pull you back in. ### Underestimating Scope - Payment applications often store data in unexpected places (logs, temp files, databases) - Systems connected to the CDE are in scope - Third-party integrations may pull CHD into scope - Cloud environments have shared responsibility models ### Scope Creep Over Time - New sales channels added without security review - New devices connected to payment network - Test environments using production data - Acquired companies with different security postures ### Documentation Gaps - Outdated network diagrams - Missing or incomplete policies - Incomplete service provider inventory - No business justification for enabled protocols/ports ### Key Management Weaknesses - Using weak or default encryption keys - No key rotation schedule - Storing keys with encrypted data - No split knowledge or dual control for key operations ### Misunderstanding Compensating Controls - Compensating controls only apply when you can't meet the original requirement - Thin documentation of why the original requirement isn't achievable - Not demonstrating equivalent protection - Failing to re-evaluate annually ## PCI DSS 4.0 Key Changes ### Customized Approach - Design your own controls to meet requirement objectives - Document and test effectiveness - Requires QSA validation - More flexibility but more documentation burden ### Targeted Risk Analysis - For certain requirements, determine frequency via targeted risk analysis (TRA) instead of fixed schedules - Can apply to some log reviews, vulnerability scanning, and other periodic activities where 4.0 explicitly allows - Must document methodology and defend conclusions ### Enhanced Authentication - **MFA required for all CDE access** (not just remote access) - **12-character passwords** (8 characters only if the system can't support 12) - Service account password/key protection requirements ### Payment Page Security (Future-Dated to March 2025) **Requirement 6.4.3:** Authorize, document, and monitor all scripts (JavaScript, etc.) on payment pages **Requirement 11.6.1:** Implement mechanisms to detect unauthorized changes to payment page content Both address Magecart attacks. An attacker injects a script into your payment page and steals card data. ## Getting Started with Compliance 1. **Understand your data flows** - Map where CHD enters, moves through, and exits your environment 2. **Determine your merchant level** - Based on annual transaction volume 3. **Identify scope reduction opportunities** - Tokenization, P2PE, outsourcing 4. **Select appropriate SAQ** - After implementing scope reduction 5. **Implement required controls** - Gap analysis against applicable requirements 6. **Engage qualified assessors** - QSA for Level 1, or self-assessment 7. **Establish ongoing processes** - Quarterly scans, annual assessments, continuous monitoring Steps 1 through 4 are where the money is. Get them right and you land on SAQ A, where step 7 is one questionnaire a year and no quarterly scans. ## Next Steps **Just learning about PCI?** 1. Map your cardholder data environment โ†’ Where does card data flow? 2. Determine your merchant level โ†’ Based on annual transaction volume 3. Identify scope reduction opportunities โ†’ Tokenization eliminates most PCI burden **Ready to reduce scope?** 1. Evaluate tokenization providers โ†’ Let them handle card data, not you 2. Consider hosted payment pages โ†’ Remove your systems from scope entirely 3. Ask your processor about P2PE terminals โ†’ Reduce in-store PCI requirements **Preparing for assessment?** 1. Gap analysis against your SAQ type โ†’ Know what's required 2. Engage a [QSA](#qualified-security-assessors) early (Level 1) โ†’ Don't wait until assessment time 3. Establish quarterly [ASV scanning](#approved-scanning-vendors) โ†’ See the vendor comparison above 4. Check [what your processor includes](#processor-pci-tools) โ†’ Don't buy tools you already have --- ## See Also - [Payment Tokenization](/docs/payments/reference/tokenization) - Reducing PCI scope with tokens - [Fraud Detection Fundamentals](/docs/fraud/detection) - Detection approaches - [AVS and CVV](/docs/fraud/prevention/avs-cvv) - Verification signals - [3D Secure](/docs/fraud/prevention/3ds) - Authentication for payments - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes - [Authorization Decisioning](/docs/fraud/detection/authorization-decisioning) - How issuers decide - [Payments Overview](/docs/payments) - How money moves - [Processor Management](/docs/operations/processor-management) - Working with processors - [Network Programs](/docs/chargebacks/reference/network-programs) - Compliance thresholds - [AML Basics](/docs/compliance/aml-basics) - Anti-money laundering - [Consumer Protection](/docs/compliance/consumer-protection) - Reg E and Reg Z - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Session security {JSON.stringify({"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Do I need to be PCI compliant?","acceptedAnswer":{"@type":"Answer","text":"Yes, if you accept credit cards. Most small merchants qualify for SAQ A (22 controls) by using hosted payment pages like Stripe Checkout, Square, or PayPal. If you never see raw card numbers, your PCI burden is minimal."}},{"@type":"Question","name":"Which PCI SAQ do I need?","acceptedAnswer":{"@type":"Answer","text":"Most Level 4 merchants (under 1 million Visa transactions per year) using hosted checkout qualify for SAQ A, which has just 22 controls. If you store card data on your own servers, you need SAQ D with 300+ controls."}},{"@type":"Question","name":"What happens if I'm not PCI compliant?","acceptedAnswer":{"@type":"Answer","text":"The commonly quoted figure of $5,000 to $100,000 per month has no published source. PCI SSC does not levy fines, and neither Visa nor Mastercard publishes a fine schedule. Card networks assess the acquiring bank, which may pass costs through to you under your merchant agreement. What is well established: you are liable for the costs of a data breach, including card replacement, forensic investigation and notification, and your processor may raise your rates or terminate your account."}}]})} --- ## PSD2 and SCA for US Merchants Source: https://paymentsandrisk.com/docs/compliance/psd2-sca # PSD2 and SCA for US Merchants :::info[TL;DR] - **SCA (Strong Customer Authentication) applies to you** if you sell to European cardholders, wherever your business is registered. You need 3D Secure for most EU card-not-present transactions - **The liability shift is the payoff**: 3DS-authenticated transactions move fraud dispute liability to the card issuer - **You can ask for exemptions**: low-value (under โ‚ฌ30), low-risk TRA-eligible, and recurring subscriptions after the first payment - **No regulator fines you.** Issuers just decline the SCA-required transactions that weren't authenticated ::: You sell to European customers and your business is registered in the US. SCA still applies to you. PSD2 (Payment Services Directive 2) is the European law. SCA (Strong Customer Authentication) is the authentication rule inside it. Not having a European entity doesn't get you out of it. The short version: **You need 3D Secure for most European card-not-present transactions.** ## Does This Apply to You? **SCA applies if:** - You're selling to customers with European cards - Transactions are card-not-present (online, phone, recurring) - Customer's issuer is in the European Economic Area (EEA: EU + Iceland, Liechtenstein, Norway) **SCA doesn't apply if:** - Customer's card is issued outside EEA (even if they're physically in Europe) - Transaction is card-present (chip + PIN satisfies SCA) - You're selling from Europe to US customers (US cards, no SCA) **The trigger is the customer's issuing bank location, not the customer's physical location.** --- ## What is SCA? **Strong Customer Authentication** requires two of three factors: | Factor | Examples | |--------|----------| | **Knowledge** | Password, PIN, security question | | **Possession** | Phone, card, hardware token | | **Inherence** | Fingerprint, face recognition, voice | **For card payments**: 3D Secure (3DS) is the standard SCA implementation. **3DS provides**: - Knowledge: Password or biometric through banking app - Possession: Phone with banking app - = Two factors = SCA compliant --- ## How SCA Works for US Merchants ### Without 3DS (Non-Compliant) ```mermaid flowchart LR A[Customer enters card] --> B[You submit auth] B --> C[Issuer declinesSCA required] C --> D[Transaction fails] style C fill:#ef4444,color:#fff style D fill:#ef4444,color:#fff ``` **Result**: European issuers decline non-3DS transactions. Your conversion rate in Europe falls off a cliff. ### With 3DS (Compliant) ```mermaid flowchart LR A[Customer enters card] --> B[3DS challengetriggered] B --> C[Customer authenticatesin banking app] C --> D{Auth success?} D -->|Yes| E[Transaction approved+ Liability shift] D -->|No| F[Transaction fails] style E fill:#22c55e,color:#fff ``` **Result**: The transaction gets approved, you've got the liability shift, and the customer had to authenticate. --- ## When SCA Is Required | Transaction Type | SCA Required? | Notes | |------------------|---------------|-------| | **Initial card-not-present** | Yes | Unless exemption applies | | **Recurring (after first)** | No | First payment must be SCA-authenticated | | **Card-present (chip + PIN)** | No | Chip + PIN satisfies SCA | | **Contactless under โ‚ฌ50** | No | Low-value exemption | | **Merchant-initiated (MIT)** | No | Customer not present | Only the **first transaction** in a subscription needs SCA. Every recurring charge after that one is exempt. --- ## SCA Exemptions European regulations let you skip SCA in a few specific cases: | Exemption | Criteria | Merchant Burden | |-----------|----------|-----------------| | **Low-value** | Under โ‚ฌ30 | Not cumulative over โ‚ฌ100 or 5 transactions | | **Recurring payments** | After SCA-authenticated first payment | Must use MIT flag | | **TRA (Transaction Risk Analysis)** | Low-risk transactions, low fraud rate | Fraud rate thresholds: under 0.13% (up to 100 EUR), under 0.06% (up to 250 EUR), under 0.01% (up to 500 EUR) | | **Trusted beneficiaries** | Customer whitelists merchant | Customer must add you in banking app | | **Corporate payments** | B2B corporate cards | Depends on issuer | | **Secure corporate process** | Dedicated payment processes | Rare | **See**: [3DS Exemptions](/docs/fraud/prevention/3ds/exemptions) for full details. --- ## How to Comply (Implementation) ### Step 1: Enable 3DS **If you're on Stripe or Shopify Payments:** 1. 3DS is already enabled by default for European cards 2. Stripe automatically triggers 3DS when required 3. No action needed (it just works) **If you're on Square:** - Square doesn't support 3DS - You can't sell card-not-present to Europe compliantly on Square - Use Stripe for European sales or migrate **If you're on a traditional processor:** - Contact your processor to enable 3DS - Integration required (varies by processor) - Budget 20-80 hours for integration ### Step 2: Handle Redirects 3DS requires redirecting customers to their bank: 1. Customer enters card on your checkout 2. Redirect to issuer's authentication page 3. Customer authenticates (password, biometric, etc.) 4. Redirect back to your site 5. Complete transaction **On mobile**: use an in-app browser, not an external one. It's a cleaner handoff. ### Step 3: Request Exemptions When Possible For low-risk transactions, request TRA exemption: - Reduces friction (no challenge) - Still SCA-compliant - Only works if your fraud rate is low **Stripe handles this automatically** if you qualify. ### Step 4: Flag Recurring Properly For subscriptions: - First payment: Full 3DS authentication - Subsequent: Use MIT (Merchant Initiated Transaction) flag - No 3DS needed for recurring **Stripe and most processors handle this automatically.** --- ## What Happens If You Don't Comply ### Immediate Impact **European issuers decline non-SCA transactions**: - Your auth rate drops 30-80% for European customers - Conversions tank - Revenue from Europe evaporates **This isn't a fine or penalty. Transactions just fail.** ### No Direct Penalties for Non-EU Merchants If you're a US merchant: - European regulators don't fine you directly - Your processor faces potential fines (they'll pass to you) - Main impact: transactions decline = lost sales **The market enforces this one, not a regulator.** You can't sell anything if the issuer declines it. --- ## PSD2 Beyond SCA PSD2 covers a lot more ground than just SCA: | PSD2 Component | What It Is | US Merchant Impact | |----------------|------------|-------------------| | **SCA** | Authentication requirement | Must implement 3DS | | **Open Banking** | API access to bank data | Enables pay-by-bank methods | | **Payment initiation** | Third-party payment initiation | Enables SEPA alternatives | | **Refund rights** | 14-day cooling-off period | Applies to EU consumer sales | | **Surcharging ban** | Can't surcharge most EU cards | Check by country | **For most US SMBs**: SCA is the only part that changes anything. --- ## US Merchant Compliance Checklist ``` โ–ก Enable 3DS in your processor (Stripe auto-enables for EU) โ–ก Test European card transactions (use Stripe test cards) โ–ก Implement redirect flow for 3DS challenges โ–ก Flag recurring payments as MIT after first payment โ–ก Request TRA exemptions for low-risk transactions (if available) โ–ก Monitor European auth rates (should be 85-95% with 3DS) โ–ก Check if surcharging is allowed in target EU countries โ–ก Understand 14-day refund rights for EU consumers ``` --- ## Test to Run **EU compliance audit (3 weeks):** **Week 1: Geography check** 1. Calculate % of revenue from EU customers: ____% 2. Pull auth rates for EU transactions 3. Check if 3DS is enabled (look for "3DS" in transaction logs) **Week 2: Auth rate analysis** 4. EU auth rate with 3DS: Should be 85-95% 5. If under 80%, investigate why (likely SCA declines) 6. Check frictionless rate (% that don't see challenge) **Week 3: Exemption optimization** 7. Check if TRA exemptions are being used 8. Monitor low-value exemptions (under โ‚ฌ30) 9. Ensure recurring payments are MIT-flagged **Success criteria**: EU auth rate over 85%, frictionless rate over 60%, no SCA decline codes. --- ## Scale Callout **Under $50K/month, under 5% EU:** - Don't worry about SCA yet - Enable 3DS when EU becomes 10%+ - Focus on US market **$50K-$250K/month, 10-20% EU:** - Ensure 3DS is enabled (should be automatic on Stripe) - Monitor EU auth rates - Request TRA exemptions if fraud rate is low **$250K-$1M/month, 20%+ EU:** - Optimize frictionless rate (send more data for TRA) - Use low-value exemptions strategically - Consider local EU entity for better rates **Over $1M/month, 30%+ EU:** - Consider Adyen for local EU acquiring - Full exemption optimization - Monitor SCA compliance by country --- ## Where This Breaks 1. **UK left EU but kept SCA**: Brexit happened, but UK still requires SCA. Don't assume UK = different rules. 2. **Not all EU countries enforce equally**: Some countries have soft enforcement. Plan for strict compliance anyway, because it's the safer bet. 3. **Card-present in EU still needs chip + PIN**: US merchants with EU retail locations need PIN-enabled terminals, not signature. 4. **Recurring payment exemption can be revoked**: If fraud rate climbs, issuers can require SCA on subsequent recurring charges. It doesn't happen often, but it can happen. 5. **TRA exemptions require low fraud**: If your fraud rate exceeds 0.13%, you won't qualify for any TRA exemption. Higher transaction values require even lower rates (0.06% for up to 250 EUR, 0.01% for up to 500 EUR). --- ## Common US Merchant Questions ### "Do I need a European entity?" **No.** SCA applies to the transaction, not your business location. - US entity selling to EU customers: SCA required - EU entity selling to US customers: SCA not required ### "What if I only sell B2B?" **Maybe exempt.** Corporate cards can be exempt from SCA, but: - Depends on card type (not all corporate cards are exempt) - Issuer decides - Safer to implement 3DS anyway ### "Can I just block European customers?" **Yes, but**: - You're walking away from 20-30% of global e-commerce market - Implementing 3DS is easier than you think (automatic on Stripe) - Why exclude customers when compliance is simple? ### "Does this apply to PayPal?" **No.** PayPal authenticates customers themselves: - Customers log into PayPal (knowledge + possession) - PayPal handles SCA compliance - You don't need to do anything **If customer pays with card through PayPal**: PayPal handles 3DS. --- ## Next Steps **Selling to Europe?** 1. Read [3D Secure guide](/docs/fraud/prevention/3ds/) for implementation 2. Enable 3DS in Stripe dashboard (or verify it's enabled) 3. Test with European test cards **Optimizing EU compliance?** 1. Review [3DS Exemptions](/docs/fraud/prevention/3ds/exemptions) for TRA/low-value 2. Monitor frictionless authentication rates 3. Send more data for better TRA qualification **Want to avoid SCA entirely?** 1. Use [regional payment methods](/docs/payments/payment-methods/regional/europe) - iDEAL, Bancontact 2. Local payment methods often have better conversion than 3DS-challenged cards 3. Consider [PayPal](/docs/payments/processors/paypal) for EU (they handle SCA) --- ## See Also - [3D Secure](/docs/fraud/prevention/3ds/) - Full 3DS implementation guide - [3DS Exemptions](/docs/fraud/prevention/3ds/exemptions) - TRA, low-value, recurring - [European Payment Methods](/docs/payments/payment-methods/regional/europe) - iDEAL, Bancontact, SEPA - [Going Global](/docs/payments/going-global) - International expansion strategy - [Stripe](/docs/payments/processors/stripe) - Auto-handles SCA compliance - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing with 3DS - [Consumer Protection](/docs/compliance/consumer-protection) - EU consumer rights --- ## Failed Payment Collection Source: https://paymentsandrisk.com/docs/compliance/subscriptions/failed-payment-collection # Failed Payment Collection :::info[TL;DR] - Dunning (payment retries) isn't collections (pursuing unpaid debt). Most subscription businesses only need dunning, and crossing into collections triggers FDCPA compliance - The FDCPA applies when you use a third-party collections agency. It doesn't apply when you're collecting your own first-party debt, but state laws may still impose limits - Standard dunning should stop after 3-5 attempts over 2-3 weeks. Past that you're damaging the bank relationship and you're raising R05 (unauthorized) return risk - Write-off policy matters: anything uncollected after 60-90 days goes to bad debt. Leave it in collections limbo and you're distorting your own MRR ::: Dunning is payment retry logic. Collections is what happens when dunning fails. Most subscription businesses know how to retry a payment. Fewer know when to stop, which rules kick in, and when the debt just isn't worth chasing. This page covers the line between normal dunning and actual debt collection. ## Why This Matters for Subscription SMBs **The scenario:** 1. Customer signs up for your $50/month SaaS subscription 2. Month 3: Their card declines (insufficient funds) 3. You retry 3 times over 2 weeks (normal dunning) 4. All retries fail 5. Customer stops responding to emails 6. You suspend their account **Now what?** - Do you keep trying to collect the $50? - Can you call them repeatedly? - Can you email them every day? - When do you give up and write it off? - What if you accidentally violate debt collection laws? **Here's what to do at each of those points.** --- ## What "Debt Collection" Actually Means Here **For subscription SMBs, "debt collection" is**: **NOT**: Hiring aggressive collectors to chase people down **NOT**: Reporting to credit bureaus **NOT**: Suing customers for small amounts **YES**: Understanding when your normal payment retry crosses into legal "debt collection" territory **YES**: Knowing when the cost to recover $50 exceeds the $50 itself **YES**: Protecting yourself from accidentally harassing customers **The practical question**: "Our dunning failed. Do we keep trying or write it off?" --- ## TL;DR for Busy SMBs **The answer for most subscription businesses:** **Debts under $100**: Write off at 60-90 days. Not worth pursuing. **Debts $100-$500**: Maybe internal collections for 30 more days, then write off. **Debts over $500**: Consider external collections agency, but only if customer has ability to pay. **Don't**: Call customers repeatedly, threaten legal action, or report to credit bureaus for subscription debts. **Do**: Send 2-3 friendly reminders, then write it off and move on. **The cost to collect $50 exceeds $50.** Your time and brand reputation are worth more. --- ## Dunning vs Collections vs Charge-Off | Stage | What It Is | Timeline | Who Handles | |-------|------------|----------|-------------| | **Dunning** | Automatic payment retries + reminders | Days 0-30 | Your system | | **Collections (internal)** | Persistent contact to collect debt | Days 30-90 | Your team | | **Collections (external)** | Third-party agency attempts collection | Days 90-180 | Collections agency | | **Charge-off** | Write off as uncollectible | Day 120-180 | Accounting | **This page focuses on stages 2-4** (actual collections). For dunning (stage 1), see [Subscriptions & Recurring](/docs/payments/subscriptions-recurring). --- ## When Does Dunning Become Collections? That's the distinction that matters. Most subscription SMBs never do actual "debt collection", they retry payments and then they give up. You still need to know where the line is, because you don't want to cross it by accident. ### Dunning (This is Normal, Keep Doing It) **Acceptable dunning practices:** - Automated payment retries (3-7 attempts over 2-4 weeks) - Email reminders: "Your payment failed, please update your card" - In-app prompts: "Update payment method to restore service" - Service suspension until payment (you stop providing service) - Friendly reminders: "Hi, your card declined. Want to update it?" :::warning[Network Retry Limits] Card networks cap how many times you can retry a declined transaction. Go past it and you're fined: - **Visa**: 15 retries within 30 days per card/merchant combination - **Mastercard**: 10 retries within 24 hours, maximum 35 retries within 30 days ($0.10 assessment per retry over threshold) These limits apply specifically to retries on the same card number for the same merchant. If a customer updates their card, the counter resets. Check your processor's current limits, because the networks don't leave them alone and you won't get a notice. ::: **That isn't debt collection.** It's normal business operations. Nothing applies beyond basic decency and the network retry limits above. You don't need a compliance program for it. ### Collections (This is Where Rules Kick In) **You've crossed into "collections" when you:** **Real-world examples:** | Dunning (OK) | Collections (Different Rules) | |--------------|-------------------------------| | "Your payment failed. Click here to update your card." | "You owe us $50. Pay immediately or we'll take legal action." | | Retry payment 3 times over 2 weeks | Call customer daily for 2 weeks demanding payment | | Suspend service until card is updated | Threaten to report to credit bureaus if not paid | | Send 3 automated emails | Call customer's workplace asking about payment | | "Update your card in your account settings" | "We've hired a collections agency to pursue you" | **The practical line:** - Up to 5 friendly contacts over 4 weeks = Normal dunning - More than 5 contacts, demanding language, threats = Collections territory **For most SMBs**: You never cross this line. You just write it off after 3-5 dunning attempts. --- ## Fair Debt Collection Practices Act (FDCPA) ### Does FDCPA Apply to Merchants? **Maybe.** **FDCPA applies to**: - Third-party debt collectors (collections agencies) - Companies whose **principal business** is collecting debts **FDCPA doesn't apply to**: - Creditors collecting their own debts (most subscription businesses) - BUT: Many states have similar laws that DO apply to all collectors **Practical reality**: Even if the FDCPA doesn't legally apply to you, following its guidelines protects you from state-level violations. ### FDCPA Key Rules | Prohibited Practice | What It Means | |---------------------|---------------| | **Harassment** | Repeated calls, profane language, threats | | **False statements** | Lying about amount, legal action, credit reporting | | **Unfair practices** | Collecting unauthorized amounts, depositing post-dated checks early | | **Third-party contact** | Telling others about the debt | | **Inconvenient times** | Calling before 8 AM or after 9 PM | | **Workplace contact** | If you know employer prohibits it | **Penalties**: $1,000 per violation + legal fees + damages --- ## When to Stop Collecting ### The 90-Day Rule (Industry Standard) **Most subscription businesses stop active collection at 90 days past due**: **Days 0-30**: Dunning (automated retries, update card emails) **Days 30-60**: Gentle reminders (1-2 emails, maybe 1 call) **Days 60-90**: Final notices (last chance to pay) **Day 90+**: Write it off and move on **Why 90 days?**: - Recovery rates drop dramatically after 90 days (5-10% recovery) - Cost of collection exceeds expected recovery ($30-50 to collect $50) - Legal risk increases with persistent contact - Brand damage from aggressive collections > $50 recovered - Better to write off and move on **The real advice**: For subscription SMBs, write off small debts quickly (60-90 days). Don't waste time or damage your brand chasing $30-$100. ### What This Page Tells You NOT to Do **Common SMB mistakes:** 1. **Calling customers 10+ times** about a $50 failed payment - **Reality**: This violates harassment rules and destroys your brand - **Do instead**: 2-3 friendly emails, then write off 2. **Threatening legal action** for small subscription debts - **Reality**: False threats violate FDCPA-like state laws - **Do instead**: Suspend service, send final notice, write off 3. **Hiring collections agency** for debts under $100 - **Reality**: Agency takes 50%, you net $25-50, customer hates you forever - **Do instead**: Write it off, it's not worth it 4. **Pursuing failed payments for 6+ months** - **Reality**: Cost to collect > recovery after 90 days - **Do instead**: Set 90-day write-off policy and stick to it **The guidance is**: Stop trying to collect. Write it off. Move on. ### Cost-Benefit Analysis **Calculate whether to continue collecting**: | Debt Age | Recovery Rate | Cost to Collect | Net Recovery | |----------|---------------|-----------------|--------------| | **0-30 days** | 60-80% | $2-5 per account | High | | **30-60 days** | 30-50% | $5-15 per account | Moderate | | **60-90 days** | 15-25% | $15-30 per account | Low | | **90-180 days** | 5-10% | $30-50 per account | Negative often | | **Over 180 days** | Under 5% | $50-100+ | Strongly negative | **Stop collecting when**: Cost to collect > expected recovery **For most subscription businesses**: - Under $50 debt: Stop at 30 days - $50-$200 debt: Stop at 60-90 days - Over $200 debt: Consider external collections at 90 days --- ## Collections Agencies: When and How ### When to Use Collections Agency **Consider external collections if**: - Debt is over $100-200 (agencies won't take smaller) - Customer has assets/ability to pay - You've exhausted internal collection attempts - Debt is under 90-180 days old (fresher = better) **Skip external collections if**: - Debt is under $100 (not worth it) - Customer is judgment-proof (no assets) - Debt is over 1 year old (too stale) - Your brand reputation matters more than recovery ### How Collections Agencies Work **Contingency basis** (most common): - Agency keeps 25-50% of recovered amount - You get 50-75% - No upfront cost - Agency only makes money if they collect **Flat-fee or account purchase**: - Agency buys debt for 5-20 cents per dollar - You get cash upfront (but pennies on dollar) - Agency owns the debt and keeps all recovery ### Collections Agency Recovery Rates | Debt Age | Expected Recovery | Your Net (50% contingency) | |----------|-------------------|---------------------------| | **60-90 days** | 15-25% | 7-12% of original debt | | **90-180 days** | 10-15% | 5-7% of original debt | | **Over 180 days** | 5-10% | 2-5% of original debt | **$1,000 debt at 90 days**: - Agency recovers: $150 (15%) - Agency keeps: $75 (50%) - You get: $75 (7.5% of original debt) **Is $75 worth damaging customer relationship and your brand?** Depends on your business. --- ## Charge-Off Decisions ### What is a Charge-Off? **Charge-off** = Recognizing debt as uncollectible and removing from accounts receivable **This is an accounting decision**, not a legal one: - Debt still legally exists - Customer still owes it - You can still collect - But you're not counting it as expected revenue ### When to Charge Off **IRS Guidelines** (for tax deduction): - Must be "worthless" (uncollectible) - Reasonable efforts to collect - Typically 120-180 days past due **Industry practice for subscriptions**: - B2C: Charge off at 90-120 days - B2B: Charge off at 120-180 days - Enterprise: May pursue longer ### Charge-Off Process 1. **Stop including in accounts receivable** 2. **Mark as bad debt expense** 3. **Decide**: Write off entirely or send to collections 4. **Document** why debt is uncollectible 5. **Notify accounting** for tax purposes :::note[Tax Implications] Charged-off debt may be tax-deductible as a bad debt expense. Ask your accountant. That's tax territory and we're not in it. ::: --- ## When to Write Off Entirely **Write off without further collection if**: | Scenario | Action | |----------|--------| | **Debt under $50** | Cost to collect exceeds value | | **Customer complained about product/service** | Collections will create negative reviews | | **Payment method fraud** | Customer claims unauthorized, likely to win | | **Customer is unreachable** | No valid contact info, no response | | **Brand risk too high** | Collections damage outweighs recovery | **For most subscription SaaS**: Write off anything under $100 at 90 days. The brand damage from chasing it isn't worth $50-100. --- ## Best Practices for Subscription Businesses ### Tier Your Collection Effort by Debt Size | Debt Amount | Collection Strategy | |-------------|---------------------| | **Under $25** | 30 days dunning, then write off | | **$25-$100** | 60 days dunning, then write off | | **$100-$500** | 90 days internal collections, then decide | | **Over $500** | 90 days internal, consider external collections | ### Separate Involuntary from Voluntary Churn **Involuntary churn** (payment failed): - Customer wanted to stay, card declined - Worth significant effort to recover - Update card tools, retries, customer service **Voluntary churn** (customer cancelled): - Customer chose to leave - Don't pursue aggressively - May attempt win-back campaign later **Don't waste collections effort on voluntary churn.** ### Document Everything For any collections activity: - Log all contact attempts (date, time, method, outcome) - Save all communications (emails, call recordings) - Document customer promises ("I'll pay next week") - Record disputes or complaints **If you send to collections agency**, you need this documentation. --- ## Test to Run **Failed payment collections audit:** **Week 1: Identify aged debt** 1. Pull all failed payments over 30 days past due 2. Bucket by age: - 30-60 days: $_____ - 60-90 days: $_____ - Over 90 days: $_____ **Week 2: Calculate recovery rates** 3. For each bucket, calculate: - Total debt in bucket - Amount recovered (if you've been collecting) - Recovery rate: recovered / total **Week 3: Set charge-off policy** 4. Define your charge-off thresholds: - Under $25: Charge off at ___ days - $25-$100: Charge off at ___ days - Over $100: Charge off at ___ days 5. Implement policy 6. Track recovery rates by bucket **Success criteria**: Clear charge-off policy, recovery rates improve or costs decrease. --- ## Scale Callout **Under $100K/month MRR:** - Write off aggressively (under $100 at 60 days) - Internal collections only - Don't use external agencies - Brand matters more than recovery **$100K-$500K/month MRR:** - Tier collection effort by debt size - Consider external collections for $200+ debts - Still write off under $100 quickly **$500K-$1M/month MRR:** - Dedicated collections process - External agency relationship for $150+ debts - Track recovery rates by bucket **Over $1M/month MRR:** - Collections team or dedicated resource - Automated collections workflows - External agency for $100+ debts - But still write off quickly for brand protection --- ## Where This Breaks 1. **Aggressive collections destroy brand**: One angry customer posting about collections harassment can cost you 10-100 future ones. That's the number nobody puts in the model. 2. **FDCPA violations are expensive**: $1,000 per violation. One aggressive collector making 50 calls = $50K+ exposure. 3. **Payment disputes override collections**: If the customer disputes with their bank, stop collections that day. You're in the chargeback process now, not yours. 4. **International customers have different rules**: EU has stricter consumer protection. GDPR limits contact. Research local laws. 5. **Subscription services have leverage**: Cancel service = customer can't use product. That's better leverage than any collections call. --- ## Next Steps **Need to collect failed payments?** 1. Implement proper [dunning sequence](/docs/payments/subscriptions-recurring) first 2. Set charge-off thresholds by debt size 3. Document all collection activity **Considering collections agency?** 1. Only for debts over $100-200 2. Research agency reputation 3. Verify they follow FDCPA 4. Calculate if 7-12% net recovery is worth brand risk **Want to reduce failed payments instead?** 1. Implement [Card Account Updater](/docs/payments/subscriptions-recurring#card-account-updater-cau) 2. Use [network tokens](/docs/payments/reference/tokenization) for higher auth rates 3. Optimize [dunning sequence](/docs/payments/subscriptions-recurring#dunning-sequences) --- ## See Also - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Dunning sequences and retries - [Recurring Billing Compliance](/docs/compliance/subscriptions/recurring-billing) - Legal requirements - [Decline Codes](/docs/reference/decline-codes) - Understanding hard vs soft declines - [Auth Optimization](/docs/payments/auth-optimization) - Improving recurring auth rates - [Chargeback Prevention](/docs/chargebacks/prevention) - Subscription dispute prevention - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund vs collect --- ## Recurring Billing Requirements Source: https://paymentsandrisk.com/docs/compliance/subscriptions/recurring-billing # Recurring Billing Requirements :::info[TL;DR] - Disclose price, billing frequency and how to cancel **before** you ask for a card number. On the page, not buried in the terms. - Express consent, on a box that isn't pre-checked. Timestamp it. Keep the record 3+ years. - Reminder 7+ days before a free trial converts. Amount and date in it. - Signed up online means they cancel online. Same channel, no extra steps, no retention gauntlet. - The FTC's Click-to-Cancel Rule was vacated in July 2025. ROSCA didn't go anywhere. The FTC still enforces under it, so nothing practical changed. - California is the state that bites. Goods supplied without proper consent are an unconditional gift. The customer owes you nothing. ::: Most subscription chargebacks aren't fraud. They're a customer who forgot they subscribed. Or couldn't find the cancel button. Or didn't recognize the line on their statement. The compliance rules below are also the chargeback-prevention list. Getting compliant and cutting disputes is one project, not two. ## Card Network Requirements Visa and Mastercard landed in the same place by different routes. Build to the stricter one and you're compliant with both. You'll also have removed most of what creates subscription disputes. ### Visa Subscription Rules #### Express Consent - Get consent for the recurring charge at enrollment. On its own, separate from everything else. - It has to name the subscription terms. Not folded into a general terms-of-service click. - **The box can't be pre-checked.** Most common violation there is. One screenshot proves it. #### Enhanced Notification at Enrollment Send the terms even if nothing gets charged at signup. It has to include: - Confirmation of the subscription agreement - Transaction amount and frequency - How and when it renews - Clear cancellation instructions - Merchant contact information #### Free Trial Conversion Send a reminder at least **7 days before the first paid charge**. It has to include: - Amount to be charged - Date of charge - How to cancel #### Cancellation Requirements - Online signup means online cancellation. No exceptions. - You can't demand a phone call or a letter if signup didn't need one. - "Simple" means few clicks and no friction bolted on to slow people down. - Send a cancellation confirmation. It's your best evidence on a 13.2. #### Transaction Identification - Use the right MCC for subscription services. - Put your actual brand name in the billing descriptor. See [descriptors and communications](/docs/chargebacks/prevention/descriptors-and-comms). - Store credentials under Visa's stored-credential mandate. ### Mastercard Subscription Rules Miss these and it comes back as a [chargeback](/docs/chargebacks). Reason code [4853](/docs/reference/reason-codes/mastercard/cardholder-dispute), Cardholder Dispute. #### March 2022 Updates - Confirmation email at enrollment, with all terms. - Payment receipt after each successful billing. - Cancellation instructions on every communication. #### September 2022 Updates - Billing reminders on plans with **180+ day intervals**, 7-30 days ahead. - Negative option reminder before trial-to-paid conversion, 7+ days. - Enhanced consent requirements. #### Cancellation - The cancellation channel has to match the signup channel. - **Online signup = online cancel required.** - You can't add steps that weren't there at enrollment. ## Federal Requirements ### ROSCA (Restore Online Shoppers' Confidence Act) ROSCA covers every internet subscription. Any product, any size. Three requirements: #### 1. Clear and Conspicuous Disclosure - Every material term goes in front of them **before** you take billing info. - Not in the terms of service. Not in fine print. - Price, frequency and cancellation policy, at minimum. - Visible without scrolling past other content. #### 2. Express Informed Consent - They have to do something affirmative. Passive acceptance isn't consent. - Consent to these recurring terms, not to your agreement generally. - Before any charge. - A separate mechanism from your other agreements. #### 3. Simple Cancellation Mechanism - "Simple" isn't defined in the statute. That's deliberate. - Cancellation can't be meaningfully harder than signup was. - The FTC's cases draw the actual line. Read the enforcement history below. ### FTC Click-to-Cancel Rule (Status) - Finalized October 2024. - **Vacated by the 8th Circuit in July 2025**, on procedural grounds. - The FTC kept enforcing under ROSCA and FTC Act Section 5. - The dead rule still shows what the FTC thinks the law already requires. Loosened your cancel flow when the rule got struck down? Put it back. The rule died on procedure, not substance. ROSCA is what the enforcement actions ran on anyway. **Still enforced under ROSCA:** - Cancellation as easy as signup. - No forced conversation with a rep unless signup required one. - Clear disclosure of material terms. ### Recent FTC Enforcement | Company | Date | Issue | Outcome | |---------|------|-------|---------| | Uber | April 2025 | Deceptive enrollment, difficult cancellation | Litigation ongoing | | Cleo AI | March 2025 | Hidden subscription terms, cancellation barriers | Action filed | | Care.com | August 2024 | Cancellation issues | $8.5M settlement | | Amazon | Ongoing | Deceptive Prime enrollment | Litigation | **Penalties:** up to about $53,000 per violation under the FTC Act, on the 2025 civil penalty adjustments. ## State Laws ### California Automatic Renewal Law (ARL) California is the strictest state. It's also the one that changes what you build. Sell to a California customer at all? Build to the ARL. Treat the other states as covered. #### July 2025 Amendments (AB 2863) - **Express affirmative consent**: on the renewal terms specifically. - **Record retention**: 3 years, or 1 year post-termination. - **Cancellation medium**: the same one they enrolled in. - **Pre-enrollment disclosure**: cost, frequency and cancel policy, next to the enrollment. - **Annual reminders**: on terms of 12 months or longer. - **Price change notice**: in advance. - **One save rule**: one retention offer during cancellation, then let them go. #### Existing Requirements - Clear and conspicuous disclosure of the renewal terms. - Affirmative consent to the agreement. - Acknowledgment with terms and cancellation info after signup. - **Goods or services supplied without proper consent count as an unconditional gift.** The customer keeps them and owes you nothing. A consent-record failure becomes a total loss on the sale. #### Enforcement - California AG and district attorneys. - Private plaintiffs, and class actions are common. - Significant statutory damages. ### New York - Clear disclosure of autorenewal terms before signup. - Easy cancellation mechanism required. - Civil penalties apply (NY General Business Law ยง527 et seq.). - The AG and local government both enforce it. ### Colorado - Renewal terms have to be disclosed. - Cancellation has to be available. - Enforcement activity is growing. ### Other States with Auto-Renewal Laws 20+ states regulate auto-renewal in some form: - District of Columbia - North Dakota - Vermont - Virginia - Illinois - Oregon - And others :::warning[State law is a moving target] State auto-renewal laws differ, and they change most legislative sessions. None of this is legal advice. For a small merchant the practical answer is simple. Build to California and stop tracking the rest. Big enough that a state AG would notice you? Get counsel who follows the states you sell into. ::: ## Implementation Checklist ### Pre-Enrollment - [ ] Display price clearly (including post-trial price) - [ ] Show billing frequency (monthly, annual, etc.) - [ ] Explain trial period and conversion date - [ ] Provide cancellation instructions - [ ] Link to full terms of service - [ ] All disclosures "clear and conspicuous" - [ ] Disclosures in proximity to enrollment (not buried) ### At Enrollment - [ ] Capture express consent (checkbox, **not pre-checked**) - [ ] Separate consent for subscription vs. one-time purchase - [ ] Record timestamp and method of consent - [ ] Store consent record for **3+ years** ### Post-Enrollment Confirmation - [ ] Send immediate confirmation email/text - [ ] Include all subscription terms - [ ] Repeat cancellation instructions - [ ] Provide customer service contact - [ ] Include transaction amount and frequency ### Before Trial Conversion - [ ] Send reminder **7+ days** before first charge - [ ] Include specific charge amount - [ ] Include charge date - [ ] Include cancellation method - [ ] Make it easy to cancel from the reminder ### Ongoing Communications - [ ] Receipt after each successful charge - [ ] Cancellation instructions on every receipt - [ ] Price change notifications in advance - [ ] Annual reminders (California, 12+ month terms) ### Cancellation Process - [ ] Online cancel if online signup - [ ] Minimal clicks to complete - [ ] No forced upsells before confirmation - [ ] Immediate confirmation of cancellation - [ ] Clear effective date of cancellation - [ ] No penalties for cancellation (unless disclosed) ## Chargeback Prevention for Subscriptions ### Common Subscription Chargeback Reasons | Reason | Root Cause | |--------|------------| | "I forgot about this subscription" | Poor communication, no reminders | | "Trial converted without my knowledge" | Insufficient trial conversion notice | | "I couldn't figure out how to cancel" | Difficult cancellation process | | "I don't recognize this charge" | Unclear billing descriptor | Every row is a communication failure, not a fraud problem. Good news. You can fix all four without buying anything. ### Prevention Strategies **Clear Billing Descriptors:** - Use the name they'd recognize, plus the word "subscription". - `ACME*MONTHLY SUB`, not `PYMNT SVC 12345`. - Legal entity in the descriptor, brand name on the storefront? They won't connect the two. **Pre-Charge Reminders:** - 7+ days before trial conversion - Before annual renewals - When price changes **Easy Online Cancellation:** - Self-service portal - Minimal clicks - Immediate confirmation **Proactive Customer Outreach:** - Failed payment notifications - Usage reminders for unused subscriptions - Win-back offers before cancellation **Prevention Tools:** - Ethoca and Verifi alerts - Order Insight / Consumer Clarity enrollment - Clear transaction enrichment data ### Visa Reason Code 13.2 [13.2, Cancelled Recurring Transaction](/docs/reference/reason-codes/visa/13-2-cancelled-recurring) is what you get for billing someone after they asked you to stop. You also get it when they only *think* they asked. That's why the confirmation email beats your internal record. **To defend a 13.2, you need:** - The date the request arrived, and the channel it came through. - Proof the charge covered a period before cancellation took effect. - The cancellation confirmation you sent, with its timestamp. - Your terms showing you bill through the end of the paid period. If you can't produce the confirmation you sent them, you'll lose this one. Send the email, keep the email. ## Record Retention Requirements | Record Type | Minimum Retention | Requirement Source | |-------------|-------------------|-------------------| | Consent capture | 3 years | California ARL | | Transaction records | 2+ years | PCI DSS, network rules | | Cancellation confirmations | 2+ years | Best practice for disputes | | Customer communications | 1 year post-termination | California ARL | | Terms of service versions | Duration of use + 2 years | Best practice | ## Where This Breaks **The consent record exists but you can't produce the screen.** A boolean `consent = true` and a timestamp prove nothing about what the customer saw. Snapshot the enrollment screen, version it, tie each consent record to a version. Without that you can't rebut a California ARL claim. You can't win a 13.2 either. **Cancellation works, but only during business hours.** A "cancel" link that opens a support ticket isn't online cancellation. A human approves it, so you've met neither the network rule nor ROSCA. The customer who tried at 11pm on a Sunday files a chargeback on Monday. **The trial reminder goes to the signup email nobody reads.** Send it, then check the open rate. Under 20% and you have a compliant email nobody sees. That protects you legally and does nothing for your dispute rate. Add an in-product notice. **Your annual plan reminds nobody.** Twelve months is long enough to forget you exist. California requires the reminder on 12+ month terms. It's the highest-yield email in a subscription business, whatever state they're in. **You updated the price and told them in the terms.** A price change needs direct advance notice. Changing the number on your pricing page isn't notice. Those disputes are unwinnable. **Retention offers turn into a maze.** One save attempt is defensible. California limits it to exactly that. Three screens of offers is what an FTC complaint looks like. It's also what an examiner screenshots. ## High-Risk Considerations Processors price subscriptions as higher risk. They're not wrong. Expect it in your quote and don't take it personally: - Higher chargeback rates - Trial abuse - Customer complaints - Regulatory scrutiny - Negative option concerns ### What to Expect - Enhanced monitoring requirements - Possible reserves (rolling or upfront) - Stricter chargeback thresholds - Regular compliance audits - Higher processing rates ### Mitigation Strategies - Transparent pricing and terms - Easy cancellation process - Proactive customer communication - Strong consent documentation - Low chargeback ratios - Positive customer reviews ## Sample Consent Flow ### Step 1: Pre-Enrollment Disclosure > **Subscription Terms** > > You are enrolling in [Product Name] for $X.XX per month. > > - Your subscription will automatically renew each month > - You will be charged $X.XX on the [date] of each month > - You can cancel anytime at [website.com/cancel] or by calling [phone] > - See our full [Terms of Service] for complete details ### Step 2: Consent Capture > [ ] I agree to the subscription terms above. I understand I will be charged $X.XX per month until I cancel. > > [Subscribe Now] *(Checkbox must not be pre-checked)* ### Step 3: Confirmation > **Subscription Confirmed** > > Thank you for subscribing to [Product Name]! > > **Subscription Details:** > - Amount: $X.XX per month > - Next charge: [Date] > - Renewal: Automatic monthly > > **To Cancel:** > - Online: [website.com/cancel] > - Phone: [number] > - Email: [email] > > A confirmation email has been sent to [email address]. --- :::warning[Verified August 2026] Subscription rules move faster than anything else on this site. The FTC's Click-to-Cancel Rule was vacated in July 2025. Enforcement carried on under ROSCA anyway. State laws change most sessions, California's especially. Check the current position before you make a compliance decision on the strength of this page. ::: ## Next Steps **Setting up subscription billing?** 1. [Follow implementation checklist](#implementation-checklist) - Pre, at, and post enrollment 2. [Review network rules](#card-network-requirements) - Visa and Mastercard requirements 3. [Design consent flow](#sample-consent-flow) - Pre-enrollment to confirmation **Ensuring compliance?** 1. [Meet ROSCA requirements](#rosca-restore-online-shoppers-confidence-act) - Federal rules 2. [Check California ARL](#california-automatic-renewal-law-arl) - Strictest state law 3. [Set up record retention](#record-retention-requirements) - 3+ year consent **Preventing subscription chargebacks?** 1. [Identify root causes](#common-subscription-chargeback-reasons) - Forgot, couldn't cancel 2. [Implement prevention strategies](#prevention-strategies) - Reminders, easy cancel 3. [Defend against 13.2](#visa-reason-code-132) - Cancelled recurring disputes --- ## See Also - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing subscription chargebacks - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Ethoca, Verifi for subscription disputes - [Reason Code 13.2](/docs/reference/reason-codes/visa/13-2-cancelled-recurring) - Cancelled recurring disputes - [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM thresholds - [Consumer Protection](/docs/compliance/consumer-protection) - Reg E, Reg Z basics - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Payment operations for subscriptions - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party dispute abuse - [Refund Fraud](/docs/fraud/types/refund-fraud) - Refund abuse patterns - [Descriptors & Communications](/docs/chargebacks/prevention/descriptors-and-comms) - Clear billing descriptors - [Processor Management](/docs/operations/processor-management) - High-risk considerations --- # Operations ## Operations Source: https://paymentsandrisk.com/docs/operations # Operations :::info[TL;DR] - **Daily (5-15 min)**: Auth rate, fraud queue, chargeback queue, deposits - **Weekly (30-45 min)**: CB ratio trend, win rate, processor emails, reconciliation - **Monthly (1-2 hr)**: Statement review, effective rate, rule performance - **Oh shit**: Auth drops 10%+, 5+ CBs/day, processor "review" email โ†’ act immediately - Scale by volume: under $500K/yr = weekly CB count check only; over $2M/yr = real-time monitoring ::: The unglamorous work that keeps the money moving and the losses small. Most weeks it's 15 minutes a day. --- ## Pick Your Mode [ ๐Ÿ”ง Operator Daily/weekly tasks. Checklist and processor management. ](/docs/operations/checklist) [ ๐Ÿ“Š Analyst Tracking and optimization. Metrics and statement analysis. ](/docs/operations/metrics) [ ๐Ÿ“š Reference Procedures and workflows. Representment and change checklists. ](/docs/operations/representment-workflow) Popular [ โœ… Operations Checklist Start Here Daily, weekly, monthly routines ](/docs/operations/checklist) [ ๐Ÿ“Š Total Cost Model Complete budgeting worksheet - all payment costs ](/docs/payments/total-cost-model) [ ๐Ÿ› ๏ธ Tool Stack by Tier What tools to buy at each volume tier ](/docs/payments/tool-stack) [ โš”๏ธ Representment Workflow Popular Fighting chargebacks step-by-step ](/docs/operations/representment-workflow) [ ๐Ÿค Processor Management Working with your processor ](/docs/operations/processor-management) [ ๐Ÿ“„ Reading Statements Understand fees, catch overcharges ](/docs/operations/reading-statements) [ ๐Ÿ”’ Holds and Reserves Why your money's stuck ](/docs/operations/holds-and-reserves) [ ๐Ÿ†˜ When to Get Help DIY vs consultant vs hire decision framework ](/docs/operations/when-to-get-help) [ ๐Ÿ“ˆ Scaling Milestones What changes from $100K to $500K to $1M+ ](/docs/operations/scaling-milestones) --- :::tip[If You Only Have 2 Hours This Week] 1. Check your chargeback ratio (stay under 0.65%) 2. Respond to any disputes due in the next 7 days 3. Verify yesterday's deposits hit your bank 4. Scan for processor emails you've missed The [full checklist](/docs/operations/checklist) has the daily, weekly and monthly routines. ::: :::info[Scale Matters] **Under $100K/month:** Check your chargeback count weekly and verify deposits hit your bank. That's your entire ops routine. Skip the Sandbox Training section below. **$100K-$1M/month:** Add weekly chargeback ratio tracking, monthly statement reviews and a basic representment process. That's 30-60 minutes a week. **Over $1M/month:** You'll want real-time monitoring, a dedicated dispute workflow, and someone who owns payment operations by name. See [Who Owns What](/docs/operations/who-owns-what). **Over $10M/month:** Full-time ops team, multi-processor monitoring, incident response playbooks, quarterly vendor reviews. See [Scaling Milestones](/docs/operations/scaling-milestones). ::: --- Operations at a Glance | Task | Frequency | Time | Who | Link | |------|-----------|------|-----|------| | Check fraud queue | Daily | 5 min | Fraud/Ops | [Checklist](/docs/operations/checklist) | | Review new disputes | Daily | 5 min | Ops | [Representment](/docs/operations/representment-workflow) | | Verify deposits | Daily | 2 min | Finance | [Reading Statements](/docs/operations/reading-statements) | | CB ratio monitoring | Weekly | 10 min | Ops | [Metrics](/docs/operations/metrics) | | Processor emails | Weekly | 5 min | Ops | [Processor Mgmt](/docs/operations/processor-management) | | Statement review / reconciliation | Monthly | 30 min | Finance | [Reading Statements](/docs/operations/reading-statements) | | Rule performance | Monthly | 20 min | Fraud | [Checklist](/docs/operations/checklist) | --- Core Operations Guides [ โœ… Operations Checklist Daily, weekly, monthly checks with time estimates ](/docs/operations/checklist) [ ๐Ÿฆ ACH Operations Managing bank payments, preventing returns, verification tools ](/docs/operations/ach-operations) [ ๐Ÿค Processor Management Working with your processor, handling scary emails, when to switch ](/docs/operations/processor-management) [ ๐Ÿ”’ Holds and Reserves Why your money's stuck, and what to do about it ](/docs/operations/holds-and-reserves) [ ๐Ÿ‘ฅ Who Owns What Roles, responsibilities, and handoffs by team size ](/docs/operations/who-owns-what) [ ๐Ÿ”„ Payment Change Checklist What to verify before shipping checkout changes ](/docs/operations/change-checklist) [ ๐Ÿ“„ Reading Your Statement Understanding fees, catching overcharges ](/docs/operations/reading-statements) [ โš”๏ธ Representment Workflow Fighting chargebacks operationally ](/docs/operations/representment-workflow) --- --- Quick Links [๐Ÿ“‰ Chargeback spike?](/docs/playbooks/reduce-chargebacks-fast) [๐Ÿšจ Fraud attack?](/docs/playbooks/survive-fraud-attack) [โš ๏ธ Approaching thresholds?](/docs/compliance/network-rules/dispute-monitoring) [๐Ÿ“Š Need metrics?](/docs/operations/metrics) --- ## Next Steps Just getting started? [Operations Checklist](/docs/operations/checklist) - Daily/weekly routines [Processor Management](/docs/operations/processor-management) - Working with processor [Reading Statements](/docs/operations/reading-statements) - Understand fees Handling disputes? [Representment Workflow](/docs/operations/representment-workflow) - Step-by-step [Chargebacks Overview](/docs/chargebacks) - Full guide [Time Frames](/docs/reference/time-frames) - Don't miss deadlines --- :::tip[New to payment operations?] Start with **[The Guide, Pathway 4: Running Payments Daily](/docs/learning-pathways/running-payments-daily/daily-weekly-tasks)**. It's a 19-minute walkthrough of daily tasks, reading statements and when to get help. This page is the deep dive. ::: ## See Also [๐Ÿ’ณ Payments Overview](/docs/payments) [๐Ÿ›ก๏ธ Fraud Prevention](/docs/fraud/prevention) [๐Ÿ’ฐ Chargebacks](/docs/chargebacks) [๐Ÿ“‹ Compliance](/docs/compliance) - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Fraud Metrics](/docs/fraud/metrics) - Measuring fraud performance - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Payments Metrics](/docs/payments/metrics) - Transaction health - [Benchmarks](/docs/reference/benchmarks) - Industry comparisons - [Time Frames](/docs/reference/time-frames) - Response deadlines - [3D Secure](/docs/fraud/prevention/3ds) - Authentication setup - [Buying Payments](/docs/payments/buying-payments) - Processor selection --- ## Payment-to-Accounting Integration Source: https://paymentsandrisk.com/docs/operations/accounting-integration # Payment-to-Accounting Integration :::info[TL;DR] - Your processor deposits net amounts (after fees, refunds, chargebacks) but your accounting needs to record gross revenue, fees, and adjustments separately - these will never match unless you map them correctly - Set up dedicated accounts for processing fees, refunds, chargeback losses, and chargeback fees - dumping everything into "Sales" creates a mess you'll spend hours untangling at month-end - Every processor integration (Stripe/Square/PayPal into QuickBooks/Xero/Wave) has different gaps - know yours before you trust the sync - A 5-step monthly close process catches mismatches before they compound into quarterly fire drills ::: Your processor says $14,832 settled this week. Your bank shows $14,832 deposited. But QuickBooks shows $15,940 in revenue. Where did the other $1,108 go? It didn't go anywhere. Your processor deposited net (after fees and refunds). Your accounting recorded gross (total sales). The $1,108 is processing fees, a refund, and a chargeback - all deducted before the money hit your bank. This gap is where SMBs lose hours every month, and it's entirely preventable with the right setup. ## Why the Numbers Never Match Five things create the gap between "processor settled" and "accounting shows": **1. Gross vs. net deposits.** Most processors deposit net - they deduct fees before sending you money. Your POS or ecommerce platform records gross sales. If your accounting pulls from the POS, it shows more revenue than your bank received. **2. Fee timing.** Some processors deduct fees per-transaction (net settlement). Others bill fees monthly in a separate deduction. Stripe deducts per transaction. A traditional merchant account might deduct fees on the 1st of the following month. If you don't know which model your processor uses, your books will be off every single month. **3. Refund classification.** A $50 refund isn't negative revenue - it's a contra-revenue entry. But many integrations dump refunds into the same bucket as sales, just with a negative sign. This understates both your gross revenue and your refund rate. **4. Chargeback entries.** A chargeback hits you twice: the transaction amount is reversed AND you pay a $15-25 fee. Most accounting integrations miss the fee entirely. Some miss the reversal too, leaving "revenue" on the books for money you gave back months ago. **5. FX gain/loss.** If you accept international payments, the exchange rate at transaction time differs from the rate at settlement. That difference is a real gain or loss that belongs in its own account, not buried in revenue. ## Setting Up Your Chart of Accounts Before you connect anything, create these accounts. This structure works in QuickBooks, Xero, and Wave. | Account Type | Account Name | What Goes Here | Examples | |-------------|-------------|----------------|----------| | **Revenue** | Payment Revenue | Gross transaction amounts | Card sales, online orders, invoices paid | | **Expense** | Processing Fees | All processor fees | Interchange, assessment, markup, monthly fees | | **Contra-Revenue** | Refunds Issued | Customer refunds | Full refunds, partial refunds, credits | | **Expense** | Chargeback Losses | Disputed transaction amounts you lost | Fraud chargebacks, service disputes | | **Expense** | Chargeback Fees | Per-chargeback processor fees | $0 to $30 per dispute, usually $15, plus retrieval fees | | **Liability** | Processor Reserves | Funds held by processor | Rolling reserves, fixed reserves | | **Other Income/Expense** | FX Gain/Loss | Currency conversion differences | Rate differences between capture and settlement | **Why this matters:** When everything flows through a single "Sales" account, you can't tell whether revenue dropped because sales are down or because chargebacks are up. Separate accounts give you visibility without extra work once configured. ### Account Naming Tips - Prefix processor-specific accounts if you run multiple processors: "Stripe Processing Fees" vs "Square Processing Fees" - Keep refunds as contra-revenue (not negative revenue) so your gross revenue number stays accurate - Create sub-accounts for chargeback losses vs. chargeback fees - the loss is the transaction amount, the fee is the processor's charge ## Integration by Processor Not all integrations are equal. Here's what actually works and where the gaps are. | Processor | Accounting App | Integration Method | What Syncs | Known Gaps | |-----------|---------------|-------------------|------------|------------| | **Stripe** | QuickBooks Online | Stripe's official connector | Sales, fees, refunds, payouts | Chargeback fees may not categorize correctly; reserve movements not tracked | | **Stripe** | Xero | Stripe's official connector | Sales, fees, refunds, payouts | Multi-currency reconciliation can drift; manual CB fee review needed | | **Stripe** | Wave | CSV import or Zapier | Depends on setup | No native integration - requires manual mapping or third-party automation | | **Square** | QuickBooks Online | Square's official connector | Sales, fees, refunds, tips | Tips and fees can merge; item-level detail often missing; CB entries incomplete | | **Square** | Xero | Square's official connector | Sales, fees, refunds | Modifier and discount handling is inconsistent; manual CB reconciliation | | **Square** | Wave | CSV import | Basic transaction data | No native connector - CSV export and manual categorization required | | **Shopify** | QuickBooks Online | Third-party (A2X, Synder) | Sales, fees, refunds, shipping | Native sync is unreliable for payment data - use A2X or Synder instead | | **Shopify** | Xero | Third-party (A2X, Synder) | Sales, fees, refunds, shipping, tax | Same as above - third-party tools handle the gross-to-net mapping | | **PayPal** | QuickBooks Online | PayPal connector | Sales, fees, refunds | Holds and disputes sync poorly; personal vs business transfers can confuse categorization | | **PayPal** | Xero | PayPal feed or manual | Transaction feed | Fee breakdowns are minimal; FX conversions create reconciliation noise | | **PayPal** | Wave | Bank feed or CSV | Basic transaction data | Minimal detail - requires significant manual categorization | ### The Third-Party Tool Question For Shopify merchants, tools like A2X or Synder are worth the $19-49/month. They map gross sales, fees, refunds, and taxes to the right accounts automatically. The native Shopify-to-QuickBooks sync creates more problems than it solves because it doesn't properly separate fees from revenue. For Stripe and Square, the native connectors work for basic setups. Add a third-party tool when you're running multiple processors or need item-level detail in your accounting. ## Multi-Processor Reconciliation Running two processors through one bank account is common (card processor plus PayPal, or separate processors for in-store and online). It's also where reconciliation falls apart. ### The Problem Your bank shows a $3,200 deposit on Tuesday. Was that $2,400 from Stripe and $800 from Square? Or $3,200 from Stripe with Square settling tomorrow? Without matching each deposit to its source, your books drift. ### The Fix **Step 1: Separate deposit identification.** Most processors let you add a descriptor or reference to deposits. Configure each processor to use a unique deposit descriptor so you can identify them in your bank feed. **Step 2: Use a clearing account.** Create a "Payment Clearing" or "Undeposited Funds" account in your accounting software. All processor settlements flow through this account before hitting your bank. When the bank deposit arrives, you match it against the clearing account balance. ``` Stripe settlement ($2,400) -> Payment Clearing Account Square settlement ($800) -> Payment Clearing Account Bank deposit ($3,200) -> Clears against Payment Clearing Account ``` **Step 3: Reconcile weekly, not monthly.** With multiple processors, monthly reconciliation means 30+ deposits to untangle. Weekly reconciliation keeps the matching manageable - usually 4-8 deposits to identify and match. **Step 4: Track fees per processor.** If both processors deduct fees from deposits, you need separate fee accounts (or at minimum, separate categories) to compare costs. This also feeds your [processor management](/docs/operations/processor-management) decisions - you can't negotiate rates you can't measure. ## Common Mismatches and Fixes When your books don't balance, start here. These cover 90% of payment-accounting mismatches. | Symptom | Likely Cause | Fix | |---------|-------------|-----| | Bank deposit is less than recorded revenue | Processor deducted fees from deposit (net settlement) | Record gross revenue and fees separately; match net to bank deposit | | Revenue is higher than actual sales | Refunds recorded as negative sales instead of contra-revenue | Reclassify refunds to Refunds Issued account; fix integration mapping | | Mystery deductions from bank account | Monthly processor fee billing (separate from per-transaction fees) | Check processor statement for monthly/annual fees; create recurring journal entry | | Deposit amounts don't match any single day's sales | Processor batches multiple days or splits large settlements | Match deposits to processor settlement reports, not daily sales totals | | Chargeback losses not showing in P&L | Integration doesn't sync chargeback reversals | Manually enter chargebacks from processor dashboard monthly; record both amount and fee | | Small unexplained differences ($0.01 - $2.00) | FX rounding, micro-adjustments, or assessment fee changes | Create an "Adjustments" category; write off amounts under $5 monthly rather than chasing them | | Month-end revenue doesn't match processor total | Timing - transactions on the 31st settle in the next month | Use processor settlement date (not transaction date) for accounting period cutoff | | Reserve balance not reflected anywhere | No liability account for processor reserves | Create Processor Reserves liability account; update monthly from processor dashboard | ### The Timing Trap The most frustrating mismatch is timing. A customer pays on January 31st. The processor settles on February 2nd. The bank shows the deposit on February 3rd. Which month does the revenue belong to? For most SMBs, use the **transaction date** for revenue recognition and the **settlement date** for cash reconciliation. Your revenue is January. Your cash arrived in February. Both are correct - they're answering different questions. ## Monthly Close Checklist Run this process in the first week of each month. It takes 30-60 minutes once your accounts are set up correctly. ### Step 1: Pull Processor Settlement Reports (5 min) Download the monthly settlement summary from each processor. You need: - Total gross volume - Total fees deducted - Total refunds - Total chargebacks (amount + fees) - Total net deposited ### Step 2: Match Net Deposits to Bank (10 min) Compare total net deposits from your processor reports to actual bank deposits. They should match within a few dollars (rounding). If they're off by more than $50, investigate before proceeding. Use your bank's transaction search to filter by deposit descriptor if you set one up per processor. ### Step 3: Verify Revenue Recording (10 min) Compare gross revenue in your accounting to gross volume from the processor. Common discrepancies: - Sales tax included in accounting but not in processor volume - Tips included in processor volume but categorized separately in accounting - Pending authorizations recorded as revenue but not yet settled ### Step 4: Reconcile Fees, Refunds, and Chargebacks (15 min) For each processor: - Processing fees in accounting = fees on processor statement - Refunds issued in accounting = refunds on processor statement - Chargeback losses in accounting = chargeback amounts on processor report - Chargeback fees in accounting = chargeback fees on processor report If your integration doesn't sync chargebacks automatically (most don't do it well), enter them manually. Two minutes per chargeback is worth it. ### Step 5: Update Reserve Balance and Close (5 min) Check your current reserve balance on each processor dashboard. Adjust the Processor Reserves liability account to match. This isn't revenue or expense - it's your money that you can't access yet. Mark the month as reconciled. File your processor statements somewhere you can find them. :::tip[Automation Tip] If you're spending more than an hour on this monthly, you either have an integration gap (fix the connector or add a third-party tool) or a chart of accounts problem (accounts aren't granular enough to catch mismatches quickly). The first close takes longer. By month three, it should be routine. ::: ## Where This Breaks **Shopify with multiple payment methods.** Shopify Payments, PayPal, and Shop Pay all settle differently. Shopify's native accounting sync lumps them together. Use A2X or Synder to separate them, or reconcile manually from the Shopify Payments payout report. **Switching processors mid-month.** If you migrate from one processor to another, you'll have a split month with two settlement sources, potentially overlapping refunds on old transactions, and different fee structures. Plan processor switches at month boundaries when possible. **Marketplace payouts.** If you sell on Amazon, Etsy, or similar marketplaces alongside your own store, marketplace payouts include their own fees, refunds, and adjustments. These need separate revenue and fee accounts - don't mix marketplace revenue with direct sales. ## Next Steps **Setting up for the first time?** 1. [Create your chart of accounts](#setting-up-your-chart-of-accounts) with separate fee and refund accounts 2. [Check your processor's integration](#integration-by-processor) and note the known gaps 3. [Run your first monthly close](#monthly-close-checklist) to establish a baseline **Fixing a reconciliation mess?** 1. [Diagnose the mismatch](#common-mismatches-and-fixes) using the symptom table 2. [Set up a clearing account](#multi-processor-reconciliation) if you run multiple processors 3. [Review your processor statement](/docs/operations/reading-statements) for fees you missed **Optimizing your monthly process?** 1. [Automate what you can](#integration-by-processor) with native or third-party connectors 2. [Add the close to your operations checklist](/docs/operations/checklist) as a monthly task 3. [Forecast cash flow](/docs/operations/cash-flow-forecasting) using your reconciled numbers --- ## Related Pages - [Settlement and Reconciliation](/docs/payments/settlement/reconciliation) - How processor settlements work - [Reading Your Processor Statement](/docs/operations/reading-statements) - Fee breakdowns and effective rate calculation - [Payout Strategy](/docs/operations/payout-strategy) - Payout timing, reserves, and cash flow - [Cash Flow Forecasting](/docs/operations/cash-flow-forecasting) - Projecting cash from reconciled data - [Operations Checklist](/docs/operations/checklist) - Where monthly close fits in your routine - [Multi-Processor Operations](/docs/operations/multi-processor) - Managing multiple processors - [Processor Management](/docs/operations/processor-management) - Comparing costs across processors - [Holds and Reserves](/docs/operations/holds-and-reserves) - Understanding reserve mechanics --- ## ACH Operations Source: https://paymentsandrisk.com/docs/operations/ach-operations # ACH Operations :::info[TL;DR] - **ACH settles before you know it'll stick.** No real-time authorization like cards. Returns land 2-5 days later - **R01 (insufficient funds) you can retry. R10 you can't.** R10 means unauthorized, and that's a fraud signal. Stop debiting that account - **Nacha's ceilings: 0.5% unauthorized, 3% administrative.** Your bank enforces them. Cross one and ACH origination can get suspended - **Verify the account before you debit it.** That's the highest-ROI fraud control on ACH. Plaid and MX pay for themselves fast ::: ACH settles before anyone knows whether it'll stick. There's no real-time authorization. A card gives you an answer on the spot. ACH just goes. Then a return lands days later. Maybe the account was empty. Maybe the customer told their bank they never agreed to it. You're always working on a delay. This page covers the return codes that matter, then verification tools, retry logic, and Nacha's thresholds. :::tip[If You're Under $1M/Year on ACH] Start with account verification on new customers and ignore risk scoring for now. Your volume doesn't justify the cost or complexity of Plaid Signal or similar tools. ::: ## The Big Four Return Codes These are the returns you'll see 90%+ of the time: | Code | Name | What It Really Means | Your Exposure | |------|------|---------------------|---------------| | R01 | Insufficient Funds | Account is empty or overdrawn | Retry in a few days, might work | | R02 | Account Closed | Account no longer exists | Don't retry, get new payment method | | R03 | No Account/Unable to Locate | Account number is wrong | Data entry error, verify with customer | | R10 | Customer Advises Unauthorized | Customer told their bank they didn't authorize this | This is the ACH version of a chargeback | **R10 is the scary one.** It means the customer went to their bank and said "I didn't authorize this." Even if they did authorize it, you now have a dispute on your hands and potential issues with your ACH provider. ## Less Common But Important | Code | Name | When You'll See It | |------|------|--------------------| | R05 | Unauthorized Consumer Debit | Consumer account debited using a corporate SEC code (CCD/CTX instead of PPD/WEB) | | R07 | Authorization Revoked | Customer cancelled their authorization | | R08 | Payment Stopped | Customer put a stop payment on this specific transaction | | R09 | Uncollected Funds | Funds exist but aren't available yet | | R29 | Corporate Customer Advises Not Authorized | R10 equivalent for business accounts | See [ACH Return Codes](/docs/reference/return-codes/ach) for the complete list. ## Nacha Thresholds Your bank or processor will usually warn you before Nacha does, but they're reacting to the same numbers: | Metric | Target | Yellow Flag | Red Flag | |--------|--------|-------------|----------| | Overall return rate | Under 3% | 3-15% | Over 15% | | Unauthorized rate (R05/R07/R10/R11/R29/R51) | Under 0.25% | 0.25-0.5% | Over 0.5% | | Administrative rate (R02/R03/R04) | Under 1.5% | 1.5-3% | Over 3% | *Nacha's formal enforcement thresholds: 0.5% unauthorized, 3% administrative, 15% overall. The targets above are deliberately tighter.* **R10s are different.** One R10 might be a confused customer. Three R10s in a month is a pattern your processor will notice. Five and you'll get a call. ## Verification Stack From cheapest to most expensive: ### 1. Micro-deposits (Cheapest, Slowest) Send two small deposits (usually $0.01-$0.99), customer confirms the amounts. **Good for:** Low-risk recurring payments where you can wait 2-3 days **Bad for:** Anything time-sensitive, high-value first transactions **Cost:** Pennies per verification ### 2. Instant Account Verification Connect to customer's bank via Plaid, Stripe Financial Connections, Finicity, or MX. Verify account ownership instantly. **Good for:** Most ecommerce and subscription businesses **Bad for:** Customers who won't connect their bank (some demographics resist this) **Cost:** $0.50-2.00 per verification ### 3. Balance Check Same connection as above, but also check current balance. **Where this breaks:** Balance checks are a snapshot, not a promise. The customer can drain the account between your check and the debit. Useful for flagging obviously-empty accounts, not for guaranteeing payment. ### 4. Risk Scoring (Plaid Signal, etc.) ML-based scoring using account history, balance patterns, identity signals. **Good for:** High-value transactions, lending, insurance premiums **Bad for:** Low-value transactions where the cost doesn't justify the risk reduction **Cost:** $1-5+ per transaction ## Volume-Tiered Recommendations **Under $100K/year ACH:** - Micro-deposits for new customers - Manual review of any R01s before retry - That's it **$100K-$1M/year:** - Instant account verification for all new customers - Basic balance check for transactions over $500 - Track your R01 rate weekly **$1M-$10M/year:** - Plaid (Auth + Balance) or equivalent - Consider Plaid Signal for high-value transactions - Automated retry logic for R01s - R10 investigation workflow **Over $10M/year:** - Full verification stack - Risk scoring on all transactions - Dedicated ACH operations monitoring - Direct Nacha membership consideration :::tip[Experiment to Run: Balance Check ROI] **Hypothesis:** Balance checks will reduce R01 returns enough to justify the cost. **Test:** For 30 days, run balance checks only on first debits over $500. Compare R01 rates vs. segment with no checks. **Metrics:** R01 rate, balance check cost, net savings **Decision rule:** If (R01 reduction ร— average recovery cost) > balance check cost, keep it **Typical result:** Balance checks have diminishing returns under $500. Test your own break-even. ::: ## Verification Tool Comparison | Tool | Coverage | Strength | Best For | |------|----------|----------|----------| | Plaid (Auth, Identity, Balance, Signal) | Broadest | Most features, best known | Default choice for most | | Stripe Financial Connections | Good | Tight Stripe integration | Already on Stripe | | Finicity (Mastercard) | Good | Enterprise features | Large volume, need alternatives | | MX | Strong in credit unions | CU coverage | Customers at credit unions | **Honest take:** Plaid has the most coverage and is the default for a reason. The others are worth evaluating if you're large enough to negotiate pricing or have specific coverage gaps. ## Retry Logic for R01s When you get an R01 (insufficient funds), don't immediately give up: **Timing matters:** - Retry 3-5 business days later - If monthly payment, try around typical payday (1st, 15th) - Max 2-3 retries before giving up **Don't retry:** - R02 (closed account) - Account is gone - R03 (can't locate) - Wrong account number - R10 (unauthorized) - They've disputed, stop trying ## Handling R10s An R10 is a claim of unauthorized transaction. Treat it seriously: 1. **Stop all debits** to that customer immediately 2. **Pull the authorization records** - Do you have signed ACH authorization? 3. **Check for fraud signals** - New customer? Changed bank details recently? 4. **Respond to your processor** within 24 hours if they ask If you have clear authorization documentation and the customer is lying, you can dispute the R10. But it's an uphill battle and often not worth the effort for small amounts. ## Where This Breaks **Balance checks don't prevent R01s:** A customer can have $5,000 when you check and $0 when you debit. Balance is directional, not deterministic. **Weekend timing:** ACH doesn't process on weekends or bank holidays. A debit initiated Friday might not settle until Tuesday, giving three days for the balance to change. **Business vs Consumer accounts:** Different rules, different protections. Business accounts have fewer protections, which cuts both ways. **Same-day ACH limitations:** Same-day ACH has dollar limits and cutoff times. Not all transactions qualify. ## Next Steps **Setting up ACH operations?** 1. [Know the big four returns](#the-big-four-return-codes) - R01, R02, R03, R10 2. [Choose verification stack](#verification-stack) - Micro-deposits to risk scoring 3. [Follow volume recommendations](#volume-tiered-recommendations) - Right-sized approach **Handling ACH returns?** 1. [Implement retry logic](#retry-logic-for-r01s) - When to retry R01s 2. [Handle R10s properly](#handling-r10s) - Unauthorized claims 3. [Stay under Nacha thresholds](#nacha-thresholds) - Target metrics **Choosing verification tools?** 1. [Compare verification options](#verification-stack) - Cost vs coverage 2. [Evaluate tools](#verification-tool-comparison) - Plaid, Stripe, Finicity 3. [Consider balance checks](#3-balance-check) - Test ROI before committing --- ## Related - [ACH Return Codes](/docs/reference/return-codes/ach) - Complete code reference - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - ACH vs wire vs RTP - [Holds and Reserves](/docs/operations/holds-and-reserves) - What happens when your ACH risk spikes - [Settlement & Reconciliation](/docs/payments/settlement) - When money moves - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Fraud Prevention](/docs/fraud/prevention) - Prevention strategies - [Third-Party Fraud](/docs/fraud/types/third-party) - Unauthorized transaction fraud - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party dispute abuse - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Managing recurring ACH - [Payout Strategy](/docs/operations/payout-strategy) - Settlement timing - [Regulation E](/docs/compliance/consumer-protection/reg-e) - Consumer liability for EFT - [Operations Metrics](/docs/operations/metrics) - Tracking performance - [Outbound ACH Fraud](/docs/fraud/types/outbound-ach-fraud) - Supplier payment fraud and ACH origination risks --- ## Alerts Configuration Source: https://paymentsandrisk.com/docs/operations/alerts-configuration # Alerts Configuration :::info[TL;DR] - Processor email alerts going to spam is the most common reason merchants discover chargebacks days late - verify your notification routing right now - Chargeback alerts need immediate action; most processor dispute windows are 20-45 days, and operational time gets eaten fast if you don't route these to real inboxes - Set up escalation routing to at least one backup recipient - a single point of failure in payment alerts costs you money when that person is on vacation - Test your alerts before you need them; an untested alert is unreliable by definition ::: You can't respond to problems you don't know about. Most merchants discover chargebacks days late, miss KYC document requests, and find out about payout issues when payroll bounces. Proper alerts turn reactive firefighting into proactive management. ## What Matters 1. **Email alerts are the minimum.** If your processor emails go to spam, you're blind. 2. **Chargeback alerts need immediate action.** Hours matter for response windows. 3. **Escalation routing prevents single points of failure.** Backup recipients are mandatory. 4. **Test your alerts.** An untested alert is an unreliable alert. 5. **Alert fatigue is real.** Too many low-priority notifications and you'll ignore the important ones. --- :::tip[Solo Operator? Start Here (3 Alerts Only)] If you're a one-person operation with limited time, enable only these three alerts and ignore everything else on this page: 1. **Chargeback notification** - So you don't miss response deadlines (check that processor emails aren't going to spam) 2. **Payout failure** - So you know immediately if your money stops flowing 3. **Account health warning** - So you're not blindsided by a ratio threshold breach That's it. The rest of the alerts below are for when you have bandwidth to act on them. Adding alerts you'll ignore creates noise that buries the ones that matter. Come back to Tier 2 when you're past $100K/month. ::: ## Essential Alerts to Enable ### Tier 1: Enable Immediately | Alert | Why It's Critical | Response Time | |-------|-------------------|---------------| | **Chargeback notification** | Dispute response deadlines are short | Within 24 hours | | **Fraud alert (TC40/SAFE)** | Early warning of fraud reports | Within 48 hours | | **KYC/KYB document request** | Delays cause payout holds | Within 24 hours | | **Account health warning** | Approaching thresholds | Same day | | **Payout failure** | Cash flow impact | Immediate | ### Tier 2: Enable for Operational Visibility | Alert | Why It Matters | Response Time | |-------|----------------|---------------| | **Large transaction alert** | Fraud/error detection | Same day review | | **Deposit confirmation** | Cash flow tracking | Daily reconciliation | | **Reserve change** | Cash flow impact | Within 48 hours | | **Failed transaction spike** | Technical or fraud issue | Within hours | | **Refund velocity alert** | Abuse or operational issue | Same day | ### Tier 3: Enable Based on Volume | Alert | When to Enable | |-------|----------------| | **Auth rate drop** | Over $100k/mo | | **Decline code distribution shift** | Over $100k/mo | | **Velocity threshold breach** | If you have velocity rules | | **3DS challenge rate spike** | If using 3DS | --- ## Email Deliverability Setup Alerts are useless if they go to spam. ### Before Launch 1. **Allowlist processor domains** - Add processor email domains to safe senders - Common: `@stripe.com`, `@squareup.com`, `@paypal.com`, `@braintreegateway.com` - Check your processor's documentation for all sending domains 2. **Use a dedicated inbox** - Create `payments@yourcompany.com` or similar - Don't use a personal inbox that gets cluttered 3. **Add backup recipients** - At least two people on critical alerts - Different email domains if possible (backup on personal email) 4. **Check spam folder during week 1** - After enabling alerts, check spam daily for first week - Train spam filter by marking legitimate alerts as "not spam" ### Test Email Delivery 1. Trigger a test alert (most processors have test mode) 2. Verify arrival in primary inbox 3. Check arrival at backup recipient 4. Measure delivery time (should be near-instant) --- ## Escalation Configuration ### Who Gets What | Alert Type | Primary | Backup | Escalation | |------------|---------|--------|------------| | **Chargebacks** | Ops lead | Finance | Owner/CFO if no response in 24h | | **KYC requests** | Finance | Ops lead | Owner if no response in 12h | | **Payout issues** | Finance | Owner | N/A | | **Fraud alerts** | Fraud/ops | Owner | N/A | | **Technical alerts** | Dev/tech | Ops | N/A | ### Time-of-Day Routing If your processor supports it: - **Business hours:** Route to ops team - **After hours:** Route to on-call or owner - **Weekends:** Route to personal email with text backup ### Backup Recipient Rules - **Always have a backup.** Single points of failure = missed alerts. - **Different person, not just different email.** Two emails to the same person doesn't help if they're on vacation. - **Different domain for critical alerts.** If company email goes down, personal backup still works. --- ## Testing Your Alerts ### "Prove Alerts Fire" Checklist Before going live, verify each critical alert: - [ ] **Triggered test chargeback notification** (via sandbox/test mode) - [ ] **Verified email arrived in inbox** (not spam) - [ ] **Confirmed backup recipient received copy** - [ ] **Tested response workflow** (clicked links, accessed dashboard) - [ ] **Verified mobile delivery** (if using mobile email) - [ ] **Tested webhook delivery** (if applicable) ### Periodic Fire Drills Monthly or quarterly: 1. Trigger a test alert 2. Time response from alert to action 3. Verify all recipients received it 4. Document any failures and fix ### What to Do When Test Fails | Failure | Fix | |---------|-----| | **Alert didn't send** | Check processor settings, contact support | | **Alert went to spam** | Add to safe senders, train filter | | **Backup didn't receive** | Verify backup email, check their spam | | **Delayed delivery** | Check processor status, consider SMS backup | --- ## Webhook Basics for Operators Webhooks are automated notifications from your processor to your systems. You don't need to code them, but you need to know if they're working. ### What a Webhook Is - **Push notification to your system** (not email) - **Triggers automated workflows** (update database, send internal alert) - **Real-time delivery** (faster than email) ### Operator Questions to Ask :::note[Ask Your Dev] "Are our webhooks configured and monitored? How do we know if a webhook fails? What alerts depend on webhooks?" ::: ### What Happens When Webhooks Fail - **Silent failures:** You don't know something happened - **Delayed processing:** Orders sit in limbo - **Missed chargebacks:** Response deadlines pass - **Reconciliation gaps:** Systems out of sync ### Webhook Monitoring Ask your dev team to confirm: - Webhook endpoint is monitored for uptime - Failed webhook deliveries trigger alerts - Retry logic handles temporary failures - Logs exist for debugging --- ## Alert Fatigue Prevention Too many alerts = ignored alerts. ### Consolidation Strategies | Instead of | Do This | |------------|---------| | Alert per transaction over $100 | Daily digest of large transactions | | Every declined transaction | Alert only if decline rate spikes | | Every refund | Alert only if refund velocity exceeds threshold | ### Priority Levels | Priority | Examples | Delivery | |----------|----------|----------| | **Critical** | Chargeback, KYC request, payout failure | Immediate email + SMS if available | | **High** | Large transaction, fraud alert, reserve change | Immediate email | | **Medium** | Auth rate shift, decline pattern change | Daily digest | | **Low** | Routine confirmations | Weekly digest or dashboard only | ### Review and Prune Monthly: - Which alerts did you act on? - Which alerts did you ignore? - Turn off or digest the ignored ones --- ## Processor-Specific Setup ### Stripe **Dashboard:** Settings โ†’ Business settings โ†’ Notifications Key alerts: - Disputes (chargebacks) - Payouts - Account updates (verification requests) - Radar alerts, if you're on a paid Radar tier (Standard, Plus or Pro) ### Square **Dashboard:** Settings โ†’ Notifications Key alerts: - Disputes - Deposit notifications - Account alerts ### PayPal **Dashboard:** Settings โ†’ Notifications Key alerts: - Dispute notifications - Transaction alerts - Account limitations ### Braintree **Control Panel:** Settings โ†’ Notifications Key alerts: - Dispute notifications - Webhook configurations - Account alerts --- ## Test to Run **1-week alerts audit:** **Day 1-2:** Setup - Document current alert configuration - Identify missing critical alerts - Add backup recipients - Check spam folders **Day 3-5:** Verify - Trigger test alerts for each type - Verify delivery to primary and backup - Time delivery speed - Test response workflow **Day 6-7:** Optimize - Remove low-value alerts - Consolidate into digests where appropriate - Document final configuration **Success criteria:** All Tier 1 alerts enabled and tested. Backup recipients confirmed. No alerts going to spam. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Tier 1 alerts only. Email is fine. Owner as primary and backup recipient. | | **$100k-$1M/mo** | Tier 1 + Tier 2. Dedicated payments inbox. Ops lead as primary. | | **Over $1M/mo** | All tiers. Webhook-based automation. Dedicated monitoring. On-call rotation for critical alerts. | --- ## Where This Breaks 1. **Email deliverability problems.** Alerts going to spam is the #1 failure. Check weekly until you trust the setup. 2. **Alert fatigue.** If you're ignoring alerts, you'll miss the important one. Prune aggressively. 3. **Single recipient failures.** Person on vacation, email full, left the company. Always have a backup. 4. **Webhook silent failures.** If your system depends on webhooks and they fail silently, you're blind. Monitor webhook health. --- ## Cross-Links **Understand payout timing before setting alert expectations:** - [Payout Strategy](/docs/operations/payout-strategy): know when money should arrive so you can alert on delays **Related operational guides:** - [Processor Reporting Checklist](/docs/reference/processor-reporting-checklist) - Data requirements - [Operations Index](/docs/operations) - Full operations guide - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Ethoca, Verifi details - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking ratios - [Fraud Metrics](/docs/fraud/metrics) - Monitoring fraud rates - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold monitoring - [Holds and Reserves](/docs/operations/holds-and-reserves) - Understanding holds - [Reading Statements](/docs/operations/reading-statements) - Understanding costs - [Processor Management](/docs/operations/processor-management) - Working with processors - [Operations Checklist](/docs/operations/checklist) - Daily monitoring routine - [Who Owns What](/docs/operations/who-owns-what) - Alert routing ownership - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - When alerts show spikes --- ## Next Steps **Setting up alerts?** 1. [Enable Tier 1 alerts](#tier-1-enable-immediately) - Chargebacks, fraud, KYC, payouts 2. [Fix email deliverability](#email-deliverability-setup) - Check spam, allowlist domains 3. [Add backup recipients](#backup-recipient-rules) - Different person, different domain **Testing alerts?** 1. [Run prove alerts fire checklist](#prove-alerts-fire-checklist) - Test each critical alert 2. [Verify backup delivery](#testing-your-alerts) - All recipients receive 3. [Schedule periodic fire drills](#periodic-fire-drills) - Monthly or quarterly **Reducing alert fatigue?** 1. [Consolidate to digests](#consolidation-strategies) - Daily instead of per-transaction 2. [Set priority levels](#priority-levels) - Critical vs low 3. [Review and prune monthly](#review-and-prune) - Turn off ignored alerts --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Alert-to-action time** | Response speed | Critical: same day | | **Alert volume by type** | Noise level | Trend down over time | | **Missed alert rate** | Deliverability issues | 0% | | **False positive rate** | Alert quality | Minimize | | **Escalation frequency** | Primary recipient reliability | Rare | --- ## Cash Flow Forecasting with Payment Float Source: https://paymentsandrisk.com/docs/operations/cash-flow-forecasting # Cash Flow Forecasting with Payment Float :::info[TL;DR] - Payment float puts your cash 2-3 business days behind your sales. You can't spend Tuesday's revenue until Thursday or Friday. - Model three scenarios every week. Normal, refund spike, chargeback hold. The one you skip is the one that hits you. - Fifteen minutes a week of forecasting saves more businesses than any fraud tool. Cash flow kills more SMBs than fraud does. - Your formula: expected weekly cash = projected sales x (1 - reserve%) - refunds - chargebacks - fees, shifted by your payout delay. ::: Your money arrives days after you earn it. Forecasting is how you keep that gap from breaking you. You already know [how payouts work](/docs/operations/payout-strategy). Settlement timing, batch cutoffs, reserves. That page has the mechanics. This one answers the next question. How do you actually plan around it? Cash flow kills more small businesses than fraud does. The money's coming, it just arrives on the wrong day. You sold $40K last week, and payroll is due today. Your processor hasn't deposited yet. That gap between earning money and having money is where businesses break. --- ## The Cash Flow Gap Every card sale creates a timing mismatch. You deliver on Day 0. The cash lands Day 2 or 3. Suppliers, payroll and rent don't wait for it. ```mermaid flowchart TD A["Sale CapturedDay 0"] --> B["Batch SettlesDay 1"] B --> C["Payout ArrivesDay 2-3"] D["Supplier InvoiceDue Day 30"] -.->|"You need cash HERE"| E["Pay Supplier"] F["PayrollDue Day 15"] -.->|"You need cash HERE"| G["Pay Staff"] H["Rent / SaaS BillsDue Day 1"] -.->|"You need cash HERE"| I["Pay Bills"] C -->|"Cash available"| J["Bank Account"] J --> E J --> G J --> I style A fill:#3b82f6,color:#fff style C fill:#22c55e,color:#fff style D fill:#f59e0b,color:#fff style F fill:#f59e0b,color:#fff style H fill:#f59e0b,color:#fff ``` **The core problem**: revenue flows in continuously. Obligations hit on fixed dates. A $100K month sounds great. Then $15K is in reserve, $8K in refunds hasn't settled, and payroll lands three days before your biggest weekly payout. --- ## Building Your Forecast Model Stop guessing. Use this formula: ``` Expected Weekly Cash = (Projected Sales x (1 - Reserve%)) - Refunds - Chargebacks - Fees shifted forward by your payout delay (T+2 or T+3, where T+X = funds arrive X days after transaction) ``` Week 1 sales produce cash in Week 1 plus your delay. On T+2 with a Friday batch cutoff, Monday through Thursday sales arrive Wednesday through Saturday. Friday sales land the following Tuesday. ### Input Variables Every number comes from something you already have. Where to find each one: | Variable | Where to Find It | Update Frequency | |----------|------------------|------------------| | **Projected weekly sales** | POS/e-commerce dashboard, trailing 4-week average | Weekly | | **Reserve percentage** | Processor agreement or merchant portal | Check monthly | | **Refund rate** | Processor dashboard, returns report | Weekly | | **Chargeback volume** | Processor dashboard, [chargeback metrics](/docs/chargebacks/metrics) | Weekly | | **Processing fees** | Monthly statement, [effective rate](/docs/operations/reading-statements) | Monthly | | **Payout delay (T+X)** | Processor agreement, deposit history | Verify quarterly | | **Batch cutoff time** | Processor docs or support | Set once | | **Upcoming fixed costs** | Accounting software, bill calendar | Weekly | ### Example: $80K/Month E-Commerce Store - Weekly sales projection: $20,000 - Rolling reserve: 10% ($2,000 held) - Refund rate: 3% ($600) - Chargeback rate: 0.5% ($100) - Processing fees: 2.9% ($580) - Payout delay: T+2 **Expected weekly cash arriving**: $20,000 - $2,000 - $600 - $100 - $580 = **$16,720** That's 83.6% of gross sales. Plan your expenses around the full $20K and you're short every single week. --- ## Three Scenarios to Model Run your numbers through three scenarios every week. Five minutes, once you have a template. ### Scenario 1: Normal Operations Use your trailing 4-week averages for sales, refunds and chargebacks. That's your baseline, the week where nothing unusual happens. **Assumption**: sales within 10% of average, refund rate under 3%, chargebacks under 0.5%. ### Scenario 2: Refund Spike A product recall, a viral complaint, a seasonal return wave like January on holiday sales. Refunds can hit 8-15% of weekly volume for 2-4 weeks. **Model this**: swap your normal refund rate for 10%. On the $20K/week store above, $600 in refunds becomes $2,000. Weekly cash drops $1,400. **Why it matters**: refunds hit your account as debits. On a thin balance, a spike can overdraft your deposit account before you notice. ### Scenario 3: Chargeback Hold Your [chargeback rate](/docs/chargebacks/metrics) crosses 0.9%. The processor flags the account. Your reserve jumps from 10% to 25%. Or payouts pause entirely for the review. **Model this**: set the reserve to 25% and add a 5-day payout delay. On the $20K/week store, $2,000 in reserves becomes $5,000. Every dollar arrives a week later. **Why it matters**: this is the scenario that bankrupts businesses. The money isn't gone, it comes back eventually. Payroll and rent just don't wait for a risk team to finish reviewing. See [holds and reserves](/docs/operations/holds-and-reserves) for how to respond. | Scenario | Weekly Cash | vs. Normal | Cash Gap Risk | |----------|-------------|------------|---------------| | **Normal** | $16,720 | Baseline | Low | | **Refund spike (10%)** | $15,320 | -$1,400 | Medium | | **Reserve increase (25%)** | $13,720 | -$3,000 | High | | **Payout pause (7 days)** | $0 for first week | -$16,720 | Critical | --- ## Cash Flow by Business Type The timing mismatch looks different depending on what you sell. ### E-Commerce / Inventory Businesses **The gap**: you buy inventory on Day 0. You pay the supplier on Day 30. The product sells on Day 45-60 and the card revenue lands Day 47-63. That's a 30-60 day hole between cash out and cash in. **What helps**: negotiate net-60 supplier terms. Use purchase order financing on large orders. Keep 2-3 weeks of operating expenses in reserve. Track inventory turnover next to your cash forecast. ### SaaS / Subscription Businesses **The gap**: small day to day, since recurring revenue is predictable. Annual plan refunds are the hidden risk. One enterprise customer cancelling a $12K annual subscription puts a $12K hole in the month. **What helps**: model annual plan exposure separately. If 30% of revenue is annual plans, hold a buffer of your largest single-plan refund times three. Watch for [friendly fraud](/docs/fraud/types/friendly-fraud) on annual renewals. ### Service Businesses **The gap**: you pay staff on the 1st and 15th. Clients pay net-30, if you're lucky. Cards help, but most service businesses still invoice. So the real delay is 30-45 days, not 2-3. **What helps**: move as much billing to card-on-file as you can. Offer invoice clients 2% off for paying inside 10 days. Track card revenue and invoice revenue separately, because one is fast and one is slow. ### Seasonal Businesses **The gap**: revenue lands in 3-4 months. Expenses spread across 12. Peak season has to fund 6-8 months of little or nothing. **What helps**: set aside 30-40% of net revenue during peak, in your own reserve account. Not the processor's. Model your off-season burn rate and work backward to the minimum peak-season target. --- ## When Cash Gets Trapped Sometimes it isn't timing. Sometimes your money is being held. These need action, not planning. **Reserve increases**: the processor raises your rolling reserve from 5% to 15% after a chargeback spike. On $80K a month that's another $8,000 locked up. See [holds and reserves](/docs/operations/holds-and-reserves). **Payout holds**: deposits stop dead. Usually a volume spike, a chargeback threshold breach or a risk review. It can run 3 to 30 days. Your buffer has to cover that window. **Chargeback cascades**: one product issue triggers 50 chargebacks in a week. Each one comes off your next payout. If the total beats the payout, your processor debits your bank account. See [chargeback metrics](/docs/chargebacks/metrics) for thresholds. **Processor account review**: they decide to look at your account. Maybe a volume milestone. Maybe your [MCC code](/docs/reference/mcc-codes) drew attention. Payouts slow or stop while they look. :::warning[Emergency Buffer Rule] Keep two weeks of fixed operating expenses in a separate bank account. Payroll, rent, the subscriptions you can't lose. Don't connect it to your processor. That's your survival fund when payouts stop. ::: --- ## Simple Weekly Forecast Process It takes 15 minutes once you've done it twice. Monday morning. **Step 1 - Record last week's actuals (3 minutes)** Log actual deposits, refunds, chargebacks and fees. Compare to your forecast. Off by more than 10%? Find out why. **Step 2 - Project this week's sales (3 minutes)** Use your trailing 4-week average. Adjust for what you know about this week: a promotion, a seasonal shift, a launch. Don't overthink it. The average is usually close enough. **Step 3 - Apply the formula (2 minutes)** Projected sales x (1 - reserve%) - expected refunds - expected chargebacks - fees = expected cash. Shift by your payout delay to see which days the cash actually lands. **Step 4 - Check against obligations (4 minutes)** Map daily cash arrivals against what's due. Payroll, suppliers, subscriptions, rent. Flag any day where outflows beat your projected balance. **Step 5 - Run the stress scenario (3 minutes)** Pick whichever scenario feels likeliest this week and re-run the numbers. Still solvent under stress? You're fine. If not, move money or delay a payment now. Not Friday. --- ## Tools That Help You don't need expensive software. Start simple and add a tool when manual tracking breaks down. | Tool | Cost | Best For | Limitations | |------|------|----------|-------------| | **Spreadsheet (Google Sheets/Excel)** | Free | Everyone starting out | Manual data entry, easy to forget | | **Float** | $59+/month | Visual cash flow forecasting | Needs accounting software integration | | **Pulse** | $29+/month | Simple scenario modeling | Limited integrations | | **Fathom** | $39+/month | Reporting and forecasting combined | Overkill for small businesses | | **Processor dashboard** | Free | Real-time deposit tracking | No forecasting, just actuals | | **Your accounting software** | Varies | Cash flow reports built in | Forecasting features vary widely | **Under $500K a month**: a spreadsheet with your formula, updated weekly. You'll know when you've outgrown it. Two weeks running where you miss the forecast by 20% because you couldn't track every variable. Then move to Float or something like it. See [scaling milestones](/docs/operations/scaling-milestones) for the upgrade points at each volume tier. --- ## Next Steps Your next move depends on where you are: - **Just starting on cash flow planning?** Go back to [payout strategy](/docs/operations/payout-strategy). Know your exact payout timing, batch cutoff and reserve terms. You can't forecast what you can't measure. - **Forecasting already, but worried about disruptions?** Read [holds and reserves](/docs/operations/holds-and-reserves). It covers what triggers a hold and how to get money released faster. - **Outgrowing manual processes?** Check [scaling milestones](/docs/operations/scaling-milestones) for the volume thresholds where better tooling pays for itself. --- ## Related Pages - [Payout Strategy](/docs/operations/payout-strategy) - settlement timing, batch cutoffs and reserve structures - [Holds and Reserves](/docs/operations/holds-and-reserves) - types of holds, how to respond, how to get funds released - [Settlement Timing](/docs/payments/settlement/timing) - when an authorization becomes settled funds - [Reconciliation](/docs/payments/settlement/reconciliation) - matching expected deposits to actual arrivals - [Accounting Integration](/docs/operations/accounting-integration) - connecting processor data to your books - [Reading Your Processor Statement](/docs/operations/reading-statements) - fees, and your effective rate - [Scaling Milestones](/docs/operations/scaling-milestones) - what to add at each volume tier - [Chargeback Metrics](/docs/chargebacks/metrics) - the thresholds that trigger reserves and holds --- ## Payment Change Checklist Source: https://paymentsandrisk.com/docs/operations/change-checklist # Payment Change Checklist :::info[TL;DR] - If a checkout change can move authorization rate, fraud rules or payment method availability, it doesn't ship without sign-off from whoever owns payments or risk - The minimum test set before shipping: one successful card payment, one declined card, and one refund processed in the staging environment - Billing descriptor changes take effect within 1-5 business days but can't be rolled back instantly - test and confirm before pushing live - Post-deploy, watch auth rate and error rate for 24 hours. A 2%+ drop in auth rate isn't noise, it's a rollback conversation ::: If a change can break [auth rate](/docs/payments/reference/authorization-basics), it needs sign-off from whoever owns payments or fraud. Checkout is where the money happens. A change that looks minor can tank conversion, trip fraud rules or create disputes. Test it before you ship it, because you won't get a warning. :::tip[Minimum for Solo Operators] Run at least these tests before you ship any checkout change: - [ ] One successful card payment - [ ] One forced decline (use test card or wrong CVV) - [ ] One refund - [ ] Confirmation email renders correctly ::: ## Pre-Deploy Checks :::tip[No Staging Environment?] Many SMBs don't have a staging environment - they test on production. That's fine if you're careful: 1. Process a real $1.00 test transaction with your own card 2. Verify the charge appears in your processor dashboard 3. Process a refund on that test transaction 4. Confirm the refund appears in your dashboard and your email This takes 5 minutes and catches 90% of integration issues. Do it every time you change anything in checkout. ::: ### For Any Checkout Change - [ ] Payment flow works end-to-end in staging (or via real $1 test transaction if no staging) - [ ] Successful transaction creates correct order - [ ] Declined transaction shows appropriate error - [ ] Refund flow works - [ ] Confirmation emails send and render correctly - [ ] Transaction appears in processor dashboard - [ ] Amount matches order total (including tax, shipping) ### For Payment Method Changes Adding or removing payment methods: - [ ] New method enabled in processor dashboard - [ ] Fallback works if new method fails - [ ] Currency handling correct - [ ] Mobile experience tested - [ ] Fraud rules updated if needed (different signals for different methods) ### For Fraud Rule Changes - [ ] Rule tested against historical transactions - [ ] False positive estimate acceptable - [ ] Monitoring in place for first 24-48 hours - [ ] Rollback plan documented **If you're under $1M/year in volume:** Don't push more than one new rule a month. Always review every single block manually for the first day. ### For Processor Changes Switching processors or adding failover: - [ ] BIN routing tested (especially for international cards) - [ ] Billing descriptor matches old processor - [ ] Webhook/notification endpoints updated - [ ] Subscription migrations planned - [ ] Old processor stays active for chargebacks - [ ] Auth rates monitored closely first 2 weeks ## Common A/B Test Traps A/B testing checkout is high-stakes. Watch for: **Auth rate differences:** the test variant can have a lower auth rate that wipes out the conversion gain. Measure auth rate too, or you're reading half the result. **Fraud signal changes:** moving fields, changing where the device fingerprint loads, or adding inputs can all move fraud scoring. Your fraud tool won't tell you unless you ask. **Mobile vs desktop divergence:** Payment flows often break differently on mobile. Test both. **Timing issues:** Checkout A/B tests need longer to reach significance because of: - Chargebacks that appear 30+ days later - Subscription renewal effects - Fraud that takes time to surface **The trap:** Declaring a winner based on immediate conversion, then discovering 6 weeks later that the "winner" had 2x the chargebacks. ## For Agencies and Contractors If someone else is touching your checkout: ### Before They Start - [ ] Define exactly what they can and cannot change - [ ] Require staging deployment first - [ ] Require your sign-off before production - [ ] Document rollback procedure ### Specific Restrictions - **No changes to fraud parameters** without explicit approval - **No changes to billing descriptor** without testing - **No removal of security features** (CVV, 3DS, etc.) - **No direct database access** to payment tables ### After They Deploy - [ ] You (not they) verify payment flow works - [ ] Monitor auth rate for 48 hours - [ ] Check processor dashboard for anomalies ## Post-Deploy Monitoring ### First Hour - [ ] Auth rate within normal range - [ ] No error spikes in logs - [ ] Successful transactions appearing ### First Day - [ ] Auth rate stable - [ ] No unusual decline patterns - [ ] Fraud queue not spiking - [ ] Customer support not getting payment complaints ### First Week - [ ] Auth rate trend normal - [ ] No unexpected chargebacks appearing - [ ] Processor hasn't flagged anything ## Rollback Triggers Roll back immediately if: - Auth rate drops more than 5% without explanation - Error rate on checkout exceeds 2% - Fraud queue triples without traffic increase - Customers report payment failures - Processor contacts you about anomalies Don't wait to investigate. Roll back first, then figure out what happened. ## Where This Breaks **"Unrelated" changes:** the footer update that broke a JavaScript dependency the payment form needed. Test checkout even when the deploy "isn't related". **Third-party script updates:** analytics, chat widgets and the rest can conflict with payment iframes. They'll update without telling you, so test checkout after. **CDN and caching:** Payment pages should generally not be cached, but misconfigurations happen. Stale payment tokens cause confusing failures. **Test mode leakage:** you make a change in test mode and the test credentials go to production with it. Use separate API keys and enforce it at the environment level, because you can't catch this by reading the diff. ## Testing Card Numbers Use your processor's test cards. Common examples: | Card Number | Result | |-------------|--------| | 4242 4242 4242 4242 | Success | | 4000 0000 0000 0002 | Decline | | 4000 0000 0000 9995 | Insufficient funds | | 4000 0000 0000 3220 | 3DS required | Check your processor's documentation for their specific test cards. These are Stripe examples. ## Next Steps **Making a checkout change?** 1. [Run pre-deploy checks](#pre-deploy-checks) - Payment flow, errors, confirmation 2. [Test with test cards](#testing-card-numbers) - Success, decline, 3DS scenarios 3. [Set up post-deploy monitoring](#post-deploy-monitoring) - Auth rate, errors, queue **Changing fraud rules?** 1. [Follow fraud rule checklist](#for-fraud-rule-changes) - Backtest, estimate FP, monitor 2. [Test against historical transactions](#for-fraud-rule-changes) - Before deploying 3. [Set rollback triggers](#rollback-triggers) - Know when to revert **Switching processors?** 1. [Complete processor checklist](#for-processor-changes) - BIN routing, webhooks, descriptors 2. [Plan parallel running](#for-processor-changes) - Keep old active for chargebacks 3. [Monitor first 2 weeks](#for-processor-changes) - Auth rates closely --- ## Related - [Operations Checklist](/docs/operations/checklist) - Ongoing monitoring - [Processor Management](/docs/operations/processor-management) - When processor changes go wrong - [Auth Rate Optimization](/docs/playbooks/increase-auth-rates) - Improving auth performance - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing payment completion - [3D Secure](/docs/fraud/prevention/3ds) - Authentication changes - [Decline Codes](/docs/reference/decline-codes) - Understanding failures - [Fraud Prevention](/docs/fraud/prevention) - Rule change impacts - [Alerts Configuration](/docs/operations/alerts-configuration) - Monitoring setup - [PCI DSS](/docs/compliance/pci-dss) - Security requirements - [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) - Migration planning - [Payments Metrics](/docs/payments/metrics) - Tracking auth rate changes - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rule configuration impacts --- ## Operations Checklist Source: https://paymentsandrisk.com/docs/operations/checklist # Operations Checklist :::info[TL;DR] - **Daily (5-15 min)**: [Auth rate](/docs/payments/metrics), failed transactions, chargeback queue, fraud queue, deposits - **Weekly (30-45 min)**: Chargeback ratio trend, win rate, fraud rate by channel, refunds, processor emails - **Monthly (1-2 hr)**: Statement review, effective rate, reason code breakdown, rule performance - **Oh shit triggers**: Auth drops 10%+, 5+ CBs in a day, processor "review" email, payout delay - Scale: Solo operators just check CB count weekly and respond to disputes before expiry ::: If you process under 100 orders a day, the daily check is a 5-minute dashboard glance. It's the weekly rhythm that matters, not the daily noise. :::tip[Minimum Viable Version] **Solo operators:** Check your chargeback count weekly, respond to disputes before they expire, and verify deposits hit your bank. Everything else can wait until you're bigger. ::: ## Daily Checks (5-15 minutes) Skip these if you're under 100 orders/day. Look at the weekly pattern instead. | Check | What You're Looking For | Time | |-------|------------------------|------| | Auth approval rate | Sudden drop (>5% below baseline) | 2 min | | Failed transactions | Patterns in decline codes | 2 min | | Chargeback queue | New disputes to respond to | 3 min | | Fraud queue | Flagged orders awaiting review | 5 min | | Deposit verification | Yesterday's batch hit the bank | 2 min | **Sample size matters:** if you only had 20 orders yesterday, one decline moves your rate 5%. That isn't a signal. Look at the weekly pattern. ### Traffic Light Thresholds (Daily) | Metric | Green | Yellow | Red | |--------|-------|--------|-----| | Auth rate | Over 95% of baseline | 90-95% of baseline | Under 90% of baseline | | Fraud queue | Under 10 orders | 10-25 orders | Over 25 orders | | Failed auths | Under 3% | 3-5% | Over 5% | ## Weekly Checks (30-45 minutes) This is where the real patterns show up. | Check | What You're Looking For | Time | |-------|------------------------|------| | Chargeback ratio | Trend toward 0.65% threshold | 5 min | | Dispute win rate | Tracking representment success | 5 min | | Fraud rate by channel | Which traffic sources are risky | 10 min | | Refund rate | Unusual spikes (product issues?) | 5 min | | Processor communications | Any emails you missed | 5 min | | Payout reconciliation | All expected funds received | 10 min | ### Traffic Light Thresholds (Weekly) | Metric | Green | Yellow | Red | |--------|-------|--------|-----| | Chargeback ratio | Under 0.5% | 0.5-0.65% | Over 0.65% | | Fraud rate | Under 0.3% | 0.3-0.5% | Over 0.5% | | Dispute win rate | Over 40% | 25-40% | Under 25% | | Refund rate | Under 5% | 5-10% | Over 10% | :::tip[These Are Early Warnings, Not Enforcement Thresholds] The traffic light above is intentionally conservative. "Red" at 0.65% does **not** mean you're in a network monitoring program. It means you need to act now before you get there. Actual enforcement thresholds are higher: - **Visa VAMP** (effective April 2025): Merchant Excessive threshold is **1.5%** (2.2% in CEMEA), effective 1 April 2026, and only once you also hit 1,500 combined fraud reports and disputes in the month. VAMP includes both fraud reports and chargebacks in its ratio. - **Mastercard ECM** enforcement starts at **100-299 chargebacks** and a **1.50-2.99%** ratio, in the same month Catching problems at 0.65% costs far less than fixing them after enforcement. Once you're in a monitoring program, you face monthly fines, mandatory remediation plans, and potential [MATCH listing](/docs/chargebacks/match-tmf). See [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) for the full breakdown. ::: ## Monthly Checks (1-2 hours) | Check | What You're Looking For | Time | |-------|------------------------|------| | Processor statement review | Fee changes, rate creep | 20 min | | Effective rate calculation | Staying competitive | 10 min | | Chargeback reason code breakdown | What's driving disputes | 15 min | | Rule performance review | Any rule blocking >1% of traffic | 20 min | | Velocity threshold review | Still appropriate for volume? | 15 min | | Reserve/holdback status | When funds release | 10 min | ### Rule Performance Red Flags If a single rule is blocking more than 1% of traffic or driving more than 20% of blocks, review it. Either it's too aggressive, or you've got a real problem that needs a different fix. ## Oh Shit Triggers Stop what you're doing and investigate immediately: | Trigger | What It Means | First Action | |---------|---------------|--------------| | Auth rate drops >10% in an hour | Processor issue or you broke checkout | Check processor status page, test a transaction | | 5+ chargebacks in a day (if normally under 1) | Attack or product issue | Pull the orders, look for patterns | | Processor emails about "review" or "risk" | They're nervous about you | Reply within 2 hours, even if just "received, investigating" | | Payout delayed without explanation | They're holding your money | Call (don't email) and ask for risk/underwriting | | Chargeback ratio hits 0.75% | You're approaching program thresholds | See [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) | | Multiple R10 returns (ACH) | Someone claimed unauthorized | Stop debiting that customer, investigate immediately | ## Checklist by Team Size ### Solo Operator (No Dedicated Payments Person) **Daily:** Glance at dashboard for anything obviously wrong. 2 minutes. **Weekly:** - [ ] Check chargeback count (not ratio, just count) - [ ] Respond to any open disputes - [ ] Verify week's deposits - [ ] Read any processor emails **Monthly:** - [ ] Calculate effective rate from statement - [ ] Review chargeback reasons - [ ] Check if reserve is releasing on schedule ### Small Team (1-2 People Touch Payments) **Daily:** - [ ] Review fraud queue - [ ] Check for new disputes - [ ] Verify deposits **Weekly:** - [ ] Full metrics review (chargebacks, fraud, auth rate) - [ ] Processor communication review - [ ] Reconciliation check **Monthly:** - [ ] Statement deep dive - [ ] Rule performance review - [ ] Threshold adjustments ### Medium Team (Dedicated Fraud/Payments Person) Add to the above: **Daily:** - [ ] Auth rate monitoring with alerts - [ ] Fraud queue SLA tracking - [ ] Shift handoff notes **Weekly:** - [ ] Cross-functional sync (fraud + support + finance) - [ ] Vendor performance review - [ ] Channel-level fraud breakdown **Monthly:** - [ ] Vendor contract review - [ ] Threshold tuning session - [ ] Competitive rate check ## Monthly Experiments Pick one experiment each month. Don't do more than one at a time (you can't measure what worked). **Experiment ideas:** - [ ] Tighten one fraud rule, measure CB impact for 30 days - [ ] Change refund policy for one product category, measure dispute rate - [ ] Test new billing descriptor wording, compare recognition rates - [ ] Add delivery photos to representment packets, measure win rate change - [ ] Change retry timing for declined recurring payments, measure recovery rate **Template:** ``` Month: ___________ Experiment: ___________ Hypothesis: ___________ Metric: ___________ Result: ___________ Keep/Kill: ___________ ``` ## Where This Breaks **Flash sales and promotions:** your normal thresholds will throw false positives. Either adjust them beforehand or have someone ready to approve flagged orders fast, because they won't wait. **Seasonal businesses:** Weekly patterns are useless if you do 80% of volume in Q4. Build seasonal baselines. **New product launches:** Expect elevated chargebacks 30-45 days after launch as customers receive products and decide they're not happy. **International expansion:** Time zones mess with daily monitoring. A "spike" at 3am your time is somebody's normal business hours. ## Next Steps **Solo operator?** 1. [Use minimum viable checklist](#solo-operator-no-dedicated-payments-person) - CB count, disputes, deposits 2. [Know oh shit triggers](#oh-shit-triggers) - When to drop everything 3. [Monthly statement review](#monthly-checks-1-2-hours) - Effective rate, reason codes **Building operations routine?** 1. [Set up daily checks](#daily-checks-5-15-minutes) - Auth rate, fraud queue, deposits 2. [Establish weekly cadence](#weekly-checks-30-45-minutes) - Ratios, win rate, reconciliation 3. [Configure alerts](/docs/operations/alerts-configuration) - Automate what you can **Scaling team?** 1. [Match checks to team size](#checklist-by-team-size) - Solo vs small vs medium 2. [Run monthly experiments](#monthly-experiments) - One at a time, measure impact 3. [Account for edge cases](#where-this-breaks) - Flash sales, seasonal, international --- ## Related - [Operations Metrics](/docs/operations/metrics) - KPIs behind these checks - [Processor Management](/docs/operations/processor-management) - Handling scary emails - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - When thresholds approach - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking ratio and win rate - [Fraud Metrics](/docs/fraud/metrics) - Fraud rate monitoring - [Alerts Configuration](/docs/operations/alerts-configuration) - Setting up notifications - [Reading Statements](/docs/operations/reading-statements) - Monthly statement review - [Who Owns What](/docs/operations/who-owns-what) - Ownership clarity - [ACH Operations](/docs/operations/ach-operations) - Bank payment checks - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold monitoring - [Representment Workflow](/docs/operations/representment-workflow) - Dispute response - [Holds and Reserves](/docs/operations/holds-and-reserves) - Reserve monitoring --- ## Holds and Reserves Source: https://paymentsandrisk.com/docs/operations/holds-and-reserves # Holds and Reserves :::info[TL;DR] - **Rolling reserve**: 5-10% held per transaction, released 90-180 days after the **transaction date** (not the hold date) - **Upfront reserve**: Lump sum ($5K-$50K+) held until closure or risk improvement - **Payout hold**: Full payout stopped. Something triggered risk review (chargeback spike, volume spike) - **Response**: Get it in writing, provide documentation fast, ask for risk/underwriting (not frontline) - **MATCH list**: 5-year blacklist if terminated. Focus on getting funds released ::: Your processor is holding your money. It's stressful and it's usually not fatal. Knowing why they did it is what tells you how to respond. ```mermaid flowchart LR subgraph JAN["January Sales $100K"] J1[10% Reserved$10K held] end subgraph FEB["February Sales $100K"] F1[10% Reserved$10K held] end subgraph MAR["March Sales $100K"] M1[10% Reserved$10K held] end subgraph APR["April"] A1[Jan ReserveReleased $10K] end JAN --> FEB --> MAR --> APR J1 -.->|90 days| A1 style J1 fill:#ef4444,color:#fff style F1 fill:#ef4444,color:#fff style M1 fill:#ef4444,color:#fff style A1 fill:#22c55e,color:#fff ``` **At steady state:** You always have 3-6 months of reserves sitting with your processor. :::warning[Benchmark Caveat] The percentages below are typical ranges, not promises. High-risk verticals like travel, CBD, nutraceuticals, or high-ticket coaching will often see the top end of these numbers, or higher. ::: ## Types of Holds ### Rolling Reserve A percentage of each transaction is held and released on a delay (typically 90-180 days). **Typical terms:** - 5-10% of each transaction - Released 90-180 days after the original transaction - Continues until processor is comfortable with your risk **Example:** You process $100K in January with a 10% rolling reserve. $10K is held. In April (90 days later), that $10K releases. Meanwhile, you've built up reserves from February and March. **Cash flow impact:** At steady state, you always have ~3-6 months of reserves sitting with your processor. ### Upfront Reserve A lump sum held before you start processing, or demanded after a risk event. **Typical terms:** - $5K-$50K+ depending on volume and risk - Held until account closure or risk improvement - May be funded from withheld payouts **When you'll see this:** - New merchant in risky vertical - After chargeback spike - After volume spike that exceeded underwriting ### Payout Hold Your regular payout is delayed or stopped entirely. **Why this happens:** - Risk review triggered - Chargeback threshold exceeded - Suspicious activity flagged - Volume exceeded underwriting limits **This is the scary one.** A reserve you know about in advance. A payout hold means something's already gone wrong. ## Common Reserve/Hold Ranges | Scenario | Reserve/Hold | Duration | |----------|-------------|----------| | Low-risk ecommerce, established | 0-5% rolling | 30-90 days | | New merchant, low-risk | 5-10% rolling | 90-180 days | | Medium-risk vertical | 10-15% rolling | 180 days | | High-risk vertical | 15-20%+ rolling, plus upfront | 180+ days | | After chargeback spike | 10-20% increase, or upfront demand | Until ratios improve | | Risk review/investigation | Full payout hold | Until resolved | ## What Triggers Holds | Trigger | Processor Concern | Your Response | |---------|-------------------|---------------| | Chargeback ratio increase | Future losses | Provide remediation plan | | Volume spike | Underwriting mismatch | Explain the growth | | Refund spike | Product/service issues | Explain the cause | | Industry news | Vertical-wide concern | Proactive communication | | Account changes | Fraud risk | Provide documentation | ## When Funds Are Held: Step by Step ### Day 1-2: Assess 1. **Determine the type** - Is this a reserve increase, payout hold, or full freeze? 2. **Get it in writing** - Email your processor asking for specific reason and timeline 3. **Check your contract** - What did you agree to? ### Day 3-7: Respond 1. **Provide requested documentation** quickly 2. **Offer a call** with their risk/underwriting team 3. **Prepare a remediation plan** if chargebacks are the issue **What to say:** > We understand the need for additional review. We've prepared [documentation] and have implemented [specific changes] to address the concerns. We're available for a call at your convenience to discuss. ### If They're Unresponsive - **Escalate:** Ask for risk or underwriting, not frontline support - **Document everything:** Keep records of all communication - **Consult an attorney** if significant funds are held without explanation **Hard line:** If frontline support can't answer, ask for risk or underwriting specifically. Those are the teams that decide holds. ## Cash Flow Math Understanding your actual exposure: **Scenario:** $200K/month, 10% rolling reserve, 90-day release | Month | Processed | Held (10%) | Released | Net Reserve | |-------|-----------|------------|----------|-------------| | 1 | $200K | $20K | $0 | $20K | | 2 | $200K | $20K | $0 | $40K | | 3 | $200K | $20K | $0 | $60K | | 4 | $200K | $20K | $20K | $60K | At steady state, you have $60K sitting with your processor. Plan for this. ## Negotiating Reserve Terms :::info[If You're Under $250K/Month] You probably can't negotiate reserve terms yet. Processors set standard terms for smaller merchants, and there's no account manager to call. Your leverage comes from clean history over time - keep your chargeback ratio under 0.5% for 6+ months and your processor may automatically reduce your reserve. **What you CAN do at any volume:** Ask (via support ticket or email) for a reserve review after 6 months of clean processing. The worst they say is no. Don't threaten to leave - at this volume, they'll let you. ::: **When you have leverage:** - Clean history (6+ months, low chargebacks) - Growing volume - Long relationship **What to ask for:** - Reserve percentage reduction (10% โ†’ 5%) - Shorter release period (180 days โ†’ 90 days) - Cap on total reserve amount **What to offer:** - More transaction data/transparency - Faster response to risk inquiries - Higher minimum monthly volume commitment ## MATCH Listing If they say you're being MATCH listed (Member Alert to Control High-Risk Merchants, often called the TMF even though that's a separate Visa file), assume that processor relationship is over. **Focus on:** 1. Getting reserved funds released (they must release after liabilities clear) 2. Finding a specialist acquirer (some work with MATCH-listed merchants) 3. Understanding why you were listed (for next processor conversation) MATCH stays on your record for 5 years. Some codes are worse than others. A MATCH for chargebacks is more recoverable than a MATCH for fraud. ## Where This Breaks **Contract fine print:** Your processor can usually adjust reserves with little notice. Read the risk section, because that's where it's written. **Silent holds:** Some processors hold payouts and don't tell you. No news isn't good news. If your payout is late, ask that day. **Release timing:** The "90 days" starts from the transaction date, not the hold date. If you're on a rolling reserve, you're always building new reserves. **Reserve on closure:** When you close your account, reserves may be held 6-12+ months for chargebacks on past transactions. ## Next Steps **Funds just got held?** 1. [Assess the type](#day-1-2-assess) - Reserve increase, payout hold, or freeze? 2. [Get it in writing](#day-1-2-assess) - Ask processor for specific reason 3. [Respond quickly](#day-3-7-respond) - Provide documentation, offer call **Managing existing reserve?** 1. [Understand your exposure](#cash-flow-math) - Calculate actual cash locked up 2. [Know when to negotiate](#negotiating-reserve-terms) - Clean history = leverage 3. [Ask for reserve release](#negotiating-reserve-terms) - Reduce % or shorten release period **Facing MATCH listing?** 1. [Focus on fund release](#match-listing) - They must release after liabilities clear 2. [Find specialist acquirer](#match-listing) - Some work with MATCH merchants 3. [Understand the reason](#match-listing) - For next processor conversation --- ## Related - [Processor Management](/docs/operations/processor-management) - Working with your processor - [Dispute Monitoring Programs](/docs/compliance/network-rules/dispute-monitoring) - VAMP, ECM thresholds that trigger holds - [Network Programs](/docs/chargebacks/reference/network-programs) - MATCH and threshold details - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Improving the metrics that matter - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes before they happen - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking your ratios - [Fraud Prevention](/docs/fraud/prevention) - Reducing fraud-related holds - [Payout Strategy](/docs/operations/payout-strategy) - Understanding payout timing - [Settlement & Reconciliation](/docs/payments/settlement) - When money moves - [Reading Statements](/docs/operations/reading-statements) - Understanding your costs - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Operations Checklist](/docs/operations/checklist) - Daily monitoring - [Cash Flow Forecasting](/docs/operations/cash-flow-forecasting) - Planning around reserves and payment float --- ## Operations Metrics Source: https://paymentsandrisk.com/docs/operations/metrics # Operations Metrics :::info[TL;DR] - **Collections**: Contact rate over 50%, promise-kept over 60%, recovery rate over 5% - **Monitoring**: Alert response under 15 min (critical), false alert rate under 20% - **Reconciliation**: Match rate over 99%, exception rate under 1%, resolution under 24h - **Incident**: MTTD under 15 min, MTTR under 30 min, recurrence under 10% - Related: [Fraud Metrics](/docs/fraud/metrics), [Chargeback Metrics](/docs/chargebacks/metrics) ::: Operations metrics tell you whether your payment infrastructure is running smoothly. Fraud and chargeback metrics measure outcomes; operations metrics measure the machine. If reconciliation is breaking, alerts are slow, or incidents keep recurring, your outcomes will suffer no matter how good your fraud rules or chargeback representment are. Most SMBs don't need all of these on day one. Start with reconciliation and monitoring metrics. Add the rest as your volume and team grow. ## Collections Metrics :::info[Skip This Section If...] Collections metrics apply only if you invoice customers, run payment plans, or manage subscription dunning. If you're a standard e-commerce merchant where customers pay at checkout, skip to [Monitoring Metrics](#monitoring-metrics) below. ::: Relevant if you invoice customers, offer payment plans, or need to recover failed payments (including dunning for subscriptions). | Metric | Definition | Target | |--------|------------|--------| | Contact rate | Reached / Attempted | >50% | | Promise-to-pay rate | Promises / Contacts | >30% | | Promise kept rate | Kept / Promised | >60% | | Roll rate | Moved to worse bucket / Total in bucket | Under 40% | | Recovery rate | Recovered $ / Charged-off $ | >5% | ### How to Read Collections Metrics The collections funnel works like a sales funnel: each step has a conversion rate, and the product of all steps gives you your overall recovery. ``` Example: 100 past-due accounts x 55% contact rate = 55 reached x 35% promise-to-pay = 19 promises x 65% promise kept = 12 recovered Overall recovery: 12 / 100 = 12% ``` **What "recovery rate" means for different business types:** | Business Type | What You're Recovering | Typical Rate | |---------------|----------------------|--------------| | Subscriptions (failed payment dunning) | Expired/declined card retries | 10-30% | | Invoicing (net-30/60 terms) | Late payments | 85-95% (most pay eventually) | | Bad debt (charged-off accounts) | Accounts sent to collections | 5-15% | For most SMBs, the collections metric that matters most is **dunning recovery rate**: what percentage of failed subscription payments you recover through retry logic and customer outreach. See [Failed Payment Collection](/docs/compliance/subscriptions/failed-payment-collection) for dunning strategies. ### When Collections Metrics Signal a Problem - **Contact rate under 30%.** Your email is going to spam, your phone numbers are wrong, or customers are avoiding you. Check delivery rates and try alternate channels. - **Promise-kept rate under 40%.** Customers are agreeing to pay and then not following through. Shorten the payment window, offer immediate payment links, or require partial payment upfront. - **Roll rate over 50%.** Accounts are aging faster than you're recovering them. Your dunning sequence may need more urgency or earlier escalation. ## Monitoring Metrics These measure how quickly you detect and respond to issues in your payment operations. | Metric | Definition | Target | |--------|------------|--------| | Alert response time | Time to acknowledge alert | Under 15 min (critical) | | False alert rate | False alerts / Total alerts | Under 20% | | Mean time to detect | Discovery to alert | Under 5 min | | Dashboard uptime | Available time / Total time | >99.9% | ### What to Monitor (and How to Know If It's Working) | What You Monitor | Why | Alert Threshold | |------------------|-----|-----------------| | Authorization rate | Sudden drop = processor issue or rule problem | Drops more than 5 percentage points from baseline | | Payout arrival | Late payouts = cash flow risk | Any payout more than 1 business day late | | Chargeback volume | Spike = fraud attack or fulfillment issue | More than 2x your daily average | | Decline rate | Spike = false positive rule or issuer problem | Rises more than 3 percentage points | | Processor status | Downtime = lost revenue | Any outage notification | ### For SMBs: What "Monitoring" Actually Looks Like If you're running under $100K/month, "monitoring" doesn't mean a dashboard with real-time charts. It means: 1. **Check your processor dashboard daily.** 5 minutes. Look at yesterday's sales count, decline count, and any flagged transactions. 2. **Set up email alerts.** Stripe, Square, and most processors can email you when a chargeback is filed or a payout fails. 3. **Review payouts weekly.** Make sure the money hitting your bank matches what your processor dashboard says. That's it. As you grow, add more: | Volume | Monitoring Level | |--------|-----------------| | Under $50K/month | Daily dashboard check + email alerts | | $50K-$250K/month | Add weekly reconciliation + chargeback ratio tracking | | $250K-$1M/month | Add automated alerts on auth rate, decline rate, fraud rate | | Over $1M/month | Real-time dashboards, dedicated ops person, SLA tracking | ### False Alert Rate: The Alert Fatigue Problem ``` False Alert Rate = Alerts that required no action / Total alerts Example: You receive 20 alerts per week. 4 require investigation or action. 16 are noise (normal fluctuations, known issues, duplicates). False alert rate = 16 / 20 = 80% (way too high) ``` If your false alert rate is above 30%, you'll start ignoring alerts, and the one time a real problem occurs, you'll miss it. Fix by: - Raising thresholds so only meaningful deviations trigger alerts - Deduplicating alerts (one alert per issue, not one per occurrence) - Adding time-based suppression (don't alert on a 5-minute blip; alert on a 30-minute trend) ## Reconciliation Metrics Reconciliation is matching your processor's records against your bank deposits to make sure you received the money you're owed. | Metric | Definition | Target | |--------|------------|--------| | Match rate | Auto-matched / Total items | >99% | | Exception rate | Manual review needed / Total | Under 1% | | Resolution time | Exception to resolution | Under 24 hours | | Aged exceptions | Exceptions >3 days old | 0 | ### How Reconciliation Works ``` Your records say: Processor says: Bank deposit: 100 transactions 100 transactions $9,500 $10,000 gross $10,000 gross (after fees) $500 in fees $500 in fees ``` When all three match, you're reconciled. When they don't, you have an exception to investigate. **Common reconciliation exceptions and what causes them:** | Exception | Common Cause | Resolution | |-----------|-------------|------------| | Bank deposit doesn't match processor total | Processor held funds (reserve, rolling hold) | Check processor dashboard for holds | | Transaction in your records but not processor's | Transaction voided or not captured | Check auth-vs-capture timing | | Processor shows a transaction you don't have | Duplicate charge, test transaction, or glitch | Investigate and refund if needed | | Fees don't match expected amount | Downgrade, rate change, or chargeback fee | Compare fee schedule to actual charges | ### For SMBs: Minimum Viable Reconciliation At minimum, check weekly: 1. **Do your payouts match your sales?** Compare your processor dashboard's payout report against your bank statement. If the numbers are off by more than your expected fee percentage, investigate. 2. **Are all payouts arriving on time?** Your processor's payout schedule (usually T+2 business days) should be consistent. Late payouts can signal a hold or an issue. 3. **Are there any unexpected fees?** Look for chargeback fees, PCI non-compliance fees, or statement fees you didn't expect. This takes 10 minutes per week. It catches 90% of issues before they become serious. ## Incident Metrics An "incident" is anything that disrupts your ability to process payments: processor outage, sudden decline spike, fraud attack, payout failure, or integration error. | Metric | Definition | Target | |--------|------------|--------| | Mean time to detect (MTTD) | Incident start to detection | Under 15 min | | Mean time to respond (MTTR) | Detection to response start | Under 30 min | | Mean time to resolve | Detection to resolution | Under 4 hours | | Incident recurrence rate | Repeat incidents / Total | Under 10% | ### Common Payment Incidents and Response | Incident | Detection Method | First Response | |----------|-----------------|----------------| | Processor outage | Auth rate drops to 0% | Check processor status page, notify customers, enable backup processor if available | | Fraud spike | Chargeback alerts or sudden block rate increase | Tighten rules, check for card testing, review recent approvals | | Payout failure | Bank deposit missing on expected date | Contact processor support, check for holds or compliance issues | | Integration error | Checkout errors spike in your logs | Roll back recent code changes, check API status | | Decline spike | Auth rate drops 10%+ in hours | Check if a fraud rule is over-triggering, contact processor if systemic | ### Post-Incident: The Only Metric That Prevents Repeats **Recurrence rate** measures whether the same type of incident keeps happening. If it's above 10%, you're treating symptoms instead of causes. After every significant incident, document: 1. What happened 2. When you detected it 3. How you fixed it 4. What you'll change to prevent it from happening again The prevention step is the one most teams skip. A processor outage might prompt you to set up a backup processor. A fraud spike might prompt you to add a velocity rule that would have caught it earlier. ## Process Metrics | Metric | Definition | Target | |--------|------------|--------| | SLA adherence | Within SLA / Total | >95% | | Process error rate | Errors / Total actions | Under 1% | | Escalation rate | Escalated / Total | Under 5% | | Documentation completeness | Required fields complete | 100% | These matter most for teams with more than one person handling payment operations. If you're a solo operator, focus on reconciliation and monitoring metrics first and add process metrics when you hire your second person. ### SLA Adherence: What SLAs to Set | Process | Reasonable SLA | |---------|---------------| | Chargeback response | Within 5 business days of receipt | | Refund processing | Within 2 business days of approval | | Customer escalation | Same business day | | Reconciliation exception | Resolved within 24 hours | | Fraud alert review | Within 4 hours (business hours) | ## Staffing Metrics | Metric | Definition | Notes | |--------|------------|-------| | Cases per analyst | Active cases / FTE | Track trend | | Utilization rate | Productive time / Available | 75-85% target | | Training completion | Completed / Required | 100% | | Quality score | Accuracy on audited cases | >95% | Staffing metrics are relevant when you have dedicated payment operations staff. For most SMBs under $1M/month, payment operations is a part-time responsibility, not a full-time role. ### When to Hire for Payment Operations | Volume | Who Handles Payments | |--------|---------------------| | Under $100K/month | Founder or office manager (1-2 hours/week) | | $100K-$500K/month | Designated person, part-time (5-10 hours/week) | | $500K-$2M/month | Full-time operations person | | Over $2M/month | Operations team (2-3 people) | See [Who Owns What](/docs/operations/who-owns-what) for role definitions and [Scaling Milestones](/docs/operations/scaling-milestones) for when to add headcount. ## Test to Run **Reconciliation accuracy check:** 1. Pick one week of payouts from your processor. 2. Match each payout against your bank deposits. Do the amounts match (within expected fee range)? 3. For any mismatch, identify the cause: held funds, chargeback deduction, fee discrepancy, or timing difference. 4. Track how long each mismatch takes to resolve. 5. Set up a simple weekly check going forward (15 minutes, same day each week). **Success criteria:** All payouts match bank deposits within your expected fee range. Any exceptions are explained and resolved within 24 hours. If you find unexplained discrepancies, contact your processor. ## Where This Breaks - **Solo operator trying to track everything.** Start with reconciliation and monitoring only. Add incident, process, and staffing metrics as your team grows. Tracking 25 metrics with no team to act on them is busywork. - **Alerts without action.** Monitoring metrics are worthless if nobody responds. Before adding a new alert, ask: "Who will see this, and what will they do?" If the answer is "nobody" and "nothing," don't create it. - **Measuring process metrics without process.** If your chargeback response workflow is "whoever notices it handles it," process error rate and SLA adherence are meaningless. Document the process first, then measure it. - **Seasonal distortion.** Holiday volume spikes can make incident rates and exception rates look better (lower percentage on higher volume) while masking real problems. Compare like periods: this January vs. last January, not January vs. December. - **Vendor dashboard as single source of truth.** Your processor's dashboard may not show holds, reserves, or mid-cycle fee changes clearly. Reconcile against your bank statement, not just the processor report. ## Next Steps **New to operations metrics?** 1. [Start with the operations checklist](/docs/operations/checklist) - Daily and weekly monitoring tasks 2. [Understand benchmarks](/docs/reference/benchmarks) - Industry comparison standards **Setting up monitoring?** 1. [Configure alerts](/docs/operations/alerts-configuration) - Set up notifications for key thresholds 2. [Review processor management](/docs/operations/processor-management) - Acquirer relationship metrics **Tracking specific areas?** 1. [Chargeback metrics](/docs/chargebacks/metrics) - Dispute ratio monitoring 2. [Fraud metrics](/docs/fraud/metrics) - Fraud rate tracking 3. [Reading statements](/docs/operations/reading-statements) - Understanding your costs --- :::info[Other Metrics Pages] Tracking operations is just one piece. See also: [Payments Metrics](/docs/payments/metrics) ยท [Fraud Metrics](/docs/fraud/metrics) ยท [Chargeback Metrics](/docs/chargebacks/metrics) ยท [Compliance Metrics](/docs/compliance/metrics) ::: ## Related Topics - [Fraud Metrics](/docs/fraud/metrics) - Fraud rate tracking - [Chargeback Metrics](/docs/chargebacks/metrics) - Dispute ratios - [Compliance Metrics](/docs/compliance/metrics) - Compliance KPIs - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Reading Statements](/docs/operations/reading-statements) - Understanding costs - [ACH Operations](/docs/operations/ach-operations) - Bank payment metrics - [Terminal Operations](/docs/operations/terminal-operations) - CP metrics - [Representment Workflow](/docs/operations/representment-workflow) - Win rate tracking - [Benchmarks](/docs/reference/benchmarks) - Industry comparisons - [Who Owns What](/docs/operations/who-owns-what) - Ownership clarity - [Operations Checklist](/docs/operations/checklist) - Daily and weekly monitoring - [Scaling Milestones](/docs/operations/scaling-milestones) - Growth thresholds - [Running Fraud Operations](/docs/operations/running-fraud-operations) - Operational cadence --- ## Multi-Processor Operations Source: https://paymentsandrisk.com/docs/operations/multi-processor # Multi-Processor Operations :::info[TL;DR] - Most growing SMBs end up running two processors, usually by accident. Set up separate accounting tracks on day one or reconciliation gets ugly. - Every processor brings its own chargeback portal, fraud tools, and settlement clock. Nothing connects unless you connect it. - Third-party fraud tools (Kount, Sardine, Signifyd) span both processors. Processor-native tools only see their own traffic, and that's your blind spot. - Payment orchestration (Spreedly, Primer) makes sense above $2M/month. Below that the complexity costs more than it saves. ::: [Processor Management](/docs/operations/processor-management) covers running one processor and knowing when to switch. This page covers what happens when you don't switch. You add a second one and run both. Most growing SMBs end up here, and nobody warns them what it costs to operate. ## Why You End Up with Two Processors Nobody plans to run two processors. It happens for one of four reasons, and all four are legitimate. ### Channel Split You sell in-store and online. Your POS runs on one processor, say Square for terminals. Your website runs on another, say Stripe. Neither handles both channels well, so you keep both. ### Platform Requirements Shopify Payments handles your storefront, but your B2B orders run through a custom Stripe checkout. Or you keep PayPal for buyer protection on high-risk items. The platform picks the processor, not you. ### Redundancy and Failover Your primary processor goes down for 4 hours on a Saturday. If it's your only processor, you lose every sale in that window. A backup gives you somewhere to send traffic, and even one carrying 10% of volume works. At $1M+/month, 4 hours down costs $5,500+ in lost sales. A backup runs a few hundred a month in minimum fees. The math isn't close. ### Negotiation Leverage Two processors give you real numbers to negotiate with. "We're sending 30% of our $2M a month to your competitor" gets attention. "We got a quote from your competitor" never does. --- ## How Multi-Processor Flow Works ```mermaid flowchart TD A[Customer Payment] --> B{Routing Logic} B -->|In-store / POS| C[Processor A] B -->|Online / Custom| D[Processor B] B -->|Failover| D C --> E[Bank Account A] D --> F[Bank Account B] E --> G[Accounting System] F --> G C --> H[Chargeback Portal A] D --> I[Chargeback Portal B] H --> J[Dispute Workflow] I --> J ``` Everything downstream of the routing decision is doubled. Two deposit streams, two chargeback portals, two sets of fees. That's the operational cost. --- ## Operating Two Processors ### Reconciliation That's where it gets messy fast. **Separate vs. shared bank accounts:** give each processor its own bank account. This isn't optional advice - it's the most important operational call you'll make here. Two processors depositing into one account turns matching into a daily puzzle. With separate accounts you look at Account A and know every dollar came from Processor A. | Approach | Pros | Cons | |----------|------|------| | **Separate bank accounts** (recommended) | Clean reconciliation, easy to trace issues, processor-level cash flow visibility | More accounts to manage, slightly more complex treasury | | **Shared bank account** | Simpler banking, single balance to monitor | Deposit matching is painful, harder to spot discrepancies, reserve holds affect combined balance | **Matching deposits to processors:** - Each processor settles on its own schedule: Stripe T+2, Square T+1, Adyen varies. - Deposits won't match daily sales totals. Fees, refunds, and chargebacks get netted out first. - Reconcile each processor on its own, then combine the totals in your accounting system. - See [Reconciliation](/docs/payments/settlement/reconciliation) for the detail, then just run it twice. ### Chargeback Management Two processors means two chargeback portals. This is where merchants lose money. They don't lose these disputes so much as miss them entirely. **The real danger:** you check Stripe's dispute dashboard daily and forget Square for a week. Deadlines pass. You auto-lose. **What to do:** - Route email alerts from both processors into one inbox (see [Alerts Configuration](/docs/operations/alerts-configuration)). - Track every dispute deadline in one calendar or task list. - Check that your alert service (Verifi, Ethoca) covers both MIDs. Those vendors match on BIN and descriptor, so a new MID may not be covered. - If you use a dispute vendor like Chargeflow or Justt, confirm it connects to both processors. | Task | Processor A | Processor B | Combined View | |------|-------------|-------------|---------------| | Dispute notifications | Portal A email | Portal B email | Shared inbox | | Response deadlines | Portal A calendar | Portal B calendar | Single task list | | Alert coverage (Verifi/Ethoca) | Verify MID enrolled | Verify MID enrolled | Confirm both covered | | Win rate tracking | Portal A reporting | Portal B reporting | Manual spreadsheet or vendor | ### Fraud Tools That's the biggest hidden gotcha. **Processor-native fraud tools only see their own traffic.** Stripe Radar scores Stripe transactions and Square's fraud detection sees Square transactions. A fraudster gets blocked on your Stripe checkout, then tries Square. Square has no idea it just happened. **Third-party fraud tools fix that.** Kount, Sardine, Signifyd, and Sift sit in front of both processors. They see every transaction, whoever ends up handling it. Two processors plus a fraud problem means you need one. **Data gaps when you split traffic:** - Velocity rules reset across processors unless the tool is shared. Three per card per day becomes six. - Device fingerprint data doesn't cross processor lines. - Chargeback feedback may only train one processor's model. Above $250K/month with a CB ratio over 0.6%, a third-party tool already pays for itself. The blind spot alone can push you there. See [Fraud Vendor Selection](/docs/fraud/vendors/selection-guide) for how to compare them. ### Reporting You now have two dashboards showing you half the picture each. **Options for unified reporting:** | Approach | Effort | Cost | Best For | |----------|--------|------|----------| | **Manual spreadsheet** | High (weekly export + combine) | Free | Under $500K/month | | **Accounting integration** | Medium (one-time setup) | $50-200/month | $500K-$2M/month | | **BI tool** (Metabase, Looker) | High (initial), low (ongoing) | $0-500/month | Over $1M/month | | **Orchestration platform** | Low (built-in) | $1,000+/month | Over $2M/month | **Track these every week, both processors:** - Total volume, combined - Effective rate per processor, to see whether one costs more - Chargeback ratio per processor and combined, since networks judge per-MID - Auth approval rate per processor, because routing to the worse one costs money See [Accounting Integration](/docs/operations/accounting-integration) for connecting both processors to your books. --- ## When Two Becomes Three Managing processors by hand stops scaling at some point. That's what payment orchestration platforms are for. ### What Orchestration Platforms Do Spreedly, Primer, and Pagos sit between your checkout and your processors. They give you: - **Smart routing** - each transaction goes to the processor most likely to approve it - **Automatic failover** - Processor A drops, traffic moves to Processor B - **Unified reporting** - one dashboard across every processor - **Token vaulting** - store card tokens once, use them anywhere - **A/B testing** - run processors head-to-head on live traffic ### When Orchestration is Worth It **Worth it:** - Over $2M/month in volume. - Three or more processors. - Real international volume, with different processors per region. - Auth rate is a priority. A 0.5% lift is $10K/month at $2M. - You've outgrown manual routing and reconciliation. **Overkill:** - Under $1M/month. The orchestration fee eats the savings. - Two processors with a clean channel split. In-store versus online needs no smart routing. - Simple domestic-only business. - Nobody on staff to run the platform. **Typical orchestration costs:** $1,000-5,000/month base plus $0.01-0.05 per transaction. At $2M/month across ~50,000 transactions, that's $1,500-4,500/month. It pays only if the auth lift plus saved labor beats that number. --- ## Decision Framework This table maps each reason to the work it creates. | Reason for Multiple Processors | Operational Complexity | Recommendation | |-------------------------------|----------------------|----------------| | **Channel split** (POS + online) | Medium - two portals, two reconciliation tracks, but traffic doesn't overlap | Separate bank accounts, shared chargeback inbox. Third-party fraud tool usually not needed since channels are distinct. | | **Platform requirement** (Shopify Payments + Stripe) | Low-Medium - platforms handle most of the integration. You manage reconciliation and disputes. | Separate accounts, verify alert coverage on both MIDs. Keep reporting simple. | | **Redundancy/failover** | Low - backup processor handles minimal volume until needed. | Keep backup warm with 5-10% of volume. Test failover quarterly. Separate bank account for clarity. | | **Negotiation leverage** | Medium - you're actively splitting volume. Both processors need monitoring. | Run 70/30 split. Track auth rates and effective rates on both. Re-negotiate quarterly. | | **Smart routing/optimization** | High - requires orchestration platform and ongoing tuning. | Only at $2M+/month. Use Spreedly or Primer. Dedicate someone to manage it. | --- ## Next Steps **Just added a second processor?** 1. Open a separate bank account for the new processor's deposits. 2. Call your alert vendor and confirm the new MID is covered. 3. Route email alerts from both portals to a [shared inbox](/docs/operations/alerts-configuration). **Struggling with reconciliation across processors?** 1. Read the [Reconciliation](/docs/payments/settlement/reconciliation) process and run it per processor. 2. Connect both processors to your [accounting system](/docs/operations/accounting-integration). 3. Build one weekly spreadsheet: volume, effective rate, CB ratio per processor. **Considering an orchestration platform?** 1. Confirm you're above $2M/month, because below that it rarely pays off. 2. Check your [scaling milestones](/docs/operations/scaling-milestones) for the right tier. 3. Run a 30-day proof of concept on 10% of traffic with Spreedly, Primer, or Pagos. --- ## Related Pages - [Processor Management](/docs/operations/processor-management) - Managing one processor, negotiation, and switching - [Reconciliation](/docs/payments/settlement/reconciliation) - Matching deposits to transactions, run per processor - [Accounting Integration](/docs/operations/accounting-integration) - Connecting processors to your books - [Scaling Milestones](/docs/operations/scaling-milestones) - When multi-processor becomes necessary by volume tier - [Fraud Vendor Selection](/docs/fraud/vendors/selection-guide) - Choosing tools that span multiple processors - [Reading Your Processor Statement](/docs/operations/reading-statements) - Understanding fees across accounts - [Alerts Configuration](/docs/operations/alerts-configuration) - Setting up notifications across both portals - [Buying Payments](/docs/payments/buying-payments) - Choosing and evaluating processors --- ## Payout Strategy Source: https://paymentsandrisk.com/docs/operations/payout-strategy # Payout Strategy :::info[TL;DR] - Standard settlement is T+2 for most US card processors, and your **first** payout takes longer than your steady-state schedule while the processor completes underwriting - Instant payout isn't cheap: Stripe charges 1.5% in the US, Square charges 1.95%, PayPal charges 1.50% with a $0.50 minimum. That's a real fee on every transfer, not a rounding error - Reserves are your processor's protection against chargebacks - a rolling reserve (5-10% of daily volume held 90-180 days) is common for new or high-risk accounts - Knowing your batch cutoff time matters: miss the cutoff by one hour and your money moves one business day later - Cash flow planning means accounting for payout timing as a real variable, not assuming same-day settlement ::: "Where's my money?" is the most common [payment operations](/docs/operations) question. Understanding payout timing, reserves, and cutoffs prevents cash flow surprises and angry calls to your [processor](/docs/operations/processor-management). ```mermaid flowchart LR A[SaleDay 0] --> B[SettlementDay 1] B --> C{ReserveHeld?} C -->|No| D[PayoutDay 2] C -->|Yes| E[10% Held] E --> F[90% PayoutDay 2] E --> G[Reserve ReleasedDay 90-180] style D fill:#22c55e,color:#fff style F fill:#f59e0b,color:#fff style G fill:#22c55e,color:#fff ``` Most merchants don't know their actual payout timing until they need money that isn't there. ## What Matters 1. **Standard payout timing varies by [processor](/docs/operations/processor-management) and risk tier.** T+1 is not universal. 2. **Reserves are cash flow traps.** Understand what triggers them and how to release them. 3. **Cutoff times determine when today becomes tomorrow.** Miss the cutoff, add a day. 4. **Multi-currency payouts add [FX](/docs/payments/reference/fx-and-settlement) timing complexity.** Know when conversion happens. 5. **Your cash flow forecast must account for reserves, [refunds](/docs/fraud/types/refund-fraud), and [chargebacks](/docs/chargebacks).** --- ## When Does Your Money Actually Arrive? ### Standard Payout Timing by Processor Type | Processor Type | Typical Timing | Notes | |----------------|----------------|-------| | **Aggregators (Stripe, Square)** | T+2 standard | Can be T+1 or instant for fee | | **Traditional merchant accounts** | T+1 to T+3 | Depends on agreement | | **High-risk processors** | T+7 or longer | Plus reserve holds | | **PayPal** | Instant to PayPal balance, T+1 to bank | Varies by account status | **T+X means:** Transaction on Day 0, funds arrive Day X. ### Your First Payout Is Slower Than Every Payout After It This is the single most common "where's my money?" call, and almost every processor does it. Your first payout is held longer than your published schedule while the processor finishes underwriting your account and confirms your bank details. Once that first transfer clears, you drop into the normal cadence. The wait isn't a universal published number. It's set per account and depends on your industry, your volume, and what your application looked like. Stripe, Square and PayPal all show your actual schedule inside the dashboard: | Processor | Where your real payout schedule lives | |-----------|---------------------------------------| | **Stripe** | Dashboard > Balances > Payouts, and Settings > Payout schedule | | **Square** | Dashboard > Balance > Transfer settings | | **PayPal** | Wallet > Bank accounts, plus any holds shown on the account status page | **What to do about it:** check the dashboard on day one, before you've promised anyone that money. Don't plan payroll or supplier payments around your first two weeks of card revenue. If your first payout is later than the dashboard says it should be, that's usually a KYC document request sitting unanswered, not a bank problem. ### Same-Day and Instant Payout Options Many processors offer faster payouts for a fee. These are the published rates: | Option | Fee | Source (verified 2026-08-02) | |--------|-----|------------------------------| | **Stripe Instant Payouts (US)** | 1.5% of the amount. Minimum payout $0.50, maximum $9,999 | [docs.stripe.com/payouts/instant-payouts](https://docs.stripe.com/payouts/instant-payouts) | | **Square Instant Transfer** | 1.95% per transfer, available 24/7 | [Square Help Center](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options) | | **PayPal Instant Transfer to bank** | 1.50%, $0.50 minimum fee | [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) | | **Braintree same-day ACH** | 1.5% + $0.10 (standard ACH is 0.75% capped at $5) | [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | | **Helcim, Adyen, Shopify Payments, Stax, Clover, Toast** | Not published | Ask your rep for the instant or expedited payout fee in writing | :::warning[Stripe's 1% instant payout rate is not a US rate] Stripe charges **1.5%** for instant payouts in the US, Australia, New Zealand and the UAE. The 1% figure that circulates widely is Stripe's rate for Canada, the EU, the UK, Singapore, Norway, Hong Kong and Malaysia. If you're a US merchant budgeting at 1%, you're under-budgeting by half. Source: [docs.stripe.com/payouts/instant-payouts](https://docs.stripe.com/payouts/instant-payouts), verified 2026-08-02. ::: **What instant payout actually costs you.** On a $5,000 transfer: Stripe US takes $75, PayPal takes $75, Square takes $97.50. Pull instant twice a week on $5,000 and Square costs you about $10,140 a year in transfer fees alone. That's not an emergency-cash-flow tool, that's a line item. Use it for genuine gaps, not as your default setting. ### Why Timing Varies | Factor | Impact | |--------|--------| | **Risk tier** | Higher risk = longer holds | | **Volume history** | New accounts wait longer | | **Industry (MCC)** | High-risk MCCs have longer holds | | **Chargeback ratio** | High ratio = extended timing | | **Reserve status** | Active reserve delays net payout | --- ## Understanding Your Reserve Reserves protect the processor from your chargebacks and refunds. They protect you from nothing. ### Types of Reserves | Type | How It Works | |------|--------------| | **Rolling reserve** | X% of each transaction held for Y days, then released | | **Fixed reserve** | Flat amount held until account closes or requirement lifted | | **Minimum balance** | Must maintain balance; tops up from payouts if needed | | **Capped reserve** | Rolling reserve until cap reached, then stops accruing | ### Typical Reserve Structures | Risk Level | Reserve Structure | |------------|-------------------| | **Low risk** | No reserve or 5% rolling / 30 days | | **Medium risk** | 5-10% rolling / 90 days | | **High risk** | 10-20% rolling / 180 days + fixed | | **Very high risk** | 20%+ rolling / 180+ days | ### What Triggers Reserve Increases | Trigger | Processor Response | |---------|-------------------| | **[Chargeback ratio](/docs/chargebacks/metrics) spike** | Increase reserve % or extend hold period | | **Volume spike without notice** | Temporary hold pending review | | **[MCC](/docs/reference/mcc-codes) change** | Re-underwriting, possible new reserve | | **[Fraud reports](/docs/chargebacks/reference/network-programs)** | Immediate reserve increase | | **[Refund rate](/docs/fraud/types/refund-fraud) spike** | May trigger review | ### How to Negotiate Reserve Release 1. **Build track record:** 6-12 months clean processing history 2. **Request review:** Formally ask for reserve reduction 3. **Provide documentation:** Show stable financials, low disputes 4. **Offer alternatives:** Higher processing volume commitment, personal guarantee :::note[Ask Your Processor] "What are the criteria for reducing or releasing my reserve? When can I request a review?" ::: --- ## Payout Frequency Strategy ### Daily vs. Weekly vs. Monthly | Frequency | Best For | Trade-off | |-----------|----------|-----------| | **Daily** | Cash flow dependent businesses | More bank transactions to reconcile | | **Weekly** | Most SMBs | Simpler reconciliation, slight delay | | **Monthly** | Low-volume, simple operations | Significant cash flow delay | ### Matching Payouts to Expenses Align payout timing with your expense cycles: - **Payroll on Friday?** Ensure Thursday payout. - **Rent due on 1st?** Weekly payout ending before month-end. - **Inventory purchases?** Daily payouts if supplier terms are tight. ### Multi-Account Payout Routing If you have multiple bank accounts: - Route operating expenses to primary account - Route reserves/savings to secondary - Some processors support split payouts --- ## Cutoff Times and Batch Behavior ### Why Cutoff Times Matter Transactions after the cutoff don't settle until the next batch. | Example | Cutoff 5 PM ET | |---------|----------------| | **Transaction at 4:30 PM** | Settles today, arrives T+X from today | | **Transaction at 5:30 PM** | Settles tomorrow, arrives T+X from tomorrow | A Friday 6 PM transaction might not arrive until Wednesday (T+2 from Monday). ### Common Cutoff Times | Processor | Typical Cutoff | |-----------|----------------| | **Stripe** | Daily automatic batching | | **Square** | 5 PM PT | | **Traditional processors** | 5-6 PM ET, configurable | | **PayPal** | Varies by transaction type | ### Weekend and Holiday Edge Cases | Scenario | Impact | |----------|--------| | **Friday after cutoff** | Settles Monday | | **Saturday/Sunday transactions** | Settle Monday | | **Bank holiday** | Add a day to payout | | **Processor holiday** | May differ from bank holiday | **Friday sales often don't arrive until Tuesday or Wednesday.** Plan accordingly. --- ## Multi-Currency Payout Complexity ### When Conversion Happens | Timing | How It Works | Impact | |--------|--------------|--------| | **At capture** | Converted when you capture payment | Rate locked early | | **At settlement** | Converted when batch settles | Rate may shift | | **At payout** | Converted when funds transfer to bank | Most rate variability | ### Holding Foreign Currency vs. Auto-Converting | Approach | When It Makes Sense | |----------|---------------------| | **Auto-convert to USD** | Simple, no FX management needed | | **Hold in local currency** | You have local expenses in that currency | | **Manual conversion timing** | You want to optimize FX rates (requires attention) | ### Multi-Currency Reconciliation If you hold multiple currencies: - Track balances per currency - Reconcile in original currency first - Convert for reporting at consistent rates - Document FX gains/losses **Cross-link:** [FX and Settlement](/docs/payments/reference/fx-and-settlement) for FX mechanics. --- ## Cash Flow Forecasting ### What to Include | Factor | How It Affects Cash | |--------|---------------------| | **Gross sales** | Money coming in (eventually) | | **Payout timing** | When it actually arrives | | **Reserves held** | Money you can't access | | **Refunds** | Deducted from next payout | | **Chargebacks** | Deducted immediately + fees | | **Fees** | Deducted from payout or billed separately | ### Simple Cash Flow Model ``` Expected cash = (Sales ร— (1 - reserve %)) - Expected refunds - Expected [chargebacks](/docs/chargebacks) - [Fees](/docs/payments/buying-payments) - Payout timing delay ``` :::tip[Deep Dive] For a full forecasting framework with three-scenario modeling, business-type breakdowns, and a weekly forecast process, see [Cash Flow Forecasting](/docs/operations/cash-flow-forecasting). ::: ### What to Tell Your CFO - **Don't report gross sales as cash.** Report net after [fees](/docs/payments/buying-payments), refunds, reserves. - **Track effective collection period.** Payout timing + reserve release. - **Flag reserve changes.** A new 10% reserve on $100k/mo = $10k less cash flow. - **Model scenarios.** What happens if [chargeback ratio](/docs/chargebacks/metrics) spikes and reserve doubles? --- ## Test to Run **2-week payout audit:** **Week 1:** Baseline - Document current payout timing and frequency - Calculate actual T+X by tracking several transactions - Identify reserve structure and current balance - Map cutoff time to your sales patterns **Week 2:** Optimize - Adjust payout frequency if needed - Request reserve review if eligible - Set up deposit confirmation alerts - Update cash flow forecast with accurate timing **Success criteria:** Accurate payout timing documented. Alert system in place. Cash flow forecast reflects reality. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo** | Accept default payout timing. Understand reserve terms. Don't optimize yet. | | **$100k-$1M/mo** | Match payout frequency to expenses. Negotiate reserve terms. Set up deposit alerts. | | **Over $1M/mo** | Daily payouts, multi-bank routing, active reserve management, cash flow modeling. | --- ## Where This Breaks 1. **Unexpected reserve increases.** A [chargeback](/docs/chargebacks) spike can trigger immediate reserve hold on money you were counting on. Build buffer. Monitor your [chargeback metrics](/docs/chargebacks/metrics). 2. **Payout freezes during KYC/KYB review.** [Processor](/docs/operations/processor-management) asks for documents, you delay, payouts stop. Respond within 24 hours. See [AML basics](/docs/compliance/aml-basics) for KYC requirements. 3. **Multi-currency [reconciliation](/docs/payments/settlement) failures.** [FX conversions](/docs/payments/reference/fx-and-settlement) at different times create discrepancies. Use consistent conversion dates. --- ## Alerts to Configure Set up these alerts for payout operations: - **Deposit confirmation:** Notification when payout arrives - **Payout failure:** Alert if scheduled payout doesn't process - **Reserve change:** Notification of reserve % or balance changes - **Large payout:** Notification for payouts above threshold **Cross-link:** [Alerts Configuration](/docs/operations/alerts-configuration) for setup details. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Actual T+X** | Real payout timing | Track trend | | **Reserve as % of monthly volume** | Cash flow impact | Minimize | | **Payout-to-sales ratio** | Net after fees/refunds/chargebacks | Track trend | | **Failed payout rate** | Banking issues | 0% | | **Cash conversion cycle** | Sale to cash in bank | Minimize | --- ## Next Steps **Understanding payout timing?** 1. [Check standard timing by processor](#standard-payout-timing-by-processor-type) - Aggregators vs traditional 2. [Know cutoff times](#cutoff-times-and-batch-behavior) - Miss cutoff, add a day 3. [Understand weekend/holiday impact](#weekend-and-holiday-edge-cases) - Friday sales โ†’ Tuesday cash **Managing reserves?** 1. [Know reserve types](#types-of-reserves) - Rolling, fixed, minimum, capped 2. [Understand triggers](#what-triggers-reserve-increases) - Chargebacks, volume spikes 3. [Negotiate release](#how-to-negotiate-reserve-release) - Build track record, request review **Optimizing cash flow?** 1. [Match payout frequency to expenses](#matching-payouts-to-expenses) - Payroll, rent, inventory 2. [Build cash flow forecast](#cash-flow-forecasting) - Include reserves, refunds, chargebacks 3. [Run payout audit](#test-to-run) - 2-week baseline and optimize --- ## Related Pages - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Settlement and Reconciliation](/docs/payments/settlement) - Funding flows - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Cross-border complexity - [Alerts Configuration](/docs/operations/alerts-configuration) - Deposit alerts - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Holds and Reserves](/docs/operations/holds-and-reserves) - Reserve mechanics - [Reading Statements](/docs/operations/reading-statements) - Fee analysis - [Chargeback Metrics](/docs/chargebacks/metrics) - Ratio impact on reserves - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold consequences - [Invoicing](/docs/payments/invoicing) - B2B payment timing - [Operations Checklist](/docs/operations/checklist) - Daily payout verification - [ACH Operations](/docs/operations/ach-operations) - Bank payment settlement timing - [Cash Flow Forecasting](/docs/operations/cash-flow-forecasting) - Planning around payment float - [SMB Banking Integration](/docs/payments/smb-banking-integration) - How bank choice affects settlement --- ## Processor Management Source: https://paymentsandrisk.com/docs/operations/processor-management # Processor Management :::info[TL;DR] - **Processor relationship**: They're a business partner with their own risk appetite. Incentives don't always align - **Reply to warning emails immediately.** Silence makes them nervous - **Worth switching if**: >0.3% effective rate difference, reliability issues, poor support, exiting your vertical - **Negotiation leverage**: meaningful at $100K+/month, substantial at $2M+/month - Configure [velocity rules](#common-processor-rules-to-configure) and capture metadata for disputes ::: Your processor isn't your friend, but they aren't your enemy either. They're a business partner with their own risk appetite, and their incentives don't always align with yours. :::tip[If You're Under $50K/Month] Don't churn processors just to save 5 basis points. Focus on support quality and features first. The savings aren't worth the migration headache at your volume. ::: ## Emails You'll Get and What They Mean ### "We've noticed increased chargebacks..." **Translation:** Your chargeback ratio is approaching their threshold. They're giving you a warning before taking action. **Reply template:** > Thank you for flagging this. We've identified [specific cause] and are implementing [specific fix]. We expect to see improvement within [timeframe]. Happy to schedule a call to discuss our remediation plan. **Don't:** Ignore this email. Silence makes them nervous. ### "Your account is under review..." **Translation:** Something triggered their risk system. Could be volume spike, chargeback increase, or industry-level concern. **Reply template:** > Thanks for reaching out. We're available to provide any documentation you need. Could you clarify what specific information would be helpful? We can provide [transaction data / authorization records / business documentation] within [timeframe]. **Don't:** Panic-withdraw all your money. That confirms their suspicion. ### "We're adjusting your reserve..." **Translation:** They're holding more of your money. This is bad but not fatal. **Reply template:** > We understand the need to adjust risk parameters. Could you help us understand what metrics or changes would allow us to revisit this reserve level in [3-6 months]? We'd like to have clear targets to work toward. See [Holds and Reserves](/docs/operations/holds-and-reserves) for what to do next. ### "We're terminating your account..." **Translation:** They've decided you're not worth the risk. **Immediate actions:** 1. Ask (in writing) when final payout will occur 2. Ask if you're being placed on MATCH/TMF 3. Start looking for a new processor immediately 4. Consult a payments attorney if significant funds are held ## Good Reasons to Switch Processors - **Significantly better rates** at your current volume (>0.3% effective rate difference) - **Better features** you'll actually use (multi-currency, specific payment methods) - **Reliability issues** (frequent outages, slow settlements) - **Poor support** when you have real problems - **They're exiting your vertical** ## Bad Reasons to Switch Processors - **Marginally better rates** (under 0.1% difference at low volume) - **Shiny new features** you don't need - **Sales pitch promises** without checking references - **One bad support interaction** - **FOMO** about what competitors use ## Negotiation Tactics ### Know Your Numbers Before any negotiation, calculate: - Your effective rate (total fees / total volume) - Your chargeback ratio - Your average transaction size - Your monthly volume trend ### What's Negotiable | Usually Negotiable | Sometimes Negotiable | Rarely Negotiable | |-------------------|---------------------|-------------------| | Processing rate (basis points) | Monthly fees | Interchange (pass-through) | | Per-transaction fee | Chargeback fees | Network fees | | Reserve percentage | Payout timing | PCI compliance fees | | Contract length | Early termination fee | | ### Worked Example Your current state: - $100K/month volume - 3.1% effective rate (blended) - Low-risk ecommerce You get quotes around 2.7% from competitors. That 0.4% difference on $100K/month = **$400/month savings**. Over a year: $4,800. Worth a conversation with your current processor before switching. **What to say:** > We've been happy with [Processor], but we're doing a routine rate review. We've received competitive quotes around 2.7% for our volume and risk profile. Is there room to revisit our pricing? Most processors would rather cut rates than lose a good merchant. ### What to Watch For - **Tiered pricing** that looks good on low tickets but kills you on higher ones - **"Qualified" rate** that most transactions don't qualify for - **Hidden fees** (batch fees, statement fees, PCI non-compliance fees) - **Rate lock** that expires and reverts to higher rates ## Red Flags **If they pause payouts and refuse to explain why in writing, start planning your exit.** Good processors communicate. Silent processors are building a case. **If frontline support can't answer basic questions,** ask for risk or underwriting specifically. Those are the teams that actually decide things. **If they mention MATCH listing,** assume that processor relationship is over. Focus on getting money released and finding a specialist acquirer. ## Switching Processors ### Before You Switch - [ ] Calculate total cost of current processor (including all fees) - [ ] Get 2-3 competitive quotes - [ ] Check references from similar businesses - [ ] Read the contract (especially termination clauses) - [ ] Plan for parallel running period ### The Migration 1. **Don't turn off the old processor** until the new one is fully tested 2. **Migrate subscriptions carefully** - customers hate re-entering cards 3. **Keep old processor active** for chargebacks on old transactions 4. **Update your billing descriptor** to match across processors ### After You Switch - Monitor auth rates closely for first 2 weeks - Watch for unexpected declines (BIN routing issues) - Keep old processor relationship alive for 6+ months (chargebacks on old transactions) ## Volume Thresholds for Leverage | Monthly Volume | Your Leverage | |---------------|---------------| | Under $25K | Minimal. Use aggregators (Stripe, Square). | | $25K-$100K | Some. Can negotiate fees, not rates. | | $100K-$500K | Meaningful. Worth shopping around. | | $500K-$2M | Significant. Direct processor relationships make sense. | | Over $2M | Substantial. Multiple processor strategy, custom pricing. | --- ## Metadata and Rule Configuration Your processor likely offers rule configuration for fraud screening, velocity limits, and transaction handling. Getting these right prevents losses and false declines. ### Common Processor Rules to Configure | Rule Type | Purpose | Default Often Wrong | |-----------|---------|---------------------| | **Velocity limits** | Cap transactions per card/customer/time | Often too loose | | **Amount limits** | Max per transaction | Often too high | | **AVS rules** | How to handle AVS mismatches | Often too strict | | **CVV rules** | Whether to accept CVV failures | Usually correct | | **BIN blocking** | Block certain card types/countries | Usually none | | **Geographic rules** | IP vs billing country match | Often not configured | ### Velocity Rule Configuration | Rule | Starting Point | Adjust Based On | |------|----------------|-----------------| | Transactions per card per day | 3-5 | Typical customer behavior | | Amount per card per day | 2x AOV | Normal purchase patterns | | Transactions per IP per hour | 10-20 | Expected traffic sources | | Failed attempts per card per day | 3 | Card testing attacks | ### Metadata to Capture Store this with every transaction for debugging and disputes: | Field | Why | |-------|-----| | **IP address** | Fraud investigation, geolocation | | **Device fingerprint** | Link transactions to devices | | **User agent** | Bot detection, device type | | **Session ID** | Tie to checkout behavior | | **Customer account ID** | Link to account history | | **Shipping address** | Delivery verification | | **AVS/CVV response** | Dispute evidence | | **3DS authentication data** | Liability shift proof | :::tip[Make Your Metadata Searchable] When a chargeback arrives, you have 20-45 days to find evidence. If your transaction metadata isn't searchable, you'll waste hours per dispute. **Minimum searchable fields:** - Order ID / invoice number - Customer email - Shipping tracking number - IP address at checkout - Device fingerprint (if available) - Delivery confirmation date **How to set this up:** Most processors let you attach metadata to transactions. In Stripe, use the `metadata` field on PaymentIntents. In Square, use `note` and `reference_id`. In Adyen, use `merchantReference` and `additionalData`. Store enough to find any transaction within 60 seconds. See [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) for what evidence wins disputes, and [Evidence Framework](/docs/fraud/detection/evidence-framework) for building systematic evidence collection. ::: ### Rule Testing Protocol Before deploying a new rule: 1. **Shadow mode first.** Run the rule without blocking. See what would have been blocked. 2. **Analyze flagged transactions.** What percentage were actually fraud? What percentage were good customers? 3. **Calculate false positive rate.** If more than 1-2% of flagged transactions are legitimate, rule is too aggressive. 4. **Deploy gradually.** Start with 10% of traffic, monitor, expand. 5. **Set rollback plan.** Know how to turn it off quickly if problems emerge. ### Rule Documentation For each rule, document: | Element | What to Record | |---------|----------------| | Rule name | Clear, descriptive | | Business justification | Why this rule exists | | Expected behavior | What it blocks, what it allows | | Created date | When implemented | | Last reviewed | When last validated | | Owner | Who to contact | | Success criteria | How to know it's working | :::note[Ask Your Processor] "What rule configuration options do you offer? Can I see what rules are currently active on my account? How do I add custom rules?" ::: --- ## Next Steps **Got a scary email?** 1. [Decode the message](#emails-youll-get-and-what-they-mean) - Chargebacks, review, reserve, termination 2. [Respond immediately](#emails-youll-get-and-what-they-mean) - Silence makes them nervous 3. [Request specific criteria](#emails-youll-get-and-what-they-mean) - What metrics to hit **Considering switching?** 1. [Check good vs bad reasons](#good-reasons-to-switch-processors) - Is it worth the hassle? 2. [Know your leverage by volume](#volume-thresholds-for-leverage) - $100K+/mo matters 3. [Follow negotiation tactics](#negotiation-tactics) - Know your numbers **Configuring processor rules?** 1. [Review common rules](#common-processor-rules-to-configure) - Velocity, AVS, CVV, geographic 2. [Capture metadata](#metadata-to-capture) - IP, device, session for disputes 3. [Follow testing protocol](#rule-testing-protocol) - Shadow mode first --- ## Related - [Holds and Reserves](/docs/operations/holds-and-reserves) - When they hold your money - [Reading Your Processor Statement](/docs/operations/reading-statements) - Understanding what you're paying - [Payment Change Checklist](/docs/operations/change-checklist) - Testing after processor changes - [Fraud Prevention](/docs/fraud/prevention) - Rules and configuration for fraud - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Configuring fraud rules - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Tracking devices - [Network Programs](/docs/chargebacks/reference/network-programs) - Chargeback thresholds - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Payments Metrics](/docs/payments/metrics) - Monitoring payment health - [Buying Payments](/docs/payments/buying-payments) - Choosing processors - [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring) - Compliance programs - [Multi-Processor Operations](/docs/operations/multi-processor) - Running two processors simultaneously - [SMB Banking Integration](/docs/payments/smb-banking-integration) - How bank choice affects settlement --- ## Reading Your Processor Statement Source: https://paymentsandrisk.com/docs/operations/reading-statements :::info[Learning Path Version] New to reading statements? Start with [The Guide, Pathway 4, Lesson 2](/docs/learning-pathways/running-payments-daily/reading-your-statements) for the beginner walkthrough. This page goes deeper into reconciliation, fee analysis, and spotting problems. ::: # Reading Your Processor Statement :::info[TL;DR] - Your effective rate (total fees รท total volume) is the only number that matters for cost comparison - ignore the headline rate - **Benchmark your interchange line, not just your total.** This site's blend is 0.89% + 15.8c card-present and 1.36% + 15.2c online; add 0.14% + $0.02 of network assessments and you get the 1.03% + 17.8c and 1.50% + 17.2c pass-through used in every worked example here ([Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions)) - Interchange downgrades are the most common source of overpayment: missing Level 2/3 data, late settlement, or wrong transaction type each cost 0.2-0.8% extra per transaction - Monthly minimums, PCI non-compliance fees, and statement fees are often negotiable or removable - audit your statement line by line at least once a year - 10 minutes a month reviewing your statement catches overcharges and rate creep before they compound into thousands of dollars ::: Most merchants pay more than they should because they don't understand their statement. 10 minutes a month can save you thousands a year. :::tip[The Lazy Route] If you only have 10 minutes this month: 1. Calculate your effective rate 2. Scan for any new fee names 3. Check that your chargeback count matches your own records ::: ## Effective Rate: The Only Number That Matters Forget the quoted rate. Calculate what you actually pay: ``` Effective Rate = Total Fees / Total Volume ร— 100 ``` **Example:** - Total volume: $87,432 - Total fees: $2,535 - Effective rate: 2.90% Your processor quoted 2.4% + $0.30? That's the base rate. After interchange pass-through, assessments, and fees, you're at 2.90%. This is normal. ### Effective Rate Benchmarks | Business Type | Typical Effective Rate | |---------------|----------------------| | In-person (chip/tap) | 1.8% - 2.3% | | Standard ecommerce | 2.5% - 3.2% | | High-risk ecommerce | 3.0% - 4.5% | | B2B (Level 2/3 data) | 2.0% - 2.7% | | Subscription/recurring | 2.4% - 3.0% | | International cards | +0.5% - 1.5% additional | **If you're new or doing very low volume,** your effective rate will bounce around a lot. Focus on whether it's trending down once you're above $20K/month. ## Anatomy of a Statement ### Volume Summary - **Gross volume:** Total transactions processed - **Net volume:** After refunds and chargebacks - **Transaction count:** Number of transactions - **Average ticket:** Volume / count Watch for: Average ticket changes (could indicate fraud or product mix shift) ### Fee Breakdown Fees come in layers: **Interchange (non-negotiable):** - Set by Visa/Mastercard - Varies by card type, transaction type, industry - Passed through to you (in interchange-plus pricing) **Assessments (non-negotiable):** - Network fees from Visa/Mastercard - Commonly quoted at 0.13% - 0.15%, but **neither network publishes a US assessment schedule**, so nobody can source that range to a primary document. This site models 0.14% + $0.02 and labels it unverified ([Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions)) - Some processors fold assessments into the interchange line and some break them out. Check which yours does before you compare your interchange percentage to anyone else's **Processor markup (negotiable):** - This is where your processor makes money - Could be basis points, per-transaction, or both - This is what you negotiate **Other fees (sometimes negotiable):** - Monthly/annual fees - PCI compliance fees - Statement fees - Batch fees - Chargeback fees ### Chargeback Section - **Count:** Number of chargebacks this period - **Amount:** Dollar value of chargebacks - **Fees:** Per-chargeback fees, which vary far more between processors than most merchants expect Published per-dispute fees, verified 2026-08-02 against each vendor's own page: | Processor | Per-dispute cost | Source | |-----------|------------------|--------| | **Helcim** | $0 if the case is resolved in your favour, $15 if you lose | [helcim.com/pricing](https://www.helcim.com/pricing/) | | **Stripe** | $15 to receive the dispute (never returned) plus $15 to counter it (returned only on an outright win) | [support.stripe.com](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) | | **Braintree** | $15.00, not stated to be refunded on a win | [paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees) | | **Square** | **$0.** "There are no fees for dispute management services for chargebacks" | [squareup.com/help](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough) | | **Shopify Payments** | $15.00 in the US, returned to you if you win | [help.shopify.com](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process) | | **Toast** | $15.00, charged win or lose | [support.toasttab.com](https://support.toasttab.com/en/article/Chargeback-FAQ) | | **PayPal** | $15.00 on wallet and Guest Checkout disputes, $20.00 on card chargebacks. Never both on one dispute. $30.00 above a 1.5% dispute ratio | [paypal.com/us/business/paypal-business-fees](https://www.paypal.com/us/business/paypal-business-fees) | | **Stax** | Optional chargeback protection add-on at $25 per chargeback | [staxpayments.com/pricing](https://staxpayments.com/pricing/) | | **Moneris** (Canada) | CA$25.00, plus a CA$80.00 authorization chargeback handling fee | [moneris.com/en/pricing](https://www.moneris.com/en/pricing) | | **Authorize.net** | $0.00 on card chargebacks, $25.00 on eCheck.Net. Gateway fee only | [authorize.net/pricing](https://www.authorize.net/en-us/sign-up/pricing.html) | | **Adyen, Clover, Worldpay, Global Payments, Checkout.com** | Not published | Ask for the per-dispute fee in writing before you sign | Two of those lines change how you should read your own statement. If you're on Stripe and you fight a dispute and only partially win, neither fee comes back, so a contested dispute costs $30 whatever the outcome. If you're on PayPal, check which fee line you got. The $15 dispute fee and the $20 chargeback fee attach to different transaction channels, so seeing both against one transaction is a billing error worth querying, not normal. **Check this against your own records.** If the statement shows 12 chargebacks and you only handled 8, investigate. Either you missed some or there's an error. :::note[If your processor won't publish it, ask] Adyen, Clover, Worldpay and Global Payments publish no US dispute fee at all. Nuvei puts it on Schedule A of your merchant application, so it's per-contract. Ask for the number in writing before you sign, and know what good looks like: the published US range is **$0 to $30**, and most processors charge $15. Anything above $30 isn't on any US fee schedule this site could find. ::: ## Red Flag Checklist Scan each statement for: - [ ] **New fee names** you've never seen before - [ ] **Rate increases** without notification - [ ] **PCI non-compliance fees** (should be $0 if you're compliant) - [ ] **Excessive batch fees** (some processors charge per batch, per day) - [ ] **Chargeback count mismatch** with your records - [ ] **Effective rate creep** (trending up month over month) - [ ] **Minimum fees triggered** (if volume dropped below minimums) ### New Fee Names to Watch For | Fee Name | What It Means | Negotiable? | |----------|---------------|-------------| | Network Access Fee | Visa/MC fee pass-through | No | | Fixed Acquirer Network Fee (FANF) | Visa fee | No | | PCI Non-Compliance | You haven't done PCI SAQ | Yes (complete SAQ) | | Regulatory Fee | Catch-all for new network fees | Maybe | | Risk Monitoring Fee | They're nervous about you | Usually no | ## Sample Statement Walkthrough **Summary:** ``` Processing Volume: $87,432.00 Transaction Count: 1,247 Refunds: $2,103.00 Chargebacks: $412.00 Net Volume: $84,917.00 ``` **Fee Detail:** ``` Interchange Fees: $1,842.22 Assessment Fees: $113.66 Processing Fee: $412.32 Monthly Fee: $25.00 PCI Fee: $19.99 Chargeback Fees: $45.00 -------------------------------- Total Fees: $2,458.19 ``` **Calculation:** - Average ticket: $87,432.00 / 1,247 = $70.11 - Effective rate: $2,458.19 / $87,432.00 = 2.81% - Interchange as % of total fees: 75% (normal) - Processor markup: ~0.5% + per-transaction **Red flags in this example:** - **The interchange line itself.** $1,842.22 on $87,432 is **2.11%**, and this site's blended interchange is 0.89% + 15.8c card-present and 1.36% + 15.2c online. At a $70 average ticket that's 1.12% in person or 1.58% online, so this merchant is paying about **34% more interchange than a blended online mix would predict**. That's not automatically an error, but it has only three explanations worth checking: a genuinely rewards-heavy or commercial-card-heavy customer base, keyed and card-not-present transactions you thought were card-present, or downgrades. Only the last two are fixable, and both are worth finding - Chargeback fees at $45 are most likely three disputes at $15 each, which is what Stripe and Braintree publish. Check your own processor's published fee in the table above before you infer a count - But chargeback amount is $412, which could be 1-4 transactions - Worth verifying the count matches your records That first bullet is the whole point of pulling a statement apart. Your effective rate can look normal while the interchange underneath it runs 50 to 100 basis points above a blended benchmark, and no amount of markup negotiation touches that. ## Pricing Models ### Interchange-Plus (Best for Most) You pay interchange (cost) + fixed markup. **Pros:** Transparent, you see exactly what each card type costs **Cons:** Statements are complex, harder to predict monthly cost ### Tiered/Bundled (Avoid If Possible) Transactions are grouped into "qualified," "mid-qualified," "non-qualified" tiers. **Pros:** Simple statement **Cons:** You have no idea what you're actually paying, most transactions end up in expensive tiers **The trap:** "Qualified rate" of 1.69% sounds great until you realize only 20% of transactions qualify. ### Flat Rate (Fine for Small Volume) One rate for everything (e.g., 2.9% + $0.30). **Pros:** Simple, predictable **Cons:** You overpay on cheap interchange cards, underpay on expensive ones **Good for:** Simple product mix, and merchants who value a predictable number over the lowest number. **The old advice was "flat rate under $50K/month," and it no longer holds automatically.** Interchange-plus with no monthly fee now exists at the bottom of the market: Helcim publishes interchange + 0.40% + 8c in person and interchange + 0.50% + 25c online for merchants doing $0-50,000 a month, with a $0 monthly fee and no PCI, setup, statement or cancellation fee ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). The blended card-present pass-through this site publishes is **1.03% + 17.8c**, interchange plus network assessments. That lands Helcim's entry band at **1.43% + 25.8c all-in in person**, which on a $50 ticket is **1.95% against Square's 2.90%** - a gap of 95 basis points, not the 30-odd that most comparisons show. The difference is worth knowing when you read your own statement. The narrower figure comes from assuming a card mix averaging 1.80% + $0.10, which is roughly a single card type rather than a blend, and it inflates the interchange-plus side of every comparison. See [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). The condition on that verdict is ticket size, not volume. Below about a **$9.23** card-present ticket, Square's flat rate is the cheaper of the two at any volume, because 15 cents beats 25.8 cents. Run your own numbers off your last statement rather than assuming flat rate wins because you're small, or that interchange-plus wins because you're not. ## B2B and Level 2/3 Data If you sell to businesses, you're leaving money on the table without Level 2/3 data. **Level 2 data:** Tax amount, customer code, merchant postal code **Level 3 data:** Line-item detail (item descriptions, quantities, prices) **Impact:** Can reduce interchange by 0.5% - 1.0% on B2B transactions **If your statement doesn't show Level 2/3 categories,** ask your processor what it would take to qualify. Many processors can enable this with minimal technical work. ## When to Renegotiate Triggers for a pricing conversation: - 6+ months of clean history (low chargebacks) - Volume increased significantly since you signed - Effective rate trending up - You've gotten competitive quotes See [Processor Management](/docs/operations/processor-management) for negotiation tactics. :::tip[Effective Rate Tracking Experiment] Calculate your effective rate monthly for 6 months and plot it. **What you're looking for:** - Is it stable? Good. - Is it trending down as you grow? Expected and good. - Is it trending up? Time for a conversation with your processor. - Is it bouncing around? Normal at low volume, should stabilize above $20K/month. If you're above $50K/month and your effective rate hasn't dropped in 6 months, you have negotiating power you're not using. ::: ## Where This Breaks **Mid-month rate changes:** Some fee changes take effect mid-statement period, making month-over-month comparison messy. **Amex and Discover fees:** These networks price differently. Don't average them with Visa/MC. **Delayed chargebacks:** A chargeback on a January transaction might appear on your March statement. This is normal but makes tracking harder. **Refund interchange:** You don't get interchange back on refunds with most processors. A refunded transaction still cost you money. ## Next Steps **Quick monthly review?** 1. [Calculate effective rate](#effective-rate-the-only-number-that-matters) - Total fees / total volume 2. [Scan for new fee names](#red-flag-checklist) - Any surprises? 3. [Verify chargeback count](#chargeback-section) - Matches your records? **Understanding your costs?** 1. [Walk through fee breakdown](#fee-breakdown) - Interchange, assessments, markup 2. [Compare to benchmarks](#effective-rate-benchmarks) - Where do you stand? 3. [Identify pricing model](#pricing-models) - Interchange-plus vs tiered **Time to renegotiate?** 1. [Check renegotiation triggers](#when-to-renegotiate) - Clean history, volume growth 2. [Track effective rate trend](#when-to-renegotiate) - 6 months of data 3. [Follow negotiation tactics](/docs/operations/processor-management) - Know your numbers --- ## Related - [Processor Management](/docs/operations/processor-management) - Negotiating better rates - [Operations Metrics](/docs/operations/metrics) - What else to track - [Settlement & Reconciliation](/docs/payments/settlement) - How deposits work - [Interchange](/docs/payments/reference/interchange) - Interchange rate details - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute costs - [Holds and Reserves](/docs/operations/holds-and-reserves) - Understanding reserves - [PCI DSS](/docs/compliance/pci-dss) - Avoiding non-compliance fees - [Benchmarks](/docs/reference/benchmarks) - Industry rate comparisons - [Payout Strategy](/docs/operations/payout-strategy) - Understanding payout timing - [Card Payments](/docs/payments/payment-methods/cards) - Understanding card costs - [Operations Checklist](/docs/operations/checklist) - Monthly statement review task - [Buying Payments](/docs/payments/buying-payments) - Processor selection and pricing - [Accounting Integration](/docs/operations/accounting-integration) - Connecting statements to QuickBooks/Xero --- ## Representment Workflow Source: https://paymentsandrisk.com/docs/operations/representment-workflow # Representment Workflow :::info[TL;DR] - **Workflow**: Receive โ†’ Analyze reason code โ†’ Decide โ†’ Gather evidence โ†’ Respond โ†’ Monitor - **Deadlines are critical**: Visa 30 days, Mastercard 45 days, Amex 20 days - Decision matrix: strong evidence + any amount = represent; weak evidence + low amount = accept - See [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) for what evidence you need - Target: over 40% win rate, over 95% on-time submission, under 15 days average response time ::: A systematic approach to responding to chargebacks and maximizing win rates. :::tip[SMB Shortcut: Under 10 Chargebacks/Month] If you're handling fewer than 10 chargebacks per month, you don't need a formal workflow. Here's the fast version: 1. **Receive notification** - Check email daily for chargeback alerts (set a filter) 2. **Quick decision** (2 minutes): Is it under $50 with weak evidence? Accept it. Is it over $50 or do you have delivery proof? Fight it. 3. **Gather what you have** (10 minutes): Order confirmation, shipping tracking screenshot, any customer emails. Don't spend more than 15 minutes. 4. **Upload to processor portal** (5 minutes): Compile into one PDF, upload, submit. 5. **Move on** - Check outcome in 30-60 days. Don't obsess. Total time per chargeback: 15-20 minutes. If you're spending longer, your evidence collection process needs work - see [compelling evidence](/docs/chargebacks/representment/compelling-evidence). For the detailed workflow below, use it when you're handling 10+ chargebacks/month or when you need to systematically improve your win rate. ::: --- ## Overview ```mermaid flowchart LR A[๐Ÿ“ฅ Receive\nChargeback] --> B[๐Ÿ” Analyze\nReason Code] B --> C{Decision} C -->|Accept| D[๐Ÿ“ Log &\nClose] C -->|Represent| E[๐Ÿ“„ Gather\nEvidence] E --> F[๐Ÿ“ค Submit\nResponse] F --> G[๐Ÿ“Š Monitor\nOutcome] G -->|Won| H[โœ… Close] G -->|Lost| I[๐Ÿ“ˆ Learn &\nClose] ``` **Key principle:** Every step has a deadline. Track them religiously. --- ## Step 1: Receive and Log Chargeback ### Immediate Actions | Action | Timeline | |--------|----------| | Log receipt date | Same day | | Calculate response deadline | Same day | | Assign to analyst | Within 24 hours | | Begin evidence search | Within 24 hours | ### Information to Record | Field | Source | |-------|--------| | Case number | Network/processor notification | | Reason code | Chargeback details | | Amount | Chargeback details | | Transaction date | Original transaction | | ARN | Chargeback details | | Response deadline | Calculate from receipt | ### Calculate Deadline | Network | Standard Window | |---------|-----------------| | Visa | 30 calendar days from chargeback | | Mastercard | 45 calendar days from chargeback | | Amex | 20 calendar days from notification | | Discover | 30 calendar days from chargeback | --- ## Step 2: Analyze Reason Code ### Determine Requirements For each reason code, identify: 1. **What is alleged?** - Fraud, non-receipt, quality, etc. 2. **What evidence defeats it?** - Per network rules 3. **What are the exclusions?** - When representment isn't allowed 4. **What is realistic win rate?** - Based on evidence available ### Reason Code Categories | Category | Typical Evidence Needed | |----------|------------------------| | **Fraud (10.x, 48xx)** | 3DS, AVS, delivery proof, prior transactions | | **Authorization (11.x)** | Valid authorization record | | **Processing Error (12.x)** | Correct transaction data | | **Consumer Dispute (13.x)** | Delivery proof, terms, refund record | ### Check for Auto-Lose Conditions Don't waste resources if: - Past response deadline - Duplicate case (already represented) - Valid chargeback per rules - No possible evidence exists - Exclusion applies --- ## Step 3: Make Represent Decision ### Decision Matrix | Evidence Quality | Amount | Decision | |-----------------|--------|----------| | Strong | Any | Represent | | Medium | High (over $100) | Represent | | Medium | Low (under $100) | Case-by-case | | Weak | High | Consider (learning) | | Weak | Low | Accept | | None | Any | Accept | ### Factors to Consider | Factor | Impact | |--------|--------| | Evidence strength | Primary factor | | Transaction amount | ROI consideration | | Win rate history | Expectation setting | | Customer relationship | Future value | | Analyst capacity | Resource allocation | ### Document Decision Record: - Decision (represent/accept) - Rationale - Expected win probability - Assigned analyst --- ## Step 4: Gather Evidence ### Evidence Checklist by Type #### For Fraud Chargebacks ``` โ˜ 3D Secure authentication data โ˜ ECI value โ˜ CAVV/AAV โ˜ Transaction ID โ˜ AVS match result โ˜ CVV match result โ˜ Device fingerprint data โ˜ IP address and geolocation โ˜ Prior undisputed transactions โ˜ Customer communication โ˜ Delivery confirmation ``` #### For Non-Receipt Chargebacks ``` โ˜ Tracking number โ˜ Carrier delivery confirmation โ˜ Signature (if obtained) โ˜ Photo proof (if available) โ˜ Delivery address vs. billing โ˜ Customer correspondence โ˜ Download logs (digital goods) โ˜ Access timestamps (services) ``` #### For Quality/Not-As-Described ``` โ˜ Product listing as displayed โ˜ Terms and conditions โ˜ Customer acceptance record โ˜ Inspection report (if applicable) โ˜ Return refusal documentation โ˜ Customer communications โ˜ Quality specifications ``` #### For Cancelled Recurring ``` โ˜ Original consent documentation โ˜ Terms with cancellation policy โ˜ Cancellation request log โ˜ Transaction before/after cancel date โ˜ Pre-billing notifications sent โ˜ Usage logs after "cancellation" ``` ### Evidence Quality Standards | Standard | Requirement | |----------|-------------| | Legible | Clear and readable | | Complete | All relevant pages | | Relevant | Specific to this transaction | | Identified | Transaction reference visible | | Masked | PAN truncated (last 4 only) | --- ## Step 5: Prepare Response ### Response Components | Component | Purpose | |-----------|---------| | Cover letter | Summary of defense | | Evidence packet | Supporting documentation | | Rebuttal letter | Point-by-point response | | Message text | Required network codes | ### Message Text by Network #### Mastercard (DE 72) | Defense | Message Text | |---------|--------------| | Delivered | `DELIVERED MMDDYY` | | Credit issued | `CREDIT ISSUED MMDDYY` | | Compelling evidence | `COMP EVID` | | Authenticated | `AUTH MMDDYY/NNNNNN SL 1` | #### Visa Include in response: - Representment reason - Evidence description - Transaction details ### Document Organization ``` 1. Cover Letter - Case number - Transaction details - Summary of defense 2. Evidence Tab A: Transaction Data - Receipt/order details - Authorization record 3. Evidence Tab B: Delivery/Service - Tracking - Confirmation 4. Evidence Tab C: Customer Contact - Communications - Prior transactions 5. Evidence Tab D: Authentication - 3DS data - AVS/CVV results ``` --- ## Step 6: Submit Response ### Submission Checklist ``` โ˜ Verify case number is correct โ˜ Confirm all evidence attached โ˜ Check file size limits โ˜ Verify format requirements โ˜ Double-check deadline โ˜ Take screenshot of submission โ˜ Save confirmation email/number ``` ### Submission Methods | Network | Method | |---------|--------| | Visa | Via VROL/Verifi or processor portal | | Mastercard | Via Mastercom or processor portal | | Amex | Via Amex merchant portal | | Discover | Via processor portal | ### Document Submission Record: - Date/time submitted - Confirmation number - Files submitted - Portal used --- ## Step 7: Monitor Outcome ### Track Resolution | Status | Meaning | Action | |--------|---------|--------| | Won | Chargeback reversed | Update records | | Lost | Representment rejected | Analyze why | | Pre-arb filed | Issuer challenges | Prepare response | | Arbitration | Network decision | Submit evidence | ### Response Timeline | Stage | When to Expect | |-------|----------------| | Initial response | 30-45 days | | Pre-arbitration | 30 days after response | | Arbitration | 45 days after pre-arb | ### Win/Loss Analysis For each outcome, document: - Reason code - Evidence submitted - Outcome - Network feedback (if any) - Lessons learned --- ## Metrics to Track ### Volume Metrics | Metric | Calculation | |--------|-------------| | Chargebacks received | Count per period | | Representment rate | Represented / Received | | Response rate | Submitted on time / Represented | ### Performance Metrics | Metric | Calculation | Target | |--------|-------------|--------| | Win rate | Won / Submitted | over 40% | | Pre-arb rate | Pre-arbs / Won | under 30% | | Arbitration rate | Arbitrations / Pre-arbs | under 10% | ### Efficiency Metrics | Metric | Calculation | Target | |--------|-------------|--------| | Avg response time | Days to submit | under 15 days | | SLA compliance | On-time / Total | over 95% | | Evidence completeness | Docs per case | Track trend | --- ## Common Mistakes ### Process Mistakes | Mistake | Prevention | |---------|------------| | Missed deadline | Calendar + alerts | | Wrong case number | Double-check before submit | | Missing evidence | Checklist review | | Wrong reason code defense | Match evidence to code | ### Evidence Mistakes | Mistake | Prevention | |---------|------------| | Illegible documents | Quality check before submit | | Missing pages | Complete document review | | Wrong transaction | Verify ARN/transaction ID | | Unmasked PAN | Always truncate to last 4 | ### Strategy Mistakes | Mistake | Prevention | |---------|------------| | Representing weak cases | Decision matrix | | Not representing strong cases | Evidence review | | Generic responses | Customize per reason code | | Missing message text | Checklist per network | --- ## Templates ### Cover Letter Template ``` RE: Case Number [CASE#] Transaction Date: [DATE] Amount: [AMOUNT] ARN: [ARN] Dear Disputes Team, We are submitting this representment for the above-referenced chargeback filed under reason code [CODE]. [BRIEF SUMMARY OF DEFENSE] Enclosed please find: - [LIST OF EVIDENCE] Based on the evidence provided, we respectfully request this chargeback be reversed. Sincerely, [NAME/TITLE] ``` --- ## Next Steps **Setting up representment workflow?** 1. [Calculate deadlines](#calculate-deadline) - Network-specific windows 2. [Create decision matrix](#decision-matrix) - When to represent 3. [Build evidence checklists](#evidence-checklist-by-type) - By fraud type **Responding to a chargeback?** 1. [Analyze reason code](#step-2-analyze-reason-code) - What evidence defeats it 2. [Gather evidence](#step-4-gather-evidence) - Checklist by type 3. [Submit response](#step-6-submit-response) - Before deadline **Improving win rates?** 1. [Track metrics](#metrics-to-track) - Win rate, response time 2. [Avoid common mistakes](#common-mistakes) - Process, evidence, strategy 3. [Use templates](#templates) - Cover letter format --- ## See Also - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Time Frames Reference](/docs/reference/time-frames) - Network deadlines - [Reason Codes - Mastercard](/docs/reference/reason-codes/mastercard) - MC dispute codes - [Reason Codes - Visa](/docs/reference/reason-codes/visa) - Visa dispute codes - [Reason Codes - Amex](/docs/reference/reason-codes/amex) - Amex dispute codes - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Winning Evidence](/docs/chargebacks/winning-evidence) - Documentation strategy - [Chargeback Metrics](/docs/chargebacks/metrics) - Win rate tracking - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Fraud Classification](/docs/reference/fraud-classification) - Identify fraud type - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes upstream --- ## Running Fraud Operations Source: https://paymentsandrisk.com/docs/operations/running-fraud-operations # Playbook: Running Fraud Operations :::info[TL;DR] - **Daily:** Clear the review queue (same-day SLA), scan for spikes, process block list additions - **Weekly:** Check false positive rate (sample 10 blocked transactions), review fraud losses, check score distribution - **Monthly:** Full rule performance review, threshold check, retire stale rules, update velocity limits - **Quarterly:** Re-run threshold sweep, review seasonal adjustments, audit allow/block lists - You're operating five things: rules, model thresholds, the review queue, block/allow lists, and feedback. This playbook ties them together ::: This is the operational playbook for running fraud detection day-to-day. It ties together [fraud rules](/docs/fraud/detection/building-fraud-rules), [ML model feedback](/docs/fraud/detection/fraud-model-feedback), [review queues](/docs/fraud/detection/manual-review), and [block/allow lists](/docs/fraud/detection/building-fraud-rules#allow-lists-and-block-lists) into a working system. For crisis response (active fraud attack), use [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) instead. This playbook is for steady-state operations. --- ## Workflow Overview ```mermaid flowchart LR A[DAILYQueue &Spikes] --> B[WEEKLYLosses &FP Check] B --> C[MONTHLYRule Review &Thresholds] C --> D[QUARTERLYThreshold Sweep &Seasonal Adjust] D --> A style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` --- ## The Five Things You Operate | Component | What It Is | Your Job | |-----------|-----------|----------| | **Rules** | Your logic for known fraud patterns | Create, tune, retire. [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) | | **Model thresholds** | Your sensitivity dial for ML scores | Set, monitor drift, re-calibrate. [Risk Scoring](/docs/fraud/prevention/risk-scoring) | | **Review queue** | Your gray zone for ambiguous transactions | Clear daily, maintain SLA. [Manual Review](/docs/fraud/detection/manual-review) | | **Block/allow lists** | Your overrides for known good and bad actors | Add on confirmed fraud, prune expired entries. [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules#allow-lists-and-block-lists) | | **Feedback** | Your improvement engine for ML | Verify chargebacks flow, send fraud reports fast. [Fraud Model Feedback](/docs/fraud/detection/fraud-model-feedback) | Everything else is a detail of one of these five. --- ## Daily Operations **Time budget:** 15-30 minutes for most SMBs. ``` โ–ก Clear the review queue - SLA: same business day for all items - For each review item: โ–ก Check fraud signals (score, rules triggered, device, IP) โ–ก Decision: approve, decline, or escalate โ–ก If fraud confirmed: add email + device to block list โ–ก If legitimate: approve and consider adding to allow list - If queue is consistently > 50 items/day, your thresholds are sending too much to review. Tighten rules or adjust score thresholds โ–ก Scan for spikes - Check: decline rate vs. yesterday (> 2x = investigate) - Check: fraud alerts or flags vs. yesterday - Check: review queue volume vs. normal - If spike detected: follow Survive a Fraud Attack playbook โ–ก Process block list additions - Add confirmed fraud identifiers (email, card hash, device) - Set expiration dates (IP: 30-90 days, email: 12 months) - Don't batch these. Block confirmed fraud immediately ``` :::tip[Automating Daily Tasks] Most of the daily block list work can be automated. Configure your review tool to auto-add identifiers to the block list when a reviewer marks a transaction as fraud. Configure your processor to auto-block on chargeback. Manual daily work should be reviewing the queue and scanning for spikes. ::: --- ## Weekly Operations **Time budget:** 30-60 minutes. ``` โ–ก Review fraud losses vs. blocked transactions - Pull: total fraud losses this week ($) - Pull: total blocked transaction value this week ($) - Compare to last week and 4-week average - Rising fraud losses with stable blocks = new pattern getting through - Rising blocks with stable fraud = rules may be too aggressive โ–ก Check false positive rate - Sample 10 blocked or declined transactions from the past week - For each: was it actually fraud or a legitimate customer? - Calculate: legitimate / total sampled = false positive rate - Target: under 50% false positive rate - Over 50%: identify the triggering rules and loosen or add exceptions โ–ก Look for new patterns - Review this week's confirmed fraud: โ–ก Same merchant category or product? โ–ก Same BIN range or card issuer? โ–ก Same geography or IP range? โ–ก Same time of day? - If you see a cluster: write a rule in shadow mode (see Building Fraud Rules) โ–ก Check score distribution for drift - Pull fraud score histogram for the past week - Compare to 4-week rolling average - If median shifted > 5 points: investigate - See Fraud Model Feedback for drift response ``` --- ## Monthly Operations **Time budget:** 1-2 hours. ``` โ–ก Full rule performance review - Pull trigger rate per rule (how often each rule fires) - Pull precision per rule (fraud-in-hits rate) - Fill in the rule performance table (template below) - Action by result: โ–ก Fraud-in-hits > 30%, FP rate low โ†’ Keep, consider tightening โ–ก Fraud-in-hits 10-30% โ†’ Add conditions or tighten threshold โ–ก Fraud-in-hits 1% of traffic โ†’ Probably too aggressive โ–ก Threshold check - Is your score distribution shifting? (Check weekly data) - Has your block rate changed > 20% from baseline? - Has your fraud-in-approved rate changed? - If any shifted significantly: re-run threshold sweep (see Risk Scoring) โ–ก Update velocity limits for seasonal changes - Next month: peak season? Holiday? Back-to-school? - If approaching peak: loosen velocity limits 10-15% - If leaving peak: tighten back to baseline - See Velocity Rules for seasonal edge cases โ–ก Retire stale rules - Identify rules that haven't triggered in 90 days - Verify the fraud pattern they targeted is no longer active - Retire (disable, don't delete. Keep a log in case the pattern returns) โ–ก Audit block/allow lists - Remove expired block list entries (should be automatic if TTL is set) - Review allow list entries: still justified? - Check for block list entries without expiration dates. Add them โ–ก Send fraud reports - Review any confirmed fraud not yet reported to your vendor - Verify chargeback integration is still flowing (see Fraud Model Feedback) ``` ### Monthly Rule Performance Template | Rule Name | Triggers | Blocks | Reviews | Fraud Caught | False Positives | FP Rate | Action | |-----------|----------|--------|---------|-------------|-----------------|---------|--------| | *Example: High value review* | *500* | *0* | *500* | *45* | *350* | *70%* | *Add tenure exception* | | | | | | | | | | | | | | | | | | | | | | | | | | | | --- ## Quarterly Operations **Time budget:** 2-4 hours. ``` โ–ก Re-run threshold sweep - Follow the experiment in Risk Scoring - Compare optimal thresholds to current settings - If shifted > 10 points: update thresholds gradually (not all at once) โ–ก Review seasonal adjustments - What's coming next quarter? Holidays, promotions, slow season? - Pre-plan threshold adjustments for known peaks - Set calendar reminders to loosen/tighten on specific dates โ–ก Full block/allow list audit - Export block list. How many entries? How old is the oldest? - Export allow list. Are any entries stale (customer inactive)? - Prune lists. Smaller lists are faster and more accurate โ–ก Evaluate tool effectiveness - Is your current fraud stack catching enough? - Are you outgrowing your tools? - Review: total fraud rate, false positive rate, review rate, net fraud cost - If fraud rate > 0.1% consistently: consider upgrading tools (see Fraud Vendors) ``` --- ## When Things Go Wrong ### Fraud Spike **Trigger:** Fraud losses jump 2x+ over baseline in a single day. ``` โ–ก Immediate (first 30 minutes): - Tighten rules: lower amount ceilings, reduce velocity limits - Increase review queue priority - Check: is this a known pattern or something new? โ–ก Within 2 hours: - Investigate pattern: IPs, devices, BINs, email domains - Deploy targeted block list entries - Write a targeted rule in shadow mode (or live if high confidence) โ–ก Within 24 hours: - Measure: is the spike contained? - If not contained: follow Survive a Fraud Attack playbook - If contained: keep new rules in place, monitor for 1 week ``` ### False Positive Spike **Trigger:** Customer complaints about declined transactions jump, or your weekly FP sample shows > 60% legitimate. ``` โ–ก Immediate: - Identify which rule(s) are causing the most false positives - Move the worst offender from "decline" to "review" (or shadow mode) โ–ก Within 24 hours: - Analyze: what changed? New rule deployed? Score drift? Traffic mix change? - Check: did someone tighten a threshold without testing? โ–ก Within 1 week: - Re-test the rule in shadow mode - Add exceptions for affected customer segments - Monitor false positive rate daily until stable ``` ### New Attack Type **Trigger:** You see fraud getting through that doesn't match any existing rules. Chargebacks from a pattern you haven't seen before. ``` โ–ก Document the pattern: - What do the fraudulent transactions have in common? - IP range? Device type? Product category? Time pattern? โ–ก Write a rule in shadow mode: - Target the identified pattern - Run shadow for 1 week (accelerated from the normal 2 weeks) - If fraud-in-hits > 30%: promote to live โ–ก Report to your vendor: - Send fraud reports for all confirmed fraud in this pattern - This helps the ML model learn faster โ–ก Monitor for adaptation: - Fraudsters adjust. Watch for the same pattern with slight variations ``` ### Vendor Outage **Trigger:** Your fraud vendor or scoring service is down. Transactions are coming through unscored. ``` โ–ก Immediate fallback: - Enable basic processor rules (if not already active): โ–ก Amount cap: decline orders over $X (5x your AOV) โ–ก Velocity limit: block > 3 charges per card per hour โ–ก Country mismatch: review (not decline) international orders - Send all orders over your review threshold to manual review โ–ก During outage: - Monitor block rate and fraud rate manually - Be conservative: it's better to review more than to approve blind โ–ก After recovery: - Re-score any transactions that were processed unscored (if possible) - Review the manual decisions from the outage period - Check for fraud that slipped through during the outage ``` --- ## Measuring Success Track these four metrics to know if your fraud operations are working. | Metric | Formula | Target | Red Flag | |--------|---------|--------|----------| | **Fraud rate** | Fraud losses / Total volume | Under 0.1% | Above 0.3% | | **Block rate** | Declined transactions / Total transactions | Watch for drift | Sudden change > 20% | | **False positive rate** | Legitimate blocked / Total blocked | Under 50% | Above 70% | | **Review rate** | Manual reviews / Total transactions | Under 2% | Above 5% (queue bottleneck) | ### Net Fraud Cost Formula ``` Net fraud cost = Fraud losses + (False positives x Average order value x Estimated LTV loss rate) + (Review volume x Cost per review) - (Fraud prevented x Average fraud amount) ``` This is the number that matters. Optimizing fraud rate alone can drive false positives up. Optimizing false positives alone can let fraud through. Net fraud cost captures the full trade-off. For the false positive cost calculation, see [Risk Scoring: Finding Your Thresholds](/docs/fraud/prevention/risk-scoring#finding-your-thresholds). For fraud economics, see [Fraud Economics](/docs/fraud/fundamentals/economics). --- ## Next Steps **Setting up fraud operations for the first time?** 1. Deploy the [day-one rule set](/docs/fraud/detection/building-fraud-rules#your-day-one-rule-set) 2. Start with just the daily checklist for the first month 3. Add weekly and monthly checks as you build muscle **Already running operations but want to improve?** 1. Start the weekly [false positive sampling](#weekly-operations) if you're not doing it 2. Build the [monthly rule performance template](#monthly-rule-performance-template) 3. Set up your first [threshold sweep](/docs/fraud/prevention/risk-scoring) **In a crisis right now?** 1. [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) - Active attack response 2. [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Chargeback ratio spiking --- ## Related - [Building Fraud Rules](/docs/fraud/detection/building-fraud-rules) - Starter rules, allow/block lists, shadow mode - [Fraud Model Feedback](/docs/fraud/detection/fraud-model-feedback) - Feedback loops and model monitoring - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Thresholds and cost calculations - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP, email, phone intelligence vendors - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate-based detection and tuning - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - When to use each approach - [Manual Review](/docs/fraud/detection/manual-review) - Review queue management - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Platform-specific setup - [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) - Crisis response playbook - [Fraud Metrics](/docs/fraud/metrics) - Measuring detection performance - [Fraud Economics](/docs/fraud/fundamentals/economics) - Cost of fraud decisions - [Fraud Vendors](/docs/fraud/vendors/landscape) - Third-party tools - [Experimentation](/docs/reference/experimentation) - Testing changes safely --- ## Scaling Milestones - What Changes by Volume Tier Source: https://paymentsandrisk.com/docs/operations/scaling-milestones # Scaling Milestones - What Changes by Volume Tier :::info[TL;DR] - What works at $100K/month breaks at $500K. What you ignored at $250K becomes critical at $1M. There are real inflection points where an investment goes from wasteful to essential - Under $250K/month: processor built-ins, basic alerts and manual review are enough. Don't buy fraud platforms or chargeback vendors yet - $250K-$1M/month: the ROI on alert services (RDR/Ethoca), dedicated dispute management, and interchange optimization tools kicks in - Over $1M/month: processor diversification, dedicated fraud tooling and a real risk team stop being optional - **Moving off flat-rate beats negotiating your flat rate, usually by 5x.** At $250K/month card-present on a $75 ticket that's about $2,970 a month against a published interchange-plus band. A 0.2% discount is worth $500. Every cost figure here uses one pass-through assumption, 1.03% + $0.178 card-present ([Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions)) - Almost no fraud vendor publishes a price. SEON does, at $699/month for 2,500 checks. That's your only public anchor for judging every quote-only vendor ::: What worked at $100K/month breaks at $500K. What you could ignore at $250K becomes critical at $1M. This page pulls the tier-based guidance scattered across the site into one roadmap. ## Why This Matters **Every $250K increment, something changes.** - New tools become ROI-positive - Monitoring thresholds you couldn't hit are now reachable - Manual processes don't scale - Processor relationships shift **Guess wrong and you either waste money or walk into a crisis you could have prevented.** Under $50K Tier 1 - Processor built-ins only $50K-$250K Tier 2 - Add dispute alerts $250K-$1M Tier 3 - Fraud tools + rate negotiation $1M-$5M Tier 4 - Full-time hire + full tool stack $5M+ Tier 5 - Multi-processor + dedicated team --- ## Quick Tier Overview ```mermaid %%{init: {'themeVariables': {}}}%% xychart-beta title "Hours/Week by Volume Tier" x-axis ["Under $50K", "$50K-$250K", "$250K-$1M", "$1M-$5M", "$5M+"] y-axis "Hours per Week" 0 --> 45 bar [3, 6, 12, 30, 40] ``` | Tier | Monthly Volume | Key Changes | Time Investment | |------|----------------|-------------|-----------------| | **Tier 1** | Under $50K | Processor built-ins only | 2-4 hrs/week | | **Tier 2** | $50K-$250K | Add dispute alerts | 4-8 hrs/week | | **Tier 3** | $250K-$1M | Add fraud tool, negotiate rates | 8-15 hrs/week | | **Tier 4** | $1M-$5M | Hire full-time, full tool stack | 20-40 hrs/week | | **Tier 5** | Over $5M | Multi-processor, dedicated team | Full-time team | ```mermaid %%{init: {'themeVariables': {'cScale0': '#6b7280', 'cScale1': '#6b7280', 'cScale2': '#6b7280', 'cScale3': '#6b7280', 'cScale4': '#6b7280', 'cScaleLabel0': '#ffffff', 'cScaleLabel1': '#ffffff', 'cScaleLabel2': '#ffffff', 'cScaleLabel3': '#ffffff', 'cScaleLabel4': '#ffffff'}}}%% timeline title What to Add at Each Milestone Under $50K : Processor built-ins : Manual review $50K-$250K : Dispute alerts : Basic monitoring $250K-$1M : Fraud tools : Rate negotiation : Dedicated hours $1M-$5M : Full-time hire : Full tool stack : Multi-processor eval $5M+ : Dedicated team : Multi-processor live : Enterprise fraud platform ``` --- ## From $0 to $50K/Month (Getting Started) ### What You Need **Processor**: Square or Helcim. Published rates, verified 2026-08-02: | Processor | Card present | Online | Monthly fee | Source | |-----------|--------------|--------|-------------|--------| | **Square** (Free plan) | 2.6% + 15c | 3.3% + 30c | $0 | [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees) | | **Helcim** ($0-50K/mo band) | Interchange + 0.40% + 8c | Interchange + 0.50% + 25c | $0 | [helcim.com/pricing](https://www.helcim.com/pricing/) | | **Stripe** | 2.7% + 5c | 2.9% + 30c | $0 | [stripe.com/pricing](https://stripe.com/pricing) | Two notes on that table, and both are about the cents rather than the percentages. Square's card-present fixed component is **15 cents**, not 10. A lot of comparison content still carries the wrong figure, and on a $12 coffee five cents is most of your margin. Stripe Terminal's is **5 cents**, a full dime lower, against a rate only a tenth of a point higher. Run that same $12 coffee: Square takes 46.2c, Stripe takes 37.4c. **At a low ticket the fixed fee decides it, and Stripe is about nine cents a sale cheaper.** Card-present, at a coffee-shop ticket, that's the whole comparison. **Tools**: Processor built-ins only. Stripe Radar Lite comes with Stripe Payments at no extra charge. Radar Standard, Plus and Pro are paid subscriptions you don't need yet. Square's built-in risk rules are included. **Staffing**: Founder handles part-time (2-4 hours/week) ### Critical Setup (Week 1) **Do these immediately.** - Set billing descriptor correctly (prevents 30% more chargebacks) - Enable basic fraud rules (Stripe Radar Lite or Square defaults) - Configure email receipts - Set up reconciliation process **See**: [Stripe First Week](/docs/playbooks/stripe-first-week), [Square First Week](/docs/playbooks/square-first-week), [Shopify First Week](/docs/playbooks/shopify-first-week) ### What to Monitor **Weekly checks**: - Chargeback count (should be 0-3/week) - Refund rate (under 5%) - Deposit timing (verify funds arrive) **Don't monitor yet.** CB ratio, because your volume is too low to hit thresholds :::warning[What NOT to Buy at This Tier] - **Fraud tools** - Negative ROI at this volume. Almost nobody here publishes a price. The exception is SEON, whose Starter plan is **$699/month for 2,500 fraud checks** ([seon.io/pricing](https://seon.io/pricing/), verified 2026-08-02). Sift, Signifyd, Riskified, Forter, Sardine and Equifax/Kount are all quote-only. Use SEON's number as your sanity anchor. If a salesperson quotes far above roughly 28 cents a check, ask why - **Dispute alerts** - ROI unlikely under $50K. Verifi and Ethoca don't publish alert pricing. It sells through resellers, so the price you're offered is the reseller's, not the network's. Ask for the per-alert price and the monthly minimum, in writing - **Analytics platforms** - Processor dashboard is sufficient - **Consultants** - Playbooks handle your problems at this scale ::: ### Budget for This Tier - Processing fees, on a $50 average ticket: **2.90% card-present or 3.90% online** on Square's Free plan, **1.95% card-present or 2.84% online** on Helcim's entry band. The channel matters more than the tier does at this size - Chargeback costs: $200-800/month (if 0.5% ratio) - Tools: $0-50/month - **Add roughly 0.3-0.8% for chargebacks and tools** on top of whichever processing rate applies. Don't budget a single all-in number **See**: [Total Cost Model](/docs/payments/total-cost-model) --- ## From $50K to $250K/Month (Add Dispute Alerts) ### What Changes at $100K/Month **You can now hit volume thresholds.** - Dispute alert ROI turns positive at this volume - Mastercard ECM: 100 disputes/month threshold - Your CB ratio actually matters now **What to add**: - **Dispute alerts** (Verifi + Ethoca). Neither network publishes alert pricing, and you'll buy through a reseller. Get the per-alert fee, the monthly minimum, and the contract term in writing before you sign - **Weekly ratio monitoring** (not just count) ### Month 1 at $100K Checklist ``` โ˜ Calculate current CB ratio (disputes / volume) โ˜ If over 0.65%: Add dispute alerts immediately โ˜ Set up weekly ratio tracking spreadsheet โ˜ Start 3-bid shopping for better rates โ˜ Review Common Mistakes list ``` ### When to Add Dispute Alerts **Add when you hit either of these.** - 75+ chargebacks/month OR - 0.65%+ chargeback ratio **Work out your own break-even. Don't trust a vendor's ROI slide.** The method, at $150K/month: 1. **Transaction count.** $150,000 at a $75 average ticket is 2,000 transactions a month. Use your own average ticket. 2. **Chargebacks.** A 0.6% dispute ratio on 2,000 transactions is 12 chargebacks a month. 3. **How many alerts catch.** Alert programs typically resolve around 40% before they become chargebacks. Call it 5. 4. **What you actually save.** Not the sale. Resolving an alert means refunding the customer. The revenue is gone either way. What you save is the dispute fee plus the 1-3 hours you'd have spent responding. 5. **The dispute fee you avoid**, published rates read 2026-08-02. $15 on [Stripe](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) or [Braintree](https://www.paypal.com/us/enterprise/paypal-braintree-fees). $15 or $20 on [PayPal](https://www.paypal.com/us/business/paypal-business-fees), depending on whether the transaction went through a PayPal account. **$0 on [Square](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough)**. CA$25 on [Moneris](https://www.moneris.com/en/pricing). And $15 on [Helcim](https://www.helcim.com/pricing/), only if you'd have lost the case. **Your break-even:** 5 prevented disputes ร— $15 = $75/month in fees, plus 5 ร— 2 hours of your time. Value your time at $50/hour and alerts are worth up to **$575/month**. The fees are the small half of that. Most of what you're buying is your own time back, and the ratio. On Square the fee is $0, so the whole case rests on time and ratio. If you're on PayPal and your dispute ratio is near 1.5%, the maths changes sharply. Above that line every dispute costs $30, win or lose. So 5 prevented disputes saves $150 in fees instead of $75, and the ceiling goes to $650/month. Get a quote, compare it to that number, walk if it's above. Verifi and Ethoca don't publish alert pricing. The figure you're quoted is a reseller's margin decision, and it's negotiable. **See**: [Setup Dispute Alerts](/docs/playbooks/setup-dispute-alerts) ### What to Monitor **Weekly** (30-45 min): - CB ratio trend (target: under 0.5%) - Win rate on disputes - Fraud rate - Auth rate **Monthly** (1-2 hours): - Review processor statement - Calculate effective rate - Check if you can negotiate rates yet (not until $250K+) ### Staffing Still founder/operations generalist: - 4-8 hours/week on payment operations - 1-2 hours/week on chargeback responses (5-15/month) **Don't hire yet.** Not enough volume to justify a dedicated person. ### Budget for This Tier - Processing fees: still channel-driven, not tier-driven. Use the Tier 1 figures above and calculate your own from your statement - Chargeback costs: $800-2,000/month - Tools: dispute alerts, price not published. Budget against the break-even you calculated above, not against a number you read somewhere --- ## From $250K to $1M/Month (Add Fraud Tool, Negotiate Rates) ### What Changes at $250K/Month **You can hit BOTH ratio and count thresholds.** - Potential for VAMP/ECM enrollment - Processor will start negotiating rates - Fraud tool ROI becomes positive (if CB ratio >0.6%) ### What Changes at $500K/Month **Tools become critical.** - Fraud tool prevents VAMP breach - Backup processor relationship worth considering - Manual fraud review becomes overwhelming (100+ flags/day) ### Month 1 at $250K Checklist ``` โ˜ Run 3-bid process (processor negotiation now works) โ˜ Price an interchange-plus quote against your current flat rate - usually the bigger saving โ˜ Ask current processor for a volume discount as well (0.1-0.2% is a realistic ask) โ˜ Calculate fraud tool ROI (if CB ratio >0.6%, add tool) โ˜ Consider fractional help if overwhelmed (8-15 hrs/week is a lot) โ˜ Review tool stack tier guidance ``` ### Tools to Add **At $250K/month, CB ratio 0.6-0.8%**: - Dispute alerts: Required - Fraud tool (Sift, Signifyd, SEON): Consider strongly - Chargeback automation (Chargeflow): Nice-to-have **At $500K/month, any CB ratio**: - Fraud tool: Required - Dispute alerts: Required - Analytics: Stripe Sigma or exports :::note[What fraud vendors actually publish] Of the major fraud platforms, only **SEON** publishes a price. Starter is $699/month for 2,500 fraud checks, 10 users and 50 custom rules. Premium is quote-only ([seon.io/pricing](https://seon.io/pricing/), verified 2026-08-02). **Signifyd** publishes its model but no numbers. "A percentage of the order total when an order is approved." It varies by product, vertical, order volume and average ticket. And there's "no charge when an order is declined due to fraud" ([signifyd.com/pricing](https://www.signifyd.com/pricing/), verified 2026-08-02). **Sift, Riskified, Forter, Sardine, Accertify** and **Equifax (formerly Kount)** publish nothing. Quote only. When you take those calls, ask four things. Is pricing per screened transaction, per approved order, or a platform subscription? What's the monthly minimum? What's the contract term? And for anything sold as a guarantee, what does it cover and when does the money arrive? ::: **See**: [Tool Stack by Tier](/docs/payments/tool-stack) ### Rate Negotiation, and Why Switching Models Usually Beats It The standard advice is to call your processor and ask for 0.1-0.2% off. At $250K/month that's worth $250-500 a month. Fine advice. It's also the smaller of the two moves available to you. The bigger move is leaving flat-rate for interchange-plus. The markup is published openly and drops automatically as you grow. No negotiation required. **Worked comparison at $250K/month, card present.** Assume a $75 average ticket, so 3,333 transactions. Pass-through is this site's blended card-present figure of **1.03% + $0.178**, interchange plus network assessments. That one assumption drives both interchange-plus rows. It's also the only input here that isn't a published vendor rate. Read [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) before you rely on it. | Option | Markup structure | Monthly cost | Effective rate | |--------|------------------|--------------|----------------| | **Square Free** (flat) | 2.6% + 15c, all-in | $7,000 | 2.80% | | **Helcim** ($100K-500K band) | Interchange + 0.25% + 7c, $0/mo | $4,027 | 1.61% | | **Stax** | Interchange + 0% + 8c, plus subscription | $3,634 at its published $199 floor | 1.45% | Sources, all verified 2026-08-02: [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), [helcim.com/pricing](https://www.helcim.com/pricing/), [staxpayments.com/pricing](https://staxpayments.com/pricing/). **Moving off flat rate saves this merchant $2,973 a month against Helcim's published band. Negotiating 0.2% off flat rate saves $500.** Do the switch first, then negotiate. Read the Stax row as a floor, not a price. $250,000 a month is $3M a year, far above the top band Stax publishes. So $199 is the smallest its subscription could be. The real number is whatever it quotes you. If that quote comes back at $199, Stax saves $3,366 a month rather than $2,973. Either way the switch is worth roughly six times the discount you'd get by asking nicely. **These figures used to be wrong here, and wrong in the direction that made you less likely to act.** The old version assumed a card mix averaging 1.80% + $0.10 in interchange. That's roughly one card type, not a blend. It published $5,692 for Helcim and a saving of $1,300-1,700. The real saving is about twice that. :::warning[Stax's volume bands are ANNUAL, not monthly] Stax publishes $99/month up to $150,000 **per year**, $139/month for $150,000-$250,000 **per year**, and $199+/month above $250,000 per year. Plenty of comparison content reads those as monthly bands. That makes Stax look about 12 times dearer than it is. It steers small merchants away from a genuinely cheap option. A shop doing $20,000 a month is at $240,000 a year. That's the **$139 tier**, not a custom quote. The flip side. At $250,000 a month you're at $3M a year, far above the top published band. The "+" in "$199+" is doing real work there. Stax says "subscription prices are determined by processing volume." Ask what your actual subscription would be before you model it. Source: [staxpayments.com/pricing](https://staxpayments.com/pricing/), verified 2026-08-02. ::: **Helcim needs no negotiation at all.** Its bands are published. They apply automatically on monthly credit card volume. | Monthly volume | In person | Online | |---|---|---| | **$0-50K** | IC + 0.40% + 8c | IC + 0.50% + 25c | | **$50K-100K** | IC + 0.35% + 7c | IC + 0.45% + 20c | | **$100K-500K** | IC + 0.25% + 7c | IC + 0.35% + 20c | | **$500K-1M** | IC + 0.20% + 6c | IC + 0.25% + 15c | | **$1M-5M** | IC + 0.15% + 6c | IC + 0.15% + 15c | | **Over $5M** | Custom | Custom | That's five published bands plus custom above $5M, not three. The discount arrives when your volume does. One trap when you compare the two. **Helcim's bands key off monthly volume. Stax's key off annual.** A merchant at $20,000 a month is in Helcim's entry band and Stax's $139 tier at the same time. Compare them without converting and you're off by a factor of twelve. Plenty of content is. **See**: [Processor Contracts](/docs/payments/buying-payments/contracts) ### Staffing Changes **At $500K/month**: - Consider fractional expert (10-20 hrs/week at $2K-4K/month) - OR operations generalist spending 25% time on payments - Founder can't handle 15 hours/week anymore **At $750K-$1M**: - Plan for full-time hire at $1M - Start writing job description - Budget $60K-80K/year ### What to Monitor **Daily** (5-15 min): - Fraud queue (approve/decline flagged orders) - Chargeback notifications **Weekly** (30-60 min): - CB ratio by network (Visa, Mastercard separate) - Win rate by reason code - Fraud tool performance **Monthly** (2-3 hours): - Full cost analysis - Tool ROI review - Optimization opportunities ### Budget for This Tier - Processing fees on a $75 ticket: **1.61% card-present and about 2.35% online** on Helcim's published $100K-500K bands, against 2.80% and 3.70% on Square's Free plan (see the worked comparison above) - Chargeback costs: $2,000-5,000/month - Tools: mostly quote-only. SEON's published $699/month is the only real anchor. Everything else depends on what you negotiate - Labor: $2,000-4,000/month (fractional or internal) --- ## From $1M to $5M/Month (Hire Full-Time, Full Stack) ### What Changes at $1M/Month **You MUST have dedicated resources.** - 100+ chargebacks/month (50+ hours/month to respond) - 500+ fraud reviews/day (impossible for one person part-time) - Both networks monitoring you - Reserves of $100K-$300K locked up ### Month 1 at $1M Checklist ``` โ˜ Hire full-time payments/fraud person ($60K-80K/year) โ˜ Ensure full tool stack (fraud tool + alerts + analytics) โ˜ Get onto interchange-plus if you aren't already, and target a markup near 0.15-0.20% + 6c โ˜ Benchmark any quote against Helcim's published $1M-5M band, which needs no negotiation โ˜ Establish backup processor relationship โ˜ Document all processes (fraud review, CB response, reconciliation) โ˜ Weekly metrics reporting to leadership ``` ### Required Tools **No longer optional.** - Fraud tool: no enterprise vendor publishes a price. SEON's $699/month for 2,500 checks is the only published figure in the category. You're well past that check volume. So you're in quote territory. Ask for the per-check or per-decision rate at your volume, not a bundled monthly number - Dispute alerts: not published, reseller-quoted - Analytics: Stripe Sigma + BI tool - Accounting integration: Full automation **Consider**: - Chargeback guarantee (if CB ratio >0.7%). Nobody publishes a rate. Signifyd at least publishes the shape of the deal. A percentage of the order total on approved orders, with no charge when an order is declined for fraud ([signifyd.com/pricing](https://www.signifyd.com/pricing/), verified 2026-08-02). Get the percentage for your vertical and average ticket. Then ask what the guarantee covers, whether item-not-received abuse is included, and how fast reimbursement lands - Manual review outsourcing (if 24/7 coverage needed) ### Processor Strategy **At $1M-$2M**: - Single processor on interchange-plus, backup approved but carrying minimal volume **At $2M-$5M**: - Consider multi-processor (70/30 split) - Use backup for redundancy + negotiation leverage - Look at Adyen if you're genuinely international. Read the note below before you assume it's cheaper **Rate targets, stated as markup rather than all-in.** All-in effective rates depend on your card mix. "Aim for 2.5%" hides whether you got a good deal or a rich card mix. Benchmark the markup instead. Helcim publishes interchange + 0.15% + 6c in person for $1M-5M/month, with no negotiation and no monthly fee ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). On this site's blended card-present pass-through that's roughly a **1.50% effective rate at $1M/month on a $75 ticket**. And it's a published price, not a negotiated one. Run the same band on the inflated 1.80% interchange assumption and it reads 2.16% instead, which is how a published rate gets mistaken for a mediocre one ([Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions)). So the target at $1M+ isn't 2.5-2.7%. It's a markup at or below 0.20% + 6c card present. If a processor quotes well above that and can't explain why, you're paying for something. You should be able to name it. :::note[Adyen at this tier] Adyen doesn't publish SMB or mid-market rates. It publishes the structure. Interchange++ plus a **$0.13 processing fee per transaction**, with an indicative card markup of **0.60%**. Then the caveat: "the fees outlined above are indicative; please get in touch to discuss pricing options" ([adyen.com/pricing](https://www.adyen.com/pricing), verified 2026-08-02). Two things worth knowing. First, there's **no $10M/year volume minimum** on Adyen's pricing page. That figure circulates widely and it isn't Adyen's. What Adyen does say is "we do not have monthly fees, set-up fees, integration fees or closure fees. We do have a minimum invoice depending on industry or business model." No amount attached. Ask for that minimum monthly invoice in writing before you integrate. Second, on price alone Adyen's indicative 0.60% markup is above Helcim's published 0.15% band at the same volume. The case for Adyen is local acquiring across many countries. One platform for global payment methods. Auth-rate optimisation on cross-border traffic. Buy it for that. Don't buy it expecting a cheaper domestic markup. ::: ### Staffing **At $1M/month**: - 1 FTE: Payments Operations Generalist - Handles: Fraud review, CB responses, processor management, reporting - 40 hours a week, all of it spoken for **At $2M-$3M/month**: - 2 FTE: Split fraud and chargebacks - OR 1 FTE + outsourced manual review **At $5M/month**: - 2-3 FTE: Fraud Analyst + CB Specialist + Manager - OR 1 manager + outsourced operations ### What to Monitor **Real-time**: - Fraud tool dashboard (approve/decline decisions) - Chargeback notifications (respond within 48 hours) **Daily** (15-30 min): - CB ratio by network - Auth rate trends - Fraud false positive rate **Weekly** (1-2 hours): - Win rate analysis - Tool performance review - Processor relationship check **Monthly** (4-8 hours): - Executive reporting - Cost optimization - Strategic planning ### Budget for This Tier - Processing fees on a $75 ticket: around **1.50% card-present and 2.08% online** on Helcim's published $1M-5M bands, higher if your card mix is rewards-heavy - Chargeback costs: $5,000-15,000/month - Tools: quote-only across the board at this tier - model your own from the per-decision rates you're quoted - Labor: $5,000-10,000/month (FTE salaries) --- ## Over $5M/Month (Multi-Processor, Dedicated Team) ### What Changes at $5M/Month **Enterprise operations.** - 300+ chargebacks/month - 2,000+ fraud reviews/day - Multi-processor required (redundancy + leverage) - Network relationships matter - Direct acquirer conversations possible ### Tools **Required full stack.** No enterprise vendor publishes pricing. Every line here is a negotiation, not a price list. - Enterprise fraud platform (Forter, Riskified, Signifyd, Accertify). Not published, quote-only. Riskified's pricing page is a contact form. Forter's says "speak with one of our Forter experts". Accertify is demo-request only - Dispute alerts. Not published, bought through resellers - Chargeback guarantee. Not published by anyone. Signifyd publishes the model, a percentage of approved order value with nothing charged on fraud declines. It publishes no percentages - Analytics platform. Priced per vendor, no published benchmark worth quoting - Orchestration: Consider payment orchestration layer :::warning[Ownership changes that break old vendor shortlists] Two names on a lot of enterprise shortlists have moved. Both verified 2026-08-02 from the vendors' own domains. - **Midigator** is gone as a standalone product. midigator.com 301-redirects to kount.com, and **kount.com itself now 301-redirects to equifax.com/business/identity-fraud/**. Equifax acquired Midigator in 2022 and folded it into Kount. The Kount brand is now being absorbed into Equifax the same way. If chargeback automation is on your requirements list, talk to Equifax. Ask whether the Midigator automation is still sold, and under what name - **Accertify is no longer an American Express company.** Its own about-us page calls "the successful carve-out of Accertify from American Express" complete. It names no current owner ([accertify.com/about-us](https://www.accertify.com/about-us/)). Any vendor comparison still labelling it "an American Express company" is out of date ::: ### Processor Strategy **Multi-processor required.** - Primary: 60-70% of volume (Stripe or Adyen) - Secondary: 20-30% (Braintree or traditional) - Backup: 10% (redundancy) **Rate targets.** Above $5M/month everything is custom and nobody publishes a rate. An all-in percentage target is guesswork. Anchor on the last published band instead. Helcim publishes interchange + 0.15% + 6c card present at $1M-5M/month, and says custom pricing starts above $5M ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). At $5M+ you should be negotiating a markup **below** 0.15% + 6c, plus scheme fees passed through at cost. If a quote can't be split into interchange, scheme fees and markup, it isn't a quote you can evaluate. **Consider**: Direct acquiring relationships, bypass aggregators entirely. ### Staffing **Minimum team**: - Payments Manager (1) - Fraud Analysts (2-3) - Chargeback Specialists (1-2) - OR outsource operations (20-40 people equivalent) **Budget**: $250K-$500K/year in salaries OR $10K-$30K/month outsourced ### What You've Outgrown - Stripe/Square standard pricing (negotiate or leave) - Manual chargeback responses (automate or outsource) - Single processor (risk too high) - Founder managing payments (need professionals) ### Budget for This Tier - Processing fees: interchange plus a negotiated markup below 0.15% + 6c. All-in depends entirely on card mix - Chargeback costs: $15,000-50,000/month - Tools: quote-only, no published benchmark - Labor: $20,000-50,000/month --- ## Critical Transitions and When They Happen ### $75K/Month: First Tool Decision **What triggers**: Dispute volume where alert ROI turns positive (typically 10-15+ chargebacks/month) **What to add**: Dispute alerts. Verifi and Ethoca publish no pricing. Run the break-even in the Tier 2 section above and use it as your walk-away number. **Why now**: ROI turns positive **See**: [Setup Dispute Alerts](/docs/playbooks/setup-dispute-alerts) --- ### $100K/Month: Serious Monitoring Starts **What triggers**: Can hit both volume (100 CBs) and ratio (0.9%) thresholds **What changes**: - Track CB ratio by network (Visa, Mastercard separate) - Weekly monitoring minimum (not monthly) - Read every processor email same-day **Why now**: Breach means escalating network fees (VAMP $8/dispute + ECM fines) **See**: [Chargeback Monitoring](/docs/chargebacks/monitoring/thresholds) --- ### $250K/Month: Negotiation Becomes Possible **What triggers**: Volume high enough for processor attention **What to do**: - Run 3-bid process, and make at least one bid interchange-plus - Ask current processor for volume pricing. A 0.1-0.2% discount is a realistic ask - Compare that discount against simply moving to a published interchange-plus band **Why now**: The negotiation is worth $250-500 a month at this volume. Switching pricing models is worth roughly $3,000 a month card-present on a $75 ticket (see the [worked comparison](#rate-negotiation-and-why-switching-models-usually-beats-it)). Do the bigger one first. **One more thing at this volume.** Square publishes an upward threshold rather than a downward one. Its own fee page says "if you process over $250,000 per year, talk to our team about custom pricing" ([squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02). That's $250,000 a **year**, roughly $21,000 a month. Near this tier and still on Square's published rates? You're past the point where they invite the conversation. **See**: [Processor Contracts](/docs/payments/buying-payments/contracts) --- ### $500K/Month: Fraud Tool Decision Point **What triggers**: - CB ratio >0.7% OR - Manual fraud review overwhelming (100+ flags/day) **What to add**: Fraud tool (Sift, Signifyd, Forter, SEON) **Cost**: Not published, except SEON at $699/month for 2,500 fraud checks ([seon.io/pricing](https://seon.io/pricing/), verified 2026-08-02). At $500K/month and a $75 ticket you run about 6,700 transactions. That's above SEON's Starter allowance, so you're in quote territory everywhere. Ask every vendor for the per-check or per-decision rate at your volume. Then the quotes are comparable. **Why now**: Prevents VAMP breach + ROI turns positive **See**: [Tool Stack by Tier](/docs/payments/tool-stack) --- ### $750K-$1M/Month: Plan for Full-Time Hire **What triggers**: Founder/ops person spending 15+ hours/week on payments **What to do**: - Write job description (Payments Operations Specialist) - Budget $60K-80K/year + benefits - Hire at $1M or when time exceeds 20 hrs/week **Why now**: Founder time is expensive, dedicated person needed **See**: [When to Get Help](/docs/operations/when-to-get-help) --- ### $1.5M-$2M/Month: Multi-Processor Strategy **What triggers**: - Risk of account termination = business death - Negotiation leverage needed - 99.9%+ uptime required **What to do**: - Approve backup processor - Route 20-30% to secondary - Keep backup warm (can flip if primary issues) **Why now**: Single processor risk too high **See**: [Processor Management](/docs/operations/processor-management) --- ### $5M+/Month: Enterprise Operations **What triggers**: Can't scale manual processes further **What changes**: - Multi-processor required (not optional) - Dedicated team required (2-5 people) - Direct acquirer conversations - Consider Adyen for global coverage and local acquiring. It publishes no rate card and no volume floor. The widely repeated "$10M/year minimum" appears nowhere on Adyen's pricing page. Ask for the minimum monthly invoice in writing **Why now**: Enterprise problems require enterprise solutions --- ## Tier-by-Tier Action Checklist ### Entering Tier 2 ($50K โ†’ $100K) **Month 1**: - [ ] Add dispute alerts if CB ratio >0.65% - [ ] Set up weekly ratio tracking - [ ] Create monitoring spreadsheet **Month 2-3**: - [ ] Run 3-bid process (may not get discounts yet) - [ ] Document fraud review process - [ ] Test current tool stack adequacy **By $100K**: - [ ] Dispute alerts active - [ ] Weekly monitoring routine - [ ] Processor relationship established --- ### Entering Tier 3 ($250K โ†’ $500K) **Month 1**: - [ ] Get an interchange-plus quote and compare it to your current flat rate - [ ] Negotiate the markup, targeting 0.25% + 7c or better card present - [ ] Calculate fraud tool ROI - [ ] If CB >0.7%: Add fraud tool immediately **Month 3-6**: - [ ] Implement fraud tool if CB ratio justifies - [ ] Consider fractional expert if time >10 hrs/week - [ ] Start daily monitoring (not just weekly) **By $500K**: - [ ] Negotiated rates in place - [ ] Fraud tool if needed - [ ] Clear operations process --- ### Entering Tier 4 ($1M โ†’ $2M) **Month 1**: - [ ] Hire full-time payments person OR - [ ] Engage fractional expert 30-40 hrs/week - [ ] Full tool stack (fraud + alerts + analytics) - [ ] Weekly executive reporting **Month 3-6**: - [ ] Backup processor approved - [ ] Document all processes for new hire - [ ] Consider multi-processor split (70/30) **By $1.5M**: - [ ] Dedicated person(s) managing payments - [ ] Backup processor operational - [ ] Automated workflows --- ## Common Scaling Mistakes ### Mistake 1: Not Adding Tools at Tier Transitions **Symptom**: Hit $500K/month, still using Stripe Radar Lite only, CB ratio climbing **Cost**: Breach VAMP = escalating per-dispute fees + potential ECM fines **Fix**: Add fraud tool when volume or CB ratio triggers it (don't wait) --- ### Mistake 2: Delaying Negotiation **Symptom**: Processing $1M/month on flat-rate pricing for 12 months **Cost**: Far more than the 0.2% discount you didn't ask for. At $1M/month card present on a $75 ticket, Square's published 2.6% + 15c costs $28,000 a month. Helcim's published $1M-5M band of interchange + 0.15% + 6c costs about $14,973. That's on this site's blended card-present pass-through of 1.03% + $0.178. That's **$13,027 a month, about $156,300 a year**. It required no negotiation at all. Just a different pricing model. **Fix**: Move to interchange-plus early, then negotiate the markup at $250K+ and aggressively at $500K+ --- ### Mistake 3: Hiring Too Late **Symptom**: Founder burning out at 25 hrs/week on payments, $1.5M/month **Cost**: Founder time worth $150-300/hour, spending on $30/hour tasks **Fix**: Hire at $1M or when time exceeds 15-20 hrs/week --- ### Mistake 4: No Backup Processor at $2M+ **Symptom**: Single processor, account held for 7 days **Cost**: About $467K in lost sales (7 days of $2M spread over 30) **Fix**: Backup processor relationship by $1.5M-$2M --- ## Test to Run **Step 1: Identify your tier** Current monthly volume: $______ - Under $50K: Tier 1 - $50K-$250K: Tier 2 - $250K-$1M: Tier 3 - $1M-$5M: Tier 4 - Over $5M: Tier 5 **Step 2: Check tier requirements** Go to your tier section above, check off items: - [ ] Required tools in place? - [ ] Monitoring appropriate for tier? - [ ] Staffing adequate? - [ ] Rates negotiated (if tier 3+)? **Step 3: Plan next tier** If you're growing, review next tier up: - What tools to budget for? - When to add them? - Staffing changes needed? **Success criteria**: You know exactly what to add at next $100K increment. --- ## Scale Callout **Every $100K volume increase**: - Review tier guidance - Check if you should add tools - Recalculate budgets **Every 6 months**: - Audit against tier checklist - Ensure you haven't missed tier transitions **When things break**: - CB ratio spikes - Auth rate drops - Fraud attack happens --- ## Where This Breaks 1. **Rapid growth**: If you go $100K โ†’ $1M in 3 months, you'll skip tiers. Add tools aggressively, don't wait for ROI certainty. 2. **High-risk industries**: Supplements, high-ticket, long-delivery hit thresholds at lower volumes. Add tools 1 tier earlier. 3. **Seasonal businesses**: Peak volume determines tier, not average. Budget for peak tools year-round. 4. **Multi-channel**: Card-present + online requires different tool stacks. May need to split guidance. 5. **Subscription vs transactional**: SaaS scaling looks different (lower fraud, different tools). This is generic across models. --- ## Next Steps **Starting out (Tier 1)?** 1. Follow [First Week Setup](/docs/playbooks/stripe-first-week) guides 2. Review [Common Mistakes](/docs/payments/common-mistakes) 3. Don't worry about scaling yet **Hit a tier transition?** 1. Review checklist for your new tier 2. Add required tools 3. Budget for increased costs **Growing fast?** 1. Read 2 tiers ahead 2. Budget for tools you'll need in 6 months 3. Hire/negotiate before you're overwhelmed --- ## See Also - [Tool Stack by Tier](/docs/payments/tool-stack) - Detailed tool recommendations - [Total Cost Model](/docs/payments/total-cost-model) - Budget by tier - [When to Get Help](/docs/operations/when-to-get-help) - Hiring vs consultant decisions - [Operations Checklist](/docs/operations/checklist) - Daily/weekly tasks by size - [Who Owns What](/docs/operations/who-owns-what) - Ownership framework by stage - [Chargeback Monitoring](/docs/chargebacks/monitoring/thresholds) - Thresholds by volume - [Processor Contracts](/docs/payments/buying-payments/contracts) - Negotiation by volume - [Common Mistakes](/docs/payments/common-mistakes) - Mistakes by tier - [Multi-Processor Operations](/docs/operations/multi-processor) - Running two processors simultaneously --- ## Terminal Operations Source: https://paymentsandrisk.com/docs/operations/terminal-operations # Terminal Operations :::info[TL;DR] - Know where every terminal is. An asset register prevents loss, speeds up support calls, and keeps your PCI scope honest - Firmware updates are security patches, not optional upgrades. Unpatched firmware is a finding during a PCI assessment - Update off-peak, and test one terminal before you touch the fleet. A bad update during Saturday lunch costs more than the update process ever will - Different firmware and different settings across locations means every support call starts from zero. Standardize once and stop paying for it ::: A terminal dies at 6pm on a Friday and you find out you've got no spare, no serial number written down anywhere, and nobody who knows which processor rep to call. That's the failure this page is built to prevent. Most terminal problems are boring and preventable: an inventory nobody maintains, firmware two years stale, WiFi that drops under load, and four employees sharing one manager PIN. Fix those four and your hardware mostly stops being a problem. ## What Matters 1. **Know where your terminals are.** Asset tracking prevents loss and speeds up support. It also keeps your [PCI scope](/docs/compliance/pci-dss) accurate. 2. **Firmware updates are security updates.** Outdated firmware is a [compliance risk](/docs/compliance/pci-dss), not a cosmetic one. 3. **Connectivity causes most failures.** WiFi, cellular and Bluetooth each fail in their own way, and each one shows up as [declines](/docs/reference/decline-codes). 4. **Access controls prevent [fraud](/docs/fraud).** Not everyone needs refund capability. See [refund abuse](/docs/fraud/types/refund-fraud). 5. **Consistency across locations.** Same settings, same training, same [metrics](/docs/operations/metrics). --- ## Terminal Inventory Management ### Asset Tracking Basics For each terminal, maintain: | Field | Why | |-------|-----| | **Serial number** | Unique identifier for support | | **Location** | Which store/register | | **Assigned employee** | Accountability | | **Model/firmware version** | Compatibility and update tracking | | **Purchase date** | Warranty and replacement planning | | **Processor terminal ID** | Links to processor records | A spreadsheet is fine. The point isn't the tool, it's that somebody can answer "which terminal is this?" over the phone in ten seconds. ### Labeling System Physical labels on each terminal: - Asset tag number - Location identifier - Support phone number **Example:** "Terminal #A-001 | Main Store Register 1 | Support: 555-0123" ### Spare Strategy | Locations | Spare Terminals | |-----------|-----------------| | 1 location | 1 spare | | 2-5 locations | 1 spare per 2-3 locations | | 5+ locations | Regional spare pools | A configured spare sitting in a drawer beats overnight shipping every single time. The spare only helps if it's already set up, so configure it the day it arrives, not the day you need it. ### What to Do When a Terminal Goes Missing 1. Check processor dashboard for last transaction 2. Review camera footage if available 3. Remotely disable if possible 4. Report to processor security team 5. Document for insurance/compliance 6. Replace from spare inventory --- ## Multi-Location Operations ### Consistency Requirements Every location should run: - Same terminal model (or compatible models) - Same firmware version - Same settings configuration - Same training materials - Same escalation procedures ### Centralized vs. Distributed Management | Approach | Best For | |----------|----------| | **Centralized** | Franchises, chains, consistency-critical | | **Distributed** | Independent locations, local autonomy | ### Configuration Standardization Settings to standardize: - Receipt format - Tip prompt settings - Timeout values - Offline transaction limits - Employee access levels **Tip:** Export the configuration from one terminal and import it to the rest. Don't set them up by hand one at a time. That's where the drift comes from. ### Location-Level Reporting Track per location (see [operations metrics](/docs/operations/metrics)): - Transaction volume - Keyed transaction % (high = potential [fraud risk](/docs/fraud/card-present-fraud)) - [Decline rate](/docs/payments/metrics) (compare to [benchmarks](/docs/reference/benchmarks)) - Refund rate (high = potential [refund abuse](/docs/fraud/types/refund-fraud)) - Terminal uptime Then compare them. The outlier is telling you something: a hardware problem, a training gap, or a [fraud pattern](/docs/fraud/detection/velocity-rules) that hasn't spread yet. --- ## Firmware and Software Updates ### Why Updates Matter | Risk of Outdated Firmware | Related | |---------------------------|---------| | Security vulnerabilities | [Card-present fraud](/docs/fraud/card-present-fraud) | | [PCI](/docs/compliance/pci-dss) compliance issues | [Compliance overview](/docs/compliance) | | Missing features | [Auth optimization](/docs/payments/auth-optimization) | | Compatibility problems | Gateway and POS integrations break | | Processor support ends | You're on your own when it fails | ### Update Scheduling | Timing | Best Practice | |--------|---------------| | **When to update** | After hours, before peak periods | | **When not to update** | During business hours, before holidays | | **Testing** | Test on one terminal before fleet-wide | | **Rollback plan** | Know how to revert if update fails | ### Update Process 1. **Notification:** Processor announces update 2. **Review:** Check release notes for changes 3. **Schedule:** Pick maintenance window 4. **Test:** Update one terminal, verify 5. **Deploy:** Roll to remaining terminals 6. **Verify:** Confirm all terminals updated ### Automatic vs. Manual Updates | Automatic | Manual | |-----------|--------| | Less work | More control | | Risk of bad timing | Risk of forgetting | | Processor-managed | You manage | **The call:** automatic for security patches, manual for feature updates. You'll forget the security ones, and you don't want a feature change landing unannounced on a Friday. :::note[Ask Your Processor] "How are firmware updates delivered? Can I schedule them? What's the rollback process?" ::: --- ## Connectivity Troubleshooting ### Connection Types | Type | Pros | Cons | |------|------|------| | **Ethernet** | Most reliable, fastest | Requires wiring | | **WiFi** | Flexible placement | Interference, security | | **Cellular (LTE)** | Works anywhere | Monthly cost, slower | | **Bluetooth** | Portable | Battery, pairing issues | If you can run a cable, run a cable. Everything else on that list is a compromise you're making for convenience. ### WiFi Issues | Symptom | Cause | Fix | |---------|-------|-----| | Intermittent drops | Interference | Change channel, relocate router | | Slow transactions | Weak signal | Add access point, relocate terminal | | Won't connect | Password change | Re-enter credentials | | Works then fails | DHCP lease | Set static IP | ### Cellular Issues | Symptom | Cause | Fix | |---------|-------|-----| | No signal | Coverage gap | Relocate terminal, add antenna | | Slow | Congestion | Try different carrier | | SIM errors | Deactivated SIM | Contact carrier/processor | ### Offline Mode Most terminals will queue transactions when the connection drops. That keeps the line moving, and it's worth having, but you're taking on real risk while it runs: - No real-time authorization - Declined cards aren't caught until the batch settles - Higher fraud exposure - Data loss if the terminal fails before it uploads **Settings:** - Set a low maximum offline transaction amount - Set a low maximum offline transaction count - Set the offline time limit in hours, not days - Turn it off entirely if your business can take the downtime instead ### Quick Diagnostic Steps 1. **Check connection status** in the terminal menu 2. **Restart the terminal.** This clears most of what you'll hit 3. **Check the router/modem** if it's on WiFi 4. **Check cellular signal** if it's on LTE 5. **Swap with a known-good terminal** to work out whether it's the unit or the connection 6. **Call processor support** with the terminal ID already in front of you --- ## Employee Access and Training ### Access Levels | Level | Capabilities | |-------|--------------| | **Cashier** | Process sales, void own transactions | | **Shift lead** | Above + void others, small refunds | | **Manager** | Above + large refunds, reports, settings | | **Admin** | Full access including configuration | ### Employee Setup For each employee: - Unique login/PIN, never a shared one - Appropriate access level - Training documentation signed - A removal process for when they leave That last one is the one everybody skips. Departed staff keep working PINs for months, and it doesn't show up until something goes wrong. ### Training Checklist New employee terminal training: - [ ] Basic transaction processing - [ ] Chip, tap, swipe order of preference - [ ] When to request different card - [ ] Recognizing suspicious behavior - [ ] Void vs. refund difference - [ ] End-of-shift procedures - [ ] Who to call for issues ### Employee Fraud Prevention | Risk | Control | |------|---------| | Refund fraud | Manager approval for refunds | | Skimming | Regular terminal inspection | | Keyed abuse | Monitor keyed % by employee | | Void manipulation | Require customer signature on voids | --- ## Compliance and Security ### Daily Security Checks - [ ] Terminal casing intact - [ ] No overlay on card slot - [ ] No overlay on PIN pad - [ ] Cables secure - [ ] Tamper seals intact ### PCI DSS Terminal Requirements | Requirement | Action | |-------------|--------| | **PTS device list** | Use only approved devices | | **Physical security** | Inspect regularly, report tampering | | **Firmware** | Keep current | | **Disposal** | Securely wipe before disposal | ### End-of-Life Terminal Handling When you replace a terminal: 1. Confirm the data is wiped (factory reset) 2. Remove it from your processor account 3. Physically destroy the storage if you can 4. Keep the certificate of destruction for your compliance records Step 2 is the one that bites. A terminal still attached to your MID is still your PCI scope, whether or not it's plugged in. ### Tamper Response If you suspect tampering: 1. **Stop using the terminal immediately** 2. **Preserve the evidence.** Don't try to fix it 3. **Call processor security** 4. **Review recent transactions** 5. **File a police report if it's confirmed** 6. **Document everything** --- ## Test to Run **Monthly terminal health check:** **Week 1:** Inventory - Verify terminal count matches records - Check firmware versions - Inspect each terminal physically **Week 2:** Performance - Pull keyed transaction % by terminal - Review decline rates by terminal - Check offline transaction volume **Week 3:** Access - Audit employee access levels - Remove departed employees - Verify manager approval workflows **Week 4:** Connectivity - Test failover (disconnect primary, verify backup) - Check offline mode settings - Update any stale configurations **Success criteria:** All terminals accounted for, current firmware, appropriate access levels, connectivity tested. --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100k/mo CP** | Basic inventory tracking. Weekly visual inspection. Owner handles issues. | | **$100k-$1M/mo CP** | Formal asset tracking. Spare terminal strategy. Monthly health checks. | | **Over $1M/mo CP** | Centralized fleet management. Dedicated terminal support. Real-time monitoring. Regular security audits. | --- ## Where This Breaks 1. **Multi-location inconsistency.** Different settings, different firmware, different training, and every support call starts from scratch. Standardize. 2. **Forgotten firmware updates.** That terminal in the corner running two-year-old firmware is the one that'll fail your assessment. Put updates on the calendar. 3. **No spare terminals.** A Friday night failure with no backup costs you the whole weekend. One spare pays for itself the first time. 4. **Shared credentials.** "Everyone uses the manager code" means nobody is accountable for anything. Individual logins, always. --- ## Analyst Layer: Metrics to Track | Metric | What It Tells You | Target | |--------|-------------------|--------| | **Terminal uptime** | Reliability | > 99.5% | | **Keyed % by terminal** | Hardware or training issues | < 2% | | **Firmware currency** | Compliance status | All current | | **Offline transaction %** | Risk exposure | < 1% | | **Time to replace failed terminal** | Operational readiness | < 4 hours | Keyed % is the one to watch first. It moves when a chip reader is dying and it moves when somebody's working around your controls, and you can't tell those apart from the number alone. Go look at the terminal. --- ## Next Steps **Setting up terminal fleet?** 1. [Implement asset tracking](#asset-tracking-basics) - Know where terminals are 2. [Create spare strategy](#spare-strategy) - Backup terminals ready 3. [Standardize configurations](#configuration-standardization) - Consistency across locations **Managing terminals day-to-day?** 1. [Schedule firmware updates](#update-scheduling) - After hours, test first 2. [Troubleshoot connectivity](#connectivity-troubleshooting) - WiFi, cellular fixes 3. [Set access levels](#access-levels) - Employee permissions **Ensuring security and compliance?** 1. [Perform daily security checks](#daily-security-checks) - Tamper inspection 2. [Meet PCI requirements](#pci-dss-terminal-requirements) - Firmware, disposal 3. [Handle end-of-life terminals](#end-of-life-terminal-handling) - Secure disposal --- ## Related Pages - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Terminal selection - [Card-Present Fraud](/docs/fraud/card-present-fraud) - Physical payment fraud - [Operations Index](/docs/operations) - Operations overview - [PCI DSS](/docs/compliance/pci-dss) - Physical security requirements - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Fraud Prevention](/docs/fraud/prevention) - Prevention strategies - [Refund Fraud](/docs/fraud/types/refund-fraud) - Employee abuse patterns - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Transaction pattern detection - [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Chip security - [Operations Metrics](/docs/operations/metrics) - Tracking performance - [Decline Codes](/docs/reference/decline-codes) - Understanding declines - [Reading Statements](/docs/operations/reading-statements) - Understanding costs --- ## When to Get Help Source: https://paymentsandrisk.com/docs/operations/when-to-get-help :::info[Learning Path Version] For the beginner overview, start with [The Guide, Pathway 4, Lesson 3](/docs/learning-pathways/running-payments-daily/when-to-get-help). This page goes deeper into when to escalate, hiring specialists, and working with processors. ::: # When to Get Help :::info[TL;DR] - DIY works for most problems. You need outside help when it's urgent, when it's specialized, or when being wrong costs more than the fee - The two clearest triggers: you're in a network monitoring program (VAMP/ECM) with weeks to fix it, or your processor threatened account termination - Consultants are best for one-time problems (MATCH dispute, processor negotiation, fraud incident response). Don't hire full-time until the volume justifies it - Your processor's risk team is free and often underused - calling them proactively when you see a problem is better than waiting for them to call you ::: Most payment problems you can solve yourself with playbooks and documentation. Some you can't. Knowing which is which is the whole skill. It's about where DIY stops working, and what kind of help to get. ## The Question This Answers **"Should I handle this myself or hire someone?"** **Wrong answer**: "I'll figure it out" (when you're in VAMP with 3 weeks to fix) **Right answer**: Specific decision criteria by problem type --- ## DIY vs Get Help Decision Framework ```mermaid flowchart TD A[Payment Problem] --> B{Can you loseyour account?} B -->|Yes| C[Get help immediately] B -->|No| D{Is ROI clearlypositive?} D -->|Yes| E[Get help ifcost justified] D -->|No| F{Do you havetime to learn?} F -->|Yes| G[DIY with playbooks] F -->|No| H[Get help tosave time] C --> I[Consultant or Legal] E --> J[Calculate ROI] H --> K[Fractional or Contractor] G --> L[Use site resources] style C fill:#ef4444,color:#fff style I fill:#ef4444,color:#fff style G fill:#22c55e,color:#fff style L fill:#22c55e,color:#fff ``` --- ## Problems You Can Solve Yourself (DIY) ### โœ… Chargeback Ratio 0.3-0.65% **Why DIY works**: - Not in crisis territory yet - Playbooks exist: [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Time to fix: 2-4 weeks - Cost: $0 (your time only) **Don't hire help unless**: Ratio climbing fast or can't dedicate 5-10 hours/week. --- ### โœ… Basic Fraud Patterns **Why DIY works**: - Processor built-in tools sufficient under $500K/month - Configure Stripe Radar or Square fraud settings yourself - Playbook exists: [Survive Fraud Attack](/docs/playbooks/survive-fraud-attack) **Don't hire help unless**: Sophisticated fraud (account takeover, bust-out) or over $1M/month. --- ### โœ… Processor Selection (Under $1M/Month) **Why DIY works**: - Stripe vs Square decision is straightforward - Guides exist: [Processor Profiles](/docs/payments/processors) - Rates are non-negotiable anyway (no expert needed) **Don't hire help unless**: You're over $1M and negotiating custom rates. --- ### โœ… Standard Setup and Configuration **Why DIY works**: - First-week guides exist: [Stripe](/docs/playbooks/stripe-first-week), [Square](/docs/playbooks/square-first-week) - Processor documentation is good - Time: 4-12 hours total **Don't hire help unless**: Complex integration (marketplace, custom platform). --- ### โœ… Individual Chargeback Responses **Why DIY works**: - Reason code guides exist: [Visa](/docs/reference/reason-codes/visa), [Mastercard](/docs/reference/reason-codes/mastercard) - Evidence requirements documented: [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Time: 30-60 min per chargeback **Don't hire help unless**: Over 100 chargebacks/month (hire FTE instead). --- ## Problems That Need Help (Get Expert) ### ๐Ÿšจ Chargeback Ratio 0.75%+ and Rising **Why you need help**: - Entering processor danger zone (~0.9%) and approaching ECM territory (1.5%) - Fees escalate: VAMP charges $8/dispute; ECM fines reach $25K-$100K+/month - 2-4 weeks to fix before disaster - Consultant has seen this 50+ times, you haven't **Type of help**: Chargeback consultant **Cost**: $5,000-$15,000 one-time **ROI**: Prevents escalating VAMP/ECM fees + MATCH listing **When to hire**: Immediately when ratio hits 0.75% **Alternative**: Implement [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) yourself, but if it doesn't work in 2 weeks, hire help. --- ### ๐Ÿšจ Already in Monitoring Program (VAMP, ECM) **Why you need help**: - Fines escalate monthly (VAMP: per-dispute fees; ECM: starts at $1K/month, escalates rapidly) - Processor may terminate you in 3 months if no improvement - Required remediation plan to network - This is business-threatening **Type of help**: Chargeback consultant + potentially legal **Cost**: $10,000-$25,000 **ROI**: Saves your processing account ($100K-$1M+ value) **When to hire**: The day you receive monitoring program notice **See**: [MATCH/TMF List](/docs/chargebacks/match-tmf) and [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) --- ### ๐Ÿšจ Processor Termination Notice **Why you need help**: - 30-90 days to find new processor - Risk of MATCH listing - May need to negotiate with current processor - Funds held for 90-180 days **Type of help**: Payment consultant + lawyer **Cost**: $5,000-$20,000 **ROI**: Might prevent MATCH listing (5-year impact) **When to hire**: Immediately upon termination notice **DIY option**: None. This is too serious. --- ### ๐Ÿšจ Data Breach Suspected or Confirmed **Why you need help**: - PCI forensics required - Legal notification obligations (varies by state) - Card brand reporting required - Potential MATCH listing (code 01) **Type of help**: PFI (PCI Forensic Investigator) + lawyer **Cost**: $15,000-$100,000+ depending on scope **ROI**: Required by card networks, not optional **When to hire**: Within 24 hours of discovery **See**: [Breach Response Playbook](/docs/playbooks/breach-response) --- ### ๐Ÿ’ฐ Rate Negotiation Over $1M/Month **Why you might need help**: - Potential savings: 0.2-0.5% = $24K-$120K/year at $1M-$2M - Consultant fee: $5,000-$15,000 - You don't know market rates, consultant does **Type of help**: Payment consultant or broker **Cost**: $5,000-$15,000 OR commission on savings **ROI**: Positive if volume over $1M/month **When to hire**: When you hit $1M/month sustained volume **DIY option**: Research market rates, use comparison pages, negotiate yourself. Worth trying before hiring. **See**: [Processor Contracts](/docs/payments/buying-payments/contracts) --- ### ๐Ÿ’ฐ International Expansion (First Time) **Why you might need help**: - Tax, legal, entity structure complexity - Payment method selection by country - Compliance (PSD2, data localization, etc.) - First time doing this = high error cost **Type of help**: International payment consultant OR Merchant of Record (Paddle, FastSpring) **Cost**: - Consultant: $10,000-$30,000 - MoR: 5-8% of revenue (they handle everything) **ROI**: Depends on market size **When to hire**: If target market is $100K+/year opportunity **DIY option**: Start with [Going Global](/docs/payments/going-global) and [Regional Payment Methods](/docs/payments/payment-methods/regional), hire help if stuck. --- ## Types of Help Available ### 1. Payment Consultant (Project-Based) **What they do**: - Chargeback reduction strategies - Processor negotiation - Fraud program optimization - Operations audit **Cost**: $5,000-$30,000 per engagement **Duration**: 4-12 weeks **Best for**: Specific problems (CB crisis, rate negotiation, fraud attack) **When to use**: - CB ratio >0.75% - Rate negotiation at $1M+ - Fraud attack you can't contain **Red flag**: Multi-year retainers. Most problems are solved in 8-12 weeks. --- ### 2. Fractional/Part-Time Expert **What they do**: - Ongoing fraud review - Monthly chargeback responses - Metrics monitoring - Strategic guidance **Cost**: $2,000-$8,000/month (10-40 hours) **Duration**: Ongoing (3-12 months) **Best for**: $500K-$2M/month businesses not ready for FTE **When to use**: - 50-150 chargebacks/month - Need expert but can't afford $80K/year FTE - Scaling rapidly and need guidance **Alternative**: Outsourced chargeback response services ($500-$2K/month) --- ### 3. Full-Time Hire **What they do**: - Daily fraud review - Chargeback representment - Processor management - Tool administration - Reporting and optimization **Cost**: $60,000-$90,000/year + benefits **Duration**: Permanent **Best for**: Over $1M-$2M/month sustained **When to hire**: - 100+ chargebacks/month - 200+ fraud reviews/week - Complex operations (multi-processor, international) **See**: Staffing guidance (not yet created - future page) --- ### 4. Legal Help **When you need a lawyer**: - Processor termination (MATCH listing risk) - Data breach (notification obligations) - FTC investigation (subscription compliance) - Large customer lawsuit - Complex contracts (non-standard agreements) **Cost**: $300-$800/hour OR $10,000-$50,000 retainer **Best for**: Legal exposure, not operational problems **When to hire**: Any legal threat or regulatory investigation --- ### 5. Technical Integration Help **When you need developer**: - Custom checkout implementation - Marketplace/platform (Stripe Connect) - Complex integration (API, webhooks) - Migration between processors **Cost**: $75-$200/hour OR $5,000-$30,000 project **Best for**: Technical implementation, not strategy **When to hire**: When your team doesn't have dev resources --- ## Cost-Benefit Decision Matrix | Problem | DIY Cost | Expert Cost | DIY Time | Expert Time | Decision | |---------|----------|-------------|----------|-------------|----------| | **CB ratio 0.5%** | $0 | $5K | 20 hours | 0 hours | DIY | | **CB ratio 0.85%** | Risk of MATCH | $10K | 40 hours | 0 hours | Expert | | **Rate negotiation ($2M/mo)** | $0 | $10K | 20 hours | 0 hours | Expert (ROI: $60K/yr) | | **Standard setup** | $0 | $3K | 8 hours | 0 hours | DIY | | **Data breach** | Illegal to DIY | $50K+ | N/A | 0 hours | Expert (required) | | **Fraud attack** | $0-5K loss | $5K | 10 hours | 0 hours | DIY first, expert if persists | --- ## Red Flags You're In Over Your Head **Get help immediately if**: ### 1. You Can't Explain What's Happening **Symptom**: "Chargebacks keep going up and I don't know why" **Red flag**: After reading [What Is a Chargeback?](/docs/chargebacks), you still can't identify root cause. **Action**: Hire consultant to audit and diagnose. --- ### 2. You're Spending 20+ Hours/Week on Payments **Symptom**: Full-time job just managing chargebacks, fraud, processor **Red flag**: At $500K/month, this should be 5-10 hours/week max. **Action**: Hire fractional expert or outsource chargeback responses. --- ### 3. You've Received Multiple Threshold Warnings **Symptom**: 3+ emails from processor about CB ratio, fraud rate, or risk review **Red flag**: DIY isn't working fast enough. **Action**: Hire consultant before you hit threshold. --- ### 4. Processor Isn't Responding **Symptom**: Sent 3+ emails about account hold, no response **Red flag**: You don't have leverage or know who to escalate to. **Action**: Hire consultant with processor relationships. --- ### 5. You Don't Understand Your Own Metrics **Symptom**: Can't calculate CB ratio, don't know what VAMP is, can't read statement **Red flag**: Flying blind is dangerous. **Action**: Either dedicate time to learn OR hire fractional expert to set up monitoring. --- ## Consultant ROI Calculator **Decision formula**: Hire consultant if `(Problem cost - Consultant fee) > $0` ### Example 1: Chargeback Crisis (ROI: Positive) **Problem**: CB ratio 0.88% and climbing. That's your processor's line, not a network one (VAMP and ECM both start at 1.5%), and your processor is the one threatening to act **DIY cost**: - Reserves and pass-through fees now, then VAMP per-dispute fees and ECM escalating fines if the trend continues (ECM starts at $1K/month and increases) - Risk of MATCH listing **Consultant cost**: $10,000 **Consultant result**: Reduce to 0.72% in 6 weeks **ROI**: $10K cost prevents $75K+ in fines **Decision**: Hire immediately --- ### Example 2: Rate Negotiation at $2M/Month (ROI: Positive) **Problem**: Paying 2.9% at $2M/month volume **DIY cost**: $0 but rates stay same **Consultant cost**: $15,000 OR 25% of first-year savings **Consultant result**: 0.3% reduction (2.9% โ†’ 2.6%) **Savings**: $2M ร— 0.3% ร— 12 = $72,000/year **ROI**: $15K cost โ†’ $72K/year savings **Decision**: Hire consultant --- ### Example 3: Standard Fraud Review at $200K/Month (ROI: Negative) **Problem**: Reviewing 50 fraud flags/week **DIY cost**: 5 hours/week ร— $50/hr = $1,000/month **Consultant cost**: $3,000/month fractional **Consultant result**: Same outcome, you save 5 hours/week **ROI**: $3K cost to save $1K = Lose $2K/month **Decision**: DIY, it's not that many flags yet --- ## When to Get Each Type of Help ### Consultant (Project-Based) - When | Scenario | Hire When | Cost | ROI | |----------|-----------|------|-----| | **CB ratio crisis** | Over 0.75% | $5K-15K | Prevents MATCH | | **Rate negotiation** | Over $1M/month | $10K-20K | $50K-$200K/year | | **Fraud attack** | Can't stop after 48 hours | $5K-10K | Prevents $10K-$50K loss | | **International launch** | Over $100K/year target market | $10K-30K | Prevents $20K-$100K mistakes | | **Processor termination** | Termination notice received | $10K-25K | Might prevent MATCH | --- ### Fractional Expert - When | Scenario | Hire When | Cost | Alternative | |----------|-----------|------|-------------| | **50-100 CBs/month** | Can't keep up | $2K-5K/month | Outsourced CB response | | **Daily fraud review** | 100+ flags/day | $3K-8K/month | Full-time at $6K/month | | **Scaling rapidly** | $500K โ†’ $2M in 6 months | $3K-6K/month | Wait for FTE at $2M | --- ### Full-Time Employee - When | Trigger | Role | Salary | When | |---------|------|--------|------| | **100+ CBs/month** | Payments Operations | $60K-$80K | Over $1M/month | | **$2M+ volume** | Fraud Analyst | $65K-$90K | High CB/fraud rate | | **Multi-processor** | Payments Manager | $80K-$120K | Over $5M/month | --- ### Legal Help - When | Scenario | Hire Immediately | Cost | |----------|------------------|------| | **Data breach** | Suspected or confirmed | $15K-$100K+ | | **MATCH listing** | Termination + MATCH threat | $10K-$30K | | **FTC investigation** | Subscription compliance | $20K-$100K | | **Customer lawsuit** | Class action threat | $15K-$50K+ | | **Contract dispute** | Processor non-compete, non-standard terms | $5K-$20K | **Legal is not negotiable** for these scenarios. Budget for it. --- ## Problem-Specific Guidance ### Chargeback Crisis **CB ratio 0.4-0.65%**: DIY - Use [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Time: 2-4 weeks - Cost: Your time only **CB ratio 0.65-0.85%**: Consider consultant - You're approaching processor warning thresholds - Consultant ROI: Prevents escalation to monitoring programs - Cost: $5,000-$10,000 **CB ratio over 0.85%**: Hire consultant immediately - Risk of processor escalation or VAMP/ECM enrollment - Fines escalate monthly and compound quickly - Consultant cost < fine cost --- ### Fraud Problem **Isolated fraud**: DIY - One-off fraud orders - Use processor fraud tools - Cost: $0 **Coordinated attack**: DIY first, hire if persists - BIN attack, card testing, velocity spike - Use [Survive Fraud Attack](/docs/playbooks/survive-fraud-attack) - If continues 48+ hours: Hire expert ($5K-$10K) **Sophisticated fraud**: Hire expert - Account takeover, bust-out, synthetic identity - Requires specialized tools + expertise - Cost: Fraud tool ($2K-5K/month) + consultant setup ($5K-$10K) --- ### Processor Problems **Account hold (routine review)**: DIY - Provide requested documents - Wait 3-7 days - Cost: $0 **Account hold (30+ days)**: Hire consultant - Consultant has processor relationships - Can escalate appropriately - Cost: $3,000-$8,000 **Termination threat**: Hire consultant + lawyer - Need to negotiate or find alternative - Legal review of termination - Cost: $10,000-$30,000 --- ### International Expansion **Adding payment methods**: DIY - Use [Regional Payment Methods](/docs/payments/payment-methods/regional) - Enable in Stripe/Shopify dashboard - Cost: Dev time only (4-16 hours) **Full market launch**: Consider consultant or MoR - Target market over $100K/year - Consultant: $10K-$30K - MoR (Paddle, FastSpring): 5-8% of revenue but they handle everything - ROI: Prevents $20K-$100K in compliance mistakes **See**: [Going Global](/docs/payments/going-global) --- ## Outsourcing Options ### Chargeback Response Services **What they do**: Respond to chargebacks for you **Vendors**: Chargeflow, Chargebacks911, others **Cost**: $300-$2,000/month OR per-chargeback fee **Best for**: 50-200 chargebacks/month **When to use**: - You don't have time to respond yourself - Cheaper than hiring FTE - Want to maintain win rates **DIY until**: 50+ chargebacks/month --- ### Fraud Review Services **What they do**: Manual review of flagged transactions **Cost**: $0.50-$3 per review OR $1,000-$5,000/month **Best for**: 100-500 fraud flags/day **When to use**: - You can't review 100+ orders/day yourself - Cheaper than FTE ($2K-$5K/month vs $6K/month salary) - Want 24/7 coverage **DIY until**: Can't keep up (orders piling up, missing fraud) --- ## Test to Run **Week 1: Identify your problems** 1. List all payment problems you're facing 2. Rank by severity (account-threatening vs annoying) 3. Rank by urgency (need fixed this week vs this quarter) **Week 2: Calculate DIY cost vs Expert cost** For each problem: 4. **DIY cost**: Your time (hours ร— $50-100/hr) + risk of failure 5. **Expert cost**: Consultant quote or market rate 6. **ROI**: If expert cost < DIY cost + risk, hire expert **Week 3: Decision** 7. Account-threatening problems: Hire immediately 8. Positive ROI problems: Hire if you have budget 9. Negative ROI problems: DIY with playbooks **Success criteria**: Clear decision for each problem (DIY or hire, not "figure it out later"). --- ## Scale Callout **Under $500K/month:** - DIY almost everything - Exception: Data breach (hire legal/PFI) - Exception: MATCH listing threat (hire consultant) **$500K-$1M/month:** - DIY routine operations - Hire for: CB crisis (0.8%+), rate negotiation, complex fraud - Consider: Fractional expert if overwhelmed **$1M-$5M/month:** - Hire for: Rate negotiation, international launch, CB crisis - Consider: Full-time payments person at $1.5M-$2M - DIY: Routine fraud review, individual CB responses **Over $5M/month:** - Hire: Full-time team (2-5 people) - Consultant: Strategic projects only - DIY: Day-to-day operations (you have team) --- ## Where This Breaks 1. **Ego prevents hiring**: "I can figure this out" while the ratio hits 0.95%. You probably can't, and the account is the price. 2. **Hiring too early wastes money**: a $200K/month business paying $15K for routine setup. You don't need that yet, do the playbooks first. 3. **Wrong type of help**: a fraud consultant won't fix a chargeback problem. Match the expert to the problem. 4. **Multi-year contracts for one-time problems**: most engagements should run 8-12 weeks. If they're pitching a year, that's the tell. 5. **Hiring instead of fixing root cause**: Hiring manual reviewers when real problem is wrong fraud rules. Fix the system, don't bandaid with people. --- ## Next Steps **Have a problem right now?** 1. Use decision tree above to determine DIY vs hire 2. If hiring: Get 2-3 quotes, check references 3. If DIY: Start with relevant playbook **Scaling and planning ahead?** 1. Know your thresholds (when to hire at each stage) 2. Budget for potential consultant needs 3. Build relationships before you need help **Want to hire someone?** 1. Fractional expert: Search "payment consultant" + your niche 2. FTE: Post job description (staffing guide - future page) 3. Legal: Payment industry attorney (not general business lawyer) --- ## See Also - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - DIY chargeback reduction - [Survive Fraud Attack](/docs/playbooks/survive-fraud-attack) - DIY fraud response - [Breach Response](/docs/playbooks/breach-response) - When to hire PFI/legal - [MATCH/TMF List](/docs/chargebacks/match-tmf) - When consultant prevents MATCH - [Tool Stack by Tier](/docs/payments/tool-stack) - When to buy tools vs hire people - [Who Owns What](/docs/operations/who-owns-what) - Ownership by business stage - [Processor Contracts](/docs/payments/buying-payments/contracts) - Negotiation guidance - [Going Global](/docs/payments/going-global) - International consultant decision --- ## Who Owns What Source: https://paymentsandrisk.com/docs/operations/who-owns-what # Who Owns What :::info[TL;DR] - **One throat to choke per problem.** Not informed, not consulted, one person who feels pain if it fails - **Stage 1 (under $500K/yr)**: You check disputes daily, verify deposits weekly, answer processor emails in 24h - **Stage 2**: Hand off "I don't recognize this charge" to support, but you decide disputes - **Stage 3**: Set boundaries, not procedures ("refund under $50 without asking") - **Escalate early**: Chargeback ratio >0.75%, processor warning, anything you're unsure about ::: Unclear ownership is how chargebacks expire without response and fraud queues pile up. If you're still finding product-market fit, you don't have an ops problem. You have a survival problem. Come back when payments friction is costing you real money. The only rule that matters: every problem needs exactly one person who will feel pain if it doesn't get solved. Not "informed." Not "consulted." One person who wakes up at 3am when the alert fires. Everything else is organizational theater. ## Stage 1: It's Just You You're the company. Maybe you have a cofounder. Your job is simple: don't let anything expire or go unanswered. **The checklist:** - Check disputes daily (they have deadlines) - Verify deposits weekly (make sure you're getting paid) - Answer processor emails within 24 hours (silence makes them nervous) That's it. Don't build dashboards. Don't tune fraud rules. Don't optimize. You're not at the scale where any of that matters. **When this breaks:** Around $500K-$1M annual volume, or when payments work takes more than an hour a day. If you're spending real time on this, it's time for Stage 2. ## Stage 2: Someone Else Can Do This You've hired someone. Support person, ops generalist, doesn't matter. The question is: what can they handle without you? The key handoff is "I don't recognize this charge." Train them: 1. Pull the order 2. Explain what it was for 3. If customer still insists, escalate to you 4. Do NOT immediately refund Immediate refunds train customers to dispute. You want them to call you, not their bank. **Simple ownership:** | Problem | Who Handles | Escalates To | |---------|-------------|--------------| | Customer questions | Support | You | | Dispute response | You | (nowhere, you're the end) | | Refund requests | Support (under $50) | You (over $50) | | Processor emails | You | (nowhere) | **When this breaks:** You're spending more than 5 hours a week on payments personally, or you're the bottleneck on decisions that could be routine. ## Stage 3: Dedicated Person Someone's job now includes payments or fraud. Partial role or full role, doesn't matter. The shift: you set boundaries, they operate within them. **Boundaries, not procedures:** - "Refund under $50 without asking me" - "Block orders with these 3 signals automatically" - "Escalate if customer claims over $200" - "Call me if chargeback ratio hits 0.6%" The goal is that they can handle 90% of situations without you. The 10% that escalates should be genuinely weird or high-stakes. **Weekly check-in (30 min max, can be async):** - Disputes trending up or down? - Any patterns in the queue? - Anything weird from the processor? - Rules to add, remove, or adjust? If they're constantly hitting escalation thresholds, either the thresholds are wrong or they need more training. Fix that, don't add more meetings. ## Stage 4: Multiple People Resist the urge to over-process. More people doesn't mean more structure. It means clearer ownership. **Principles:** - One throat to choke per problem type - Bias toward whoever has context - Ship changes and iterate, don't committee them - Postmortems, not processes When disputes spike, ask "what's the top cause?" not "who's responsible?" | If Driven By | Owner | |--------------|-------| | Third-party fraud | Whoever owns fraud rules | | Friendly fraud | Support + fraud together | | Product issues | Product | | Shipping problems | Ops | | Billing confusion | Payments (fix descriptors) | Pick the single biggest driver. Fix it. Then move to the next one. **The dangerous question:** If someone asks "Can we get a RACI for this?" it usually means ownership is unclear. Fix the ownership problem. Don't paper over it with a matrix nobody will reference. ## The "I Don't Recognize This Charge" Handoff This phrase covers five different situations: 1. **Descriptor confusion:** Your billing name doesn't match your brand 2. **Forgot:** It's been 3 weeks, they genuinely don't remember 3. **Family member:** Kid or spouse used the card. [Ask whether it was handed over](/docs/reference/fraud-classification#worked-example-my-family-member-used-my-card) before you call it fraud 4. **Actual fraud:** Stolen card, they really didn't do it 5. **Buyer's remorse:** They know exactly what the charge was and they want their money back Support should NOT immediately refund. Pull the order, explain the charge clearly. If the customer insists they didn't order, escalate. Escalation decides: - Confusion โ†’ explain better, fix descriptor if pattern emerges - Forgot โ†’ explain, done - Family โ†’ explain, maybe refund depending on policy - Fraud โ†’ refund, investigate signals, flag for detection - Abuse โ†’ hold the line, document Document every decision. You're building pattern data for later. ## Escalation Triggers Escalation isn't failure. Under-escalating is how small problems become big ones. **Escalate to founder/leadership:** - Chargeback ratio exceeds 0.75% - Processor sends a warning email - Single incident over your threshold (define this: $500? $1,000?) - You're not sure what to do **Escalate to legal:** - Contract disputes with processor - Customer mentions lawsuit - Regulatory inquiry, subpoena, data breach When in doubt, escalate. The cost of over-escalating is a 5-minute conversation. The cost of under-escalating can be an account shutdown. ## Where This Breaks **Single points of failure:** If one person is the only one who can respond to disputes and they go on vacation, disputes expire. Write down the mechanical steps so anyone can follow them in an emergency. **Ambiguous ownership during growth:** You're between stages, nobody's sure who owns what. Name it explicitly, set an end date ("Sarah owns this until we hire"), and survive. **Nobody owns prevention:** Someone owns responding to chargebacks, but nobody owns reducing them. Assign the upstream problem, not just the downstream symptom. **Cross-functional blame:** Chargebacks spiked. Was it fraud? Product quality? Shipping? Everyone points at everyone else. Pick the single biggest driver, fix that first, then move to the next one. ## The Startup Version 1. One owner per problem type, not a team 2. Start with zero process, add only when something breaks twice 3. Define boundaries, not procedures 4. Review outcomes, not activities 5. Iterate weekly (last week's rules might be wrong, that's fine) You're not building a compliance department. You're trying to lose less money while you figure out the business. ## If You're a Team of One Most payment operations advice assumes you have a team. If it's just you - founder, sole proprietor, one-person shop - here's the reality. **You're every role in the table above.** Don't build dashboards. Don't set up escalation paths to yourself. Focus on three things: 1. **Don't let deadlines expire.** Chargeback response windows are 20-45 days depending on the network (Amex 20 days, Visa 30, Discover 30, Mastercard 45). Set a calendar reminder when one arrives. Missing a deadline is an automatic loss. See [Time Frames](/docs/reference/time-frames) for the full breakdown. 2. **Check deposits weekly.** Every Friday, verify your bank deposits match what your processor says it sent. If they don't match, investigate before the trail goes cold. See [reconciliation](/docs/payments/settlement/reconciliation) for the process. 3. **Set two alerts.** Your processor can email you when (a) a chargeback arrives, and (b) your chargeback ratio crosses 0.5%. Everything else can wait until you have help. **The trap:** You'll be tempted to spend hours tuning fraud rules, building spreadsheets, and optimizing processes. At your scale, a better product and faster customer responses prevent more chargebacks than any fraud tool. Focus on the business. **When to get help:** If payments work takes more than 3 hours per week, or you're losing more than 1% of revenue to fraud and chargebacks combined, it's time for [Stage 2](#stage-2-someone-else-can-do-this) or [outside help](/docs/operations/when-to-get-help). --- ## Next Steps **Just getting started?** 1. [Review the operations checklist](/docs/operations/checklist) - Daily and weekly tasks to assign 2. [Understand chargeback metrics](/docs/chargebacks/metrics) - Know when escalation is needed **Building your team?** 1. [Set up alerts](/docs/operations/alerts-configuration) - Who gets notified for what 2. [Document representment workflow](/docs/operations/representment-workflow) - Dispute response ownership **Scaling operations?** 1. [Review processor management](/docs/operations/processor-management) - Manage acquirer relationships 2. [Configure holds and reserves](/docs/operations/holds-and-reserves) - Cash flow impact by owner --- ## Related - [Operations Checklist](/docs/operations/checklist) - What to check and when - [Processor Management](/docs/operations/processor-management) - Handling scary emails - [Chargeback Metrics](/docs/chargebacks/metrics) - Dispute tracking - [Fraud Metrics](/docs/fraud/metrics) - Fraud rate monitoring - [Operations Metrics](/docs/operations/metrics) - Performance KPIs - [Representment Workflow](/docs/operations/representment-workflow) - Dispute response process - [Alerts Configuration](/docs/operations/alerts-configuration) - Setting up notifications - [Holds and Reserves](/docs/operations/holds-and-reserves) - Cash flow impact - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Reducing billing confusion - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party dispute abuse - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency response playbook --- # Playbooks ## Playbooks Source: https://paymentsandrisk.com/docs/playbooks # Playbooks :::info[TL;DR] - Step-by-step actions, not explanations. Use these when something is on fire, you're shipping a project, or you want a quick win - Each playbook lists what you need before you start, then walks the steps in order - Want the foundations instead? [The Guide](/docs/learning-pathways/getting-started-with-payments/introduction) is 15 lessons, about 105 minutes ::: Something's on fire, or you're shipping a project, or you want a quick win. Follow these. :::tip[Want the full picture?] Playbooks solve immediate problems. **[The Guide](/docs/learning-pathways/getting-started-with-payments/introduction)** teaches you the foundations: 15 lessons covering payments, chargebacks, fraud, operations, and costs (~105 min total). ::: :::tip[If You Only Have 2 Hours This Week] If nothing is actively on fire: 1. Pick one metric that's been bugging you (auth rate, chargeback ratio, fraud rate) 2. Form a hypothesis about why it's off 3. Design one small test to validate or invalidate that hypothesis 4. Run it for a week That's how you make progress without getting lost in optimization theater. ::: --- First Week Setup Just got approved? Do these before your first live transaction. [ โšก Stripe First Week Day-by-day checklist: descriptor, fraud rules, RDR, webhooks ](/docs/playbooks/stripe-first-week) [ โ–ช๏ธ Square First Week POS setup, item library, staff training, prevent keyed-in waste ](/docs/playbooks/square-first-week) [ ๐Ÿ›’ Shopify First Week Avoid third-party fees, enable fraud analysis, optimize checkout ](/docs/playbooks/shopify-first-week) --- Crisis Playbooks Use these when you don't have time to think. [ ๐Ÿ”ฅ Reduce Chargebacks Fast Ratio above 0.7% and climbing, or you're already in a monitoring program ](/docs/playbooks/reduce-chargebacks-fast) [ ๐Ÿšจ Survive a Fraud Attack Velocity spike, BIN attack, or coordinated fraud in progress ](/docs/playbooks/survive-fraud-attack) [ ๐Ÿ›ก๏ธ Breach Response Suspected or confirmed card data breach - first 72 hours ](/docs/playbooks/breach-response) [ ๐Ÿ“‰ Fix Declining Auth Rates Auth rate dropped suddenly and you need to diagnose fast ](/docs/playbooks/fix-declining-auth-rates) --- Quick Wins (2 Weeks or Less) High-impact improvements you can ship fast. [ ๐Ÿ”” Set Up Dispute Alerts 1-2 weeks Prevent 20-40% of chargebacks before they hit ](/docs/playbooks/setup-dispute-alerts) [ ๐Ÿ”’ First-Time 3DS Setup 1-2 weeks Liability shift without killing conversion ](/docs/playbooks/first-time-3ds-setup) [ ๐Ÿ“ฑ Onboard Digital Wallets 2-4 weeks Higher auth rates, lower fraud, better mobile ](/docs/playbooks/onboard-digital-wallets) [ ๐Ÿ’ณ Handle a Refund Request Same day Step-by-step from request to resolution ](/docs/playbooks/handle-refund-request) --- Optimization Playbooks For when nothing's broken and you just want the numbers better. [ ๐Ÿ“ˆ Increase Auth Rates Auth approval rate dropping or below benchmark ](/docs/playbooks/increase-auth-rates) [ โš™๏ธ Auth Optimization Deep dive on retry logic, network tokens, issuer work ](/docs/payments/auth-optimization) [ ๐Ÿงช Payments Experimentation Testing fraud rules and checkout changes safely ](/docs/reference/experimentation) --- Project Playbooks These ones need planning. [ ๐ŸŒ Launch New Country Expanding to a new market ](/docs/playbooks/launch-new-country) [ ๐Ÿ”„ Processor Switch Checklist Migrating processors without losing transactions ](/docs/playbooks/processor-switch-checklist) --- For Larger Operations Over $1M/month? These cover what changes. [ ๐Ÿ“ˆ Scaling Milestones What changes at each volume tier: tools, staffing, and negotiation leverage ](/docs/operations/scaling-milestones) [ ๐Ÿฆ Processor Management Multi-processor strategy, rate negotiation, and relationship management ](/docs/operations/processor-management) [ ๐ŸŒ Launch New Country Local acquiring, regional payment methods, and compliance by market ](/docs/playbooks/launch-new-country) --- Popular [ ๐Ÿ”ฅ Reduce Chargebacks Fast Popular Crisis playbook for ratio above 0.7% ](/docs/playbooks/reduce-chargebacks-fast) [ ๐Ÿ”” Set Up Dispute Alerts Prevent 20-40% of chargebacks (1-2 week project) ](/docs/playbooks/setup-dispute-alerts) [ ๐Ÿ”’ First-Time 3DS Setup Liability shift without killing conversion ](/docs/playbooks/first-time-3ds-setup) [ ๐Ÿ“ˆ Increase Auth Rates Systematic auth rate improvement ](/docs/playbooks/increase-auth-rates) --- ## How Playbooks Work Each playbook has: 1. **Trigger criteria** - How to know you need this playbook 2. **Steps** - Do these in order 3. **Checkpoints** - How to know each step worked 4. **Success criteria** - How to know you're done Playbooks are for doing, not understanding. They're hypothesis-test-learn cycles, not checklists to follow blindly. If you want the concepts, the main sections have them. ## The Experimental Mindset Throwing tools at a problem you haven't diagnosed is expensive guessing. Every playbook should get you to: 1. **Understand why** (talk to customers, look at data) 2. **Form a hypothesis** (we think it's X because of Y) 3. **Test** (change one thing, measure for 2 weeks) 4. **Learn** (did it work? why or why not?) Even in a crisis, you're running experiments. They're just faster and higher-stakes. --- ## Next Steps In a crisis right now? [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Ratio spiking [Survive Fraud Attack](/docs/playbooks/survive-fraud-attack) - Fraud in progress [Breach Response](/docs/playbooks/breach-response) - Data breach suspected [Fix Auth Rates](/docs/playbooks/fix-declining-auth-rates) - Sudden auth drop Want a quick win? [Set Up Dispute Alerts](/docs/playbooks/setup-dispute-alerts) - Prevent chargebacks [First-Time 3DS](/docs/playbooks/first-time-3ds-setup) - Liability shift [Digital Wallets](/docs/playbooks/onboard-digital-wallets) - Mobile conversion Need background first? [Fraud Fundamentals](/docs/fraud/fundamentals) - Understand concepts [Chargeback Basics](/docs/chargebacks) - How disputes work [Benchmarks](/docs/reference/benchmarks) - What "good" looks like --- ## See Also [๐Ÿ” Fraud Detection](/docs/fraud/detection) [๐Ÿ’ฐ Chargebacks](/docs/chargebacks) [โš™๏ธ Operations](/docs/operations) [๐Ÿ“Š Benchmarks](/docs/reference/benchmarks) - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute ratios - [Fraud Metrics](/docs/fraud/metrics) - Monitoring fraud rates - [Payments Metrics](/docs/payments/metrics) - Auth rate tracking - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [3D Secure](/docs/fraud/prevention/3ds) - Authentication setup - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Alert services - [Processor Management](/docs/operations/processor-management) - Working with processors - [Experimentation](/docs/reference/experimentation) - Testing methodology --- ## Breach Response Source: https://paymentsandrisk.com/docs/playbooks/breach-response # Playbook: Breach Response :::warning[Business-Critical] Suspect card data got out? The next 72 hours decide whether this is a manageable incident or the end of your business. Move now. ::: :::info[TL;DR] - **Hour 0-4**: contain it, preserve evidence, call your processor by phone rather than email - **Hour 4-24**: engage a PCI Forensic Investigator, notify your acquirer formally - **Day 1-3**: card brand notification through the acquirer, legal review, scope assessment - **Week 1-4**: full investigation, remediation, re-certification - **Silence isn't an option.** Mastercard and Amex want 24 hours, Discover 48, Visa 3 days. ::: The clock starts when you suspect a breach, not when you confirm it. ## Workflow Overview ```mermaid flowchart LR A[HOUR 0-4Contain] --> B[HOUR 4-24Notify] --> C[DAY 1-3Investigate] --> D[WEEK 1-4Remediate] style A fill:#ef4444,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Actions | |-------|-------------| | **Contain** | Stop the bleeding, preserve evidence, contact processor | | **Notify** | Engage PFI, formal notifications to acquirer and brands | | **Investigate** | Scope assessment, forensic analysis, affected card identification | | **Remediate** | Fix vulnerabilities, re-certify, handle fines and liabilities | :::tip[Have these on hand before you need them] - Your processor's emergency contact number - Your acquirer's breach notification requirements - Your cyber liability policy number, if you carry one - Who in the building can sign off on an external vendor at 2am ::: --- ## When to Use This Playbook Start this playbook when you see: | Signal | Urgency | |--------|---------| | Confirmed malware on payment systems | **Immediate** | | Anomalous outbound data transfers from POS/e-commerce | **Immediate** | | Card brand notification of fraud cluster | **Immediate** | | Suspicious files in payment environment | High | | Unusual database queries on card data | High | | Third-party breach affecting your data | High | | Ransomware attack on any systems | High | **When in doubt, assume breach and start the clock.** --- ## Hour 0-4: Contain ### Stop the Bleeding (First 30 Minutes) ``` โ–ก Isolate affected systems (don't turn off - preserve evidence) โ–ก Disconnect payment systems from network (if actively exfiltrating) โ–ก Block suspicious IPs/connections at firewall โ–ก Change all administrative passwords (payment systems, databases) โ–ก Disable compromised user accounts ``` :::danger[Don't] - **Don't wipe systems** - you'll destroy the forensic evidence - **Don't reboot servers** - volatile memory is holding evidence - **Don't try to fix it yourself** - you may still need a PFI - **Don't discuss it on email or Slack** - assume the attacker is reading ::: ### Preserve Evidence (Hour 1) ``` โ–ก Take memory dumps of affected systems (if capable) โ–ก Capture full disk images before any changes โ–ก Export firewall and network logs (last 90 days minimum) โ–ก Export database query logs โ–ก Screenshot any suspicious activity โ–ก Document timeline: when discovered, by whom, initial observations ``` ### Call Your Processor (Hour 1-2) **Call, don't email.** Email is too slow and may be compromised. What to say: > "We have a suspected data security incident affecting our payment environment. We're in containment mode and need to initiate your breach response process." Ask: 1. Who is my incident response contact? 2. What's the formal notification process? 3. Do you have a preferred PCI Forensic Investigator (PFI)? 4. What are my immediate obligations? ### Assemble Response Team (Hour 2-4) | Role | Responsibility | |------|----------------| | **Incident Commander** | Single decision maker, coordinates response | | **IT/Security Lead** | Technical containment and evidence preservation | | **Legal** | Notification requirements, liability, communications | | **Finance** | Reserve funds for PFI, fines, customer notification | | **Communications** | Internal and external messaging (if required) | | **Vendor Contact** | Point person for processor, PFI, insurance | --- ## Hour 4-24: Notify ### Engage a PCI Forensic Investigator (PFI) You'll need one for most breaches. The PCI SSC certifies them to investigate card data. **When you're required to bring one in:** - Your card brand or acquirer asks for one - More than 10,000 cards may have been exposed - Malware turned up on your payment systems - A Common Point of Purchase has been identified **How to find one:** 1. Ask your processor or acquirer for their preferred list 2. Check PCI SSC's [list of approved PFIs](https://www.pcisecuritystandards.org/assessors_and_solutions/pci_forensic_investigators) 3. Your cyber insurance may have a panel of approved investigators **Expect to pay:** $20,000-$100,000+ depending on scope and urgency. ### Formal Acquirer Notification (Hour 8-12) You have to notify your acquirer formally. That's the bank behind your merchant account. ``` โ–ก Written notification (email + certified letter) โ–ก Include: Date discovered, initial scope estimate, containment steps taken โ–ก Request: Confirmation of receipt, next steps, timeline requirements โ–ก Ask: Card brand notification requirements and process ``` ### Card Brand Notifications (Hour 12-24) The brands run hard notification windows. Your acquirer usually does the talking, and you feed them the facts. | Network | Notification Window | Key Requirements | |---------|---------------------|------------------| | **Visa** | Within 3 calendar days of discovery | Account Data Compromise (ADC) process | | **Mastercard** | Within 24 hours | Account Data Compromise (ADC) process | | **Amex** | Within 24 hours | Direct notification (separate from Visa/MC) | | **Discover** | Within 48 hours | Separate process from other networks | ### Document Everything ``` โ–ก Create incident log (timestamped actions and decisions) โ–ก Record all phone calls (date, time, who, summary) โ–ก Save all emails related to incident โ–ก Document any evidence collected โ–ก Track hours spent (for insurance claims) ``` --- ## Day 1-3: Investigate ### PFI Initial Assessment The PFI will: ``` โ–ก Deploy forensic tools on affected systems โ–ก Analyze malware (if present) โ–ก Determine entry point and attack timeline โ–ก Identify systems with card data access โ–ก Estimate date range of exposure โ–ก Begin card number identification ``` ### Scope Assessment Work out: | Question | Impact | |----------|--------| | **How many cards exposed?** | Determines reissuance liability | | **What data elements?** | PAN only vs. PAN + CVV vs. track data | | **Date range of exposure?** | Card brand operational costs | | **How did attacker get in?** | Remediation requirements | | **Is attack ongoing?** | Containment priority | ### Legal and Regulatory Review ``` โ–ก Identify applicable breach notification laws (by state/country) โ–ก Determine customer notification timeline requirements โ–ก Review contracts with partners/vendors for notification requirements โ–ก Assess regulatory reporting obligations (if any) โ–ก Review cyber insurance policy coverage and notification requirements ``` ### Internal Communication What to tell employees: - The incident is under investigation right now - Don't discuss it outside the company at all - Send every inquiry to the named spokesperson - Cooperate fully with the investigators - Preserve anything that might turn out to be evidence --- ## Week 1-4: Remediate ### Fix the Vulnerabilities Based on PFI findings, you'll need to address root causes: | Finding | Typical Remediation | |---------|---------------------| | **Malware on POS** | Clean rebuild, endpoint protection, network segmentation | | **Unpatched systems** | Patch management program, vulnerability scanning | | **Weak credentials** | Password policy, MFA implementation | | **No network segmentation** | Segment payment systems, firewall rules | | **Third-party compromise** | Vendor security review, access restrictions | ### Re-Certification After remediation, you may need: ``` โ–ก PCI DSS re-assessment (if Level 1 or required by acquirer) โ–ก New SAQ completion (for smaller merchants) โ–ก Vulnerability scan by Approved Scanning Vendor (ASV) โ–ก Penetration test (if required) โ–ก Remediation validation by PFI ``` ### Handle Fines and Liabilities **Potential costs:** | Cost Category | Typical Range | |---------------|---------------| | **PFI investigation** | $15,000-$100,000+ | | **Card reissuance** | $3-$10 per card reissued | | **Operational costs** | Variable (fraud monitoring by networks) | | **Non-compliance fines** | $5,000-$100,000+ | | **Customer notification** | $1-$5 per customer | | **Credit monitoring** | $10-$30 per affected customer/year | | **Legal fees** | Variable | | **Increased processing rates** | Potential 0.5-2% increase | ### Customer Notification (If Required) If notification is required by law or contract: ``` โ–ก Draft notification letter (legal review) โ–ก Prepare FAQ for customer inquiries โ–ก Set up dedicated phone line or email โ–ก Offer credit monitoring if appropriate โ–ก Document all notifications sent ``` --- ## Post-Incident: Recovery ### Return to Normal Processing ``` โ–ก Get written clearance from acquirer โ–ก Confirm PFI has closed investigation โ–ก Resume full processing (may be phased) โ–ก Monitor for any attack resumption โ–ก Verify reserves/holds are released on schedule ``` ### Lessons Learned Within 30 days of resolution: ``` โ–ก Conduct post-incident review โ–ก Document what worked and what didn't โ–ก Identify control gaps that allowed breach โ–ก Create action plan for improvements โ–ก Update incident response procedures โ–ก Train staff on new controls ``` ### Long-Term Improvements What to fix for next time: | Area | Typical Improvements | |------|----------------------| | **Detection** | Log monitoring, SIEM, intrusion detection | | **Prevention** | Network segmentation, endpoint protection, access controls | | **Response** | Updated playbooks, regular drills, vendor relationships | | **Compliance** | Regular assessments, continuous compliance monitoring | --- ## Cost Planning Template Use this to estimate breach costs: ``` Breach Cost Estimate -------------------- Investigation: PFI engagement: $_________ Internal labor (hours x rate): $_________ External legal: $_________ Card Brand Assessments: Cards exposed: _________ Estimated reissuance: $_________ (cards x $5 avg) Operational costs: $_________ (from network) Fines: Non-compliance fines: $_________ Late notification fines: $_________ Customer Costs: Customers affected: _________ Notification costs: $_________ Credit monitoring: $_________ Customer compensation: $_________ Recovery: Remediation: $_________ Re-certification: $_________ Increased rates: $_________/year TOTAL ESTIMATED COST: $_________ ``` --- ## When to Get a Lawyer Call a lawyer today if: - The breach may touch more than 10,000 records - You operate across states or countries, so notification law gets messy - The attackers are demanding a ransom - You carry cyber insurance. The policy may name your counsel for you - Regulatory obligations apply, like HIPAA or SOX - Third-party data was caught in it - Litigation looks likely --- ## Quick Reference: Key Deadlines | Deadline | Requirement | |----------|-------------| | **Immediate** | Contain and preserve evidence | | **24 hours** | Notify acquirer and card brands | | **State-specific** | Customer notification (varies by state: 30-90 days typical) | | **30 days** | Begin PFI investigation | | **90 days** | Complete remediation (typical) | | **Varies** | Re-certification (depends on level and scope) | --- ## Emergency Contacts Template Fill in for your organization: | Role | Name | Phone | Email | |------|------|-------|-------| | Incident Commander | | | | | IT/Security Lead | | | | | Legal | | | | | Processor Emergency Line | | | | | Acquirer Contact | | | | | Cyber Insurance Broker | | | | | PFI (pre-selected) | | | | --- ## Test to Run **Breach response drill (quarterly):** Run a tabletop exercise: 1. **Scenario:** "We found unknown files on our payment server, and customers are reporting fraudulent charges." 2. Walk through first 4 hours of this playbook 3. Identify the gaps. Who didn't know their role, and what contact info was missing? 4. Update the playbook and the contact list from what you found **Success criteria:** Team can execute first 4 hours without confusion about roles or contacts. --- ## Related - [PCI DSS Compliance](/docs/compliance/pci-dss) - Baseline security requirements - [MATCH / TMF List](/docs/chargebacks/match-tmf) - What happens if processing is terminated - [Processor Management](/docs/operations/processor-management) - Working with processors - [Terminal Security](/docs/fraud/terminal-security) - Preventing POS breaches - [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) - Fraud attack response - [Network Programs](/docs/chargebacks/reference/network-programs) - Brand compliance programs - [Holds and Reserves](/docs/operations/holds-and-reserves) - Cash flow during incidents --- ## First-Time 3DS Setup Source: https://paymentsandrisk.com/docs/playbooks/first-time-3ds-setup # First-Time 3DS Setup (Playbook) :::info[TL;DR] - **Week 1**: Integrate 3DS2 (processor-provided is fastest), implement challenge flow - **Week 1-2**: Define triggers (first-time customer? High-value? EU?), configure risk thresholds - **Testing**: Frictionless success, challenge success, challenge failure, not enrolled, attempted - **Go live**: Start with 10-25% of traffic, target over 70% frictionless, under 2% conversion drop - **Success**: Fraud disputes showing liability shift, conversion stable ::: 3D Secure shifts fraud liability to the issuer when authentication succeeds. Done wrong it kills conversion. Done right you won't notice it and neither will most customers. What's below is a 3DS2 setup for first-timers. _Timeline: 1-2 weeks. Integration complexity varies by provider._ :::warning[Key Principle: 3DS Instead of Decline] If you're thinking about declining a transaction for fraud, use 3DS instead. You get liability shift if they pass, and lose nothing if they fail. See [3DS deep-dive](/docs/fraud/prevention/3ds) for the full rationale. ::: :::danger[3DS Only Protects Against Fraud Chargebacks] Liability shift covers fraud disputes (Visa 10.4, Mastercard 4837). Customers can still dispute for merchandise not received, not as described, or credit not processed. 3DS doesn't protect against bad fulfillment. ::: ## Workflow Overview ```mermaid flowchart LR A[WEEK 1Integrate] --> B[WEEK 1-2Configure] --> C[WEEK 2Test & Launch] --> D[ONGOINGMonitor] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Integrate** | Choose provider, configure settings, implement challenge flow | | **Configure** | Define triggers, set SCA exemptions, build risk rules | | **Test & Launch** | Test all scenarios, rollout 10-25%, expand to 100% | | **Monitor** | Track rates, tune rules, check fraud impact | You'll need a processor that supports 3DS2, access to a 3DS provider, the ability to change your checkout flow, and test cards. ## Trigger Criteria Use this playbook when: - You're accepting CNP payments without 3DS - Fraud chargebacks are eating into margin - You sell to EU customers (SCA mandate) - You want liability shift for high-risk transactions --- ## Understanding 3DS2 ### How 3DS2 Works ```mermaid flowchart LR A[Customer enters card] --> B[Send auth request with 3DS data] B --> C[3DS server contacts issuer] C --> D{Issuer decides} D -->|Frictionless| F[Auth proceeds] D -->|Challenge| E[Customer authenticatesOTP, app, biometric] E --> F ``` ### 3DS2 vs 3DS1 | Feature | 3DS1 (Legacy) | 3DS2 (Current) | |---------|---------------|----------------| | User experience | Always redirect | Mostly frictionless | | Data shared | Minimal | 100+ data points | | Mobile experience | Poor | Native SDKs | | Approval rate | Lower | Higher | ### Key Outcomes | Result | What Happens | Liability | |--------|--------------|-----------| | **Frictionless success** | No customer action | Shifts to issuer | | **Challenge success** | Customer authenticates | Shifts to issuer | | **Challenge failed** | Customer fails auth | Transaction declined | | **Not enrolled** | Card doesn't support 3DS | Stays with merchant | | **Attempted** | Issuer unavailable | Shifts to issuer | --- ## Week 1: Integration ### Step 1: Choose 3DS Provider | Provider Type | Examples | Pros | Cons | |---------------|----------|------|------| | **Integrated with processor** | Stripe Radar, Braintree | Easiest setup | Less control | | **Standalone** | Cardinal, Netcetera | More control | More integration | | **Gateway-provided** | [Adyen](/docs/payments/processors/adyen), [Checkout.com](/docs/payments/processors/checkout-com) | Single vendor | Vendor lock-in | **Recommendation:** start with processor-integrated 3DS. It's the fastest thing to turn on and it's hard to get wrong. If you need more control later, that's when standalone makes sense. ### Step 2: Configure 3DS Settings #### If Using Stripe 1. In your Stripe Dashboard, go to **Payments > Settings** 2. Under "Radar rules," enable 3D Secure for your chosen conditions 3. Or tell your developer: "Set `request_three_d_secure: 'automatic'` in payment options" **What to tell your developer:** "Configure Stripe to request 3DS automatically based on risk. Use the Radar dashboard or API options." #### If Using Adyen 1. In the Adyen Customer Area, go to **Risk > 3D Secure** 2. Configure authentication preferences per transaction type 3. Enable "Native 3DS" for better mobile experience **What to tell your developer:** "Enable native 3DS in the authentication config. Pass browser info for frictionless rates." ### Step 3: Implement Challenge Flow When 3DS requires a challenge, the customer sees an authentication popup or redirect: 1. Receive challenge URL or data from 3DS response 2. Render challenge in iframe or redirect 3. Customer completes authentication (OTP, app approval, biometric) 4. Receive completion callback 5. Continue with authorization **What to tell your developer:** "Use Stripe.js `handleCardAction()` or Adyen's Drop-in component to render challenges. Both handle the redirect flow automatically." **Checkpoint:** 3DS integrated; test transactions showing challenge when expected. --- ## Week 1-2: Tuning ### Step 1: Define When to Trigger 3DS Don't 3DS everything. Target high-risk transactions: | Condition | 3DS Recommendation | |-----------|-------------------| | **First-time customer** | Yes (no history) | | **High-value order** | Yes (over $X threshold) | | **High-risk country** | Yes | | **Mismatched geo** | Yes (IP vs billing) | | **Returning trusted customer** | No (friction hurts) | | **Low-value order** | No (fraud cost low) | | **EU customer** | Required (SCA mandate) | ### Step 2: Configure Risk Thresholds Configure your processor or fraud tool to trigger 3DS on these conditions: | Condition | Rule | |-----------|------| | High-value orders | Require 3DS when order is over $500 | | New customers + moderate value | Require 3DS for new customers over $100 | | High-risk countries | Always require 3DS | | Geo mismatch | Require 3DS when IP country differs from billing country | | High fraud score | Require 3DS when fraud score exceeds threshold (e.g., 70+) | **What to tell your developer:** "Set up Radar rules (Stripe) or risk rules (Adyen) to trigger 3DS on these conditions. Most processors have dashboard UIs for this." ### Step 3: SCA Exemption Strategy (EU Only) SCA allows exemptions. Use them to reduce friction: | Exemption | When to Use | |-----------|-------------| | **Low value** | Under 30 EUR | | **Low risk (TRA)** | Your fraud rate is low | | **Recurring** | Subsequent subscription payments | | **Trusted beneficiary** | Customer whitelisted you | **Note:** Issuers can override exemptions. Track exemption success rate. --- ## Testing Checklist ### Test Card Scenarios | Scenario | What to Test | |----------|--------------| | Frictionless success | No challenge, auth succeeds | | Challenge success | Challenge presented, customer completes, auth succeeds | | Challenge failure | Challenge presented, customer fails, auth declined | | Not enrolled | Card doesn't support 3DS, auth proceeds without | | Issuer unavailable | Attempted result, auth may proceed | ### Integration Tests - [ ] 3DS triggers on configured conditions - [ ] Challenge renders correctly (desktop) - [ ] Challenge renders correctly (mobile) - [ ] Callback handles success - [ ] Callback handles failure - [ ] Timeout handled gracefully - [ ] Fallback if 3DS unavailable **Checkpoint:** All test scenarios passing. --- ## Go Live and Monitor ### Initial Rollout 1. **Start with 10-25% of eligible traffic** 2. Monitor for 1 week 3. Check key metrics before expanding ### Metrics to Track | Metric | Target | Red Flag | |--------|--------|----------| | Frictionless rate | Over 70% | Under 50% | | Challenge success rate | Over 80% | Under 60% | | Conversion impact | Under 2% drop | Over 5% drop | | Liability shift rate | Over 90% | Under 70% | ### What Good Looks Like - 3DS requested on 20-40% of transactions (risk-based) - 70-85% frictionless (no customer action) - 80%+ challenge success when challenged - Fraud chargebacks dropping - Conversion stable --- ## Success Criteria You're done when: - [ ] 3DS integrated and processing live traffic - [ ] Risk-based triggers configured (not 3DS on everything) - [ ] Frictionless rate above 70% - [ ] Conversion impact under 2% - [ ] Fraud disputes showing liability shift --- ## Scale Callout | Volume | Approach | |--------|----------| | **Under $100k/mo** | Use processor default 3DS; minimal tuning; focus on working integration | | **$100k-$1M/mo** | Custom risk rules; A/B test thresholds; optimize frictionless rate | | **Over $1M/mo** | Sophisticated risk model; exemption strategy; issuer-level analysis | --- ## Where This Breaks - **3DS on every transaction.** Kills conversion. Be selective. - **No browser data passed.** Frictionless rate tanks. Collect and pass device data. - **Mobile challenge renders poorly.** Test on actual devices; use native SDKs. - **Ignoring exemptions (EU).** Over-authenticating loyal customers. Implement TRA. - **Not tracking liability shift.** Can't prove ROI. Tag transactions with 3DS result. --- ## SCA Requirements (EU) If you sell to EU customers, SCA is required with exceptions: ### Must Authenticate - First-time EU card transactions over 30 EUR - High-risk transactions (unless exempt) ### Exemption Eligible - Under 30 EUR (low value) - Recurring after first payment - Your fraud rate qualifies for TRA - B2B payments (some cases) ### Your Fraud Rate for TRA | Your Fraud Rate | Amount Threshold for Exemption | |-----------------|-------------------------------| | Under 0.13% | Up to 100 EUR | | Under 0.06% | Up to 250 EUR | | Under 0.01% | Up to 500 EUR | --- ## Next Steps After 3DS is live and stable: 1. **Tune thresholds**: A/B test your risk triggers, because you're trading frictionless rate against fraud protection and you can't have both 2. **Add exemptions** (EU): Implement TRA exemptions if your fraud rate qualifies 3. **Track liability shift**: Verify fraud chargebacks are being deflected to issuers 4. **Consider network tokens**: Combine 3DS with [network tokenization](/docs/payments/auth-optimization) for additional auth lift --- ## Related - [3D Secure](/docs/fraud/prevention/3ds) - Deep-dive on 3DS mechanics - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Fraud Prevention](/docs/fraud/prevention) - Prevention strategies - [Benchmarks](/docs/reference/benchmarks) - Industry 3DS benchmarks - [Payments Experimentation](/docs/reference/experimentation) - A/B testing 3DS triggers - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification signals - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining 3DS with scoring - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Setting up 3DS rules - [Checkout Conversion](/docs/payments/checkout-conversion) - Measuring friction impact - [Third-Party Fraud](/docs/fraud/types/third-party) - What 3DS protects against - [Chargeback Prevention](/docs/chargebacks/prevention) - Liability shift benefits - [Increase Auth Rates](/docs/playbooks/increase-auth-rates) - Optimizing auth after 3DS --- ## Fix Declining Auth Rates Source: https://paymentsandrisk.com/docs/playbooks/fix-declining-auth-rates # Fix Declining Auth Rates (Playbook) :::info[TL;DR] - **Hour 1**: confirm the drop is real and isn't a data artifact, isolate the segment (BIN, geo, method), pull decline codes. Half the time that's where it ends - **Hour 2-4**: Match pattern. Issuer-specific? All traffic? Soft declines (51)? Hard declines (14, 54)? 3DS-related? - **Common fixes**: roll back the aggressive rule, restart the card updater, fix the 3DS config, or get your processor to do issuer outreach. It's usually the first one - **Set alerts**: 0.5pp below 7-day average, 2x normal for specific decline codes - See [Auth Optimization](/docs/payments/auth-optimization) for proactive improvements ::: Auth rate dropped 2+ points in a week? Don't panic. This playbook helps you diagnose the cause in hours, not days. Most drops come from a small number of root causes. Find yours. _Timeline: 1-3 days to diagnose, 1-2 weeks to fix._ ## Workflow Overview ```mermaid flowchart LR A[HOUR 1Identify Scope] --> B[HOUR 2-4Root Cause] --> C[DAY 2-3Implement] --> D[ONGOINGMonitor] style A fill:#ef4444,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Identify Scope** | Confirm drop is real, isolate segment (BIN, geo, method), check decline codes | | **Root Cause** | Check scenarios, match symptoms to likely causes | | **Implement** | Quick fixes (same day), medium fixes (this week), plan longer fixes | | **Monitor** | Set up alerts, track recovery, document learnings | Pull four things before you start. Your processor dashboard, auth rate broken out by segment, the decline code breakdown, and the timestamp of when it started dropping. Without that you're guessing, and you'll guess wrong. ## Trigger Criteria Use this playbook when: - Auth rate dropped more than 1% week-over-week - Auth rate dropped more than 0.5% day-over-day - You're suddenly below your historical baseline - Customer complaints about declined payments spike --- ## Hour 1: Identify the Scope ### Step 1: Confirm the Drop Is Real Rule out data issues first: - Check total transaction volume (did volume spike or drop?) - Verify reporting isn't lagged or broken - Compare multiple data sources if available **Checkpoint:** Confirmed real auth rate decline, not data artifact. ### Step 2: Isolate the Segment Break down auth rate by: | Segment | Check For | |---------|-----------| | **Card brand** | Visa vs MC vs Amex vs Discover | | **BIN/Issuer** | Specific issuer having issues | | **Geography** | US vs international; specific countries | | **Payment method** | Cards vs wallets vs ACH | | **Transaction type** | CP vs CNP; one-time vs recurring | | **3DS status** | 3DS vs non-3DS | | **Time of day** | Certain hours affected | **Checkpoint:** Identified whether drop is global or isolated to specific segment. ### Step 3: Check Decline Codes Pull decline code distribution: | Code | Meaning | If Spiking | |------|---------|------------| | 05 | Do not honor | Issuer-side issue or fraud signal | | 51 | Insufficient funds | Customer mix changed | | 14 | Invalid card number | Tokenization or integration issue | | 54 | Expired card | Card updater not running | | 57 | Transaction not permitted | MCC or geo restriction | | 65 | Velocity exceeded | Your rules or issuer rules | **Checkpoint:** Identified which decline codes increased. --- ## Hour 2-4: Root Cause Analysis ### Scenario A: Specific Issuer Declining More **Symptoms:** - One or few issuers (BINs) show major decline increase - Other issuers unchanged **Likely causes:** - Issuer fraud model updated - Issuer technical issues - Your fraud rate with that issuer triggered blocks **Actions:** 1. Check if issuer has known outage (check DownDetector, X/Twitter) 2. Review your fraud/chargeback rate with that issuer 3. Contact processor to check for issuer advisories 4. If persistent, escalate through network channels ### Scenario B: All Traffic Declining More **Symptoms:** - Decline increase across all segments - Happened suddenly at specific time **Likely causes:** - Integration change deployed - Processor/gateway issue - New fraud rule too aggressive - 3DS configuration changed **Actions:** 1. Check recent code deploys (was anything pushed?) 2. Check processor status page 3. Review fraud rule changes in last 48 hours 4. Check 3DS challenge rate (did it spike?) ### Scenario C: Soft Declines (05, 51) Increasing **Symptoms:** - "Do not honor" or "Insufficient funds" codes up - Customer quality may have changed **Likely causes:** - Traffic source changed (new marketing channel) - Time of month (end of month, funds low) - Fraud testing attacks (generates declines) **Actions:** 1. Compare traffic sources week-over-week 2. Check for velocity spikes (fraud testing?) 3. Implement retry logic if not already present 4. Review if new marketing is bringing lower-quality leads ### Scenario D: Hard Declines (14, 54) Increasing **Symptoms:** - "Invalid card" or "Expired card" codes up - Often recurring billing affected **Likely causes:** - Card updater stopped working - Token migration issue - Integration sending wrong data **Actions:** 1. Verify card updater is running (check processor dashboard) 2. Check tokenization integrity 3. Review integration logs for malformed requests ### Scenario E: 3DS-Related Decline **Symptoms:** - Non-3DS auth rate stable; 3DS auth rate dropped - Challenge rate increased - Frictionless rate decreased **Likely causes:** - 3DS provider issue - Risk threshold changed - Issuer ACS issues **Actions:** 1. Check 3DS provider status 2. Review 3DS risk settings (did thresholds change?) 3. Compare challenge vs frictionless rates 4. Test 3DS flow manually --- ## Day 2-3: Implement Fixes ### Quick Fixes (Same Day) | Issue | Fix | |-------|-----| | Too-aggressive fraud rule | Roll back or loosen in shadow mode | | Integration bug | Hotfix and deploy | | Card updater stopped | Re-enable or restart | | 3DS misconfigured | Adjust thresholds | ### Medium Fixes (This Week) | Issue | Fix | |-------|-----| | Issuer blocking you | Contact processor for issuer outreach | | Retry logic missing | Implement smart retry for soft declines | | Bad traffic source | Pause channel, investigate | ### Longer Fixes (Ongoing) | Issue | Fix | |-------|-----| | High fraud rate causing blocks | Improve fraud prevention | | Need network tokens | Implement tokenization project | | Need better 3DS | Tune risk model, consider new provider | --- ## Monitoring After Fix Set up alerts to catch future drops: | Alert | Threshold | |-------|-----------| | Auth rate drop | More than 0.5pp below 7-day average | | Specific decline code spike | More than 2x normal volume | | 3DS challenge rate | More than 5pp above baseline | | Single issuer decline rate | More than 10pp above baseline | --- ## Success Criteria You're done when: - [ ] Root cause identified and documented - [ ] Fix implemented or escalation in progress - [ ] Auth rate recovering toward baseline - [ ] Monitoring alerts configured to catch recurrence --- ## Scale Callout | Volume | Approach | |--------|----------| | **Under $100k/mo** | Focus on biggest decline code first; may not have segment granularity | | **$100k-$1M/mo** | Full segment analysis; processor should help with issuer outreach | | **Over $1M/mo** | Real-time monitoring required; dedicated processor contact; issuer-level optimization | --- ## Where This Breaks - **No segment-level data.** Ask processor for detailed reporting; you need this visibility. - **Can't identify deploy timing.** Correlate with engineering; need deploy timestamps. - **Processor says "issuer issue" but won't help.** Escalate; ask for issuer outreach or network escalation. - **Auth rate keeps bouncing.** That's usually A/B tests, bot traffic or something external. It's a longer investigation. - **Multiple issues at once.** Fix one at a time and validate, or you won't know which fix worked. --- ## Next Steps After stabilizing auth rates: 1. **Document the root cause**: Add to your runbook for faster diagnosis next time 2. **Set up alerts**: Configure [monitoring](/docs/operations/alerts-configuration) to catch future drops early 3. **Optimize proactively**: Move to [Increase Auth Rates](/docs/playbooks/increase-auth-rates) playbook 4. **Review quarterly**: Schedule regular auth rate reviews to catch gradual declines --- ## Related - [Auth Optimization](/docs/payments/auth-optimization) - Proactive improvements - [Decline Codes Reference](/docs/reference/decline-codes) - Understanding decline reasons - [Authorization Basics](/docs/payments/reference/authorization-basics) - Auth fundamentals - [Benchmarks](/docs/reference/benchmarks) - Industry auth rate targets - [Payments Experimentation](/docs/reference/experimentation) - A/B testing changes - [Increase Auth Rates](/docs/playbooks/increase-auth-rates) - Optimization playbook - [3D Secure](/docs/fraud/prevention/3ds) - 3DS troubleshooting - [Processor Management](/docs/operations/processor-management) - Processor relationships - [Alerts Configuration](/docs/operations/alerts-configuration) - Setting up monitoring - [Payments Metrics](/docs/payments/metrics) - Tracking auth rates - [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) - When migration causes issues - [Card Payments](/docs/payments/payment-methods/cards) - Card type impacts --- ## Handle a Refund Request Source: https://paymentsandrisk.com/docs/playbooks/handle-refund-request # Playbook: Handle a Refund Request :::info[TL;DR] - **Under $25**: Refund immediately. The cost of investigation exceeds the transaction value. - **$25-$500**: Check order details, then decide within 24 hours. Speed prevents chargebacks. - **Over $500**: Investigate, but communicate with the customer within 4 hours. - **Every refund request you handle well is a chargeback you prevented.** A refund costs ~3% of the transaction. A chargeback costs $50-175+. - **Empower your support team.** Agents who can refund without escalation resolve requests 3x faster. ::: Step-by-step guide for when a customer asks for their money back. The goal: resolve it before they call their bank. ## Workflow Overview ```mermaid flowchart LR A[RECEIVERequest arrives] --> B[ASSESSCheck details] --> C[DECIDERefund or investigate] --> D[RESOLVEProcess and communicate] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Receive** | Log the request, acknowledge to customer within 4 hours | | **Assess** | Pull order details, check for fraud signals, review history | | **Decide** | Refund, partial refund, deny with explanation, or escalate | | **Resolve** | Process refund, confirm to customer, update records | ## When to Use This Playbook - Customer emails, calls, or chats asking for a refund - Customer posts a complaint on social media - You receive a pre-chargeback alert (Ethoca, CDRN, RDR) - Customer's bank contacts you before filing a formal dispute ## Step 1: Receive and Acknowledge ``` โ–ก Log the request with timestamp, channel, and customer ID โ–ก Acknowledge receipt within 4 hours (same business day) โ–ก Use this template: "Hi [Name], I received your request about order [#]. I'm looking into this now and will follow up within [24 hours / 1 business day]." โ–ก Do NOT ask the customer to "wait while we investigate" without giving a timeline ``` :::warning[Speed Matters] Customers who don't hear back within 24 hours are significantly more likely to file a chargeback. Every hour of silence increases your risk. ::: ## Step 2: Assess the Request Pull the order details and check these signals: ``` โ–ก Order details: โ–ก Transaction amount โ–ก Order date and delivery date โ–ก Product/service delivered? โ–ก Digital or physical goods? โ–ก Customer history: โ–ก First-time or repeat customer? โ–ก Previous refund requests? How many? โ–ก Previous chargebacks? โ–ก Fraud signals: โ–ก Does the request match the order? (e.g., "never received" but tracking shows delivered) โ–ก Multiple refund requests in short period? โ–ก Pattern matches known friendly fraud? โ–ก Timing: โ–ก Within your posted refund window? โ–ก If outside window, how far outside? ``` ### Quick Decision Matrix | Amount | Customer History | Fraud Signals | Action | |--------|-----------------|---------------|--------| | Under $25 | Any | None | Refund immediately | | Under $25 | Any | Suspicious | Refund (not worth investigating) | | $25-$100 | Good | None | Refund immediately | | $25-$100 | Good | Suspicious | Investigate, decide in 24h | | $25-$100 | Bad (repeat refunds) | Any | Investigate, decide in 24h | | $100-$500 | Good | None | Refund or partial refund | | $100-$500 | Any | Suspicious | Investigate, decide in 24h | | Over $500 | Good | None | Verify details, refund in 24h | | Over $500 | Any | Suspicious | Full investigation | ## Step 3: Decide ### Option A: Full Refund Use when: - Amount is small (under $25-50 for your business) - Customer has a legitimate complaint - Product was genuinely not delivered or defective - You're outside the return window but the request is reasonable ``` โ–ก Process refund through your processor dashboard โ–ก Refund to original payment method (required by most processors) โ–ก Send confirmation email with refund amount and expected timing โ–ก Note: Refunds take 5-10 business days to appear on customer's statement ``` ### Option B: Partial Refund Use when: - Customer used part of the service before requesting refund - Product was partially delivered or partially defective - Shipping costs were incurred that can't be recovered - You want to retain some value while satisfying the customer ``` โ–ก Calculate fair partial amount โ–ก Explain the breakdown to the customer before processing โ–ก Get customer agreement before processing (email confirmation) โ–ก Process and confirm ``` ### Option C: Deny with Explanation Use when: - Strong evidence of friendly fraud (confirmed delivery, usage logs) - Request is clearly outside policy and unreasonable - Customer has a pattern of abuse ``` โ–ก Prepare evidence (tracking, delivery confirmation, usage logs) โ–ก Respond with specific reasons, not just "policy says no" โ–ก Offer alternatives: exchange, store credit, partial refund โ–ก Document everything in case this becomes a chargeback โ–ก Save all communication for potential representment ``` :::tip[The Alternatives Save You] Even when denying a full refund, offering an alternative (store credit, exchange, partial refund) prevents 40-60% of chargebacks that would otherwise follow a denial. ::: ### Option D: Escalate Use when: - Amount is large and circumstances are ambiguous - Customer is threatening legal action - Request involves a product safety issue - You need manager approval per your internal policy ``` โ–ก Inform customer of escalation and revised timeline โ–ก Escalate with full context (don't make the next person start over) โ–ก Follow up within the promised timeline ``` ## Step 4: Resolve and Follow Up ``` โ–ก Process the decided action (refund, partial, denial) โ–ก Send confirmation to customer with: โ–ก What was decided โ–ก If refund: amount and expected timing (5-10 business days) โ–ก If denied: clear reasoning and alternatives offered โ–ก Update customer record with outcome โ–ก If this was a pre-chargeback alert: respond to the alert โ–ก Flag patterns for review (is this product generating lots of requests?) ``` ## After Resolution: Prevent Repeats After every 10 refund requests, review for patterns: ``` โ–ก Are refunds clustering around a specific product? โ–ก Are refunds clustering around a specific timeframe (e.g., 30 days post-purchase)? โ–ก Is your refund policy clearly visible before checkout? โ–ก Are your billing descriptors recognizable? (Check: would a customer recognize the charge on their statement?) โ–ก Are confirmation and shipping emails being sent and received? ``` ## Measuring Success | Metric | Target | What It Tells You | |--------|--------|-------------------| | **Refund response time** | Under 24 hours | Speed of customer resolution | | **Refund-to-chargeback ratio** | 3:1 or higher | Are you refunding before customers dispute? | | **Repeat refund rate** | Under 5% of customers | Are you attracting serial refunders? | | **Refund rate** | Under 2% of transactions | Overall refund volume health | --- ## See Also - [Refund Strategy](/docs/chargebacks/refund-strategy) - The math behind refund vs. fight decisions - [Refund Policy Design](/docs/chargebacks/refund-policy) - Building a policy that prevents chargebacks - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before they start - [Billing Statement Names](/docs/chargebacks/prevention/descriptors-and-comms) - Fix unrecognized charges - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN pre-dispute alerts - [Representment](/docs/chargebacks/representment) - When the customer disputes anyway --- ## Increase Auth Rates Source: https://paymentsandrisk.com/docs/playbooks/increase-auth-rates # Playbook: Increase Authorization Rates :::info[TL;DR] - **Week 1**: Retry logic experiments. Soft declines (51, 61) retry timing, technical (91, 96) immediate retry - **Week 2**: Card updater enrollment (VAU, ABU), proactive expiration emails - **Week 3**: [3DS](/docs/fraud/prevention/3ds) on recurring setup, frictionless tuning (more data = higher frictionless rate) - **Week 4**: Network token conversion for card-on-file (+2-5% lift typical) - **Cumulative potential**: 5-15% improvement. But measure each experiment individually ::: Systematic approach to improving payment authorization rates. Auth rate optimization is a series of experiments, not a checklist. Each change is a hypothesis about what's causing declines. ## Workflow Overview ```mermaid flowchart LR A[WEEK 1Retry Logic] --> B[WEEK 2Card Update] --> C[WEEK 33DS Tuning] --> D[WEEK 4Network Tokens] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Retry Logic** | Baseline assessment, soft decline retry timing, technical retry experiments | | **Card Update** | Account updater enrollment (VAU, ABU), proactive expiration outreach, measure ROI | | **3DS Tuning** | 3DS on recurring setup, frictionless tuning (more data), measure impact | | **Network Tokens** | Convert cards to network tokens, measure lift (+2-5% typical), calculate ROI | ## When to Use This Playbook - Auth rates below industry benchmark (typically 85-95%) - Significant auth rate decline - High rate of soft declines - Customer complaints about payment failures ## First Experiment to Run This Week **Hypothesis:** We don't know which decline codes are actually addressable. **Experiment:** 1. Pull your top 5 decline codes from last 30 days 2. Categorize each as: retry-able, card-updatable, fraud-related, or hard decline 3. Calculate what % of declines are actually addressable **Expected outcome:** You'll know where to focus. Usually 30-50% of declines are addressable with retry logic or card updates. ## Baseline Assessment ``` Current State: โ–ก Overall auth rate: _______% โ–ก Auth rate by card brand: - Visa: _______% - Mastercard: _______% - Amex: _______% โ–ก Auth rate by transaction type: - First purchase: _______% - Recurring: _______% - Card on file: _______% ``` ### Decline Code Categorization | Category | Example Codes | Addressable? | How to Test | |----------|--------------|--------------|-------------| | Insufficient funds | 51, 61, 65 | Yes | Retry with timing experiment | | Card errors | 14, 54, 41, 43 | Yes | Account updater | | Do Not Honor | 05 | Maybe | Multiple approaches | | Technical | 91, 96 | Yes | Immediate retry | | Fraud blocks | 57, 59 | Maybe | Review your fraud rules | ## Week 1: Retry Logic Experiments ### Experiment: Soft Decline Retry Timing **Hypothesis:** Retrying insufficient funds declines at end of month will recover X% of transactions. **Test:** - Segment A: Retry code 51/61 after 24 hours - Segment B: Retry code 51/61 on the 1st and 15th of month - Segment C: No retry (control) **Metrics:** Recovery rate, customer complaints **Run length:** 30 days (need full month for payday cycles) **Guardrail:** Stop if customer complaints about duplicate charges exceed 0.1% ### Experiment: Technical Retry **Hypothesis:** Retrying code 91/96 immediately will recover X%. **Test:** - Retry technical errors once immediately - If fail, retry again after 5 seconds - Max 3 attempts **Metrics:** Recovery rate per retry **Expected:** 50-70% recovery on technical errors ## Week 2: Card Update Experiments ### Experiment: Account Updater ROI **Hypothesis:** Account updater will improve auth rate by X% and is worth the cost. **Test:** 1. Enroll in Visa Account Updater (VAU) and Mastercard ABU 2. Measure: cards updated, auth rate lift on updated cards, cost per update **Decision rule:** If auth rate lift ร— transaction value > cost per update, keep it **Typical results:** 2-5% lift, usually positive ROI for recurring billing ### Experiment: Proactive Expiration Updates **Hypothesis:** Reaching out to customers before card expiration reduces involuntary churn. **Test:** - Segment A: Email customers 30 days before expiration with easy update link - Segment B: No proactive outreach (control) **Metrics:** Card update rate, churn rate, auth rate ## Week 3: 3DS Optimization ### Experiment: 3DS on Recurring Setup **Hypothesis:** Using 3DS on initial recurring transaction will improve subsequent auth rates. **Test:** - Segment A: Require 3DS on initial subscription transaction - Segment B: No 3DS on initial transaction **Metrics:** Initial conversion (expect drop), subsequent recurring auth rate (expect lift) **Decision:** If recurring auth improvement ร— LTV > initial conversion drop ร— AOV, keep it ### Experiment: Frictionless 3DS Tuning **Hypothesis:** Sending more data to 3DS will increase frictionless rate without hurting fraud protection. **Test:** 1. Baseline your current frictionless rate 2. Add additional data fields (device info, customer history, etc.) 3. Measure frictionless rate change **Expected:** 10-20% frictionless rate improvement with more data ## Week 4: Network Tokens ### Experiment: Network Token Conversion **Hypothesis:** Network tokens will improve auth rates on card-on-file transactions. **Test:** - Convert existing saved cards to network tokens (Visa, Mastercard) - Compare auth rates: tokenized vs. PAN **Typical results:** 2-5% improvement **Cost consideration:** Some processors charge per token. Calculate ROI. ## Measurement Framework For each experiment: | Experiment | Hypothesis | Metric | Control | Result | Keep/Kill | |------------|------------|--------|---------|--------|-----------| | Retry timing | +2% recovery | Recovery rate | No retry | ___% | | | Account updater | +3% auth | Auth rate | No updater | ___% | | | 3DS on recurring | +1% recurring auth | Recurring auth | No 3DS | ___% | | | Network tokens | +2% COF auth | COF auth | PAN | ___% | | ## Expected Improvements (Cumulative) | Optimization | Typical Lift | Confidence | |--------------|-------------|------------| | Smart retry | 1-3% | High | | Account updater | 2-5% | High | | Network tokens | 2-5% | Medium | | 3DS optimization | 1-3% | Medium | | Data quality fixes | 0.5-2% | Variable | **Cumulative potential:** 5-15% improvement But measure each one. Yours will vary with your current state, your customer base and your card mix, so don't take the numbers as promises. :::warning[Where Experiments Lie to You] - **Seasonality:** auth rates move with spending patterns. Compare to the same period last year, because last month isn't the control. - **Card mix changes:** If you're acquiring different customer types, your baseline is shifting. - **Processor changes:** if you switched processors, your auth rates moved for that reason and you can't read your optimizations through it. - **Selection bias:** If you only retry "good" looking declines, you'll overestimate retry effectiveness. ::: ## Anti-Pattern: What Not to Do - Don't implement all optimizations at once (can't measure what worked) - Don't retry hard declines (05 codes) aggressively (can get you blocked) - Don't assume vendor claims (test their "2-5% lift" claims yourself) - Don't optimize auth rate at the expense of fraud rate (measure both) ## Next Steps After running optimization experiments: 1. **Keep winners, kill losers**: Document which experiments improved auth rates and make them permanent 2. **Set baselines**: Lock in new auth rate benchmarks for future comparison 3. **Monitor for regression**: Set alerts if auth rate drops below new baseline 4. **Expand to other segments**: Apply winning strategies to international or different card types 5. **Balance with fraud**: Verify fraud rate didn't increase alongside auth improvements --- ## Related - [Payments Metrics](/docs/payments/metrics) - Tracking payment health - [Auth Optimization](/docs/payments/auth-optimization) - Detailed optimization guide - [Decline Codes](/docs/reference/decline-codes) - Understanding decline reasons - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and auth rate impact - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring billing optimization - [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Tokenized payment methods and wallet-based auth lift - [Benchmarks](/docs/reference/benchmarks) - Auth rate targets - [Processor Management](/docs/operations/processor-management) - Working with processors - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Balancing fraud vs. auth - [Card Payments](/docs/payments/payment-methods/cards) - Card type impact on auth rates - [Checkout Conversion](/docs/payments/checkout-conversion) - Conversion optimization - [Payment Change Checklist](/docs/operations/change-checklist) - Testing retry changes --- ## Launch New Country Source: https://paymentsandrisk.com/docs/playbooks/launch-new-country # Playbook: Launch New Country :::info[TL;DR] - Budget 12 weeks. Four research, four setup, two testing, two soft launch. - Local acquiring is the decision that matters. Cross-border costs roughly 1-2% more all in, and it authorizes worse. - Adapt your fraud rules before you launch. Your US rules will over-block or under-protect somewhere else. - Confirm compliance before the first transaction, not after your decline spike. SCA in Europe, KYC everywhere. ::: Opening a new country takes about three months. ## Workflow Overview ```mermaid flowchart LR A[WEEK 1-4Research] --> B[WEEK 4-8Setup] --> C[WEEK 8-10Pre-Launch] --> D[WEEK 10-12+Launch] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Research** | Market assessment, payment landscape, fraud research, regulatory requirements | | **Setup** | Acquiring partner, local methods, fraud rules, compliance setup | | **Pre-Launch** | E2E testing, localize UX, monitoring setup, support ready | | **Launch** | Soft launch %, monitor metrics, full launch, optimize & tune | ## When to Use This Playbook - Launching in a new geographic market. - Adding local payment methods to an existing market. - Setting up local acquiring instead of processing cross-border. - Adapting fraud rules for a region you don't know. ## Phase 1: Research (Week 1-4) ### Market Assessment ``` โ–ก Target country: _____________ โ–ก Expected transaction volume: _____________ โ–ก Primary customer segment: _____________ โ–ก Product/service being offered: _____________ ``` ### Payment Landscape Research ``` โ–ก Dominant payment methods: - Cards: _______% - Local wallets: _______% - Bank transfers: _______% - Other: _______% โ–ก Popular local methods: 1. _____________ 2. _____________ 3. _____________ โ–ก Card network prevalence: - Visa: _______% - Mastercard: _______% - Local networks: _____________ ``` ### Fraud Landscape Research ``` โ–ก Common fraud types in market โ–ก Local fraud trends โ–ก Average fraud rate for segment โ–ก Required fraud prevention measures โ–ก Local verification challenges ``` ### Regulatory Requirements ``` โ–ก Payment licensing requirements โ–ก Data localization requirements โ–ก Consumer protection laws โ–ก Chargeback/dispute regulations โ–ก Privacy/GDPR equivalent โ–ก Tax obligations ``` ## Phase 2: Setup (Week 4-8) ### Payment Infrastructure ``` โ–ก Select acquiring partner(s) โ–ก Set up local currency processing โ–ก Implement local payment methods โ–ก Configure currency conversion (if needed) โ–ก Set up settlement accounts โ–ก Test payment flows ``` ### Fraud & Risk Infrastructure ``` โ–ก Adapt fraud rules for market โ–ก Set up local data sources: - Address verification - Phone verification - ID verification - Device intelligence coverage โ–ก Configure risk thresholds โ–ก Set up manual review for launch ``` ### Compliance Setup ``` โ–ก Legal entity (if required) โ–ก Local data storage (if required) โ–ก Privacy policy updates โ–ก Terms of service localization โ–ก Consumer notices โ–ก Tax registration ``` ## Phase 3: Pre-Launch (Week 8-10) ### Testing ``` โ–ก End-to-end payment testing โ–ก All payment method testing โ–ก Refund/chargeback flow testing โ–ก Fraud rule testing (synthetic data) โ–ก Customer support flow testing โ–ก Reporting/reconciliation testing ``` ### Localization ``` โ–ก Currency display โ–ก Language support โ–ก Local customer support hours โ–ก Localized error messages โ–ก Local payment method UX โ–ก Descriptor localization ``` ### Monitoring Setup ``` โ–ก Payment success rate dashboards โ–ก Fraud rate monitoring โ–ก Chargeback tracking โ–ก Currency reconciliation โ–ก Alerting for anomalies ``` ## Phase 4: Soft Launch (Week 10-12) ### Limited Rollout ``` โ–ก Launch to limited audience (%) โ–ก Monitor key metrics closely: - Auth rate target: _______% - Fraud rate cap: _______% - Chargeback rate cap: _______% โ–ก Daily review cadence โ–ก Quick escalation path for issues ``` ### Early Adjustments ``` โ–ก Tune fraud rules based on data โ–ก Adjust risk thresholds โ–ก Fix UX issues โ–ก Address customer feedback โ–ก Optimize payment routing ``` ## Phase 5: Full Launch (Week 12+) ### Ramp Up ``` โ–ก Gradual increase in traffic โ–ก Monitor performance at scale โ–ก Capacity check on manual review โ–ก Customer support scaling ``` ### Optimization ``` โ–ก Auth rate optimization โ–ก Fraud rule tuning โ–ก Local payment method optimization โ–ก Cost optimization (routing, FX) ``` ## Country-Specific Considerations ### Europe (SEPA Region) ``` โ–ก PSD2/SCA compliance โ–ก GDPR compliance โ–ก SEPA Direct Debit consideration โ–ก Local wallet adoption (varies by country) โ–ก Strong authentication requirements ``` ### UK ``` โ–ก FCA considerations โ–ก Open Banking opportunities โ–ก Post-Brexit regulatory changes โ–ก High card penetration ``` ### Latin America ``` โ–ก High fraud rates (Brazil especially) โ–ก Local card networks (Elo, Hipercard) โ–ก Installment payments (parcelado) โ–ก Boleto (Brazil), OXXO (Mexico) โ–ก CPF/tax ID verification ``` ### Asia Pacific ``` โ–ก Mobile wallet dominance (varies) โ–ก Local networks (JCB Japan, UnionPay China) โ–ก QR code payments โ–ก Regulatory complexity (varies widely) โ–ก Data localization (varies) ``` ## Launch Checklist Summary ### Legal/Compliance ``` โ–ก Licensing requirements met โ–ก Data requirements addressed โ–ก Consumer protections in place โ–ก Tax obligations understood ``` ### Payments ``` โ–ก Acquiring relationship established โ–ก Payment methods integrated โ–ก Settlement process confirmed โ–ก FX strategy defined ``` ### Risk ``` โ–ก Fraud rules adapted โ–ก Verification coverage confirmed โ–ก Manual review capacity ready โ–ก Monitoring in place ``` ### Operations ``` โ–ก Customer support ready โ–ก Localization complete โ–ก Testing complete โ–ก Runbooks documented ``` ## Next Steps After launch: 1. **Fix the payment mix**: Find what converts locally. Push those. 2. **Tune fraud rules**: Your US baseline won't fit this market's data. 3. **Review costs**: Check FX and acquiring, then renegotiate at volume. 4. **Plan the next market**: Reuse what worked and skip what didn't. 5. **Build local contacts**: You'll want someone to call when things break. --- ## Related Topics - [Payments Overview](/docs/payments) - Payment fundamentals - [Fraud Prevention](/docs/fraud/prevention) - Prevention strategies - [Compliance](/docs/compliance) - Regulatory requirements - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Cross-border costs - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - Local payment methods - [3D Secure](/docs/fraud/prevention/3ds) - SCA and authentication - [Processor Management](/docs/operations/processor-management) - Acquiring relationships - [Network Rules](/docs/compliance/network-rules) - Regional network requirements - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Regional fraud patterns - [Fraud Metrics](/docs/fraud/metrics) - Market-specific baselines - [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) - Adding new processors - [Going Global](/docs/payments/going-global) - International payments guide --- ## Onboard Digital Wallets Source: https://paymentsandrisk.com/docs/playbooks/onboard-digital-wallets # Onboard Digital Wallets (Playbook) :::info[TL;DR] - Apple Pay and Google Pay should be your first payment optimization project. 50%+ lower fraud, 3-5% higher auth rates, and it doesn't change your processing cost - Most processors (Stripe, Braintree, Adyen) have wallet support built in - enabling it takes hours, not weeks, if you're already on their platform - Apple Pay requires domain verification and an Apple Pay merchant identifier. Google Pay is a lighter setup, but don't launch it without testing on a real Android device - Watch the wallet payment mix after launch. Adoption usually climbs to 20-40% of mobile transactions inside 30-60 days, and if yours doesn't, button placement is why ::: Apple Pay and Google Pay transactions see 50%+ lower fraud and 3-5% higher auth rates than raw card entry. If you're not accepting them, you're leaving money on the table. This playbook gets you live in 2-4 weeks. _Timeline: 2-4 weeks, or faster if there's a dashboard toggle at your processor._ ## Workflow Overview ```mermaid flowchart LR A[WEEK 1Processor Setup] --> B[WEEK 2Integration] --> C[WEEK 3Testing] --> D[WEEK 4Launch] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Processor Setup** | Confirm wallet support, Apple Pay Merchant ID, Google Pay console access | | **Integration** | Hosted or custom checkout, Apple Pay + Google Pay code | | **Testing** | Test matrix (iOS, Android, desktop), all devices, refund flows | | **Launch** | Enable production, track metrics (auth, fraud, conversion), optimize placement | You'll need a processor account that supports digital wallets, access to your gateway dashboard, an Apple Developer account for Apple Pay, Google Pay Business Console access for Google Pay, and either developer time or a gateway that handles the integration for you. ## Trigger Criteria Use this playbook when: - You don't accept Apple Pay or Google Pay - Mobile conversion is below desktop - Auth rates on mobile are lagging - You want to reduce CNP fraud without adding friction --- ## Week 1: Processor Setup ### Step 1: Confirm Processor Support | Processor | Apple Pay | Google Pay | Notes | |-----------|-----------|------------|-------| | Stripe | Native | Native | Just enable in dashboard | | Braintree | Native | Native | Minimal config needed | | Adyen | Native | Native | Enable per merchant account | | Worldpay | Supported | Supported | May need separate enrollment | | First Data | Supported | Supported | Check terminal compatibility | **Checkpoint:** Processor confirms wallet support is enabled on your account. ### Step 2: Apple Pay Merchant ID 1. Log into Apple Developer account 2. Create Merchant ID (Certificates, Identifiers & Profiles) 3. Generate Payment Processing Certificate 4. Upload certificate to processor/gateway 5. Domain verification (add file to /.well-known/) **Checkpoint:** Apple Pay Merchant ID active, domain verified. ### Step 3: Google Pay Setup 1. Register in Google Pay Business Console 2. Request production access 3. Configure merchant info (name, country) 4. No certificate required (easier than Apple Pay) **Checkpoint:** Google Pay production access approved. --- ## Week 2: Integration ### For Hosted Checkouts (Stripe Checkout, PayPal, etc.) Most hosted checkouts auto-enable wallets. Verify: 1. Check your checkout config 2. Enable Apple Pay / Google Pay toggles 3. Test on iOS (Apple Pay) and Android (Google Pay) **Checkpoint:** Wallet buttons appear on mobile checkout. ### For Custom Checkout If you're building a custom checkout (not using hosted checkout), your developer will need to: #### Apple Pay Integration 1. Check if Apple Pay is available on the customer's device 2. Show the Apple Pay button only when supported 3. Configure supported networks (Visa, Mastercard, Amex) 4. Handle the payment response and send to your processor **What to tell your developer:** "Use the Apple Pay JS API. Our processor has documentation and test cards." #### Google Pay Integration 1. Initialize the Google Pay client for production 2. Check if Google Pay is ready to pay 3. Configure allowed card networks and auth methods 4. Connect to your payment gateway for tokenization **What to tell your developer:** "Use the Google Pay API. Configure it with our processor's gateway ID." **Checkpoint:** Wallet buttons appear; test transactions succeed in sandbox. --- ## Week 3: Testing ### Test Matrix | Scenario | Apple Pay | Google Pay | |----------|-----------|------------| | Safari iOS | Test | N/A | | Chrome iOS | N/A | Test | | Safari macOS (Touch ID) | Test | N/A | | Chrome Android | N/A | Test | | Chrome Desktop (with phone) | N/A | Test | ### Test Cases - [ ] Successful payment on iOS device - [ ] Successful payment on Android device - [ ] Payment with saved card in wallet - [ ] Refund processes correctly - [ ] Wallet shows in transaction details - [ ] Auth rate tracking captures wallet type **Checkpoint:** All test cases pass in production with real cards. --- ## Week 4: Launch and Monitor ### Step 1: Enable in Production 1. Remove feature flags / enable for all users 2. Ensure buttons appear on mobile and desktop (where supported) 3. Monitor error logs for first 24 hours ### Step 2: Track Metrics Set up reporting to compare: | Metric | Card Entry | Apple Pay | Google Pay | |--------|------------|-----------|------------| | Auth rate | Baseline | Target +3-5% | Target +3-5% | | Fraud rate | Baseline | Target -50% | Target -50% | | Checkout conversion | Baseline | Target +5-10% | Target +5-10% | ### Step 3: Optimize Placement Best practices for wallet buttons: - Above the fold on checkout - Before card entry form (not hidden below) - Equal visual weight to card option - On product pages for express checkout (optional) **Checkpoint:** Wallets live in production; metrics tracking enabled. --- ## Success Criteria You're done when: - [ ] Apple Pay and Google Pay both accepting live transactions - [ ] Metrics show auth rate improvement vs card entry - [ ] Mobile conversion stable or improved - [ ] No increase in support tickets --- ## Scale Callout | Volume | Considerations | |--------|----------------| | **Under $100k/mo** | Hosted checkout with wallet support is fastest path; prioritize this over custom integration | | **$100k-$1M/mo** | Track wallet adoption rate; A/B test button placement; ensure both iOS and Android covered | | **Over $1M/mo** | Wallet-specific auth analysis; push wallets in marketing; consider express checkout on PDPs | --- ## Where This Breaks - **Processor doesn't support wallets.** Switch processors or use third-party tokenization. - **Apple domain verification fails.** Check .well-known file is accessible; no redirects. - **Low adoption after launch.** That's usually button placement. A/B test position and size. - **Auth rate same as cards.** The improvement varies, and it's still worth it for the fraud reduction. - **Desktop Safari users confused.** Requires Touch ID Mac or iPhone nearby; consider tooltip. --- ## Next Steps After wallets are live: 1. **Track adoption rate**: What % of customers use wallets? Set targets for growth 2. **A/B test placement**: Experiment with button position and size to drive adoption 3. **Add express checkout**: Consider wallet buttons on product pages for one-click purchase 4. **Measure fraud impact**: Compare fraud rates between wallet and card-entry transactions 5. **Enable PayPal/Venmo**: If not already, consider additional wallet options --- ## Related - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Tokenized payments security - [Benchmarks](/docs/reference/benchmarks) - Industry wallet adoption - [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Wallet fundamentals - [Checkout Conversion](/docs/payments/checkout-conversion) - Conversion optimization - [Fraud Prevention](/docs/fraud/prevention) - Wallet fraud reduction - [Increase Auth Rates](/docs/playbooks/increase-auth-rates) - Auth optimization playbook - [Processor Management](/docs/operations/processor-management) - Processor wallet support - [3D Secure](/docs/fraud/prevention/3ds) - Authentication interaction - [Cards](/docs/payments/payment-methods/cards) - Card network fundamentals - [Payments Metrics](/docs/payments/metrics) - Tracking wallet performance - [Payment Change Checklist](/docs/operations/change-checklist) - Testing wallet integration --- ## Processor Switch Checklist Source: https://paymentsandrisk.com/docs/playbooks/processor-switch-checklist # Processor Switch Checklist (Playbook) :::info[TL;DR] - Processor migrations take 4-8 weeks minimum; complex token migrations with large card-on-file databases take 12+ weeks - don't underestimate the timeline - Token portability is the make-or-break factor. Confirm your current processor will export tokens and the new one can import them before you sign anything, because you can't fix it after - Run both processors in parallel for 2-4 weeks instead of a hard cutover. Route a percentage of traffic to the new one first, so integration issues don't land on all your revenue at once - Recurring billing is the highest-risk part. Test every subscription scenario (new charges, retries, cancellations) before you touch your existing subscriber base, and don't migrate it in one go ::: Switching processors is high-stakes: mess up the migration and you'll lose recurring revenue, break checkout, or spend a quarter on reconciliation. This one's about not doing that. _Timeline: 4-8 weeks minimum, and complex migrations take 12+ weeks._ ## Workflow Overview ```mermaid flowchart LR A[WEEK 1-2Discovery] --> B[WEEK 2-4Integration] --> C[WEEK 3-6Token Migration] --> D[WEEK 5-8Execution] --> E[WEEK 6-10Cleanup] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#ef4444,color:#fff style E fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Discovery** | Inventory current processor, map features to new, define token strategy | | **Integration** | Build parallel integration, test matrix (auth, capture, refund, void), all flows | | **Token Migration** | Export strategy, import tokens, validate mapping, cutover planning | | **Execution** | Ramp 10% โ†’ 25% โ†’ 50% โ†’ 100%, monitor auth rate, migrate recurring billing | | **Cleanup** | Sunset old processor, update docs, post-migration review | Line up four things before Phase 1: the signed contract with the new processor, a live account and test credentials, your current processor's policy on exporting token and card data, and engineering time booked. The third one decides the other three. If your current processor won't put its token export policy in writing before you sign, you aren't planning a migration, you're planning a re-collection project. Find that out now, not in week three. ## Trigger Criteria Use this playbook when: - You're migrating to a new payment processor - You're adding a backup processor - You're consolidating from multiple processors to one - Current processor relationship is ending The real cost here is 4-8 weeks of engineering time that isn't going into your product. Weigh the reason against that before Phase 1. Abandon it in week five and you're running two half-built integrations. That's worse than the processor you were unhappy with. --- ## Phase 1: Discovery (Week 1-2) ### Step 1: Inventory Current State Document everything about current processor: | Item | Document | |------|----------| | **Transaction types** | One-time, recurring, auth+capture, etc. | | **Payment methods** | Cards, ACH, wallets, local methods | | **Token format** | Vault structure, token format | | **Recurring billing** | Subscription count, billing frequency | | **Stored credentials** | How many cards on file | | **MIDs** | All merchant IDs, per-MID config | | **Reporting** | Settlement, reconciliation, disputes | | **Integrations** | APIs, webhooks, SDKs in use | ### Step 2: Map to New Processor | Feature | Current | New Processor | Gap? | |---------|---------|---------------|------| | Card vault | Yes/No | Yes/No | | | Network tokens | Yes/No | Yes/No | | | 3DS | Version | Version | | | ACH | Yes/No | Yes/No | | | Apple/Google Pay | Yes/No | Yes/No | | | Reporting format | Format | Format | | **Checkpoint:** Feature parity confirmed or gaps documented with workarounds. ### Step 3: Token Migration Strategy | Scenario | Approach | |----------|----------| | **Processor supports token migration** | Export tokens, import to new processor | | **No direct migration** | Use network tokens (Visa/MC token services) | | **Neither works** | Re-collect cards at next transaction | | **Account updater available** | May help with expired cards during transition | **Critical question:** Can you export raw PANs or tokens that the new processor accepts? --- ## Phase 2: Integration (Week 2-4) ### Step 1: Build New Integration Parallel integration approach: ```mermaid flowchart TD A[Your Checkout] --> B[Payment Router] B --> C[Old Processorcurrent] B --> D[New Processortesting] style A fill:#3b82f6,color:#fff style B fill:#6b7280,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` ### Step 2: Integration Checklist - [ ] Auth request/response handling - [ ] Capture flow - [ ] Refund flow - [ ] Void flow - [ ] Partial capture (if used) - [ ] 3DS integration - [ ] AVS/CVV handling - [ ] Error handling and retries - [ ] Webhook receivers - [ ] Tokenization flow - [ ] Recurring billing integration ### Step 3: Test Matrix | Test Case | Status | |-----------|--------| | Successful card auth | | | Declined card (various codes) | | | 3DS challenge flow | | | 3DS frictionless flow | | | Auth + capture | | | Auth + void | | | Auth + partial capture | | | Refund (full) | | | Refund (partial) | | | Recurring billing (create) | | | Recurring billing (charge) | | | Recurring billing (update) | | | Apple Pay | | | Google Pay | | **Checkpoint:** All test cases passing in sandbox. --- ## Phase 3: Token Migration (Week 3-5) ### Option A: Processor-to-Processor Migration If new processor accepts imported tokens: 1. Request token export from current processor 2. Transform token format if needed 3. Import tokens to new processor vault 4. Map old token IDs to new token IDs 5. Update your database with new token references 6. Validate sample of migrated tokens ### Option B: Network Token Migration Using Visa/Mastercard network tokenization: 1. Ensure both processors support network tokens 2. Export network tokens (DPAN + cryptograms) from old processor 3. Register network tokens with new processor 4. Network tokens work across processors ### Option C: Gradual Re-collection If migration not possible: 1. Keep old processor active for existing tokens 2. New customers go to new processor 3. At next transaction, existing customers re-enter card 4. Migrate stored credential to new processor 5. Eventually sunset old processor Rank these A, then B, then C. Option C isn't a strategy, it's attrition on a delay. Every re-entry is a chance for the customer to cancel. **Checkpoint:** Migration approach chosen and tested with sample data. --- ## Phase 4: Cutover Planning (Week 4-6) ### Step 1: Define Cutover Strategy | Strategy | Pros | Cons | |----------|------|------| | **Big bang** | Clean cutover | High risk | | **Percentage ramp** | Lower risk | Longer timeline | | **New customers only** | Lowest risk | Two systems forever | | **By segment** | Targeted migration | Complexity | **Recommendation:** Percentage ramp (10% โ†’ 25% โ†’ 50% โ†’ 100%) Ramp, for almost everyone. A broken integration then lands on a tenth of your revenue instead of all of it. Under $100k a month, big-bang it and go do something else, because at that size the ramp costs more in project management than it saves in risk. The one to avoid is new customers only. It reads as the safe option. It commits you to two integrations, two reconciliations and two support runbooks forever. ### Step 2: Create Rollback Plan Define criteria and process: | Trigger | Action | |---------|--------| | Auth rate drops 5%+ vs baseline | Pause ramp, investigate | | Error rate over 1% | Route back to old processor | | New processor outage | Automatic failover to old | | Dispute rate spikes | Investigate before proceeding | ### Step 3: Communication Plan | Stakeholder | What to Communicate | When | |-------------|--------------------|----| | Customer support | New error codes, escalation path | 1 week before | | Finance | New settlement schedule, reconciliation changes | 2 weeks before | | Engineering | On-call schedule, rollback procedures | 1 week before | | Customers | Only if checkout UX changes significantly | Optional | --- ## Phase 5: Migration Execution (Week 5-8) ### Step 1: Initial Ramp (10%) 1. Route 10% of new transactions to new processor 2. Monitor for 3-5 days minimum 3. Check: - Auth rate vs baseline - Error rate - Customer complaints - Settlement accuracy ### Step 2: Expand Ramp (25% โ†’ 50% โ†’ 75%) At each stage: 1. Increase traffic percentage 2. Monitor for 2-3 days 3. Verify metrics stable 4. Proceed or troubleshoot ### Step 3: Full Cutover (100%) 1. Route 100% to new processor 2. Keep old processor available for fallback 3. Monitor closely for 1 week 4. Begin old processor sunset planning ### Step 4: Recurring Billing Migration Handle separately from one-time payments, and only after one-time traffic has held at 100% for a full week: 1. Identify all active subscriptions 2. Migrate tokens (per Phase 3 approach) 3. Update subscription records with new tokens 4. Test billing on subset of subscriptions 5. Run first full billing cycle with monitoring 6. Validate all charges succeeded This is the highest-risk step in the whole migration. Give it its own week and its own rollback. If a billing cycle goes wrong you want exactly one variable to look at, and you want the old processor still standing. Don't batch it. **Checkpoint:** All traffic on new processor, metrics stable. --- ## Phase 6: Cleanup (Week 6-10) ### Step 1: Sunset Old Processor 1. Confirm no active traffic to old processor 2. Resolve any pending transactions/settlements 3. Download historical data for records 4. Cancel old processor contract (if applicable) 5. Remove old processor code paths (after stabilization) ### Step 2: Update Documentation - [ ] Internal runbooks updated - [ ] Dispute handling procedures updated - [ ] Reconciliation processes updated - [ ] Alert thresholds calibrated for new processor ### Step 3: Post-Migration Review | Question | Answer | |----------|--------| | Auth rate vs pre-migration? | | | Any lost recurring customers? | | | Settlement timing acceptable? | | | Support ticket volume? | | | Lessons for next migration? | | --- ## Success Criteria You're done when: - [ ] 100% of traffic on new processor - [ ] Auth rate within 0.5% of pre-migration baseline - [ ] All recurring billing functioning - [ ] Reconciliation process working - [ ] Old processor dependencies removed The auth rate line is the one that gets waved through. A migration that settles outside that 0.5% band isn't finished, it's a revenue cut you agreed to on a call and then stopped measuring. Compare declines at BIN level and close the gap, or route back. --- ## Scale Callout | Volume | Considerations | |--------|----------------| | **Under $100k/mo** | Can often do big-bang cutover; simpler token migration | | **$100k-$1M/mo** | Percentage ramp recommended; test recurring billing carefully | | **Over $1M/mo** | Dedicated migration team; extended parallel running; fallback essential | --- ## Where This Breaks - **Token migration fails.** Test migration on small sample first. Have re-collection fallback. - **Auth rate tanks.** The new processor doesn't have the same issuer relationships. Compare at BIN level before you commit. - **Recurring billing broken.** Test billing flow end-to-end before migrating subscriptions. - **Settlement reconciliation off.** Different settlement timing/format. Update finance processes. - **Old processor shuts down early.** Get the timeline in writing, and keep them live longer than you think you'll need. - **No rollback tested.** Test failover before you need it. Don't assume it works. --- ## Critical Metrics to Track | Metric | Pre-Migration | During Ramp | Post-Migration | |--------|---------------|-------------|----------------| | Auth rate | Baseline | Daily | Weekly | | Error rate | Baseline | Hourly | Daily | | Decline codes | Distribution | Daily | Weekly | | Settlement lag | Baseline | Daily | Weekly | | Dispute rate | Baseline | Weekly | Monthly | --- ## Next Steps After migration is complete: 1. **Optimize on new processor**: Run [auth optimization experiments](/docs/playbooks/increase-auth-rates) now that you have fresh baseline 2. **Clean up old code**: Remove old processor integration after 30-day stability period 3. **Update documentation**: Runbooks, escalation contacts, API references 4. **Renegotiate terms**: At 6-month mark, review volume and negotiate better rates 5. **Plan redundancy**: Consider keeping a backup processor relationship for failover --- ## Related - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Processor Reporting Checklist](/docs/reference/processor-reporting-checklist) - Data requirements - [Settlement & Reconciliation](/docs/payments/settlement) - Post-capture operations - [Benchmarks](/docs/reference/benchmarks) - Auth rate targets - [Processor Management](/docs/operations/processor-management) - Working with processors - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Migrating recurring billing - [3D Secure](/docs/fraud/prevention/3ds) - Authentication integration - [Decline Codes](/docs/reference/decline-codes) - Understanding declines - [Holds and Reserves](/docs/operations/holds-and-reserves) - Processor reserves - [Payment Change Checklist](/docs/operations/change-checklist) - Testing changes - [Reading Statements](/docs/operations/reading-statements) - Understanding processor costs - [Buying Payments](/docs/payments/buying-payments) - Processor selection criteria {JSON.stringify({"@context":"https://schema.org","@type":"HowTo","name":"How to Switch Payment Processors Without Breaking Anything","description":"A 4-8 week checklist for migrating payment processors covering discovery, integration, token migration, percentage-based cutover, and cleanup.","totalTime":"P56D","step":[{"@type":"HowToStep","name":"Phase 1: Discovery (Week 1-2)","text":"Inventory your current processor setup - transaction types, payment methods, token format, recurring billing, stored credentials, MIDs, reporting, and integrations. Map each feature to the new processor and document any gaps. Decide on a token migration strategy: processor-to-processor export, network tokens, or gradual re-collection at next transaction."},{"@type":"HowToStep","name":"Phase 2: Integration (Week 2-4)","text":"Build a parallel integration with a payment router that can send traffic to both processors. Complete the integration checklist: auth, capture, refund, void, 3DS, AVS/CVV, webhooks, tokenization, and recurring billing. Run the full test matrix in sandbox covering successful auths, declines, 3DS flows, partial captures, refunds, and wallet payments."},{"@type":"HowToStep","name":"Phase 3: Token Migration (Week 3-5)","text":"If the new processor accepts imported tokens, export from the current processor, transform format if needed, import to the new vault, and map old token IDs to new ones. Alternatively, use Visa/Mastercard network tokens that work across processors, or keep the old processor active and re-collect cards gradually at the next transaction."},{"@type":"HowToStep","name":"Phase 4: Cutover Execution (Week 5-8)","text":"Ramp traffic using a percentage approach: 10% for 3-5 days, then 25%, 50%, 75%, and finally 100%. At each stage, monitor auth rate vs. baseline, error rate, customer complaints, and settlement accuracy. Migrate recurring billing separately - test billing flow end-to-end before migrating your full subscriber base. Define rollback triggers: pause if auth rate drops 5%+ or error rate exceeds 1%."},{"@type":"HowToStep","name":"Phase 5: Cleanup (Week 6-10)","text":"Confirm no active traffic to the old processor. Resolve pending transactions and settlements, download historical data, and cancel the old contract. Update internal runbooks, dispute handling procedures, and reconciliation processes. Run a post-migration review comparing auth rate, recurring customer retention, settlement timing, and support ticket volume."}]})} --- ## Reduce Chargebacks Fast Source: https://paymentsandrisk.com/docs/playbooks/reduce-chargebacks-fast # Playbook: Reduce Chargebacks Fast :::info[TL;DR] - **Week 1**: Talk to 10 customers who disputed. Understand the root cause before fixing anything - **Week 2**: Test ONE hypothesis (descriptor? shipping? subscription confusion? fraud?) - **Week 3-4**: Deploy [alert services](/docs/chargebacks/prevention/alerts) (Verifi, Ethoca), measure results - **Emergency**: Proactively refund questionable orders, restrict high-risk products, manual review - **Exit criteria**: Under 0.9% for 3 consecutive months (processor safety zone), under 1.5% AND under 100 chargebacks (Mastercard ECM) ::: :::info[This Playbook vs. Zero Point Nine Panic] **This playbook** is a structured 4-week process: diagnose root cause, test one fix at a time, measure results. **[Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic)** is hour-by-hour triage for when you need to act today. If you're in immediate crisis, start there, then come back here for the sustained fix. ::: Rapid chargeback reduction when approaching network thresholds. Throwing tools at chargebacks without understanding the cause is expensive guessing. This playbook is structured as hypothesis-test-learn, not a checklist to blindly follow. ## Workflow Overview ```mermaid flowchart LR A[WEEK 1Understand] --> B[WEEK 2Quick Wins] --> C[WEEK 3-4Deploy Alerts] --> D[ONGOINGMeasure] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Understand** | Talk to 10 customers who disputed, classify disputes by root cause | | **Quick Wins** | Pick ONE hypothesis, set success metric, run test | | **Deploy Alerts** | Enroll in Verifi/Ethoca, test alert workflow | | **Measure** | Check if fix worked, expand or kill based on data | ## When to Use This Playbook - Chargeback ratio approaching 0.9% (processor danger zone) or 1.5% (Mastercard ECM) - Already in a monitoring program - Received network warning letter - Significant month-over-month increase ## First: Understand Why Before you do anything else, talk to 10 customers who disputed. **Questions to ask (fact-seeking, not opinion-seeking):** - "What were you trying to do when you made this purchase?" - "What did you expect to see on your statement?" - "What did you do when you first noticed the problem?" - "Did you contact us before disputing?" **What you'll learn:** - Descriptor confusion (they didn't recognize the charge) - Shipping problems (never arrived, took too long) - Product issues (not as described, defective) - Subscription confusion (forgot they signed up, couldn't cancel) - Actual fraud (they really didn't make the purchase) - Friendly fraud (they did make it, they're lying) 5-10 conversations will tell you whether you have a representment problem or a root cause problem. Usually it's root cause. ## Current Situation Assessment ``` Current Month: โ–ก Transaction count: _______ โ–ก Chargeback count: _______ โ–ก Chargeback ratio: _______% Top 3 Reason Codes: 1. _______ (count: ___) 2. _______ (count: ___) 3. _______ (count: ___) Hypothesis: We think the main driver is _____________ because _____________. ``` ## Week 1: Quick Wins (Test One Thing) Pick ONE hypothesis from your customer conversations and test it. ### If It's Descriptor Confusion **Hypothesis:** Customers don't recognize our billing name. **Test:** Update descriptor to match your brand + add phone number. **Metric:** Track "I don't recognize this charge" support contacts over 2 weeks. **Expected result:** 20-30% reduction in recognition-related disputes. ### If It's Shipping Problems **Hypothesis:** Customers dispute because they think it never arrived. **Test:** Add proactive tracking emails (shipped, in transit, delivered). **Metric:** Track 13.1/4855 "not received" chargebacks over 30 days. **Expected result:** 30-50% reduction in not-received disputes. ### If It's Subscription Confusion **Hypothesis:** Customers forget they subscribed or can't cancel. **Test:** Send clearer renewal notices 7 days before charge + simplify cancellation to under 3 clicks. **Metric:** Track 13.2/4853 "cancelled recurring" chargebacks over 30 days. **Expected result:** 40-60% reduction in subscription disputes. ### If It's Actual Fraud **Hypothesis:** We're approving too many fraudulent transactions. **Test:** Enable 3DS on orders over $200 from new customers. **Metric:** Track 10.4/4837 fraud chargebacks AND auth rate over 2 weeks. **Guardrail:** Auth rate can't drop more than 5%. **Expected result:** 30-50% reduction in fraud chargebacks on that segment. ## Week 2: Deploy Alerts Enroll in network alert programs to stop disputes before they become chargebacks: ``` โ–ก Visa Verifi (formerly VROL/RDR) โ–ก Mastercard: Ethoca alerts, and Collaboration inside Mastercom (different things) โ–ก Verify alert response workflow โ–ก Test that someone works the alerts inside the SLA ``` Alerts are a tax on bad customer experience. They buy you time, but the root cause still needs fixing. ## Week 3-4: Measure and Iterate ### Did Your Hypothesis Hold? | Hypothesis | Expected Result | Actual Result | Next Step | |------------|-----------------|---------------|-----------| | Descriptor confusion | -20% recognition issues | ___% | Keep / Adjust / Kill | | Shipping problems | -30% not-received | ___% | Keep / Adjust / Kill | | Subscription confusion | -40% cancelled recurring | ___% | Keep / Adjust / Kill | | Actual fraud | -30% fraud CB | ___% | Keep / Adjust / Kill | ### If It Didn't Work - Was your sample size large enough? (Need 30+ days for CB data) - Was your hypothesis wrong? (Talk to more customers) - Did you test the wrong segment? (Try different population) - Did something else change? (Isolate variables) ### If It Worked - Can you expand the change? - What's the next biggest driver? - Document what worked for future reference ## Emergency Measures If threshold is imminent and you need to buy time: ``` โ–ก Proactively refund anything questionable (cheaper than CB + fee) โ–ก Temporarily restrict high-risk product categories โ–ก Manual review ALL orders (temporary, not sustainable) โ–ก Contact network rep to discuss situation ``` :::warning[These Are Band-Aids] Emergency measures buy time. They don't fix root causes. If you're still doing manual review on all orders after 30 days, you haven't solved the problem. ::: ## Chargeback Ratio Math Understand the denominator: ``` Ratio = Chargebacks (current month) / Transactions (prior month*) *Network-specific timing - verify with your processor ``` **Reducing the numerator:** - Prevent chargebacks (fraud controls, better CX) - Deflect to refunds (alerts, customer service) - Resolve disputes pre-chargeback **Managing the denominator:** - Maintain transaction volume - Don't artificially inflate with low-value transactions (networks notice) ## Exit Criteria ### Visa Safe Zone (Processor Level) ``` โ–ก Below 0.9% for 3 consecutive months (processor danger zone) โ–ก AND below 100 chargebacks per month ``` ### Mastercard ECM Exit ``` โ–ก Below 1.5% AND below 100 chargebacks for 3 consecutive months ``` ## Post-Crisis: What to Keep Every chargeback crisis is an expensive lesson. Don't waste it. **Document:** - What was the root cause? - What test worked? - What should you keep doing? - What would have caught this earlier? **Permanent changes:** - If descriptor change worked, keep it - If alerts are deflecting disputes, keep them - If 3DS on high-risk worked, keep it - If proactive shipping emails worked, keep them ## First Experiment to Run This Week If you're reading this and your ratio is above 0.7%: **Hypothesis:** We don't actually know why customers are disputing. **Experiment:** Call 5 customers who disputed in the last 30 days. Ask what happened. **Time:** 2 hours **Expected outcome:** You'll know whether you have a fraud problem, a CX problem, or a product problem. Then you can pick the right fix. ## Next Steps **Crisis under control?** 1. [Chargeback Metrics](/docs/chargebacks/metrics) - Set up ongoing monitoring 2. [Prevention Overview](/docs/chargebacks/prevention) - Long-term prevention strategy 3. [Alert Services](/docs/chargebacks/prevention/alerts) - Optimize your alert setup **Still in trouble?** 1. [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Emergency actions 2. [Network Programs](/docs/chargebacks/reference/network-programs) - Understand the monitoring program 3. [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Win more fights **Need to understand why?** 1. [Friendly Fraud](/docs/fraud/types/friendly-fraud) - When customers lie 2. [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms) - Fix recognition issues --- ## Related - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking your ratios - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Understanding dispute flow - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party dispute abuse - [Third-Party Fraud](/docs/fraud/types/third-party) - Stolen card fraud - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM details - [Network Thresholds](/docs/compliance/network-rules/dispute-monitoring) - Compliance programs - [Representment](/docs/chargebacks/representment) - Fighting disputes - [Chargeback Vendors](/docs/chargebacks/vendors) - Prevention tools - [3D Secure](/docs/fraud/prevention/3ds) - Fraud authentication - [Refund Strategy](/docs/chargebacks/refund-strategy) - When to refund vs. fight - [Processor Management](/docs/operations/processor-management) - Handling processor warnings - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Documentation requirements :::tip[Want to understand why this happened?] This playbook fixes the immediate crisis. To understand the root causes and build lasting prevention, **[start The Guide from the beginning](/docs/learning-pathways/getting-started-with-payments/introduction)**, 15 lessons covering payments, chargebacks, fraud prevention, operations, and cost optimization. ::: {JSON.stringify({"@context":"https://schema.org","@type":"HowTo","name":"How to Reduce Chargebacks Fast","description":"A 4-week hypothesis-driven playbook to reduce chargebacks below the 0.9% processor danger zone.","totalTime":"P28D","step":[{"@type":"HowToStep","name":"Week 1: Understand the Root Cause","text":"Talk to 10 customers who disputed. Classify disputes by root cause: descriptor confusion, shipping problems, product issues, subscription confusion, or true fraud. Do not fix anything yet."},{"@type":"HowToStep","name":"Week 2: Test One Quick Win","text":"Pick ONE hypothesis based on your root cause analysis. Set a success metric and run the test. Common fixes: update billing descriptor, add shipping notifications, improve cancellation flow, or tighten fraud rules."},{"@type":"HowToStep","name":"Week 3-4: Deploy Alert Services","text":"Enroll in Verifi RDR (Visa automated resolution) and Ethoca alerts (Mastercard global). Configure auto-refund rules for clear-cut cases. Expected result: 20-40% chargeback reduction."},{"@type":"HowToStep","name":"Ongoing: Measure and Iterate","text":"Track chargeback ratio weekly. Exit criteria: under 0.9% for 3 consecutive months. If the first fix did not work, kill it and test the next hypothesis."}]})} --- ## Set Up Dispute Alerts Source: https://paymentsandrisk.com/docs/playbooks/setup-dispute-alerts # Set Up Dispute Alerts (Playbook) :::info[TL;DR] - **Week 1**: Enroll with Ethoca (Mastercard-owned) and Verifi CDRN (Visa-owned) - **Week 2**: Configure notifications by API or email, then write your auto-refund rules (under $50, digital goods, no tracking) - **Go live**: Respond inside 24 hours, track match rate and prevention rate - **What to expect**: 20-40% fewer chargebacks, 30-50% of disputes matched by an alert - **The math**: $20-40 per alert against a $15 chargeback fee at most processors. On fees alone that loses money. You're buying the ratio, not the fee saving ::: Alerts let you refund a transaction before it turns into a chargeback. You still lose the sale either way, so the thing you're actually buying is the fee and the ratio, and for most merchants that's worth $20-40 a head. This playbook gets you connected to Ethoca, Verifi CDRN and RDR in one to two weeks, and most of that time is just waiting on approvals. If you're reading this because your ratio is climbing, alerts will help but they won't fix the cause. Run this alongside [reduce chargebacks fast](/docs/playbooks/reduce-chargebacks-fast), not instead of it. ## Workflow Overview ```mermaid flowchart LR A[WEEK 1Enrollment] --> B[WEEK 2Integration] --> C[GO LIVELaunch] --> D[ONGOINGOperate] style A fill:#3b82f6,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Enrollment** | Choose approach (direct, processor, aggregator), enroll Ethoca + Verifi | | **Integration** | Configure notifications (API or email), define auto-refund rules, test E2E | | **Launch** | Enable alerts, monitor errors, track ROI | | **Operate** | Daily pending alerts check, weekly metrics review, monthly ROI analysis | **What you need on hand:** legal entity and bank docs, your [descriptors](/docs/chargebacks/prevention/descriptors-and-comms) exactly as they print on statements, your processor MIDs, the ability to refund by API or by hand, your current ratio from [chargeback metrics](/docs/chargebacks/metrics), and a budget of $20-40 per alert. ## Trigger Criteria Run this playbook if: - Your chargeback ratio is above 0.5% and still climbing - You want to head off disputes rather than fight them - You're in a monitoring program, or close enough to worry - Customers are disputing charges they should recognize --- ## Understanding Alert Services ### The Three Services | Service | Network | How It Works | Best For | |---------|---------|--------------|----------| | **Ethoca** | Mastercard-owned | Alert when cardholder initiates dispute | Fraud disputes, faster notification | | **Verifi CDRN** | Visa-owned | Alert network with issuer participation | Visa-heavy merchants | | **Verifi RDR** | Visa | Auto-resolve disputes based on rules | High-volume, automated resolution | Both networks own one of these now, so this isn't a third-party bolt-on any more. Coverage still depends on which issuers participate, which is why the match rate lands around a third rather than everything. ### How Alerts Prevent Chargebacks ``` Traditional path: Customer disputes โ†’ Issuer files chargeback โ†’ You lose With alerts: Customer disputes โ†’ Alert sent โ†’ You refund โ†’ No chargeback filed ``` ### Expected Results | Metric | Typical Impact | |--------|----------------| | Chargebacks prevented | 20-40% reduction | | Alert match rate | 30-50% of disputes | | Response window | 24-72 hours | | ROI breakeven | 1-2 months typically | --- ## Week 1: Enrollment ### Step 1: Choose Your Approach | Option | Pros | Cons | |--------|------|------| | **Direct enrollment** | Lower per-alert cost | More integration work | | **Through processor** | Faster setup | Higher per-alert cost | | **Through aggregator** | Single integration for all | Highest per-alert cost | **The call:** if your processor bundles alerts, start there. You'll pay a bit more per alert and you'll be live weeks earlier, and being live is what saves you money. Move to direct enrollment later if the volume justifies it. ### Step 2: Ethoca Enrollment 1. Apply at Ethoca (or through processor/aggregator) 2. Provide business documentation 3. Submit descriptor list (exactly as it appears on statements) 4. Configure notification endpoint or email 5. Wait for approval (3-7 business days) **Checkpoint:** Ethoca account active, descriptors registered. ### Step 3: Verifi CDRN Enrollment 1. Apply at Verifi (or through processor/aggregator) 2. Provide MID list and descriptors 3. Choose notification method (API, email, portal) 4. Configure response workflow 5. Wait for approval (3-7 business days) **Checkpoint:** Verifi CDRN account active, connected to your MIDs. ### Step 4: Verifi RDR Setup (Optional) RDR resolves the dispute for you, without anyone looking at it. That's the appeal and that's the risk, so start it small. 1. Enroll in RDR through Verifi 2. Define resolution rules: - Always refund under $X - Always refund if digital goods - Always refund if no tracking 3. Set liability acceptance threshold 4. Test on one segment before you turn it on everywhere **Checkpoint:** RDR rules configured and active. --- ## Week 2: Integration and Testing ### Step 1: Configure Notifications #### API Integration (Recommended for Volume) At any real volume you want a webhook, not an inbox: 1. Create an endpoint on your server to receive alert notifications 2. When an alert arrives, look up the original transaction 3. Apply your auto-refund rules (see next section) 4. Respond to the alert with your decision (refunded, declined, and so on) **What to tell your developer:** "Set up a webhook endpoint for Ethoca and Verifi. When an alert comes in, check it against our auto-refund rules and process it. We have to respond inside 24 hours." #### Email/Portal (Lower Volume) 1. Configure alert emails to operations inbox 2. Set up monitoring for alert emails 3. Define SLA for response (under 24 hours) 4. Create manual refund workflow ### Step 2: Define Auto-Refund Rules | Condition | Recommended Action | |-----------|-------------------| | Transaction under $50 | Auto-refund (ROI positive) | | Digital goods | Auto-refund (hard to prove delivery) | | No tracking available | Auto-refund (can't win dispute anyway) | | Subscription (canceled) | Auto-refund | | Known friendly fraud pattern | Review before refund | | High-value physical goods | Review, may have proof | ### Step 3: Test the Flow 1. Process a test transaction 2. Simulate an alert (if the provider has a test mode) 3. Verify the notification arrives 4. Process the refund 5. Confirm the alert response went back 6. Confirm no chargeback follows **Checkpoint:** End-to-end flow tested and working. --- ## Go Live Checklist - [ ] Ethoca active and receiving alerts - [ ] Verifi CDRN active and receiving alerts - [ ] Notification workflow configured - [ ] Auto-refund rules defined - [ ] Manual review queue set up - [ ] Response SLA defined (under 24 hours) - [ ] Metrics tracking enabled --- ## Ongoing Operations ### Daily Tasks 1. Check for pending alerts 2. Work the manual review queue 3. Confirm auto-refunds are actually completing ### Weekly Metrics | Metric | Track | |--------|-------| | Alerts received | Volume trend | | Match rate | Alerts / Total disputes | | Response time | Average hours to respond | | Refund rate | % of alerts refunded | | Prevention rate | Chargebacks avoided | ### Monthly Review 1. Work out your actual ROI (chargebacks prevented against alert fees paid) 2. Check your false positive rate, meaning good sales you refunded for nothing 3. Tune the auto-refund thresholds 4. Check descriptor coverage. New product, new billing name, new gap --- ## Success Criteria You're done when: - [ ] Both Ethoca and Verifi CDRN active - [ ] Alerts being received and processed - [ ] Response time under 24 hours - [ ] Chargeback ratio trending down - [ ] ROI positive (cost vs prevented chargebacks) --- ## Scale Callout | Volume | Approach | |--------|----------| | **Under $100k/mo** | Manual email alerts are usually enough; a processor bundle gets you live fastest | | **$100k-$1M/mo** | API integration; written auto-refund rules; check ROI weekly | | **Over $1M/mo** | Full automation; RDR for volume resolution; someone who owns alert ops | --- ## Where This Breaks - **Descriptors not registered.** The alerts won't match anything and you'll pay for a service that does nothing. Audit descriptors quarterly. - **Response too slow.** Past 72 hours the chargeback gets filed anyway and you've paid for the alert on top. Set a tight SLA and mean it. - **Auto-refunding everything.** Fraudsters work out what you're doing faster than you'd think. Keep thresholds and keep a review queue. - **Nobody tracking ROI.** It's easy to quietly overpay for years. If the alert costs more than the chargeback would have, stop. - **New MIDs not enrolled.** Add a processor or a MID and it's outside coverage until somebody enrolls it. Make that part of the launch checklist. --- ## Cost Analysis ### Typical Costs | Item | Cost Range | |------|------------| | Ethoca per alert | $20-40 | | Verifi CDRN per alert | $20-40 | | RDR per resolution | $15-25 | | Chargeback fee | $0-30, typically $15 | | Chargeback ratio damage | Not billed to you directly, but it's what pushes you into a monitoring program | ### ROI Calculation Assume 10,000 transactions a month and 100 chargebacks, so a 1.00% ratio: ``` Alerts matched (35% of disputes): 35 Alert cost at $30 each: $1,050 Chargebacks prevented: 35 Chargeback fees avoided at $15: $525 Ratio: 100 -> 65 chargebacks, 1.00% -> 0.65% Net on fees alone: -$525 ``` That model uses $15, the fee most US processors publish. On fees alone alerts lose money, and it isn't close. $30 is the highest published US figure, and even there you only break even. Nobody publishes $60. If a reseller shows you ROI built on a $60 or $100 chargeback fee, ask which processor charges it, because [none of the ones verified here do](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated). What you're buying is the ratio. Going from 1.00% to 0.65% is the difference between sitting in a monitoring program and not, and that's worth more than $525 a month. Buy alerts for the ratio. Treat the fee savings as change. Two things the model above leaves out, and you should put them back in with your own numbers. First, you refund the sale on every alert you accept, including the ones that would never have become chargebacks. That's your false positive cost and it's real money. Second, ask your acquirer whether alert-resolved transactions still count toward your fraud-based program ratios, because a dispute the cardholder already reported as fraud may have been counted before your refund ever landed. See [network programs](/docs/chargebacks/reference/network-programs) for how the counting works. --- ## Next Steps Once alerts are running: 1. **Tune the auto-refund rules.** Your real alert mix won't look like the table above 2. **Check ROI monthly.** Alert cost has to stay under the chargeback cost you're avoiding 3. **Add new descriptors.** Every product launch and billing change opens a coverage gap 4. **Consider RDR.** If your Visa volume is heavy, automated resolution is worth the look 5. **Fix the root cause.** Alert data tells you why people dispute. That's the part that actually lowers the ratio --- ## Related - [Chargeback Alerts Deep Dive](/docs/chargebacks/prevention/alerts) - Detailed alert coverage - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis playbook - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Chargebacks Overview](/docs/chargebacks) - Dispute fundamentals - [Chargeback Prevention](/docs/chargebacks/prevention) - Prevention hierarchy - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Where alerts fit - [Chargeback Metrics](/docs/chargebacks/metrics) - Ratio tracking - [Chargeback Vendors](/docs/chargebacks/vendors) - Alert providers - [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Crisis response - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Billing clarity - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Alerts Configuration](/docs/operations/alerts-configuration) - Operations alert setup {JSON.stringify({"@context":"https://schema.org","@type":"HowTo","name":"How to Set Up Dispute Alerts (Ethoca, Verifi, and RDR)","description":"A 2-week implementation guide to set up Ethoca, Verifi CDRN, and RDR dispute alert services to prevent chargebacks before they hit your account.","totalTime":"P14D","step":[{"@type":"HowToStep","name":"Week 1: Enrollment","text":"Choose your enrollment approach (direct, through processor, or through aggregator). Enroll with Ethoca by submitting business documentation and your descriptor list. Enroll with Verifi CDRN by providing your MID list and descriptors. Optionally set up Verifi RDR for automated dispute resolution. Approval takes 3-7 business days per provider."},{"@type":"HowToStep","name":"Week 2: Integration and Testing","text":"Configure notifications via API webhook (recommended for high volume) or email/portal (lower volume). Define auto-refund rules: auto-refund transactions under $50, digital goods with no proof of delivery, and canceled subscriptions. Test the full end-to-end flow from alert receipt to refund processing to alert response."},{"@type":"HowToStep","name":"Go Live: Launch Alerts","text":"Activate Ethoca and Verifi CDRN alert receiving. Confirm notification workflow is operational and auto-refund rules are active. Set up the manual review queue for cases that need human review. Define a response SLA under 24 hours and enable metrics tracking."},{"@type":"HowToStep","name":"Ongoing: Operate and Optimize","text":"Daily: check pending alerts, process the manual review queue, verify auto-refunds are completing. Weekly: track alert volume, match rate, response time, and prevention rate. Monthly: calculate ROI (chargebacks prevented vs. alert fees), review false positive rate, tune auto-refund thresholds, and check descriptor coverage for new products."}]})} --- ## Shopify Payments First Week Setup Source: https://paymentsandrisk.com/docs/playbooks/shopify-first-week # Shopify Payments First Week Setup :::info[TL;DR] - Enable Shopify Payments before processing any live orders. Using a third-party gateway costs an extra **2% on Basic, 1% on Grow, 0.6% on Advanced and 0.2% on Plus**, on every order, permanently. That's the real lock-in - Set your billing descriptor and business address before launch; wrong descriptor information causes 20-30% higher "I don't recognize this" chargebacks in the first 90 days - Enable shipping confirmation emails and fraud analysis during Day 1 setup, not after your first dispute - **Upgrade your plan far earlier than most advice suggests.** The break-even is around CA$31,000 a month of online volume for Basic to Grow, not $100,000. Work it out from your own region's published numbers before you leave money on the table - Work this 7-day checklist before you soft-launch. It's 4-6 hours now against problems that cost $1,000-$10,000 to fix later ::: You just launched your Shopify store. Shopify Payments is already enabled. But don't process real orders until you complete this 7-day checklist. These configurations prevent chargebacks, improve conversion, and save money. ```mermaid %%{init: {'themeVariables': {'cScale0': '#f59e0b', 'cScale1': '#f59e0b', 'cScale2': '#f59e0b', 'cScale3': '#f59e0b', 'cScale4': '#f59e0b', 'cScale5': '#f59e0b', 'cScale6': '#f59e0b', 'cScaleLabel0': '#1c1e21', 'cScaleLabel1': '#1c1e21', 'cScaleLabel2': '#1c1e21', 'cScaleLabel3': '#1c1e21', 'cScaleLabel4': '#1c1e21', 'cScaleLabel5': '#1c1e21', 'cScaleLabel6': '#1c1e21'}}}%% timeline title Shopify First Week Setup Day 1 : Verify Shopify Payments : Payout schedule : Fraud analysis settings Day 2 : Billing descriptor : Shipping confirmations : Refund policy Day 3-4 : Checkout optimization : Abandoned cart recovery Day 5-7 : Soft launch : Monitor disputes : Review analytics ``` ## Why This Matters **Common Shopify first-week mistakes**: - Using third-party gateway โ†’ Pay Shopify an extra 2% per order on Basic, unnecessarily - Missing shipping confirmations โ†’ 40% more "not received" disputes - No fraud analysis enabled โ†’ First fraud attack drains inventory - Wrong refund policy โ†’ Customer confusion and disputes - No abandoned cart recovery โ†’ Lose 10-20% of potential sales **This checklist prevents these.** Budget 4-6 hours over 7 days. | Day | Tasks | Time | Priority | |-----|-------|------|----------| | **Day 1** | Verify Shopify Payments, payout schedule, fraud analysis, billing descriptor | 1 hr | Critical | | **Day 2** | Shipping confirmations, refund policy, email templates | 1 hr | Critical | | **Day 3-4** | Checkout optimization, abandoned cart recovery, payment methods | 1.5 hrs | High | | **Day 5-7** | Soft launch, monitor disputes, review analytics | 1.5 hrs | High | --- ## Day 1: Payments Configuration (1 hour) ### Task 1: Verify Shopify Payments is Enabled (10 min) **Where**: Shopify Admin โ†’ Settings โ†’ Payments **Verify**: - Shopify Payments is activated (not PayPal or Stripe) - Status shows "Active" - Bank account connected for payouts **Why Shopify Payments**: - Avoid the third-party gateway fee, which is 2% on Basic and applies to every order - Unified reporting (sales + payments) - Faster payouts **If you see "PayPal" or "Stripe"**: remove them, or you're paying Shopify an extra 2% on every order on the Basic plan, on top of what that gateway charges you. See [Third-Party Payment Gateway Fee](#1-third-party-payment-gateway-fee) for the rate on each plan. --- ### Task 2: Configure Payout Schedule (10 min) **Where**: Settings โ†’ Payments โ†’ Payout Schedule **Options**: - Daily (recommended) - Weekly - Monthly **Choose**: Daily for consistent cash flow. **Payout timing**: 2-3 business days (standard) **Why it matters**: Daily = predictable cash flow. Weekly = lumpy cash flow. --- ### Task 3: Set Fraud Analysis Level (15 min) **Where**: Settings โ†’ Payments โ†’ Fraud Analysis **Levels**: - **Low**: Analyze fewer orders (higher fraud risk) - **Medium**: Default (recommended for most) - **High**: Analyze more orders (lower fraud risk, may hold legitimate orders) **Start with**: Medium **Shopify will flag suspicious orders** - you decide whether to fulfill. **Why it matters**: Level too low = fraud gets through. Level too high = legitimate orders held. --- ### Task 4: Enable 3D Secure (Verify) (10 min) **Where**: Settings โ†’ Payments **Verify 3D Secure (SCA) is enabled**: - Should be ON by default for European cards - Required for PSD2 compliance **If selling to EU**: 3DS is automatic. No action needed. **If US-only**: 3DS will still trigger for high-risk transactions. **Why it matters**: European issuers decline non-3DS transactions. You need this enabled. --- ### Task 5: Test Checkout (15 min) **Before going live**: **Use Shopify's test mode**: 1. Enable test mode (Settings โ†’ Payments) 2. Use Shopify test card: 1 (Visa) 3. Complete full checkout 4. Verify confirmation email arrives 5. Check order shows in Orders tab 6. Disable test mode **Why it matters**: Bugs in checkout = lost sales. Test before customers arrive. --- ## Day 2: Fraud and Chargeback Prevention (1.5 hours) ### Task 6: Set Up Fraud Indicators (30 min) **Where**: Orders โ†’ Order Details (on flagged orders) **Shopify shows fraud indicators**: - AVS mismatch (billing address doesn't match) - CVV mismatch - High-risk country - Unusual order patterns **Your job**: Decide whether to fulfill or cancel **Best practice - Cancel if**: - AVS and CVV both fail - Customer is new + high-value order + suspicious email - Shopify recommends cancellation :::tip[Why it matters] One $500 fraud order = 15-20 legitimate orders worth of profit lost. ::: --- ### Task 7: Configure Shipping Confirmations (30 min) **Where**: Settings โ†’ Notifications โ†’ Shipping **Enable**: - Shipping confirmation email (to customer) - Include tracking number - Send when order is fulfilled :::tip[Why it matters] Shipping confirmations reduce "not received" disputes by 40-60%. This is the #1 chargeback prevention tool. ::: --- ### Task 8: Set Up Order Confirmation Emails (30 min) **Where**: Settings โ†’ Notifications โ†’ Orders **Customize order confirmation**: - Include clear business name - Add customer support email - Include refund policy link - Show item descriptions clearly **Why it matters**: Clear confirmations prevent "I didn't order this" disputes. --- ## Day 3: Checkout Optimization (1 hour) ### Task 9: Optimize Checkout Settings (30 min) **Where**: Settings โ†’ Checkout **Configure**: - **Customer information**: Email required - **Customer accounts**: Optional (don't force signup) - **Shipping address**: Require for physical goods - **Abandoned checkout recovery**: Enable (automatic emails) **Abandoned cart emails**: - Send 1 hour after abandonment - Include cart contents - 10-20% of abandoned carts convert **Why it matters**: Abandoned cart recovery = 10-20% more sales at $0 cost. --- ### Task 10: Add Trust Signals to Checkout (30 min) **Where**: Theme customization โ†’ Checkout **Add**: - Security badges (SSL, trust seals) - Clear refund policy link - Customer support contact - Estimated delivery time **Why it matters**: Trust signals increase conversion 5-15%. --- ## Day 4-5: Refund and Return Policy (1 hour) ### Task 11: Create Clear Refund Policy (30 min) **Where**: Your website + Settings โ†’ Policies **Your refund policy must include**: - Timeframe (30 days, 60 days, etc.) - Conditions (unopened, unused, etc.) - Process (how to request refund) - Timeline (how long for refund to process) **Link to policy**: - Footer of every page - Checkout page - Confirmation emails :::tip[Why it matters] Clear policy shown at checkout reduces disputes by 15-20%. ::: --- ### Task 12: Configure Shopify Return Settings (30 min) **Where**: Settings โ†’ Shipping and Delivery โ†’ Returns **Set up**: - Return window (match your policy) - Return shipping cost (customer pays or you pay) - Restocking fee (if applicable) **Why it matters**: Makes returns easy = fewer chargebacks. Customers prefer to return properly than dispute. --- ## Day 6-7: Monitoring and Optimization (1 hour) ### Task 13: Review First Orders (30 min) **Check first 10-20 orders**: 1. Fraud indicators: Any flagged? 2. How you handled flagged orders 3. Customer emails received? 4. Any refund requests? 5. Shipping working properly? **Learn from first customers** before scaling. --- ### Task 14: Set Up Weekly Monitoring (30 min) **Create process**: **Every Monday**: - Review last week's sales (Orders โ†’ Export) - Check fraud rate (flagged / total) - Check refund rate (refunds / total) - Review any disputes **Set targets**: - Fraud rate: Under 1% - Refund rate: Under 5-10% (varies by industry) - Disputes: 0 in first month **Why it matters**: Catching CB ratio spike in Week 2 vs Month 3 saves your account. --- ## Shopify-Specific Gotchas ### 1. Third-Party Payment Gateway Fee This is the most expensive decision on the page, and it's structurally true in every market Shopify operates in. If you process through anyone other than Shopify Payments, Shopify charges you a fee on **every order**, on top of whatever your gateway charges: | Plan | Third-party gateway fee | |------|-------------------------| | **Basic** | 2.0% | | **Grow** | 1.0% | | **Advanced** | 0.6% | | **Plus** | 0.2% | Source: [shopify.com/pricing](https://www.shopify.com/pricing), verified 2026-08-02. **On $100,000/month of orders on the Basic plan, that's $2,000 a month, $24,000 a year** - paid to Shopify for the privilege of not using Shopify Payments, entirely separate from your processor's fees. Even on Plus at $1M/month it's $2,000 a month. **Never use a third-party gateway** unless Shopify Payments isn't available in your country or your business type isn't accepted. And factor this fee in before you get excited about a lower rate elsewhere: a processor has to beat Shopify Payments by more than 2% on Basic to be worth it, and almost nothing beats anything by 2%. --- ### 2. Plan Tier Optimization :::note[Shopify's US rates, confirmed] **There is no shopify.com/us/pricing path**, so don't read its 404 as Shopify hiding US rates. Shopify resolves country by connection, and the bare [shopify.com/pricing](https://www.shopify.com/pricing) opened from a US connection is the US card. **US, verified 2026-08-02:** Basic **$39/mo** ($29 annual) at 2.9% + 30c online and **2.6% + 10c** in person; Grow **$105/mo** ($79 annual) at 2.7% + 30c and 2.5% + 10c; Advanced **$399/mo** ($299 annual) at 2.5% + 30c and 2.4% + 10c; Plus from **$2,300/mo** with "most competitive rates." **Canada, for contrast:** CA$49 / CA$132 / CA$517 monthly, or CA$37 / CA$99 / CA$389 annually; online 2.8% / 2.6% / 2.4% + 30c; in person 2.6% / 2.5% / 2.4% + **CA$0.00**. ::: **One structural fact, with the caveat that gets missed:** Shopify's in-person fixed fee is **10 cents in the US and zero in Canada**, and the zero gets quoted as true in every market. Either way it's the lowest of the flat-rate options - Square charges 15c, Clover 10c, Zettle 9c, Stripe Terminal 5c - which makes Shopify POS good for low-ticket retail. On a $6 coffee, Square's 15c is 2.5% of the sale against Shopify's 10c at 1.7%. **The plan upgrade break-even, and why the usual advice is wrong.** The formula is simple: ``` Break-even monthly volume = (price difference between plans) / (rate difference between plans) ``` Run it on the Canadian numbers. Basic to Grow is a CA$62/month price increase for a 0.2 percentage point rate drop (2.8% to 2.6%). CA$62 / 0.002 = **CA$31,000 a month**. Above that, Grow is cheaper. Grow to Advanced is CA$290/month for another 0.2 points: CA$290 / 0.002 = **CA$145,000 a month**. The per-transaction 30c is identical across Basic, Grow and Advanced, so it's only the percentage that matters here. **The widely repeated "upgrade to Grow above $100K/month" is off by roughly 3x, and it costs you money every month you believe it.** A store doing CA$50,000 a month online saves CA$100 in rate and pays CA$62 more in subscription, so it's CA$38 a month better off on Grow. At CA$100,000 a month the gap is CA$138 a month, about CA$1,656 a year. Run the formula with your own region's published numbers - the method holds even though the inputs change. --- ### 3. Chargeback Threshold Shopify Payments has lower threshold than Stripe: - Warning at 0.6-0.65% - Risk at 0.75%+ - Termination possible at 1.0%+ **Monitor from Day 1.** Shopify is less forgiving than Stripe. --- ## Test to Run **End of Week 1 audit:** **Checklist**: - [ ] Shopify Payments enabled (not third-party) - [ ] Email receipts working - [ ] Shipping confirmations configured - [ ] Fraud analysis set to Medium - [ ] Refund policy published and linked - [ ] Abandoned cart recovery enabled - [ ] Test order completed successfully - [ ] First 10 orders processed without issues - [ ] No chargebacks received - [ ] Monitoring process established **Success criteria**: All boxes checked by end of Week 1. --- ## Scale Callout **First $10K processed:** - Monitor every order manually - Review all fraud flags - Respond to customers within 2 hours **Around CA$31K/month of online volume:** - Run the plan break-even formula. This is roughly where Grow overtakes Basic on the Canadian numbers, and it's much earlier than most advice says - Weekly monitoring sufficient - Patterns established **Around CA$145K/month of online volume:** - This is roughly where Advanced overtakes Grow on the Canadian numbers. If you're at $500K/month and still on Basic or Grow, you're several hundred dollars a month behind - Review chargeback ratio (should be under 0.5%) - Consider additional fraud tools if needed **Beyond $1M:** - Compare a custom platform against Shopify Plus honestly. Plus starts from CA$3,400/month and still charges a 0.2% third-party gateway fee if you process elsewhere, which is $2,000 a month on $1M you don't get back - Migration costs are high ($50K-200K) - But savings may justify at very high volume :::note[Your chargeback fee is $15, and you get it back if you win] It isn't on the pricing page. It's in the help centre, in a country table that gives **United States $15 USD**, alongside this: "When a chargeback is filed, your bank charges a processing fee. If you win the chargeback, then the fee is returned to you" ([Shopify Help Center](https://help.shopify.com/en/manual/payments/chargebacks/chargeback-process), read 2026-08-02). Read the wording carefully. Shopify says **your bank** charges it, not Shopify. So $15 is what shows up through Shopify Payments, and it isn't necessarily every dispute cost you'll carry. The keyed rate, the instant payout fee and the volume floor genuinely aren't published anywhere, so those are still worth asking about in writing. ::: --- ## Where This Breaks 1. **High-risk products**: Shopify rejects supplements, CBD-adjacent and adult products faster than most processors. Don't find that out on Day 8. 2. **International immediately**: If 50%+ of sales are international from Day 1, you'll want multi-currency in this checklist (extra 2-3 hours). 3. **Subscription products**: If selling subscriptions, add subscription app setup (ReCharge, Bold, etc.) - extra 4-6 hours. 4. **Print-on-demand/dropshipping**: Long shipping times (2-4 weeks) = higher dispute risk. Extra fraud prevention needed. 5. **Volume spike**: Launch and do $100K in week one and Shopify holds the account for review. Expect a 3-7 day delay, and it's normal. --- ## Next Steps **Completed first week?** 1. Review [Shopify Payments Profile](/docs/payments/processors/shopify-payments) for optimization 2. Read [Operations Checklist](/docs/operations/checklist) for ongoing tasks 3. Optimize based on first month data **Need to reduce costs?** 1. Calculate which plan tier optimizes your costs 2. See [Total Cost Model](/docs/payments/total-cost-model) 3. Review [Processor Comparison](/docs/payments/processor-comparison) **Growing and optimizing?** 1. [Checkout Conversion](/docs/payments/checkout-conversion) - Improve conversion rates 2. [Chargeback Prevention](/docs/chargebacks/prevention) - Reduce disputes 3. [Auth Optimization](/docs/payments/auth-optimization) - Improve approval rates --- ## See Also - [Shopify Payments Profile](/docs/payments/processors/shopify-payments) - Full Shopify overview - [Stripe First Week](/docs/playbooks/stripe-first-week) - Alternative if on Stripe - [Square First Week](/docs/playbooks/square-first-week) - Alternative if on Square - [Operations Checklist](/docs/operations/checklist) - Ongoing operations - [Checkout Conversion](/docs/payments/checkout-conversion) - Optimizing Shopify checkout - [Total Cost Model](/docs/payments/total-cost-model) - Budgeting - [Chargeback Prevention](/docs/chargebacks/prevention) - Dispute reduction --- ## Square First Week Setup Source: https://paymentsandrisk.com/docs/playbooks/square-first-week # Square First Week Setup :::info[TL;DR] - Square is live in 15 minutes but takes 3-4 hours to configure correctly; investing that time now prevents disputes and lost revenue later - Disable keyed-entry for regular sales immediately; keyed costs 3.5% + 15c against 2.6% + 15c card present, so you pay a straight 0.9% penalty on every keyed dollar - Enable receipt emails before your first sale; customers who receive receipts dispute at roughly half the rate of those who don't - Build your item library before processing volume; it enables inventory tracking and gives you transaction-specific delivery evidence if you ever need to fight a chargeback - Square's card-present fixed fee is **15 cents, not 10**. A lot of published comparisons still say 10, and on small tickets that gap matters - Square isn't the cheapest processor on rate at any ticket size or volume modelled here. It's the fastest to set up and the POS software is included, which are real reasons to choose it. See [what it costs you at scale](#scale-callout) and the [interchange assumption](/docs/payments/reference/cost-model-assumptions) behind that comparison ::: Square is the fastest processor to set up - you can accept payments in 15 minutes. But taking 2-3 hours to configure properly prevents costly mistakes and saves thousands later. ```mermaid %%{init: {'themeVariables': {'cScale0': '#f59e0b', 'cScale1': '#f59e0b', 'cScale2': '#f59e0b', 'cScale3': '#f59e0b', 'cScale4': '#f59e0b', 'cScale5': '#f59e0b', 'cScaleLabel0': '#1c1e21', 'cScaleLabel1': '#1c1e21', 'cScaleLabel2': '#1c1e21', 'cScaleLabel3': '#1c1e21', 'cScaleLabel4': '#1c1e21', 'cScaleLabel5': '#1c1e21'}}}%% timeline title Square First Week Setup Day 1 : Business info : Square Reader setup : Receipt settings Day 2 : Item library : Disable keyed-entry : Staff permissions Day 3 : Test transactions : Monitor first sales : Review reports ``` ## Why This Matters **Square is plug-and-play, but you still need to configure**: - Wrong business info โ†’ Disputes go unanswered (can't reach you) - No receipt emails โ†’ "I don't recognize this" disputes - Keyed-in enabled โ†’ Staff keys in everything at 3.5% instead of swiping at 2.6% - No item library โ†’ Can't track what sells, can't prove delivery **This checklist takes 3-4 hours total over 3 days.** Worth it to prevent problems. ### What Square Actually Charges Every number below comes from Square's own published fee page, verified 2026-08-02: [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees). | What you're doing | Free plan | Plus | Premium | |-------------------|-----------|------|---------| | **Card present** (tap, dip, swipe) | 2.6% + 15c | 2.5% + 15c | 2.4% + 15c | | **Online** | 3.3% + 30c | 2.9% + 30c | 2.9% + 30c | | **Keyed or card on file** | 3.5% + 15c | 3.5% + 15c | 3.5% + 15c | | **ACH via Square Invoices** | Not available | 1%, $1 minimum, $10 cap | 1%, $1 minimum, $10 cap | | **Monthly subscription** | $0 - Square Free has "no monthly subscription costs" | Check current price on Square's pricing page | Check current price on Square's pricing page | **Your chargeback fee is $0.** Square states it outright: "There are no fees for dispute management services for chargebacks - we cover the fee for every dispute that we work together to challenge" ([Square Support](https://squareup.com/help/us/en/article/3882-payment-disputes-walkthrough), read 2026-08-02). That's better than every other US processor except the Authorize.net gateway. Most charge $15. One caveat worth an email. Square's Payment Terms reserve the right to recover "the amount of any Chargeback and any associated Fees, fines, or penalties listed in the Fee Schedule." That covers network fines from a monitoring program, not a per-dispute fee. If your ratio climbs, ask what gets passed through. **There's no volume floor.** Square publishes only an upward threshold: "if you process over $250,000 per year, talk to our team about custom pricing" **Instant Transfer costs 1.95% per transfer** ([Square Help Center](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options), verified 2026-08-02). Not 1.5%, not 1.75%. Both of those figures circulate and both are wrong. | Day | Tasks | Time | Priority | |-----|-------|------|----------| | **Day 1** | Business info, Square Reader setup, receipt settings | 1 hr | Critical | | **Day 2** | Item library, disable keyed-entry, staff permissions | 1.5 hrs | High | | **Day 3** | Test transactions, monitor first sales, review reports | 1 hr | High | --- ## Day 1: Basic Setup (1 hour) ### Task 1: Verify Business Information (15 min) **Where**: Square app โ†’ Account & Settings โ†’ Business Information **Verify**: - Legal business name is correct - Support phone number works - Business address is correct - Email is monitored daily :::tip[Why it matters] Disputes and important notices go to this contact info. Wrong email = missed chargebacks = auto-lose. ::: --- ### Task 2: Set Up Square Reader (30 min) **What you need**: - Square Reader (magstripe, chip, or contactless) - Charged and paired to your phone/tablet **Steps**: 1. Download Square POS app 2. Pair reader via Bluetooth 3. Process test transaction ($1.00 to yourself) 4. Refund test transaction 5. Verify everything works **Why it matters**: Don't discover broken reader during first customer transaction. Test beforehand. --- ### Task 3: Customize Receipt Settings (15 min) **Where**: Square app โ†’ Settings โ†’ Receipts **Configure**: - **Email receipts**: ON - **SMS receipts**: Optional - **Printed receipts**: Only if you have printer - Add return policy to receipt footer - Add support email/phone :::tip[Why it matters] Email receipts reduce "I don't recognize this" disputes by 20-30%. ::: --- ## Day 2: Inventory and Items (1.5 hours) ### Task 4: Create Item Library (1 hour) **Where**: Square app โ†’ Items **For each product/service**: - Name (appears on receipts) - Price - SKU (optional but recommended) - Category - Tax settings **Why create items vs open pricing**: - Track what sells (reporting) - Prove delivery for disputes ("They bought X on Y date") - Faster checkout (tap item vs typing price) - Tax automation **Start with top 10-20 items.** Add rest over time. **Why it matters**: "They bought PRODUCT X" wins disputes. "They bought something" doesn't. --- ### Task 5: Set Up Categories (30 min) **Where**: Items โ†’ Categories **Create categories**: - For retail: By product type (shirts, pants, accessories) - For restaurants: By meal type (breakfast, lunch, drinks) - For services: By service type (haircut, color, treatments) **Why it matters**: Reports by category show what's profitable. Chargebacks by category show what's disputed most. --- ## Day 3: Fraud and Risk Settings (1 hour) ### Task 6: Configure Fraud Prevention (30 min) **Where**: Square app โ†’ Settings โ†’ Account & Settings โ†’ Security **Square's built-in fraud protection**: - Enabled by default (can't disable) - Automatically flags suspicious transactions - No configuration needed **What YOU can configure**: - **CVV verification**: Recommended ON for keyed transactions - **Address verification (AVS)**: Recommended ON for CNP - **Decline high-risk**: Let Square handle this automatically **For card-present**: Fraud is rare. Don't over-configure. **For Square Online (e-commerce)**: Verify fraud tools are enabled. --- ### Task 7: Disable or Limit Keyed Entry (30 min) **Where**: Square app โ†’ Settings โ†’ Checkout **Why this matters** (rates verified 2026-08-02, [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees)): - Swiped, dipped or tapped: 2.6% + 15c - Keyed in manually: 3.5% + 15c - **The fixed 15c is identical either way, so the penalty is a clean 0.9% of the sale** **At 100 keyed transactions a month averaging $100**: that's $10,000 keyed, and 0.9% of it is $90 a month gone. At $50,000 a month keyed, it's $450 a month. **Configuration**: - **Require explanation for keyed entry** (if possible) - Train staff: "Use the reader, don't key in" - Only key when customer doesn't have physical card **Exception**: Restaurants taking phone orders need keyed-in enabled. --- ## Ongoing Best Practices (Post-Week 1) ### Task 8: Set Up Employee Permissions (if applicable) **Where**: Square app โ†’ Team โ†’ Employees **Create staff accounts with permissions**: - Cashier: Process sales, refunds (no reporting) - Manager: Full access except bank settings - Owner: Everything :::tip[Why it matters] Staff can't steal if they don't have refund access. Separate permissions protect you. ::: --- ### Task 9: Enable Tipping (if applicable) **Where**: Checkout settings โ†’ Tipping **For restaurants/services**: - Enable tipping - Set suggested amounts (15%, 18%, 20%) - Choose when to prompt (before or after payment) **For retail**: Usually skip --- ### Task 10: Review First Week of Transactions **End of Week 1, review**: 1. Total volume: $______ 2. Transaction count: ______ 3. Chargebacks: ______ (should be 0 in first week) 4. Refunds: ______ (under 5% is normal) 5. Keyed-in %: ______ (should be under 10%) **Red flags**: - >20% keyed-in: Retrain staff - >5% refunds: Product or service issue - Any chargebacks in Week 1: Investigate immediately --- ## Square Online Setup (If Applicable) **If using Square for e-commerce in addition to card-present**: ### Additional Day 1 Tasks: **Task 11: Set Up Square Online Store (1 hour)** - Configure shipping zones and rates - Add product photos and descriptions - Test checkout flow end-to-end - Verify email confirmations send **Task 12: Configure Shipping Confirmations (30 min)** - Enable automatic shipping confirmation emails - Include tracking numbers - Add "Order shipped" customer communications **Why it matters**: Shipping confirmations reduce "not received" disputes by 40-60%. --- ## Square vs Stripe: Setup Differences | Setup Area | Square | Stripe | |------------|--------|--------| | **Descriptor** | Auto-set from business name | Must configure manually | | **Fraud rules** | Automatic, can't customize much | Fully customizable | | **Dispute alerts** | Not available | RDR available | | **Webhooks** | Available but not required | Critical for automation | | **POS** | Full POS included free | Separate terminal/SDK | **Square is simpler**: Less configuration needed, but also less control. --- ## Common Square First-Week Mistakes ### Mistake 1: Not Training Staff on Reader Usage **Symptom**: Staff keys in every transaction (3.5% + 15c instead of 2.6% + 15c) **Cost**: 0.9% of every keyed dollar. At $50,000 a month that's $450; at $100,000 a month it's $900 **Prevention**: 15-minute training: "Use the reader for every transaction unless customer doesn't have card" --- ### Mistake 2: No Item Library **Symptom**: Everything processed as "Sale" with no item details **Cost**: Can't prove what was purchased in disputes, can't track inventory **Prevention**: Spend 1 hour building item library before opening --- ### Mistake 3: Missing Email Receipts **Symptom**: Customers don't have proof of purchase, dispute charges **Cost**: 15-20% higher "I don't recognize" disputes **Prevention**: Enable email receipts on Day 1 --- ### Mistake 4: Wrong Tax Settings **Symptom**: Over or under-collecting sales tax **Cost**: Compliance violations discovered months later **Prevention**: Verify tax rate matches your state/locality --- ### Mistake 5: Instant Transfer Addiction **Symptom**: Using Instant Transfer daily because the money's right there **Cost**: **1.95% per transfer**, which is $195 on every $10,000 you pull early. Run $40,000 a month through Instant Transfer and it's $780 a month, $9,360 a year ([Square Help Center](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options), verified 2026-08-02). **Prevention**: Use standard transfers (1-2 business days). Keep Instant for genuine cash gaps, not as your default. If you find yourself needing it every week, the problem is working capital, not transfer speed. --- ## Test to Run **Square first-week audit:** **Day 7 review:** 1. Process a test transaction, check receipt format 2. Calculate keyed-in percentage: ____% (should be under 10%) 3. Review first week reports in Square dashboard 4. Check for any disputes (should be 0) 5. Verify staff can operate reader without help **Success criteria**: Receipts look professional, keyed-in under 10%, staff trained, no disputes. --- ## Scale Callout **First week ($5K-10K):** - Manual POS mode fine - Owner handles all transactions - Simple item library (10-20 items) **First month ($50K-100K):** - Add staff if needed - Expand item library - Review metrics weekly **First quarter ($150K-300K):** - Consider Square Plus. Beyond the inventory features it drops card present from 2.6% to 2.5% + 15c and online from 3.3% to 2.9% + 30c, and it unlocks ACH on invoices at 1% capped at $10. Check the current subscription price on Square's pricing page and work out whether the rate drop covers it at your volume - Hire dedicated staff - Daily reporting review **Beyond $500K:** - **Square was never the cheapest option on rate. What changes at this volume is that the gap stops being trivial.** At $500,000 a month card present on a $50 average ticket, Square's Free plan costs **$14,500 a month** (2.6% ร— $500,000 = $13,000, plus 15c ร— 10,000 transactions = $1,500), an effective **2.90%** - Helcim's published $500K-1M band is interchange + 0.20% + 6c with no monthly fee ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). Using this site's [published pass-through assumption](/docs/payments/reference/cost-model-assumptions) of 1.03% + $0.178 card present, the all-in cost is 1.23% + $0.238, which is **$8,530 a month** (1.23% ร— $500,000 = $6,150, plus $0.238 ร— 10,000 = $2,380), an effective **1.71%** - That's a saving of **$5,970 a month, $71,640 a year**. You'll see much smaller figures quoted for the same switch, often $2,900 or $3,600 a month. They come from assuming an interchange rate close to a single card type rather than a blend, which understates what interchange-plus saves you. The [assumptions page](/docs/payments/reference/cost-model-assumptions) fixes one blend for the whole site so every comparison here uses the same input - For reference in the same cell: PayPal Zettle is $12,350 (2.47%). Stax would compute to $7,929 at its published $199 floor and would beat Helcim, but $6M a year is far above the $250,000 where Stax stops publishing a ceiling, so that figure is a floor, not a quote. Get one. Square Plus and Premium cut the rate to 2.5% and 2.4% but Square doesn't publish those plan prices, so they can't be ranked either - Check the interchange assumption against your own statement before acting on any of it. It's the one input here that isn't a published vendor rate, and your card mix moves it - Square's POS software is still good, and that's a real reason to stay. Just make the trade knowingly instead of by default --- ## Where This Breaks 1. **High volume immediately**: If you're processing $100K+ in first week, you'll trigger Square's risk review. Prepare for potential hold. 2. **Online + in-person**: If you're using Square for both, setup is 2x (POS + Online). Budget 6-8 hours total. 3. **Multiple locations**: Each location needs separate setup, hardware, training. Multiply timeline by location count. 4. **High-ticket items ($500+)**: Square holds high-ticket payments for 24-72 hours. Warn customers about potential delays. On big-ticket B2B work, ACH through Square Invoices is 1% capped at $10 on the Plus and Premium plans, so a $3,000 invoice costs $10 instead of $105.15 on a keyed card (3.5% + 15c). That cap is the single biggest lever on this page for anyone with large invoices. 5. **Subscription/recurring**: Square's card-on-file rate is 3.5% + 15c, which is the same as keyed and the most expensive rate Square publishes. On $20,000 a month of recurring billing that's $700 plus per-transaction cents. Price a recurring-focused processor against it before you build your subscription business on Square. --- ## Next Steps **Completed first week?** 1. Read [Square Processor Profile](/docs/payments/processors/square) for optimization 2. Review [Operations Checklist](/docs/operations/checklist) for ongoing tasks 3. Monitor weekly and adjust **Need additional features?** 1. [Loyalty program](/docs/playbooks/) - Square Loyalty setup 2. [Inventory management](https://squareup.com/help/us/en/article/5806) - Track stock 3. [Employee management](https://squareup.com/help/us/en/topic/team-management) - Time tracking **Growing out of Square?** 1. Calculate [Total Cost Model](/docs/payments/total-cost-model) at current volume 2. Compare to negotiated rates with traditional processors 3. See [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) --- ## See Also - [Square Processor Profile](/docs/payments/processors/square) - Full Square overview - [Stripe First Week](/docs/playbooks/stripe-first-week) - Alternative if switching to Stripe - [Card-Present Terminal Decisions](/docs/payments/card-present-terminal-decisions) - Hardware selection - [Terminal Security](/docs/fraud/terminal-security) - Protecting Square hardware - [Operations Checklist](/docs/operations/checklist) - Ongoing operations - [Total Cost Model](/docs/payments/total-cost-model) - Budgeting for Square - [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes from Day 1 --- ## Stripe First Week Setup Source: https://paymentsandrisk.com/docs/playbooks/stripe-first-week # Stripe First Week Setup :::info[TL;DR] - Don't process live transactions until these 7 tasks are complete; the common first-week mistakes each cost thousands and some (wrong billing descriptor) can't be fixed instantly - Set your billing descriptor on Day 1. It takes 1-5 business days to propagate, and if it's wrong you'll carry 30% more chargebacks for up to 90 days - Enable Stripe Radar and set at least basic rules before going live. The default setup won't catch patterns specific to your business - Set up webhook handlers for `payment_intent.payment_failed` and `charge.dispute.created` before processing real money ::: You just got approved by Stripe. Don't start processing live transactions until you complete this checklist. These 7 tasks prevent 80% of problems new Stripe merchants face. ```mermaid %%{init: {'themeVariables': {'cScale0': '#f59e0b', 'cScale1': '#f59e0b', 'cScale2': '#f59e0b', 'cScale3': '#f59e0b', 'cScale4': '#f59e0b', 'cScale5': '#f59e0b', 'cScale6': '#f59e0b', 'cScaleLabel0': '#1c1e21', 'cScaleLabel1': '#1c1e21', 'cScaleLabel2': '#1c1e21', 'cScaleLabel3': '#1c1e21', 'cScaleLabel4': '#1c1e21', 'cScaleLabel5': '#1c1e21', 'cScaleLabel6': '#1c1e21'}}}%% timeline title Stripe First Week Setup Day 1 : Billing descriptor : Fraud rules (Radar) Day 2 : Webhooks : Tax settings Day 3 : Dispute alerts : Payout schedule Day 4-5 : Test transactions : Monitor logs Day 6-7 : Go live : Review first-day data ``` ## Why This Matters **Common first-week mistakes that cost thousands**: - Wrong billing descriptor โ†’ 30% higher chargebacks for 30 days (can't change faster) - No fraud rules enabled โ†’ First fraud attack costs $5K-$20K - No dispute alerts โ†’ Miss 40% of preventable chargebacks - Wrong tax settings โ†’ Compliance issues months later - No webhooks โ†’ Can't detect failed payments **This checklist prevents these.** Budget 8-12 hours total over 7 days. | Day | Tasks | Time | Priority | |-----|-------|------|----------| | **Day 1** | Billing descriptor, fraud rules, refund policy, test mode | 2 hrs | Critical | | **Day 2** | Dispute alerts (RDR), email receipts, webhooks | 2 hrs | Critical | | **Day 3** | Payout schedule, reconciliation, accounting software | 1.5 hrs | High | | **Day 4** | Terms of service review, tax collection | 1 hr | Medium | | **Day 5-7** | First live transactions, monitoring dashboard, review schedule | 3 hrs | High | --- ## Day 1: Critical Configuration (2 hours) ### Task 1: Set Your Billing Descriptor (30 min) **Where**: Stripe Dashboard โ†’ Settings โ†’ Public Details โ†’ Statement Descriptor **What to set**: - **Statement descriptor**: What appears on customer's card statement (22 characters max) - **Shortened descriptor**: Mobile/condensed version (10 characters) **Best practices**: - Use your recognizable business name - Include phone number if space allows - Avoid: Generic terms, abbreviations customers won't recognize - Test: Would your mother recognize this charge? **Example**: - Bad: "WEBSERV*PROD" - Good: "YOURSTORE.COM" - Better: "YOURSTORE 555-0123" :::tip[Why it matters] Wrong descriptor causes 20-30% of "I don't recognize this charge" disputes. Changes apply to new transactions immediately but may take a few days to appear on cardholder statements. ::: --- ### Task 2: Configure Basic Fraud Settings (30 min) **Where**: Dashboard โ†’ Radar โ†’ Rules **Enable these Day 1**: 1. **Block payments if ZIP/postal code fails** (if selling to US only) 2. **Block payments if CVC check fails** (card security code) 3. **3D Secure on high-risk** (Stripe enables automatically, verify it's on) **Stripe Radar (free tier) is already enabled.** Just verify default rules are active. **Don't**: Get aggressive with rules on Day 1. Start conservative, tighten after you see patterns. :::tip[Why it matters] Zero fraud rules = first fraud attack drains inventory. ::: --- ### Task 3: Set Up Refund Policy (15 min) **Where**: Your website + Stripe metadata **Do this**: 1. Write clear refund policy on your website 2. Link to policy from checkout 3. Add policy URL to Stripe metadata (custom field) **Why it matters**: Clear refund policy shown at checkout reduces "not as described" disputes by 15-20%. --- ### Task 4: Test Mode Transaction (45 min) **Before going live, test**: **Use Stripe test cards**: - Success: 4242 4242 4242 4242 - Decline: 4000 0000 0000 0002 - Fraud: 4100 0000 0000 0019 **Test scenarios**: 1. Successful payment โ†’ Verify confirmation email 2. Declined payment โ†’ Verify error message is clear 3. Refund โ†’ Process test refund 4. Check statement descriptor displays correctly **Why it matters**: Bugs in production cost real money and look unprofessional. --- ## Day 2: Dispute Prevention (2 hours) ### Task 5: Enable Dispute Alerts (RDR) (30 min) **Where**: Dashboard โ†’ Settings โ†’ Dispute Settings **Turn on**: - **Automatic refund for RDR alerts** (Visa's Rapid Dispute Resolution) - Set threshold: Refund disputes under $100 automatically **Cost**: Included free with Stripe :::tip[Why it matters] RDR deflects 20-40% of Visa disputes before they become chargebacks. This alone saves $300-$1,000/month at $500K volume. ::: --- ### Task 6: Configure Email Receipts (30 min) **Where**: Dashboard โ†’ Settings โ†’ Emails **Enable**: - Successful payment receipts - Refund confirmations - Failed payment notifications (if recurring billing) **Customize**: - Add your logo - Include support email - Add refund policy link **Why it matters**: Customers who receive clear receipts dispute 25% less often. --- ### Task 7: Set Up Webhook Endpoints (1 hour) **Where**: Dashboard โ†’ Developers โ†’ Webhooks **Critical webhooks**: - `payment_intent.succeeded` - Track successful payments - `payment_intent.payment_failed` - Handle failures - `charge.dispute.created` - Alert on chargebacks - `charge.refund.updated` - Track refunds :::tip[Why it matters] Without webhooks, you can't automate fulfillment, detect failed subscriptions, or get real-time dispute alerts. ::: **Ask your dev**: "Can you set up Stripe webhooks for these 4 events?" --- ## Day 3: Operational Setup (1.5 hours) ### Task 8: Configure Payout Schedule (15 min) **Where**: Dashboard โ†’ Balance โ†’ Payout Schedule **Options**: - Daily (recommended for most) - Weekly - Monthly - Manual **Choose**: Daily for regular cash flow. Weekly if you want to batch. **Why it matters**: daily gets you cash twice a week instead of once. That's the whole cash-flow difference. --- ### Task 9: Set Up Reconciliation (30 min) **Where**: Dashboard โ†’ Reports **Download**: - Last week's transactions (even if $0) - Practice reconciliation process - Understand report format **Set reminder**: Weekly reconciliation every Monday **Why it matters**: a $1K discrepancy in Month 1 is easy to find. In Month 6 it's six months of records. --- ### Task 10: Connect Accounting Software (45 min) **Where**: Dashboard โ†’ Apps **If using QuickBooks/Xero**: - Install Stripe integration - Configure account mapping - Test sync **If not using accounting software**: - Export CSV weekly - Import to your system **Why it matters**: Manual reconciliation scales poorly. Automate from Day 1. --- ## Day 4: Compliance Basics (1 hour) ### Task 11: Review Terms of Service (30 min) **Where**: Dashboard โ†’ Settings โ†’ Business Settings **Verify**: - Business name is correct - Support email works - Refund policy uploaded - Prohibited items compliance **Check Stripe's restricted business list**: Ensure your products aren't prohibited. **Why it matters**: Violating TOS = account termination without warning. --- ### Task 12: Set Up Tax Collection (30 min - if applicable) **Where**: Dashboard โ†’ Settings โ†’ Tax **If selling in multiple states**: - Enable Stripe Tax ($0.50/transaction via API, or 0.5% via no-code integration) - Or integrate TaxJar/Avalara **If single state**: - Configure tax rate manually **Why it matters**: Tax compliance violations discovered months later are expensive. --- ## Day 5-7: Testing and Monitoring (3 hours) ### Task 13: Process First Live Transactions (Day 5) **First 10 live transactions**: - Monitor for declines (should be under 15%) - Check descriptor displays correctly - Verify receipts send automatically - Test refund process with friend/test customer **Red flags**: - >20% decline rate (rules too aggressive or pricing issue) - Customers confused by descriptor - Emails not sending --- ### Task 14: Set Up Monitoring Dashboard (Day 6, 1 hour) **Create spreadsheet tracking**: - Daily volume - Decline rate (declined / attempted) - Fraud rate (disputed as fraud / volume) - Refund rate **Set alerts**: - Decline rate >20%: Investigate rules - Fraud rate >0.5%: Tighten controls - Refund rate >5%: Product/service issue **Why it matters**: You need baseline data to know what's normal for YOUR business. --- ### Task 15: Schedule Regular Reviews (Day 7, 30 min) **Set calendar reminders**: - **Daily** (first 2 weeks): Check dispute notifications, review fraud flags - **Weekly**: Reconciliation, review metrics - **Monthly**: Full cost analysis, optimize **Create checklist**: - Week 1: Daily monitoring - Week 2-4: Every 2-3 days - Month 2+: Weekly reviews **Why it matters**: Catching problems in Week 1 vs Month 3 saves thousands. --- ## First Week Checklist Summary ### Pre-Launch (Do Before First Transaction) ``` โ–ก Set billing descriptor (Day 1) โ–ก Enable basic fraud rules (Day 1) โ–ก Add refund policy to website (Day 1) โ–ก Test with test cards (Day 1) โ–ก Enable RDR dispute alerts (Day 2) โ–ก Configure email receipts (Day 2) โ–ก Set up webhook endpoints (Day 2) โ–ก Configure payout schedule (Day 3) โ–ก Set up reconciliation process (Day 3) โ–ก Connect accounting software (Day 3) โ–ก Review TOS compliance (Day 4) โ–ก Set up tax collection (Day 4) ``` ### Post-Launch (After First Transactions) ``` โ–ก Monitor first 10 transactions (Day 5) โ–ก Create monitoring dashboard (Day 6) โ–ก Schedule regular reviews (Day 7) โ–ก Week 2: Review first week metrics โ–ก Week 3: Adjust fraud rules if needed โ–ก Week 4: Optimize based on data ``` --- ## Common First-Week Mistakes ### Mistake 1: Wrong Descriptor **Symptom**: 5-10 "I don't recognize this" disputes in first month **Cost**: $150 in fees + $500 in lost products + 30 days to fix **Prevention**: Test descriptor with real customers before going live --- ### Mistake 2: No Fraud Rules **Symptom**: $5K in fraud orders in first week **Cost**: $5K in product + shipping, CB fees later **Prevention**: Enable Stripe Radar defaults on Day 1 --- ### Mistake 3: Missing RDR Alerts **Symptom**: 10 chargebacks that could have been prevented **Cost**: $150 in fees + ~$500 in product **Prevention**: Enable RDR on Day 2 --- ### Mistake 4: No Webhooks **Symptom**: Can't track payments automatically, manual fulfillment **Cost**: 5-10 hours/week manual work **Prevention**: Set up webhooks Day 2 --- ### Mistake 5: No Baseline Metrics **Symptom**: Don't know if 1% decline rate is good or bad **Cost**: Opportunity cost of not optimizing **Prevention**: Start tracking from Day 1 --- ## Test to Run **Week 1 health check (end of first week):** **Metrics to check**: 1. Authorization rate: Should be over 85% - If under 80%: Fraud rules too aggressive or technical issue 2. Chargeback notifications: Should be 0-2 in first week - If >3: Descriptor issue or fraud 3. Decline reasons: Check dashboard - Most common should be "insufficient funds" (normal) - If "fraud" is #1: Rules too tight 4. Refund rate: Should be under 5% - If over 10%: Product/service issue 5. Webhook delivery: 100% success rate - If failures: Fix integration immediately **Success criteria**: 85%+ auth rate, 0-2 disputes, refunds under 5%, webhooks working. --- ## Scale Callout **First $10K processed:** - Monitor daily (not kidding) - Every transaction matters - Fix issues immediately **First $100K processed:** - Monitor every 2-3 days - Patterns emerge - Adjust fraud rules based on data **First $500K processed:** - Weekly monitoring sufficient - Baseline established - Focus on optimization **Beyond $1M:** - You're past "first week" territory - See [Operations Checklist](/docs/operations/checklist) --- ## Where This Breaks 1. **High-volume launch**: If you're launching with $100K+ in first week, compress this timeline to 2-3 days. You need everything set up BEFORE volume hits. 2. **Marketplace/platform**: Multi-vendor setup requires Stripe Connect. This checklist doesn't cover that (see Stripe Connect docs). 3. **International from Day 1**: Add multi-currency and regional payment methods. This one's US and cards only. 4. **Card-present**: Need Stripe Terminal setup (hardware, readers, SDK). Different checklist. 5. **Existing business migrating**: Token migration, customer communication needed. See [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist). --- ## Next Steps **Completed first week?** 1. Review [Operations Checklist](/docs/operations/checklist) for ongoing tasks 2. Read [Auth Optimization](/docs/payments/auth-optimization) to improve approval rates 3. Plan [3DS setup](/docs/playbooks/first-time-3ds-setup) if fraud >0.5% **Need help with specific tasks?** 1. [Stripe Documentation](https://stripe.com/docs) - Official docs 2. [Stripe Support](https://support.stripe.com) - Email support 3. [Payment Ecosystem](/docs/payments/payment-ecosystem) - Understanding how Stripe fits **Ready for ongoing operations?** 1. [Operations Checklist](/docs/operations/checklist) - Daily/weekly/monthly tasks 2. [Processor Management](/docs/operations/processor-management) - Working with Stripe 3. [Chargeback Prevention](/docs/chargebacks/prevention) - Reducing disputes from Day 1 --- ## See Also - [Stripe Processor Profile](/docs/payments/processors/stripe) - Full Stripe overview - [Square First Week](/docs/playbooks/square-first-week) - Alternative if on Square - [Shopify First Week](/docs/playbooks/shopify-first-week) - Alternative if on Shopify - [Operations Checklist](/docs/operations/checklist) - Ongoing operations after setup - [Processor Switch Checklist](/docs/playbooks/processor-switch-checklist) - If migrating to Stripe - [Total Cost Model](/docs/payments/total-cost-model) - Budgeting for Stripe costs - [Tool Stack by Tier](/docs/payments/tool-stack) - What tools to add when --- ## Survive a Fraud Attack Source: https://paymentsandrisk.com/docs/playbooks/survive-fraud-attack # Playbook: Survive a Fraud Attack :::info[TL;DR] - **Hour 0-1**: Confirm attack is real, identify vector ([card testing](/docs/fraud/types/card-testing), [ATO](/docs/fraud/types/account-takeover), etc.), enable emergency friction, block bad IPs/devices - **Hour 1-4**: Pattern analysis (IPs, devices, BINs, emails), deploy targeted rules in priority order - **Hour 4-24**: Measure effectiveness, tune controls, gradually relax emergency measures - **Post-attack**: Root cause analysis. What would have detected this earlier? - Even in crisis, you're running experiments: hypothesis, metric, kill criteria ::: :::tip[Solo operator? Here's your version of this playbook] You don't need a fraud team to survive an attack. If you're on Stripe, Square, or Shopify and seeing a flood of tiny orders, failed payments, or weird signups: 1. **Turn your processor's fraud protection to its strictest setting** (Stripe: Radar rules; Shopify: Fraud analysis + flagged-order holds; Square: Risk Manager). 2. **Add a CAPTCHA to checkout** (built into most platforms, or a free plugin). 3. **Call your processor's support line and say "I'm under a card testing attack."** Ask them to add velocity limits to your account. They deal with this daily. 4. **Pause any ads** pointing at the page being attacked - you're paying to import fraud. 5. **Don't refund anything yet** - wait until the attack stops, then deal with cleanup once. Then use the hour-by-hour checklist below, where "fraud team" means you. ::: 24-hour response guide for active fraud attacks. Every attack is an expensive lesson. Don't waste it. ## Workflow Overview ```mermaid flowchart LR A[HOUR 0-1Contain] --> B[HOUR 1-4Analyze] --> C[HOUR 4-24Stabilize] --> D[POST-ATTACKLearn] style A fill:#ef4444,color:#fff style B fill:#8b5cf6,color:#fff style C fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff ``` | Phase | Key Tasks | |-------|-----------| | **Contain** | Confirm attack is real, block bad IPs/devices, notify fraud team | | **Analyze** | Pattern analysis (IPs, devices, BINs), update rules, expand blocks | | **Stabilize** | Fine-tune rules, restore normal operations, track losses | | **Learn** | Root cause analysis, permanent changes, write incident report | ## When to Use This Playbook - Sudden spike in fraud transactions (2x+ baseline) - Card testing attack detected - Coordinated fraud ring identified - ATO wave hitting your accounts ## Hour 0-1: Assess & Contain ### Immediate Assessment ``` โ–ก Confirm attack is real (not false positive spike) โ–ก Identify attack vector: โ–ก Card testing (high velocity, small amounts, high declines) โ–ก ATO wave (failed logins, profile changes) โ–ก Application fraud burst (similar applications) โ–ก Transaction fraud spike (unusual patterns) โ–ก Estimate current exposure ($) โ–ก Identify affected segments/products ``` ### Immediate Containment ``` โ–ก Enable emergency friction (CAPTCHA, rate limits) โ–ก Block identified bad IPs/devices โ–ก Lower auto-approval thresholds โ–ก Increase manual review queue priority โ–ก Notify on-call fraud team ``` :::info[This is a Bet] Some emergency measures hurt conversion. Take the hit, but write down your assumptions and metrics so you can back out intelligently later. If you block all orders from a country, measure: how many good orders are you losing? Is that worth the fraud prevented? ::: ### Communication (Hour 1) ``` โ–ก Alert fraud team lead โ–ก Notify security team โ–ก Brief management (if large scale) โ–ก Prepare customer support talking points ``` ## Hour 1-4: Analyze & Adapt ### Pattern Analysis ``` โ–ก Identify common attributes: โ–ก IP ranges โ–ก Device fingerprints โ–ก BINs/card ranges โ–ก Email patterns โ–ก Shipping addresses โ–ก Time patterns โ–ก Determine attack sophistication level โ–ก Estimate attack scale and trajectory ``` ### Deploy Targeted Rules Based on patterns found, deploy rules in this order: **1. High-confidence blocks (low false positive risk):** ``` โ–ก Block specific device fingerprints seen in fraud โ–ก Block IPs with 100% fraud rate โ–ก Block email domains used only in fraud ``` **2. Medium-confidence rules (some false positive risk):** ``` โ–ก Add velocity limits (transactions per IP/hour) โ–ก Require step-up auth for flagged BINs โ–ก Manual review for new customers from affected countries ``` **3. Last resort (high false positive risk):** ``` โ–ก Decline all orders from specific countries โ–ก Manual review all new customers โ–ก Pause specific product categories ``` ### Rule Testing Even in Crisis You're still running experiments, just faster. For each rule you deploy: - **Hypothesis:** This rule will block X% of fraud with Y% false positives - **Metric:** Block rate, false positive rate (check manually for first hour) - **Kill criteria:** If false positive rate exceeds 5%, tighten or remove ## Hour 4-8: Stabilize ### Measure Effectiveness ``` โ–ก Track fraud rate change since rules deployed โ–ก Monitor false positive rate (customer complaints, support contacts) โ–ก Compare hourly fraud $ before/after โ–ก Assess customer impact ``` ### Tune Controls ``` โ–ก Tighten rules if attack continues โ–ก Loosen rules if false positives too high โ–ก Add new rules as patterns emerge โ–ก Remove ineffective rules ``` ### Document Actions ``` โ–ก Log all rule changes with timestamps โ–ก Document decision rationale โ–ก Track affected customers/transactions โ–ก Preserve evidence for investigation ``` ## Hour 8-24: Recover & Learn ### Transition to Normal ``` โ–ก Gradually relax emergency controls โ–ก Return manual review to normal staffing โ–ก Monitor for attack resumption โ–ก Keep targeted blocks in place longer ``` ### Impact Assessment ``` โ–ก Total fraud prevented: $_______ โ–ก Total fraud losses: $_______ โ–ก Estimated false positives: _______ โ–ก Customer complaints: _______ โ–ก Operational cost: $_______ ``` ## Post-Attack (Day 2-7): Learn ### What Would Have Caught This Earlier? The most valuable question. Don't skip it. ``` โ–ก What signal appeared first? โ–ก How long between first signal and detection? โ–ก What alert or rule SHOULD have fired? โ–ก What data did we not have that would have helped? ``` ### Root Cause Analysis ``` โ–ก How did the attack start? โ–ก Why wasn't it detected earlier? โ–ก What control gaps were exploited? โ–ก How can we prevent recurrence? ``` ### Permanent Improvements Based on what you learned: **New detection rules:** ``` โ–ก Rule 1: _______________ (catches: _______________) โ–ก Rule 2: _______________ (catches: _______________) ``` **New alerts:** ``` โ–ก Alert if _____________ exceeds _____________ in _____________ window ``` **Process changes:** ``` โ–ก _____________________________________________ ``` ## Incident Report Template Document for future reference: ``` Attack Summary: - Date/time started: _______________ - Date/time contained: _______________ - Attack type: _______________ - Duration: _______________ - Total exposure: $_______________ - Loss prevented: $_______________ - Actual loss: $_______________ - False positives: _______________ Root Cause: _________________________________ What Worked: _________________________________ What Didn't Work: _________________________________ Permanent Changes Made: _________________________________ Open Questions: _________________________________ ``` ## Quick Reference: Common Attack Types | Attack | Signs | First Response | False Positive Risk | |--------|-------|----------------|---------------------| | Card Testing | High velocity, small $, high declines | Rate limit, CAPTCHA | Low | | ATO Wave | Failed logins, profile changes | Lock accounts, MFA | Medium | | App Fraud Burst | Similar applications, velocity | Tighten onboarding | Medium | | Transaction Spike | Unusual patterns, new customers | Lower approval threshold | High | ## Emergency Contacts Template Fill in for your organization: | Role | Name | Phone | Email | |------|------|-------|-------| | Fraud Lead | | | | | Security | | | | | Engineering | | | | | Customer Support | | | | | Management | | | | | Legal | | | | ## First Experiment to Run After an Attack Once the crisis is over: **Hypothesis:** We would have detected this attack X hours earlier if we had _____________. **Experiment:** Build that alert or rule. Backtest against the attack data. Deploy in shadow mode. **Expected outcome:** Next similar attack gets detected faster. ## Related - [Card Testing](/docs/fraud/types/card-testing) - High-velocity attack pattern - [Account Takeover](/docs/fraud/types/account-takeover) - Credential abuse attacks - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate-based detection - [Data Enrichment](/docs/fraud/detection/data-enrichment) - IP and email pattern analysis during attacks - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Device-based blocking - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Combining fraud signals - [Fraud Metrics](/docs/fraud/metrics) - Measuring attack impact - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Emergency rule deployment - [Manual Review](/docs/fraud/detection/manual-review) - Escalated review queues - [Network Programs](/docs/chargebacks/reference/network-programs) - Threshold monitoring - [3D Secure](/docs/fraud/prevention/3ds) - Authentication friction - [Alerts Configuration](/docs/operations/alerts-configuration) - Setting up attack detection :::tip[Build proper defenses] Attack contained? Learn how to set up lasting fraud protection so you're ready next time. **[Start The Guide, Pathway 3: Protecting from Fraud](/docs/learning-pathways/protecting-from-fraud/fraud-basics)**, 3 lessons covering fraud basics, free protections, and ongoing monitoring. ::: {JSON.stringify({"@context":"https://schema.org","@type":"HowTo","name":"How to Survive a Fraud Attack","description":"A 24-hour response guide for active fraud attacks covering containment, pattern analysis, stabilization, and post-attack learning.","totalTime":"P1D","step":[{"@type":"HowToStep","name":"Hour 0-1: Assess and Contain","text":"Confirm the attack is real (not a false positive spike). Identify the attack vector - card testing, ATO wave, application fraud burst, or transaction fraud spike. Enable emergency friction such as CAPTCHA and rate limits, block bad IPs and devices, lower auto-approval thresholds, and notify the on-call fraud team."},{"@type":"HowToStep","name":"Hour 1-4: Analyze and Deploy Targeted Rules","text":"Run pattern analysis on IPs, device fingerprints, BINs, email patterns, shipping addresses, and time patterns. Deploy rules in priority order: first block high-confidence indicators (specific devices and IPs with 100% fraud rate), then add medium-confidence velocity limits, then last-resort country blocks or full manual review."},{"@type":"HowToStep","name":"Hour 4-24: Stabilize and Recover","text":"Measure rule effectiveness by tracking fraud rate change and false positive rate. Tune controls - tighten if the attack continues, loosen if false positives are too high. Document all rule changes with timestamps. Gradually relax emergency controls and transition to normal operations."},{"@type":"HowToStep","name":"Post-Attack: Root Cause Analysis and Permanent Fixes","text":"Determine what signal appeared first and how long it took to detect. Identify what control gaps were exploited. Build new detection rules and alerts based on what you learned. Write an incident report documenting attack type, duration, total exposure, losses prevented, and permanent changes made."}]})} --- # Reference ## Card Networks Source: https://paymentsandrisk.com/docs/reference/card-networks # Card Networks :::info[TL;DR] - Your processor moves the money. The networks write the rules and levy the fines - Visa is roughly 50% of US volume, Mastercard roughly 25%. Amex and Discover are smaller and run their own rulebooks - Response windows differ by network: Visa 30 days, Mastercard 45, Amex 20, Discover 30 - When a threshold letter lands, work out whether it's the network or your processor talking. The fix is different ::: Your processor moves the money. The networks make the rules and hand out the fines. Breach a chargeback threshold and it's Visa or Mastercard coming for you, not your processor. Get that backwards and you'll spend a week arguing with the wrong people. ## The Four Major Networks [ ๐Ÿ’ณ Visa Market share: ~50% US, ~40% global Chargeback threshold: ~0.9% (processor-enforced) / VAMP 1.5% (2.2% in CEMEA) Response window: 30 days Type: Open-loop network ](/docs/reference/card-networks/visa) [ ๐Ÿ”ด Mastercard Market share: ~25% US, ~35% global Chargeback threshold: ECM at 100-299 chargebacks AND 1.50-2.99% Response window: 45 days Type: Open-loop network ](/docs/reference/card-networks/mastercard) [ ๐Ÿ”ต American Express Market share: ~15-20% US, ~10% global Chargeback threshold: none published Response window: 20 days Type: Closed-loop network ](/docs/reference/card-networks/amex) [ ๐ŸŸ  Discover Market share: ~7-10% US, under 1% global Chargeback threshold: none published Response window: 20-30 days Type: Closed-loop network ](/docs/reference/card-networks/discover) --- ## Open-Loop vs Closed-Loop ### Open-Loop (Visa, Mastercard) ```mermaid flowchart LR I1[Issuer 1Chase] --> V[Visa Network] I2[Issuer 2Bank of America] --> V I3[Issuer 3Wells Fargo] --> V V --> A1[Acquirer 1] V --> A2[Acquirer 2] A1 --> M[Merchants] A2 --> M style V fill:#1a1f71,color:#fff ``` **Characteristics**: - Network is separate from issuers and acquirers - Many banks issue Visa/Mastercard cards - Competition among issuers - Network sets rules but doesn't compete ### Closed-Loop (Amex, Discover) ```mermaid flowchart LR A[Amex/Discover] --> |Issues cards to| C[Cardholders] A --> |Operates network| N[Processing] A --> |Acquires merchants| M[Merchants] style A fill:#3b82f6,color:#fff ``` **Characteristics**: - One company does everything - Issues own cards (mostly) - Operates the network - Often handles acquiring - More control, less competition **What this means for merchants**: - Open-loop: Rules are negotiated between many parties - Closed-loop: One company makes all decisions --- ## Network Comparison for Merchants | Factor | Visa | Mastercard | Amex | Discover | |--------|------|------------|------|----------| | **Chargeback threshold** | 1.5% VAMP (2.2% CEMEA), on 1,500+ events | 100-299 AND 1.50-2.99% (ECM) | None published | None published | | **Monitoring programs** | VAMP | ACMP: ECM, HECM, EFM. Plus SMMP | Internal, no numbers | Internal, no numbers | | **Response window** | 30 days | 45 days | 20 days | 20-30 days | | **Reason code format** | 2-digit (10.4) | 4-digit (4837) | Letter (F29) | Letter (UA02) | | **Win rate (typical)** | 40-50% | 40-50% | 30-40% | 30-40% | | **Network fees** | Not published. This site assumes 0.14% + $0.02 | Not published. Same assumption | Not published | Not published | | **International presence** | High | High | Medium | Low | Nobody publishes an assessment schedule. Not Visa, not Mastercard, not Amex, not Discover. The 0.13-0.15% you'll see quoted everywhere traces to processor statements and vendor blogs, never to a network document. This site carries a single assumed figure and says so: 0.14% + $0.02, [derived here](/docs/payments/reference/cost-model-assumptions). **Two of the four won't tell you where the line is.** Visa and Mastercard at least leak numbers through acquirers. Amex and Discover don't have numbers to leak. Amex acts when your volume looks "disproportionate" to it. Discover reserves the call to "our sole discretion". So on those two, your acquirer's house limit is the only line that exists. --- ## Which Network Matters Most? ### By Volume (Your Processor Reports This) **Typical US merchant transaction mix**: - Visa: 50-55% - Mastercard: 25-30% - Amex: 10-15% - Discover: 5-10% **Where to focus**: - Monitor Visa first (most volume, strictest thresholds) - Monitor Mastercard second (second most volume) - Amex and Discover publish no threshold at all, so there's nothing to monitor against. Watch your acquirer's limit instead ### By International **If you're selling internationally**: - Visa: Dominant globally - Mastercard: Strong in EU, LATAM, Asia - Amex: US and premium segments only - Discover: Irrelevant internationally **International merchants**: Visa + Mastercard = 95%+ of your international volume. --- ## How to Work With Networks (Hint: You Don't) **You never contact networks directly**. Everything goes through your processor: | Want to... | Who You Contact | |------------|-----------------| | Dispute a chargeback | Your processor | | Ask about monitoring programs | Your processor | | Request threshold exception | Your processor (they ask network) | | Report fraud cluster | Your processor | | File for arbitration | Your processor | **Networks work B2B** (bank-to-bank). Merchants are excluded from direct communication. **Exception**: MATCH listings. There's no self-service lookup, but the acquirer that listed you must give you the listing ICA and the reason code on request, and must respond to a removal request within 30 calendar days. Mastercard states you don't need a lawyer for that request. --- ## Network-Specific Strategies ### Visa: Most Strict, Most Important **Strategy**: - Monitor Visa ratio weekly (0.9% threshold is low) - Implement CE 3.0 for Visa fraud disputes - Set internal alarm at 0.65% (VAMP early warning) - Respond to Visa disputes within 15 days (even though you have 30) **Priority**: Highest - Visa breaches hurt most ### Mastercard: More Forgiving **Strategy**: - Monitor Mastercard separately (1.5% ECM threshold) - Watch for "prior month" calculation quirks - Use full 45-day window if needed - Implement Ethoca alerts (Mastercard-owned) **Priority**: High - second most volume ### Amex: Inquiry-Focused **Strategy**: - Respond to inquiries within 48 hours (prevents chargebacks) - Accept that win rates are lower (30-40%) - Use same evidence as Visa/MC - Track 20-day deadlines carefully **Priority**: Medium - lower volume, higher AOV ### Discover: Low Volume, Low Risk **Strategy**: - Treat like Visa/MC disputes (same evidence) - Don't forget 20-30 day windows - Low volume = rarely breach thresholds **Priority**: Low - unless Discover is unusually high % for you --- ## Test to Run **Multi-network monitoring setup:** **Week 1: Build tracking** 1. Create spreadsheet with columns: - Total disputes this month - Visa disputes | Visa ratio - MC disputes | MC ratio - Amex disputes | Amex ratio - Discover disputes | Discover ratio **Week 2: Set thresholds** 2. Add threshold rows. Only two of these come from a network: - Visa: 1.5% VAMP merchant excessive, on 1,500+ events. Your processor will act nearer 0.9% - Mastercard: 100-299 chargebacks AND 1.50-2.99% (ECM). Track the count and the ratio as two rows - Amex: ask your acquirer. Amex publishes nothing - Discover: ask your acquirer. Discover publishes nothing Don't put a made-up number in the Amex and Discover rows. Put your acquirer's house limit there, in writing, or leave them blank. A fake threshold that nobody enforces is worse than an empty cell, because you'll manage to it. **Week 3: Alert system** 3. Calculate distance to threshold for each network 4. Set alerts at: - Visa: 0.65% (processor early warning) - Mastercard: 75 chargebacks, or a 1.20% ratio, whichever comes first - Amex and Discover: whatever your acquirer told you, minus a third **Success criteria**: Weekly monitoring across all four networks, alerts before breaching. --- ## Scale Callout **Under $100K/month:** - Track total ratio (all networks combined) - Don't split by network yet (volume too low) - Unlikely to breach count thresholds **$100K-$500K/month:** - Start tracking Visa and Mastercard separately - Can breach count thresholds (100/month) - Amex/Discover still low priority **$500K-$1M/month:** - Track all four networks separately - Visa ratio is your biggest risk - Implement network-specific alerts **Over $1M/month:** - Dedicated monitoring per network - Network-specific prevention strategies - Consider chargeback guarantee services --- ## Where This Breaks 1. **Digital wallet confusion**: Apple Pay and Google Pay transactions can be any network. Check your statements, because you can't tell from the wallet. 2. **Network rules change**: Visa and Mastercard update rules quarterly. Your processor should inform you, but they don't always. 3. **Processor errors in reporting**: Your processor reports your ratios to the networks. If they get it wrong, you're the one who pays. Check their math. 4. **Multi-processor complexity**: Each processor reports separately, so nobody's aggregating across them but you. 5. **International vs domestic rules**: Networks have different rules for cross-border transactions. Research before expanding. --- ## Next Steps **New to network rules?** 1. Read [Payment Ecosystem](/docs/payments/payment-ecosystem) first 2. Understand [who does what](/docs/payments/reference/provider-types) 3. Then dive into individual network pages **Monitoring chargeback ratios?** 1. [Chargeback Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - All programs 2. [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Crisis response 3. [Network Programs Reference](/docs/chargebacks/reference/network-programs) - Full details **Dealing with network fines?** 1. [MATCH/TMF List](/docs/chargebacks/match-tmf) - Termination database 2. [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Emergency playbook 3. [Chargeback Prevention](/docs/chargebacks/prevention) - Long-term strategy --- ## See Also - [Payment Ecosystem](/docs/payments/payment-ecosystem) - Understanding the four-party model - [Chargeback Monitoring](/docs/chargebacks/monitoring/thresholds) - VAMP, ECM, other programs - [MATCH/TMF List](/docs/chargebacks/match-tmf) - Network termination lists - [Reason Codes](/docs/reference/reason-codes) - All network codes - [Processor Management](/docs/operations/processor-management) - Working through processors - [Network Programs](/docs/chargebacks/reference/network-programs) - Detailed program specs --- ## Decline Codes Source: https://paymentsandrisk.com/docs/reference/decline-codes # Decline Codes :::info[TL;DR] - A decline code is the issuer telling you why it said no. They follow ISO 8583, with per-network variations - Soft declines (91, 92, 96, 19, 22, 68) are temporary. Retry with exponential backoff: immediately, 30 minutes, 4 hours, 24 hours - Hard declines (14, 15, 54, 56, 41, 43) are permanent. Retrying them looks like card testing and gets you flagged - 51 insufficient funds sits in between. Tell the customer, don't auto-retry - CNP decline rates run 10-15%, against 2-5% card-present. A high CNP rate isn't automatically a problem ::: When a transaction gets declined, the issuing bank returns a response code saying why. The codes follow the ISO 8583 standard, though each network's added its own variations. ## Quick Reference: Most Common Codes | Code | Meaning | Retry? | What to Tell Customer | |------|---------|--------|----------------------| | 05 | Do Not Honor | Maybe after 24h | "Please contact your card issuer" | | 51 | Insufficient Funds | After customer action | "Card declined - check available balance" | | 54 | Expired Card | No | "Card has expired - use a different card" | | 14 | Invalid Card Number | No | "Please verify your card number" | | 41/43 | Lost/Stolen Card | No | "Card cannot be used - contact issuer" | | 65 | Activity Limit Exceeded | After 24h | "Daily limit reached - try tomorrow" | | 91 | Issuer Unavailable | Yes, retry shortly | "Temporary issue - please try again" | :::info[CP vs CNP] Decline codes apply to both card-present and card-not-present transactions. CNP declines run higher though, typically 10-15% against 2-5% for CP. Some codes are CP-only, like the PIN ones. Others you'll only see in CNP, like the 3DS authentication codes. ::: :::tip[New to payments?] Looking up a specific code? You're in the right place. Want to understand the bigger picture (how money moves, why transactions fail, and what to do about it)? **[Start The Guide](/docs/learning-pathways/getting-started-with-payments/introduction)**, 15 lessons, ~105 minutes total. ::: ## Also in This Section - **[Soft vs Hard Declines](#soft-vs-hard-declines)** - Which declines to retry and which to stop - **[Mastercard Merchant Advice Codes](#mastercard-merchant-advice-codes-mac)** - Avoid fees by respecting MAC 03/21 rules - **[Visa-Specific Codes](#visa-specific-codes)** - Credential-on-file and authentication codes --- ## ISO 8583 Standard Codes (All Networks) These are the ISO 8583 codes, and you'll see them across Visa, Mastercard, Discover and (partially) American Express. ### Approval Codes | Code | Description | Action | |------|-------------|--------| | 00 | Approved | Transaction successful | | 08 | Honour with identification | Approved, verify ID | | 10 | Partial approval | Approved for partial amount only | | 11 | Approved (VIP) | Approved | | 16 | Approved, update track 3 | Approved, card data update needed | ### Card Issues | Code | Description | Retry? | Merchant Action | |------|-------------|--------|-----------------| | 14 | Invalid card number | No | Ask customer to verify card number | | 15 | No such issuer | No | Card prefix doesn't match any issuer | | 33 | Expired card (alternate) | No | Request different card | | 54 | Expired card | No | Request different card | | 56 | No card record | No | Card not on issuer's file | ### Fraud/Security | Code | Description | Retry? | Merchant Action | |------|-------------|--------|-----------------| | 04 | Pick up card | No | Do not return card (CP only) | | 07 | Pick up card, special condition (fraud) | No | Do not return card (CP only) | | 34 | Suspected fraud | No | Do not proceed | | 41 | Lost card | No | Card reported lost | | 43 | Stolen card | No | Card reported stolen | | 59 | Suspected fraud | No | Do not proceed | | 63 | Security violation | Maybe | CVV/CVC mismatch possible - verify | ### Funds/Limits | Code | Description | Retry? | Merchant Action | |------|-------------|--------|-----------------| | 51 | Insufficient funds | After customer action | Customer needs to add funds | | 52 | No checking account | No | Wrong account type | | 53 | No savings account | No | Wrong account type | | 61 | Exceeds withdrawal amount limit | After 24h | Daily limit reached | | 65 | Exceeds withdrawal frequency limit | After 24h | Too many transactions today | ### Authorization Issues | Code | Description | Retry? | Merchant Action | |------|-------------|--------|-----------------| | 01 | Refer to card issuer | No | Customer must call issuer | | 02 | Refer to card issuer (special condition) | No | Customer must call issuer | | 03 | Invalid merchant | No | Check merchant ID configuration | | 05 | Do not honor | Maybe after 24h | Generic decline - customer should call issuer | | 06 | Error | No | Check transaction details | | 12 | Invalid transaction | No | Transaction type not allowed | | 13 | Invalid amount | No | Check amount formatting | | 57 | Transaction not permitted to cardholder | No | Card restricted from this transaction type | | 58 | Transaction not permitted to terminal | No | Terminal not configured for this type | | 62 | Restricted card | No | Card has restrictions | ### PIN-Related (Card-Present Only) | Code | Description | Retry? | Merchant Action | |------|-------------|--------|-----------------| | 55 | Incorrect PIN | Yes (limited) | Customer can retry with correct PIN | | 75 | Allowable PIN tries exceeded | No | Card locked - customer must call issuer | | 86 | Cannot verify PIN | Yes | Technical issue with PIN verification | ### Technical Issues | Code | Description | Retry? | Merchant Action | |------|-------------|--------|-----------------| | 19 | Re-enter transaction | Yes | Retry the transaction | | 22 | Suspected malfunction | Yes | Retry shortly | | 30 | Format error | No | Check message format | | 31 | Bank not supported by switch | No | Routing issue | | 68 | Response received too late | Yes | Timeout - retry | | 90 | Cutoff is in process | Yes | Batch processing in progress | | 91 | Issuer or switch inoperative | Yes | Retry in a few minutes | | 92 | Financial institution cannot be found | Yes | Routing issue - retry | | 96 | System malfunction | Yes | Retry shortly | ### Other | Code | Description | Retry? | Merchant Action | |------|-------------|--------|-----------------| | 17 | Customer cancellation | No | Customer cancelled | | 21 | No action taken | No | No specific reason provided | | 93 | Transaction cannot be completed - violation of law | No | Cannot proceed | | 94 | Duplicate transmission | No | Already processed | --- ## Visa-Specific Codes Visa adds alphanumeric codes on top of the standard ISO 8583 set. You'll meet most of them on recurring billing. | Code | Description | Retry? | Notes | |------|-------------|--------|-------| | 1A | Authentication required | Yes | 3DS authentication needed | | 6P | Customer ID verification failed | No | Identity verification failed | | N4 | Exceeds issuer withdrawal limit | After 24h | Similar to code 61 | | N7 | CVV2 failure | Yes | Re-enter security code | | P1 | Issuer not available | Yes | Retry shortly | | R0 | Stop payment order | No | Recurring payment stopped by cardholder | | R1 | Revocation of authorization order | No | Cardholder revoked authorization | | R3 | Revocation of all authorizations | No | All recurring authorizations cancelled | | Z1 | Offline declined | No | Card declined offline | | Z3 | Unable to go online, offline declined | No | Could not connect, declined locally | ### Visa Credential-on-File Codes | Code | Description | Retry? | Action | |------|-------------|--------|--------| | R0 | Customer requested stop recurring | No | Remove customer from billing | | R1 | Revocation of specific authorization | No | Contact customer for new payment method | | R3 | Revocation of all authorizations | No | Contact customer - all stored credentials invalid | --- ## Mastercard-Specific Codes ### Standard Mastercard Codes | Code | Description | Retry? | Notes | |------|-------------|--------|-------| | 70 | Contact card issuer | Yes | Customer should verify with bank | | 78 | No account | No | Account doesn't exist | | 79 | Life cycle decline | No | Card status changed (closed, blocked) | | 82 | CVV/CVC check failed | Yes | Re-enter security code | | 83 | Fraud/security decline | No | High-risk transaction blocked | ### Mastercard Merchant Advice Codes (MAC) Since November 2021, Mastercard groups declines into categories with Merchant Advice Codes. **Retrying after MAC 03 or 21 within 30 days incurs fees.** | MAC | Meaning | Action | |-----|---------|--------| | 01 | Updated information needed | Use Account Updater (for codes 79, 82) or 3DS (for code 83) | | 02 | Try again later | Retry is allowed | | 03 | Do not retry | Do NOT retry - fees apply if you do | | 21 | Payment cancelled | Do NOT retry - cardholder cancelled | **Fee for violating MAC 03/21:** $0.50 per retry (increased from $0.30 in January 2025). That adds up fast if you're running subscription retries. --- ## American Express Codes American Express doesn't follow the same structure. Its codes are mostly three digits. ### Approval Codes | Code | Description | Action | |------|-------------|--------| | 000 | Approved | Transaction successful | | 001 | Approve with ID | Approved, verify identification | | 002 | Partial authorization | Approved for partial amount | ### Decline Codes | Code | Description | Retry? | Notes | |------|-------------|--------|-------| | 100 | Deny | Yes | General decline | | 101 | Expired card / invalid expiration date | No | Card expired | | 106 | PIN tries exceeded | Yes (with PIN reset) | Card locked for PIN | | 109 | Invalid service establishment | Yes | Merchant setup issue | | 110 | Invalid amount | Yes | Check amount formatting | | 111 | Invalid account | No | Account doesn't exist | | 115 | Requested function not supported | No | Transaction type not allowed | | 117 | Incorrect PIN | Yes | Retry with correct PIN | | 119 | Transaction not permitted (PIN) | No | Restriction on account | | 122 | Invalid keyed card security code | Yes | CID incorrect - re-enter | | 125 | Additional customer identification required | Yes | Need more verification | | 130 | Invalid effective date on card | Yes | Check card dates | | 181 | Format error | Yes | Message format issue | | 183 | Invalid currency code | No | Currency not supported | | 187 | Deny - new card issued | Yes | New card exists, get from customer | | 200 | Deny - pick up card | No | Card reported lost/stolen | | 911 | Card issuer timed out | Yes | Retry shortly | | 912 | Host unavailable | Yes | Retry shortly | | D2 | Invalid service code, restricted | No | Card restricted | | D4 | Invalid transaction | No | Transaction type not allowed | --- ## Discover Codes Discover primarily uses the standard ISO 8583 codes (00-99). Key Discover-specific behaviors: | Code | Discover-Specific Notes | |------|------------------------| | 05 | Generic decline - common on Discover | | 51 | Insufficient funds - same as other networks | | 54 | Expired card | | 57 | Transaction not permitted - may indicate international restriction | | 62 | Often means Discover not accepted at terminal | ### Discover Stop Payment Codes | Code | Description | Action | |------|-------------|--------| | R0 | Stop payment order | Customer requested stop - do not retry | | R1 | Revocation of authorization | Remove stored credential | --- ## Soft vs Hard Declines ### Soft Declines (Retriable) These are temporary. They'll often clear on their own, or on a retry: | Category | Codes | Strategy | |----------|-------|----------| | Issuer unavailable | 91, 92, 96 | Retry immediately, then with exponential backoff | | Processing errors | 19, 22, 68 | Retry once immediately | | Timeout | 911, 912 | Retry in 30-60 seconds | | Authentication needed | 1A | Redirect to 3DS | **Retry strategy:** Auto-retry with exponential backoff. First retry immediately, second at 30 min, third at 4 hours, fourth at 24 hours. ### Hard Declines (Not Retriable) These are permanent. The customer has to do something before you'll get an approval: | Category | Codes | Strategy | |----------|-------|----------| | Invalid card | 14, 15, 54, 56 | Request different payment method | | Lost/Stolen | 41, 43, 200 | Do not proceed, contact security if needed | | Fraud blocks | 04, 07, 34, 59 | Do not proceed | | Card restrictions | 57, 62, 119 | Customer must contact issuer | | Insufficient funds | 51 | Notify customer, don't auto-retry | **Strategy:** Notify the customer and ask for a different payment method. Never auto-retry these. ### Gray Area Declines A few codes sit in between. You'll have to use judgment: | Code | When to Retry | When Not to Retry | |------|---------------|-------------------| | 05 (Do Not Honor) | First occurrence, retry after 24h | Repeated declines on same card | | 65 (Activity Limit) | Next calendar day | Same day | | 51 (Insufficient Funds) | After customer confirms funds added | Never auto-retry | | 01 (Refer to Issuer) | After customer contacts bank | Until customer confirms resolution | --- ## Decline Code Categories for Reporting When building decline analytics, group codes into these categories: | Category | Codes | Typical % | Action | |----------|-------|-----------|--------| | **Insufficient Funds** | 51, 65, N4 | 25-40% | Customer notification | | **Card Invalid** | 14, 54, 56, 101 | 10-15% | Request new card | | **Do Not Honor** | 05, 100 | 15-25% | Contact issuer | | **Fraud/Security** | 04, 41, 43, 59 | 5-10% | Do not retry | | **Technical** | 91, 92, 96, 911 | 5-10% | Auto-retry | | **Authentication** | 1A, 125 | 5-15% | 3DS/verification flow | | **Other** | All others | 10-20% | Case by case | --- ## Test to Run **Weekly decline analysis:** 1. Pull all declines from your processor for last 7 days 2. Group by response code 3. Calculate percentage of total transactions 4. Compare to benchmarks above 5. Investigate any category over 5% of total volume **Monthly retry analysis:** 1. Count retries per decline code 2. Calculate retry success rate per code 3. Identify codes you're retrying that never succeed (stop retrying those) 4. Check for Mastercard MAC 03/21 violations --- ## Scale Callout | Volume | Focus | |--------|-------| | **Under $100K/mo** | Know soft vs hard. Don't retry hard declines. | | **$100K-$1M/mo** | Build decline reporting by category. Implement smart retry logic. | | **Over $1M/mo** | Negotiate decline code visibility with processor. Build automated retry rules. Monitor MAC compliance. | --- ## Where This Breaks **Processor code mapping:** Your processor probably translates network codes into its own. Ask for the original network response code, not just their internal one. **Generic declines:** Code 05 tells you nothing. Push your processor for a more specific code when they've got one. **International cards:** The same code can mean different things at an international issuer. Code 57 especially varies by region. **Retry fees:** Mastercard's MAC program penalizes retries on codes 03 and 21. Your retry logic needs to respect that, or you're paying for it. --- ## Next Steps **Building decline handling?** 1. Implement soft/hard classification 2. Set up smart retry logic with backoff 3. Build customer messaging by decline type **Improving auth rates?** 1. [Auth optimization playbook](/docs/payments/auth-optimization) - Full guide 2. [Card Account Updater](/docs/payments/subscriptions-recurring#card-account-updater-cau) - Keep cards current 3. [3D Secure](/docs/fraud/prevention/3ds) - Handle authentication declines **Subscription retry strategy?** 1. [Recurring billing guide](/docs/payments/subscriptions-recurring) - Dunning best practices 2. Respect Mastercard MAC codes - avoid fees 3. Don't retry hard declines ever --- ## Related Resources - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Dunning and retry - [3D Secure](/docs/fraud/prevention/3ds) - Authentication declines - [Reason Codes](/docs/reference/reason-codes) - Chargeback reason codes (different from decline codes) - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Checkout Conversion](/docs/payments/checkout-conversion) - Reducing abandonment - [Benchmarks](/docs/reference/benchmarks) - Target auth rates - [Card Testing](/docs/fraud/types/card-testing) - Fraud causing declines --- ## Glossary Source: https://paymentsandrisk.com/docs/reference/glossary # Glossary :::info[TL;DR] - Plain-English definitions for the jargon that turns up in processor emails and network notices - Starts with the questions merchants actually ask, then runs A to Z - Want the abbreviation expanded rather than explained? Use [Acronyms](/docs/reference/acronyms) ::: Key terms and definitions in payments, chargebacks, and risk management. ## Common Questions **What is a chargeback ratio and why does it matter?** : It's the share of your transactions that turn into disputes. Visa and Mastercard both track it. Processors start flagging you around 0.9%. Network programs like VAMP and ECM kick in higher, with per-dispute fees that escalate. It's the most important number in payment risk. โ†’ [Chargebacks Overview](/docs/chargebacks) | [Network Programs](/docs/chargebacks/reference/network-programs) **Why is Visa threatening to fine me?** : You've probably blown past your processor's chargeback threshold, usually around 0.9%. Now they're passing through VAMP per-dispute fees, or asking for a remediation plan. Cut disputes fast. You have about three months before they drop you. โ†’ [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) | [Network Programs](/docs/chargebacks/reference/network-programs) **Why was my merchant account terminated?** : Usually one of three things. Excessive chargebacks, excessive fraud, or a terms violation. If you landed on the MATCH list, that's an industry blacklist. Most processors won't onboard you for the five years it lasts. โ†’ [MATCH/TMF List](/docs/chargebacks/match-tmf) **How do I lower my processing fees?** : Start with your effective rate: total fees รท total volume. Above 2.9% on card-not-present, you may be overpaying. Then negotiate. Send correct transaction data so you hit better interchange. And price interchange-plus against your flat rate. โ†’ [Buying Payments](/docs/payments/buying-payments) | [Interchange](/docs/payments/reference/interchange) **What does the charge description on my customer's statement mean?** : That's your billing descriptor. If customers don't recognize it, they dispute the charge. Show your business name plus a phone number or URL. โ†’ [Descriptors and Comms](/docs/chargebacks/prevention/descriptors-and-comms) **What's the difference between fraud and friendly fraud?** : "Real" fraud means someone used a card without the owner's consent. Friendly fraud is a real customer who made a real purchase, then disputed it. You will also see friendly fraud called [first-party fraud or first-party misuse](/docs/reference/fraud-classification), which mean the same thing. They'll claim they didn't authorize it, never got it, or weren't satisfied. Different problems, different fixes. โ†’ [Fraud Types](/docs/fraud/types) | [Friendly Fraud](/docs/fraud/types/friendly-fraud) **Should I fight this chargeback or just accept it?** : Depends on the amount, the reason code, and your evidence. Under $25, it's rarely worth the effort. Over $100 with delivery confirmation or 3DS authentication, fight it. Match the evidence to the specific reason code. โ†’ [Chargebacks Overview](/docs/chargebacks) | [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) **What is interchange and can I negotiate it?** : Interchange is the fee the customer's bank charges on every transaction. Blended across a normal US card mix, that's about 0.9% in person and 1.4% online. One card can sit far off that. Regulated debit is 0.05% + $0.21. A non-qualified transaction is 3.15% + $0.10. You can't negotiate interchange itself, since Visa and Mastercard set it. You can negotiate your processor's markup on top. โ†’ [Interchange](/docs/payments/reference/interchange) | [How the blend is derived](/docs/payments/reference/cost-model-assumptions) **How do I know if my processing fees are too high?** : Calculate your effective rate: total fees รท total volume. Online, 2.7-3.0% is typical. Above 3.5%, something's wrong. Compare against benchmarks for your business type. โ†’ [Reading Statements](/docs/operations/reading-statements) | [Benchmarks](/docs/reference/benchmarks) **What is 3D Secure and do I need it?** : 3D Secure (3DS) is an extra verification step at online checkout. The customer confirms through their bank's app or a one-time code. Fraud liability shifts from you to the bank. If you sell online and have a fraud problem, nothing else works as well. โ†’ [3D Secure](/docs/fraud/prevention/3ds) --- ## Popular in This Section - **[Chargeback](#c)** - Forced transaction reversal initiated by the cardholder's bank - **[Authorization](#a)** - The process of verifying a transaction can proceed - **[3DS (3D Secure)](#t)** - Authentication protocol for card-not-present transactions - **[Interchange](#i)** - Fee paid by acquiring bank to issuing bank per transaction - **[PCI DSS](#p)** - Security standard for handling cardholder data --- ## A **AAV (Accountholder Authentication Value)** : Mastercard's authentication verification value generated during Identity Check (3DS) authentication. **ABU (Automatic Billing Updater)** : Mastercard's service that automatically updates stored card credentials when cards are replaced or renewed. **ACMP (Acquirer Chargeback Monitoring Program)** : Mastercard's umbrella name for ECM, HECM and EFM. It carries no threshold and no fine of its own. Worth knowing because your acquirer will use it in an email and expect you to follow. Get identified in ACMP for four months or more and Mastercard's fifth subscription standard, the receipt after each charge, turns from a recommendation into a requirement. โ†’ [Network Programs](/docs/chargebacks/reference/network-programs) **ACH (Automated Clearing House)** : US electronic network for bank transfers, including direct deposits and bill payments. โ†’ [ACH Operations](/docs/operations/ach-operations) **Acquirer** : The financial institution that processes card transactions on behalf of merchants. Also called "acquiring bank" or "merchant bank." โ†’ [Payment Ecosystem](/docs/payments/payment-ecosystem) **Allocation** : Visa's dispute process. Liability is assigned automatically from transaction data, with no merchant response. **ARN (Acquirer Reference Number)** : A 23-digit number assigned by the acquirer to uniquely identify a transaction. Critical for dispute tracking. **ATO (Account Takeover)** : Unauthorized access to and control of a legitimate user's account. โ†’ [Account Takeover](/docs/fraud/types/account-takeover) **Authorization** : Checking that a transaction can proceed. Verifies available credit or funds and card validity. โ†’ [Authorization & Capture](/docs/payments/auth-and-capture) **AVS (Address Verification Service)** : Compares the billing address the customer gives you to the one the issuer has on file. โ†’ [AVS & CVV](/docs/fraud/prevention/avs-cvv) --- ## B **BIN (Bank Identification Number)** : First 6-8 digits of a card number identifying the issuing bank. Also called IIN (Issuer Identification Number). **BRAM (Business Risk Assessment and Mitigation)** : Mastercard program for high-risk merchant category oversight. โ†’ [Network Programs](/docs/chargebacks/reference/network-programs) **Bust-Out** : Credit built up legitimately over time, then maxed out all at once before the account vanishes. โ†’ [Fraud Rings](/docs/fraud/types/bust-out) --- ## C **CAVV (Cardholder Authentication Verification Value)** : Visa's cryptographic value proving cardholder authentication during 3D Secure. **Central Site Business Date** : Mastercard's reference date found in PDS 0158, subfield 5, used for calculating chargeback time frames. **Chargeback** : Forced reversal of a transaction initiated by the cardholder's bank. Also called "dispute" in some contexts. โ†’ [Chargebacks Overview](/docs/chargebacks) **CIT (Cardholder Initiated Transaction)** : A transaction initiated directly by the cardholder, as opposed to merchant-initiated. **CNP (Card Not Present)** : Transactions without the physical card. Online, phone, or mail orders. โ†’ [Payments Overview](/docs/payments) **Collaboration** : Visa's dispute process. The merchant can send evidence before the final decision. **Compelling Evidence** : Documentation that proves cardholder participated in or benefited from a disputed transaction. โ†’ [Winning Evidence](/docs/chargebacks/winning-evidence) **CP (Card Present)** : Transactions where the physical card is used at a terminal or point of sale. **CVV/CVC (Card Verification Value/Code)** : 3-4 digit security code on card used for CNP verification. CVV2 specifically refers to the printed code. โ†’ [AVS & CVV](/docs/fraud/prevention/avs-cvv) --- ## D **DE (Data Element)** : Specific field in ISO 8583 message format used for payment card transactions. Example: DE 72 contains message text. **DPD (Days Past Due)** : Number of days a payment is overdue from its due date. --- ## E **ECI (Electronic Commerce Indicator)** : Value indicating the authentication level of an e-commerce transaction. Key values: 05 (fully authenticated), 06 (attempted), 07 (not authenticated). **ECP (Excessive Chargeback Program)** : Mastercard's monitoring program for merchants exceeding chargeback thresholds. ECM is 100-299 chargebacks AND a 1.50-2.99% ratio. HECM is 300+ AND 3.00%+. โ†’ [Network Programs](/docs/chargebacks/reference/network-programs) **EFM (Excessive Fraud Merchant)** : Mastercard's fraud-side program, separate from ECM and running alongside it. Four tests have to land in the same month: 1,000+ Mastercard transactions, $50,000+ in fraud claims, a 0.50%+ fraud-to-sales ratio, and 3DS coverage under 50% in regulated markets or 10% elsewhere. The 3DS test is the one you control directly. โ†’ [Network Programs](/docs/chargebacks/reference/network-programs) **EMV (Europay, Mastercard, Visa)** : Global standard for chip card payments providing enhanced security over magnetic stripe. โ†’ [EMV & Contactless](/docs/fraud/prevention/emv-contactless) --- ## F **False Positive** : A legitimate transaction incorrectly flagged or blocked as fraud. **First-Party Fraud** : Fraud committed by the actual customer using their own identity, with intent to defraud. โ†’ [First-Party Fraud](/docs/fraud/types/first-party) **Friendly Fraud** : Legitimate cardholder disputing a valid transaction they actually made. Also called "first-party misuse." โ†’ [Friendly Fraud](/docs/fraud/types/friendly-fraud) **FRR (First Ride Risk)** : Mastercard transit program allowing initial ride without prior authorization. --- ## G **GCMS (Global Clearing Management System)** : Mastercard's transaction clearing system. **GMAP (Global Merchant Audit Program)** : Mastercard's merchant audit program, **suspended since 15 October 2020**. Its 3%, 5% and 8% tiers get quoted as live thresholds. They aren't, and they were never enforced at those levels. Reason code 4849 belongs to QMAP, not GMAP. A relaunch dated 1 April 2027 has been reported and Mastercard hasn't confirmed it. โ†’ [Mastercard GMAP](/docs/chargebacks/reference/gmap) --- ## I **Identity Check** : Mastercard's brand name for 3D Secure authentication. โ†’ [3D Secure](/docs/fraud/prevention/3ds) **Interchange** : Fee paid by merchant's acquiring bank to cardholder's issuing bank for each transaction. Blends to about 0.89% + $0.158 card-present and 1.36% + $0.152 online on a normal US card mix; individual cards run 0.05% + $0.21 to 3.15% + $0.10. โ†’ [Interchange](/docs/payments/reference/interchange) **IPM (Integrated Product Messages)** : Mastercard's clearing message format. **Issuer** : The bank that issues cards to consumers and is responsible for cardholder accounts. โ†’ [Payment Ecosystem](/docs/payments/payment-ecosystem) --- ## K **KBA (Knowledge-Based Authentication)** : Identity verification using questions only the user should know. **KYC (Know Your Customer)** : Process of verifying customer identity, required by regulations. โ†’ [AML Basics](/docs/compliance/aml-basics) --- ## L **Liability Shift** : Transfer of fraud loss responsibility between parties based on EMV/3DS compliance. When implemented correctly, liability shifts from merchant to issuer. โ†’ [3D Secure](/docs/fraud/prevention/3ds) | [EMV Liability](/docs/fraud/reference/emv-liability) --- ## M **Mastercom** : Mastercard's online dispute management platform. **MCC (Merchant Category Code)** : Four-digit code classifying merchants by business type. โ†’ [MCC Codes](/docs/reference/mcc-codes) **MERP (Merchant Elevated Risk Program)** : Visa's program for merchants showing unusual activity, **AP Region only**, effective 9 April 2026. The thresholds live in the Merchant Elevated Risk Program Guide, which goes to acquirers and not to you. Visa can order your acquirer, or you, to deploy remediation tools. The assessments land on the acquirer: USD 25,000 on a first identification and USD 50,000 on a repeat with the same acquirer, then monthly charges, then risk reduction requirements. Source: Visa Core Rules and Visa Product and Service Rules, 18 April 2026, sections 10.4.4.4 and 12.5.8.1. **MFA (Multi-Factor Authentication)** : Authentication requiring multiple verification methods. **MIT (Merchant Initiated Transaction)** : A transaction initiated by the merchant without cardholder interaction, such as recurring billing. โ†’ [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) **Metro 2** : Standard format for reporting credit information to bureaus. --- ## N **No-Show** : Hotel/travel charge when customer makes reservation but doesn't arrive and doesn't cancel. --- ## P **PAN (Primary Account Number)** : Full card number, typically 16 digits. **PCI DSS (Payment Card Industry Data Security Standard)** : Security standard for handling cardholder data. โ†’ [PCI-DSS Compliance](/docs/compliance/pci-dss) **PDS (Private Data Subelements)** : Mastercard's extended data fields in ISO messages. **PII (Personally Identifiable Information)** : Data that can identify a specific individual. **POI (Point of Interaction)** : Location/device where card transaction occurs (terminal, website, etc.). **Pre-Arbitration** : Dispute stage after representment where issuer challenges merchant's response before arbitration. โ†’ [Chargeback Lifecycle](/docs/chargebacks/lifecycle) --- ## Q **QMAP (Questionable Merchant Audit Program)** : Mastercard's audit program for merchants with fraud patterns it wants to look at directly. It isn't a ratio program. Reason code 4849 is QMAP's, not GMAP's, and a MATCH listing under QMAP goes in as code 08. โ†’ [Network Programs](/docs/chargebacks/reference/network-programs) --- ## R **RDR (Rapid Dispute Resolution)** : Visa's program allowing pre-dispute resolution before chargebacks file. โ†’ [Chargeback Alerts](/docs/chargebacks/prevention/alerts) **Reason Code** : Code indicating the specific category/reason for a chargeback. โ†’ [Reason Codes Reference](/docs/reference/reason-codes) **Representment** : Merchant's response to a chargeback with evidence disputing the claim. Also called "second presentment" (Mastercard). โ†’ [Representment Workflow](/docs/operations/representment-workflow) **ROC (Record of Charge)** : American Express's term for transaction record. --- ## S **SafeKey** : American Express's brand name for 3D Secure authentication. โ†’ [3D Secure](/docs/fraud/prevention/3ds) **SCA (Strong Customer Authentication)** : EU requirement under PSD2 for multi-factor authentication on certain transactions. โ†’ [3D Secure](/docs/fraud/prevention/3ds) **Second Presentment** : Mastercard's term for representment - merchant's response to a chargeback. **SLI (Security Level Indicator)** : Mastercard's indicator of authentication level. Values: 1 = first-party authenticated, 2 = delegated authentication. **SMMP (Scam Merchant Monitoring Program)** : Mastercard's scam programme for card-not-present merchants, enforceable since 24 July 2026. It isn't part of ACMP and it isn't a ratio program. It obliges your acquirer to open an investigation within 72 hours of a trigger, and the only outcome is that Mastercard and Maestro acceptance stops. No fines, no ladder, no grace period. Refunds and chargebacks get added together, so refunding to protect your chargeback ratio feeds this one. โ†’ [Scam Merchant Monitoring](/docs/chargebacks/reference/scam-merchant-monitoring) **Stand-In** : Network-level authorization when issuer is unavailable. **Synthetic Identity** : Fabricated identity mixing real and fake data. It belongs to no real person. โ†’ [Synthetic Identity Fraud](/docs/fraud/types/synthetic-identity) --- ## T **Third-Party Fraud** : Fraud committed using stolen identity of an innocent victim. โ†’ [Third-Party Fraud](/docs/fraud/types/third-party) **TLID (Transaction Link Identifier)** : Mastercard's identifier linking related transactions. **3DS (3D Secure)** : Authentication protocol for card-not-present transactions providing liability shift. โ†’ [3D Secure Guide](/docs/fraud/prevention/3ds) --- ## U **UCAF (Universal Cardholder Authentication Field)** : Mastercard's authentication data field containing AAV and authentication details. --- ## V **VAU (Visa Account Updater)** : Visa's service that automatically updates stored card credentials. **VCR (Visa Claims Resolution)** : Visa's dispute resolution system including Allocation and Collaboration workflows. โ†’ [Chargeback Lifecycle](/docs/chargebacks/lifecycle) **VDMP (Visa Dispute Monitoring Program)** : Visa's program monitoring merchants exceeding dispute thresholds. Now consolidated into VAMP. โ†’ [Network Programs](/docs/chargebacks/reference/network-programs) **Velocity** : Rate of transactions or activities over time. Velocity rules detect unusual transaction patterns. โ†’ [Velocity Rules](/docs/fraud/detection/velocity-rules) **VFMP (Visa Fraud Monitoring Program)** : Visa's program monitoring merchants exceeding fraud thresholds. Now consolidated into VAMP. The name survives only on dispute condition 10.5, which is still live. โ†’ [Network Programs](/docs/chargebacks/reference/network-programs) **VFMP-3DS (Visa Fraud Monitoring Program for 3-D Secure)** : A separate US-only track that measured fraud on your Visa Secure traffic alone. Being in it cost you the 3DS liability shift, which is the whole reason you turned 3DS on. **Retired 1 April 2025**, folded into VAMP along with VDMP, VFMP and DGMFM. Fraud on authenticated transactions now just lands in the one VAMP ratio. Reported thresholds while it ran were 0.5% and $5,000 for early warning, 0.75% and $7,500 for the standard program. Those come from vendor write-ups, not from Visa, and sources disagree on whether fines ever applied. If a vendor quotes VFMP-3DS at you today, they're selling against a program that closed over a year ago. โ†’ [Network Programs](/docs/chargebacks/reference/network-programs) **Visa Secure** : Visa's brand name for 3D Secure authentication. โ†’ [3D Secure](/docs/fraud/prevention/3ds) **VROL** : Visa Resolve Online - Visa's dispute management platform. --- ## X **X-Code** : Network authorization when issuer declines but network approves based on risk assessment. --- --- ## See Also - [Acronyms](/docs/reference/acronyms) - Abbreviation lookup - [Reason Codes](/docs/reference/reason-codes) - Chargeback categories - [Decline Codes](/docs/reference/decline-codes) - Authorization failures - [Time Frames](/docs/reference/time-frames) - Response deadlines - [MCC Codes](/docs/reference/mcc-codes) - Merchant category codes - [Benchmarks](/docs/reference/benchmarks) - Industry standards - [Fraud Types Overview](/docs/fraud/types) - Detailed fraud definitions - [Chargeback Overview](/docs/chargebacks) - Dispute process explained - [Payments Overview](/docs/payments) - Transaction fundamentals - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM details --- ## Reference Source: https://paymentsandrisk.com/docs/reference # Reference :::info[TL;DR] - Quick lookups, not learning. Find the code, the threshold or the deadline and get back to work - [Decline Codes](/docs/reference/decline-codes) for why a transaction failed. [Reason Codes](/docs/reference/reason-codes) for why a chargeback was filed - [Time Frames](/docs/reference/time-frames) for how long you have to respond. Miss that window and you lose automatically - Want the concepts instead? Start at [Payments](/docs/payments), [Chargebacks](/docs/chargebacks) or [Fraud](/docs/fraud) ::: ## How to Use This Section Find what you're after: | Scenario | Go To | |----------|-------| | **Transaction declined, need to know why** | [Decline Codes](/docs/reference/decline-codes) | | **Got a chargeback, need the reason code meaning** | [Reason Codes](/docs/reference/reason-codes) | | **Need to know how long you have to respond** | [Time Frames](/docs/reference/time-frames) | | **Saw an acronym you don't know** | [Acronyms](/docs/reference/acronyms) or [Glossary](/docs/reference/glossary) | | **Want to know if your metrics are normal** | [Benchmarks](/docs/reference/benchmarks) | | **ACH payment bounced** | [ACH Return Codes](/docs/reference/return-codes/ach) | **Need the why, not the code?** Start here: - [Payments](/docs/payments) - How transactions work - [Chargebacks](/docs/chargebacks) - Dispute process explained - [Fraud](/docs/fraud) - Prevention and detection --- :::info[Typical Range Disclaimer] Everything marked "Typical" here assumes US domestic transactions at standard risk. Your numbers will differ. MCC, customer base, transaction mix and geography all move them. ::: :::note[What's Not Covered Yet] This site doesn't yet cover in depth: - Marketplace/PayFac operations and compliance - Crypto and stablecoin payments - Cross-border payout optimization - Card program management (issuer-side deep dives) Might add them later, might not. ::: --- Popular --- What You Need Right Now [ โ“ "Why was this declined?" Decline codes explain authorization failures ](/docs/reference/decline-codes) [ โ“ "What's this reason code?" Reason codes explain chargeback categories ](/docs/reference/reason-codes) [ โ“ "When do I have to respond?" Deadlines by network and stage ](/docs/reference/time-frames) [ โ“ "What does this mean?" Acronyms: AVS, CVV, ARN, TC40... ](/docs/reference/acronyms) --- Card Networks Card networks make the rules. Which one you're on decides your thresholds and programs. [ ๐ŸŒ Card Networks Overview Visa, Mastercard, Amex, Discover - who does what and which rules matter ](/docs/reference/card-networks) [ ๐Ÿ’ณ Visa VAMP program, 30-day response, processors flag at ~0.9% ](/docs/reference/card-networks/visa) [ ๐Ÿ”ด Mastercard ECM 1.5% threshold, 45-day response, MATCH list operator ](/docs/reference/card-networks/mastercard) [ ๐Ÿ”ต American Express Closed-loop, inquiry process, 20-day response, premium cardholders ](/docs/reference/card-networks/amex) [ ๐ŸŸ  Discover Smallest network, ~1.0% threshold, 20-30 day response ](/docs/reference/card-networks/discover) --- Reason Codes by Network Every chargeback has a code. The code tells you why. It also tells you what evidence you'll need to fight it. [ ๐Ÿ’ณ Visa 10.4 (fraud), 13.1 (not received), 13.2 (cancelled recurring) ](/docs/reference/reason-codes/visa) [ ๐Ÿ”ด Mastercard 4837 (fraud), 4853 (dispute), 4834 (POI error) ](/docs/reference/reason-codes/mastercard) [ ๐Ÿ”ต Amex F29 (fraud), C08 (goods not received), C28 (cancelled recurring) ](/docs/reference/reason-codes/amex) [ ๐ŸŸ  Discover UA02 (fraud), RG (not received), AP (recurring) ](/docs/reference/reason-codes/discover) --- Decline Codes [Decline Codes](/docs/reference/decline-codes) - why an authorization failed, and what you can do about it. The ones you'll see constantly: - **05** (Do Not Honor) - the issuer's shrug. A retry sometimes works - **51** (Insufficient Funds) - there's no money there - **14** (Invalid Card Number) - a typo, or a test card - **54** (Expired Card) - you'll need a fresh card on file --- ACH Return Codes [ACH Return Codes](/docs/reference/return-codes/ach) - why ACH payments bounce. The ones that matter: - **R01** (Insufficient Funds) - the common one. You can retry - **R10** (Unauthorized) - it's the ACH chargeback. 60 days - **R29** (Corporate Unauthorized) - R10's corporate twin --- Response Deadlines [Time Frames](/docs/reference/time-frames) - miss one and you've lost automatically. | Network | Representment | Pre-Arb | Arbitration | |---------|--------------|---------|-------------| | Visa | 30 days | 30 days | 45 days | | Mastercard | 45 days | 30 days | 45 days | | Amex | 20 days | 45 days | N/A | | Discover | 30 days | N/A | N/A | --- Terminology [ ๐Ÿ“– Glossary Definitions and terminology ](/docs/reference/glossary) [ ๐Ÿ”ค Acronyms AVS, CVV, ARN, TC40, etc. ](/docs/reference/acronyms) [ ๐Ÿ” Fraud Classification Identify fraud types and responses ](/docs/reference/fraud-classification) --- ## Next Steps Looking up a code? [Decline Codes](/docs/reference/decline-codes) - Auth failures [Reason Codes](/docs/reference/reason-codes) - Chargeback categories [ACH Return Codes](/docs/reference/return-codes/ach) - Bank returns Need context? [Payments Overview](/docs/payments) - How transactions work [Chargebacks Overview](/docs/chargebacks) - Dispute process [Fraud Types](/docs/fraud/types) - Threat landscape Building a process? [Benchmarks](/docs/reference/benchmarks) - What "good" looks like [Time Frames](/docs/reference/time-frames) - Critical deadlines [Experimentation](/docs/reference/experimentation) - Test safely --- ## See Also [๐Ÿ’ณ Payments](/docs/payments) [๐Ÿ’ฐ Chargebacks](/docs/chargebacks) [๐Ÿ” Fraud Types](/docs/fraud/types) [๐Ÿ“‹ Compliance](/docs/compliance) - [Fraud Prevention](/docs/fraud/prevention) - Stopping fraud - [Operations](/docs/operations) - Operational processes - [Playbooks](/docs/playbooks) - Step-by-step guides - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [3D Secure](/docs/fraud/prevention/3ds) - Authentication - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification signals - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking disputes - [Fraud Metrics](/docs/fraud/metrics) - Measuring performance --- ## American Express Reason Codes Source: https://paymentsandrisk.com/docs/reference/reason-codes/amex # American Express Reason Codes :::info[TL;DR] - Amex uses a letter-and-number system: F for fraud, A for authorization, P for processing, C for consumer disputes - F29 card-not-present fraud, C08 not received and C28 cancelled recurring are the ones you'll actually meet - You get 20 days to respond. That's the shortest window of any network, so build the packet the day the notice arrives - Amex issues its own cards, so there's no separate issuer to argue with ::: You've got an Amex notice with a code on it. Find the code below, then start the packet. The three you'll actually meet are F29, C08 and C28. Each has its own page. ### Deep-Dive Guides - **[F29 - Card Not Present Fraud](/docs/reference/reason-codes/amex/f29-cnp-fraud)** - Unauthorized CNP transaction (most common Amex fraud code) - **[C08 - Goods/Services Not Received](/docs/reference/reason-codes/amex/c08-not-received)** - Merchandise or services never delivered - **[C28 - Cancelled Recurring Billing](/docs/reference/reason-codes/amex/c28-cancelled-recurring)** - Subscription dispute after cancellation ## Code Categories ### Fraud (F Series) | Code | Name | Description | |------|------|-------------| | F10 | Missing Imprint | Card imprint not obtained | | F14 | Missing Signature | Transaction lacks signature | | F24 | No Cardholder Authorization | Cardholder denies participating | | [F29](/docs/reference/reason-codes/amex/f29-cnp-fraud) | Card Not Present Fraud | Unauthorized CNP transaction | | F30 | EMV Counterfeit | Counterfeit chip card | | F31 | EMV Lost/Stolen/NRI | Lost, stolen, or never received card | ### Authorization (A Series) | Code | Name | Description | |------|------|-------------| | A01 | Charge Amount Exceeds Authorization | Amount differs from auth | | A02 | No Valid Authorization | Authorization not obtained | | A08 | Authorization Approval Expired | Auth expired before clearing | ### Processing (P Series) | Code | Name | Description | |------|------|-------------| | P01 | Unassigned Card Number | Invalid card number | | P03 | Credit Processed as Charge | Credit/debit confusion | | P04 | Credit Not Processed | Refund not received | | P05 | Charge Amount Incorrect | Wrong amount charged | | P07 | Late Submission | Transaction submitted too late | | P08 | Duplicate Charge | Same transaction charged twice | | P22 | Non-Matching Card Number | Card number discrepancy | | P23 | Currency Discrepancy | Wrong currency charged | ### Consumer (C Series) | Code | Name | Description | |------|------|-------------| | C02 | Credit Not Processed | Expected refund not received | | C04 | Goods/Services Returned | Return not credited | | C05 | Goods/Services Cancelled | Cancellation not credited | | [C08](/docs/reference/reason-codes/amex/c08-not-received) | Goods/Services Not Received | Merchandise never arrived | | C14 | Paid by Other Means | Duplicate payment | | C18 | "No Show" or CARDeposit Cancelled | Hotel/travel dispute | | [C28](/docs/reference/reason-codes/amex/c28-cancelled-recurring) | Cancelled Recurring Billing | Subscription dispute | | C31 | Goods/Services Not as Described | Quality/description dispute | | C32 | Goods/Services Damaged/Defective | Defect dispute | ## Response Time Frames :::warning[Shorter Windows] American Express has **shorter response windows** than Visa/Mastercard. ::: | Stage | Window | |-------|--------| | Inquiry response | **20 calendar days** | | Chargeback response | **20 calendar days** | | Documentation request | **10 calendar days** | ## Inquiry Process Amex often sends inquiries before chargebacks: ```mermaid flowchart LR A[Inquiry Received] --> B[20 days to respond] B --> C{Response?} C -->|Yes| D[Inquiry Closedor Chargeback] C -->|No| E[Automatic Chargeback] style A fill:#6366f1,color:#fff style E fill:#ef4444,color:#fff ``` ## Key Differences from Visa/MC | Factor | Amex | Visa/MC | |--------|------|---------| | Response time | 20 days | 30-45 days | | Inquiry process | Common | Less common | | Dispute platform | Amex merchant portal | VROL/Mastercom | | Liability shift | SafeKey (3DS) | 3DS | ## SafeKey (3D Secure) Authenticate through SafeKey and fraud liability moves to the issuer. ECI 05 means fully authenticated. You've got to be enrolled properly first. It doesn't always hold. Certain MCC categories and transactions under the threshold fall outside it. So do technical failures. ## Documentation Requirements ### For Fraud Disputes (F Series) - SafeKey authentication data - AVS/CVV results - Delivery confirmation - Customer communication ### For Consumer Disputes (C Series) - Terms and conditions - Delivery/service proof - Refund documentation - Communication records ## Win Rate Expectations | Code Type | With Evidence | Without Evidence | |-----------|---------------|------------------| | F29 (SafeKey) | 70-85% | - | | F29 (no SafeKey) | 30-45% | Under 15% | | C08 (delivery proof) | 60-75% | Under 20% | | C28 (consent docs) | 50-65% | Under 20% | ## Popular in This Section - **[F29 - CNP Fraud](/docs/reference/reason-codes/amex/f29-cnp-fraud)** - Unauthorized card-not-present transaction - **[C08 - Not Received](/docs/reference/reason-codes/amex/c08-not-received)** - Merchandise never arrived - **[C28 - Cancelled Recurring](/docs/reference/reason-codes/amex/c28-cancelled-recurring)** - Subscription dispute - **[SafeKey (3DS)](#safekey-3d-secure)** - Liability shift for Amex ## Related Resources - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Time Frames Reference](/docs/reference/time-frames) - Response deadlines - [3D Secure Implementation](/docs/fraud/prevention/3ds) - SafeKey authentication - [Visa Reason Codes](/docs/reference/reason-codes/visa) - Visa code comparison - [Mastercard Reason Codes](/docs/reference/reason-codes/mastercard) - MC code comparison - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflection tools - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address verification - [Recurring Billing](/docs/compliance/subscriptions/recurring-billing) - Subscription rules - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis response --- ## Discover Reason Codes Source: https://paymentsandrisk.com/docs/reference/reason-codes/discover # Discover Reason Codes :::info[TL;DR] - Discover uses 2-4 character alphanumeric codes grouped by type - UA is fraud, AT and AW are authorization, DP and IN are processing errors, RM, RG and NF are consumer disputes - UA02 card-not-present fraud, RG non-receipt and AP cancelled recurring cover most of what you'll see - You get 30 days to respond. Discover issues its own cards, so the network and the issuer are the same party ::: You've got a Discover notice with a code on it. Find the code below. The three you'll actually meet are UA02, RG and AP. Each has its own page. ### Deep-Dive Guides - **[UA02 - Fraud: Card Not Present](/docs/reference/reason-codes/discover/ua02-cnp-fraud)** - Unauthorized CNP transaction (most common Discover fraud code) - **[RG - Non-Receipt of Goods/Services](/docs/reference/reason-codes/discover/rg-non-receipt)** - Merchandise or services never delivered - **[AP - Cancelled Recurring Payments](/docs/reference/reason-codes/discover/ap-cancelled-recurring)** - Subscription dispute after cancellation ## Code Categories ### Fraud (UA Series) | Code | Name | Description | |------|------|-------------| | UA01 | Fraud - Card Present | Unauthorized CP transaction | | [UA02](/docs/reference/reason-codes/discover/ua02-cnp-fraud) | Fraud - Card Not Present | Unauthorized CNP transaction | | UA05 | Fraud - Chip Card | EMV counterfeit fraud | | UA06 | Fraud - Chip Card Lost/Stolen | EMV lost/stolen fraud | | UA10 | Request Transaction Receipt | Receipt request | | UA11 | Cardholder Claims Fraud | Fraud allegation | ### Authorization (AT/AW Series) | Code | Name | Description | |------|------|-------------| | AT | Authorization Non-Compliance | Auth requirements not met | | AW | Altered Amount | Cleared amount differs | ### Processing Errors (DP/IN Series) | Code | Name | Description | |------|------|-------------| | DP | Duplicate Processing | Charged twice | | IN | Invalid Card Number | Bad card number | | LP | Late Presentment | Delayed clearing | | NC | Non-Matching Account Number | Account mismatch | | PM | Paid by Other Means | Duplicate payment method | | RN1 | Account Number Discrepancy | Number doesn't match | | RN2 | Credit Not Posted | Refund missing | ### Consumer Disputes (RM/RG/NF Series) | Code | Name | Description | |------|------|-------------| | RM | Quality/Not as Described | Merchandise dispute | | [RG](/docs/reference/reason-codes/discover/rg-non-receipt) | Non-Receipt of Goods/Services | Not delivered | | NF | Non-Receipt of Cash from ATM | ATM dispute | | [AP](/docs/reference/reason-codes/discover/ap-cancelled-recurring) | Cancelled Recurring | Subscription dispute | | CD | Credit Documentation | Credit dispute | | CR | Cancelled Reservation | Hotel/travel cancellation | ## Response Time Frames | Stage | Window | |-------|--------| | Retrieval request | 14 calendar days | | Chargeback response | 30 calendar days | | Second chargeback | 30 calendar days | ## Retrieval Requests Discover often sends a retrieval request before the chargeback: ```mermaid flowchart LR A[Retrieval Request] --> B[14 days to respond] B --> C{Receipt provided?} C -->|Yes| D[May resolveor Chargeback] C -->|No| E[Chargeback] style A fill:#6366f1,color:#fff style E fill:#ef4444,color:#fff ``` Send the receipt. Add anything else that documents the sale. You've got 14 days. Ignore it and the retrieval turns into a chargeback. ## ProtectBuy (3D Secure) Discover's 3D Secure is branded ProtectBuy. The ECI values match Visa's. Authenticate the transaction and fraud liability moves to the issuer. ### ECI Values | ECI | Meaning | Liability | |-----|---------|-----------| | 05 | Fully authenticated | Issuer | | 06 | Attempted | Reduced merchant | | 07 | Not authenticated | Merchant | ## Documentation Requirements ### For Fraud (UA Series) - ProtectBuy authentication - AVS/CVV verification - Delivery confirmation - Transaction records ### For Non-Receipt (RG) - Tracking number - Delivery confirmation - Signature if available - Shipping address verification ### For Recurring (AP) - Original consent - Terms and conditions - Cancellation policy - Transaction before cancel date ## Win Rate Expectations | Code | With Evidence | Without Evidence | |------|---------------|------------------| | UA02 (ProtectBuy) | 70-85% | - | | UA02 (no 3DS) | 30-45% | Under 15% | | RG (delivery proof) | 60-75% | Under 20% | | AP (consent docs) | 50-65% | Under 20% | ## Key Differences | Factor | Discover | Visa/MC | |--------|----------|---------| | Code format | 2-4 chars | Numbers | | Retrieval use | Common | Less common | | Response time | 30 days | 30-45 days | | 3DS brand | ProtectBuy | Visa Secure/Identity Check | ## Popular in This Section - **[UA02 - CNP Fraud](/docs/reference/reason-codes/discover/ua02-cnp-fraud)** - Unauthorized card-not-present transaction - **[RG - Non-Receipt](/docs/reference/reason-codes/discover/rg-non-receipt)** - Goods/services not delivered - **[AP - Cancelled Recurring](/docs/reference/reason-codes/discover/ap-cancelled-recurring)** - Subscription dispute - **[ProtectBuy (3DS)](#protectbuy-3d-secure)** - Discover's 3D Secure program ## Related Resources - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Time Frames Reference](/docs/reference/time-frames) - Response deadlines - [3D Secure Implementation](/docs/fraud/prevention/3ds) - ProtectBuy authentication - [Visa Reason Codes](/docs/reference/reason-codes/visa) - Visa code comparison - [Mastercard Reason Codes](/docs/reference/reason-codes/mastercard) - MC code comparison - [Amex Reason Codes](/docs/reference/reason-codes/amex) - Amex code comparison - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflection tools - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address verification - [Recurring Billing](/docs/compliance/subscriptions/recurring-billing) - Subscription rules --- ## Chargeback Reason Codes Source: https://paymentsandrisk.com/docs/reference/reason-codes # Chargeback Reason Codes :::info[TL;DR] - **Fraud codes**: Visa 10.4, Mastercard 4837, Amex F29, Discover UA02. Fight with [3DS](/docs/fraud/prevention/3ds), [CE 3.0](/docs/chargebacks/representment/compelling-evidence) - **Not received**: Visa 13.1, Mastercard 4853/4855, Amex C08. Need delivery proof - **Cancelled recurring**: Visa 13.2, Mastercard 4853, Amex C28. Need original consent + terms - **Response deadlines**: Amex 20 days, Visa 30 days, Mastercard 45 days - Match your evidence to the specific code. Generic responses don't win ::: Every chargeback arrives with a reason code that tells you why the customer's bank reversed the charge. Match your response to the code, or you'll lose. A generic evidence packet loses no matter which of these codes it's answering. :::tip[New to chargebacks?] Looking up a specific code? You're in the right place. Want chargebacks from the ground up instead, including causes, cost, and how to respond? **[Start with What Is a Chargeback?](/docs/chargebacks)** ::: ## By Network ### [Mastercard Reason Codes](./mastercard) Mastercard runs on four-digit codes, grouped by category: | Code | Category | Common Issues | |------|----------|---------------| | **4808** | Authorization | Auth not obtained properly | | **4834** | Point of Interaction | Processing errors, duplicates | | **4837** | Fraud | Cardholder denies authorization | | **4853** | Cardholder Dispute | Goods/services issues | | **4863** | Recognition | Cardholder doesn't recognize | | **4870** | Chip Liability | EMV counterfeit fraud | | **4871** | Chip Lost/Stolen | Chip card lost/stolen/NRI | ### [Visa Reason Codes](./visa) Visa's numbering is two-part, Category.Subcategory: | Category | Description | Key Codes | |----------|-------------|-----------| | **10.x** | Fraud | 10.4 CNP fraud, 10.5 VFMP | | **11.x** | Authorization | 11.1-11.3 auth issues | | **12.x** | Processing Errors | 12.1-12.7 various errors | | **13.x** | Consumer Disputes | 13.1-13.9 goods/services | ### [American Express Reason Codes](./amex) Amex mixes letters and numbers, with the letter carrying the category: | Series | Category | Examples | |--------|----------|----------| | **F** | Fraud | F10, F14, F24, F29 | | **A** | Authorization | A01, A02, A08 | | **P** | Processing | P01-P23 | | **C** | Consumer | C02-C32 | ### [Discover Reason Codes](./discover) Discover uses 2-letter codes, grouped the same four ways: | Code | Category | Description | |------|----------|-------------| | **UA** | Fraud | Unauthorized transaction | | **AT/AW** | Authorization | Auth issues | | **DP/IN** | Processing | Errors | | **RM/RG/NF** | Consumer | Goods/services | ## Code Categories at a Glance ### Fraud Codes | Network | Primary Fraud Code | |---------|-------------------| | Mastercard | 4837 | | Visa | 10.4 | | Amex | F29 | | Discover | UA02 | ### Non-Receipt Codes | Network | Not Received Code | |---------|------------------| | Mastercard | 4853 (category) | | Visa | 13.1 | | Amex | C08 | | Discover | RG | ### Cancelled Recurring Codes | Network | Recurring Code | |---------|---------------| | Mastercard | 4853 (category) | | Visa | 13.2 | | Amex | C28 | | Discover | AP | ## Cross-Network Comparison ### Response Time Frames Deadlines differ by network, so work the shortest window first rather than the order they arrived. That means Amex, at 20 days. | Network | Representment Window | |---------|---------------------| | Mastercard | 45 days (varies by region) | | Visa | 30 days | | Amex | 20 days | | Discover | 30 days | ### Liability Shift (3DS) | Network | Full Shift Code | |---------|----------------| | Mastercard | SLI 1 or 2 | | Visa | ECI 05 | | Amex | ECI 05 | | Discover | ECI 05 | ## Popular in This Section - **[Visa Reason Codes](./visa)** - 10.x fraud, 11.x auth, 12.x processing, 13.x consumer - **[Mastercard Reason Codes](./mastercard)** - 4808, 4834, 4837, 4853 and more - **[Cross-Network Comparison](#cross-network-comparison)** - Response times and liability shift ## Related Resources - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements by code - [Time Frames Reference](/docs/reference/time-frames) - Response deadlines - [Network Monitoring Programs](/docs/chargebacks/monitoring/thresholds) - VAMP, ECM thresholds - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before filing - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN - [3D Secure](/docs/fraud/prevention/3ds) - Authentication and liability shift - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Fraud Classification](/docs/reference/fraud-classification) - Identify fraud types - [Decline Codes](/docs/reference/decline-codes) - Authorization failure reasons - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis response --- ## Mastercard Chargeback Reason Codes (Complete 2026 Reference) Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard # Mastercard Reason Codes :::info[TL;DR] - **Fraud (4837)**: [Primary fraud code](/docs/reference/reason-codes/mastercard/fraud). Cardholder denies authorization; fight with [compelling evidence](/docs/chargebacks/representment/compelling-evidence) - **Authorization (4807/4808)**: Card on warning bulletin or auth not obtained - **Cardholder Disputes (4853/4855)**: Goods not provided, not as described. Need delivery proof - **Chip Liability (4870/4871)**: [EMV liability shift](/docs/fraud/reference/emv-liability). Counterfeit or lost/stolen chip cards - **Chargeback window**: 90 days; Second presentment: 45 days ::: Every Mastercard dispute carries one of these codes. The code is the claim the cardholder made, and it's what decides the evidence you'll need. They're all below, from the Mastercard Chargeback Guide. ## Reason Code Categories ### Authorization Issues (4800s) | Code | Name | Description | |------|------|-------------| | [4807](./warning-bulletin) | Warning Bulletin File | Card on warning bulletin at transaction time | | [4808](./authorization) | Authorization-Related | Authorization required but not properly obtained | | [4812](./account-not-on-file) | Account Number Not on File | Transaction on invalid or closed account | ### Fraud (4830s-4870s) | Code | Name | Description | |------|------|-------------| | [4837](./fraud) | No Cardholder Authorization | Primary fraud code - cardholder denies participation | | [4863](./recognition) | Cardholder Does Not Recognize | Cardholder doesn't recognize the transaction | | [4870](./chip-liability) | Chip Liability Shift | Counterfeit chip card fraud | | [4871](./chip-lost-stolen) | Chip/PIN Lost/Stolen/NRI | Chip card lost, stolen, or never received | ### Point of Interaction Errors (4834) | Code | Name | Description | |------|------|-------------| | [4834](./poi-error) | Point of Interaction Error | Transaction processing errors at terminal | ### Cardholder Disputes (4853-4855) | Code | Name | Description | |------|------|-------------| | [4853](./cardholder-dispute) | Cardholder Dispute | Goods/services not provided, not as described, or other disputes | | [4854](./us-cardholder-dispute) | Cardholder Dispute (US Region) | US domestic catch-all dispute code | | [4855](./goods-not-provided) | Goods or Services Not Provided | Non-receipt of merchandise or services | ## Time Frame Quick Reference | Stage | Standard | ATM/Maestro Europe | |-------|----------|-------------------| | Chargeback | 90 days | 120 days | | Second Presentment | 45 days | 45 days | | Pre-Arbitration | 30 days | 30 days | | Arbitration | 45 days | 75 days | ## Regional Variations Time frames move by region, sometimes a lot. Don't count days off this table if you're outside the US - the individual code pages carry the detail. ### Shortened Windows - **Nigeria domestic**: 2 business days for representment - **Costa Rica domestic**: 10 calendar days for representment - **Tanzania domestic**: 20 calendar days for representment ## Popular in This Section - **[4837 - Fraud](./fraud)** - Primary fraud code (cardholder denies authorization) - **[4853 - Cardholder Dispute](./cardholder-dispute)** - Goods/services not provided or not as described - **[4808 - Authorization](./authorization)** - Auth not obtained properly - **[4834 - Processing Error](./poi-error)** - Duplicates and processing errors ## Related Resources - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Time Frames Reference](/docs/reference/time-frames) - Response deadlines - [Mastercard ECP Program](/docs/chargebacks/monitoring/thresholds) - Monitoring thresholds - [Visa Reason Codes](/docs/reference/reason-codes/visa) - Visa code comparison - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Ethoca for MC - [3D Secure](/docs/fraud/prevention/3ds) - Identity Check authentication - [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Chip liability - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification tools - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis response --- ## Visa Reason Codes Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa # Visa Reason Codes :::info[TL;DR] - **Fraud (10.x)**: [10.4 CNP Fraud](/docs/reference/reason-codes/visa/10-4-fraud-cnp) most common. Fight with [3DS](/docs/fraud/prevention/3ds), [CE 3.0](/docs/chargebacks/representment/compelling-evidence) - **Authorization (11.x)**: Auth declined/not obtained. Check your auth process - **Processing Errors (12.x)**: [12.6 Duplicate](/docs/reference/reason-codes/visa/12-6-duplicate) common. Check for double-processing - **Consumer Disputes (13.x)**: [13.1 Not Received](/docs/reference/reason-codes/visa/13-1-not-received), [13.2 Cancelled Recurring](/docs/reference/reason-codes/visa/13-2-cancelled-recurring) most common - **Response deadline**: 30 days from notification; cardholder has 120 days from transaction ::: Every Visa dispute arrives with a code. It's the cardholder's claim, and it's what decides which evidence wins. Find yours below. ## Reason Code Categories ### Fraud (10.x) | Code | Name | Description | |------|------|-------------| | [10.1](./10-1-emv-counterfeit) | EMV Liability Shift - Counterfeit | Counterfeit card at non-chip terminal | | [10.2](./10-2-emv-non-counterfeit) | EMV Liability Shift - Non-Counterfeit | Chip not read properly | | [10.3](./10-3-fraud-card-present) | Other Fraud - Card Present | Unauthorized CP transaction | | [10.4](./10-4-fraud-cnp) | Other Fraud - Card Not Present | Unauthorized CNP transaction | | [10.5](./10-5-vfmp) | Visa Fraud Monitoring Program | VFMP compliance | ### Authorization (11.x) | Code | Name | Description | |------|------|-------------| | [11.1](./11-1-card-recovery-bulletin) | Card Recovery Bulletin | Card on stop list | | [11.2](./11-2-declined-authorization) | Declined Authorization | Auth declined but processed | | [11.3](./11-3-no-authorization) | No Authorization | Auth not obtained | ### Processing Errors (12.x) | Code | Name | Description | |------|------|-------------| | [12.1](./12-1-late-presentment) | Late Presentment | Clearing delay | | [12.2](./12-2-incorrect-transaction-code) | Incorrect Transaction Code | Wrong transaction type | | [12.3](./12-3-incorrect-currency) | Incorrect Currency | Wrong currency charged | | [12.4](./12-4-incorrect-account) | Incorrect Account Number | Wrong account debited | | [12.5](./12-5-incorrect-amount) | Incorrect Amount | Amount discrepancy | | [12.6](./12-6-duplicate) | Duplicate Processing | Charged twice | | [12.7](./12-7-invalid-data) | Invalid Data | Data formatting issues | ### Consumer Disputes (13.x) | Code | Name | Description | |------|------|-------------| | [13.1](./13-1-not-received) | Merchandise/Services Not Received | Non-delivery | | [13.2](./13-2-cancelled-recurring) | Cancelled Recurring | Subscription not cancelled | | [13.3](./13-3-not-as-described) | Not as Described/Defective | Quality dispute | | [13.4](./13-4-counterfeit) | Counterfeit Merchandise | Authenticity dispute | | [13.5](./13-5-misrepresentation) | Misrepresentation | Misleading description | | [13.6](./13-6-credit-not-processed) | Credit Not Processed | Refund not received | | [13.7](./13-7-cancelled-merchandise) | Cancelled Merchandise/Services | Order cancelled | | [13.8](./13-8-original-credit) | Original Credit Transaction Not Accepted | Refund to wrong card | | [13.9](./13-9-non-receipt-cash) | Non-Receipt of Cash | ATM dispute | ## Time Frame Quick Reference | Stage | Standard Time Frame | |-------|-------------------| | Cardholder to Issuer | 120 days from transaction | | Issuer to Acquirer | 120 days from transaction | | Merchant Response | 30 days from notification | | Pre-Arbitration | 30 days from representment | | Arbitration | 45 days | ## Visa Claims Resolution (VCR) VCR runs disputes down two tracks. ### Allocation - Visa assigns liability straight from the rules - Some disputes never reach you at all - You don't get a say ### Collaboration - You send evidence - You've got 30 days - The evidence decides it ## Popular in This Section - **[10.4 - CNP Fraud](./10-4-fraud-cnp)** - Most common fraud code - **[13.1 - Not Received](./13-1-not-received)** - Non-delivery disputes - **[13.2 - Cancelled Recurring](./13-2-cancelled-recurring)** - Subscription disputes - **[12.6 - Duplicate](./12-6-duplicate)** - Double-charge processing errors ## Related Resources - [Compelling Evidence 3.0](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Time Frames Reference](/docs/reference/time-frames) - Response deadlines - [VAMP Programs](/docs/chargebacks/monitoring/thresholds) - Monitoring thresholds - [Mastercard Reason Codes](/docs/reference/reason-codes/mastercard) - MC code comparison - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR for Visa - [3D Secure](/docs/fraud/prevention/3ds) - Visa Secure authentication - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - CE 3.0 matching - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Verification tools - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis response --- ## Return Codes Source: https://paymentsandrisk.com/docs/reference/return-codes # Return Codes :::info[TL;DR] - Return codes tell you why a payment came back after it looked like it had worked - ACH is the one that matters for most merchants. Cards use [decline codes](/docs/reference/decline-codes) at auth and [reason codes](/docs/reference/reason-codes) at dispute - Retry rules differ by code. Some are safe to re-run, some are a NACHA violation if you do ::: Return codes indicate why a payment was returned or rejected after initial processing. ## ACH Return Codes See [ACH Return Codes](./ach) for the complete list of NACHA return reason codes. ### Most Common ACH Returns | Code | Name | Meaning | |------|------|---------| | R01 | Insufficient Funds | Account doesn't have enough money | | R02 | Account Closed | Bank account has been closed | | R03 | No Account/Unable to Locate | Account number is invalid | | R04 | Invalid Account Number | Account number structure is wrong | | R05 | Unauthorized Debit | Consumer claims they didn't authorize | | R07 | Authorization Revoked | Consumer revoked prior authorization | | R08 | Payment Stopped | Consumer placed a stop payment | | R10 | Customer Advises Unauthorized | Consumer claims entry is unauthorized | | R29 | Corporate Customer Advises Not Authorized | Business claims unauthorized | ## Popular in This Section - **[ACH Return Codes](./ach)** - Complete NACHA return reason codes - **[R01 - Insufficient Funds](#most-common-ach-returns)** - Account doesn't have enough money - **[R10 - Customer Advises Unauthorized](#most-common-ach-returns)** - Consumer claims unauthorized ## Related Resources - [Decline Codes](/docs/reference/decline-codes) - Authorization declines - [Reason Codes](/docs/reference/reason-codes) - Chargeback reason codes - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - ACH fundamentals - [Real-Time Payments](/docs/payments/payment-methods/real-time-payments) - RTP/FedNow - [Payments Metrics](/docs/payments/metrics) - Success rate tracking - [Fraud Detection](/docs/fraud/detection) - Fraud monitoring - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Settlement & Reconciliation](/docs/payments/settlement) - Funding flows - [AML Basics](/docs/compliance/aml-basics) - Compliance requirements --- ## Acronyms Source: https://paymentsandrisk.com/docs/reference/acronyms # Acronyms :::info[TL;DR] - Every abbreviation used across this site, A to Z - Covers payments, chargebacks, fraud and compliance in one list - Looking for a plain-English definition rather than an expansion? Use the [Glossary](/docs/reference/glossary) ::: Abbreviations used in payments, chargebacks, fraud, and risk management. --- ## A | Acronym | Full Term | |---------|-----------| | AAV | Accountholder Authentication Value | | ABU | Automatic Billing Updater (Mastercard) | | ACH | Automated Clearing House | | ACMP | Acquirer Chargeback Monitoring Program (Mastercard). The umbrella over ECM, HECM and EFM. It has no threshold of its own | | ACS | Access Control Server | | AML | Anti-Money Laundering | | API | Application Programming Interface | | ARN | Acquirer Reference Number | | ATO | Account Takeover | | AVS | Address Verification Service | ## B | Acronym | Full Term | |---------|-----------| | BIN | Bank Identification Number | | BRAM | Business Risk Assessment and Mitigation | | BSA | Bank Secrecy Act | ## C | Acronym | Full Term | |---------|-----------| | CAVV | Cardholder Authentication Verification Value | | CB | Chargeback | | CCPA | California Consumer Privacy Act | | CIT | Cardholder-Initiated Transaction | | CNP | Card Not Present | | CP | Card Present | | CDRN | Cardholder Dispute Resolution Network. Run by Verifi, a Visa company | | CVV/CVC | Card Verification Value/Code | ## D | Acronym | Full Term | |---------|-----------| | DCP | Discover Chargeback Program. An industry label, not a program Discover publishes. Discover states no ratio and no count anywhere | | DE | Data Element | | DFI | Depository Financial Institution | | DPD | Days Past Due | ## E | Acronym | Full Term | |---------|-----------| | ECI | Electronic Commerce Indicator | | ECM | Excessive Chargeback Merchant (Mastercard) | | ECOA | Equal Credit Opportunity Act | | ECP | Excessive Chargeback Program (Mastercard). The ECM and HECM tiers together | | EFM | Excessive Fraud Merchant (Mastercard). Four tests at once: 1,000+ transactions, $50K+ fraud, 0.50%+ fraud-to-sales, and thin 3DS coverage | | EFX | Equifax | | EMV | Europay, Mastercard, Visa | | EXP | Experian | ## F | Acronym | Full Term | |---------|-----------| | FCRA | Fair Credit Reporting Act | | FFIEC | Federal Financial Institutions Examination Council | | FIDO | Fast Identity Online | | FP | False Positive | | FRR | First Ride Risk | ## G | Acronym | Full Term | |---------|-----------| | GCMS | Global Clearing Management System | | GDPR | General Data Protection Regulation | | GLBA | Gramm-Leach-Bliley Act | | GMAP | Global Merchant Audit Program (Mastercard). **Suspended since 15 October 2020.** Its 3%/5%/8% tiers are history, not live thresholds | | GMR | Global Merchant Review (Amex) | ## H | Acronym | Full Term | |---------|-----------| | HECM | High Excessive Chargeback Merchant (Mastercard) | ## I | Acronym | Full Term | |---------|-----------| | ICP | Immediate Chargeback Program (Amex) | | IIN | Issuer Identification Number | | IP | Internet Protocol | | IPM | Integrated Product Messages | | ISO | Independent Sales Organization | ## K | Acronym | Full Term | |---------|-----------| | KBA | Knowledge-Based Authentication | | KYC | Know Your Customer | ## L | Acronym | Full Term | |---------|-----------| | LTV | Lifetime Value | ## M | Acronym | Full Term | |---------|-----------| | MATCH | Member Alert to Control High-Risk Merchants (Mastercard) | | MCC | Merchant Category Code | | MERP | Merchant Elevated Risk Program (Visa). AP Region only, effective 9 April 2026. Thresholds sit in a non-public guide | | MFA | Multi-Factor Authentication | | MID | Merchant ID | | MIT | Merchant-Initiated Transaction | | ML | Machine Learning | | MOTO | Mail Order/Telephone Order | ## N | Acronym | Full Term | |---------|-----------| | NACHA | National Automated Clearing House Association | | NRI | Never Received Issue | ## O | Acronym | Full Term | |---------|-----------| | ODFI | Originating Depository Financial Institution | | OFAC | Office of Foreign Assets Control | | OTP | One-Time Password | ## P | Acronym | Full Term | |---------|-----------| | PAN | Primary Account Number | | PCI DSS | Payment Card Industry Data Security Standard | | PDS | Private Data Subelements | | PII | Personally Identifiable Information | | PIN | Personal Identification Number | | POI | Point of Interaction | | POS | Point of Sale | | PSD2 | Payment Services Directive 2 | ## Q | Acronym | Full Term | |---------|-----------| | QMAP | Questionable Merchant Audit Program (Mastercard). Reason code 4849 belongs to QMAP, not to GMAP. MATCH code 08 is the QMAP listing | ## R | Acronym | Full Term | |---------|-----------| | RDR | Rapid Dispute Resolution. Also run by Verifi, a Visa company | | RDFI | Receiving Depository Financial Institution | | ROC | Record of Charge (Amex) / Report on Compliance | ## S | Acronym | Full Term | |---------|-----------| | SAQ | Self-Assessment Questionnaire | | SCA | Strong Customer Authentication | | SEC | SEC code (ACH transaction type) | | S/E | Service Establishment (Amex merchant) | | SLA | Service Level Agreement | | SLI | Security Level Indicator | | SMMP | Scam Merchant Monitoring Program (Mastercard). Enforceable since 24 July 2026. A 72-hour acquirer investigation, no fines and no ratio | | SSA | Social Security Administration | | SSN | Social Security Number | ## T | Acronym | Full Term | |---------|-----------| | TC | Transaction Code | | TILA | Truth in Lending Act | | TMF | Terminated Merchant File (Visa, an acquirer-held file, not the same as MATCH or VMSS) | | TLID | Transaction Link Identifier | | TOTP | Time-based One-Time Password | | TRA | Transaction Risk Analysis | | TU | TransUnion | ## U | Acronym | Full Term | |---------|-----------| | UCAF | Universal Cardholder Authentication Field | | UDAAP | Unfair, Deceptive, or Abusive Acts or Practices | ## V | Acronym | Full Term | |---------|-----------| | VAMP | Visa Acquirer Monitoring Program | | VAU | Visa Account Updater | | VCR | Visa Claims Resolution | | VDMP | Visa Dispute Monitoring Program (now part of VAMP) | | VFMP | Visa Fraud Monitoring Program (now part of VAMP) | | VFMP-3DS | Visa Fraud Monitoring Program for 3-D Secure. Retired 1 April 2025 into VAMP. While it ran, it stripped your 3DS liability shift | | VMSS | Visa Merchant Screening Service (Visa's shared terminated-merchant database, the real counterpart to MATCH) | | VROL | Visa Resolve Online | | V.I.T.A.L. | Visa Integrity Risk Analysis Tool | ## 3 | Acronym | Full Term | |---------|-----------| | 3DS | 3D Secure | --- ## Network-Specific Terms Quick Reference ### Mastercard | Term | Meaning | |------|---------| | Identity Check | 3DS brand name | | Second Presentment | Representment | | Central Site Business Date | Date reference for time frames | | Mastercom | Dispute platform | ### Visa | Term | Meaning | |------|---------| | Visa Secure | 3DS brand name | | Allocation | Auto-liability assignment | | Collaboration | Evidence-based resolution | | VROL | Dispute platform | ### American Express | Term | Meaning | |------|---------| | SafeKey | 3DS brand name | | ROC | Transaction record | | S/E | Merchant | ### Discover | Term | Meaning | |------|---------| | ProtectBuy | 3DS brand name | --- ## See Also - [Glossary](/docs/reference/glossary) - Full definitions - [Decline Codes](/docs/reference/decline-codes) - Authorization failures - [Reason Codes](/docs/reference/reason-codes) - Chargeback categories - [ACH Return Codes](/docs/reference/return-codes/ach) - Bank payment failures - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM - [3D Secure](/docs/fraud/prevention/3ds) - 3DS authentication details - [AML Basics](/docs/compliance/aml-basics) - KYC, BSA, OFAC explained - [PCI DSS](/docs/compliance/pci-dss) - Data security requirements - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, CDRN, Ethoca - [MCC Codes](/docs/reference/mcc-codes) - Merchant category codes - [Time Frames](/docs/reference/time-frames) - Dispute deadlines --- ## Payment Benchmarks: Auth Rates, Chargeback & Fraud (2026) Source: https://paymentsandrisk.com/docs/reference/benchmarks # Benchmarks (Operator Field Manual) :::info[TL;DR] - **Auth rate**: CNP 85-90% typical, CP 98-99%; Apple/Google Pay 92-97% - **Fraud rate**: CNP e-commerce 0.05-0.2%, digital goods 0.2-0.5%, travel 0.5-1.5% - **Chargeback ratio**: Under 0.5% healthy, 0.75-0.9% danger, over 0.9% crisis (Visa threshold) - **Refund rate**: 2-5% typical; refund-to-CB ratio should be 3-5:1 - Segment everything (CP vs. CNP, BIN, geo); trend over 4-8 weeks beats snapshots ::: **Key Fact:** Processors flag merchants around **0.9%** chargeback ratio (internal threshold). Visa's VAMP Merchant Excessive level is **1.5%** (2.2% in CEMEA only) with $8/dispute fines, and the non-compliant level is **0.5%**. Mastercard ECM triggers at **100-299 chargebacks AND a 1.50-2.99% ratio**, with fines up to $25,000/month at months 7-11. Above 300 and 3.00% you're in HECM instead. Stay under 0.5% to maintain a healthy buffer. Use anchors, not absolutes. Compare to yourself over time and by segment (CP vs CNP, method, BIN, geo). Your baseline matters more than industry averages. 85-90% CNP Auth Rate (typical US e-commerce) 98-99% CP Auth Rate (retail / in-person) 0.05-0.2% CNP Fraud Rate (e-commerce baseline) Under 0.9% Chargeback Ratio Safe Zone _Last verified: Dec 2025. Benchmarks shift with market conditions; recalibrate annually._ ## What Matters (5 bullets) - **Segment everything.** CP vs CNP, card brand, BIN/issuer, country, device. Aggregate numbers hide problems. - **Trend beats snapshot.** Direction over 4-8 weeks matters more than any single week. - **Read metrics together.** Auth, fraud, chargebacks, refunds, and alerts are interconnected. - **These ranges assume US domestic, mainstream MCCs.** High-risk verticals run hotter. - **Date your thresholds.** "Last verified" on any number you publish or operationalize. --- ## Authorization Rate Benchmarks ### Card-Not-Present (CNP) | Performance | Auth Rate | Notes | |-------------|-----------|-------| | Poor | Under 80% | Major issues: fix fraud rules, 3DS, or issuer relations | | Below average | 80-85% | Room for improvement | | Typical | 85-90% | Standard for US e-commerce | | Good | 90-93% | Well-optimized stack | | Excellent | 93-95% | Top of the range. Network tokens, retry logic, issuer work | ### Card-Present (CP) | Performance | Auth Rate | Notes | |-------------|-----------|-------| | Poor | Under 95% | Investigate terminal issues, connectivity | | Typical | 98-99% | Expected for retail | | Excellent | 99%+ | Fully optimized | ### By Payment Method ```mermaid %%{init: {'themeVariables': {'xyChart': {'titleColor': '#6366f1', 'plotColorPalette': '#6366f1'}}}}%% xychart-beta title "Typical Auth Rate by Payment Method" x-axis ["Cards CNP", "Cards CP", "Apple/Google Pay", "PayPal", "ACH"] y-axis "Auth Rate %" 80 --> 100 bar [87, 98, 94, 96, 99] ``` | Method | Typical Auth Rate | Notes | |--------|-------------------|-------| | Cards (CNP) | 85-90% | Varies heavily by BIN/issuer | | Cards (CP) | 98-99% | Chip/PIN highest | | Apple Pay/Google Pay | 92-97% | Tokenized, higher than raw cards | | PayPal | 95-98% | Account-to-account | | ACH | 99%+ | But watch returns | ### By Issuer Geography | Region | Typical Auth Rate | Notes | |--------|-------------------|-------| | US domestic | 88-93% | Baseline | | UK/EU | 85-90% | SCA friction may impact | | LATAM | 70-85% | Higher decline rates common | | APAC | 75-88% | Varies widely by country | | Cross-border | 5-15% lower | vs domestic acquiring | :::tip[Your Auth Rate Below 85%?] That's below typical for US e-commerce. Three things to check first: 1. **Pull your decline codes.** [Decline code reference](/docs/reference/decline-codes) shows what each code means and whether you can retry. 2. **Segment CP vs CNP.** If you're mixing them, your CNP number is worse than it looks. 3. **Check your 3DS configuration.** Over-triggering challenges tanks auth rates. See [3D Secure optimization](/docs/fraud/prevention/3ds). Already above 90%? You're doing well. Focus on [fraud rates](#fraud-rate-benchmarks) and [chargeback ratios](#chargeback-benchmarks) instead. ::: --- **Key Fact:** Typical CNP (online) authorization rates for US e-commerce are 85-90%. Apple Pay and Google Pay tokenized transactions achieve 92-97% because network tokens provide stronger issuer trust signals. If your auth rate is below 85%, check your decline codes, CP/CNP segmentation, and 3DS configuration first. ## Fraud Rate Benchmarks ### By Transaction Type | Type | Typical Fraud Rate | Alert Level | |------|-------------------|-------------| | CNP e-commerce | 0.05-0.2% | Over 0.3% = tighten rules | | CP retail | 0.01-0.05% | Over 0.1% = investigate | | Digital goods | 0.2-0.5% | Higher baseline expected | | Subscriptions | 0.1-0.3% | Monitor initial vs recurring | ### By Industry (CNP) ```mermaid %%{init: {'themeVariables': {'xyChart': {'titleColor': '#6366f1', 'plotColorPalette': '#ef4444'}}}}%% xychart-beta title "Typical Fraud Rate by Industry (bps)" x-axis ["Retail", "Luxury", "Digital", "Travel", "Gaming", "Crypto"] y-axis "Basis Points" 0 --> 200 bar [15, 55, 45, 100, 125, 200] ``` | Industry | Typical Fraud Rate | Notes | |----------|-------------------|-------| | General retail | 0.1-0.2% | Baseline | | Luxury/high-ticket | 0.3-0.8% | Attractive target | | Digital goods | 0.3-0.6% | No physical verification | | Travel | 0.5-1.5% | High-risk category | | Gaming/gambling | 0.5-2%+ | Varies with regulation | | Crypto/forex | 1-3%+ | Extreme high-risk | ### Fraud Detection Metrics | Metric | Good | Concerning | |--------|------|------------| | False positive rate | Under 1% | Over 2% hurts conversion | | Catch rate (true positive) | 60-80% | Under 50% = rules too weak | | Manual review rate | Under 5% | Over 10% = automation gaps | | Review-to-block rate | 20-40% | Too high = rules too loose | :::tip[Fraud Rate Above 0.3% (CNP)?] You're above the typical range for e-commerce. Start here: 1. **Identify the fraud type.** [First-party](/docs/fraud/types/first-party) vs [third-party](/docs/fraud/types/third-party) vs [ATO](/docs/fraud/types/account-takeover) require different responses. 2. **Check if you have risk scoring.** If not, that's your first investment. See [risk scoring](/docs/fraud/prevention/risk-scoring). 3. **Under $1M/year?** Your processor's built-in fraud tools are probably enough. Don't buy vendor tools yet. See [vendor landscape](/docs/fraud/vendors/landscape). Fraud rate under 0.1%? Make sure your [false positive rate](#fraud-detection-metrics) isn't too high. Blocking good customers costs more than fraud at low rates. ::: --- ## Chargeback Benchmarks ### Chargeback Ratio Thresholds | Ratio | Status | Action | |-------|--------|--------| | Under 0.5% | Healthy | Monitor normally | | 0.5-0.75% | Caution | Increase monitoring | | 0.75-0.9% | Danger | Active remediation needed | | 0.9-1.5% | Crisis | Processor action likely: reserves, pass-through fees, termination | | Over 1.5% | Network threshold breach | VAMP or ECM enrollment, once you also clear the count minimum | ### Network Program Thresholds | Network | Standard Threshold | Enhanced Threshold | |---------|-------------------|-------------------| | Visa (VAMP) | ~0.9% (processor-enforced) | 1.5% merchant excessive (2.2% in CEMEA) + 1,500 combined fraud reports + disputes | | Mastercard (ECM) | 100-299 disputes AND 1.50-2.99% | 300+ disputes AND 3.00%+ (HECM) | | American Express | No published number | - | | Discover | No published number | - | Amex and Discover both run closed loops, and neither prints a ratio. Amex says only that it acts when your chargeback count is "considered disproportionate" (_Merchant Reference Guide - U.S._, section 11.10). Discover's Merchant Operating Regulations say it can terminate you for "excessive returns or Disputes, as determined by us in our sole discretion". That's the whole standard. The 1.0% you'll see quoted for Discover across the web traces to no Discover document. We used to print it. It's gone. ### Chargeback Composition | Reason Type | Typical Share | Red Flag | |-------------|---------------|----------| | Fraud disputes | 50-70% | - | | Friendly fraud (explicitly classified) | 20-40% | Over 50% = evidence problem | | "Unrecognized" | 5-10% | Over 20% = descriptor issue | | Service/quality | 10-20% | Over 30% = product/CX problem | | Recurring billing | 5-15% | Over 25% = cancellation issue | *Note: These are reason-code-based categories. True [friendly fraud](/docs/fraud/types/friendly-fraud) (cardholder made the purchase but disputes) cuts across all categories and may represent 60-80% of total chargebacks for e-commerce merchants. That range is an industry estimate, not a measured figure.* :::tip[Chargeback Ratio Above 0.75%?] You're in the danger zone. Here's what to do based on where you are: - **0.75-0.9%**: Active remediation. [Reduce chargebacks fast](/docs/playbooks/reduce-chargebacks-fast) covers the highest-impact actions. - **Above 0.9%**: Program enrollment risk. [0.9% Panic Guide](/docs/chargebacks/zero-point-nine-panic) is the emergency playbook. - **Got your first chargeback?** Don't panic. [Your First Chargeback](/docs/chargebacks/your-first-chargeback) explains what it actually costs and when to worry. Check your [chargeback composition](#chargeback-composition) first. "Unrecognized" chargebacks above 20% means your billing descriptor is wrong. That's a 10-minute fix that can cut your ratio in half. ::: --- ## Refund Benchmarks ### Refund Rate | Rate | Interpretation | |------|----------------| | Under 2% | May be too restrictive; could increase disputes | | 2-5% | Typical for most merchants | | 5-10% | Higher but may be appropriate for some models | | Over 10% | Investigate product/CX issues | ### Refund-to-Chargeback Ratio | Ratio | Interpretation | |-------|----------------| | Under 2:1 | Refunding too little; disputes filling the gap | | 3-5:1 | Healthy balance | | 5-10:1 | Acceptable; strong refund policy | | Over 10:1 | May be over-refunding; investigate | --- ## Alert Performance Benchmarks ### Ethoca/CDRN/Verifi Metrics | Metric | Good | Target | |--------|------|--------| | Alert match rate | 30-50% | As high as possible | | Response time | Under 2 hours | Ideally automated | | Refund vs ignore | 80%+ refund | Depends on ticket size | | Prevented disputes | 20-40% reduction | Track before/after | ### Real-Time Alert Response | Response Time | Performance | |---------------|-------------| | Under 1 hour | Excellent | | 1-4 hours | Good | | 4-24 hours | Acceptable | | Over 24 hours | Missing value | --- ## By Business Model ### Subscriptions | Metric | Benchmark | |--------|-----------| | Initial auth rate | 80-85% | | Recurring auth rate | 90-95% | | Involuntary churn | Under 3% monthly | | Dunning recovery | 10-30% of failed | | Subscription fraud | 0.1-0.3% | ### Digital Goods | Metric | Benchmark | |--------|-----------| | Auth rate | 80-88% (more 3DS step-up) | | Fraud rate | 0.3-0.6% (higher baseline) | | Dispute win rate | 30-50% (harder to prove) | ### Physical Goods | Metric | Benchmark | |--------|-----------| | Auth rate | 85-92% | | Fraud rate | 0.1-0.2% | | Dispute win rate | 50-70% (delivery proof helps) | | "Not received" share | 20-40% of disputes | ### B2B | Metric | Benchmark | |--------|-----------| | Auth rate | 90-95% | | Fraud rate | Under 0.1% | | ACH return rate | Under 1% | | Invoice payment | Net-30 to Net-60 typical | --- ## Keyed Transaction Benchmarks (CP) | Keyed % of CP Volume | Status | |----------------------|--------| | Under 2% | Normal | | 2-5% | Investigate | | 5-10% | Problem | | Over 10% | Major red flag | High keyed rates may indicate: - Terminal issues - Card-not-present masquerading as CP - Employee fraud - Training gaps --- ## Benchmarks by Revenue Tier ($50K-$5M) Industry averages hide the reality that a $100K/year Etsy seller and a $3M/year DTC brand face completely different numbers. Here's what to expect at your size. | Metric | $50K-$250K/yr | $250K-$1M/yr | $1M-$5M/yr | |--------|---------------|---------------|-------------| | **Auth rate (CNP)** | 82-87% | 85-90% | 88-93% | | **Fraud rate** | 0.1-0.4% | 0.08-0.25% | 0.05-0.15% | | **Chargeback ratio** | 0.3-0.8% | 0.2-0.6% | 0.15-0.4% | | **Refund rate** | 3-8% | 2-5% | 2-4% | | **Processing cost** | 2.7-3.9% | 2.3-2.9% | 2.1-2.6% | | **Manual review rate** | 0% (no tools) | 2-5% | 5-10% | | **Reconciliation method** | Eyeball bank deposits | Spreadsheet | Semi-automated | **Why smaller merchants have worse numbers:** - **Auth rates** are lower because smaller merchants often lack network tokens, retry logic, and issuer relationships - **Fraud rates** are higher per transaction because fraudsters target merchants with weaker controls - **Chargeback ratios** are higher because a single dispute hits harder (10 chargebacks on 2,000 transactions = 0.5%) - **Processing costs** are higher mostly because of small tickets and flat-rate pricing, not because of weak negotiating leverage :::note[Where the processing-cost range comes from] The fixed per-transaction cents are what punish small merchants, and they don't shrink with volume. Square's Free plan is 2.6% + 15c card present and 3.3% + 30c online ([squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02). Work through the effective rate: | Average ticket | Card present, 2.6% + 15c | Online, 3.3% + 30c | |----------------|--------------------------|--------------------| | $25 | 3.20% | 4.50% | | $50 | 2.90% | 3.90% | | $100 | 2.75% | 3.60% | A small online seller with a $50 average ticket is at 3.90%, well above the benchmark range in the table above. That isn't a negotiating failure, it's arithmetic. **At the top of the table, the range describes what merchants that size typically pay. It is not the floor.** Helcim publishes interchange + 0.25% + 7c card present for $100K-500K a month with no monthly fee ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). On this site's [published pass-through assumption](/docs/payments/reference/cost-model-assumptions) of 1.03% + $0.178 card present, that's an all-in 1.28% + $0.248 - and what it works out to depends entirely on your average ticket: | Average card-present ticket | Helcim $100K-500K band, effective | |---|---| | $25 | 2.27% | | $50 | 1.78% | | $100 | 1.53% | A single "2.28% effective" for that band can't be reproduced. It doesn't say which average ticket it assumes, and it runs on an interchange figure of 1.80% + $0.10, which isn't a blended card mix at all - it's roughly the rate for one card type, a consumer rewards credit card. The table above states the ticket, and the interchange assumption is published and sourced. If those figures look far below the 2.1-2.6% row in the table, that's the point. The benchmark row tells you what merchants pay. The Helcim column tells you what a published rate card costs at a stated ticket. The gap between the two is the size of the prize for anyone still on flat rate above $1M a year. ::: **The volume trap:** At low volume, a handful of chargebacks can spike your ratio above network thresholds. A merchant doing 500 transactions/month only needs 5 chargebacks to hit 1.0%. See [chargeback thresholds](#chargeback-ratio-thresholds) for the exact numbers. --- ## How to Use These Benchmarks ### Step 1: Establish Your Baseline Before comparing to industry, know your own numbers: - Calculate each metric for last 90 days - Segment by CP/CNP, geography, method - Document as your baseline ### Step 2: Compare to Benchmarks - Are you above/below industry norms? - Which segments are problems? - Where are quick wins? ### Step 3: Track Trends - Weekly: Auth rate, fraud rate, chargeback ratio - Monthly: All metrics, segmented - Quarterly: Deep dive, re-baseline ### Step 4: Set Alerts | Metric | Alert When | |--------|------------| | Auth rate | Drops over 0.5pp from baseline | | Fraud rate | Rises over 0.05pp | | Chargeback ratio | Approaches 0.75% | | Refund rate | Changes over 1pp | --- ## Where This Breaks - **Mixing CP and CNP.** Never combine in single number. - **Seasonality.** Holiday, promo weeks skew baselines. Compare like periods. - **High-risk MCCs.** Travel, gaming, crypto run above these ranges. Set your own bands. - **International traffic.** Expect lower auth, higher fraud. Get local acquiring before judging. - **Low volume.** Small sample sizes create noise. Need 1000+ transactions for reliable rates. --- ## Next Steps **Establishing your baseline?** 1. [Follow the 4-step process](#how-to-use-these-benchmarks) - Baseline, compare, track, alert 2. [Segment by CP vs CNP](#by-payment-method) - Never combine in one number 3. [Set internal alert thresholds](#step-4-set-alerts) - Catch problems early **Comparing to industry?** 1. [Check auth rate benchmarks](#authorization-rate-benchmarks) - CNP 85-90%, CP 98-99% 2. [Review fraud rate by industry](#by-industry-cnp) - Know your vertical 3. [Understand chargeback thresholds](#chargeback-ratio-thresholds) - Under 0.5% healthy **Improving metrics?** 1. [Optimize auth rate](/docs/payments/auth-optimization) - Network tokens, retry logic 2. [Reduce fraud rate](/docs/fraud/prevention) - Risk scoring, 3DS 3. [Lower chargeback ratio](/docs/chargebacks/prevention) - Alerts, descriptors --- ## Related - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Payments Metrics](/docs/payments/metrics) - Tracking payment health - [Fraud Metrics](/docs/fraud/metrics) - Measuring fraud rates - [Chargeback Metrics](/docs/chargebacks/metrics) - Dispute measurement - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Prevention tools - [Processor Reporting Checklist](/docs/reference/processor-reporting-checklist) - Data requirements - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Dispute Monitoring](/docs/compliance/network-rules/dispute-monitoring) - Compliance programs - [3D Secure](/docs/fraud/prevention/3ds) - Auth rate impact - [Decline Codes](/docs/reference/decline-codes) - Understanding declines - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Fraud detection performance - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring billing metrics --- ## American Express Source: https://paymentsandrisk.com/docs/reference/card-networks/amex # American Express :::info[TL;DR] - Amex is a closed-loop network: they issue cards, set rules, AND process acquiring in many cases - this gives them more data about disputes but makes the process less transparent for merchants - Amex's dispute process is different from Visa/Mastercard: they contact you directly and you have 20 days to respond (shorter than Visa's 30 days) - Amex typically has 5-15% higher average transaction values but lower acceptance among budget-conscious customers; most US businesses should accept it - Amex publishes no US interchange rate, because there isn't one. It's a closed loop with no separate issuer to reimburse. What you pay is a merchant discount rate, reported at 2.5-3.5%. Visa and Mastercard consumer credit interchange is 1.51-2.30% + $0.10 card-present, so Amex does cost more, but a discount rate and an interchange rate aren't the same measurement ::: American Express is different from Visa and Mastercard. Amex is a "closed-loop" network - they issue cards, operate the network, AND handle acquiring (sometimes). This gives them more control but also makes them harder to work with as a merchant. ## What Makes Amex Different ### Closed-Loop vs Open-Loop **Visa/Mastercard (Open-Loop)**: ``` Issuer โ†” Network โ†” Acquirer โ†” Merchant (Separate companies at each step) ``` **American Express (Closed-Loop)**: ``` Issuer + Network + Acquirer = Amex (Same company controls multiple steps) ``` **What this means**: - Amex issues most Amex-branded cards themselves - Amex sets the rules AND enforces them directly - Amex sometimes IS your acquirer (OptBlue program) - Amex has more control over the entire transaction ### OptBlue Program Amex created "OptBlue" to let third-party processors handle Amex: - Your Stripe/Square account can accept Amex - You don't contract with Amex directly - Amex still sets the rules **Pre-OptBlue**: Merchants had to contract with Amex separately (painful) **Post-OptBlue**: Most SMBs accept Amex through their existing processor (easy) **If you're on Stripe or Square, you're likely using OptBlue without knowing it.** --- ## Amex Rules That Matter to Merchants ### 1. No Formal Chargeback Monitoring Program Unlike Visa (VAMP) and Mastercard (ECM), Amex doesn't publish specific chargeback ratio thresholds. **But**: - Amex monitors ratios internally - Over 1-1.5% = warnings - Over 2%+ = termination discussions - They don't publish the numbers **Less transparent than Visa/Mastercard**, but generally more lenient. ### 2. Inquiry Process Before Chargebacks Amex uses an **inquiry process**: | Step | What Happens | Timeframe | |------|--------------|-----------| | **Inquiry** | Amex asks for transaction info | 20 days to respond | | **Resolution** | If satisfied, no chargeback filed | N/A | | **Chargeback** | If not satisfied, formal dispute | 20 days to respond | **Key insight**: Responding well to inquiries prevents many chargebacks. Amex inquiries are common (Visa/Mastercard rarely do this). ### 3. Shorter Response Windows Amex gives less time to respond: - Inquiry response: **20 days** - Chargeback response: **20 days** - vs Visa (30 days) and Mastercard (45 days) **Set calendar reminders** - Amex deadlines sneak up faster. ### 4. Reason Code Format Amex uses letter-number format: | Code | Category | Example | |------|----------|---------| | **F29** | Fraud - card not present | Most common fraud code | | **C08** | Goods/services not received | Not received disputes | | **C28** | Cancelled recurring | Subscription cancellations | | **C32** | Goods/services not as described | Quality disputes | **Fewer codes than Visa/Mastercard** but same dispute types. **Full breakdown**: [Amex Reason Codes](/docs/reference/reason-codes/amex) --- ## Amex Network Fees Amex fees are **higher than Visa/Mastercard**: | Fee Type | Typical Rate | Notes | |----------|--------------|-------| | **Discount rate** | 2.5-3.5% (reported, not published by Amex) | Visa/MC consumer credit interchange is 1.51-2.30% + $0.10 card-present | | **Per-transaction** | Varies | Built into discount rate | | **No interchange** | N/A | Amex keeps the whole discount | **Amex publishes no US rate card.** The 2.5-3.5% above is a reported range rather than an Amex figure, and OptBlue rates vary by acquirer. Ask your acquirer for your actual Amex discount rate in writing. Visa and Mastercard do publish, in full, twice a year: Visa's schedule is dated 18 April 2026 and Mastercard's 17 April 2026. **Careful with the comparison.** A discount rate is your all-in cost. Interchange is a wholesale input your processor marks up. Comparing 2.5-3.5% Amex against 1.51-2.30% Visa interchange overstates the gap, because the Visa number doesn't include assessments or your processor's margin yet. **Why Amex costs more**: Amex issues premium rewards cards. They fund those rewards from merchant fees. **OptBlue pricing** (through Stripe/Square): - Similar to Visa/Mastercard (2.9% + $0.30) - Amex subsidizes to match competitors - At high volumes, may be higher --- ## Amex Dispute Process ### Stage 1: Inquiry **Trigger**: Cardholder questions charge **What Amex asks for**: - Transaction details - Product/service description - Delivery confirmation (if applicable) - Customer communication **Response window**: 20 days **If you respond well**: ~40-60% of inquiries don't escalate to chargebacks ### Stage 2: Chargeback **If inquiry doesn't resolve**: - Formal chargeback filed - You receive notification - 20 days to submit representment - Amex reviews and decides **Response window**: 20 days (strict) ### Stage 3: Amex Reviews **Unlike Visa/Mastercard**: Amex IS the issuer in most cases. They're reviewing their own cardholder's claim. **This creates bias** - Amex tends to side with cardholders (they're protecting their own customers). **Win rates**: - Amex: 30-40% typical - Visa/Mastercard: 40-50% typical - **Amex is harder to win** ### No Pre-Arbitration Amex doesn't have a pre-arbitration stage: - Representment โ†’ Decision - No second chance to argue **Mastercard/Visa**: Representment โ†’ Pre-arb โ†’ Arbitration (multiple chances) **Amex**: Representment โ†’ Decision (one chance) --- ## When Amex Intervenes ### 1. Ratio Too High Amex doesn't publish thresholds but: - Over 1%: Monitoring starts - Over 1.5%: Warnings sent - Over 2%: Termination discussions **Less strict than Visa** but still enforced. ### 2. Fraud Patterns Amex monitors for: - Multiple fraud complaints - Cardholder disputes of premium card benefits - Merchant category violations **Amex protects their premium cardholders aggressively.** ### 3. OptBlue Violations If you're on OptBlue (through Stripe/Square): - Amex can kick you off OptBlue - Your processor may still work, but no Amex cards - Violations: fraud, chargebacks, MCC issues --- ## Why Merchants Accept Amex Despite higher fees and harder disputes, merchants accept Amex because: **1. Premium customers** - Amex cardholders have higher average incomes - Higher AOV (average order value) - Lower fraud rates (Amex screens applicants heavily) **2. B2B dominance** - Amex is huge in business spending - Corporate cards are often Amex - If you sell B2B, Amex is unavoidable **3. Customer expectation** - Not accepting Amex looks unprofessional - Premium brands expect Amex acceptance **4. OptBlue made it easy** - Pre-OptBlue: Separate Amex contract (painful) - Post-OptBlue: Amex works through your existing processor --- ## When to Skip Amex **Consider not accepting Amex if:** - Your margins are thin (under 20%) and every 0.5% matters - You're primarily low-ticket transactions (under $20) - OptBlue pricing is significantly higher than Visa/MC - You're a pure consumer brand (not B2B) **Calculate**: - What % of your transactions are Amex? (Typically 5-15%) - Are Amex customers higher AOV? (Typically yes, 20-40% higher) - Does revenue from Amex exceed extra fees? **Most merchants keep Amex** because the 5-15% of transactions are worth it. --- ## Test to Run **Amex ROI audit (if you're already accepting Amex):** **Week 1: Transaction analysis** 1. Pull last 3 months of transactions 2. Calculate Amex %: Amex transactions / Total = ____% 3. Calculate Amex revenue %: Amex sales / Total sales = ____% **Week 2: Profitability check** 4. Calculate Amex fees paid 5. Calculate what you would have paid at Visa/MC rates 6. Extra cost: $_____ /month **Week 3: Value assessment** 7. Calculate Amex average order value vs overall AOV 8. Amex AOV premium: ____% 9. Decision: Does Amex revenue justify extra fees? **Success criteria**: If Amex represents 10%+ of revenue or has 20%+ higher AOV, it's worth accepting despite higher fees. --- ## Scale Callout **Under $100K/month:** - Amex is 5-10% of transactions typically - Extra fees: $50-$150/month - Worth accepting (professionalcredibility) **$100K-$1M/month:** - Amex share may be 10-15% - Extra fees: $200-$800/month - Still worth it unless pure consumer brand **Over $1M/month:** - If B2B, Amex is unavoidable - If consumer, audit if revenue justifies cost - Consider negotiating Amex rates **Over $10M/month:** - Amex will negotiate custom pricing - Likely getting sub-3% rates through OptBlue - Definitely keep Amex at this scale --- ## Where This Breaks 1. **Closed-loop means Amex bias**: Amex reviews their own cardholder disputes. They protect their customers. Win rates are lower. 2. **Premium cardholders are demanding**: Amex customers have high expectations. "Not as described" disputes are common. 3. **No network-level escalation**: Unlike Visa/MC arbitration, Amex IS the network. Their decision is final. 4. **Inquiry responses take time**: Responding to inquiries properly requires same effort as chargeback responses. Budget for this. 5. **OptBlue vs Direct varies by processor**: Some processors charge more for Amex. Check your statements. --- ## Next Steps **Understanding Amex better?** 1. [Amex Reason Codes](/docs/reference/reason-codes/amex) - All Amex dispute codes 2. [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence for Amex 3. [Representment](/docs/chargebacks/representment) - Amex-specific process **Optimizing Amex acceptance?** 1. Respond to inquiries within 48 hours (20-day window but faster is better) 2. Collect same evidence as Visa/MC (3DS, tracking, etc.) 3. Monitor Amex ratio separately **Comparing networks?** 1. [Visa](/docs/reference/card-networks/visa) - Open-loop, stricter monitoring 2. [Mastercard](/docs/reference/card-networks/mastercard) - Open-loop, higher thresholds 3. [Discover](/docs/reference/card-networks/discover) - Smaller US network 4. [Card Networks Overview](/docs/reference/card-networks) - All four compared --- ## See Also - [Card Networks Overview](/docs/reference/card-networks) - All networks compared - [Visa](/docs/reference/card-networks/visa) and [Mastercard](/docs/reference/card-networks/mastercard) - Open-loop networks - [Payment Ecosystem](/docs/payments/payment-ecosystem) - Network role explained - [Reason Codes](/docs/reference/reason-codes/amex) - Amex dispute codes - [B2B Commercial Cards](/docs/payments/reference/b2b-commercial) - Amex corporate card dominance - [Chargeback Representment](/docs/chargebacks/representment) - Fighting Amex disputes --- ## Discover Network: Card Rules, Disputes & Acquirer Model Source: https://paymentsandrisk.com/docs/reference/card-networks/discover # Discover :::info[TL;DR] - Discover is a closed-loop network like Amex: they issue cards and handle acquiring, giving them direct control over the dispute process - US market share is 7-10%; accepting Discover is expected for US consumer businesses but rarely the deciding factor in a purchase - Discover's dispute response window is 30 days; their process is similar to Amex (direct merchant contact) rather than Visa/Mastercard's bank-to-bank process - Discover cards run on the Discover/Diners Club network internationally; in some markets they're accepted on UnionPay rails through a network-sharing agreement ::: Discover is the smallest of the four major US card networks (Visa, Mastercard, Amex, Discover). Like Amex, Discover is a closed-loop network - they issue cards and handle acquiring. Market share is low but acceptance is expected in the US. ## What Discover Actually Does **Discover is**: - A closed-loop network (like Amex) - A card issuer (issues Discover-branded cards) - Sometimes an acquirer (Discover Global Network) - The rule-maker for Discover cards **Market share**: - US: ~7-10% of card transactions - International: Minimal (partnerships with Diners Club, JCB) **Acceptance**: Expected in US, rare internationally. --- ## Discover vs Visa/Mastercard/Amex | Factor | Discover | Visa/Mastercard | Amex | |--------|----------|-----------------|------| | **Network type** | Closed-loop | Open-loop | Closed-loop | | **Market share (US)** | 7-10% | 75% combined | 15-20% | | **International** | Low | High | Medium | | **Pricing** | Similar to Visa/MC | Baseline | Higher | | **Monitoring programs** | Less formal | Very formal | Moderate | **For merchants**: Discover is like Amex (closed-loop) but with lower volume and fees similar to Visa/MC. --- ## Discover Rules That Matter to Merchants ### 1. Dispute Monitoring Discover runs no named monitoring program the way Visa runs VAMP and Mastercard runs ECM: - Internal monitoring, no public thresholds - **No published ratio.** The standard in Discover's own Merchant Operating Regulations is "excessive returns or Disputes, as determined by us in our sole discretion" - Lower volume means less strict enforcement in practice **Reality**: Discover is small enough to handle merchants case-by-case instead of by automated program. Numbers get quoted for Discover anyway. 1%, 1.5%, "1% or 100 chargebacks". None of them trace back to Discover. Your acquirer's house limit is the only Discover line that will ever actually be enforced on you, so get that one in writing. ### 2. Reason Code Format Discover uses letter-number codes: | Code | Category | Description | |------|----------|-------------| | **UA02** | Fraud | Fraud - full recourse | | **RG** | Non-receipt | Goods/services not received | | **AA** | Does not recognize | Cardholder doesn't recognize charge | | **AP** | Cancelled recurring | Subscription/recurring cancelled | **Similar to Amex's letter-number format**, not Visa's 10.4 or Mastercard's 4837. **Full breakdown**: [Discover Reason Codes](/docs/reference/reason-codes/discover) ### 3. Response Timeframes | Action | Timeframe | |--------|-----------| | **Representment response** | 20-30 days (varies by code) | | **Pre-arbitration** | No separate pre-arbitration stage | | **Arbitration** | Exists, but the window isn't published | **Similar to Amex**: Shorter windows than Visa/Mastercard. Discover does have arbitration. Its Merchant Operating Regulations say the Dispute Rules "describe the procedures for Dispute Arbitration". The Dispute Rules themselves aren't public, so the filing window isn't either. Anyone printing "Discover arbitration: 45 days" got it by copying Visa's number across. Don't plan a deadline on it. Get the window from your acquirer in writing. --- ## Discover Network Fees Discover fees are competitive with Visa/Mastercard: | Fee Type | Rate | Notes | |----------|------|-------| | **Assessment** | Not published. Commonly reported at 0.13% | All Discover transactions | | **Network authorization** | $0.0195 | Per transaction | | **Data usage fee** | $0.0045 | Per transaction | **Total network fees**: ~0.14-0.16% (same as Visa/MC) **Interchange**: Discover's interchange rates are similar to Visa/Mastercard. --- ## Why Merchants Accept Discover Despite low volume (7-10%), merchants accept Discover because: **1. US Customer Expectation** - Not accepting Discover looks incomplete - Customers expect all four networks - Professional credibility **2. Easy Through OptBlue Equivalent** - Stripe, Square, most processors include Discover - No separate contract needed - Same pricing as Visa/MC usually **3. Similar Fees to Visa/MC** - Not more expensive like Amex - Interchange and assessment similar - No premium pricing **4. Low Effort** - If your processor supports Visa/MC, Discover is already enabled - Zero additional integration --- ## When to Skip Discover **Consider not accepting Discover if:** - You're international-only (Discover has no global presence) - Your processor charges premium rates for Discover - Compliance costs outweigh 7% of revenue **Reality**: Most processors include Discover automatically. You're probably already accepting it without realizing. **Check your statements**: Look for "Discover" transactions. If you have any, you're accepting it. --- ## Common Discover Gotchas ### 1. Low Volume = Less Practice **Problem**: Discover is only 7-10% of transactions - You get fewer Discover disputes - Less practice responding - Easy to forget Discover has different codes/rules **Reality**: When you get a Discover dispute, you have to remember their specific process. ### 2. Closed-Loop Bias Like Amex, Discover IS the issuer: - They're protecting their own cardholders - Less neutral than Visa/MC - Win rates may be lower **Estimate**: 30-40% win rate (vs 40-50% for Visa/MC) ### 3. Shorter Response Windows 20-30 days flies by faster than you think: - Receive dispute Friday - Weekend = 2 days gone - Holiday week = another 5 days gone - You have 13 days left **Set calendar reminders immediately** when you receive Discover disputes. ### 4. Less Documentation Discover's process is less documented than Visa/MC: - Fewer online resources - Your processor may not have Discover expertise - Community knowledge is limited **You're on your own more** with Discover disputes. --- ## Test to Run **Discover acceptance audit:** **Week 1: Volume check** 1. Pull last 3 months of transactions 2. Calculate Discover %: Discover transactions / Total = ____% 3. Typical: 5-10% **Week 2: Profitability check** 4. Calculate Discover fees paid 5. Compare to Visa/MC fees (should be similar) 6. If Discover fees are 20%+ higher, investigate why **Week 3: Dispute check** 7. Pull Discover disputes from last year 8. How many? (Expect: very few due to low volume) 9. Win rate: ____% **Success criteria**: Discover is 5-10% of volume, fees match Visa/MC, minimal disputes. --- ## Scale Callout **All volume tiers:** - Discover is 7-10% regardless of scale - Fees are similar to Visa/MC - Accept it unless you have specific reason not to **Exception**: International-only businesses - Discover has no international presence - 0% of non-US customers have Discover - Can skip if 100% international --- ## Where This Breaks 1. **International sales**: Discover is US-only effectively. Partnerships with Diners Club and JCB exist but are rare. 2. **Low-volume means low expertise**: Your processor's support team may not know Discover rules well. You're troubleshooting on your own. 3. **Closed-loop bias**: Discover sides with cardholders (their own customers). Evidence requirements are same as Visa/MC but win rates are lower. 4. **No published threshold at all**: Discover's Merchant Operating Regulations let it act when you have "excessive returns or Disputes, as determined by us in our sole discretion". That's the entire standard. No ratio, no count, no ladder. The 1.0% figure that half the web quotes for Discover doesn't come from any Discover document. Visa and Mastercard don't publish either, but at least their numbers leak through acquirers. Discover's don't, because there aren't any to leak. Ask your acquirer for its own limit and treat that as the real one. 5. **Bundled with other processors**: Some processors automatically include Discover. You may be accepting it without realizing. --- ## Next Steps **Understanding Discover?** 1. [Discover Reason Codes](/docs/reference/reason-codes/discover) - All Discover codes 2. [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence works same as Visa/MC 3. [Representment](/docs/chargebacks/representment) - Response process **Comparing networks?** 1. [Visa](/docs/reference/card-networks/visa) - Largest network, strictest monitoring 2. [Mastercard](/docs/reference/card-networks/mastercard) - Second largest, higher thresholds 3. [American Express](/docs/reference/card-networks/amex) - Premium cards, closed-loop 4. [Card Networks Overview](/docs/reference/card-networks) - All four compared **Managing disputes across networks?** 1. [Chargeback Monitoring](/docs/chargebacks/monitoring/thresholds) - All network programs 2. [Reason Code Reference](/docs/reference/reason-codes) - All network codes 3. [Time Frames](/docs/reference/time-frames) - Response deadlines by network --- ## See Also - [Card Networks Overview](/docs/reference/card-networks) - All four networks compared - [Visa](/docs/reference/card-networks/visa) and [Mastercard](/docs/reference/card-networks/mastercard) - Open-loop competitors - [American Express](/docs/reference/card-networks/amex) - Closed-loop peer - [Payment Ecosystem](/docs/payments/payment-ecosystem) - Network role in payments - [Reason Codes](/docs/reference/reason-codes/discover) - Discover dispute codes - [Chargeback Representment](/docs/chargebacks/representment) - Fighting disputes - [Network Programs](/docs/chargebacks/reference/network-programs) - Monitoring programs --- ## Mastercard Source: https://paymentsandrisk.com/docs/reference/card-networks/mastercard # Mastercard :::info[TL;DR] - Mastercard's chargeback monitoring programs (ECM at 1.5% ratio, HECM at 3.0%) have higher thresholds than Visa's VAMP but longer dispute response windows (Mastercard gives 45 days for representment vs. Visa's 30 days) - MATCH (Member Alert to Control High-risk Merchants) is the terminated merchant database operated by Mastercard; it's the primary tool processors use to screen new merchants - Mastercard's reason codes differ from Visa's; code 4837 (No Cardholder Authorization) is their equivalent of Visa's fraud category and the highest-volume dispute category - Mastercard Identity Check is their 3DS implementation; ensure your processor supports it for European transactions and liability shift ::: Mastercard is the world's second-largest card network (after Visa). Like Visa, they don't issue cards or process payments - they set rules and operate the infrastructure connecting banks. Mastercard's programs have higher thresholds than Visa and longer response windows. ## What Mastercard Actually Does **Mastercard is NOT**: - Your processor - Your acquirer - A card issuer **Mastercard IS**: - The network infrastructure (Banknet) - The rule-maker for Mastercard-branded cards - The operator of MATCH (terminated merchant database) - The enforcer of network standards **Same as Visa**: You communicate with Mastercard only through your processor, never directly. --- ## Mastercard's Rules That Matter to Merchants ### 1. Chargeback Monitoring Programs Mastercard's programs are more forgiving than Visa's: | Program | Threshold | Consequences | |---------|-----------|--------------| | **ECM** (Excessive Chargeback Merchant) | 100-299 chargebacks AND a 1.50-2.99% ratio, in the same month | Fines ($1K-$100K/month escalating) | | **HECM** (High Excessive Chargeback Merchant) | 300+ chargebacks AND a 3.00%+ ratio | Higher fines ($1K-$200K/month escalating) | | **EFM** (Excessive Fraud Merchant) | 1,000+ ecom transactions AND $50,000+ fraud AND 0.50%+ fraud ratio AND low 3DS penetration, all in the same month | Fraud-specific monitoring | **Timeframe**: Prior month's transactions as denominator (Visa uses the same calendar month for both halves of its ratio) **Key difference from Visa**: - Mastercard: 1.5% ECM threshold (vs Visa's VAMP merchant excessive at 1.5%) - Mastercard: Uses the prior month as the denominator (vs Visa's same calendar month) - Mastercard: 45-day response window (vs Visa's 30 days) **Typically easier to avoid Mastercard programs** than Visa's. ### 2. Reason Code System Mastercard uses a 4-digit reason code format: | Code Range | Category | Common Codes | |------------|----------|--------------| | **4800s** | Authorization | 4808 (Authorization required), 4834 (POI error) | | **4830s-4840s** | Fraud | 4837 (Fraud - no cardholder auth) | | **4850s** | Consumer disputes | 4853 (Cardholder dispute), 4855 (Goods not provided) | | **4860s-4870s** | EMV/Chip | 4870 (Chip liability shift), 4871 (Chip/PIN) | **Full breakdown**: [Mastercard Reason Codes](/docs/reference/reason-codes/mastercard) ### 3. MATCH List (Terminated Merchant File) Mastercard operates the **MATCH list** (Member Alert to Control High-risk Merchants): - Database of terminated merchants - 5-year listing, then automatic purge - All acquirers check before onboarding - 11 reason codes for listing, down from 14 in February 2025 - Codes 04 and 05 carry published numbers: 1.5% of Mastercard sales plus USD 5,000 for chargebacks, 8% fraud-to-sales for fraud **Visa's shared database is VMSS**, the Visa Merchant Screening Service. Visa's **TMF** (Terminated Merchant File) is something else, a file your acquirer keeps on you. Processors use the names loosely. They aren't the same system. **See**: [MATCH/TMF List](/docs/chargebacks/match-tmf) for full details. ### 4. Response Timeframes | Action | Timeframe | |--------|-----------| | **Representment response** | 45 days (vs Visa's 30) | | **Pre-arbitration response** | 30 days | | **Arbitration filing** | 45 days | **Mastercard gives you more time** at representment than Visa. Not at pre-arbitration. Pre-arbitration is **30 days**. You'll see 45 quoted. That's the representment window, carried across by mistake. Mastercard's Chargeback Guide is explicit: the issuer can file for arbitration once "the 30-calendar days have passed". Your representment window and your pre-arbitration window are different lengths, so don't carry the 45 across in your head. --- ## Mastercard Network Fees Mastercard charges assessment fees on every transaction: | Fee Type | Rate | When Charged | |----------|------|--------------| | **Assessment fee** | 0.1375% | All Mastercard transactions | | **Acquirer brand fee** | $0.0045 | Per transaction (US) | | **Network clearing fee** | $0.0075 | Per transaction | | **Cross-border fee** | 1.0% | International transactions | **Total network fees**: ~0.15-0.30% (similar to Visa) --- ## When Mastercard Intervenes ### 1. ECM/HECM Breach **What happens**: - Month 1: Warning, no fines - Month 2-3: $1,000/month (ECM) or $1,000-$2,000 (HECM) - Month 4-6: $5,000/month (ECM) or $10,000 (HECM) - Month 7-11: $25,000/month (ECM) or $50,000 (HECM) - Month 12+: $50,000-$100,000+ and MATCH listing likely **Mastercard's enforcement**: - Fines applied to your processor - Processor passes to you (or absorbs if they're nice) - Processor may terminate you to stop fines ### 2. QMAP (Questionable Merchant Audit Program) Mastercard's fraud audit program: - Triggered by fraud patterns or complaints - Requires forensic investigation - Can lead to MATCH listing (code 08) **Rare but serious** when it happens. ### 3. Standards Violations Mastercard monitors compliance with: - PCI DSS requirements - Transaction integrity rules - Surcharging laws - Merchant category codes (MCCs) **Violations**: Fines and potential MATCH listing. --- ## Mastercard vs Visa: What's Different | Factor | Mastercard | Visa | |--------|------------|------| | **Chargeback threshold** | 1.5% + 100 (ECM) | 0.9% (processor) / 1.5% (VAMP; 2.2% CEMEA) | | **Response time** | 45 days | 30 days | | **Calculation method** | Prior month denominator | Rolling month | | **Reason code format** | 4-digit (4837) | 2-digit (10.4) | | **Terminated merchant list** | MATCH Pro | TMF + VMSS (separate systems) | | **Market share** | 25% US, 35% global | 50% US, 40% global | | **Assessment fees** | 0.1375% | 0.14% | **For most merchants**: Mastercard's higher ECM threshold (1.5%) and longer response window (45 vs 30 days) make it slightly easier to work with than Visa. --- ## Mastercard-Specific Gotchas ### 1. Prior Month Denominator Mastercard calculates ratio differently: **Visa**: Disputes this month / transactions this month (rolling) **Mastercard**: Disputes this month / transactions LAST month **Impact**: Volume drops affect your ratio next month - $500K in sales (Month 1) - $200K in sales (Month 2) - 50 disputes in Month 2 - Ratio: 50 / $500K (last month) = 0.01% โœ… **But**: - 50 disputes in Month 3 - Ratio: 50 / $200K (Month 2 sales) = 0.025% โš ๏ธ **Seasonal businesses** can spike into ECM during slow months. ### 2. First Chargeback/Second Chargeback Split Mastercard separates: - **First chargeback**: Initial dispute - **Second chargeback** (pre-arb): Issuer challenges your representment **Both count toward ECM threshold.** Losing a representment = two chargebacks on your record. ### 3. Collaboration Initiative Mastercard's pre-dispute alert system: - Similar to Visa RDR (Rapid Dispute Resolution) - Called "Ethoca alerts" (Mastercard owns Ethoca) - Deflect disputes before filing **See**: [Chargeback Alerts](/docs/chargebacks/prevention/alerts) ### 4. Maestro (Global Debit) Mastercard owns Maestro (debit card scheme popular outside US): - Different rules than Mastercard credit - Common in EU - Less common in US **If you sell internationally**, you'll see Maestro transactions. --- ## Test to Run **Mastercard monitoring check:** **Week 1: Calculate your position** 1. Pull Mastercard disputes from last month 2. Pull Mastercard transactions from month BEFORE that 3. Calculate: disputes / prior month transactions 4. Compare to 1.5% ECM threshold **Week 2: Trend analysis** 5. Compare last 3 months of Mastercard ratios 6. Improving or worsening? 7. Seasonal patterns? **Week 3: Response time audit** 8. Check your average Mastercard response time 9. Are you using the full 45 days? 10. Faster responses often win more (even though you have 45 days) **Success criteria**: Ratio under 0.75%, trending down or stable, average response time under 20 days. --- ## Scale Callout **Under $100K/month:** - Unlikely to hit 100 Mastercard disputes/month - Ratio is your risk (1.5% ECM threshold) - Keep under 1.0% for safety margin **$100K-$1M/month:** - Can hit both ratio and count - Monitor Mastercard separately from Visa - Some months you'll breach one but not the other **Over $1M/month:** - HECM (3.0%) becomes the threat if volume is high enough - Mastercard fines are as painful as Visa's - Implement prevention tools **Over $10M/month:** - Both networks monitoring you - Need dedicated compliance resources - Consider chargeback guarantees for high-risk segments --- ## Where This Breaks 1. **Prior month calculation hurts seasonal businesses**: Holiday spike in December, slow January = high ratio in February when disputes from December hit. 2. **Mastercard gives more time but issuers use it**: 45-day window means issuers sometimes take longer to file disputes. Older disputes are harder to defend. 3. **MATCH lasts 5 years**: then the record purges automatically. There's a removal request process, but it needs your acquirer to agree the listing was an error. Prevention is critical. 4. **International Mastercard is different**: Mastercard has higher global market share than Visa outside US. If you're selling internationally, Mastercard volume may exceed Visa. 5. **Digital wallets may route through Mastercard**: Apple Pay, Google Pay transactions can be Mastercard-branded. Check your mix. --- ## Next Steps **Monitoring Mastercard programs?** 1. [Chargeback Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - ECM/HECM details 2. [Network Programs Reference](/docs/chargebacks/reference/network-programs) - All programs 3. [MATCH/TMF List](/docs/chargebacks/match-tmf) - Terminated merchant database **Understanding Mastercard disputes?** 1. [Mastercard Reason Codes](/docs/reference/reason-codes/mastercard) - All codes 2. [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements 3. [Representment](/docs/chargebacks/representment) - Response process **Comparing to other networks?** 1. [Visa](/docs/reference/card-networks/visa) - Stricter thresholds, faster timelines 2. [American Express](/docs/reference/card-networks/amex) - Closed-loop differences 3. [Card Networks Overview](/docs/reference/card-networks) - All four compared --- ## See Also - [Card Networks Overview](/docs/reference/card-networks) - All networks compared - [Visa](/docs/reference/card-networks/visa) - Comparison to Visa rules - [Payment Ecosystem](/docs/payments/payment-ecosystem) - Network role in payments - [Chargeback Monitoring](/docs/chargebacks/monitoring/thresholds) - ECM/HECM programs - [MATCH/TMF](/docs/chargebacks/match-tmf) - Mastercard's terminated merchant list - [Reason Codes](/docs/reference/reason-codes/mastercard) - All Mastercard codes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Ethoca (Mastercard-owned) --- ## Visa Source: https://paymentsandrisk.com/docs/reference/card-networks/visa # Visa :::info[TL;DR] - Visa sets rules and fines merchants for breaking them, but they don't process your payments or issue your cards - your processor and issuing bank do that - VAMP (Visa Acquirer Monitoring Program) replaced VDMP and VFMP in April 2025; the merchant excessive threshold is 1.5% (2.2% in CEMEA) with 1,500+ disputes, but processors commonly flag merchants around 0.9% - Visa Compelling Evidence 3.0 (CE 3.0) allows fraud dispute liability shift if you can prove two prior undisputed transactions from the same device and card - Visa's chargeback response window is 30 days; missing it means automatic loss regardless of how strong your evidence is ::: Visa is the world's largest card network. They don't issue cards, they don't provide merchant accounts, and they don't process your payments. They set the rules, operate the network that connects banks, and fine you when you break their rules. Understanding what Visa controls vs what your processor controls matters when you're trying to fix problems. ## What Visa Actually Does **Visa is NOT**: - Your processor (that's Stripe, Square, etc.) - Your acquirer (that's your merchant account bank) - An issuer (that's Chase, Bank of America, Capital One, etc.) **Visa IS**: - The network connecting issuers and acquirers - The rule-maker for how Visa-branded cards work - The enforcer when merchants or banks break rules - The arbitrator in complex disputes ```mermaid flowchart LR subgraph Customer["Customer Side"] C[Cardholder] --> I[IssuerChase, BoA, etc.] end subgraph Network["Visa Network"] V[VisaRules & Infrastructure] end subgraph Merchant["Merchant Side"] A[Acquirer/ProcessorStripe, Square, etc.] --> M[You] end I |VisaNet| V V |VisaNet| A style V fill:#1a1f71,color:#fff ``` **What this means**: You never talk to Visa directly. Everything goes through your processor/acquirer. --- ## Visa's Rules That Matter to Merchants ### 1. Chargeback Monitoring Programs Visa runs VAMP (Visa Acquirer Monitoring Program) to monitor merchant chargeback ratios: | Level | Threshold | Consequences | |-------|-----------|--------------| | **Processor flagging** | ~0.9% ratio (processor-set) | Warnings, remediation requests | | **VAMP Merchant Excessive** | 1.5% ratio + 1,500 combined fraud reports + disputes (2.2% in CEMEA) | $8 per CNP dispute fee (3-month grace for first-time) | VAMP is an **acquirer-level** program. Visa monitors your acquirer's portfolio, and your acquirer manages individual merchants. Most processors start watching at ~0.9% (the old VDMP threshold) as their own internal policy. **Timeframe**: Rolling 1-month calculation **How it works**: 1. Your processor reports your ratios to Visa monthly 2. If you breach, Visa fines your processor 3. Your processor passes fines to you (or terminates you) 4. Three consecutive months in a program = mandatory remediation plan **See**: [Chargeback Monitoring Programs](/docs/chargebacks/monitoring/thresholds) and [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) for prevention. ### 2. Reason Code System Visa uses a 2-digit reason code format: | Code Range | Category | Examples | |------------|----------|----------| | **10.x** | Fraud | 10.4 (CNP fraud), 10.5 (Fraud Monitoring Program) | | **11.x** | Authorization | 11.1 (Card Recovery Bulletin), 11.2 (Declined auth) | | **12.x** | Processing errors | 12.1 (Late presentment), 12.6 (Duplicate) | | **13.x** | Consumer disputes | 13.1 (Not received), 13.2 (Cancelled recurring) | **Full breakdown**: [Visa Reason Codes](/docs/reference/reason-codes/visa) ### 3. Response Timeframes | Action | Timeframe | |--------|-----------| | **Representment response** | 30 days | | **Pre-arbitration response** | 30 days | | **Arbitration filing** | 45 days | **Miss these and you auto-lose.** ### 4. Compelling Evidence 3.0 Visa's CE 3.0 program lets you win fraud disputes with historical evidence: **Requirements**: - 2+ prior undisputed transactions on same card - 120-365 days before disputed transaction - 2+ matching elements: device ID, IP, shipping address, account **Win rate**: 70-85% when CE 3.0 qualifies (vs 15-25% without) **See**: [Compelling Evidence 3.0](/docs/chargebacks/representment/compelling-evidence) --- ## Visa Network Fees (You Pay These) Visa charges **network assessment fees** on every transaction: | Fee Type | Rate | When Charged | |----------|------|--------------| | **Assessment fee** | Not published. Assumed 0.14% | All Visa transactions | | **Network fee (credit)** | 0.13% | Credit cards | | **Network fee (debit)** | 0.05% | Debit cards (unregulated) | | **International fee** | 1.0% | Cross-border transactions | | **APF (Acquirer Processing Fee)** | $0.0195 | Per transaction | **These are non-negotiable**. Every merchant pays them (usually hidden in your processor's rate). **Total network fees**: ~0.15-0.30% depending on card type and geography. --- ## When Visa Intervenes Directly Visa steps in when: ### 1. Excessive Chargebacks **Above ~0.9% (processor threshold)**: - Your processor flags you and demands a remediation plan - Processor may pass through VAMP per-dispute fees ($8 per CNP dispute) - Continued high ratios lead to processor termination **VAMP Merchant Excessive (1.5%; 2.2% CEMEA)**: - Visa charges $8 per CNP dispute directly to your acquirer - Acquirer passes cost to you or terminates - If no improvement = MATCH listing likely ### 2. Fraud Clusters **Common Point of Purchase (CPP)**: - Multiple fraud complaints trace to your location - Visa investigates directly - Forensic examination may be required - Can lead to MATCH listing under code 01, Account Data Compromise, whose definition now covers Common Point of Purchase. The old standalone code 02 was removed in February 2025 ### 3. Rule Violations Visa fines for: - Surcharging violations - Incorrect MCCs - Late presentment - Incorrect transaction codes **Fines**: $10K-$100K+ per violation ### 4. Arbitration If you and the issuer can't resolve a dispute: - Either party can escalate to Visa arbitration - Visa makes final decision - Loser pays arbitration fee ($600+) + the dispute amount - Visa's decision is binding **When this happens**: Rarely. Under 1% of chargebacks reach arbitration. --- ## Visa vs Mastercard: Key Differences | Factor | Visa | Mastercard | |--------|------|------------| | **Market share (US)** | ~50% | ~25% | | **Chargeback threshold** | ~0.9% (processor) / 1.5% VAMP merchant excessive | 1.5% + 100/month (ECM) | | **Response timeframe** | 30 days | 45 days | | **Reason code format** | 10.4, 13.1 (2-digit) | 4837, 4853 (4-digit) | | **Monitoring programs** | VAMP | ECM/HECM | | **Compelling Evidence** | CE 3.0 (strong program) | Similar but less documented | | **Arbitration** | Visa decides | Mastercard decides | **For merchants**: Processors typically flag Visa disputes earlier (~0.9%) than Mastercard's ECM threshold (1.5%). Visa gives shorter response windows (30 vs 45 days for MC). --- ## Visa's Core Programs ### VDMP and VFMP (Legacy - Replaced by VAMP) VDMP (Visa Dispute Monitoring Program) and VFMP (Visa Fraud Monitoring Program) were replaced by VAMP in April 2025. The old VDMP had a 0.9% + 100 disputes/month threshold that many processors still use as their internal benchmark. Under VAMP, Visa monitors at the **acquirer level** and identifies individual "merchant excessive" cases at 1.5% (2.2% in CEMEA) with 1,500+ disputes. Rather than flat monthly fines, VAMP charges $8 per CNP dispute. **Practical impact**: Most processors still flag you around 0.9% because they need to manage their own acquirer-level VAMP ratio (excessive at 0.7%). The 0.9% "danger zone" is real - it's just enforced by your processor, not directly by Visa. ### Visa Integrity Risk Program (VIRP) Monitors rule violations: - Surcharging violations - MCC misclassification - Processing violations **Fines**: $10K-$100K per violation --- ## Test to Run **Visa compliance health check:** **Week 1: Check your ratios** 1. Calculate current chargeback ratio (all Visa disputes) 2. Calculate fraud ratio (10.x code disputes only) 3. Compare to thresholds: - Under 0.65%: Healthy - 0.65-0.9%: Warning zone (processor may flag you) - Over 0.9%: Crisis (processor action likely) **Week 2: Review reason codes** 4. Pull last 50 Visa disputes 5. Count by reason code (10.4, 13.1, 13.2, etc.) 6. Identify your top 3 codes **Week 3: Evidence audit** 7. For top 3 codes, check if you have required evidence 8. Code 10.4 (fraud): Do you have 3DS? Device matching? 9. Code 13.1 (not received): Do you have tracking + signature? 10. Fix evidence gaps before next dispute **Success criteria**: Ratio under 0.65%, evidence collection in place for top 3 codes. --- ## Scale Callout **Under $100K/month:** - Unlikely to hit high dispute counts at this volume - Focus on keeping ratio under 0.5% - VAMP isn't an immediate concern **$100K-$1M/month:** - Can hit both ratio and count thresholds - Monitor weekly, not monthly - Set internal alarm at 0.6% ratio **Over $1M/month:** - High risk of VAMP if fraud prevention isn't strong - Implement chargeback alerts (RDR) - Consider chargeback guarantee services **Over $10M/month:** - VAMP merchant excessive (1.5%; 2.2% CEMEA) becomes the direct threat - Must have dedicated fraud/chargeback team - Network relationships matter (through processor) --- ## Where This Breaks 1. **Visa rules override your processor**: Your processor may say you can do something, but if Visa's rules prohibit it, Visa wins. Always verify network rules for important decisions. 2. **Visa doesn't care about your story**: You can have a great explanation for why chargebacks spiked. Visa's programs are algorithmic. Over threshold = fines. 3. **Visa timelines are strict**: 30-day response windows are firm. Weekends and holidays count. Plan for this. 4. **Visa won't talk to you directly**: All communication goes through your processor/acquirer. If your processor has a bad relationship with Visa, you suffer. 5. **Arbitration is expensive and binding**: Filing for arbitration costs $600+. If you lose, you pay that plus the dispute amount. Visa's decision is final. --- ## Next Steps **Monitoring Visa programs?** 1. [Chargeback Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - VAMP details 2. [Network Programs Reference](/docs/chargebacks/reference/network-programs) - All programs 3. [Zero Point Nine Panic](/docs/chargebacks/zero-point-nine-panic) - Crisis response **Understanding Visa dispute rules?** 1. [Visa Reason Codes](/docs/reference/reason-codes/visa) - All 20+ codes 2. [Compelling Evidence 3.0](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 details 3. [Representment](/docs/chargebacks/representment) - Fighting Visa disputes **Comparing networks?** 1. [Mastercard](/docs/reference/card-networks/mastercard) - Visa's main competitor 2. [American Express](/docs/reference/card-networks/amex) - Closed-loop network 3. [Discover](/docs/reference/card-networks/discover) - Smaller US network --- ## See Also - [Card Networks Overview](/docs/reference/card-networks) - All four networks compared - [Mastercard](/docs/reference/card-networks/mastercard) - Competitor network - [Payment Ecosystem](/docs/payments/payment-ecosystem) - Where Visa fits in the flow - [Chargeback Monitoring](/docs/chargebacks/monitoring/thresholds) - VAMP details - [MATCH/TMF List](/docs/chargebacks/match-tmf) - Mastercard's MATCH, Visa's TMF and VMSS, and how they differ - [Reason Codes](/docs/reference/reason-codes/visa) - All Visa dispute codes - [3D Secure](/docs/fraud/prevention/3ds) - Visa's liability shift program --- ## Payments Experimentation Source: https://paymentsandrisk.com/docs/reference/experimentation # Payments Experimentation (Operator Field Manual) :::info[TL;DR] - Shadow mode before enforcement: log the fraud rule decision without blocking for 1-2 weeks, measure false positives, then go live. One bad rule enforced on day one will tank your auth rate and you won't know which one did it - Pick one success metric per test (auth lift OR fraud rate OR customer impact, not all three). A three-metric test doesn't have an answer - Run tests by cohort (card brand, geography, device type), not on all traffic at once. If it's all traffic, you can't isolate what changed - Set stop rules before launch: max false positive rate, max revenue at risk per day. Then honor them, because you won't want to at the time ::: Most merchants flip fraud rules live without testing, then scramble when good orders start dying. Shadow first, then enforce. Treat payment rules like code: you wouldn't deploy straight to production, so don't do it here either. _Last verified: Dec 2025. Experimentation frameworks evolve; adapt to your stack._ ## What Matters (5 bullets) - **Shadow mode first.** Log decisions, do not block. Measure false positives before going live. - **Pick a single success metric per test.** Auth lift, fraud rate, CX impact. Not all three at once. - **Run by cohort.** Method, BIN, country, device, CP vs CNP. Never test on all traffic. - **Set stop rules before launch.** Max false positive %, max revenue at risk. Honor them. - **Feedback loops lag.** Use alerts/SAFE/TC40 to shorten the chargeback feedback delay. --- ## Shadow Mode: The Foundation Shadow mode runs your new rule in parallel without enforcing it, so nothing gets blocked and there's no downside to leaving it on. Every transaction gets two decisions: what happened, and what would've happened. That's your false positive rate, for free. ### How to Implement Shadow Mode 1. **Log both decisions** - Actual outcome + shadow rule outcome 2. **Tag transactions** - Mark "would-have-blocked" for tracking 3. **Don't affect the customer** - Shadow decisions are invisible 4. **Track over time** - 7-14 days minimum ### What to Measure in Shadow | Metric | What It Tells You | |--------|-------------------| | Would-block rate | How aggressive is the new rule | | False positive rate | Good orders that would have been blocked | | True positive rate | Bad orders correctly caught | | Coverage | What % of fraud would this catch | ### Shadow Decision Matrix | Actual Outcome | Shadow Decision | Interpretation | |----------------|-----------------|----------------| | Approved, no dispute | Would block | False positive (bad) | | Approved, disputed | Would block | True positive (good) | | Approved, no dispute | Would allow | Correct allow | | Approved, disputed | Would allow | Missed fraud | --- ## Experiment Design Pick the test type first, because the metric follows from it. For a first experiment, tighten one fraud rule. Everything else can wait. ### Test Types | Test Type | What You're Testing | Key Metric | |-----------|---------------------|------------| | Fraud rule tightening | New velocity limit | Block rate vs fraud rate | | Fraud rule loosening | Relaxing a rule | Auth rate vs fraud increase | | 3DS threshold | When to challenge | Conversion vs liability shift | | Auth retry | Decline handling | Recovery rate vs cost | | Checkout flow | Payment form changes | Conversion rate | ### Cohort Selection Never test on all traffic, because if it's all traffic you can't isolate what changed. Pick cohorts that: - Are large enough for statistical significance (500+ decisions) - Represent meaningful segments - Can be isolated **Good cohorts:** - Geographic (US vs EU vs APAC) - Payment method (card vs wallet) - Transaction type (CP vs CNP) - BIN range (specific issuers) - Device type (mobile vs desktop) - Customer type (new vs returning) ### Sample Size Guidelines | Decision Volume | Minimum Test Duration | Notes | |-----------------|----------------------|-------| | Under 100/day | 2-4 weeks | May be inconclusive | | 100-500/day | 1-2 weeks | Standard test period | | 500-2000/day | 3-7 days | Faster feedback | | Over 2000/day | 1-3 days | Can iterate quickly | Under 100 decisions a day, budget the full 2-4 weeks and still expect an inconclusive result. Leave shadow mode on and call it monitoring. --- ## Test to Run ### Week 1: Shadow Phase 1. **Choose one rule change** - Example: tighten velocity on CNP high-risk BINs 2. **Implement shadow logging** - Log would-block decisions 3. **Tag approved transactions** - Mark those that would have been blocked 4. **Monitor daily** - Check false positive rate ### Week 2: Analysis 1. **Calculate false positives** - Good orders that would have blocked 2. **Calculate true positives** - Fraud/disputes that would have caught 3. **Assess impact** - Revenue at risk vs fraud prevented 4. **Decide: proceed, modify, or abandon** ### Week 3: Ramp (if proceeding) 1. **Enable on 10-25% of traffic** - Real enforcement, limited scope 2. **Monitor hourly** - Watch for unexpected blocks 3. **Check customer support** - Any complaints about declines? 4. **Compare to control** - Does reality match shadow? ### Week 4: Full Rollout (if successful) 1. **Roll to 100%** - Only if Week 3 metrics are stable 2. **Document baseline** - New normal for this rule 3. **Set ongoing alerts** - Detect drift from baseline 4. **Plan next experiment** - Continuous improvement --- ## Metrics to Track ### Primary Metrics (choose one per test) | Metric | Definition | Target Direction | |--------|------------|------------------| | Auth rate | Approved / Attempted | Higher is better | | Block rate | Blocked / Attempted | Lower is usually better | | Fraud rate | Disputes / Approved | Lower is better | | Conversion | Completed / Started | Higher is better | ### Secondary Metrics (monitor, don't optimize) | Metric | Why Track It | |--------|--------------| | False positive rate | Catch good-order blocking | | Support tickets | Detect customer friction | | Revenue per attempt | Net effect on business | | Soft vs hard decline mix | Understand decline sources | ### Analyst Calculations ``` Block rate = Blocked transactions / Total attempts False positive rate = (Would-block AND no dispute) / Would-block True positive rate = (Would-block AND disputed) / Total disputed Lift = (New auth rate - Baseline auth rate) / Baseline auth rate ``` --- ## Stop Rules Define these before launch and honor them when they fire, because the moment a stop rule triggers is exactly when you won't want to obey it. ### Example Stop Rules | Condition | Action | |-----------|--------| | False positive rate > 2% | Pause experiment | | Auth rate drops > 1% vs control | Investigate | | Support tickets spike 2x | Pause and review | | Revenue at risk > $X | Rollback | | Any P0 incident | Immediate rollback | ### Rollback Requirements One-click rollback or it isn't an experiment. Before launching any experiment: - Confirm rollback is one-click (or automated) - Test rollback in staging - Document rollback procedure - Assign rollback authority --- ## Scale Callout | Volume | Approach | |--------|----------| | **Under $100k/mo** | Shadow only; avoid live blocks. Use alerts for spikes. No statistical significance for small tests. | | **$100k-$1M/mo** | Shadow โ†’ 25% ramp โ†’ full if false positives under 1%. Document everything. | | **Over $1M/mo** | Require rollback switch, alerting, daily review during ramp. Dedicated owner per experiment. | --- ## Where This Breaks - **No labeled outcomes.** If you can't tell good from bad orders, fix tagging first. No experimentation without truth labels. - **Chargeback feedback lags.** 30-90 day delay on dispute data. Use alerts, SAFE, TC40 to shorten the loop. - **Testing during peak periods.** Black Friday, promotions, holidays skew results. Avoid or heavily caveat. - **Multiple simultaneous changes.** Can't attribute results. Isolate one variable per test. - **No operator-dev handshake.** Engineers deploy, operators don't know. Add "show me the shadow logs" checkpoint. --- ## Common Experimentation Mistakes | Mistake | Consequence | Prevention | |---------|-------------|------------| | No shadow period | Blocked good orders immediately | Always shadow first | | Too short test | Inconclusive results | Minimum sample sizes | | No stop rules | Runaway false positives | Define before launch | | Multiple changes | Can't attribute results | One variable at a time | | No rollback plan | Stuck with bad rule | Test rollback first | | Ignoring support signals | Customer friction unnoticed | Monitor tickets | --- ## Experimentation Infrastructure ### Minimum Requirements 1. **Shadow logging** - Record shadow decisions separately 2. **Outcome tagging** - Link transactions to disputes/refunds 3. **Cohort assignment** - Deterministic customer/transaction bucketing 4. **Metrics dashboard** - Real-time visibility 5. **Alert system** - Trigger on stop rule conditions 6. **Rollback mechanism** - Quick revert capability ### Nice to Have 1. **Statistical significance calculator** - Built into dashboard 2. **Automatic ramping** - Gradual traffic increase 3. **Experiment registry** - Track all active/past tests 4. **Cross-experiment interference detection** - Catch conflicts --- ## Next Steps **Setting up your first experiment?** 1. [Implement shadow mode](#shadow-mode-the-foundation) - Log decisions without blocking 2. [Design the test](#experiment-design) - Test type, cohort, sample size 3. [Define stop rules](#stop-rules) - Before you launch **Running a test now?** 1. [Follow the 2-4 week timeline](#test-to-run) - Shadow, analyze, ramp, rollout 2. [Track key metrics](#metrics-to-track) - Primary and secondary 3. [Know when to stop](#stop-rules) - Honor the rules **Building experimentation infrastructure?** 1. [Meet minimum requirements](#minimum-requirements) - Shadow logging, tagging, cohorts 2. [Avoid common mistakes](#common-experimentation-mistakes) - No shadow, too short, no rollback 3. [Scale appropriately](#scale-callout) - By transaction volume --- ## Related - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Native fraud tools - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Rate-based detection - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Processor Reporting Checklist](/docs/reference/processor-reporting-checklist) - Data requirements - [Alerts Configuration](/docs/operations/alerts-configuration) - Monitoring setup - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Score thresholds - [3D Secure](/docs/fraud/prevention/3ds) - Authentication testing - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches - [Checkout Conversion](/docs/payments/checkout-conversion) - Friction impact - [Fraud Metrics](/docs/fraud/metrics) - Measuring performance - [Chargeback Metrics](/docs/chargebacks/metrics) - Dispute tracking - [Benchmarks](/docs/reference/benchmarks) - Performance targets --- ## Fraud Classification Source: https://paymentsandrisk.com/docs/reference/fraud-classification # Fraud Classification :::info[TL;DR] - **First party**: the person is **lying**. Own identity, own details, false claim - **Second party**: they **handed it over**. Mule, family member, or someone talked into it - **Third party**: nobody gave them anything. It was **taken** - **Synthetic**: there's **no real person** behind it - **Your response differs**: 3DS for third party, evidence for friendly fraud, payout controls for second party - **The industry doesn't agree on any of this.** Every competing definition is quoted below, so you can check us ::: This is the reference page for fraud classification. Other pages give a short definition and link here. We take a position below. Then we show every competing definition we found, so you can judge it. ## Quick Classification | What You See | Likely Type | Your Response | |--------------|-------------|---------------| | Customer disputes legitimate purchase | [Friendly Fraud](/docs/fraud/types/friendly-fraud) | Collect evidence, fight with CE 3.0 | | Card used by someone who was never given access | [Third-Party Fraud](/docs/fraud/types/third-party) | Enable 3DS for liability shift | | Same device, many accounts | [Fraud Ring](/docs/fraud/types/bust-out) | Device fingerprinting, block infrastructure | | Burst of small transactions | [Card Testing](/docs/fraud/types/card-testing) | Velocity rules, CAPTCHA | | Good customer acting strange | [Account Takeover](/docs/fraud/types/account-takeover) | MFA, behavioral analytics | | Excessive returns/refunds | [Refund Fraud](/docs/fraud/types/refund-fraud) | Policy enforcement, tracking | | Promo/coupon abuse | [Promo Abuse](/docs/fraud/types/promo-abuse) | Device linking, limits | | Fake account signups | [Account Fraud](/docs/fraud/types/application-fraud) | Email/phone verification | | Mismatched identity info | [Fake Identity](/docs/fraud/types/synthetic-identity) | Identity verification | --- ## The Four Types, Defined We're going to be direct about this, because most sources aren't. | Type | The test | In one line | |---|---|---| | **First party** | **Is the person lying?** | They're using their own identity, not hiding who they are, and lying about something | | **Second party** | **Did they hand it over?** | The real owner gave their details, card or account to someone else | | **Third party** | **Were they authorized?** | Somebody who was never given access is using it | | **Synthetic** | **Is this a real person?** | An identity built from real and fake pieces, made to deceive | ### First party: the person is lying They aren't hiding who they are. Their name is their name, their address is their address. The lie is about something else. Two shapes, and they're the same act: - **Lying about facts.** Inflating income on an application, misstating what a business does - **Lying about an event.** Saying they didn't make a purchase they made That second one is what most merchants meet, and it's usually called [friendly fraud](/docs/fraud/types/friendly-fraud). :::tip[Not repaying isn't fraud] A customer who borrows and can't pay hasn't lied. That's credit risk, and it's a pricing problem rather than a fraud problem. A customer who lied to get the money committed fraud. **The lie is the line**, and plenty of published definitions blur it. ::: ### Second party: they handed it over Someone gave their identity, card, account or device to another person. The details are genuine because they really are genuine. **The owner participated.** Why they did it varies enormously, and the reason doesn't change the classification: | Situation | Still second party? | |---|---| | Paid to let their account move money (a money mule) | Yes | | Lent a card to a parent, sibling or partner | Yes | | Talked into it on the phone, or by a fake job ad | Yes | | Pressured or controlled by someone else | Yes | | An employee abusing internal access | **No.** That's insider fraud, and it goes under first party | :::warning[Classifying is not blaming] Second party covers people who were paid and people who were tricked. Same *classification*, completely different *culpability*. Say which one you're looking at, separately. Somebody deceived by a phone call still handed their details over. That's second party. They're also a victim. Both are true. ::: ### Third party: nobody gave them anything The person using the card or identity was never given access to it. It was taken, not handed over. Stolen card data, a breached account, a hijacked login. **That's the whole difference from second party.** Did the owner hand it over, or did somebody take it? ### Synthetic: there's no real person An identity assembled from real and fabricated details. It's built to look like someone who doesn't exist. There's no victim to notify and no cardholder to call. Nobody's identity was fully used. Two forms, using the Federal Reserve's terms: | Term | What it is | Also called | |---|---|---| | **Manipulated** | A real person using a substantially different SSN or key detail | First-party synthetic, hybrid | | **Fabricated** | No real person behind it at all | Third-party synthetic, full | ### Worked example: "my family member used my card" This is the most common ambiguous case a merchant sees, and it lands in a different class depending on one fact. Most sources file it all as friendly fraud. That's wrong, and it changes what you should do. | What actually happened | Class | What you do | |---|---|---| | Cardholder gave the card to a relative, then disputed the charge | **First party** | They're lying. Fight it with evidence | | Cardholder gave the card to a relative, and genuinely forgot | **First party**, but not deliberate | Still their charge. Usually cheaper to refund and fix your descriptor | | Cardholder knowingly let a relative use it to move money | **Second party** | Treat as mule risk, not a dispute | | Relative took the card without asking | **Third party** | A real unauthorized use. The cardholder is a victim | Amex names this on its own merchant material, describing charges made by "family or staff." **A large share of what merchants log as fraud is a second cardholder in the same house or business**, and much of that isn't fraud at all. The question to ask, and it's one question: **did the cardholder hand the card over?** --- ## Does the Rest of the Industry Agree? Mostly yes on first, third and synthetic. **Not at all on second.** Here's the evidence, so you can check us. **Key Fact:** the card networks lead with this vocabulary in marketing. They barely use it in their rules. Both Visa and Mastercard say "first-party misuse" publicly. It appears **nowhere** in Visa's 925-page Core Rules. Nor in Mastercard's rules, nor its 1,153-page chargeback guide. So "the networks define it this way" means someone is quoting a brochure. ### Where the numbering comes from {/* #where-the-numbering-comes-from */} This explains most of the confusion. A normal transaction has **two** parties: you and your customer. | Party | Who that is | |---|---| | First party | your customer | | Second party | **you, the merchant** | | Third party | an outsider who was never in the transaction | So read strictly, "second-party fraud" should mean fraud committed by the merchant. Nobody uses it that way. The term got invented later, for a real problem that needed a name. It landed in a slot that was already taken. That's why no two sources define it the same way. ### First party: two camps, one act **Lenders describe the application.** | Source | What they say | |---|---| | **Experian** | "an individual who makes a promise of future repayment in exchange for goods / services without the intent to repay" | | **TransUnion** | "misrepresenting one's personal information in order to receive a product or service to which they have no entitlement." Also calls it "credit muling" | | **Equifax** | "an individual intentionally misrepresents their identity and/or gives false information for financial or material gain" | | **Socure** | "the use of one's own identity to open an account and/or commit a dishonest act for personal or financial gain" | | **DataVisor** | "the fraudster is not misrepresenting who they are, but rather, they're being deceptive about their information, and their intentions" | **Payments people describe the dispute.** | Source | What they say | |---|---| | **Ethoca (Mastercard)** | first-party fraud and friendly fraud "mean the same thing and are often used interchangeably. It's when a customer identifies a legitimate purchase on their transaction statement as fraudulent and disputes it" | | **Mastercard** | "When cardholders dispute a genuine transaction, that's first-party misuse or 'friendly' fraud" | | **Sift** | "chargeback fraud, dispute fraud, first-party fraud, first-party misuse, and friendly fraud all describe when an authorized cardholder makes a purchase... and later claims that the purchase was fraudulent" | | **Signifyd** | "any type of fraud that involves using a real, genuine identity to defraud an ecommerce company" | | **Forter** | "also known as friendly fraud... where actual customers commit fraud by disputing legitimate transactions" | | **BioCatch** | "commonly known as friendly fraud, occurs when a customer consciously disputes a transaction to avoid payment or gain a refund" | Those look like two definitions. **They're one act seen at two moments.** Lying about your income and lying about a purchase are both lying. Both use your own real identity. That's why we test for the lie instead of picking a camp. It matters when you read a number. "First-party fraud is up 40%" tells you nothing on its own. Ask what it counts: loan applications, disputed charges, or both. Visa's own commissioned research concedes it: "This abuse of the dispute system has many names, such as first-party fraud, friendly fraud, and dispute misuse. Regardless of what it is called..." **SentiLink** has said it plainly in print. First: "First Party Fraud has differing definitions depending upon who or what company you ask." Then: "The definition of First Party Fraud is confusing and can be interpreted both as (1) credit risk or (2) fraud risk." ### Second party: five different definitions Every source below describes something real. They disagree about how willing the person had to be. | How willing was the account holder? | Example | Who calls this second party | |---|---|---| | **Paid volunteer.** Knew, took a cut | classic money mule | Experian, TransUnion, SEON, Persona, KYCAID, FraudNet, Sardine | | **Helping someone.** Knew, wasn't paid | lending a card to a relative | iDenfy, Linkurious, Persona | | **Tricked.** Handed details over believing a lie | phishing, fake job ad | Equifax Canada | | **Coerced.** Under someone else's control | trafficking, an abusive relationship | Alloy, TrustDecision | | **Not the account holder at all** | an employee abusing access | AU10TIX, NordVPN | Some of the wording, so you can see the gap: | Source | What they say | |---|---| | **Experian** | "An individual knowingly gives their identity or personal information to another person, to commit fraud" | | **Sardine** | "fraud enabled by an account holder who knowingly lets someone else use their identity or account." The test is "willing complicity by the account owner" | | **Persona** | "essentially permission to engage in 'light identity theft'... both individuals are active participants in the fraud" | | **KYCAID** | "an authentic customer willingly shares their identity, account, or device with a criminal... Signals are genuine because, literally, they are. Intent is the issue" | | **Alloy** | "one person exerting psychological control over another in order to commit fraud" | | **AU10TIX** | "collusion between a member of the organization or business and an external party" | | **NordVPN** | "the perpetrator has a pre-existing relationship with the target or is an insider" | Two of those point at opposite people. For Experian, the second party is the customer who handed their details over. For AU10TIX, it's the employee. **And "knowingly" is doing a lot of work.** Sardine's test is willing complicity. Read strictly, that drops the person who was tricked by a fake job ad and the person under someone else's control. They handed over the same details, and the money moves the same way. We keep them in, and treat [classification and culpability](#second-party-they-handed-it-over) as separate questions. **We take the first four rows and reject the fifth.** Handing something over is one act, whatever the reason. It's also something you can observe. An employee abusing access never handed over anything of their own. Insider fraud also has a mature home already, in the ACFE's occupational fraud framework. ### Third party: everyone agrees | Source | What they say | |---|---| | **Experian** | used "without their consent or knowledge" | | **TransUnion** | "the person whose information is being used is unaware and has not given consent" | | **FICO** | "an unknown or **unauthorized** entity commits fraud" | | **Ethoca (Mastercard)** | "an **unauthorized** person gets ahold of someone's payment card information and credentials and makes purchases" | | **SEON** | "the use of an individual's details to commit financial crime. Often known as identity theft" | | **AU10TIX** | "an external entity, unrelated to the organization or individual" | | **Sardine** | "fraud committed with a real victim's stolen identity, credentials, or account, without their knowledge or consent" | FICO and Ethoca both use the word "unauthorized," which is the test we use. ### Synthetic: defined, but never filed The **Federal Reserve** put 12 fraud experts in a room to settle it. They landed on this: "the use of a combination of personally identifiable information (PII) to fabricate a person or entity in order to commit a dishonest act for personal or financial gain." **SentiLink**: "fraudsters combine fictitious and/or real information to create new identities with the intent to defraud." Notice what the Fed never says: which party bucket it belongs in. That isn't an oversight. Ask "whose identity was it" and there's no answer. The industry couldn't agree either. FICO ran a LinkedIn poll in September 2020. Its 42 respondents split almost evenly three ways: first party, third party, or its own category. **Focal** and **Linkurious** fold it into first party. We keep it separate, and so does the Fed. ### Some vendors aren't sorting by actor at all {/* #sorting-by-stage */} This is the deepest reason two lists don't line up, and almost nobody names it. Everything above sorts by **who did it**. Some vendors sort by **when it happened** instead: at the application, at the transaction, or on the account afterwards. **Sardine** does this. It makes application fraud a class of its own, "lying on the form," and files three things underneath it: | Sardine's subtype | Where we put it | |---|---| | Stolen identity | Third party | | Synthetic identity | Its own class | | First-party fraud | First party | So one of their classes contains three of ours. Neither list is wrong. They answer different questions, and a term that's a subtype in one is a top-level class in the other. **What to do with that.** When a vendor's taxonomy doesn't match yours, check the axis before you argue about definitions. Ask: is this sorted by **who**, or by **when**? A lot of what looks like disagreement is one list sorted by actor and another sorted by stage, set side by side as though they measured the same thing. :::tip[When a vendor quotes you a number] Ask one question: **does that figure count loan applications, disputed charges, or both?** LexisNexis counts both. That's why its numbers look larger than everyone else's. "First-party fraud is 36% of all fraud" measures something different from a chargeback-abuse figure. ::: --- ## By Actor ### First-Party Fraud (Your Customer) The customer is real and uses their own identity, but abuses your policies. | Subtype | Description | Defense | |---------|-------------|---------| | [Friendly Fraud](/docs/fraud/types/friendly-fraud) | Disputes legitimate purchase | Evidence collection, CE 3.0 | | [Refund Fraud](/docs/fraud/types/refund-fraud) | Exploits return policies | Policy enforcement | | [Promo Abuse](/docs/fraud/types/promo-abuse) | Games promotions/discounts | Device linking, limits | | Insider fraud | An employee abuses their access | Role-based access, reviews | **Chargeback outcome**: Winnable with proper evidence ### Second-Party Fraud (Your Customer, Working For Someone Else) The real owner handed over their details, card or account. The identity is genuine because it really is genuine. The money goes to somebody else. Most merchants meet this as a marketplace or payout problem rather than at checkout. | Subtype | Description | Defense | |---------|-------------|---------| | Money mule | Account exists to receive and forward funds | Payout pattern review, no-trade sellers | | Family and friends | A relative uses the card with permission | Ask before treating it as fraud | | Talked into it | Fake job ad, phone scam, romance scam | Treat the holder as a victim | | Account farming | Aged accounts sold on for their history | Dormant-then-active review | **Chargeback outcome**: Rarely a chargeback. It shows up as account closure and payout risk :::warning[Watch the line here] Someone talked into handing over their details **is** second party, because they handed them over. They're also a victim. Classification and culpability are separate questions, and you should answer both. ::: ### Third-Party Fraud (Taken, Not Given) Somebody who was never given access is using the card or identity. It was taken, not handed over. If the owner handed it over, however they were persuaded, that's second party instead. | Subtype | Description | Defense | |---------|-------------|---------| | [Stolen Card](/docs/fraud/types/third-party) | Uses compromised card | [3D Secure](/docs/fraud/prevention/3ds), [AVS/CVV](/docs/fraud/prevention/avs-cvv) | | [Card Testing](/docs/fraud/types/card-testing) | Validates stolen cards | Velocity rules, CAPTCHA | | [Account Takeover](/docs/fraud/types/account-takeover) | Hijacks customer account | MFA, behavioral analytics | **Chargeback outcome**: Hard to win unless you have 3DS liability shift ### Fake Identity Fraud Fraudster creates fabricated or mixed identity information. | Subtype | Description | Defense | |---------|-------------|---------| | [Fake Identity](/docs/fraud/types/synthetic-identity) | Fabricated persona | Identity verification | | [Account Fraud](/docs/fraud/types/application-fraud) | Fake account signups | Email/phone verification | **Chargeback outcome**: Sometimes winnable with identity mismatch evidence ### Organized Fraud This one is a different question. The classes above ask *who the actor was*. This asks *how many*. A fraud ring is usually third-party fraud at scale. | Subtype | Description | Defense | |---------|-------------|---------| | [Fraud Rings](/docs/fraud/types/bust-out) | Multi-account attacks | Device fingerprinting, consortium data | | [Triangulation](/docs/fraud/types/triangulation) | Resale scheme using a fake storefront | Shipping address analysis | **Chargeback outcome**: Document network evidence for representment --- ## Classification Decision Tree ```mermaid flowchart TD A[Fraud Detected] --> B{Who placedthe order?} B -->|Customer| C{Did they lie?} B -->|Someone else| D{Did the ownerhand it over?} B -->|Multiple accounts| E[Fraud Ring] C -->|Denied a real purchase| F[Friendly Fraud] C -->|Policy abuse| G[First-PartyRefund/Promo] C -->|No, gave detailsto someone| K[Second-Party] D -->|Taken, never given| H[Third-Party Fraud] D -->|Owner handed it over| K D -->|Nobody real| I[Fake Identity] D -->|Account hijacked| J[Account Takeover] click F "/docs/fraud/types/friendly-fraud" click G "/docs/fraud/types/refund-fraud" click H "/docs/fraud/types/third-party" click I "/docs/fraud/types/synthetic-identity" click J "/docs/fraud/types/account-takeover" click E "/docs/fraud/types/bust-out" ``` --- ## Response by Classification | Fraud Type | Immediate Action | Prevention | Chargeback Strategy | |------------|-----------------|------------|---------------------| | Friendly Fraud | Collect delivery proof | Clear descriptors, communication | CE 3.0, device data | | Second-Party | Review payouts, close if confirmed | Payout change controls | Rarely applicable | | Third-Party | Cancel/refund if caught | Enable 3DS | Rely on liability shift | | Card Testing | Block IP/device | Velocity limits, CAPTCHA | N/A (usually declined) | | ATO | Lock account, notify customer | MFA, device recognition | Show account compromise | | Refund Fraud | Flag account | Enforce policies | Document abuse pattern | | Promo Abuse | Revoke benefits | Device linking | N/A (usually internal) | | Fraud Ring | Block infrastructure | Device fingerprinting | Show organized pattern | --- ## The Part Nobody Selling Software Will Tell You A share of what gets counted as first-party fraud isn't fraud. It's people who can't pay. - **LexisNexis** runs a whole category called "distressed consumers," separate from fraud - **Visa's** commissioned research found consumer motivations split roughly evenly between wanting to avoid payment and facing economic hardship - **LexisNexis** again: first-party fraud is "exacerbated by periods of inflation and the rising cost of living" One more finding, before you build rules around age. The behavior is "not limited to younger demographics." That matters for policy. A customer in genuine difficulty responds to a payment plan. A serial abuser doesn't. Treat both as fraud and you lose the first group. --- ## Related Topics - [Fraud Types Overview](/docs/fraud/types) - Detailed guides for each type - [First-Party Fraud](/docs/fraud/types/first-party) - Customer abuse in detail - [Third-Party Fraud](/docs/fraud/types/third-party) - Used without consent - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Customer disputes - [Fake Identity Fraud](/docs/fraud/types/synthetic-identity) - Fabricated personas - [3D Secure](/docs/fraud/prevention/3ds) - Liability shift for third-party fraud - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Linking fraud cases - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - Fighting chargebacks --- ## Chargeback Source: https://paymentsandrisk.com/docs/reference/glossary/chargeback # Chargeback :::info[TL;DR] - Your customer went to their bank instead of to you - The money's gone before you hear about it - **Find your response deadline first.** It's 20-45 days. Miss it and you lose automatically - Real cost is the sale, a fee of $0 to $30, and 30-60 minutes of staff time - At the usual $15 fee, a $50 chargeback runs closer to $80 - "Chargeback" and "dispute" mean the same thing. Your dashboard says "dispute" - One chargeback is normal. A pattern is the problem ::: A chargeback is a forced reversal of a card transaction. Your customer's bank, their issuer, pulls the money back out of your account. You find out after it's gone. You get a window to respond with evidence. Respond weakly, or not at all, and you lose the money plus a fee on top. **Deadline first:** 20-45 days, depending on the network. Miss it and you lose automatically. How good your case was doesn't matter. Go find yours now: | Processor | Where to look | |-----------|---------------| | **Stripe** | Payments > Disputes | | **Square** | Transactions > Disputes | | **PayPal** | Resolution Center | | **Shopify Payments** | Orders > the order > Chargebacks | **Typical cost:** the sale, plus a fee of $0 to $30, plus 30-60 minutes of staff time. Most US processors charge $15. So a $50 chargeback usually costs you closer to $80. Whether the fee comes back depends on who you're with. Helcim, Shopify Payments and PayPal's standard tier don't charge it on a win. Square charges nothing at all, and Stripe and Toast charge it either way. The [verified per-processor table](/docs/payments/total-cost-model#step-2-chargeback-costs-often-underestimated) has the rest. :::tip[Don't Panic] One chargeback isn't an emergency. Every business that takes cards gets them. What matters is whether it becomes a pattern. That's what your chargeback ratio measures. ::: "Chargeback" and "dispute" mean the same thing in practice. A dispute is the customer's complaint, a chargeback is the money leaving. Every dashboard above says "dispute", so search for that word, not this one. --- ๐Ÿ“– **Full guide:** [What Is a Chargeback?](/docs/chargebacks) covers the whole process, what it costs, and what to do about it. ## See Also - [Your First Chargeback](/docs/chargebacks/your-first-chargeback) - what to do in the next 30 minutes - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - how disputes move from filing to resolution - [Chargeback Metrics](/docs/chargebacks/metrics) - calculating your ratio and the thresholds that fine you - [Reason Codes](/docs/reference/reason-codes) - what the code on your notice means - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - when real customers dispute real purchases --- ## Interchange Fee Source: https://paymentsandrisk.com/docs/reference/glossary/interchange-fee # Interchange Fee :::info[TL;DR] - Interchange is what your processor pays the customer's bank. You can't negotiate it. Nobody can. What you negotiate is the markup on top - It's the biggest single line in your bill. It's also smaller than the "70-80%" figure people repeat. On this site's blended card-present mix it runs about **0.89% + $0.158**. That's roughly 60% of an interchange-plus bill, closer to 40% of a flat rate on a $50 ticket - Rates vary by card type, channel, MCC and data quality. A $100 sale carries $0.27 of interchange on regulated debit. On a corporate purchasing card it carries $3.10 - Square Free card-present is 2.6% + 15c. Helcim's entry band is interchange + 0.40% + 8c. They tie when your interchange alone averages **2.06% + 5c**, after the 0.14% + 2c of network assessments this site assumes. On a blended mix that's a **$9.23 ticket** - Pull your last statement before you use any of these numbers. The card mix is yours, not ours ::: Interchange is what your bank pays the customer's bank on every card transaction. Yours is the acquirer, theirs is the issuer. The networks set the rate, and Visa, Mastercard, Amex and Discover publish the tables, updated twice a year in April and October. You can't negotiate interchange. Same category, same card type, same rate for everybody. What you negotiate is the markup on top. ## Why It Matters Interchange is the largest single line in your processing cost, but the widely repeated "70-80%" overstates it for most SMBs. On this site's [blended card-present mix](/docs/payments/reference/cost-model-assumptions), interchange runs about **0.89% + $0.158** per sale, which is $0.60 on a $50 ticket. Helcim's entry-band bill on that sale is $0.97, so interchange is roughly 60% of it. Square's Free plan charges $1.45 at 2.6% + 15c, so interchange is about 40% there. Verified 2026-08-02 at [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees). The rest is the processor's markup plus network assessments. This site carries assessments at an assumed and **unverified** 0.14% + $0.02. Neither network publishes them. A credit-heavy mix pushes that share up. A debit-heavy one pulls it down. Treat 60% as an anchor, not a fact about your business. Understanding interchange tells you: - Whether your processor's pricing is fair - Why some transactions cost more than others - Where you have room to optimize (and where you don't) ## How It's Determined Every transaction gets a rate. Several things decide which one: | Factor | Impact | |--------|--------| | **Card type** | Debit cards cost less than credit. Rewards cards cost more than basic cards. Corporate cards cost the most. | | **Transaction type** | Card-present (chip/tap) costs less than card-not-present (online). | | **MCC** | Your merchant category code affects which rate table applies. Grocery and gas have lower rates than general retail. | | **Data quality** | Sending complete transaction data (Level II/III for B2B) qualifies you for lower rates. | | **Authentication** | 3D Secure authenticated transactions may qualify for lower interchange. | ### Example Rates (US, Visa, card-present) From Visa's US schedule published 18 April 2026, cross-checked against Mastercard's of 17 April 2026. Both verified 2 August 2026. | Card Type | Card-present | Online (CNP) | |-----------|--------------|--------------| | Regulated debit (Durbin) | 0.05% + $0.22 | 0.05% + $0.22 | | Exempt debit (small issuers) | 0.70-0.80% + $0.15 | 1.65% + $0.15 | | Basic consumer credit (no rewards) | 1.51% + $0.10 | 1.89% + $0.10 | | Standard rewards credit | 1.65% + $0.10 | 2.05% + $0.10 | | Premium rewards (Signature Preferred) | 2.10% + $0.10 | 2.50% + $0.10 | | Top consumer tier (Visa Infinite, MC World Elite) | 2.30% + $0.10 | 2.60% + $0.10 | | Small business cards | around 2.10% + $0.10 | 2.79% + $0.10 | | Commercial, corporate and purchasing | 2.50-3.00% + $0.10 | 2.50-3.00% + $0.10 | | Non-qualified (failed qualification) | 3.15% + $0.10 | 3.15% + $0.10 | The regulated debit figure is the $0.21 Durbin cap plus 0.05%. Add the $0.01 fraud-prevention adjustment most issuers qualify for. It's identical on both networks, because Regulation II sets it federally and neither network prices it. The two networks converge at the bounds that matter. Top consumer tier is 2.30% + $0.10 card-present and 2.60% + $0.10 online on both. Non-qualified is 3.15% + $0.10 on both. Competitor pages present Visa and Mastercard as two separate lookups. For the numbers that bound your cost, it's one schedule. Two sets of program names. The same $100 purchase costs $0.27 on a regulated debit card tapped in store and $3.10 on a corporate purchasing card. That's more than 10x on the same sale. **No single row here is your rate.** Your rate is the mix, which is why this site uses a blended 0.89% + $0.158 card-present rather than any line above. ## Three Pricing Models Your pricing model decides what you see: | Model | How Interchange Appears | Best For | |-------|------------------------|----------| | **Flat rate** | Hidden inside one rate (Square Free is 2.6% + 15c card present, 3.3% + 30c online) | Simplicity and predictability | | **Interchange plus** | Interchange shown separately + published markup (Helcim is interchange + 0.40% + 8c card present at $0-50K/month, with a $0 monthly fee) | Anyone who wants to see the actual cost | | **Tiered** | Bundled into "qualified/mid/non-qualified" buckets | Avoid this model if possible | Rates verified 2026-08-02: [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), [helcim.com/pricing](https://www.helcim.com/pricing/). Flat-rate pricing (Square, Shopify Payments, Stripe) is simple, but it means you overpay on the cheap cards: debit, plus basic and standard-rewards credit at any normal ticket. You underpay on the expensive ones, meaning premium rewards and commercial. Interchange-plus means you pay the real interchange, the network assessments, and a published markup. For a small in-person merchant on a debit-heavy mix, interchange-plus is the right default now that the monthly fee is gone. Tiered belongs in neither camp. Bundling interchange into "qualified" buckets is exactly what stops you doing this arithmetic at all. ## Common Mistakes - **Trying to negotiate interchange.** You can't. It's set by the networks. Negotiate your processor's markup instead. - **Assuming you need volume before interchange-plus makes sense.** That used to be true. Interchange-plus carried a monthly fee back then. Helcim now publishes interchange + 0.40% + 8c card present from the first dollar. **No monthly fee, no setup fee, no PCI fee, no statement fee** ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). Once the monthly fee is zero, volume stops being the question. Card mix is. - **Not knowing your own break-even.** Square Free card present is 2.6% + 15c. Helcim's entry band is interchange + 0.40% + 8c. On top of interchange you also pay network assessments, assumed here at 0.14% + 2c. The two prices tie when your **interchange alone averages 2.06% + 5c**. Interchange plus assessments together tie at 2.20% + 7c. Same rule, stated the other way. Check which basis a comparison uses before you trust it. Below the tie point, interchange-plus wins. Above it, flat rate wins. On this site's [blended card mix](/docs/payments/reference/cost-model-assumptions) the break-even is a **$9.23 card-present ticket**. It moves between $7.94 and $12.20 depending on which card the customer hands you. A debit-heavy retail mix sits far below 2.06%. That's why interchange-plus usually wins for small in-person merchants. A premium-rewards or commercial-heavy mix sits above it and never crosses. Pull your last statement and check. - **Ignoring downgrades.** Miss the data requirements and the rate goes up. That's a downgrade. Missing CVV, missing AVS, late settlement. All of them cost you. - **Not checking your effective rate.** Total fees divided by total volume. Above 3.0% on card-not-present, go looking. One exception: Square's Free plan prices online at 3.3% + 30c. On that plan you're above 3.0% by design. The fix is a different plan or processor, not an investigation. ## How to Optimize You can't change interchange rates. You can change which rate you qualify for: 1. **Settle transactions promptly.** Capturing within 24 hours avoids downgrades. 2. **Send complete data.** AVS, CVV and order details qualify you for the best rate. 3. **Enable debit routing.** Durbin lets you route PIN debit through cheaper networks. 4. **Accept digital wallets.** Apple Pay and Google Pay are tokenized. That often qualifies them for lower rates. 5. **Switch to interchange-plus.** See the real cost per transaction. Stop overpaying on debit. --- ## See Also - [Interchange Reference](/docs/payments/reference/interchange) - Full interchange rate tables and qualification criteria - [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) - The blended interchange figure this site uses, its sources, and the sensitivity checks behind it - [Interchange Optimization](/docs/payments/interchange-optimization) - Tactics for qualifying for lower interchange rates - [Reading Statements](/docs/operations/reading-statements) - How to find interchange costs on your processor statements - [Processor Fees Guide](/docs/payments/processor-fees-guide) - Understanding all the fees beyond interchange - [Debit Routing](/docs/payments/reference/debit-routing) - Routing debit transactions to lower-cost networks - [MCC (Merchant Category Code)](/docs/reference/glossary/mcc) - How your business category affects interchange rates --- ## MCC (Merchant Category Code) Source: https://paymentsandrisk.com/docs/reference/glossary/mcc # MCC (Merchant Category Code) :::info[TL;DR] - An MCC is the four-digit code that says what your business sells. Your acquirer assigns it, you don't pick it - It sets which interchange table you qualify for, which fraud rules apply, and whether a processor will board you at all - Changing it means asking your processor, and they'll want a reason - A wrong MCC quietly costs you money on every transaction. Check yours on your statement ::: Your MCC is a four-digit number that says what you sell. Your acquirer assigns it when you open the merchant account, or your processor does if it's acting as the acquirer. You don't get a vote. Changing it later means filing a request. It does more work than most merchants realize. It sets which interchange table you qualify for. It steers which fraud rules hit your traffic. It drags in compliance requirements you never signed up for. It can decide whether a network lets you process at all. ## Why It Matters | What MCC Affects | How | |------------------|-----| | **Interchange rates** | Different MCCs qualify for different rate tables. Grocery (5411) and gas (5541) get lower rates than general retail (5999). | | **Fraud screening** | Card networks and issuers apply different risk rules by MCC. High-risk MCCs (travel, gaming, digital goods) get more scrutiny. | | **Compliance requirements** | Certain MCCs trigger additional network rules: recurring billing disclosures, age verification, content restrictions. | | **Processor acceptance** | Some processors won't onboard certain MCCs. Stripe and Square restrict high-risk categories like supplements, adult content, and firearms. | | **Customer statement** | The MCC determines how the charge is categorized on the customer's card statement (e.g., "Travel" vs. "Retail"). | | **Card benefits** | Rewards cards give bonus points by MCC category. Your MCC determines whether a purchase earns 1x or 3x points. | ## Common MCCs | MCC | Category | Notes | |-----|----------|-------| | 5411 | Grocery stores | Lower interchange rates | | 5541 | Gas stations | Lower interchange, specific terminal rules | | 5812 | Restaurants | Tip adjustment rules apply | | 5999 | General retail | Default catch-all | | 5734 | Computer software stores | Often used for SaaS | | 7372 | Computer programming/data | Common for software and digital goods | | 4722 | Travel agencies | Higher risk classification | | 7995 | Gambling/betting | Restricted MCC, many processors won't touch it | | 5967 | Direct marketing (inbound telemarketing) | High-risk, additional monitoring | ## Common Mistakes - **Wrong MCC assigned.** Get booked as "computer hardware" when you're selling SaaS and you'll pay the wrong interchange and trip the wrong fraud rules. Check your merchant agreement, or just ask. - **Not knowing your MCC.** Plenty of merchants have never looked. It's in your merchant agreement and your processor dashboard, and support will tell you. - **Assuming you can change it easily.** A change means your processor reclassifies you, and some resist, since it moves their own risk exposure. If yours is genuinely wrong, push. If you're angling for a cheaper rate, they'll say no. - **Multi-product businesses.** Sell physical goods and digital subscriptions and you still get one MCC for the whole account. If the product lines are genuinely different, separate merchant accounts with their own MCCs can pay for themselves. ## High-Risk MCCs Some MCCs draw extra scrutiny from networks, processors and issuers: | Category | MCCs | Why It's "High Risk" | |----------|------|---------------------| | Travel | 4722, 3000-3350 | High ticket, advance purchase, cancellation disputes | | Digital goods | 5815, 5816, 5818 | No physical delivery proof, instant fulfillment | | Gambling/gaming | 7995, 7994 | Regulatory restrictions, compulsive spending disputes | | Supplements/nutraceuticals | 5499, 5912 | High chargeback rates industry-wide | | Adult content | 5967 | Content restrictions, processor policies | | CBD/cannabis | 5993 | Legal gray areas, banking restrictions | If your business falls into a high-risk MCC, expect: - Fewer processor options (Stripe and Square may decline your application) - Higher processing rates (0.5-2.0% above standard) - Rolling reserves (processor holds 5-10% of your volume for 6 months) - Stricter chargeback thresholds ## How to Check Your MCC 1. **Merchant agreement.** It's in your original application or contract. 2. **Processor dashboard.** Stripe: Settings > Account details. Square: Account & Settings > Business information. 3. **Ask your processor.** Email or chat support can confirm it. 4. **Check a transaction.** Ask a customer what category your charge shows up under. That's your MCC talking. --- ## See Also - [MCC Codes Reference](/docs/reference/mcc-codes) - Full lookup table of all merchant category codes - [Interchange Fee](/docs/reference/glossary/interchange-fee) - How your MCC directly affects interchange rates - [Buying Payments](/docs/payments/buying-payments) - Processor selection including MCC-based requirements - [The merchant blacklist (MATCH)](/docs/chargebacks/match-tmf) - How wrong MCC assignment can lead to compliance violations - [Compliance Overview](/docs/compliance) - Network rules tied to specific MCCs - [Processor Comparison](/docs/payments/processor-comparison) - Which processors accept high-risk MCCs --- ## Payment Processor Source: https://paymentsandrisk.com/docs/reference/glossary/payment-processor # Payment Processor :::info[TL;DR] - Your processor routes the transaction, gets back the approve or decline, and settles the money into your bank - The word gets used loosely. It can mean the technical router, the acquirer holding your account, or an all-in-one like Stripe, Square or PayPal. For most small businesses it's one company - They control your pricing, your payout timing, your fraud tools, and whether your account stays open - It's the most consequential vendor decision you'll make ::: A payment processor is the company that handles your card transactions. A customer taps "Pay." The processor takes the card details and routes them through Visa or Mastercard to the customer's bank. It gets back an approve or a decline. Then it settles the money into your bank account. That last part isn't instant. The term gets used loosely. "Processor" can mean the company doing the technical routing. It can mean the acquirer holding your merchant account. It can mean an all-in-one platform doing both, like Stripe, Square or PayPal. For most small businesses they're the same company. ## Why It Matters Your processor is the most important vendor you have. They decide: | What They Control | Impact | |-------------------|--------| | **Your pricing** | How much you pay per transaction (2.6-3.5% is the typical range) | | **Your payout timing** | When money hits your bank (1-3 business days, sometimes longer) | | **Your fraud tools** | What built-in fraud protection you get | | **Your chargeback experience** | How disputes are communicated and managed | | **Your uptime** | If they go down, you can't accept payments | | **Your account stability** | They can freeze or terminate your account | ## Two Models ### Bundled (Payment Facilitator / PayFac) Stripe, Square, Shopify Payments and PayPal act as payment facilitators. You sign up in minutes. You process under their master merchant account. They handle the rest. | Pros | Cons | |------|------| | Fast setup (minutes, not weeks) | Flat-rate pricing (overpay at higher volume) | | No underwriting hassle | Less pricing flexibility | | Built-in fraud tools | Account freezes with little warning | | Simple dashboard | Limited customization | **Best for:** under $500K/year, anyone who wants simplicity, anyone just starting. ### Standalone (Gateway + Merchant Account) The traditional setup. You hold a merchant account with an acquirer like Worldpay, First Data or your own bank. A gateway like Authorize.net or NMI connects it to your checkout. | Pros | Cons | |------|------| | Interchange-plus pricing | Setup takes days to weeks | | More stable accounts | Underwriting required | | Negotiable rates | More vendors to manage | | Direct relationship with acquirer | More technical complexity | **Best for:** over $500K/year, high-risk MCCs, anyone who needs pricing control. ## How to Choose It comes down to volume and complexity: | Your Situation | Recommended Path | |----------------|-----------------| | Just starting, under $10K/month | Stripe or Square (fastest setup) | | E-commerce, $10K-$100K/month | Stripe, Shopify Payments, or PayPal (still simple) | | Growing, $100K-$500K/month | Start comparing interchange-plus options | | Over $500K/month | Dedicated merchant account + gateway, negotiate rates | | High-risk MCC | Specialized high-risk processor (PayKickstart, Durango, etc.) | | In-person sales | Square or Stripe Terminal (best hardware integration) | ## What to Watch For - **Effective rate creep.** Work out total fees divided by total volume every month. If it climbs with no explanation, either your pricing changed or you're taking more downgrades. Anything above 3.0% card-not-present is worth a look. - **Reserve holds.** Some processors hold back a slice of your sales, especially on new or high-risk accounts. Read the terms before you sign, because you won't renegotiate them later. A 10% rolling reserve on a $50K month locks up $5,000 of your money. - **Termination clauses.** Know what gets your account shut off. Usual triggers: chargeback ratio over 1%, sudden volume spikes, prohibited products. Termination can land you on the MATCH list. That entry sits for five years and makes a new merchant account very hard to get. - **Payout delays.** Two business days is standard for most processors. Seeing 7+ days consistently? Something's wrong. Ask your processor why. - **Support quality.** Your payments go down at 8pm on a Friday. Can you reach a human? Test that before you need it. ## Common Mistakes - **Choosing on rate alone.** The cheapest processor with bad support won't stay cheap. Saving $25 a month means nothing if they freeze your account for two weeks. - **Not reading the contract.** Early termination fees, minimum monthly fees, PCI non-compliance fees, batch fees, statement fees. Read the fine print, or make your processor walk you through every line. - **Running too long on flat-rate.** Stripe's 2.9% + $0.30 is simple, and it's expensive at volume. At $50K/month, interchange-plus can save $200-$500 a month. - **No backup processor.** Your one processor freezes or goes down, and you're not taking payments. At $100K+/month, a second processor is worth the setup cost. --- ## See Also - [Buying Payments Guide](/docs/payments/buying-payments) - End-to-end guide for selecting and onboarding a processor - [Processor Comparison](/docs/payments/processor-comparison) - Side-by-side comparison of major processors - [Processor Fees Guide](/docs/payments/processor-fees-guide) - Understanding all the fees your processor charges - [Processor Management](/docs/operations/processor-management) - Managing the ongoing relationship with your processor - [Holds and Reserves](/docs/operations/holds-and-reserves) - How processors hold funds and when reserves apply - [The merchant blacklist (MATCH)](/docs/chargebacks/match-tmf) - What happens if a processor terminates your account --- ## Look Up Your Business Category Code (MCC) Source: https://paymentsandrisk.com/docs/reference/mcc-codes # Look Up Your Business Category Code (MCC) :::info[TL;DR] - Your MCC drives your interchange, your reserve, your approval odds, and your chargeback thresholds. The wrong one costs real money - High-risk MCCs (5966, 5967, 5968 for direct marketing; 7995 for gambling; 5912 for pharmacies) get you rolling reserves of 5-10% and higher rates at most processors - Check your processor statement for the code you're actually assigned. Miscategorized merchants can overpay interchange, or look safer to underwriters than they should - You can ask for a correction. The processor decides, and some changes mean re-underwriting ::: Your [MCC](/docs/reference/glossary/mcc) (Merchant Category Code) is the code that tells the card networks and your processor what kind of business you run. Your processor assigned it, and you probably never watched it get picked. It drives your [interchange rates](/docs/reference/glossary/interchange-fee), your [reserve requirements](/docs/operations/payout-strategy), whether a [processor](/docs/reference/glossary/payment-processor) approves you at all, and which [chargeback monitoring](/docs/chargebacks/reference/network-programs) thresholds you're held to. Get it wrong and you're either overpaying or one review away from termination. ## What Your MCC Actually Controls | Impact Area | How MCC Affects It | |-------------|-------------------| | **[Interchange rates](/docs/payments/reference/interchange)** | Some MCCs qualify for lower rates (supermarkets, utilities). Others pay premium (high-risk categories). | | **[Reserve requirements](/docs/operations/payout-strategy)** | High-risk MCCs trigger 5-10% rolling reserves by default. | | **[Processor approval](/docs/payments/buying-payments)** | Some processors won't touch certain MCCs. Others specialize in them. | | **[Chargeback thresholds](/docs/chargebacks/reference/network-programs)** | Standard is 0.9% ([Visa](/docs/reference/reason-codes/visa)) / 1.5% ([Mastercard](/docs/reference/reason-codes/mastercard) ECM). Some MCCs have tighter monitoring. | | **[Fraud scoring](/docs/fraud/prevention/risk-scoring)** | Risk models weight transactions differently by MCC. | | **Card benefits** | Some cards offer bonus rewards for specific MCCs (dining, travel, groceries). | --- ## High-Risk MCC Categories These MCCs get higher [reserves](/docs/operations/payout-strategy), stricter underwriting, or a flat no from mainstream [processors](/docs/payments/buying-payments). If you're in one, here's what's coming: - Longer application review (2-4 weeks vs instant) - Rolling reserves (5-10% held for 90-180 days) - see [payout strategy](/docs/operations/payout-strategy) - Higher per-transaction [fees](/docs/payments/buying-payments) - More frequent account reviews ### Explicitly High-Risk | MCC | Category | Why It's High-Risk | |-----|----------|-------------------| | **5912** | Drug Stores, Pharmacies | Prescription fraud, controlled substances | | **5962** | Direct Marketing - Travel | High [chargeback](/docs/chargebacks) rates, fulfillment issues | | **5966** | Direct Marketing - Outbound Telemarketing | Aggressive sales, buyer's remorse | | **5967** | Direct Marketing - Inbound Teleservices | Subscription traps, unclear billing | | **5968** | Direct Marketing - Continuity/Subscription | [Recurring billing](/docs/payments/subscriptions-recurring) disputes, cancellation friction | | **5993** | Cigar Stores and Stands | Age verification, regulatory issues | | **7012** | Timeshares | High-value, long fulfillment, buyer's remorse | | **7273** | Dating and Escort Services | Fraud, disputes, reputational risk | | **7995** | Betting, Lottery, Casino Gaming | Regulatory, addiction, chargebacks | | **5816** | Digital Goods - Games | [Friendly fraud](/docs/fraud/types/friendly-fraud), virtual goods disputes | | **5817** | Digital Goods - Applications | [Subscription disputes](/docs/payments/subscriptions-recurring), unclear terms | | **5818** | Digital Goods - Large Sellers | Volume + digital = higher [fraud](/docs/fraud) exposure | ### Elevated Risk (Not Prohibited, But Scrutinized) | MCC | Category | Risk Factor | |-----|----------|-------------| | **4722** | Travel Agencies | Advance purchase, fulfillment delays, airline failures | | **4511** | Airlines | High ticket values, complex [refund](/docs/fraud/types/refund-fraud) rules | | **5094** | Precious Stones and Metals | High value, resale [fraud](/docs/fraud) | | **5944** | Jewelry, Watches, Silverware | High value, return [fraud](/docs/fraud/types/refund-fraud) | | **5999** | Miscellaneous Retail | Catch-all, hard to underwrite | | **7922** | Theatrical Producers, Ticket Agencies | Event cancellations, scalping disputes | | **7941** | Commercial Sports, Athletic Fields | Event-based, cancellation risk | | **5964** | Direct Marketing - Catalog | Fulfillment [disputes](/docs/chargebacks), return logistics | | **5814** | Fast Food Restaurants | Low margins, high volume, [fraud testing](/docs/fraud/detection/velocity-rules) ground | ### Restricted or Prohibited by Most Processors | MCC | Category | Status | |-----|----------|--------| | **7801** | Government-Owned Lotteries (US) | Requires specialized processor | | **7802** | Government-Licensed Horse/Dog Racing | State-by-state legality | | **7995** | Gambling, Casino Gaming Chips | Legal only in licensed jurisdictions | | **5933** | Pawn Shops | High fraud rates, stolen goods concerns | | **9223** | Bail and Bond Payments | Specialized processors only | --- ## Common MCC Categories ### Retail | MCC | Description | Interchange Notes | |-----|-------------|-------------------| | **5311** | Department Stores | Standard retail rates | | **5411** | Grocery Stores, Supermarkets | Lower interchange (regulated) | | **5541** | Service Stations (with fuel) | Special fuel rates apply | | **5542** | Automated Fuel Dispensers | AFD rates, outdoor terminal rules | | **5651** | Family Clothing Stores | Standard retail | | **5691** | Men's and Women's Clothing | Standard retail | | **5732** | Electronics Stores | Standard retail | | **5912** | Drug Stores, Pharmacies | Lower interchange for Rx | | **5999** | Miscellaneous Retail | Catch-all, may trigger review | ### Food & Beverage | MCC | Description | Notes | |-----|-------------|-------| | **5812** | Eating Places, Restaurants | Standard restaurant rates | | **5813** | Bars, Taverns, Cocktail Lounges | Age verification required | | **5814** | Fast Food Restaurants | High volume, card testing target | | **5811** | Caterers | Service business rates | ### Services | MCC | Description | Notes | |-----|-------------|-------| | **7230** | Barber and Beauty Shops | Service rates | | **7298** | Health and Beauty Spas | Service rates | | **7311** | Advertising Services | B2B, Level 2/3 eligible | | **7372** | Computer Programming, Systems Design | B2B, Level 2/3 eligible | | **7392** | Management Consulting | B2B, Level 2/3 eligible | | **8111** | Legal Services | Professional services rates | | **8931** | Accounting, Bookkeeping | Professional services rates | ### Healthcare | MCC | Description | Notes | |-----|-------------|-------| | **8011** | Doctors, Physicians | Healthcare rates available | | **8021** | Dentists, Orthodontists | Healthcare rates available | | **8062** | Hospitals | Large ticket, complex billing | | **8099** | Medical Services, Health Practitioners | Broad category | ### Travel & Transportation | MCC | Description | Notes | |-----|-------------|-------| | **4511** | Airlines | Complex [interchange](/docs/payments/reference/interchange), high [disputes](/docs/chargebacks) | | **4722** | Travel Agencies | Advance purchase risk | | **7011** | Lodging - Hotels, Motels, Resorts | No-show [chargebacks](/docs/chargebacks) common | | **7512** | Car Rental | Damage [disputes](/docs/chargebacks), fuel charges | | **4121** | Taxicabs, Rideshare | Low ticket, high volume | ### E-commerce & Digital | MCC | Description | Risk Level | |-----|-------------|------------| | **5815** | Digital Goods - Audiovisual Media | Elevated | | **5816** | Digital Goods - Games | High | | **5817** | Digital Goods - Applications | Elevated | | **5818** | Digital Goods - Large Digital Sellers | High volume scrutiny | | **5964** | Direct Marketing - Catalog | Elevated | | **5968** | Direct Marketing - Subscription | High | --- ## MCC Assignment Issues ### Common Misclassification Problems | What You Sell | Wrong MCC | Right MCC | Why It Matters | |--------------|-----------|-----------|----------------| | SaaS subscription | 5968 (subscription) | 5817 (digital apps) | 5968 triggers high-risk flags | | Coaching/consulting | 5999 (misc retail) | 7392 (consulting) | 5999 is a red flag catch-all | | Online courses | 5818 (digital large) | 8299 (schools) | Education MCCs have better rates | | Meal kits | 5812 (restaurants) | 5411 (grocery) | Grocery has regulated lower rates | | Fitness app | 5816 (games) | 7997 (fitness clubs) | Games MCC has higher fraud scores | ### How to Check Your MCC 1. Look at your processor statement. It's usually listed per transaction or in account settings. 2. Check your merchant agreement. The MCC should be written into it. 3. Ask your processor. They'll tell you what's on file. ### How to Request MCC Change 1. **Document your business model.** Explain what you actually sell. 2. **Provide supporting materials.** Website, product descriptions, sample invoices. 3. **Send a written request.** Email your processor's underwriting or merchant services team. 4. **Expect it to take a while.** Re-underwriting runs 1-2 weeks. 5. **Get it in writing.** The new MCC should show up on your next statement. :::warning[MCC Changes Can Backfire] Don't ask for a lower-risk MCC you don't qualify for. That's misrepresentation, and it can cost you the account. Be accurate. See [processor management](/docs/operations/processor-management) for staying in good standing. ::: --- ## MCC and Interchange Some MCCs qualify for lower interchange. That's regulated or network-negotiated, so it isn't something you pick. ### Lower Interchange MCCs (US Regulated) | MCC | Category | Why Lower | |-----|----------|-----------| | **5411** | Supermarkets | Durbin Amendment regulated | | **5541/5542** | Gas Stations | Fuel-specific rates | | **5912** | Pharmacies | Healthcare carve-outs | | **9311** | Tax Payments | Government rates | ### B2B and Level 2/3 Eligible Sell B2B on a supporting MCC and passing Level 2/3 data buys you lower interchange: | MCC Range | Category | Level 2/3 Eligible | |-----------|----------|-------------------| | **7311-7399** | Business Services | Yes | | **8111-8999** | Professional Services | Yes | | **5045-5046** | Computers, Office Equipment | Yes | See [B2B Commercial Payments](/docs/payments/reference/b2b-commercial) for Level 2/3 details. --- ## MCC Quick Lookup by Business Type ### "What MCC am I?" These are the likely codes. Your processor gets the final say. | You Are | Likely MCC | Notes | |---------|-----------|-------| | Restaurant | 5812 | 5813 if primarily bar | | Coffee shop | 5814 | Fast food category | | Clothing store | 5651 or 5691 | Depends on focus | | Electronics retailer | 5732 | | | Grocery store | 5411 | Lower regulated rates | | Gas station | 5541 or 5542 | 5542 for pay-at-pump | | Hotel | 7011 | | | Salon/spa | 7230 or 7298 | | | Gym/fitness | 7941 or 7997 | | | Doctor/dentist | 8011 or 8021 | | | Lawyer | 8111 | | | Accountant | 8931 | | | Software/SaaS | 5817 | Not 5968 | | E-commerce (physical goods) | 5999 | May want more specific | | Online courses | 8299 | Educational services | | Consulting | 7392 | | | Marketing agency | 7311 | | | Subscription box | 5964 | Direct marketing catalog | --- ## IRS Reporting by MCC Under IRC Section 6050W, payment settlement entities report your gross payment volume to the IRS. That's Form 1099-K. The threshold depends on **how** you got paid, not on your MCC. | How you got paid | Threshold | What it means for you | |---|---|---| | **Card payments through a merchant account** (your acquirer or processor) | **No minimum.** Every dollar is reported | If you take cards, you get a 1099-K, even at low volume | | **Third-party network transactions** (marketplaces, payment apps, gig platforms) | **Over $20,000 AND more than 200 transactions** | Below either number, no 1099-K from that platform | :::warning[The $600 figure you have probably seen is not current] The American Rescue Plan set a $600 threshold with no transaction minimum for third-party networks. The IRS delayed it over and over and never enforced it. It was **repealed in July 2025**. That restored the original $20,000 / 200-transaction test. Plenty of accounting blogs and processor help pages still quote $600. There's a gross-amount trap either way. The 1099-K reports **gross** volume, before refunds, chargebacks and processing fees. It'll be higher than the money you actually kept. Reconcile it against your own records before you file. Don't assume the number is your taxable income. _Verified against [IRS: Understanding your Form 1099-K](https://www.irs.gov/businesses/understanding-your-form-1099-k), 1 August 2026._ ::: --- ## Next Steps **Understanding your MCC?** 1. [Check your processor statement](/docs/operations/reading-statements) - Find your assigned MCC 2. [Review interchange rates](/docs/payments/reference/interchange) - How your MCC affects costs **Setting up payment processing?** 1. [Choose a processor](/docs/payments/buying-payments) - MCC implications for selection 2. [Understand reserves](/docs/operations/holds-and-reserves) - MCC-based reserve requirements **High-risk MCC concerns?** 1. [Review payout strategy](/docs/operations/payout-strategy) - Manage reserves and cash flow 2. [Monitor chargeback metrics](/docs/chargebacks/metrics) - Stay below monitoring thresholds 3. [Work with your processor](/docs/operations/processor-management) - Maintain good standing --- ## Related Resources - [Buying Payments](/docs/payments/buying-payments) - MCC implications during processor selection - [Interchange Reference](/docs/payments/reference/interchange) - How MCC affects your rates - [B2B Commercial](/docs/payments/reference/b2b-commercial) - Level 2/3 data for eligible MCCs - [High-Risk Considerations](/docs/payments/buying-payments/contracts#mcc-implications) - Processor selection for restricted MCCs - [Processor Management](/docs/operations/processor-management) - Maintaining good standing - [Payout Strategy](/docs/operations/payout-strategy) - Reserve requirements by MCC - [Holds and Reserves](/docs/operations/holds-and-reserves) - Understanding reserves - [Chargeback Metrics](/docs/chargebacks/metrics) - Tracking dispute rates - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - MCC impact on fraud scores - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - Digital goods disputes - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Recurring billing MCC --- ## Full MCC List | MCC | Description | IRS Reportable | |-----|-------------|----------------| | 0742 | Veterinary Services | Yes | | 0763 | Agricultural Co-operatives | Yes | | 0780 | Horticultural Services, Landscaping Services | Yes | | 1520 | General Contractors-Residential and Commercial | Yes | | 1711 | Air Conditioning, Heating, and Plumbing Contractors | Yes | | 1731 | Electrical Contractors | Yes | | 1740 | Insulation, Masonry, Plastering, Stonework, and Tile Setting Contractors | Yes | | 1750 | Carpentry Contractors | Yes | | 1761 | Roofing, Siding, and Sheet Metal Work Contractors | Yes | | 1771 | Concrete Work Contractors | Yes | | 1799 | Special Trade Contractors | Yes | | 2741 | Miscellaneous Publishing and Printing | Yes | | 2791 | Typesetting, Plate Making, and Related Services | Yes | | 2842 | Specialty Cleaning, Polishing, and Sanitation Preparations | Yes | | 3000 | United Airlines | No | | 3001 | American Airlines | No | | 3002 | Pan American | No | | 3003 | Trans World Airlines | No | | 3004 | Braniff | No | | 3005 | Continental Airlines | No | | 3006 | Western Airlines | No | | 3007 | Delta Airlines | No | | 3008 | Eastern Airlines | No | | 3009 | Ozark Airlines | No | | 3010 | Northwest Airlines | No | | 3011 | Air France | No | | 3012 | Lufthansa | No | | 3013 | Air Canada | No | | 3014 | Japan Air Lines | No | | 3015 | British Airways | No | | 3016 | Alitalia | No | | 3017 | KLM | No | | 3018 | Iberia | No | | 3019 | Irish | No | | 3020 | SAS | No | | 3021 | Swissair | No | | 3022 | Varig | No | | 3023 | Air India | No | | 3024 | Air Algerie | No | | 3025 | Philippine Airlines | No | | 3026 | El Al | No | | 3027 | Mexicana | No | | 3028 | Pakistan International | No | | 3029 | Air Malta | No | | 3030 | Sabena | No | | 3031 | Austrian Airlines | No | | 3032 | Olympic Airways | No | | 3033 | Air New Zealand | No | | 3034 | UTA/Inter-Air | No | | 3035 | TAP | No | | 3036 | Viasa | No | | 3037 | Royal Dutch | No | | 3038 | Egyptair | No | | 3039 | Kuwait | No | | 3040 | Avianca | No | | 3041 | Gulf Air | No | | 3042 | Balkan | No | | 3043 | Finnair | No | | 3044 | Aer Lingus | No | | 3045 | Air Lanka | No | | 3046 | Nigeria Airways | No | | 3047 | Air Afrique | No | | 3048 | Thai Airways | No | | 3049 | Quantas | No | | 3050 | Air Zimbabwe | No | | 3051 | Air Mauritius | No | | 3052 | VIASA | No | | 3053 | Air Gabon | No | | 3054 | Air Zaire | No | | 3055 | Air Zambia | No | | 3056 | Air Seychelles | No | | 3057 | Zambia | No | | 3058 | Aero Mexico | No | | 3059 | LAN | No | | 3060 | LACSA | No | | 3061 | CAAC | No | | 3062 | Avensa | No | | 3063 | VASP | No | | 3064 | TACA | No | | 3065 | Royal Air Maroc | No | | 3066 | Tunis Air | No | | 3067 | ALASKA | No | | 3068 | LAB | No | | 3069 | Surinam | No | | 3070 | Ladeco | No | | 3071 | Indian Airlines | No | | 3072 | Cruzerio | No | | 3073 | Ecuatoriana | No | | 3075 | Singapore | No | | 3076 | Aerolineas Argentinas | No | | 3077 | Cathay Pacific | No | | 3078 | Iran Air | No | | 3079 | CSA | No | | 3081 | Malev | No | | 3082 | LOT | No | | 3083 | JAT | No | | 3084 | TAROM | No | | 3085 | Air Inter | No | | 3086 | Adria | No | | 3087 | Air Seychelles | No | | 3088 | SATA | No | | 3089 | Tawa | No | | 3090 | Iberia | No | | 3093 | All Nippon | No | | 3094 | Zambian | No | | 3095 | MEA | No | | 3096 | Air Pacific | No | | 3097 | Saudia | No | | 3098 | PIA | No | | 3099 | USAir | No | | 3100 | Air Lanka | No | | 3101 | Air LA | No | | 3102 | Wings | No | | 3103 | British Midland | No | | 3104 | Air Liberia | No | | 3105 | Dan | No | | 3106 | Braathens | No | | 3108 | China | No | | 3109 | Leisure | No | | 3110 | TWA | No | | 3111 | British Caledonian | No | | 3112 | Korean | No | | 3114 | Air Florida | No | | 3115 | Malaysian | No | | 3116 | Air Europe | No | | 3117 | VIASA | No | | 3118 | Valley | No | | 3123 | Scruse Air | No | | 3124 | Liat | No | | 3125 | Liat | No | | 3126 | Cayman | No | | 3127 | Bahamasair | No | | 3128 | Aviaco | No | | 3129 | LAV | No | | 3130 | LAP | No | | 3131 | VIASA | No | | 3132 | Aeroflot | No | | 3133 | Air LA | No | | 3134 | Trinidad | No | | 3135 | LAR | No | | 3136 | LAC | No | | 3137 | Air Niugini | No | | 3138 | ALM | No | | 3139 | LIAT | No | | 3140 | LACSA | No | | 3141 | SAHSA | No | | 3142 | Aviateca | No | | 3143 | NICA | No | | 3144 | Virgin Atlantic | No | | 3145 | COPA | No | | 3146 | Luxair | No | | 3147 | Cumberland | No | | 3148 | Air Wisconsin | No | | 3149 | Nationair | No | | 3150 | Air Panama | No | | 3151 | America West | No | | 3152 | Air LA | No | | 3153 | Air LA | No | | 3154 | Southwest | No | | 3155 | Metro | No | | 3156 | Presidential | No | | 3158 | Air LA | No | | 3159 | Midway | No | | 3160 | Air LA | No | | 3161 | All Nippon | No | | 3162 | Business Express | No | | 3163 | Air LA | No | | 3164 | Trans European | No | | 3165 | Archana | No | | 3166 | Air LA | No | | 3167 | Aloha | No | | 3168 | Air LA | No | | 3169 | Air LA | No | | 3170 | Air LA | No | | 3171 | Canadian | No | | 3172 | Garuda | No | | 3173 | Air LA | No | | 3174 | Air LA | No | | 3175 | Air LA | No | | 3176 | Metroflight | No | | 3177 | Air LA | No | | 3178 | Air LA | No | | 3179 | Air LA | No | | 3180 | Air LA | No | | 3181 | Air LA | No | | 3182 | Northwest | No | | 3183 | Air LA | No | | 3184 | Air LA | No | | 3185 | Air LA | No | | 3186 | Air LA | No | | 3187 | Air LA | No | | 3188 | Air LA | No | | 3189 | Air LA | No | | 3190 | Air LA | No | | 3191 | Air LA | No | | 3192 | Air LA | No | | 3193 | Air LA | No | | 3194 | Air LA | No | | 3195 | Air LA | No | | 3196 | Air LA | No | | 3197 | Air LA | No | | 3198 | Air LA | No | | 3199 | Air LA | No | | 3200 | Air LA | No | | 3201 | Air LA | No | | 3202 | Air LA | No | | 3203 | Air LA | No | | 3204 | Air LA | No | | 3205 | Air LA | No | | 3206 | Air LA | No | | 3207 | Air LA | No | | 3208 | Air LA | No | | 3209 | Air LA | No | | 3210 | Air LA | No | | 3211 | Air LA | No | | 3212 | Air LA | No | | 3213 | Air LA | No | | 3214 | Air LA | No | | 3215 | Air LA | No | | 3216 | Air LA | No | | 3217 | Air LA | No | | 3218 | Air LA | No | | 3219 | Air LA | No | | 3220 | Air LA | No | | 3221 | Air LA | No | | 3222 | Air LA | No | | 3223 | Air LA | No | | 3224 | Air LA | No | | 3225 | Air LA | No | | 3226 | Air LA | No | | 3227 | Air LA | No | | 3228 | Air LA | No | | 3229 | Air LA | No | | 3230 | Air LA | No | | 3231 | Air LA | No | | 3232 | Air LA | No | | 3233 | Air LA | No | | 3234 | Air LA | No | | 3235 | Air LA | No | | 3236 | Air LA | No | | 3237 | Air LA | No | | 3238 | Air LA | No | | 3239 | Air LA | No | | 3240 | Air LA | No | | 3241 | Air LA | No | | 3242 | Air LA | No | | 3243 | Air LA | No | | 3244 | Air LA | No | | 3245 | Air LA | No | | 3246 | Air LA | No | | 3247 | Air LA | No | | 3248 | Air LA | No | | 3249 | Air LA | No | | 3250 | Air LA | No | | 3251 | Air LA | No | | 3252 | Air LA | No | | 3253 | Air LA | No | | 3254 | Air LA | No | | 3255 | Air LA | No | | 3256 | Air LA | No | | 3257 | Air LA | No | | 3258 | Air LA | No | | 3259 | Air LA | No | | 3260 | Air LA | No | | 3261 | Air LA | No | | 3262 | Air LA | No | | 3263 | Air LA | No | | 3264 | Air LA | No | | 3265 | Air LA | No | | 3266 | Air LA | No | | 3267 | Air LA | No | | 3268 | Air LA | No | | 3269 | Air LA | No | | 3270 | Air LA | No | | 3271 | Air LA | No | | 3272 | Air LA | No | | 3273 | Air LA | No | | 3274 | Air LA | No | | 3275 | Air LA | No | | 3276 | Air LA | No | | 3277 | Air LA | No | | 3278 | Air LA | No | | 3279 | Air LA | No | | 3280 | Air LA | No | | 3281 | Air LA | No | | 3282 | Air LA | No | | 3283 | Air LA | No | | 3284 | Air LA | No | | 3285 | Air LA | No | | 3286 | Air LA | No | | 3287 | Air LA | No | | 3288 | Air LA | No | | 3289 | Air LA | No | | 3290 | Air LA | No | | 3291 | Air LA | No | | 3292 | Air LA | No | | 3293 | Air LA | No | | 3294 | Air LA | No | | 3295 | Air LA | No | | 3296 | Air LA | No | | 3297 | Air LA | No | | 3298 | Air LA | No | | 3299 | Air LA | No | | 3351 | Affiliated/HERTZ | No | | 3352 | American INT | No | | 3353 | Brooks | No | | 3354 | Action | No | | 3355 | Airways | No | | 3356 | Altra | No | | 3357 | HERTZ | No | | 3358 | Holiday | No | | 3359 | Agency | No | | 3360 | Airways | No | | 3361 | National | No | | 3362 | Tilden | No | | 3363 | HERTZ | No | | 3364 | U-HAUL | No | | 3365 | HERTZ | No | | 3366 | Budget | No | | 3367 | HERTZ | No | | 3368 | Holiday | No | | 3369 | HERTZ | No | | 3370 | Rent-A-Wreck | No | | 3371 | HERTZ | No | | 3372 | HERTZ | No | | 3373 | HERTZ | No | | 3374 | HERTZ | No | | 3375 | HERTZ | No | | 3376 | Ajax | No | | 3377 | HERTZ | No | | 3378 | HERTZ | No | | 3379 | HERTZ | No | | 3380 | HERTZ | No | | 3381 | Europcar | No | | 3382 | HERTZ | No | | 3383 | HERTZ | No | | 3384 | HERTZ | No | | 3385 | Tilden | No | | 3386 | HERTZ | No | | 3387 | AVIS | No | | 3388 | HERTZ | No | | 3389 | AVIS | No | | 3390 | Dollar | No | | 3391 | Europe | No | | 3392 | HERTZ | No | | 3393 | AVIS | No | | 3394 | Kemwell | No | | 3395 | Thrifty | No | | 3396 | Tilden | No | | 3397 | HERTZ | No | | 3398 | AVIS | No | | 3399 | HERTZ | No | | 3400 | Godfreypa | No | | 3401 | HERTZ | No | | 3402 | HERTZ | No | | 3403 | HERTZ | No | | 3404 | HERTZ | No | | 3405 | Budget | No | | 3406 | HERTZ | No | | 3407 | HERTZ | No | | 3408 | HERTZ | No | | 3409 | HERTZ | No | | 3410 | HERTZ | No | | 3411 | HERTZ | No | | 3412 | AVIS | No | | 3413 | HERTZ | No | | 3414 | AVIS | No | | 3415 | HERTZ | No | | 3416 | AVIS | No | | 3417 | HERTZ | No | | 3418 | AVIS | No | | 3419 | HERTZ | No | | 3420 | AVIS | No | | 3421 | HERTZ | No | | 3422 | AVIS | No | | 3423 | HERTZ | No | | 3424 | AVIS | No | | 3425 | AVIS | No | | 3426 | HERTZ | No | | 3427 | AVIS | No | | 3428 | AVIS | No | | 3429 | HERTZ | No | | 3430 | AVIS | No | | 3431 | AVIS | No | | 3432 | HERTZ | No | | 3433 | AVIS | No | | 3434 | HERTZ | No | | 3435 | AVIS | No | | 3436 | HERTZ | No | | 3437 | AVIS | No | | 3438 | HERTZ | No | | 3439 | AVIS | No | | 3440 | HERTZ | No | | 3441 | AVIS | No | | 3501 | Holiday Inns | No | | 3502 | Best Western | No | | 3503 | Sheraton | No | | 3504 | Hilton | No | | 3505 | Forte | No | | 3506 | Golden Tulip | No | | 3507 | Friendship | No | | 3508 | Quality Inns | No | | 3509 | Marriott | No | | 3510 | Days Inns | No | | 3511 | Arabella | No | | 3512 | Inter-Continental | No | | 3513 | Westin | No | | 3514 | Americana | No | | 3515 | Sol | No | | 3516 | Pullman | No | | 3517 | Meridien | No | | 3518 | Crest | No | | 3519 | Prince | No | | 3520 | Princess | No | | 3521 | CP | No | | 3522 | Penta | No | | 3523 | Centre | No | | 3524 | Forum | No | | 3525 | Ciga | No | | 3526 | Shangri-La | No | | 3527 | Hyatt | No | | 3528 | Radisson | No | | 3529 | Red Lion | No | | 3530 | Sofitel | No | | 3531 | Novotel | No | | 3532 | Cunard | No | | 3533 | Rank | No | | 3534 | Swissotel | No | | 3535 | Ramada Inns | No | | 3536 | Howard Johnson | No | | 3537 | Travelodge | No | | 3538 | Four Seasons | No | | 3539 | C.P. | No | | 3540 | Scandic | No | | 3541 | Sara | No | | 3542 | Oberoi | No | | 3543 | Steigenberger | No | | 3544 | Econo-Lodge | No | | 3545 | Queens Moat | No | | 3546 | Swallow | No | | 3547 | HUSA | No | | 3548 | De Vere | No | | 3549 | Ladbroke | No | | 3550 | Rodeway Inns | No | | 3551 | Helmsley | No | | 3552 | Comfort Inns | No | | 3553 | Journey's End | No | | 3554 | Loews | No | | 3555 | Sonesta | No | | 3556 | Stakis | No | | 3557 | Nikko | No | | 3558 | Scots | No | | 3559 | Metropole | No | | 3560 | Mandrian | No | | 3561 | Mandarin Oriental | No | | 3562 | Omni | No | | 3563 | Registry | No | | 3564 | Pan Pacific | No | | 3565 | Climat | No | | 3566 | Doubletree | No | | 3567 | Tokyu | No | | 3568 | Westin | No | | 3569 | Inter-Europe | No | | 3570 | Hospitality International | No | | 3571 | Fimons | No | | 3572 | Regal | No | | 3573 | Compri | No | | 3574 | Residence Inns | No | | 3575 | Thistle | No | | 3576 | Lord | No | | 3577 | Park | No | | 3578 | Hilton | No | | 3579 | Embassy Suites | No | | 3580 | Fairfield | No | | 3581 | Allstar | No | | 3582 | Sonesta | No | | 3583 | Mount Charlotte | No | | 3584 | Marriott | No | | 3585 | Travel Inns | No | | 3586 | Arcadia | No | | 3587 | Ibis | No | | 3588 | Campanile | No | | 3589 | Mercure | No | | 3690 | Pullman | No | | 3691 | Ibis | No | | 3692 | Sofitel | No | | 3693 | Novotel | No | | 3694 | Mercure | No | | 3695 | Novotel | No | | 3696 | Mercure | No | | 3697 | Ibis | No | | 3698 | Mercure | No | | 3699 | Novotel | No | | 3700 | Conrad International | No | | 3701 | Downtowner | No | | 3702 | Coast | No | | 3703 | Park Inn | No | | 3704 | Downtowner | No | | 3705 | Hotle | No | | 3706 | Club Med | No | | 3707 | Bungalow | No | | 3708 | Hotle | No | | 3709 | Hotle | No | | 3710 | CroWne Plaza | No | | 3711 | Serena | No | | 3712 | Dan | No | | 3713 | Occidental | No | | 3714 | Husa | No | | 3715 | Rantasipi | No | | 3716 | Interhotel | No | | 3717 | Scandic | No | | 3718 | Arctia | No | | 3719 | Sokos | No | | 3720 | Copthorne | No | | 3721 | Post | No | | 3722 | Holiday Inn | No | | 3723 | Woolworth | No | | 3724 | Woolworth | No | | 3725 | Adrillon | No | | 3726 | Bilderberg | No | | 3727 | Papagayo | No | | 3728 | Park | No | | 3729 | Steinberger | No | | 3730 | Lusa | No | | 3731 | Jolly | No | | 3732 | Leading | No | | 3733 | SRS | No | | 3734 | Lygon | No | | 3735 | shire | No | | 3736 | Trusthouse | No | | 3737 | Relais | No | | 3738 | Hoteis | No | | 3739 | Hoteis | No | | 3740 | SRS | No | | 3741 | PANNONIA | No | | 3742 | Hungar | No | | 3743 | Danubius | No | | 3744 | Iberotel | No | | 3745 | Iberotel | No | | 3746 | Iberotel | No | | 3747 | Iberotel | No | | 3748 | Iberotel | No | | 3749 | Sunshine | No | | 3750 | Ramada Inns, Inc. | No | | 3751 | Westin Hotels | No | | 3752 | Westin Hotels | No | | 3753 | Westin Hotels | No | | 3754 | Westin Hotels | No | | 3755 | Westin Hotels | No | | 3756 | Westin Hotels | No | | 3757 | Westin Hotels | No | | 3758 | Westin Hotels | No | | 3759 | Westin Hotels | No | | 3760 | Westin Hotels | No | | 3761 | Westin Hotels | No | | 3762 | Westin Hotels | No | | 3763 | Westin Hotels | No | | 3764 | Westin Hotels | No | | 3765 | Westin Hotels | No | | 3766 | Westin Hotels | No | | 3767 | Westin Hotels | No | | 3768 | Westin Hotels | No | | 3769 | Westin Hotels | No | | 3770 | Westin Hotels | No | | 3771 | Westin Hotels | No | | 3772 | Westin Hotels | No | | 3773 | Westin Hotels | No | | 3774 | Westin Hotels | No | | 3775 | Westin Hotels | No | | 3776 | Westin Hotels | No | | 3777 | Westin Hotels | No | | 3778 | Westin Hotels | No | | 3779 | Westin Hotels | No | | 3801 | Marriott | No | | 3802 | Marriott | No | | 3803 | Marriott | No | | 3804 | Marriott | No | | 3805 | Marriott | No | | 3806 | Marriott | No | | 3807 | Marriott | No | | 3808 | Marriott | No | | 3809 | Marriott | No | | 3810 | Marriott | No | | 3811 | Ritz-Carlton | No | | 3812 | Ritz-Carlton | No | | 3813 | Ritz-Carlton | No | | 3814 | Ritz-Carlton | No | | 3815 | Ritz-Carlton | No | | 3816 | Ritz-Carlton | No | | 3817 | Ritz-Carlton | No | | 3818 | Ritz-Carlton | No | | 3819 | Ritz-Carlton | No | | 3820 | Ritz-Carlton | No | | 3821 | Ritz-Carlton | No | | 3822 | Ritz-Carlton | No | | 3823 | Ritz-Carlton | No | | 3824 | Ritz-Carlton | No | | 3825 | Ritz-Carlton | No | | 3826 | Ritz-Carlton | No | | 3827 | Ritz-Carlton | No | | 3828 | Ritz-Carlton | No | | 4011 | Railroads | Yes | | 4111 | Commuter Transport, Ferries | Yes | | 4112 | Passenger Railways | Yes | | 4119 | Ambulance Services | Yes | | 4121 | Taxicabs and Limousines | Yes | | 4131 | Bus Lines | Yes | | 4214 | Motor Freight Carriers and Trucking - Local and Long Distance, Moving and Storage Companies, and Local Delivery Services | Yes | | 4215 | Courier Services | Yes | | 4225 | Public Warehousing and Storage - Farm Products, Refrigerated Goods, and Household Goods | Yes | | 4411 | Steamship and Cruise Lines | Yes | | 4457 | Boat Rentals and Leases | Yes | | 4468 | Marinas, Marine Service, and Supplies | Yes | | 4511 | Air Carriers, Airlines | Yes | | 4582 | Airports, Flying Fields, and Airport Terminals | Yes | | 4722 | Travel Agencies, Tour Operators | Yes | | 4723 | TUI TRAVEL - GERMANY | Yes | | 4733 | Masters Countertops | Yes | | 4784 | Toll and Bridge Fees | Yes | | 4789 | Transportation Services (Not Elsewhere Classified) | Yes | | 4812 | Telecommunication Equipment and Telephone Sales | Yes | | 4813 | Key-entry/Key-punch Telecom | Yes | | 4814 | Telecommunication Services | Yes | | 4815 | VisaPhone | Yes | | 4816 | Computer Network/Information Services | Yes | | 4821 | Telegraph Services | Yes | | 4829 | Money Orders, Wire Transfer | Yes | | 4899 | Cable, Satellite, and Other Pay Television and Radio Services | Yes | | 4900 | Utilities | Yes | | 5013 | Motor Vehicle Supplies and New Parts | Yes | | 5021 | Office and Commercial Furniture | Yes | | 5039 | Construction Materials (Not Elsewhere Classified) | Yes | | 5044 | Office, Photographic, Photocopy, and Microfilm Equipment | Yes | | 5045 | Computers, Computer Peripheral Equipment, Software | Yes | | 5046 | Commercial Equipment (Not Elsewhere Classified) | Yes | | 5047 | Dental/Lab/Medical/Ophthalmic Hospital Equipment and Supplies | Yes | | 5051 | Metal Service Centers and Offices | Yes | | 5065 | Electrical Parts and Equipment | Yes | | 5072 | Hardware, Equipment, and Supplies | Yes | | 5074 | Plumbing and Heating Equipment and Supplies | Yes | | 5085 | Industrial Supplies (Not Elsewhere Classified) | Yes | | 5094 | Precious Stones and Metals, Watches and Jewelry | Yes | | 5099 | Durable Goods (Not Elsewhere Classified) | Yes | | 5111 | Stationery, Office Supplies, Printing and Writing Paper | Yes | | 5122 | Drugs, Drug Proprietaries, and Druggist Sundries | Yes | | 5131 | Piece Goods, Notions, and Other Dry Goods | Yes | | 5137 | Men's, Women's, and Children's Uniforms and Commercial Clothing | Yes | | 5139 | Commercial Footwear | Yes | | 5169 | Chemicals and Allied Products (Not Elsewhere Classified) | Yes | | 5172 | Petroleum and Petroleum Products | Yes | | 5192 | Books, Periodicals, and Newspapers | Yes | | 5193 | Florists' Supplies, Nursery Stock, and Flowers | Yes | | 5198 | Paints, Varnishes, and Supplies | Yes | | 5199 | Nondurable Goods (Not Elsewhere Classified) | Yes | | 5200 | Home Supply Warehouse Stores | Yes | | 5211 | Lumber and Building Materials Stores | Yes | | 5231 | Glass, Paint, and Wallpaper Stores | Yes | | 5251 | Hardware Stores | Yes | | 5261 | Nurseries, Lawn and Garden Supply Stores | Yes | | 5271 | Mobile Home Dealers | Yes | | 5300 | Wholesale Clubs | Yes | | 5309 | Duty Free Stores | Yes | | 5310 | Discount Stores | Yes | | 5311 | Department Stores | Yes | | 5331 | Variety Stores | Yes | | 5399 | Miscellaneous General Merchandise | Yes | | 5411 | Grocery Stores, Supermarkets | Yes | | 5422 | Freezer and Locker Meat Provisioners | Yes | | 5441 | Candy, Nut, and Confectionery Stores | Yes | | 5451 | Dairy Products Stores | Yes | | 5462 | Bakeries | Yes | | 5499 | Miscellaneous Food Stores - Convenience Stores and Specialty Markets | Yes | | 5511 | Car and Truck Dealers (New and Used) Sales, Service, Repairs, Parts, and Leasing | Yes | | 5521 | Car and Truck Dealers (Used Only) Sales, Service, Repairs, Parts, and Leasing | Yes | | 5531 | Auto and Home Supply Stores | Yes | | 5532 | Automotive Tire Stores | Yes | | 5533 | Automotive Parts and Accessories Stores | Yes | | 5541 | Service Stations (with or without Ancillary Services) | Yes | | 5542 | Automated Fuel Dispensers | Yes | | 5551 | Boat Dealers | Yes | | 5561 | Camper, Recreational and Utility Trailer Dealers | Yes | | 5571 | Motorcycle Shops and Dealers | Yes | | 5592 | Motor Homes Dealers | Yes | | 5598 | Snowmobile Dealers | Yes | | 5599 | Miscellaneous Auto, Aircraft, and Farm Equipment Dealers (Not Elsewhere Classified) | Yes | | 5611 | Men's and Boys' Clothing and Accessories Stores | Yes | | 5621 | Women's Ready-to-Wear Stores | Yes | | 5631 | Women's Accessory and Specialty Shops | Yes | | 5641 | Children's and Infants' Wear Stores | Yes | | 5651 | Family Clothing Stores | Yes | | 5655 | Sports and Riding Apparel Stores | Yes | | 5661 | Shoe Stores | Yes | | 5681 | Furriers and Fur Shops | Yes | | 5691 | Men's and Women's Clothing Stores | Yes | | 5697 | Tailors, Seamstresses, Mending, and Alterations | Yes | | 5698 | Wig and Toupee Shops | Yes | | 5699 | Miscellaneous Apparel and Accessory Shops | Yes | | 5712 | Furniture, Home Furnishings, and Equipment Stores, Except Appliances | Yes | | 5713 | Floor Covering Stores | Yes | | 5714 | Drapery, Window Covering, and Upholstery Stores | Yes | | 5718 | Fireplace, Fireplace Screens, and Accessories Stores | Yes | | 5719 | Miscellaneous Home Furnishing Specialty Shops | Yes | | 5722 | Household Appliance Stores | Yes | | 5732 | Electronics Stores | Yes | | 5733 | Music Stores-Musical Instruments, Pianos, and Sheet Music | Yes | | 5734 | Computer Software Stores | Yes | | 5735 | Record Shops | Yes | | 5811 | Caterers | Yes | | 5812 | Eating Places, Restaurants | Yes | | 5813 | Drinking Places (Alcoholic Beverages), Bars, Taverns, Cocktail Lounges, Nightclubs and Discotheques | Yes | | 5814 | Fast Food Restaurants | Yes | | 5815 | Digital Goods - Audiovisual Media | Yes | | 5816 | Digital Goods - Games | Yes | | 5817 | Digital Goods - Applications (Excludes Games) | Yes | | 5818 | Digital Goods - Large Digital Goods Merchant | Yes | | 5832 | Antique Shops | Yes | | 5912 | Drug Stores and Pharmacies | Yes | | 5921 | Package Stores - Beer, Wine, and Liquor | Yes | | 5931 | Used Merchandise and Secondhand Stores | Yes | | 5932 | Antique Shops | Yes | | 5933 | Pawn Shops | Yes | | 5935 | Wrecking and Salvage Yards | Yes | | 5937 | Antique Reproductions | Yes | | 5940 | Bicycle Shops | Yes | | 5941 | Sporting Goods Stores | Yes | | 5942 | Book Stores | Yes | | 5943 | Stationery, Office, and School Supply Stores | Yes | | 5944 | Jewelry, Watches, Clocks, and Silverware Stores | Yes | | 5945 | Hobby, Toy, and Game Shops | Yes | | 5946 | Camera and Photographic Supply Stores | Yes | | 5947 | Gift, Card, Novelty, and Souvenir Shops | Yes | | 5948 | Luggage and Leather Goods Stores | Yes | | 5949 | Sewing, Needlework, Fabric, and Piece Goods Stores | Yes | | 5950 | Glassware and Crystal Stores | Yes | | 5960 | Direct Marketing - Insurance Services | Yes | | 5961 | Mail Order Houses Including Catalog Order Stores, Book/Record Clubs (No longer valid for first presentments) | Yes | | 5962 | Direct Marketing - Travel-Related Arrangement Services | Yes | | 5963 | Door-to-Door Sales | Yes | | 5964 | Direct Marketing - Catalog Merchant | Yes | | 5965 | Direct Marketing - Combination Catalog and Retail Merchant | Yes | | 5966 | Direct Marketing - Outbound Telemarketing Merchant | Yes | | 5967 | Direct Marketing - Inbound Teleservices Merchant | Yes | | 5968 | Direct Marketing - Continuity/Subscription Merchant | Yes | | 5969 | Direct Marketing/Direct Marketers (Not Elsewhere Classified) | Yes | | 5970 | Artist's Supply and Craft Shops | Yes | | 5971 | Art Dealers and Galleries | Yes | | 5972 | Stamp and Coin Stores | Yes | | 5973 | Religious Goods Stores | Yes | | 5975 | Hearing Aids Sales and Supplies | Yes | | 5976 | Orthopedic Goods - Prosthetic Devices | Yes | | 5977 | Cosmetic Stores | Yes | | 5978 | Typewriter Stores | Yes | | 5983 | Fuel Dealers (Fuel Oil, Wood, Coal, and Liquefied Petroleum) | Yes | | 5992 | Florists | Yes | | 5993 | Cigar Stores and Stands | Yes | | 5994 | News Dealers and Newsstands | Yes | | 5995 | Pet Shops, Pet Food, and Supplies | Yes | | 5996 | Swimming Pools Sales | Yes | | 5997 | Electric Razor Stores | Yes | | 5998 | Tent and Awning Shops | Yes | | 5999 | Miscellaneous and Specialty Retail Shops | Yes | | 6010 | Manual Cash Disbursements - Customer Financial Institution | Yes | | 6011 | Automated Cash Disbursements - Customer Financial Institution | Yes | | 6012 | Merchandise and Services - Customer Financial Institution | Yes | | 6051 | Non-Financial Institutions - Foreign Currency, Money Orders (not wire transfer), Stored Value Card/Load, and Travelers Cheques | Yes | | 6211 | Security Brokers/Dealers | Yes | | 6300 | Insurance Sales, Underwriting, and Premiums | Yes | | 6381 | Insurance Premiums, (no longer valid for first presentments) | Yes | | 6399 | Insurance Carriers (Not Elsewhere Classified) | Yes | | 6513 | Real Estate Agents and Managers - Rentals | Yes | | 6529 | Remote Stored Value Load - Member Financial Institution | Yes | | 6530 | Remote Stored Value Load - Merchant | Yes | | 6531 | Payment Service Provider - Money Transfer for a Purchase | Yes | | 6532 | Payment Service Provider - Member Financial Institution | Yes | | 6533 | Payment Service Provider - Merchant | Yes | | 6534 | Money Transfer - Member Financial Institution | Yes | | 6535 | Value Purchase - Member Financial Institution | Yes | | 6536 | MoneySend Intracountry | Yes | | 6537 | MoneySend Intercountry | Yes | | 6538 | MoneySend Funding | Yes | | 6539 | Funding Transaction (Excluding MoneySend) | Yes | | 6540 | POI Funding Transactions (Excluding MoneySend) | Yes | | 7011 | Hotels, Motels, and Resorts | Yes | | 7012 | Timeshares | Yes | | 7032 | Sporting and Recreational Camps | Yes | | 7033 | Trailer Parks and Campgrounds | Yes | | 7210 | Laundry, Cleaning, and Garment Services | Yes | | 7211 | Laundry - Family and Commercial | Yes | | 7216 | Dry Cleaners | Yes | | 7217 | Carpet and Upholstery Cleaning | Yes | | 7221 | Photographic Studios | Yes | | 7230 | Barber and Beauty Shops | Yes | | 7251 | Shop Repair Shops and Shoe Shine Parlors, and Hat Cleaning Shops | Yes | | 7261 | Funeral Services and Crematories | Yes | | 7273 | Dating and Escort Services | Yes | | 7276 | Tax Preparation Services | Yes | | 7277 | Counseling Services - Debt, Marriage, Personal | Yes | | 7278 | Buying/Shopping Services, Clubs | Yes | | 7296 | Clothing Rental - Costumes, Formal Wear, Uniforms | Yes | | 7297 | Massage Parlors | Yes | | 7298 | Health and Beauty Spas | Yes | | 7299 | Miscellaneous Personal Services (Not Elsewhere Classified) | Yes | | 7311 | Advertising Services | Yes | | 7321 | Consumer Credit Reporting Agencies | Yes | | 7332 | Blueprinting and Photocopying Services | Yes | | 7333 | Commercial Photography, Art, and Graphics | Yes | | 7338 | Quick Copy, Reproduction, and Blueprinting Services | Yes | | 7339 | Stenographic and Secretarial Support Services | Yes | | 7342 | Exterminating and Disinfecting Services | Yes | | 7349 | Cleaning, Maintenance, and Janitorial Services | Yes | | 7361 | Employment Agencies, Temporary Help Services | Yes | | 7372 | Computer Programming, Integrated Systems Design, and Data Processing Services | Yes | | 7375 | Information Retrieval Services | Yes | | 7379 | Computer Repair, Maintenance, and Repair Services, (Not Elsewhere Classified) | Yes | | 7392 | Management, Consulting, and Public Relations Services | Yes | | 7393 | Detective Agencies, Protection Services, and Security Services including armored cars, guard dogs | Yes | | 7394 | Equipment Rental and Leasing Services, Tool Rental, Furniture Rental, and Appliance Rental | Yes | | 7395 | Photofinishing Laboratories, Photo Developing | Yes | | 7399 | Business Services (Not Elsewhere Classified) | Yes | | 7511 | Truck Stop | Yes | | 7512 | Car Rental | Yes | | 7513 | Truck and Utility Trailer Rentals | Yes | | 7519 | Motor Home and Recreational Vehicle Rentals | Yes | | 7523 | Parking Lots, Parking Meters, and Garages | Yes | | 7531 | Automotive Body Repair Shops | Yes | | 7534 | Tire Re-treading and Repair Shops | Yes | | 7535 | Automotive Paint Shops | Yes | | 7538 | Automotive Service Shops (Non-Dealer) | Yes | | 7542 | Car Washes | Yes | | 7549 | Towing Services | Yes | | 7622 | Electronics Repair Shops | Yes | | 7623 | Air Conditioning and Refrigeration Repair Shops | Yes | | 7629 | Electrical and Small Appliance Repair Shops | Yes | | 7631 | Watch, Clock, and Jewelry Repair | Yes | | 7641 | Furniture, Furniture Repair, and Furniture Refinishing | Yes | | 7692 | Welding Repair | Yes | | 7699 | Repair Shops and Related Services (Not Elsewhere Classified) | Yes | | 7800 | Government-Owned Lotteries | Yes | | 7801 | Government-Licensed On-Line Casinos (On-Line Gambling) | Yes | | 7802 | Government-Licensed Horse/Dog Racing | Yes | | 7829 | Motion Picture and Video Tape Production and Distribution | Yes | | 7832 | Motion Picture Theaters | Yes | | 7841 | Video Tape Rental Stores | Yes | | 7911 | Dance Halls, Studios, and Schools | Yes | | 7922 | Theatrical Producers (Except Motion Pictures), Ticket Agencies | Yes | | 7929 | Bands, Orchestras, and Miscellaneous Entertainers (Not Elsewhere Classified) | Yes | | 7932 | Billiard and Pool Establishments | Yes | | 7933 | Bowling Alleys | Yes | | 7941 | Commercial Sports, Athletic Fields, Professional Sport Clubs, and Sport Promoters | Yes | | 7991 | Tourist Attractions and Exhibits | Yes | | 7992 | Golf Courses - Public | Yes | | 7993 | Video Amusement Game Supplies | Yes | | 7994 | Video Game Arcades/Establishments | Yes | | 7995 | Betting/Casino Gambling | Yes | | 7996 | Amusement Parks, Circuses, Carnivals, and Fortune Tellers | Yes | | 7997 | Membership Clubs (Sports, Recreation, Athletic), Country Clubs, and Private Golf Courses | Yes | | 7998 | Aquariums, Sea-aquariums, Dolphinariums | Yes | | 7999 | Recreation Services (Not Elsewhere Classified) | Yes | | 8011 | Doctors | Yes | | 8021 | Dentists and Orthodontists | Yes | | 8031 | Osteopaths | Yes | | 8041 | Chiropractors | Yes | | 8042 | Optometrists and Ophthalmologists | Yes | | 8043 | Opticians, Optical Goods, and Eyeglasses | Yes | | 8049 | Podiatrists and Chiropodists | Yes | | 8050 | Nursing and Personal Care Facilities | Yes | | 8062 | Hospitals | Yes | | 8071 | Medical and Dental Laboratories | Yes | | 8099 | Medical, and Health Services (Not Elsewhere Classified) | Yes | | 8111 | Legal Services, Attorneys | Yes | | 8211 | Elementary and Secondary Schools | Yes | | 8220 | Colleges, Universities, Professional Schools, and Junior Colleges | Yes | | 8241 | Correspondence Schools | Yes | | 8244 | Business and Secretarial Schools | Yes | | 8249 | Vocational and Trade Schools | Yes | | 8299 | Schools and Educational Services (Not Elsewhere Classified) | Yes | | 8351 | Child Care Services | Yes | | 8398 | Charitable and Social Service Organizations | Yes | | 8641 | Civic, Social, and Fraternal Associations | Yes | | 8651 | Political Organizations | Yes | | 8661 | Religious Organizations | Yes | | 8675 | Automobile Associations | Yes | | 8699 | Membership Organizations (Not Elsewhere Classified) | Yes | | 8734 | Testing Laboratories ( non-medical) | Yes | | 8911 | Architectural, Engineering, and Surveying Services | Yes | | 8931 | Accounting, Auditing, and Bookkeeping Services | Yes | | 8999 | Professional Services (Not Elsewhere Classified) | Yes | | 9211 | Court Costs, including Alimony and Child Support | Yes | | 9222 | Fines | Yes | | 9223 | Bail and Bond Payments | Yes | | 9311 | Tax Payments | Yes | | 9399 | Government Services (Not Elsewhere Classified) | Yes | | 9401 | I-PURCHASING | Yes | | 9402 | Postal Services - Government Only | Yes | | 9405 | Intra-Government Purchases - Government Only | Yes | | 9406 | Government-Owned Lotteries | No | | 9700 | Automated Referral Service | No | | 9701 | Visa Credential Service | No | | 9702 | GCAS Emergency Services | No | | 9751 | U.K. Supermarkets - Electronic Hot File | No | | 9752 | U.K. Petrol Stations - Electronic Hot File | No | | 9950 | Intra-Company Purchases | No | --- ## Processor Reporting Checklist Source: https://paymentsandrisk.com/docs/reference/processor-reporting-checklist # Processor Reporting Checklist :::info[TL;DR] - If you can't see it, you can't fix it. Get the reports before you touch a fraud rule or a checkout flow. - The four that matter: auth rate by BIN, soft vs hard declines, 3DS challenge rate and conversion, chargeback ratio by reason code. - Route alerts to at least two inboxes. One inbox plus one spam filter is how merchants find out about a reserve three weeks late. - Check three things weekly: auth rate trend, chargeback ratio versus threshold, settlement timing versus schedule. - A processor that won't give you raw decline data with BINs has told you something. Write it down for the renewal. ::: Most merchants tune fraud rules blind because their processor never handed them the numbers. Ask for these reports and alerts by name. ## Minimum Reporting You Should Demand - Auth rate by issuer BIN, brand, method (CP vs CNP split). - Soft vs hard decline breakdown. - 3DS challenge rate and conversion. - Chargeback ratio by reason code and distance to thresholds. - Fraud-to-dispute linkage (TC40/SAFE match rate) where available. - Refund rate and timing. - Settlement timing and holds visibility. - Alert match rate if using CDRN/Ethoca. ## Notifications to Configure - Chargeback/dispute alerts (immediate). - Large transaction threshold alerts. - Failed transaction spike alerts. - Deposit/settlement confirmations. - Account health warnings (approaching network thresholds). - Reserve changes. - KYC/KYB document requests. ## The 3 Reports to Check Weekly - Auth rate trend (by BIN/brand/geo/method); investigate drops. - Chargeback ratio trend and distance to threshold. - Settlement/deposit timing vs expected schedule; flag delays. ## Ask Your Processor Say this, word for word: - "What reports and alerts are available by default?" - "Can I export raw declines with reason codes and BIN?" - "Do alerts go to multiple recipients? How do we add a backup?" - "Where do webhook failures show up?" ## Scale Callout - Under $100k/mo: Minimum reports, chargeback alerts, deposit confirmations. - $100k-$1M/mo: Add BIN-level auth, soft vs hard decline tracking, a weekly review cadence. - Over $1M/mo: Daily monitoring, alert routing redundancy, webhook plus email. ## Where This Breaks - No BIN or issuer detail, so you can't target fixes. - Alerts land in one inbox and the spam filter eats them. - Nobody watches the webhooks, so failures stay silent. - The processor refuses data access. Note it for the next contract renegotiation. ## Next Steps **Got the reports? Now use them:** 1. [Payments metrics](/docs/payments/metrics) - What each number should look like 2. [Benchmarks](/docs/reference/benchmarks) - Where you sit against everyone else 3. [Auth optimization](/docs/payments/auth-optimization) - What to do about a bad auth rate **Still fighting for access?** 1. [Alerts configuration](/docs/operations/alerts-configuration) - Set up routing that survives one person quitting 2. [Processor management](/docs/operations/processor-management) - How to run the relationship 3. [Experimentation](/docs/reference/experimentation) - Prove a change worked before you keep it --- ## Related - [Auth Optimization](/docs/payments/auth-optimization) - Improving approval rates - [Payments Metrics](/docs/payments/metrics) - What to track - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Native fraud tools - [Alerts Configuration](/docs/operations/alerts-configuration) - Monitoring setup - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Benchmarks](/docs/reference/benchmarks) - Target metrics - [Chargeback Metrics](/docs/chargebacks/metrics) - Dispute tracking - [Fraud Metrics](/docs/fraud/metrics) - Fraud rate tracking - [Processor Management](/docs/operations/processor-management) - Acquirer relationships - [Settlement & Reconciliation](/docs/payments/settlement) - Funding flows - [Decline Codes](/docs/reference/decline-codes) - Auth failure reasons - [3D Secure](/docs/fraud/prevention/3ds) - Authentication tracking --- ## Amex C08 - Goods/Services Not Received Source: https://paymentsandrisk.com/docs/reference/reason-codes/amex/c08-not-received # Amex C08 - Goods/Services Not Received :::info[TL;DR] C08 fires when an Amex cardholder says they paid and never got what they ordered. Your whole defense is **delivery proof**: tracking numbers, signed confirmations, delivery to the right address. Without those you'll lose. You get **20 calendar days** to respond. With solid delivery evidence, win rates run 55-80%, and the difference is whether you got a signature. ::: They admit they bought it. They say it never showed up. ## Overview Amex files C08 when a cardholder says the goods never arrived or the service never happened. It's one of the most common consumer dispute codes. It covers physical goods, digital products and services alike. The cardholder isn't disputing the authorization, so the argument is never about whether they bought it. It's about whether it arrived. ## When This Code Applies - Physical goods never arrived - Digital goods or downloads not accessible - Services not performed or not completed - Order cancelled by merchant but not refunded - Merchant went out of business before fulfillment - Partial delivery (key items missing from order) ## Cardholder Requirements Before Amex files a C08, the cardholder should: 1. **Wait for the delivery date** - They can't dispute before the goods are due 2. **Try you first** - A good faith effort to sort it out 3. **Allow reasonable time** - For a delayed delivery or a rescheduled service 4. **Actually not have it** - The goods, the service, or a big chunk of either ## Time Frames :::warning[20-Day Response Window] Amex gives you **20 calendar days**, which is shorter than Visa's 30 and Mastercard's 45. Calendar days, not business days. Weekends and holidays count. ::: | Scenario | Dispute Window | |----------|---------------| | Physical goods | 120 days from expected delivery date | | Services | 120 days from expected service date | | Digital goods | 120 days from transaction date | | Cancelled order | 120 days from cancellation date | | Stage | Window | |-------|--------| | Inquiry response | **20 calendar days** | | Chargeback response | **20 calendar days** | | Documentation request | **10 calendar days** | ## Representment Options ### 1. Goods Were Delivered **Use when:** you've got proof it arrived. **Evidence required:** - Tracking number with carrier delivery confirmation - Signature confirmation (strongly recommended for orders over $100) - Delivery address matching the order/billing address - Photo proof of delivery (if carrier provides) ### 2. Services Were Rendered **Use when:** you can show the work got done. **Evidence required:** - Service completion documentation - Work orders signed by the customer - Before/after photos or documentation - Appointment records with outcomes - Follow-up communication confirming satisfaction ### 3. Digital Goods Were Accessed **Use when:** they downloaded it or opened it. **Evidence required:** - Download confirmation logs - Access timestamps showing usage after purchase - Account login activity - Email delivery confirmation with download links - IP address at time of access ### 4. Cardholder Picked Up Goods **Use when:** they collected it in store or at the curb. **Evidence required:** - Signed pickup receipt - ID verification records - Store security footage or records - Pickup confirmation email or text ### 5. Refund Already Issued **Use when:** you've already credited the card. **Evidence required:** - Refund transaction details (date, amount, reference number) - Refund confirmation sent to cardholder - Proof refund was processed to the same card ### 6. Partial Delivery with Proof **Use when:** part of the order shipped and they're disputing all of it. **Evidence required:** - Tracking for delivered items - Documentation of what was shipped vs. what was ordered - Communication about backordered items - Offer of partial refund for undelivered items ## Required Documentation Not all delivery proof weighs the same. | Evidence Type | Strength | |--------------|----------| | Signed delivery + correct address | Strong | | Tracking delivered + correct address | Medium-Strong | | Tracking delivered + different address | Weak | | Digital access logs + IP match | Medium-Strong | | Signed service completion | Strong | | No tracking or delivery proof | Very Weak | Ship to an address that isn't on the order and the best tracking in the world still lands you on the Weak row. Tracking proves something arrived somewhere. It doesn't prove your customer got it. ## Win Rate Expectations These aren't promises, just what each kind of evidence tends to be worth. | Evidence Type | Expected Win Rate | |--------------|------------------| | Signed delivery + AVS match | 65-80% | | Tracking delivered + correct address | 55-70% | | Digital access logs | 50-65% | | Service completion signed | 60-75% | | No delivery proof | Under 20% | The gap between the top two rows is a signature. Over $100, get one. With no delivery proof at all, skip the response and go fix your shipping instead. ## Prevention Strategies ### Shipping Best Practices 1. **Always use tracking** - On every single shipment, no exceptions 2. **Require signature** - For orders over $100 or high-risk categories 3. **Ship to AVS-verified address** - Match billing and shipping when possible 4. **Send shipping notifications** - Proactive emails with tracking links 5. **Insure high-value shipments** - Carrier insurance for expensive items ### Delivery Confirmation 1. **Photo proof** - Use carriers that provide delivery photos 2. **GPS confirmation** - Delivery location verification 3. **Recipient name** - Document who signed 4. **Date/time stamps** - When delivery occurred ### For Digital Goods 1. **Instant delivery** - Minimize wait time between purchase and access 2. **Download logging** - Record IP, timestamp, device for every access 3. **Multiple delivery methods** - Email plus in-account access 4. **Access confirmation emails** - Automated delivery receipt ### For Services 1. **Sign-off at completion** - Get the customer's signature on the spot 2. **Before/after evidence** - Photos, screenshots, records 3. **Written confirmation** - An email saying the work got done 4. **Follow up** - "Everything come out OK?" builds a paper trail ### Customer Communication 1. **Ship updates unprompted** - Kills the "where's my order?" email 2. **Clear delivery estimates** - Set them at checkout, not after 3. **Easy contact options** - Let people reach you before they reach Amex 4. **Flag delays** - Same day you know about them ## Common Mistakes 1. **No tracking on shipments** - Fatal to your defense 2. **Shipping to an unverified address** - Weakens everything else you have 3. **No signature on high-value orders** - Tracking alone often isn't enough 4. **Ignoring Amex inquiries** - It auto-escalates to a chargeback 5. **Missing the 20-day deadline** - Automatic loss 6. **Thin digital delivery logs** - You can't prove access ## Related Codes - C02 - Credit Not Processed - C04 - Goods/Services Returned - C31 - Goods/Services Not as Described - C32 - Goods/Services Damaged/Defective ## Next Steps **Got this chargeback?** 1. Pull tracking โ†’ Did it deliver? Get carrier confirmation 2. Check signature โ†’ Have you got signed proof? 3. Verify address โ†’ Does it match the billing address? 4. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 5. Respond within **20 days** **Prevent future C08 chargebacks:** 1. Ship with tracking and delivery confirmation, every time 2. Require a signature over $100 3. Send shipping updates with tracking links 4. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to catch them early --- ## See Also - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes claiming non-receipt - [Refund Fraud](/docs/fraud/types/refund-fraud) - Return and non-receipt abuse patterns - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before they happen - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflect before filing - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address verification for shipping - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Amex Reason Codes](/docs/reference/reason-codes/amex) - All Amex codes - [Visa 13.1 - Not Received](/docs/reference/reason-codes/visa/13-1-not-received) - Visa equivalent - [Mastercard 4855 - Goods Not Provided](/docs/reference/reason-codes/mastercard/goods-not-provided) - Mastercard equivalent - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Customer clarity --- ## Amex C28 - Cancelled Recurring Billing Source: https://paymentsandrisk.com/docs/reference/reason-codes/amex/c28-cancelled-recurring # Amex C28 - Cancelled Recurring Billing :::info[TL;DR] The cardholder says they cancelled. You kept billing. That's a C28. Your defense is one of two things. Either you never got a cancellation request, or the charge landed before it did. You'll need consent documentation, cancellation logs and usage records. You've got **20 calendar days** to respond. With strong consent and usage evidence, win rates run 50-65%. ::: You billed a subscriber who says they'd already cancelled. Amex calls that C28. ## Overview Amex files C28 when a cardholder disputes a recurring charge. They're saying they already cancelled the subscription, membership or billing arrangement. The code covers subscriptions, memberships, automatic renewals, and any repeating charge that should have stopped. It's one of the fastest-growing categories as subscription commerce grows. ## When This Code Applies - Subscription cancelled but charges continue - Free trial converted to paid without clear consent - Recurring billing after account closure - Automatic renewal without proper notice - Charge processed after explicit cancellation request - Membership fees after cancellation ## Cardholder Requirements Before Amex files a C28, the cardholder should: 1. **Have attempted to cancel** - Through the merchant's cancellation process 2. **Allow reasonable processing time** - For cancellation to take effect 3. **Retain proof of cancellation** - Confirmation emails, reference numbers 4. **The transaction must be recurring** - Not a one-time charge ## Time Frames :::warning[20-Day Response Window] You've got **20 calendar days** to respond to a C28. Each disputed charge can be filed separately. One unhappy subscriber can trigger several chargebacks. ::: | Scenario | Dispute Window | |----------|---------------| | Standard recurring charge | 120 days from disputed transaction date | | Each charge | Can dispute each billing cycle separately | | Free trial conversion | 120 days from first paid charge | | Stage | Window | |-------|--------| | Inquiry response | **20 calendar days** | | Chargeback response | **20 calendar days** | | Documentation request | **10 calendar days** | ## Representment Options ### 1. No Cancellation Request Received **When to use:** You've got no record of a cancellation request. **Evidence required:** - Cancellation policy and process documentation - Communication logs showing no cancellation request - Account history showing active status throughout - Available cancellation channels (showing they were accessible) ### 2. Transaction Occurred Before Cancellation **When to use:** The disputed charge was processed before the cancellation request. **Evidence required:** - Cancellation request date and timestamp - Transaction date and timestamp - Billing cycle terms showing charge was properly timed - Terms and conditions specifying billing schedule ### 3. Terms Allow the Charge **When to use:** Your terms clearly disclose post-cancellation or renewal charges. **Evidence required:** - Signed or accepted terms and conditions - Specific language about cancellation timing and billing cycles - Proof cardholder agreed to terms at signup - Renewal notice sent before charge (if applicable) ### 4. Cardholder Continued Using the Service **When to use:** Usage logs prove the cardholder accessed the service after the alleged cancellation. **Evidence required:** - Login and access logs after cancellation date - Feature usage records - Content consumption data - Account activity history :::tip[Usage Logs Are Powerful Evidence] Show the cardholder logging in after they claim they cancelled. That's the strongest version of this case. Log everything. ::: ### 5. Refund Already Issued **When to use:** You've already credited the disputed charge. **Evidence required:** - Refund transaction details (date, amount, reference) - Refund confirmation sent to cardholder - Proof refund was processed to the same card ### 6. Valid Free Trial Conversion **When to use:** Cardholder signed up for a free trial that converted to paid per disclosed terms. **Evidence required:** - Trial terms clearly showing conversion date and amount - Proof cardholder agreed to trial terms - Conversion notice sent before first charge - Opt-out option provided and accessible ## Required Documentation | Evidence Type | Strength | |--------------|----------| | No cancellation record + continued usage | Strong | | Transaction before cancellation request | Strong | | Accepted terms + cancellation policy | Medium-Strong | | Conversion notice sent for trial | Medium | | No documentation of consent | Very Weak | ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | No cancellation record + usage logs | 55-70% | | Transaction before cancellation date | 60-75% | | Clear terms + consent documentation | 45-60% | | Trial conversion with notice sent | 40-55% | | No documentation | Under 20% | ## Prevention Strategies ### Clear Terms and Consent 1. **Explicit opt-in** - No pre-checked boxes or hidden consent 2. **Display terms prominently** - Before purchase, not buried in fine print 3. **State amount and frequency clearly** - "$19.99/month billed on the 1st" 4. **Explain cancellation process** - How, where, and by when 5. **Send confirmation email** - With all terms immediately after signup ### Pre-Billing Notifications 1. **Send reminders 7+ days before each charge** - Upcoming billing notice 2. **Include the amount** - The exact charge they'll see 3. **Include the date** - When the charge will process 4. **Provide a cancellation link** - One-click path to cancel 5. **Include contact information** - Phone, email, chat options :::warning[Pre-Billing Notices Prevent Chargebacks] Merchants who send pre-billing reminders see C28 rates drop 30-50%. A $0.02 email is cheaper than a $15 chargeback fee. It's cheaper again than the sale you lose with it. ::: ### Easy Cancellation 1. **Same channel as signup** - If they signed up online, let them cancel online 2. **Self-service cancellation** - Account portal with cancel button 3. **Process immediately** - Don't delay or require multiple steps 4. **Send confirmation** - Cancellation receipt with effective date 5. **No dark patterns** - Don't make cancellation deliberately difficult ### Documentation and Logging 1. **Log all communications** - Every email, call, chat, and support ticket 2. **Record consent with timestamps** - When and how they agreed 3. **Track all cancellation requests** - With confirmation records 4. **Maintain detailed usage logs** - Login times, feature usage, content access 5. **Archive billing records** - Every charge with corresponding service period ## Trial Conversions ### Best Practices 1. **Clear trial terms** - Duration, conversion date, post-trial price 2. **Conversion notice** - Email 7+ days before first paid charge 3. **Opt-out option** - Easy to cancel before conversion 4. **Confirmation at conversion** - Receipt email when paid billing starts 5. **Explicit consent** - For the transition from free to paid ### Common Trial Issues | Issue | Prevention | |-------|------------| | No conversion notice sent | Automated email 7 days before charge | | Surprise charge amount | Clear pricing at trial signup | | Hidden billing terms | Terms displayed prominently at checkout | | Difficult cancellation | Self-service cancel in account settings | | No trial end reminder | Email 3 days before trial expires | ## Common Mistakes 1. **No cancellation logs** - You can't prove you never got a request 2. **Making cancellation difficult** - Drives chargebacks and regulatory risk 3. **No pre-billing notifications** - They don't see the charge coming 4. **Poor terms display** - You can't prove informed consent 5. **Ignoring Amex inquiries** - It'll auto-escalate to a chargeback 6. **Billing after cancellation** - Even one extra charge triggers a dispute 7. **No usage logging** - You can't prove continued service access ## Related Codes - C02 - Credit Not Processed - C05 - Goods/Services Cancelled - C08 - Goods/Services Not Received - C31 - Goods/Services Not as Described ## Next Steps **Got this chargeback?** 1. Check cancellation records --> Did you receive a cancellation request? 2. Check billing dates --> Was the transaction before or after cancellation? 3. Pull usage logs --> Did the cardholder continue using the service? 4. Gather consent documentation --> Terms, signup confirmation, billing notices 5. Respond within **20 days** --> [Representment Workflow](/docs/operations/representment-workflow) **Prevent future C28 chargebacks:** 1. Make cancellation as easy as signup 2. Send pre-billing reminders 7+ days before each charge 3. [Review subscription compliance](/docs/compliance/subscriptions/recurring-billing) 4. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to refund before chargeback --- ## See Also - [Recurring Billing Compliance](/docs/compliance/subscriptions/recurring-billing) - Subscription rules and requirements - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Billing fundamentals - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflect before filing - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before they happen - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Customer clarity - [Amex Reason Codes](/docs/reference/reason-codes/amex) - All Amex codes - [Visa 13.2 - Cancelled Recurring](/docs/reference/reason-codes/visa/13-2-cancelled-recurring) - Visa equivalent - [Mastercard 4853 - Cardholder Dispute](/docs/reference/reason-codes/mastercard/cardholder-dispute) - Mastercard equivalent - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Reduce Chargebacks Playbook](/docs/playbooks/reduce-chargebacks-fast) - Crisis response --- ## Amex F29 - Card Not Present Fraud Source: https://paymentsandrisk.com/docs/reference/reason-codes/amex/f29-cnp-fraud # Amex F29 - Card Not Present Fraud :::info[TL;DR] - F29 is Amex's **main fraud code for e-commerce and card-not-present orders**. The cardholder says they didn't authorize the charge. - SafeKey (Amex's 3D Secure) is the defense that actually works. Full authentication shifts liability to the issuer. The dispute stops being yours. - Without SafeKey you're arguing with AVS/CVV results, delivery proof, and device logs. That wins sometimes, not most of the time. - You get **20 calendar days** to respond. Visa gives 30 and Mastercard gives 45. - Amex usually sends an inquiry first. Answer it well and the chargeback doesn't get filed at all. ::: A cardholder told Amex they didn't place an order you shipped. Online, phone, or mail. That's F29. On Amex it's the code e-commerce merchants see most. ## Overview A cardholder says the charge wasn't theirs, and no card was present. Amex files F29. That's online checkout, phone orders, mail orders, and anything else where the card never physically showed up. There's no chip read to fall back on. Everything you'll argue with is data you captured at checkout. ## When This Code Applies - Cardholder denies making an online purchase - Stolen card credentials used for a CNP transaction - Account takeover resulting in unauthorized orders - Family member or household user makes purchase without authorization - Friendly fraud (cardholder made the purchase but claims otherwise) ## Conditions for Valid Dispute ### Amex Must Verify 1. Cardholder didn't authorize the transaction 2. Transaction happened in a card-not-present environment 3. Dispute filed within the allowable time frame 4. Cardholder didn't benefit from the transaction ### Transaction Must Be - E-commerce (online checkout) - Mail order or telephone order (MOTO) - Recurring billing without proper SafeKey authentication - Any other environment where the card never physically appears ## Time Frames :::warning[Shorter Than Visa/Mastercard] Amex gives you **20 calendar days** to respond. Visa allows 30, Mastercard allows 45. That's a third less than Visa and under half of Mastercard. Miss it and you lose automatically. Doesn't matter how good the evidence was. ::: | Stage | Window | |-------|--------| | Inquiry response | **20 calendar days** | | Chargeback response | **20 calendar days** | | Documentation request | **10 calendar days** | ### Amex Inquiry Process Amex usually sends an inquiry before the chargeback. Treat the inquiry as your real deadline. Ignore it and the chargeback files itself. Then you're fighting, not answering. ```mermaid flowchart LR A[Inquiry Received] --> B[20 days to respond] B --> C{Response?} C -->|Yes + Strong Evidence| D[Inquiry Closed] C -->|Yes + Weak Evidence| E[Chargeback Filed] C -->|No Response| F[Automatic Chargeback] style A fill:#6366f1,color:#fff style D fill:#10b981,color:#fff style F fill:#ef4444,color:#fff ``` ## SafeKey (3D Secure) Liability Shift ### Full Liability Shift (Issuer Liable) The issuer eats the loss when all three of these are true: - SafeKey challenge completed by cardholder - ECI 05 = fully authenticated - Valid cryptogram/AEVV present ### No Liability Shift (Merchant Liable) | Scenario | ECI | Merchant Liability | |----------|-----|-------------------| | Authentication attempted, issuer unavailable | 06 | Reduced | | Authentication failed or not attempted | 07 | Full | | SafeKey not implemented | N/A | Full | | Certain excluded MCC categories | Any | Full | :::tip[SafeKey Is Your Best Defense] Nobody publishes a clean figure for SafeKey's effect on F29 volume. Anyone quoting you one is guessing. The mechanism is what matters. A fully authenticated transaction (ECI 05) moves fraud liability to the issuer. Those disputes never reach you. Take real Amex volume and it's the highest-value item on this page. ::: ## Representment Options ### 1. SafeKey Authentication **When to use:** SafeKey ran and it passed. **Evidence required:** - ECI value showing full authentication (05) - AEVV/cryptogram - Authentication timestamp - SafeKey transaction ID ### 2. AVS and CVV Match **When to use:** AVS and CVV both matched. **Evidence required:** - AVS response showing match (full or partial) - CVV/CID match confirmation - Delivery confirmation to the AVS-verified address ### 3. Delivery Confirmation **When to use:** Physical goods reached the cardholder. You've got tracking. **Evidence required:** - Carrier tracking showing delivered status - Signature confirmation (strongly recommended) - Delivery address matching billing or AVS-verified address - Photo proof of delivery (if available) ### 4. Digital Goods Access **When to use:** They used it. You've got logs. **Evidence required:** - IP address at time of download or access - Access/usage logs showing activity after purchase - Account login history - Download confirmation records ### 5. Prior Transaction History **When to use:** They've bought before and never disputed. **Evidence required:** - Previous undisputed transactions from the same account - Matching email, device, or IP across transactions - Established customer relationship documentation ### 6. Cardholder Communication **When to use:** You've got the cardholder on record about the order. **Evidence required:** - Order confirmation sent to cardholder email - Customer service correspondence about the order - Chat transcripts or call recordings ## Required Documentation | Evidence Type | Strength | |--------------|----------| | SafeKey authenticated (ECI 05) | Very Strong | | AVS match + CVV match + signed delivery | Strong | | Tracking delivered + AVS match | Medium-Strong | | Prior undisputed transactions + device match | Medium | | No authentication or delivery proof | Very Weak | ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | SafeKey authenticated (ECI 05) | 70-85% | | AVS + CVV + delivery proof | 45-60% | | Prior transaction history + device match | 35-50% | | Standard evidence only | 25-40% | | No evidence | Under 15% | That table is a decision, not trivia. Without SafeKey your best case is a coin flip. ## Prevention Strategies ### Authentication 1. **Turn on SafeKey (3D Secure 2.0)** - Moves the loss to the issuer 2. **Run the frictionless flow** - Most customers never see it 3. **Challenge the risky ones** - Step up when a signal fires ### Verification 1. **Require CVV/CID every time** - Amex puts 4 digits on the front 2. **Check AVS on every order** - Decline or review mismatches 3. **Verify email addresses** - A bounced confirmation is a signal 4. **Call for the big ones** - High-value or high-risk orders ### Evidence Collection 1. **Log everything** - IP, device fingerprint, timestamps, session data 2. **Keep the conversation** - Emails, chat logs, call recordings 3. **Require delivery confirmation** - Tracking, plus signature on big orders 4. **Track account history** - Today's boring order is tomorrow's evidence ### Fraud Screening 1. **Real-time scoring** - Catch it at checkout, not later 2. **Velocity checks** - Flag ordering patterns that aren't normal 3. **Device fingerprinting** - Match devices across sessions 4. **Address validation** - Cross-check shipping against billing ## Common Mistakes 1. **Skipping SafeKey** - You're eating avoidable fraud 2. **No delivery confirmation** - You can't prove they got it 3. **Ignoring Amex inquiries** - They don't go away, they escalate 4. **Missing the 20-day window** - Shorter than Visa/MC, easy to blow 5. **Dumping files on Amex** - A messy packet reads weak ## Related Codes - F10 - Missing Imprint - F24 - No Cardholder Authorization - F30 - EMV Counterfeit - F31 - EMV Lost/Stolen/NRI ## Next Steps **Got this chargeback?** 1. Check whether SafeKey ran โ†’ ECI 05 and you're in good shape 2. Pull AVS/CVV results โ†’ Document the match status 3. Gather delivery proof โ†’ Tracking, signature, address match 4. Look for prior undisputed orders โ†’ Same device, email, or IP? 5. Respond within **20 days** โ†’ [Representment Workflow](/docs/operations/representment-workflow) **Prevent future F29 chargebacks:** 1. [Implement 3D Secure / SafeKey](/docs/playbooks/first-time-3ds-setup) for liability shift 2. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to refund before chargeback 3. [Configure fraud detection](/docs/fraud/detection/velocity-rules) to catch unauthorized use early --- ## See Also - [3D Secure Implementation](/docs/fraud/prevention/3ds) - SafeKey setup and configuration - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Third-Party Fraud](/docs/fraud/types/third-party) - True unauthorized fraud - [Account Takeover](/docs/fraud/types/account-takeover) - ATO defense - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Proving cardholder involvement - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address and security code verification - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Fraud pattern detection - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Pre-transaction screening - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflect before filing - [Amex Reason Codes](/docs/reference/reason-codes/amex) - All Amex codes - [Visa 10.4 - CNP Fraud](/docs/reference/reason-codes/visa/10-4-fraud-cnp) - Visa equivalent - [Mastercard 4837 - Fraud](/docs/reference/reason-codes/mastercard/fraud) - Mastercard equivalent --- ## Discover AP - Cancelled Recurring Payments Source: https://paymentsandrisk.com/docs/reference/reason-codes/discover/ap-cancelled-recurring # Discover AP - Cancelled Recurring Payments :::info[TL;DR] AP is what Discover files when a cardholder says they cancelled and the charges kept coming. Your defense is one of two things. Either **you never got a cancellation request**, or the **charge landed first**. You'll need consent documentation, cancellation logs and usage records. You get **30 calendar days**. With strong consent and usage evidence, win rates run 50-65%. ::: Someone cancelled a subscription, kept getting billed, and called Discover. Here's how you fight it. ## Overview Discover files AP when a cardholder disputes a recurring charge and says they'd already cancelled. It covers subscriptions, memberships, automatic renewals, and any repeating charge the cardholder says should have stopped. AP volume is rising on the Discover network as subscription commerce grows. ## When This Code Applies - Subscription cancelled but charges continue - Free trial converted to paid without clear consent - Recurring billing after account closure - Automatic renewal without proper notice - Charge processed after explicit cancellation request - Membership fees charged after cancellation ## Cardholder Requirements Before Discover files AP, here's what the cardholder should have done: 1. **Have attempted to cancel** - Through the merchant's cancellation process 2. **Allow reasonable processing time** - For cancellation to take effect 3. **Retain proof of cancellation** - Confirmation emails, reference numbers 4. **The transaction must be recurring** - Not a one-time charge ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard recurring charge | 120 days from disputed transaction date | | Each charge | Can dispute each billing cycle separately | | Free trial conversion | 120 days from first paid charge | | Stage | Window | |-------|--------| | Retrieval request response | **14 calendar days** | | Chargeback response | **30 calendar days** | | Second chargeback | **30 calendar days** | ### Discover Retrieval Process Discover may send a retrieval request first. Answer it with your consent documentation and cancellation records. That can end the dispute before it's a chargeback. ```mermaid flowchart LR A[Retrieval Request] --> B[14 days to respond] B --> C{Consent + billing docs?} C -->|Yes + Strong| D[May Resolve] C -->|Yes + Weak| E[Chargeback Filed] C -->|No Response| F[Automatic Chargeback] style A fill:#6366f1,color:#fff style D fill:#10b981,color:#fff style F fill:#ef4444,color:#fff ``` ## Representment Options ### 1. No Cancellation Request Received **When to use:** you've got no record of a cancellation request. **Evidence required:** - Cancellation policy and process documentation - Communication logs showing none arrived - Account history showing active status throughout - The cancellation channels you offer, and proof they're reachable ### 2. Transaction Occurred Before Cancellation **When to use:** the charge went through before the cancellation did. You're arguing timing. **Evidence required:** - Cancellation request date and timestamp - Transaction date and timestamp - Billing cycle terms showing charge was properly timed - Terms and conditions specifying billing schedule ### 3. Terms Allow the Charge **When to use:** Your terms clearly disclose post-cancellation or renewal charges. **Evidence required:** - Signed or accepted terms and conditions - Specific language about cancellation timing and billing cycles - Proof cardholder agreed to terms at signup - Renewal notice sent before charge (if applicable) ### 4. Cardholder Continued Using the Service **When to use:** usage logs show the cardholder using the service after the alleged cancellation. **Evidence required:** - Login and access logs after cancellation date - Feature usage records - Content consumption data - Account activity history :::tip[Usage Logs Win Cases] Prove the cardholder logged in and used the service after they say they cancelled, and your case gets much stronger. So log activity properly. ::: ### 5. Refund Already Issued **When to use:** you've already refunded the disputed charge. **Evidence required:** - Refund transaction details (date, amount, reference) - Refund confirmation sent to cardholder - Proof refund was processed to the same Discover card ### 6. Valid Free Trial Conversion **When to use:** the cardholder took a free trial that converted to paid, per the disclosed terms. **Evidence required:** - Trial terms clearly showing conversion date and amount - Proof cardholder agreed to trial terms - Conversion notice sent before first charge - Opt-out option provided and accessible ## Required Documentation | Evidence Type | Strength | |--------------|----------| | No cancellation record + continued usage | Strong | | Transaction before cancellation request | Strong | | Accepted terms + cancellation policy | Medium-Strong | | Conversion notice sent for trial | Medium | | No documentation of consent | Very Weak | ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | No cancellation record + usage logs | 55-70% | | Transaction before cancellation date | 60-75% | | Clear terms + consent documentation | 45-60% | | Trial conversion with notice sent | 40-55% | | No documentation | Under 20% | ## Prevention Strategies ### Clear Terms and Consent 1. **Explicit opt-in** - no pre-checked boxes, and nothing hidden 2. **Display terms prominently** - before purchase, not buried in the fine print 3. **State amount and frequency clearly** - "$19.99/month billed on the 1st" 4. **Explain cancellation** - how, where, and by when 5. **Send a confirmation email** - with the terms, right after signup ### Pre-Billing Notifications 1. **Send reminders 7+ days before each charge** - Upcoming billing notice 2. **Include the exact amount** - what they'll be charged 3. **Include the date** - when the charge hits 4. **Provide a cancellation link** - Direct path to cancel 5. **Include contact information** - Phone, email, chat options :::warning[Pre-Billing Notices Are Essential] Merchants who send pre-billing reminders see AP chargeback rates drop 30-50%. A reminder email costs almost nothing. A chargeback costs the fee plus the sale. ::: ### Easy Cancellation 1. **Same channel as signup** - they signed up online, so they cancel online. Don't route them to a phone queue 2. **Self-service cancellation** - Account portal with clear cancel option 3. **Process immediately** - don't delay it or add steps 4. **Send confirmation** - a cancellation receipt with the effective date and final billing 5. **No dark patterns** - don't make cancelling deliberately hard ### Documentation and Logging 1. **Log all communications** - Every email, call, chat, and support ticket 2. **Record consent with timestamps** - When and how they agreed to recurring billing 3. **Track all cancellation requests** - With confirmation records 4. **Maintain detailed usage logs** - Login times, feature usage, content access 5. **Archive billing records** - Every charge with corresponding service period ## Trial Conversions ### Best Practices 1. **Clear trial terms** - Duration, conversion date, post-trial price 2. **Conversion notice** - Email 7+ days before first paid charge 3. **Opt-out option** - Easy to cancel before conversion 4. **Confirmation at conversion** - Receipt email when paid billing starts 5. **Explicit consent** - For the transition from free to paid ### Common Trial Issues | Issue | Prevention | |-------|------------| | No conversion notice sent | Automated email 7 days before charge | | Surprise charge amount | Clear pricing at trial signup | | Hidden billing terms | Terms displayed prominently at checkout | | Difficult cancellation | Self-service cancel in account settings | | No trial end reminder | Email 3 days before trial expires | ## Common Mistakes 1. **No cancellation logs** - you can't prove a request never arrived 2. **Making cancellation difficult** - it drives chargebacks, and it's a regulator magnet 3. **No pre-billing notifications** - the charge surprises the cardholder 4. **Poor terms display** - you can't prove informed consent 5. **Ignoring retrieval requests** - it auto-escalates to a chargeback 6. **Billing after cancellation** - one extra charge is enough to trigger a dispute 7. **No usage logging** - you can't prove they kept using the service ## Related Codes - RN2 - Credit Not Posted - RG - Non-Receipt of Goods/Services - RM - Quality/Not as Described - CR - Cancelled Reservation ## Next Steps **Got this chargeback?** 1. Check cancellation records --> Did you receive a cancellation request? 2. Check billing dates --> Was the transaction before or after cancellation? 3. Pull usage logs --> Did the cardholder continue using the service? 4. Gather consent documentation --> Terms, signup confirmation, billing notices 5. Respond within **30 days** --> [Representment Workflow](/docs/operations/representment-workflow) **Prevent future AP chargebacks:** 1. Make cancellation as easy as signup 2. Send pre-billing reminders 7+ days before each charge 3. [Review subscription compliance](/docs/compliance/subscriptions/recurring-billing) 4. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to refund before chargeback --- ## See Also - [Recurring Billing Compliance](/docs/compliance/subscriptions/recurring-billing) - Subscription rules and requirements - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Billing fundamentals - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflect before filing - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before they happen - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Customer clarity - [Discover Reason Codes](/docs/reference/reason-codes/discover) - All Discover codes - [Visa 13.2 - Cancelled Recurring](/docs/reference/reason-codes/visa/13-2-cancelled-recurring) - Visa equivalent - [Mastercard 4853 - Cardholder Dispute](/docs/reference/reason-codes/mastercard/cardholder-dispute) - Mastercard equivalent - [Amex C28 - Cancelled Recurring](/docs/reference/reason-codes/amex/c28-cancelled-recurring) - Amex equivalent - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Reduce Chargebacks Playbook](/docs/playbooks/reduce-chargebacks-fast) - Crisis response --- ## Discover RG - Non-Receipt of Goods/Services Source: https://paymentsandrisk.com/docs/reference/reason-codes/discover/rg-non-receipt # Discover RG - Non-Receipt of Goods/Services :::info[TL;DR] RG fires when a Discover cardholder says they paid and never got the goods or the service. Your whole defense is **delivery proof**. Tracking numbers, signed confirmations, delivery to the right address. Without those you'll lose. You get **30 calendar days** to respond. With solid delivery evidence, win rates run 60-75%. ::: They admit they bought it. They say it never showed up. ## Overview Discover files RG when a cardholder says the goods never arrived or the service never happened. It's one of the most common consumer dispute codes on the network. This isn't a fraud code, so the UA series doesn't apply. The cardholder admits they bought it. They just say nothing showed up. ## When This Code Applies - Physical goods never arrived at the cardholder's address - Digital goods not accessible or not delivered - Services not performed or not completed - You cancelled the order and never refunded it - The merchant shut down before fulfilling and didn't refund - Partial delivery (significant items missing from the order) ## Cardholder Requirements Before Discover files an RG dispute, the cardholder should: 1. **Wait for the delivery date** - They can't file before the goods are due 2. **Try you first** - A good faith effort to sort it out 3. **Allow reasonable time** - For a delayed delivery or a rescheduled service 4. **Actually not have it** - The goods, the service, or a big chunk of either ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Physical goods | 120 days from expected delivery date | | Services | 120 days from expected service date | | Digital goods | 120 days from transaction date | | Cancelled order | 120 days from cancellation date | | Stage | Window | |-------|--------| | Retrieval request response | **14 calendar days** | | Chargeback response | **30 calendar days** | | Second chargeback | **30 calendar days** | ### Discover Retrieval Process Discover usually sends a retrieval request before the chargeback. Answer it fast, with your delivery documentation attached. Done well, the chargeback never happens. ```mermaid flowchart LR A[Retrieval Request] --> B[14 days to respond] B --> C{Delivery proof provided?} C -->|Yes + Strong| D[May Resolve] C -->|Yes + Weak| E[Chargeback Filed] C -->|No Response| F[Automatic Chargeback] style A fill:#6366f1,color:#fff style D fill:#10b981,color:#fff style F fill:#ef4444,color:#fff ``` ## Representment Options ### 1. Goods Were Delivered **Use when:** you've got proof it arrived. **Evidence required:** - Tracking number with carrier delivery confirmation - Signature confirmation (strongly recommended for orders over $100) - Delivery address matching the order address - Photo proof of delivery (if carrier provides) ### 2. Services Were Rendered **Use when:** you can show the work got done. **Evidence required:** - Service completion documentation - Work orders signed by the customer - Before/after photos or documentation - Appointment records with outcomes - Follow-up communication confirming satisfaction ### 3. Digital Goods Were Accessed **Use when:** they downloaded it or opened it. **Evidence required:** - Download confirmation logs - Access timestamps showing usage after purchase - Account login activity - Email delivery confirmation with download links - IP address at time of access ### 4. Cardholder Picked Up Goods **Use when:** they collected it in store or at the curb. **Evidence required:** - Signed pickup receipt - ID verification records - Pickup confirmation email or text - Store records documenting the pickup ### 5. Refund Already Issued **Use when:** you've already credited the card. **Evidence required:** - Refund transaction details (date, amount, reference number) - Refund confirmation sent to cardholder - Proof refund was processed to the same Discover card ### 6. Partial Delivery with Documentation **Use when:** part of the order shipped and they're disputing all of it. **Evidence required:** - Tracking for each delivered item - Documentation of what was shipped vs. what was ordered - Communication about backordered or out-of-stock items - Offer of partial refund for undelivered items ## Required Documentation Not all delivery proof weighs the same. | Evidence Type | Strength | |--------------|----------| | Signed delivery + correct address | Strong | | Tracking delivered + correct address | Medium-Strong | | Tracking delivered + different address | Weak | | Digital access logs + IP match | Medium-Strong | | Signed service completion | Strong | | No tracking or delivery proof | Very Weak | ## Win Rate Expectations These aren't promises. They're what each kind of evidence tends to be worth. | Evidence Type | Expected Win Rate | |--------------|------------------| | Signed delivery + address match | 65-80% | | Tracking delivered + correct address | 55-70% | | Digital access logs | 50-65% | | Service completion signed | 60-75% | | No delivery proof | Under 20% | ## Prevention Strategies ### Shipping Best Practices 1. **Always use tracking** - Every shipment, every order, no exceptions 2. **Require signature** - For orders over $100 or high-risk categories 3. **Ship to a verified address** - AVS match if you've got one 4. **Send shipping notifications** - Proactive emails with tracking links 5. **Insure high-value shipments** - Carrier insurance for expensive items ### Delivery Confirmation 1. **Photo proof** - Use carriers that provide delivery photos 2. **GPS confirmation** - Delivery location verification 3. **Recipient name** - Document who signed for the package 4. **Date/time stamps** - When delivery occurred ### For Digital Goods 1. **Instant delivery** - Minimize time between purchase and access 2. **Download logging** - Record IP, timestamp, device for every access 3. **Multiple delivery methods** - Email plus in-account access 4. **Access confirmation emails** - Automated delivery receipt ### For Services 1. **Sign-off at completion** - Get the customer's signature on the spot 2. **Before/after evidence** - Photos, screenshots, records 3. **Written confirmation** - An email saying the work got done 4. **Follow up** - "Everything come out OK?" builds a paper trail ### Customer Communication 1. **Ship updates unprompted** - Kills the "where's my order?" email 2. **Clear delivery estimates** - Set them at checkout, not after 3. **Easy contact options** - Let people reach you before they reach Discover 4. **Flag delays** - Same day you know about them ## Common Mistakes 1. **No tracking on shipments** - Fatal to your defense 2. **Shipping to an unverified address** - Weakens everything else you have 3. **No signature on high-value orders** - Tracking alone often isn't enough 4. **Ignoring retrieval requests** - It auto-escalates to a chargeback 5. **Missing the 30-day deadline** - Automatic loss 6. **Thin digital delivery logs** - You can't prove access or download ## Related Codes - RM - Quality/Not as Described - NF - Non-Receipt of Cash from ATM - CD - Credit Documentation - CR - Cancelled Reservation ## Next Steps **Got this chargeback?** 1. Pull tracking โ†’ Did it deliver? Get carrier confirmation 2. Check signature โ†’ Have you got signed proof? 3. Verify address โ†’ Does it match the billing address? 4. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 5. Respond within **30 days** **Prevent future RG chargebacks:** 1. Ship with tracking and delivery confirmation, every time 2. Require a signature over $100 3. Send shipping updates with tracking links 4. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to catch them early --- ## See Also - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes claiming non-receipt - [Refund Fraud](/docs/fraud/types/refund-fraud) - Return and non-receipt abuse - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before they happen - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflect before filing - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address verification for shipping - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Discover Reason Codes](/docs/reference/reason-codes/discover) - All Discover codes - [Visa 13.1 - Not Received](/docs/reference/reason-codes/visa/13-1-not-received) - Visa equivalent - [Mastercard 4855 - Goods Not Provided](/docs/reference/reason-codes/mastercard/goods-not-provided) - Mastercard equivalent - [Amex C08 - Not Received](/docs/reference/reason-codes/amex/c08-not-received) - Amex equivalent - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Customer clarity --- ## Discover UA02 - Fraud: Card Not Present Source: https://paymentsandrisk.com/docs/reference/reason-codes/discover/ua02-cnp-fraud # Discover UA02 - Fraud: Card Not Present :::info[TL;DR] - UA02 is Discover's **main fraud code for e-commerce and card-not-present orders**. The cardholder says they didn't authorize the charge. - ProtectBuy (Discover's 3D Secure) is the defense that actually works. Full authentication shifts liability to the issuer. - Without it you're arguing with AVS/CVV results, delivery proof, and device logs. That wins sometimes, not most of the time. - You get **30 calendar days** on the chargeback. Only **14** on a retrieval request. - The retrieval is the cheaper fight. It's the one people skip. ::: A cardholder told Discover they didn't place an order you fulfilled. Online, phone, or mail. That's UA02. It's the same complaint as [Visa 10.4](/docs/reference/reason-codes/visa/10-4-fraud-cnp) and [Mastercard 4837](/docs/reference/reason-codes/mastercard/fraud). On Discover it's the fraud code you'll see most. ## Overview A cardholder says the charge wasn't theirs, and no card was present. Discover files UA02. That's online checkout, phone orders, mail orders, and anything else where the card never physically showed up. There's no chip read to fall back on. Everything you'll argue with is data you captured at checkout. ## When This Code Applies - Cardholder denies making an online purchase - Stolen card credentials used for a CNP transaction - Account takeover resulting in unauthorized orders - Family member makes purchase without cardholder knowledge - Friendly fraud (cardholder authorized the purchase but denies it) ## Conditions for Valid Dispute ### Issuer Must Verify 1. Cardholder didn't authorize the transaction 2. Transaction happened in a card-not-present environment 3. Dispute filed within the allowable time frame 4. Cardholder didn't benefit from the transaction ### Transaction Must Be - E-commerce (online checkout) - Mail order or telephone order (MOTO) - Recurring billing without proper ProtectBuy authentication - Any other environment where the card never physically appears ## Time Frames | Stage | Window | |-------|--------| | Retrieval request response | **14 calendar days** | | Chargeback response | **30 calendar days** | | Second chargeback | **30 calendar days** | ### Discover Retrieval Process Discover usually sends a retrieval request before the chargeback. That's your first and cheapest line of defense. Answer it well and the chargeback may never happen. ```mermaid flowchart LR A[Retrieval Request] --> B[14 days to respond] B --> C{Receipt + evidence provided?} C -->|Yes + Strong| D[May Resolve] C -->|Yes + Weak| E[Chargeback Filed] C -->|No Response| F[Automatic Chargeback] style A fill:#6366f1,color:#fff style D fill:#10b981,color:#fff style F fill:#ef4444,color:#fff ``` :::tip[Answer Retrievals The Same Day] A good retrieval response can stop the chargeback before it exists. You get 14 days. You'd build the same file later anyway. ::: ## ProtectBuy (3D Secure) Liability Shift ### Full Liability Shift (Issuer Liable) The issuer eats the loss when all three of these are true: - ProtectBuy challenge completed by cardholder - ECI 05 = fully authenticated - Valid cryptogram present ### Who Carries the Loss, by ECI | Scenario | ECI | Who pays | |----------|-----|----------| | Fully authenticated | 05 | Issuer | | Authentication attempted, issuer unavailable | 06 | Reduced merchant liability | | Authentication failed or not attempted | 07 | Merchant, in full | | ProtectBuy not implemented | N/A | Merchant, in full | ## Representment Options ### 1. ProtectBuy Authentication **When to use:** ProtectBuy ran and it passed. **Evidence required:** - ECI value showing full authentication (05) - Cryptogram/CAVV - Authentication timestamp - ProtectBuy transaction ID ### 2. AVS and CVV Match **When to use:** AVS and CVV both matched. **Evidence required:** - AVS response showing match (full or partial) - CVV2/CID match confirmation - Delivery confirmation to the AVS-verified address ### 3. Delivery Confirmation **When to use:** It got delivered. You've got tracking. **Evidence required:** - Carrier tracking showing delivered status - Signature confirmation - Delivery address matching billing or AVS-verified address - Photo proof of delivery (if available) ### 4. Digital Goods Access **When to use:** They used it. You've got logs. **Evidence required:** - IP address at time of download or access - Access/usage logs showing activity after purchase - Account login history - Download confirmation records ### 5. Prior Transaction History **When to use:** They've bought before and never disputed. **Evidence required:** - Previous undisputed transactions from the same account - Matching email, device, or IP across transactions - Established customer relationship documentation ### 6. Cardholder Communication **When to use:** You've got the cardholder on record about the order. **Evidence required:** - Order confirmation sent to and opened by cardholder - Customer service correspondence about the order - Chat transcripts or call recordings - Shipping address confirmation from cardholder ## Required Documentation | Evidence Type | Strength | |--------------|----------| | ProtectBuy authenticated (ECI 05) | Very Strong | | AVS match + CVV match + signed delivery | Strong | | Tracking delivered + AVS match | Medium-Strong | | Prior undisputed transactions + device match | Medium | | No authentication or delivery proof | Very Weak | ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | ProtectBuy authenticated (ECI 05) | 70-85% | | AVS + CVV + delivery proof | 45-60% | | Prior transaction history + device match | 35-50% | | Standard evidence only | 25-40% | | No evidence | Under 15% | Read that table as a decision, not trivia. Without ProtectBuy your best case is a coin flip. ## Prevention Strategies ### Authentication 1. **Turn on ProtectBuy (3D Secure 2.0)** - Moves the loss to the issuer 2. **Run the frictionless flow** - Most customers never see it 3. **Challenge the risky ones** - Only when a signal fires ### Verification 1. **Require CVV2 every time** - Collect the code, no exceptions 2. **Check AVS** - Every order, not just the big ones 3. **Verify email addresses** - A bounced confirmation is a signal 4. **Call for the big ones** - High-value or high-risk orders ### Evidence Collection 1. **Log everything** - IP, device fingerprint, timestamps, session data 2. **Keep the conversation** - Emails, chat logs, call recordings 3. **Require delivery confirmation** - Tracking, plus signature on big orders 4. **Track account history** - Today's boring order is tomorrow's evidence ### Fraud Screening 1. **Real-time scoring** - Catch it at checkout, not later 2. **Velocity checks** - Flag ordering patterns that aren't normal 3. **Device fingerprinting** - Match devices across sessions 4. **Address validation** - Cross-check shipping against billing ## Common Mistakes 1. **Skipping ProtectBuy** - You're eating avoidable fraud 2. **No delivery confirmation** - You can't prove they got it 3. **Ignoring retrieval requests** - They don't go away, they escalate 4. **Dumping files on the issuer** - A messy packet reads weak 5. **Not logging device data** - No proof they were there ## Related Codes - UA01 - Fraud: Card Present - UA05 - Fraud: Chip Card Counterfeit - UA06 - Fraud: Chip Card Lost/Stolen - UA11 - Cardholder Claims Fraud ## Next Steps **Got this chargeback?** 1. Check whether ProtectBuy ran โ†’ ECI 05 and you're in good shape 2. Pull AVS/CVV results โ†’ Document the match status 3. Gather delivery proof โ†’ Tracking, signature, address match 4. Look for prior undisputed orders โ†’ Same device, email, or IP? 5. Respond within **30 days** โ†’ [Representment Workflow](/docs/operations/representment-workflow) **Prevent future UA02 chargebacks:** 1. [Implement 3D Secure / ProtectBuy](/docs/playbooks/first-time-3ds-setup) for liability shift 2. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to refund before chargeback 3. [Configure fraud detection](/docs/fraud/detection/velocity-rules) to catch unauthorized use early --- ## See Also - [3D Secure Implementation](/docs/fraud/prevention/3ds) - ProtectBuy setup and configuration - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Third-Party Fraud](/docs/fraud/types/third-party) - True unauthorized fraud - [Account Takeover](/docs/fraud/types/account-takeover) - ATO defense - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Proving cardholder involvement - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address and security code verification - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Fraud pattern detection - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Pre-transaction screening - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflect before filing - [Discover Reason Codes](/docs/reference/reason-codes/discover) - All Discover codes - [Visa 10.4 - CNP Fraud](/docs/reference/reason-codes/visa/10-4-fraud-cnp) - Visa equivalent - [Mastercard 4837 - Fraud](/docs/reference/reason-codes/mastercard/fraud) - Mastercard equivalent - [Amex F29 - CNP Fraud](/docs/reference/reason-codes/amex/f29-cnp-fraud) - Amex equivalent --- ## 4807 (Retired) - Warning Bulletin File Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4807-warning-bulletin # Mastercard 4807 (Retired) - Warning Bulletin File :::info[TL;DR] - 4807 is retired. It was consolidated into [4808](/docs/reference/reason-codes/mastercard/authorization) and survives only as a deprecated alias - While it ran, it covered transactions on a card sitting on the Warning Bulletin, Mastercard's hot card list - Chargeback window was 90 calendar days from settlement, 120 for ATM and Maestro in Europe - The number still surfaces in real systems, so this page stays for anyone holding an old notification ::: :::warning[This code is retired - don't use it for new disputes] **4807 is no longer a chargeback reason code.** Mastercard consolidated the authorization-related codes into **4808** in its 2016 reason-code consolidation. In the current Mastercard Chargeback Guide, 4807 appears only as a deprecated sender-memo alias for 4808 - a label some systems still transmit, not a code anyone can file under. **Working a dispute today?** Use [4808 - Authorization-Related Chargeback](/docs/reference/reason-codes/mastercard/authorization). The Warning Bulletin scenario described on this page is now handled as one of the authorization conditions under 4808. **Seeing 4807 on a current notification?** Because it can still ride along as a deprecated alias, this one is genuinely ambiguous: it may be a real 4808 case wearing an old label, or it may be a processor or vendor working from stale material. Either way, don't respond to it as a standalone 4807. Ask your processor for the message reason code on the case, confirm it's 4808, and build your response around the authorization record - the auth request, the response code your terminal received, and the timestamps. ::: *Everything below describes how 4807 worked as a standalone code. It's preserved because old notifications, archived case files, and legacy vendor content still cite it, and the deprecated alias means the number still surfaces in real systems.* ## Overview Used when a transaction was processed on a card that appeared on the Warning Bulletin (hot card list) at the time of the transaction. ## When This Code Applies - Card was on Warning Bulletin at transaction time - Card was reported lost, stolen, or fraudulent - Terminal should have received decline/pick-up response - Transaction processed despite Warning Bulletin listing ## Conditions for Valid Chargeback ### Issuer Must Verify 1. Card was on Warning Bulletin at transaction time 2. Transaction was card-present 3. Merchant terminal should have checked Warning Bulletin ### Transaction Must Be - Card-present (CP) transaction - Processed at a terminal that can check Warning Bulletin - Processed after card was added to Warning Bulletin ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days from settlement | | ATM/Maestro Europe | 120 calendar days | ## Warning Bulletin Process ### How Warning Bulletin Works 1. Issuer reports card as compromised 2. Card added to Mastercard Warning Bulletin 3. Bulletin distributed to terminals/acquirers 4. Terminal should check and decline/retain card ### Response Codes | Code | Action | |------|--------| | 04 | Capture card | | 41 | Lost card | | 43 | Stolen card | ## Representment Options Limited options when Warning Bulletin applies: ### 1. Card Not on Warning Bulletin at Transaction Time **Evidence required:** - Transaction timestamp - Warning Bulletin addition timestamp - Card added after transaction ### 2. Authorization Was Approved **Evidence required:** - Valid authorization code - Auth request/response log - No Warning Bulletin match at auth time ### 3. Transaction Was Card-Not-Present **Evidence required:** - CNP transaction indicator - E-commerce or MOTO proof - Different rules apply to CNP ## Prevention Strategies ### Terminal Configuration 1. **Real-time authorization** - Always check online 2. **Warning Bulletin updates** - Keep terminal data current 3. **Response code handling** - Honor decline responses 4. **Decline = No sale** - Never override Warning Bulletin ### Staff Training 1. **Decline code recognition** - Know what 04, 41, 43 mean 2. **No override policy** - Never force through declined cards 3. **Card retention** - When safe, per local policy 4. **Documentation** - Log all Warning Bulletin events ### System Requirements 1. **Online terminals** - No offline auth 2. **Current Warning Bulletin** - Regular updates 3. **Logging** - Record all auth responses 4. **Alert on declines** - Flag Warning Bulletin matches ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | Card added after transaction | 80-90% | | Auth approved (no Warning Bulletin match) | 70-85% | | Card on Warning Bulletin at time | Under 10% | ## Common Mistakes 1. **Offline processing** - Can't check the Warning Bulletin 2. **Ignoring decline codes** - Processing despite decline 3. **Outdated Warning Bulletin** - Terminal data not current 4. **Staff override** - Forcing through blocked cards ## Regional Notes ### Europe (ATM/Maestro) - Extended 120-day chargeback window - Additional Warning Bulletin rules ### Other Regions - Standard 90-day window - Check regional variations ## Related Codes - [4808](/docs/reference/reason-codes/mastercard/authorization) - Authorization-Related (**the live code that absorbed 4807**) - [4812](/docs/reference/reason-codes/mastercard/account-not-on-file) - Account Number Not on File (also retired into 4808) - [4837](/docs/reference/reason-codes/mastercard/fraud) - No Cardholder Authorization ## See Also - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Terminal Operations](/docs/operations/terminal-operations) - [Fraud Prevention](/docs/fraud/prevention) --- ## 4808 - Authorization-Related Chargeback Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4808-authorization # Mastercard 4808 - Authorization-Related Chargeback :::info[TL;DR] - Authorization was required and you didn't obtain it properly. That's the code - It also catches deferred auth presented more than 7 calendar days after approval, refunds presented more than 5 days after the transaction, and CAT 3 device errors - Chargeback window is 90 calendar days from settlement, 120 for ATM and Maestro in Europe - You second present by proving a valid auth exists, that one auth covered a split shipment, or that you already refunded ::: Used when authorization was required but not properly obtained, or when authorization requirements were not met. ## When This Code Applies - Authorization was required but not obtained - Deferred authorization (offline chip-approved) presented more than 7 calendar days after the authorization approval date - Refund transaction presented more than 5 calendar days after transaction date - Account not in good standing and authorization protection period expired - Card-not-present authorization declined by issuer but approved through Stand-In or X-Code - Transaction improperly occurred at CAT 3 device - Transit First Ride Risk (FRR) claims ## Transactions Ineligible for This Chargeback - Properly identified Emergency Cash Advance transactions - Properly identified contactless transit aggregated transactions meeting all conditions - Taiwan domestic in-flight transactions (per AN 2491) ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days from settlement date | | Mainland China | 5-90 calendar days from settlement date | | ATM/Maestro (Europe) | 120 calendar days from Central Site Business Date | ## Authorization Protection Periods | Authorization Type | Protection Period | |-------------------|-------------------| | Preauthorizations | 30 calendar days | | Final authorizations (India domestic) | 4 calendar days (effective 3 April 2024) | | Final authorizations (all other) | 7 calendar days | | Deferred authorizations | 7 calendar days | | Undefined authorizations | 7 calendar days | | Refund transactions | 5 calendar days (effective 12 April 2024) | *Source: Mastercard Transaction Processing Rules, 9 December 2025, sections 2.5.1 through 2.9. The clock starts on the authorization approval date, not the transaction date. Mastercard splits by authorization type, not by card-present versus card-not-present.* Once the period lapses, you don't have a late authorization. You have none. Section 2.8 says the approved amount of an authorization with an expired protection period "is deemed to be zero." That's why capturing on day 8 lands here and not somewhere softer. You can extend the period on a preauthorization by submitting an additional preauthorization request for the same transaction, including a zero-amount one (section 2.9). That trick works on Mastercard and does nothing on Visa. ## Gratuity Tolerances | Transaction Type | Tolerance | |------------------|-----------| | Chip and PIN | 0% | | Contactless | 0% | | QR transactions | 0% | | Final authorization coded | 0% | | Mainland China domestic | 0% | | US domestic card-not-present (MCC 5812, 5814) | 30% | | US domestic card-present | 30% | | All other card-present | 20% | ## Currency Conversion Tolerance A **10% tolerance** exists for currency conversion differences between authorization and clearing dates. ## Representment Options The acquirer may second present when: 1. **Authorization was properly obtained** - Valid authorization exists for the transaction 2. **One authorization covered multiple clearing records** - Split shipment or partial fulfillment scenario 3. **A refund was previously issued** - Transaction was already credited 4. **The chargeback was invalid** - Doesn't meet reason code requirements ## Required Documentation | For Chargeback | For Representment | |----------------|-------------------| | None required | Proof of valid authorization | ## Second Presentment Time Frames | Region | Window | |--------|--------| | Standard | 45 calendar days from chargeback settlement | | Costa Rica domestic | 10 calendar days | | Kazakhstan domestic | 30 calendar days | | Nigeria domestic | **2 business days** | | Tanzania domestic | 20 calendar days | ## Message Text Requirements When second presenting, include in DE 72: - `AUTH MMDDYY/NNNNNN` (authorization date and approval code) ## Prevention Tips ### Best Practices 1. **Always obtain authorization before processing** - Never process without a valid auth 2. **Clear transactions within protection periods** - Don't let authorizations expire 3. **Use proper authorization codes** - Distinguish between preauth and final auth 4. **Monitor for Stand-In approvals** - These bypass issuer and may be declined later 5. **Track authorization expiration** - Set alerts before protection periods end ### Common Mistakes - Processing after authorization expiration - Not obtaining auth for add-on charges - Incorrect authorization amount vs. clearing amount - Delayed clearing beyond protection window ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | Valid authorization exists | 70-85% | | Authorization expired but valid | 30-50% | | No authorization obtained | Under 10% | ## Related Codes - 4807 - Warning Bulletin - 4812 - Account Number Not on File ## Next Steps **Got this chargeback?** 1. Pull authorization logs โ†’ Do you have a valid auth code? 2. Check auth-to-capture timing โ†’ Did you exceed the protection period? 3. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 4. Respond within 45 days (Mastercard) **Prevent future 4808 chargebacks:** 1. Capture within the protection period (7 calendar days for a final auth, 30 for a flagged preauth) 2. Re-authorize if capturing later than protection period 3. Send an additional preauthorization to extend the clock, or proper incremental auth for changed amounts 4. [Review authorization basics](/docs/payments/reference/authorization-basics) --- ## See Also - [Authorization Best Practices](/docs/payments) - [Time Frames Reference](/docs/reference/time-frames) --- ## 4812 (Retired) - Account Number Not on File Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4812-account-not-on-file # Mastercard 4812 (Retired) - Account Number Not on File :::info[TL;DR] - 4812 is retired. It was consolidated into [4808](/docs/reference/reason-codes/mastercard/authorization) and survives only as a deprecated alias - While it ran, it meant the account number didn't exist at the issuer - Chargeback window was 90 calendar days from settlement, 120 for ATM and Maestro in Europe - Options were thin. An invalid account number is hard to argue with ::: :::warning[This code is retired - don't use it for new disputes] **4812 is no longer a chargeback reason code.** Mastercard consolidated the authorization-related codes into **4808** in its 2016 reason-code consolidation. In the current Mastercard Chargeback Guide, 4812 appears only as a deprecated sender-memo alias for 4808 - a label some systems still transmit, not a code anyone can file under. **Working a dispute today?** Use [4808 - Authorization-Related Chargeback](/docs/reference/reason-codes/mastercard/authorization), which now covers invalid and closed account numbers. **Seeing 4812 on a current notification?** Because it can still ride along as a deprecated alias, this one is genuinely ambiguous: it may be a real 4808 case wearing an old label, or it may be a processor or vendor working from stale material. Don't respond to it as a standalone 4812. Ask your processor for the message reason code on the case, confirm it's 4808, and build your response around the authorization record for the account number as it was actually submitted. ::: *Everything below describes how 4812 worked as a standalone code. It's preserved because old notifications, archived case files, and legacy vendor content still cite it, and the deprecated alias means the number still surfaces in real systems.* ## What 4812 Covered A transaction ran against an account number that was never valid, had been closed, or wasn't in the issuer's system at all. Typical triggers: - Account number was never valid - Account closed before the transaction - Card number doesn't exist in issuer records - Keyed number with digit errors - Test card number used in production ## Conditions for Valid Chargeback The issuer had to show three things. The account number wasn't on file. It wasn't valid at transaction time. The transaction got processed to it anyway. ### Common Scenarios | Scenario | Description | |----------|-------------| | Closed account | Card cancelled, account terminated | | Never issued | Number never assigned to cardholder | | Digit transposition | Keyed entry error | | Test card | Sandbox card used in production | ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days from settlement | | ATM/Maestro Europe | 120 calendar days | ## Representment Options Options were thin. An invalid account number is hard to argue with. ### 1. The Account Was Valid at Transaction Time **Evidence required:** - Authorization approval code - Proof the auth was obtained successfully - Account active at auth time ### 2. The Cardholder Used This Account **Evidence required:** - Cardholder correspondence - Prior transactions on the same account - Account matched cardholder identity ### 3. Processing Error on the Acquirer Side **Evidence required:** - Proof the account number was correct - Evidence the error happened in transmission - Processor confirmation ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | Account was valid (auth obtained) | 70-85% | | Processing error proven | 50-70% | | Account never valid | Under 10% | ## Where This Breaks Most of these came from keying. Someone typed the number wrong and nothing caught it. Luhn and BIN checks catch a lot of that before the transaction leaves your terminal. Read the number back to the customer as well. Better still, don't key at all. Dip the chip or tap. Timing caused the rest. The auth clears, the cardholder closes the account, and your capture lands days later on a dead number. Capture faster and that gap closes. The dumbest version is a sandbox card in production. Separate your environments and reject test BINs outright. ## Related Codes - [4808](/docs/reference/reason-codes/mastercard/authorization) - Authorization-Related (**the live code that absorbed 4812**) - [4807](/docs/reference/reason-codes/mastercard/warning-bulletin) - Warning Bulletin (also retired into 4808) - [4837](/docs/reference/reason-codes/mastercard/fraud) - No Cardholder Authorization ## See Also - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Fraud Prevention](/docs/fraud/prevention) - [Terminal Operations](/docs/operations/terminal-operations) --- ## 4834 - Point of Interaction Error Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4834-poi-error # Mastercard 4834 - Point of Interaction Error :::info[TL;DR] - Something went wrong at the point of interaction: a duplicate charge, a wrong amount, a processing error at the terminal or on your site - Chargeback window is 90 calendar days from the transaction, 120 for ATM and Maestro in Europe - You win by showing only one transaction exists, that the two were separate legitimate sales, or that you already refunded the duplicate - Most 4834s trace back to your own batching or terminal config. Fix the cause, not the case ::: Used for transaction processing errors that occurred at the point of interaction (terminal, website, or other acceptance device). ## When This Code Applies ### Duplicate Processing - Same transaction submitted twice - Multiple authorizations cleared once each - Technical error caused duplicate ### Incorrect Amount - Cleared amount differs from authorized amount (beyond tolerance) - Wrong currency conversion - Incorrect tip/gratuity added ### Incorrect Transaction Code - Debit processed as credit (or vice versa) - Wrong transaction type indicator - Incorrect MCC used ### Late Presentment - Transaction cleared beyond allowable time frame - Delayed batch submission ### Currency/Conversion Errors - Wrong Dynamic Currency Conversion (DCC) rate - Incorrect currency code - Conversion applied when not requested ## Error Subcategories ### 4834.1 - Duplicate Processing **Conditions:** - Two or more clearing records for same transaction - Same amount, same date, same merchant - Only one authorization obtained **Time frame:** 90 calendar days from duplicate transaction date ### 4834.2 - Incorrect Amount **Conditions:** - Cleared amount exceeds authorized amount - Beyond allowable tolerance (typically 20%) - No valid reason for difference **Tolerances:** | Transaction Type | Tolerance | |------------------|-----------| | US card-present | 20% | | US CNP restaurants | 30% | | All other | 20% | ### 4834.3 - Late Presentment **Conditions:** - Transaction cleared beyond protection period - No valid authorization at time of clearing - Exceeded network time frames **Protection periods:** | Transaction Type | Window | |------------------|--------| | Standard | 7 calendar days | | Preauthorization | 30 calendar days | | Car rental/hotel | 30 calendar days | ### 4834.4 - Incorrect Currency **Conditions:** - Transaction currency doesn't match authorization - DCC applied without cardholder consent - Wrong conversion rate used ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days from transaction | | Duplicate | 90 days from duplicate clearing | | Europe ATM/Maestro | 120 calendar days | ## Representment Options ### For Duplicate Processing **Valid defenses:** - Only one transaction exists (mistaken chargeback) - Two separate, legitimate transactions - Refund already issued for duplicate **Evidence required:** - Transaction receipts showing different transactions - Proof of refund - Authorization records showing separate auths ### For Incorrect Amount **Valid defenses:** - Amount is correct per authorization - Cardholder agreed to final amount - Gratuity was within tolerance - Additional authorized charges (addendum) **Evidence required:** - Signed receipt with final amount - Authorization showing correct amount - Cardholder agreement to charges ### For Late Presentment **Valid defenses:** - Transaction was presented on time - Valid authorization existed - Within protection period **Evidence required:** - Clearing date documentation - Authorization record with date - Batch submission records ### For Incorrect Currency **Valid defenses:** - Cardholder chose DCC - Currency was correct - Conversion was accurate **Evidence required:** - DCC disclosure signed by cardholder - Receipt showing currency choice - Exchange rate documentation ## Second Presentment Time Frames | Region | Window | |--------|--------| | Standard | 45 calendar days | | Costa Rica | 10 calendar days | | Kazakhstan | 30 calendar days | | Nigeria | **2 business days** | | Tanzania | 20 calendar days | ## Prevention Strategies ### Preventing Duplicates 1. **Batch reconciliation** - Review before submission 2. **Transaction IDs** - Unique identifiers per transaction 3. **Real-time monitoring** - Catch duplicates immediately 4. **Terminal configuration** - Prevent double-swipes 5. **Staff training** - One swipe per transaction ### Preventing Amount Errors 1. **Clear receipts** - Show amount before signature 2. **Tip entry process** - Verify before settling 3. **Authorization match** - Clear amount = auth amount 4. **Tolerance monitoring** - Alert on discrepancies ### Preventing Late Presentment 1. **Daily batch settlement** - Don't accumulate 2. **Authorization timing** - Track expiration 3. **Automated clearing** - Reduce manual delays 4. **Exception reporting** - Flag aged transactions ### Preventing Currency Errors 1. **DCC disclosure** - Clear cardholder choice 2. **Rate transparency** - Show conversion details 3. **Documentation** - Keep currency choice records 4. **Training** - Staff understand DCC rules ## Win Rate Expectations | Error Type | With Evidence | Without Evidence | |------------|---------------|------------------| | Duplicate (refund issued) | 80-95% | 20-40% | | Amount (receipt signed) | 60-80% | Under 20% | | Late presentment | 30-50% | Under 10% | | Currency (DCC consent) | 50-70% | Under 20% | ## Common Mistakes 1. **No batch reconciliation** - Duplicates slip through 2. **Manual tip entry errors** - Fat fingers 3. **Delayed settlements** - Batches sit too long 4. **No DCC documentation** - Can't prove consent 5. **Exceeding tolerances** - Not monitoring differences ## Related Codes - [4808](/docs/reference/reason-codes/mastercard/authorization) - Authorization-Related - [4853](/docs/reference/reason-codes/mastercard/cardholder-dispute) - Cardholder Dispute ## Next Steps **Got this chargeback?** 1. Identify the specific error โ†’ Duplicate? Wrong amount? Late presentment? 2. Pull transaction records โ†’ Compare auth vs. capture amounts 3. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 4. Respond within 45 days (Mastercard) **Prevent future 4834 chargebacks:** 1. Implement duplicate detection before settlement 2. Reconcile batches daily โ†’ Catch errors early 3. Train staff on tip adjustment procedures 4. [Check operations checklist](/docs/operations/checklist) --- ## See Also - [Authorization Best Practices](/docs/payments) - [Decline Codes](/docs/reference/decline-codes) --- ## 4837 - No Cardholder Authorization (Fraud) Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4837-fraud # Mastercard 4837 - No Cardholder Authorization :::info[TL;DR] - 4837 is Mastercard's **primary fraud chargeback code**. You'll see it more than any other. - The cardholder says they didn't authorize the charge and didn't take part in it. - Identity Check (3D Secure) is the strongest defense. It shifts liability to the issuer. - Without it you need AVS **X** or **Y** plus delivery to that address, or compelling evidence. - Filing window is **90 calendar days**. You get **45 calendar days** to second-present. ::: The cardholder told their bank they didn't make this purchase. ## Overview You aren't arguing about whether the charge happened. You're arguing about who made it. Your evidence has to name a person, not a transaction. Identity Check does that best. The rest of this page is what you do without it. ## When This Code Applies - Cardholder denies authorizing the transaction - Card was lost, stolen, or never received - Account takeover occurred - Counterfeit card was used - Card-not-present fraud ## Transactions Ineligible for This Chargeback - Transaction occurred more than 120 days before chargeback (90 days standard) - Properly authenticated transaction with liability shift - Transaction already charged back under a different reason code - PAN doesn't match - Transaction was properly flagged as recurring with valid initial consent ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days from Central Site Business Date | | Mainland China domestic | 5-90 calendar days from settlement | | ATM/Maestro (Europe) | 120 calendar days | ## Representment Options ### 1. Addendum Charges You disclosed the extra charges up front and the cardholder took part. **Requirements:** - Original transaction was undisputed - Addendum charges were disclosed at time of original transaction - Cardholder signed or otherwise agreed to terms ### 2. Address Verification Service (AVS) **Requirements:** - AVS response was **X** or **Y** - Goods shipped to AVS-confirmed address - NOT available for Maestro or Mainland China transactions **Documentation needed:** - Proof of AVS response X or Y - Proof merchandise sent to AVS-confirmed address - Shipping carrier confirmation ### 3. Authenticated Transaction The transaction went through 3D Secure/Identity Check. **Message text for DE 72:** - `AUTH MMDDYY/NNNNNN SL 1` for SLI value 1 (first-party authentication) - `AUTH MMDDYY/NNNNNN SL 2` for SLI value 2 (delegated authentication) ### 4. Compelling Evidence (E-commerce/MO/TO) Provide **AT LEAST ONE** of: | Evidence Type | Description | |--------------|-------------| | Signed receipt | Receipt or work order signed by cardholder | | Delivery confirmation | Written confirmation of electronic delivery registration | | Correspondence | Email, SMS, or chat with cardholder about the transaction | | Pickup statement | Merchant statement documenting in-store pickup location | | Partial shipment | For partial shipments: initial transaction auth details | **Message text:** Include `COMP EVID` in DE 72 ### 5. Compelling Evidence (Registered Account) You require an account before purchase. Provide: | Evidence Type | Required | |--------------|----------| | Undisputed purchases | Other transactions from same registered account | | Device/IP match | Transaction from registered device/IP address | | Purchase details | Full order information | | Delivery proof | Signed proof of delivery | | Digital delivery | Email addresses for digital goods | | Product registration | Disputed goods registered for warranty/updates | | Usage proof | Evidence disputed goods were used | | Identity Check | Fully enabled Identity Check used for PAN registration | :::warning[Guest Checkout] This defense does **NOT** apply to guest checkout purchases. ::: ### 6. Compelling Evidence (Airlines) Provide **AT LEAST ONE** of: | Evidence Type | Description | |--------------|-------------| | Boarding documents | Flight ticket or boarding pass with passenger name | | Manifest | Flight manifest/itinerary with passenger name | | Connected charges | Upgrades, baggage, in-flight purchases | | ID linkage | Passenger ID linked to cardholder | | Loyalty credits | Frequent flyer miles credited | | Ticket delivery | Proof of ticket receipt (signed delivery, email) | ### 7. Compelling Evidence (Recurring/Installments) Provide **ALL** of: 1. Description of goods/services provided 2. Start date with: - Original transaction authorization date - Authorization approval code - CIT value (if present) 3. Proof transaction was properly flagged as recurring in both authorization and clearing ### 8. Gaming Payment Transactions The cardholder got paid out after the funding transaction they're disputing. **Documentation required (per gaming payment):** - Date of each Gaming Payment Transaction - Switch Serial Number or ARN - Transaction amount ### 9. Guaranteed Reservation ("No-Show") For hotel no-show charges, you need all of: - Proper disclosure of the cancellation policy - Cardholder didn't cancel inside the policy window - The reservation went unused ### 10. Refund Previously Issued You already refunded it. **Documentation:** - Proof of refund with date - Refund ARN or transaction ID - Amount refunded ### 11. Invalid Chargeback Sometimes the chargeback itself is bad. Check these first: | Reason | Description | |--------|-------------| | Account takeover | Merchant can prove ATO vs. card fraud | | Counter exceeded | Fraud chargeback counter exceeds threshold | | Prior fraud CBs | Two or more previous fraud chargebacks on account | | No fraud report | Not reported to Fraud and Loss Database | | Contactless | Contactless transaction at unattended terminal | | PIN verified | PIN transaction | | Invalid filing | Chargeback doesn't meet requirements | | Time frame | Past allowable filing window | | Duplicate | Same transaction already charged back | | PAN mismatch | PAN/ARN don't match dispute | | Documentation | Supporting docs not received, illegible, or incomplete | | Message text | Invalid or missing message text | ## Second Presentment Time Frames | Region | Window | |--------|--------| | Standard | 45 calendar days | | Costa Rica | 10 calendar days | | Kazakhstan | 30 calendar days | | Mainland China | 30 calendar days | | Nigeria | **2 business days** | | Tanzania | 20 calendar days | ## Pre-Arbitration ### When Issuer Can File Pre-Arbitration After receiving second presentment: - Chargeback was valid - AVS evidence invalid or goods not shipped to confirmed address - Transaction wasn't authenticated - Compelling evidence insufficient - Gaming payment evidence insufficient - Refund wasn't issued ### Issuer Must Provide **For AVS disputes:** - Denial that positive AVS was given, OR - Denial merchandise sent to AVS address, OR - Cardholder continues to dispute + confirmation address belonged to cardholder **For Compelling Evidence disputes:** - An explanation of why your evidence isn't compelling, OR - A new cardholder statement (letter, email, Form 0412) dated after second presentment ### Pre-Arbitration Time Frames | Region | Window | |--------|--------| | Standard | 30 calendar days from second presentment | | Costa Rica | 10 calendar days | | Tanzania | 10 calendar days | ### Documentation Waiting Periods Before filing pre-arbitration, issuer must wait: - **ATM/Maestro**: 10 calendar days for documentation - **All other**: 8 calendar days for documentation ## Arbitration If pre-arbitration doesn't settle it: - File within 75 calendar days. The clock runs from second presentment on ATM/Maestro, from the pre-arbitration response on everything else - Non-English documents need a translation - Mastercard rules, and the ruling is final - Filing fee is $500. The winner gets it back ## Prevention Strategies ### For E-commerce 1. **Turn on 3D Secure** - Shifts liability to the issuer 2. **Run AVS and CVV** - Store the results 3. **Require an account** - Unlocks the compelling evidence defense 4. **Send order confirmations** - To verified email addresses 5. **Use delivery confirmation** - Signature where you can 6. **Keep logs** - Device fingerprints, IPs, session data ### For Recurring/Subscriptions 1. **Get consent in writing** - With the terms attached 2. **Remind before billing** - 7 days minimum 3. **Make cancelling easy** - Same channel as signup 4. **Flag it as recurring** - In auth and in clearing 5. **Keep the original auth details** - For compelling evidence ### For High-Risk Transactions 1. **Score before you authorize** - Pre-transaction screening 2. **Run velocity checks** - Multiple orders, same parameters 3. **Watch first orders** - New accounts get more scrutiny 4. **Flag address mismatches** - Billing vs shipping ## Win Rate Expectations These aren't promises. They're what each kind of evidence tends to be worth. | Defense Type | Expected Win Rate | |--------------|------------------| | 3D Secure authenticated | 60-80% | | AVS match + delivery proof | 40-60% | | Compelling evidence (strong) | 30-50% | | Compelling evidence (weak) | 15-30% | | No evidence | Under 10% | ## Related Codes - [4863](/docs/reference/reason-codes/mastercard/recognition) - Cardholder Does Not Recognize (**retired into 4837**) - [4870](/docs/reference/reason-codes/mastercard/chip-liability) - Chip Liability Shift - [4871](/docs/reference/reason-codes/mastercard/chip-lost-stolen) - Chip Lost/Stolen/NRI ## Next Steps **Got this chargeback?** 1. Check if Identity Check (3DS) was used โ†’ Liability may have shifted 2. Check for prior undisputed transactions โ†’ Compelling evidence defense 3. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 4. Respond within 45 days (Mastercard) **Prevent future 4837 chargebacks:** 1. [Implement 3D Secure](/docs/playbooks/first-time-3ds-setup) for liability shift 2. [Configure velocity rules](/docs/fraud/detection/velocity-rules) to catch fraud patterns 3. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to refund before chargeback --- ## See Also - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [3D Secure Authentication](/docs/fraud/prevention/3ds) - Identity Check - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse - [Third-Party Fraud](/docs/fraud/types/third-party) - True fraud patterns - [Account Takeover](/docs/fraud/types/account-takeover) - ATO defense - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Proving involvement - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address verification - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Fraud detection - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Pre-transaction screening - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Ethoca for MC - [ECP Thresholds](/docs/chargebacks/monitoring/thresholds) - Program limits - [Fraud vs. Friendly](/docs/chargebacks/fraud-vs-friendly) - Classification --- ## 4853 - Cardholder Dispute Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4853-cardholder-dispute # Mastercard 4853 - Cardholder Dispute :::info[TL;DR] - Mastercard's catch-all consumer dispute code. Non-receipt, quality complaints, billing disputes, cancelled recurring, all of it - Chargeback window is 90 calendar days from the transaction or from expected delivery - Your evidence depends entirely on which sub-claim the issuer filed. Read the notification before you build the packet - Several older codes were folded into this one, so it now carries most consumer disputes ::: A catch-all dispute code covering multiple cardholder complaint scenarios including non-receipt, quality issues, and billing disputes. ## Dispute Categories Under 4853 ### Category 1: Goods or Services Not as Described The cardholder received goods/services that differ materially from what was described. **Common scenarios:** - Product quality doesn't match description - Wrong item shipped - Services not performed as agreed - Digital goods don't function as advertised ### Category 2: Goods or Services Not Received Cardholder did not receive the merchandise or services purchased. **Common scenarios:** - Physical goods never delivered - Digital goods not accessible - Services not performed - Partial delivery (missing items) ### Category 3: Credit Not Processed Merchant agreed to issue a refund but cardholder hasn't received it. **Common scenarios:** - Return accepted, no credit issued - Cancellation processed, no refund - Merchant promised refund, didn't process ### Category 4: Cancelled Recurring Transaction Cardholder cancelled recurring billing but continues to be charged. **Common scenarios:** - Subscription cancellation ignored - Trial period ended, charges began - Cancellation confirmation received but still billed ### Category 5: Digital Goods Issues specific to digital goods and services. **Common scenarios:** - Download link expired or invalid - Software key doesn't work - Streaming service not accessible - In-app purchase not delivered ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days from transaction or expected delivery | | Non-receipt | 90 days from expected delivery date | | Digital goods | 90 days from transaction date | | Recurring | 90 days from each disputed transaction | ## Cardholder Requirements Before filing, cardholder must: 1. **Attempt resolution with merchant** - Contact merchant first 2. **Allow reasonable time** - Wait for merchant response 3. **Document attempts** - Keep records of communications 4. **Wait for expected delivery** - For non-receipt claims ## Merchant Response Options ### For Not As Described **Representment available when:** - Goods/services matched description - Cardholder was provided accurate information - Terms and conditions were accepted - Cardholder used the goods/services **Evidence required:** - Product description/listing as shown to cardholder - Terms and conditions accepted - Proof of cardholder usage - Communications about the product ### For Not Received **Representment available when:** - Delivery confirmed to correct address - Cardholder signed for delivery - Tracking shows delivered - Digital goods were accessed **Evidence required:** - Proof of delivery with signature - Tracking confirmation - Access logs for digital goods - Delivery carrier confirmation ### For Credit Not Processed **Representment available when:** - Credit was issued before chargeback - Credit will appear on future statement - No refund was due per terms **Evidence required:** - Proof of credit with date - Credit transaction details - Terms showing refund not applicable ### For Cancelled Recurring **Representment available when:** - Cancellation was not received - Transaction was final authorized charge - Terms allow charge after cancellation request **Evidence required:** - Cancellation policy - Proof cancellation not received - Transaction occurred before cancellation - Terms accepted by cardholder ## Second Presentment Requirements ### Message Text (DE 72) | Defense | Message Text | |---------|--------------| | Goods as described | `GOODS AS DESC` | | Services as described | `SERV AS DESC` | | Delivered | `DELIVERED MMDDYY` | | Credit issued | `CREDIT ISSUED MMDDYY` | | No cancellation received | `NO CANCEL RCVD` | ### Documentation Standards - Must be legible - Must be relevant to specific dispute - Must be submitted within time frame - Translation required for non-English documents ## Second Presentment Time Frames | Region | Window | |--------|--------| | Standard | 45 calendar days | | Costa Rica domestic | 10 calendar days | | Kazakhstan domestic | 30 calendar days | | Nigeria domestic | **2 business days** | | Tanzania domestic | 20 calendar days | ## Pre-Arbitration ### When Issuer Can File - Second presentment evidence insufficient - Cardholder provides additional information - Documentation doesn't address dispute ### Time Frames | Region | Window | |--------|--------| | Standard | 30 calendar days | | Costa Rica domestic | 10 calendar days | | Tanzania domestic | 10 calendar days | ## Prevention Strategies ### For Non-Receipt Claims 1. **Use tracking on all shipments** - Carrier confirmation 2. **Require signature for high-value** - Proof of receipt 3. **Send shipping notifications** - Email with tracking 4. **Insure valuable shipments** - Carrier liability 5. **Photograph packaging** - Evidence of condition ### For Quality Disputes 1. **Accurate descriptions** - No exaggeration 2. **Quality photos/videos** - Show actual product 3. **Clear specifications** - Size, color, materials 4. **Manage expectations** - Realistic delivery times 5. **Quality control** - Inspect before shipping ### For Credit Not Processed 1. **Process refunds promptly** - Within 3-5 days 2. **Send confirmation** - Email with details 3. **Provide timeline** - When credit will appear 4. **Keep records** - Refund transaction IDs ### For Recurring Cancellations 1. **Easy cancellation process** - Same channel as signup 2. **Confirmation emails** - Document cancellation 3. **Honor requests immediately** - Don't charge after 4. **Send reminders** - Before renewal charges 5. **Clear terms** - Cancellation policy visible ## Win Rate Expectations | Dispute Type | With Evidence | Without Evidence | |--------------|---------------|------------------| | Not received | 60-80% | Under 20% | | Not as described | 30-50% | Under 10% | | Credit not processed | 70-90% | Under 20% | | Cancelled recurring | 40-60% | Under 15% | ## Common Mistakes 1. **No delivery confirmation** - Can't prove delivery without tracking 2. **Vague descriptions** - Product listing doesn't match 3. **Slow refunds** - Cardholder files CB before credit posts 4. **Poor cancellation process** - Hard to cancel = chargebacks 5. **No communication records** - Can't prove customer interaction ## Related Codes - 4855 - Goods or Services Not Provided - 4854 - US Region Disputes ## Next Steps **Got this chargeback?** 1. Identify the dispute category โ†’ Not received? Not as described? Cancelled recurring? 2. Pull relevant evidence โ†’ Delivery proof, product descriptions, cancellation records 3. Follow the [Representment Workflow](/docs/operations/representment-workflow) 4. Respond within 45 days (Mastercard) **Prevent future 4853 chargebacks:** 1. Use tracking on all shipments with delivery confirmation 2. Ensure product descriptions match what you ship 3. Process refunds promptly (within 3-5 days) 4. Make cancellation easy โ†’ [Subscription compliance](/docs/compliance/subscriptions/recurring-billing) --- ## See Also - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Recurring Billing Requirements](/docs/compliance/subscriptions/recurring-billing) - Subscription rules - [Refund Fraud](/docs/fraud/types/refund-fraud) - Return abuse patterns - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes - [Visa 13.1](/docs/reference/reason-codes/visa/13-1-not-received) - Visa equivalent (non-receipt) - [Visa 13.2](/docs/reference/reason-codes/visa/13-2-cancelled-recurring) - Visa equivalent (recurring) - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Ethoca for MC - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Customer clarity - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Billing fundamentals --- ## 4854 - Cardholder Dispute (US Region) Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4854-us-cardholder-dispute # Mastercard 4854 - Cardholder Dispute (US Region) :::info[TL;DR] - The US domestic version of the catch-all consumer dispute code - It covers non-receipt, not-as-described, credit not processed, duplicates and other billing disputes on US transactions - Chargeback window is 90 calendar days from the transaction, or 90 from expected or actual delivery. You get 45 calendar days to second present - Match your evidence to the specific claim. A generic packet loses ::: US domestic catch-all dispute code covering various cardholder claims including goods/services issues, billing errors, and other disputes for transactions within the United States. ## When This Code Applies - US domestic transactions only - Goods or services not received - Goods not as described or defective - Credit not processed - Duplicate processing - Other billing disputes ## Sub-Reason Codes Mastercard 4854 uses sub-reason codes to specify the dispute type: | Sub-Code | Description | |----------|-------------| | 4854.1 | Goods/services not received | | 4854.2 | Goods/services not as described | | 4854.3 | Credit not processed | | 4854.4 | Duplicate processing | | 4854.5 | Recurring billing dispute | ## Conditions for Valid Chargeback ### Cardholder Must 1. Have a valid dispute reason 2. Attempt resolution with merchant (typically) 3. File within timeframe 4. Be within US jurisdiction ### Transaction Must Be - US domestic (US issuer, US acquirer) - Covered by one of the sub-reason categories ## Time Frames | Stage | Window | |-------|--------| | Chargeback | 90 calendar days from transaction | | From delivery | 90 days from expected/actual delivery | | Second Presentment | 45 calendar days | ## Representment Options by Sub-Code ### 4854.1 - Not Received **Evidence required:** - Proof of delivery - Tracking confirmation - Signature if applicable - Digital delivery logs ### 4854.2 - Not as Described **Evidence required:** - Product listing/description - Photos of actual product - Terms and conditions - Cardholder correspondence ### 4854.3 - Credit Not Processed **Evidence required:** - Refund transaction record - ARN (Acquirer Reference Number) - Settlement confirmation - Timing of credit ### 4854.4 - Duplicate Processing **Evidence required:** - Transaction records showing single charge - Different transaction IDs - Separate purchases - Itemized receipts ### 4854.5 - Recurring Billing **Evidence required:** - Subscription terms - Cancellation policy - No cancellation request received - Renewal reminders sent ## Prevention Strategies ### For Goods Not Received 1. **Trackable shipping** - Always use tracking 2. **Delivery confirmation** - Signature for high-value 3. **Status updates** - Keep customer informed 4. **Clear timelines** - Set delivery expectations ### For Quality Disputes 1. **Accurate descriptions** - Match reality 2. **Quality photos** - Show actual product 3. **Clear return policy** - Easy to find 4. **Customer service** - Resolve before dispute ### For Credit Issues 1. **Process promptly** - Within 3-5 days 2. **Send confirmation** - Email with ARN 3. **Match card** - Credit to same card 4. **Track refunds** - Log all credits ### For Recurring 1. **Clear terms** - Upfront disclosure 2. **Reminder emails** - Before each charge 3. **Easy cancellation** - Simple process 4. **Confirmation** - Acknowledge cancellation ## Win Rate Expectations | Sub-Code | Expected Win Rate | |----------|------------------| | Not received (with delivery proof) | 65-80% | | Not as described (accurate listing) | 50-70% | | Credit issued (with proof) | 85-95% | | Duplicate (separate transactions) | 70-85% | | Recurring (terms + no cancel) | 55-70% | ## Common Mistakes 1. **No delivery tracking** - Can't prove receipt 2. **Inaccurate listings** - Sets up quality disputes 3. **Slow refunds** - Customer files before credit 4. **Hidden recurring terms** - Creates subscription disputes ## Difference from 4853 | 4853 | 4854 | |------|------| | International | US domestic only | | Multiple regions | US-specific rules | | Global time frames | US time frames | ## Related Codes - [4853](./4853-cardholder-dispute.md) - Cardholder Dispute (International) - 4855 - Goods or Services Not Provided - [4837](./4837-fraud.md) - No Cardholder Authorization ## See Also - [Winning Evidence](/docs/chargebacks/representment/compelling-evidence) - [Refund Policy](/docs/chargebacks/refund-policy) - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) --- ## 4855 (Retired) - Goods or Services Not Provided Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4855-goods-not-provided # Mastercard 4855 (Retired) - Goods or Services Not Provided :::info[TL;DR] - 4855 is retired. It was consolidated into [4853](/docs/reference/reason-codes/mastercard/cardholder-dispute) - While it ran, it was Mastercard's main non-delivery code: goods never arrived, service never performed, partial delivery, cancelled event - Chargeback window was 90 calendar days from the transaction or from expected delivery, with 45 days to second present - You won it with delivery tracking, carrier confirmation, and a signature where one applied ::: :::warning[This code is retired - don't use it for new disputes] **4855 no longer exists.** Mastercard folded the separate non-delivery codes into **4853 (Cardholder Dispute)** in its 2016 reason-code consolidation. 4855 doesn't appear anywhere in the current Mastercard Chargeback Guide. **Working a dispute today?** Use [4853 - Cardholder Dispute](/docs/reference/reason-codes/mastercard/cardholder-dispute), which is where non-delivery claims now land. **Seeing 4855 on a current notification?** The code is dead, so the label is coming from stale material: an old processor template, a legacy internal system, or out-of-date vendor documentation. Ask your processor for the actual message reason code on the case (it will almost certainly be 4853) and work it from there. The good news is that the evidence you need is unchanged - proof of delivery, or proof the service was performed. ::: *Everything below describes how 4855 worked while it was live. It's preserved because old notifications, archived case files, and legacy vendor content still cite the code, and someone reading one of those still needs to know what it meant.* ## Overview Cardholder claimed they didn't receive the merchandise or services they paid for. While it was live, this was Mastercard's primary consumer dispute code for non-delivery claims. That role now belongs to [4853](/docs/reference/reason-codes/mastercard/cardholder-dispute). ## When This Code Applies - Goods never arrived - The service was never performed - Partial delivery (missing items) - Event cancelled, no refund - Digital goods not accessible ## Conditions for Valid Chargeback ### Cardholder Must 1. Have paid for goods/services 2. Not received what was purchased 3. Attempted to resolve with merchant 4. File within timeframe ### Merchant Responsibilities - Deliver goods/services as agreed - Provide tracking for physical goods - Ensure digital access is functional - Communicate delays ## Time Frames | Stage | Window | |-------|--------| | Chargeback | 90 calendar days from transaction | | From expected delivery | 90 days from expected delivery date | | Second Presentment | 45 calendar days | ## Representment Options ### 1. Goods/Services Were Delivered **Evidence required:** - Delivery tracking number - Carrier confirmation of delivery - Signature (if applicable) - Photo proof of delivery - GPS/timestamp confirmation ### 2. Digital Goods Were Accessed **Evidence required:** - Download logs - Access/login records - Usage data - IP address at access time - Email delivery confirmation ### 3. Services Were Rendered **Evidence required:** - Service completion records - Cardholder signature on completion - Photos/documentation of work - Time logs with cardholder approval - Communication confirming completion ### 4. Cardholder Picked Up **Evidence required:** - In-store pickup records - ID verification at pickup - Signature on pickup receipt - Video footage (if available) ### 5. Refund Already Issued **Evidence required:** - Refund transaction record - ARN number - Settlement confirmation ## Prevention Strategies ### Physical Goods 1. **Trackable shipping** - All shipments tracked 2. **Signature required** - For high-value items 3. **Photo on delivery** - Carrier photos 4. **Shipping insurance** - For valuable items 5. **Status updates** - Proactive communication ### Digital Goods 1. **Immediate delivery** - Download links on payment 2. **Delivery confirmation** - Email with access info 3. **Access logging** - Track downloads/logins 4. **Multiple access methods** - Email + account 5. **Technical support** - Help with access issues ### Services 1. **Completion acknowledgment** - Get sign-off 2. **Progress updates** - Document work done 3. **Photos/documentation** - Before and after 4. **Clear scope** - Define what's included 5. **Partial completion records** - Track milestones ### Communication 1. **Order confirmation** - Immediate email 2. **Shipping notification** - When dispatched 3. **Delivery confirmation** - When delivered 4. **Delay notification** - If issues arise 5. **Contact info** - Easy to reach support ## Win Rate Expectations | Evidence Type | Expected Win Rate | |---------------|------------------| | Carrier delivery + signature | 75-90% | | Carrier delivery (no signature) | 60-75% | | Digital access logs | 55-70% | | Service completion signed | 65-80% | | No delivery proof | Under 20% | ## Common Mistakes 1. **No tracking** - Can't prove shipment 2. **No signature** - Especially for high-value 3. **No digital access logs** - Can't prove download 4. **No service sign-off** - No completion proof 5. **Poor communication** - Customer didn't know status ## Special Cases ### Delayed Delivery - Communicate proactively - Offer alternatives - Set new expectations - Consider partial refund ### Partial Delivery - Document what was delivered - Ship missing items ASAP - Partial credit if needed - Keep communication open ### Cancelled Events/Services - Prompt refund processing - Clear cancellation notice - Alternative offerings - Documentation of cancellation ### International Shipping - Longer timelines expected - Customs documentation - Tracking that survives the border - Insurance recommended ## Related Codes - [4853](/docs/reference/reason-codes/mastercard/cardholder-dispute) - Cardholder Dispute (**the live replacement for 4855**) - [4854](/docs/reference/reason-codes/mastercard/us-cardholder-dispute) - Cardholder Dispute, US Region - [4837](/docs/reference/reason-codes/mastercard/fraud) - No Cardholder Authorization ## Next Steps **Holding a notification that cites 4855?** 1. Confirm the real code โ†’ Ask your processor for the message reason code on the case; expect [4853](/docs/reference/reason-codes/mastercard/cardholder-dispute) 2. Pull delivery proof โ†’ Tracking, signature, carrier confirmation 3. Check for digital access โ†’ Download/login logs 4. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 5. Respond within the deadline on the notice (45 days under current Mastercard rules) **Prevent future non-delivery chargebacks (now filed as 4853):** 1. Use tracking on all physical shipments 2. Require signature for high-value orders 3. Log all digital good access/downloads 4. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to catch early --- ## See Also - [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) - [Representment Workflow](/docs/operations/representment-workflow) - [Digital Goods Evidence](/docs/chargebacks/digital-goods-evidence) --- ## 4863 (Retired) - Cardholder Does Not Recognize Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4863-recognition # Mastercard 4863 (Retired) - Cardholder Does Not Recognize :::info[TL;DR] - 4863 is retired. It was consolidated into [4837](/docs/reference/reason-codes/mastercard/fraud), No Cardholder Authorization - While it ran, it meant the cardholder didn't recognize the charge but stopped short of calling it fraud. Usually a confusing billing descriptor - Chargeback window was 90 calendar days, 120 for ATM and Maestro in Europe - The descriptor advice below still matters. Bad descriptors now generate 4837s instead, and those are much harder to win ::: :::warning[This code is retired - don't use it for new disputes] **4863 no longer exists.** Mastercard retired it in the 2016 reason-code consolidation. It appears nowhere in the current Mastercard Chargeback Guide. **Where these claims go now.** A cardholder who says "I didn't do this" gets [4837 - No Cardholder Authorization](/docs/reference/reason-codes/mastercard/fraud). One who recognizes the charge but disputes what they got gets [4853 - Cardholder Dispute](/docs/reference/reason-codes/mastercard/cardholder-dispute). There's no middle category any more for "I don't recognize this." **Seeing 4863 on a current notification?** The code is dead, so the label is coming from stale material. An old processor template, a legacy internal system, out-of-date vendor documentation. Ask your processor for the actual message reason code. Then work it as a 4837 fraud response, because that's almost certainly what you're facing. Don't assume the softer, non-fraud handling this code used to imply. ::: *Everything below describes how 4863 worked while it was live. It stays here because old notifications, archived case files and legacy vendor content still cite the code. The descriptor advice is still worth reading, because bad descriptors now generate 4837s instead.* ## Overview The cardholder said they didn't recognize the transaction. But they stopped short of an outright fraud claim. It was often a precursor to one, or a sign of a confusing billing descriptor. ## When This Code Applies - Cardholder doesn't recognize the merchant name. - Cardholder doesn't recall making the purchase. - The transaction looks unfamiliar on the statement, or the billing descriptor confused them. ## Key Distinction from 4837 | Code | Cardholder Statement | Implication | |------|---------------------|-------------| | 4863 | "I don't recognize this" | Confusion, not fraud | | 4837 | "I didn't do this" | Fraud claim | :::tip[Still relevant] 4863 usually fired when a poor merchant descriptor confused the cardholder, and that cause outlived the code. Those cardholders now file 4837 fraud claims, which are harder to fight. Fixing your descriptor is still the cheapest chargeback reduction going. ::: ## Common Causes ### Descriptor Issues - The business name differs from the storefront name. - The parent company name shows instead of the brand. - Names abbreviated, truncated, or a generic processor name. ### Legitimate Confusion - They forgot about the purchase, or a family member made it. - A subscription renewed, or a delivery charged late. ### Precursor to Fraud - Testing the water before a full fraud claim. - Genuine fraud they're unsure about, or an account takeover. ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days | | Europe ATM/Maestro | 120 calendar days | ## Representment Options ### 1. Transaction Recognized After Inquiry Merchant details sometimes jog the memory: - A clear description of the goods or services. - Order confirmation details, and the shipping information. ### 2. Proper Merchant Descriptor The descriptor clearly identifies the business: - The DBA name matches the advertising. - Location where it helps, and a phone number on the descriptor. ### 3. Compelling Evidence Same evidence types as 4837: - Delivery confirmation, customer correspondence, an AVS match, prior purchase history. ### 4. Recurring Transaction The transaction is part of an established pattern: - Previous undisputed charges on the card. - A subscription agreement and regular billing history. ## Message Text Requirements | Defense | Message Text | |---------|--------------| | Descriptor match | `DESC MATCH` | | Prior transactions | `PRIOR TXN` | | Recurring billing | `RECURRING` | | Compelling evidence | `COMP EVID` | ## Second Presentment Time Frames | Region | Window | |--------|--------| | Standard | 45 calendar days | | Costa Rica | 10 calendar days | | Kazakhstan | 30 calendar days | | Nigeria | **2 business days** | | Tanzania | 20 calendar days | ## Prevention Strategies ### Fix Your Descriptor **Before:** - `PAYCO*12345 800-555-1234` - `GLOBAL MERCHANT SVC` - `UNKNOWN MERCHANT` **After:** - `BRANDNAME.COM 800-555-1234` - `BRANDNAME*PRODUCT TYPE` - `BRANDNAME CITY ST` ### Best Practices for Descriptors 1. **Use recognizable name** - Brand name customers know 2. **Include phone number** - Easy to call before disputing 3. **Be consistent** - Same name across all touchpoints 4. **Include location** - City/state for brick-and-mortar 5. **Match advertising** - Same name in marketing ### Communication 1. **Clear receipts** - Show exact descriptor 2. **Order confirmations** - Preview statement appearance 3. **Shipping notices** - Link to original purchase 4. **Account statements** - Self-service history ### For Recurring/Subscriptions 1. **Pre-billing reminders** - "You'll be charged..." 2. **Consistent timing** - Same day each cycle 3. **Clear descriptor** - Include "SUBSCRIPTION" or "MONTHLY" 4. **Easy lookup** - Customer portal for history ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | Clear descriptor + delivery proof | 60-80% | | Prior undisputed transactions | 50-70% | | Customer acknowledged purchase | 80-90% | | No evidence | 20-35% | ## Escalation Path While 4863 was live, an unresolved case could escalate into a 4837 fraud chargeback. The consolidation removed the first step, so these claims now start at 4837. ```mermaid flowchart LR A[4863 Filed] --> B[Merchant Response] B --> C{Cardholder decision?} C -->|Accepts| D[Case Closed] C -->|Rejects| E[Escalates to 4837Fraud] style A fill:#8b5cf6,color:#fff style D fill:#10b981,color:#fff style E fill:#ef4444,color:#fff ``` ## Related Codes - [4837](/docs/reference/reason-codes/mastercard/fraud) - No Cardholder Authorization (**where non-recognition fraud claims land now**) - [4853](/docs/reference/reason-codes/mastercard/cardholder-dispute) - Cardholder Dispute ## See Also - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - [Reduce Chargebacks Playbook](/docs/playbooks/reduce-chargebacks-fast) --- ## 4870 - Chip Liability Shift Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4870-chip-liability # Mastercard 4870 - Chip Liability Shift :::info[TL;DR] - A counterfeit chip card ran and the chip never got read. The loss lands on whoever skipped EMV. - Chip read plus a verified PIN wins this outright. Expect 85-95%. - Two logged chip attempts before any swipe fallback. That's the line between a defense and a loss. - Chargeback window: 90 calendar days from settlement. You get 45 days to respond. - Keep your fallback rate under 5%. Above that, a terminal is broken. ::: A counterfeit EMV chip card ran at a terminal that didn't process the chip properly. Liability shifts to your acquirer, and your acquirer passes it to you. ## When This Code Applies - Counterfeit chip card transaction - Terminal didn't process chip (fallback to swipe) - Chip malfunction with improper fallback handling - Terminal not EMV-capable when chip card presented ## Liability Shift Rules ### Liability Shifts TO Merchant When: | Scenario | Liability | |----------|-----------| | Chip card + non-chip terminal | Merchant | | Chip card + fallback to swipe (improper) | Merchant | | Chip card + manual entry | Merchant | | Chip malfunction + no chip attempt | Merchant | ### Liability Stays WITH Issuer When: | Scenario | Liability | |----------|-----------| | Chip card + chip read + PIN verified | Issuer | | Chip malfunction + multiple chip attempts | Issuer | | Non-chip card at any terminal | Issuer | | Online PIN verified | Issuer | ## Chip Fallback Requirements When the chip won't read, you must: 1. **Attempt chip read at least twice** - Document attempts 2. **Use fallback only after failed attempts** - It isn't your first move 3. **Indicate fallback in authorization** - Proper coding 4. **Document the technical issue** - Terminal logs ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days from settlement | | Europe ATM/Maestro | 120 calendar days | ## Representment Options ### Valid Defenses 1. **Chip was properly read** - Transaction was EMV chip-read 2. **PIN verified online** - Cardholder entered correct PIN 3. **Technical fallback documented** - Proper chip failure handling 4. **Non-chip card** - Card didn't have chip capability 5. **Refund issued** - Transaction already credited ### Evidence Required | Defense | Documentation | |---------|---------------| | Chip read | EMV cryptogram, chip data in auth | | PIN verified | PIN verification indicator | | Fallback | Terminal logs showing chip attempts | | Non-chip card | Card verification showing no chip | ## Message Text Requirements When representing, include appropriate text in DE 72: | Defense | Message Text | |---------|--------------| | Chip read | `CHIP READ` | | PIN verified | `PIN VERIFIED` | | Proper fallback | `TECH FALLBACK` | ## Second Presentment Time Frames | Region | Window | |--------|--------| | Standard | 45 calendar days | | Costa Rica | 10 calendar days | | Kazakhstan | 30 calendar days | | Nigeria | **2 business days** | | Tanzania | 20 calendar days | ## Technical Requirements ### EMV Data Elements Authorization must include: - DE 55: EMV chip data - DE 22: POS entry mode (chip read indicator) - DE 23: Card sequence number (if applicable) ### Terminal Requirements - Certified EMV terminal - Current chip key certifications - Proper fallback configuration - Transaction logging enabled ## Prevention Strategies ### Terminal Management 1. **Ensure EMV certification** - All terminals certified 2. **Regular maintenance** - Keep chip readers clean and functional 3. **Software updates** - Current terminal software 4. **Staff training** - Proper chip card handling ### Transaction Processing 1. **Always attempt chip** - Never skip to swipe 2. **Document failures** - Log chip read errors 3. **Follow fallback procedures** - As defined by network 4. **Review exception reports** - Monitor fallback rates ### Monitoring 1. **Track fallback rate** - Should be under 5% 2. **Terminal health checks** - Regular testing 3. **Alert on anomalies** - Fallbacks shouldn't spike overnight 4. **Root cause analysis** - Investigate chip failures ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | Chip + PIN verified | 85-95% | | Documented fallback | 40-60% | | No chip read, no fallback documentation | Under 10% | ## Related Codes - [4871](/docs/reference/reason-codes/mastercard/chip-lost-stolen) - Chip Lost/Stolen/NRI - [4837](/docs/reference/reason-codes/mastercard/fraud) - No Cardholder Authorization ## See Also - [EMV Implementation](/docs/payments) - [Fraud Prevention](/docs/fraud/prevention) --- ## 4871 - Chip/PIN Lost/Stolen/NRI Source: https://paymentsandrisk.com/docs/reference/reason-codes/mastercard/4871-chip-lost-stolen # Mastercard 4871 - Chip/PIN Lost/Stolen/NRI Fraud :::info[TL;DR] - A lost, stolen or never-received chip card was used fraudulently, usually where PIN should have stopped it - Chargeback window is 90 calendar days, 120 for ATM and Maestro in Europe - You win by showing online PIN was verified, or that the transaction sat below the PIN threshold - If your terminal allowed a PIN bypass that wasn't permitted, you own the loss ::: Used when a legitimate chip card that was lost, stolen, or never received by the cardholder is used fraudulently, particularly when PIN should have prevented the fraud. ## When This Code Applies - Card was lost and used before reported - Card was stolen and used fraudulently - Card never received by cardholder (intercepted) - PIN should have been required but wasn't - PIN bypass occurred when not permitted ## Liability Shift Scenarios ### Liability Shifts TO Merchant When: | Scenario | Why | |----------|-----| | Chip + signature (when PIN required) | PIN not collected | | Chip + no CVM | Cardholder verification missing | | PIN bypass for high-value | Exceeded no-PIN limit | | Non-chip terminal | EMV not supported | ### Liability Stays WITH Issuer When: | Scenario | Why | |----------|-----| | Chip + PIN verified | Correct authentication | | PIN verified online | Issuer approved PIN | | Low-value contactless | Within no-PIN threshold | | Card not blocked timely | Issuer delay | ## PIN Requirements by Transaction Type | Transaction | PIN Required | |-------------|--------------| | Chip debit | Yes (above threshold) | | Chip credit | Varies by region | | Contactless under limit | No | | Contactless over limit | Yes | | ATM | Always | ## Regional PIN Thresholds | Region | Contactless No-PIN Limit | |--------|-------------------------| | US | $100 | | Europe | โ‚ฌ50 (varies) | | UK | ยฃ100 | | Canada | CAD $250 | | Australia | AUD $200 | ## Time Frames | Region | Chargeback Window | |--------|-------------------| | Standard | 90 calendar days | | Europe ATM/Maestro | 120 calendar days | ## Representment Options ### Valid Defenses 1. **PIN was verified** - Online PIN verification 2. **Below PIN threshold** - Transaction didn't require PIN 3. **Proper CVM performed** - Signature where permitted 4. **Card not reported lost/stolen** - At time of transaction 5. **Refund already issued** - Transaction credited ### Evidence Required | Defense | Documentation | |---------|---------------| | PIN verified | PIN verification in auth response | | Below threshold | Transaction amount vs. limit | | Signature obtained | Signed receipt | | Not reported | Timestamp vs. loss report | ## Message Text Requirements | Defense | Message Text | |---------|--------------| | PIN verified | `PIN VERIFIED` | | Signature obtained | `SIGNATURE` | | Below threshold | `UNDER THRESHOLD` | ## Second Presentment Time Frames | Region | Window | |--------|--------| | Standard | 45 calendar days | | Costa Rica | 10 calendar days | | Kazakhstan | 30 calendar days | | Nigeria | **2 business days** | | Tanzania | 20 calendar days | ## Prevention Strategies ### Terminal Configuration 1. **Require PIN for debit** - Always prompt 2. **Configure thresholds properly** - Honor network limits 3. **No PIN bypass** - Disable where not permitted 4. **CVM enforcement** - Don't skip verification ### Transaction Monitoring 1. **Velocity checks** - Multiple transactions same card 2. **Geographic anomalies** - Impossible travel 3. **High-risk indicators** - Gift cards, high value 4. **Real-time alerts** - Suspicious patterns ### Staff Training 1. **Card inspection** - Check for tampering 2. **Signature verification** - Compare to card 3. **Suspicious behavior** - Report concerns 4. **PIN entry privacy** - Shield keypad ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | PIN verified online | 85-95% | | Signature (where permitted) | 40-60% | | No PIN/signature | Under 15% | ## Difference from 4870 | Code | Scenario | Card Type | |------|----------|-----------| | 4870 | Counterfeit card | Fake chip card | | 4871 | Lost/stolen/NRI | Legitimate card, wrong hands | ## Related Codes - [4870](/docs/reference/reason-codes/mastercard/chip-liability) - Chip Liability Shift (Counterfeit) - [4837](/docs/reference/reason-codes/mastercard/fraud) - No Cardholder Authorization ## See Also - [Account Takeover Prevention](/docs/fraud/types/account-takeover) - [Third-Party Fraud](/docs/fraud/types/third-party) --- ## Visa 10.1 - EMV Liability Shift (Counterfeit) Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/10-1-emv-counterfeit # Visa 10.1 - EMV Liability Shift (Counterfeit) :::info[TL;DR] - A counterfeit card ran at your terminal and the chip never got read. Visa moves the loss to whichever side skipped EMV. - The case turns on your terminal logs. Proof of a successful chip read wins it outright. - Cardholder filing window: 120 days from the transaction date. Your response window: 30 days. - Two logged chip attempts before any swipe fallback. That's the line between a defense and a certain loss. - Non-EMV terminal? No defense exists. Replace the terminal. ::: A counterfeit card ran at a terminal that didn't read the chip. Visa calls this an **EMV liability shift dispute**, and the side that skipped EMV carries the loss. ## When This Code Applies - Counterfeit card presented at POS terminal - Chip not read (swipe fallback) - Terminal isn't EMV-capable - Card has a chip, but the chip wasn't used ## Conditions for Valid Dispute ### Issuer Must Verify 1. Card was counterfeit (verified by issuer) 2. Card has EMV chip 3. Chip wasn't used in the transaction 4. Cardholder didn't authorize it ### Transaction Must Be - Card-present (face-to-face) - Processed via magnetic stripe when chip was available - At a non-EMV or EMV-fallback terminal ## Time Frames | Scenario | Window | |----------|---------------| | Cardholder files | 120 days from transaction date | | You respond | 30 days from the dispute | ## Liability Shift Rules ### Merchant Liable When - Terminal isn't EMV-capable - EMV fell back to swipe - Technical malfunction prevented chip read ### Issuer Liable When - Card doesn't have chip - Chip was read successfully - Merchant followed proper fallback procedures ## Representment Options ### 1. Chip Was Read **Evidence required:** - Terminal transaction log showing chip read - EMV cryptogram data - Terminal EMV certification ### 2. Card Had No Chip **Evidence required:** - Card imprint (if available) - Terminal transaction record - Acquirer confirmation of mag-stripe-only card ### 3. Proper Fallback Procedure **Evidence required:** - Two chip read attempts logged - Terminal error logs - Fallback was per Visa rules ## Prevention Strategies ### Terminal Requirements 1. **EMV-enabled terminals** - All POS must support chip 2. **Contactless support** - NFC reduces counterfeit risk 3. **Fallback procedures** - Follow Visa guidelines for chip failures ### Transaction Security 1. **Never force swipe** - Unless chip genuinely fails 2. **Two-attempt rule** - Try chip twice before fallback 3. **Document fallbacks** - Log every fallback reason ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Chip was read (with proof) | 80-90% | | Proper fallback documented | 40-60% | | No fallback documentation | Under 20% | ## Common Mistakes 1. **Non-EMV terminals** - Automatic liability 2. **Forcing swipe fallback** - Without attempting chip 3. **No transaction logs** - Can't prove chip attempt 4. **Staff training gaps** - Improper fallback handling ## Related Codes - [10.2](/docs/reference/reason-codes/visa/10-2-emv-non-counterfeit) - EMV Liability Shift Non-Counterfeit - [10.3](/docs/reference/reason-codes/visa/10-3-fraud-card-present) - Other Fraud Card Present - [10.4](/docs/reference/reason-codes/visa/10-4-fraud-cnp) - Card Not Present Fraud ## Next Steps **Got this chargeback?** 1. Pull terminal logs โ†’ Was the chip read? 2. Check for fallback โ†’ Did staff attempt the chip twice first? 3. Verify EMV certification โ†’ Is the terminal certified? 4. Respond within 30 days โ†’ [Representment Workflow](/docs/operations/representment-workflow) **Prevent future 10.1 chargebacks:** 1. Put every POS on an EMV-capable terminal 2. Never force a swipe without two chip attempts 3. Log every fallback transaction and the reason for it 4. [Review EMV requirements](/docs/fraud/prevention/emv-contactless) --- ## See Also - [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Chip and NFC setup - [Card-Present Fraud](/docs/fraud/card-present-fraud) - Counterfeit and skimming patterns - [Terminal Security](/docs/fraud/terminal-security) - Tampering and skimmer checks - [Terminal Operations](/docs/operations/terminal-operations) - Day-to-day POS handling --- ## Visa 10.2 - EMV Liability Shift (Non-Counterfeit) Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/10-2-emv-non-counterfeit # Visa 10.2 - EMV Liability Shift (Non-Counterfeit) :::info[TL;DR] - A real card got used by the wrong person, and your terminal didn't read the chip. - 10.1 is a cloned card and 10.2 is a real one, but the evidence is identical. - Cardholder filing window: 120 days. Your response window: 30 days. - Prove the chip was read and you win. Chip plus PIN and it isn't close. - No chip read, no defense. Your terminal logs decide this, not your story. ::: Someone used a **lost, stolen, or never-received card** at your counter and the chip didn't get read. Visa moves the loss to whoever skipped EMV. ## When This Code Applies - Lost or stolen card used at POS - Card never received by cardholder (intercepted) - Genuine card, unauthorized transaction - Chip not read (swipe fallback) ## Conditions for Valid Dispute ### Issuer Must Verify 1. Card is genuine (not counterfeit) 2. Cardholder didn't authorize the transaction 3. Card has an EMV chip 4. Chip wasn't read in the transaction ### Transaction Must Be - Card-present - Processed without reading chip - At EMV-capable or non-EMV terminal ## Time Frames | Scenario | Window | |----------|---------------| | Cardholder files | 120 days from transaction date | | You respond | 30 days from the dispute | ## Liability Shift Rules ### Merchant Liable When - Terminal didn't read chip - EMV fallback without proper procedure - Staff accepted swipe without chip attempt ### Issuer Liable When - Chip was read successfully - Proper authentication occurred - PIN verified (if PIN-preferring card) ## Difference from 10.1 | Aspect | 10.1 | 10.2 | |--------|------|------| | Card type | Counterfeit | Genuine | | Fraud source | Cloned card | Lost/stolen card | | Key evidence | Chip vs swipe | Chip vs swipe | ## Representment Options ### 1. Chip Was Read **Evidence required:** - EMV transaction log - Cryptogram data - Terminal certification ### 2. PIN Verified **Evidence required:** - PIN entry confirmation - Terminal PIN pad log - Correct PIN on first attempt ### 3. Cardholder Present **Evidence required:** - CCTV footage - ID verification records - Signature match ## Prevention Strategies Use the chip every time. If the card has one and your terminal reads it, a swipe is a loss waiting to happen. Turn on PIN preference if your terminals support it. That's the strongest defense this code allows. Train staff on one rule: chip first, always. If a customer pushes hard for a swipe, that's information. Log every fallback and the reason for it. ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Chip + PIN verified | 85-95% | | Chip read only | 70-85% | | No chip read | Under 25% | ## Common Mistakes 1. **Swipe without a chip attempt** - Liability shifts immediately 2. **No PIN verification** - You gave up a layer 3. **Staff overriding chip prompts** - Creates the liability 4. **Missing terminal logs** - Can't prove the chip was used ## Related Codes - [10.1](/docs/reference/reason-codes/visa/10-1-emv-counterfeit) - EMV Liability Shift Counterfeit - [10.3](/docs/reference/reason-codes/visa/10-3-fraud-card-present) - Other Fraud Card Present - [10.4](/docs/reference/reason-codes/visa/10-4-fraud-cnp) - Card Not Present Fraud ## Next Steps **Got this chargeback?** 1. Pull terminal logs โ†’ Chip read? PIN entered? 2. Check CCTV โ†’ Can you identify who used the card? 3. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 4. Respond within 30 days **Prevent future 10.2 chargebacks:** 1. Chip and PIN whenever the terminal offers it 2. Put a camera on the POS 3. [Review EMV requirements](/docs/fraud/prevention/emv-contactless) --- ## See Also - [EMV & Contactless](/docs/fraud/prevention/emv-contactless) - Chip and NFC setup - [Card-Present Fraud](/docs/fraud/card-present-fraud) - Lost and stolen card patterns - [Terminal Security](/docs/fraud/terminal-security) - Tampering and skimmer checks - [Terminal Operations](/docs/operations/terminal-operations) - Day-to-day POS handling --- ## Visa 10.3 - Other Fraud (Card Present) Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/10-3-fraud-card-present # Visa 10.3 - Other Fraud (Card Present) :::info[TL;DR] - The chip got read and fraud happened anyway. That's what 10.3 covers, everything 10.1 and 10.2 miss. - Chip plus PIN plus a checked ID wins it. A signature on its own usually doesn't. - Cardholder filing window: 120 days from the transaction. Yours: 30 days to respond. - CCTV decides most of these. No camera at the POS, no case. ::: The catch-all card-present fraud code. It covers staff collusion, PIN bypass, a tampered terminal, and any chip-read transaction the cardholder still denies. ## When This Code Applies - Fraud despite chip being read - PIN bypass fraud - Collusion scenarios - Fraudulent application for card - Card manipulation at terminal ## Conditions for Valid Dispute ### Issuer Must Verify 1. Cardholder didn't authorize it 2. Transaction was card-present 3. It doesn't qualify for 10.1 or 10.2 ### Transaction Must Be - Card-present (face-to-face) - At a physical terminal - Not EMV liability shift eligible ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction date | ## When This Code Is Used (vs 10.1/10.2) | Scenario | Code | |----------|------| | Counterfeit card, no chip used | 10.1 | | Genuine card stolen, no chip used | 10.2 | | Chip used, fraud still claimed | 10.3 | | Fraudster manipulated terminal | 10.3 | | Staff collusion | 10.3 | ## Representment Options ### 1. Cardholder Authorized **Evidence required:** - Signature on receipt - PIN verification - CCTV showing cardholder - Photo ID matched ### 2. Chip + PIN Used **Evidence required:** - EMV transaction record - PIN verification log - Correct PIN on first attempt - No fallback to signature ### 3. Transaction Benefited Cardholder **Evidence required:** - Delivery to cardholder address - Cardholder pick-up verified - Prior relationship/purchases ## Prevention Strategies ### Staff Procedures 1. **ID verification** - Check ID on high-value transactions 2. **Match signatures** - Compare to card signature 3. **Watch for nervous behavior** - If it doesn't feel right, decline 4. **Multiple card attempts** - Red flag for fraud ### Terminal Security 1. **PIN preference enabled** - Require PIN over signature 2. **Camera coverage** - Record all transactions 3. **Tamper detection** - Check terminals regularly ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Chip + PIN + ID verified | 75-90% | | CCTV showing cardholder | 60-80% | | Signature only | 30-50% | | No additional proof | Under 20% | ## Common Mistakes 1. **No CCTV coverage** - Can't prove who transacted 2. **PIN bypass enabled** - You're throwing away the security benefit 3. **ID check not performed** - Especially on high-value 4. **Missing signature receipts** - No authorization proof ## Related Codes - 10.1 - EMV Liability Shift Counterfeit - 10.2 - EMV Liability Shift Non-Counterfeit - [10.4](./10-4-fraud-cnp.md) - Card Not Present Fraud ## Next Steps **Got this chargeback?** 1. Pull CCTV footage โ†’ Can you prove cardholder was present? 2. Check for chip + PIN โ†’ Was transaction authenticated? 3. Look for ID verification โ†’ Did staff check ID? 4. Respond within 30 days โ†’ [Representment Workflow](/docs/operations/representment-workflow) **Prevent future 10.3 chargebacks:** 1. Enable PIN preference on all terminals 2. Install camera coverage at all POS locations 3. Train staff to check ID on high-value transactions 4. [Review card-present fraud prevention](/docs/fraud/card-present-fraud) --- ## See Also - [Card-Present Fraud](/docs/fraud/types) - [Terminal Security](/docs/operations) - [Staff Training](/docs/operations) --- ## Visa 10.4 - Card Absent Environment (Fraud) Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/10-4-fraud-cnp # Visa 10.4 - Card Absent Environment (Fraud) :::info[TL;DR] - A cardholder told their bank they didn't make an online order. It's the fraud code you'll see most - Ran 3DS and got ECI 05? The issuer eats it. That's the whole ballgame - No 3DS? Compelling Evidence 3.0 is next best. It needs two prior clean orders from that customer - They get 120 days. You get 30 to answer ::: Someone says they didn't make the online purchase you shipped. That's 10.4, Visa's main fraud code for card-not-present. ## When This Code Applies - Cardholder denies making an online purchase - Card credentials used without authorization - Account takeover leading to CNP fraud - Stolen card used for an online purchase - Friendly fraud, where the cardholder says it wasn't them ## Conditions for Valid Dispute The issuer has to confirm two things. The cardholder didn't authorize the charge, and got no benefit from it. It also has to be card-absent, and filed inside the window. Card-absent means e-commerce, MOTO, or recurring billing without proper authentication. ## When the Dispute Isn't Valid At All {/* #invalid-disputes */} Visa lists conditions that make a 10.4 invalid before anyone argues about evidence. One of them is worth knowing by heart, because it's the serial-disputer rule and almost nobody cites it: > A Transaction on an Account Number for which the Issuer has initiated more than 35 Disputes within the previous 120 calendar days. That's Visa Core Rules section 11.7.5.3, Table 11-28, in the 18 April 2026 edition. Thirty-five disputes on one account inside four months, counted across every merchant, not just yours. Past that, a further 10.4 on that account isn't a weak dispute. It's an invalid one. You can't see the other 34. Only the issuer can. So this isn't something you check before responding, it's something you raise when a customer's behaviour smells like a pattern: several disputes from the same person, or a customer whose story keeps changing. Put it in the representment narrative and make the issuer look: > *"We believe this dispute may be invalid under Visa Core Rules 11.7.5.3. Please confirm whether more than 35 disputes have been initiated on this account number in the previous 120 calendar days."* Two honest caveats. It only covers 10.4, not every fraud code. And the rule carries two footnotes in Visa's text that we haven't read, so check the current edition before you quote it in a formal filing. ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction date | | With delivery | 120 days from delivery date (or expected delivery) | | Digital goods | 120 days from transaction date | ## Liability Shift with 3D Secure ### Full Liability Shift (Issuer Liable) When transaction is fully authenticated: - Visa Secure (3DS 2.0) - Challenge flow completed - ECI = 05 (fully authenticated) - Cryptogram present and valid ### Partial/No Liability Shift (Merchant Liable) | Scenario | ECI | Merchant Liability | |----------|-----|-------------------| | Authentication attempted, issuer unavailable | 06 | Reduced | | Authentication failed | 07 | Full | | No authentication attempted | 07 | Full | | 3DS not supported | N/A | Full | ## Compelling Evidence 3.0 (CE 3.0) Visa's enhanced compelling evidence program for repeat customers. ### CE 3.0 Requirements To qualify for CE 3.0 representment: 1. **Two prior undisputed transactions** with same payment credentials 2. **At least 120 days before disputed transaction** 3. **Matching data elements** - at least two of the four below, and one of them must be IP address or Device ID. - IP address - Device ID/fingerprint - Shipping address - User account ID ### CE 3.0 Process ```mermaid flowchart LR A[Dispute Received] --> B{CE 3.0 Eligible?} B -->|Yes| C[Submit Evidence] C --> D[Auto-reversal] B -->|No| E[Standard Representment] style A fill:#8b5cf6,color:#fff style D fill:#10b981,color:#fff style E fill:#6b7280,color:#fff ``` ### CE 3.0 Benefits - Pre-arbitration liability protection - Higher win rates - Faster resolution ## Standard Representment Options ### 1. Transaction Was Authorized **Evidence required:** - Cardholder correspondence acknowledging purchase - Order confirmation sent to cardholder email - IP/device match to prior purchases - Signed delivery confirmation ### 2. 3D Secure Authentication **Evidence required:** - ECI value showing authentication - Cryptogram/CAVV - Authentication timestamp - 3DS transaction ID ### 3. AVS/CVV Verification **Evidence required:** - AVS match (full or partial) - CVV2 match - Delivery to verified address ### 4. Delivery Confirmation **Evidence required:** - Carrier tracking showing delivered - Signature confirmation - Delivery address matches billing - Photo proof of delivery (if available) ### 5. Digital Goods Access **Evidence required:** - IP address at time of download/access - Access logs showing usage - Account login after purchase - Download confirmation ### 6. Prior Transaction History **Evidence required:** - Previous undisputed purchases - Same email/phone/device - Established customer relationship ## Representment Time Frames | Stage | Window | |-------|--------| | Initial response | 30 days from chargeback | | Pre-arbitration | 30 days from representment | | Arbitration | 45 days from pre-arb | ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | 3DS authenticated (ECI 05) | 80-95% | | CE 3.0 qualifying | 70-85% | | AVS match + delivery proof | 40-60% | | Standard evidence | 25-40% | | No evidence | Under 15% | ## Where This Breaks Most merchants who lose 10.4 never ran 3DS. Without it you get no liability shift. So you argue evidence instead of pointing at a rule. Records are next. Log IP, device fingerprint and timestamps on every order. You can't build a CE 3.0 case without them, and you can't backfill them later. Delivery proof is the other hole. "Delivered" beats "shipped." A signature beats both. Then there's the clock. You get 30 days. Teams miss it because the notice lands in an inbox nobody reads. Route dispute alerts somewhere a human looks daily. Thin evidence loses. One order confirmation email isn't a case, and you rarely get a second submission. ## Related Codes - 10.3 - Other Fraud Card Present - 10.5 - VFMP ## Next Steps **Got this chargeback?** 1. Check if 3DS was used โ†’ If ECI 05, you have strong defense 2. Check CE 3.0 eligibility โ†’ Prior undisputed transactions from same customer? 3. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 4. Respond within 30 days **Prevent future 10.4 chargebacks:** 1. [Implement 3D Secure](/docs/playbooks/first-time-3ds-setup) for liability shift 2. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to refund before chargeback --- ## See Also - [3D Secure Implementation](/docs/fraud/prevention/3ds) - Liability shift protection - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - CE 3.0 requirements - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Device Fingerprinting](/docs/fraud/detection/device-fingerprinting) - Proving cardholder involvement - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address verification - [Third-Party Fraud](/docs/fraud/types/third-party) - True fraud vs. friendly - [Account Takeover](/docs/fraud/types/account-takeover) - ATO patterns - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Fraud detection - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Pre-transaction screening - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - Deflect before filing - [VAMP Fraud Thresholds](/docs/chargebacks/monitoring/thresholds) - Fraud program limits - [Fraud vs. Friendly](/docs/chargebacks/fraud-vs-friendly) - Classification --- ## Visa 10.5 - Visa Fraud Monitoring Program Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/10-5-vfmp # Visa 10.5 - Visa Fraud Monitoring Program (VFMP) :::info[TL;DR] - VFMP was retired on 31 March 2025 and folded into VAMP on 1 April 2025. Nobody is enrolled in it today - The dispute condition still exists and is still numbered 10.5. Visa retired the program behind it - If your acquirer says you're in a fraud monitoring program, it's [VAMP](/docs/chargebacks/reference/network-programs), and the numbers are different - Everything below the overview describes the retired program. It's kept for anyone reading an old notice or an old runbook ::: :::warning[VFMP was retired on 31 March 2025] Visa retired the Fraud Monitoring Program as a program and folded it into **VAMP** (Visa Acquirer Monitoring Program) on 1 April 2025. Nobody is enrolled in VFMP today, and no VFMP fine has been assessed since then. The name survives only on this dispute condition, which is still numbered 10.5. If your acquirer has told you that you're in a fraud monitoring program, it's VAMP, and the numbers are different. See [Network Programs Reference](/docs/chargebacks/reference/network-programs) for what's live: 1.5% merchant excessive, a 1,500 combined fraud-and-dispute floor, and per-dispute fees rather than the monthly assessments below. Everything on this page below the overview describes the retired program. It's kept for anyone reading an old notice or an old runbook. ::: Disputes arising from **VFMP compliance violations**. Issuers could file under this code while the program ran. ## Overview Issuers filed this code against merchants sitting in Visa's Fraud Monitoring Program. The trigger was either a missed program requirement or a fraud transaction out of an enrolled account. ## When This Code Applies - The merchant was enrolled in VFMP - The transaction was fraudulent and came from that merchant - The merchant missed a VFMP compliance requirement - The fraud rate blew past the program thresholds ## VFMP Thresholds _Historical. These applied until 31 March 2025 and apply to nobody now. VAMP replaced them with a single combined fraud-and-dispute ratio._ ### Standard VFMP Thresholds | Tier | Fraud Basis Points | Fraud Transactions | |------|-------------------|-------------------| | Early Warning | 65 bps AND | 75 transactions | | Standard | 90 bps AND | 100 transactions | | Excessive | 180 bps AND | 1,000 transactions | ### VFMP Timeline _Also historical. VAMP charges per dispute instead: US$8 per CNP dispute at merchant excessive, not a flat monthly assessment._ | Stage | Consequence | |-------|-------------| | Month 1-4 | Identification, remediation required | | Month 5-8 | $25,000/month fines | | Month 9+ | $75,000/month fines | | Month 12 | Card acceptance termination possible | ## Conditions for Valid Dispute ### Issuer Must Verify 1. The merchant was enrolled in VFMP at the time 2. The transaction itself was fraudulent 3. The filing landed inside the program timeframes ### Merchant Situation - You were already under enhanced monitoring - Your representment options were thin - Every dispute you filed drew extra scrutiny ## Representment Options Once you were in the program, you didn't have many moves. ### 1. Transaction Was Authorized **Evidence required:** - Strong authentication proof (3DS with ECI 05) - Cardholder correspondence - Device/IP matching prior purchases ### 2. Fraud Prevention Was Applied **Evidence required:** - Fraud screening records - 3DS attempt logs - Declined transaction history showing controls ### 3. Exit VFMP Status Getting the fraud rate under the thresholds beat winning cases. Prevention mattered more than representment. ## Prevention Strategies (VFMP Exit Focus) ### Immediate Actions 1. **Enable 3DS 2.0** - Get liability shift on all transactions 2. **Tighten fraud scoring** - decline more of the borderline orders 3. **Review product/pricing** - some products attract fraud and have to go 4. **Velocity limits** - cap orders per customer, per card and per IP ### Monitoring 1. **Daily fraud review** - Don't wait for monthly reports 2. **Track basis points** - Know your real-time fraud rate 3. **Dispute categorization** - know where your fraud is coming from ### Customer Verification 1. **Enhanced verification** - confirm the order by phone or email 2. **Delivery confirmation** - require a signature on every delivery 3. **New customer friction** - make first-time buyers clear a higher bar ## Win Rate Expectations Representment during VFMP was an uphill fight: | Defense Type | Expected Win Rate | |--------------|------------------| | 3DS fully authenticated | 70-85% | | Strong prior relationship | 40-60% | | Standard evidence | 15-30% | **Reality:** spend the effort on prevention, not on representment. ## Exiting VFMP ### Exit Requirements - Fraud rate below thresholds for 3 consecutive months - Evidence that you'd closed the compliance gaps - Your acquirer confirming you're out ### Exit Strategy 1. **Aggressive fraud blocking** - accept fewer of the risky orders 2. **3DS on everything** - push the liability shift as far as it goes 3. **Product review** - pull the items that keep attracting fraud 4. **Customer segmentation** - whitelist the customers you already trust ## Common Mistakes 1. **Ignoring VFMP enrollment** - hope isn't a strategy 2. **Continuing normal operations** - if nothing changes, the fraud rate doesn't either 3. **Fighting all disputes** - Waste of resources during VFMP 4. **No root cause analysis** - you'll be back in the program ## Related Codes - 10.1 - EMV Counterfeit - 10.2 - EMV Non-Counterfeit - 10.3 - Other Fraud Card Present - [10.4](./10-4-fraud-cnp.md) - Card Not Present Fraud ## Next Steps **In VFMP program?** 1. Immediately implement [3D Secure](/docs/playbooks/first-time-3ds-setup) 2. Set up [dispute alerts](/docs/playbooks/setup-dispute-alerts) to reduce dispute count 3. Review fraud rules โ†’ Tighten [velocity checks](/docs/fraud/detection/velocity-rules) 4. Follow the [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) playbook **Get out of VFMP:** 1. Reduce fraud ratio below thresholds for 3 consecutive months 2. Work with processor on remediation plan 3. Consider temporarily blocking high-risk transactions --- ## See Also - [VAMP Programs](/docs/chargebacks/monitoring/thresholds) - [Fraud Prevention](/docs/fraud/prevention) - [3D Secure](/docs/fraud/prevention/3ds) - [Network Programs](/docs/chargebacks/reference/network-programs) --- ## Visa 11.1 - Card Recovery Bulletin Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/11-1-card-recovery-bulletin # Visa 11.1 - Card Recovery Bulletin :::info[TL;DR] - You processed a card that was on the Card Recovery Bulletin, the hot card list. Liability moved to you - Mostly card-present. Your terminal should have returned "pick up card" (04, 07, 41 or 43) and you should have declined - Dispute window is 120 days from the transaction date - Representment options are thin. You need proof the card wasn't listed when you ran it - Prevention is a terminal that checks the CRB and staff who don't override a decline ::: Transaction processed on a card that was on the **Card Recovery Bulletin (CRB)**, also known as the "hot card list." ## Overview Issuers put lost, stolen and fraudulent cards on the CRB. Your terminal is supposed to check that list before it approves a card-present sale. Run the card anyway and the loss is yours, not the issuer's. ## When This Code Applies - The card was on the CRB when you ran it - Your terminal skipped the check or ignored it - You completed the sale even though the card was listed - Almost always card-present, rarely e-commerce ## Conditions for Valid Dispute ### Issuer Must Verify 1. The card was on the CRB at sale time 2. The cardholder says they didn't make the purchase 3. The card was already blocked or cancelled ### Transaction Requirements - The sale was card-present - Your terminal should have returned "pick up card" or similar - The sale fell inside the CRB publication window ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction date | ## CRB Process ### How CRB Works 1. The cardholder reports the card lost, stolen or fraudulent 2. The issuer adds it to the Card Recovery Bulletin 3. The bulletin goes out to acquirers and terminals 4. Your terminal should decline, and staff retain the card if it's safe ### Terminal Response Codes | Code | Meaning | Merchant Action | |------|---------|-----------------| | 04 | Pick up card | Decline, retain if safe | | 07 | Pick up card (special) | Decline, retain if safe | | 41 | Lost card | Decline | | 43 | Stolen card | Decline | ## Representment Options Your options are thin. You're either proving the card wasn't listed when you ran it, or proving you got a clean approval back. ### 1. Card Not on CRB at Transaction Time **Evidence required:** - Timestamp of transaction - CRB publication records - Proof card added to CRB after transaction ### 2. Authorization Obtained **Evidence required:** - Auth approval code - Auth request/response logs - No "pick up card" response received ### 3. Timing Dispute **Evidence required:** - Transaction timestamp - CRB addition timestamp - Proof of real-time auth check ## Prevention Strategies ### Terminal Configuration 1. **Real-time auth** - every sale goes online for authorization 2. **CRB checking on** - never skip the hot card list 3. **Response code handling** - the terminal acts on the code ### Staff Training 1. **Decline codes** - your staff knows what 04, 41 and 43 mean 2. **Card retention** - retain the card only when it's safe 3. **Never override** - nobody pushes a CRB decline through ### System Requirements 1. **Online terminals** - turn off store-and-forward and offline auth 2. **Fresh CRB data** - download on schedule if you batch 3. **Response logging** - store every auth response you get ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Card added to CRB after transaction | 80-90% | | Auth approved (no CRB match) | 70-85% | | Card was on CRB at transaction | Under 10% | ## Common Mistakes 1. **Offline processing** - you can't check the CRB offline 2. **Ignoring decline codes** - selling after a "pick up" response 3. **Stale CRB data** - the terminal checks last week's list 4. **No auth logging** - you can't prove the auth was clean ## Related Codes - 11.2 - Declined Authorization - 11.3 - No Authorization - 10.1 - EMV Counterfeit ## Next Steps **Got this chargeback?** 1. Check if card was on CRB at transaction time โ†’ Very hard to defend 2. Verify you had valid authorization โ†’ Pull auth logs 3. If card was on CRB โ†’ Accept the chargeback (limited defense) **Prevent future 11.1 chargebacks:** 1. Process transactions online (real-time CRB check) 2. Update terminal CRB data regularly if offline capable 3. Never override "pick up card" decline responses 4. [Review authorization basics](/docs/payments/reference/authorization-basics) --- ## See Also - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Terminal Configuration](/docs/operations) - [Fraud Prevention](/docs/fraud/prevention) --- ## Visa 11.2 - Declined Authorization Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/11-2-declined-authorization # Visa 11.2 - Declined Authorization :::info[TL;DR] - The issuer declined and you charged the card anyway. That's the whole code - Liability is yours. This is about as clear-cut as a chargeback gets - Dispute window is 120 days from the transaction date - You win only by proving the auth was actually approved. Bring the approval code and the full request and response log - Never re-run a declined card manually. Ask for another payment method instead ::: Transaction was processed even though the authorization request was **declined by the issuer**. ## Overview A decline is the issuer telling you no. Charge the card anyway and you own the loss. There's no shared liability here. ## When This Code Applies - The auth response came back declined - You captured and settled the sale anyway - Someone at the counter overrode the decline - Your system captured without waiting for a response ## Conditions for Valid Dispute ### Issuer Must Verify 1. An authorization request went out on the sale 2. The issuer answered with a decline, not an approval 3. You captured and settled it regardless 4. The cardholder says they didn't approve it ### Response Codes That Decline | Code | Meaning | |------|---------| | 05 | Do not honor | | 14 | Invalid card number | | 51 | Insufficient funds | | 54 | Expired card | | 57 | Transaction not permitted | | 62 | Restricted card | | 63 | Security violation | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction date | ## Representment Options Your options are narrow and they all live in the auth logs. Either you have a real approval code for this sale or you don't. ### 1. Authorization Was Approved **Evidence required:** - Auth approval code - Full auth request/response log - Network transaction records - Timestamp matching ### 2. Different Transaction **Evidence required:** - Transaction IDs don't match - Declined and processed are separate transactions - Approved auth for processed transaction ### 3. Technical Error **Evidence required:** - System logs showing error - Processor confirmation of auth issue - Proof of good faith processing ## Why This Happens ### Common Causes 1. **Staff override** - somebody said "just run it through" 2. **System timeout** - the gateway assumed approval and captured 3. **Multiple attempts** - the capture matched the wrong auth 4. **Manual entry** - the sale bypassed the auth system 5. **Offline processing** - the terminal stored and forwarded it ## Prevention Strategies ### System Configuration 1. **No decline override** - your POS shouldn't let anyone force a sale 2. **Auth matching** - check for a real approval code before capture 3. **Timeout handling** - a timeout isn't an approval, so retry 4. **Online-only mode** - turn off offline processing everywhere ### Staff Training 1. **Decline means no sale** - no exceptions, not even for regulars 2. **Multiple attempts** - every retry needs its own fresh auth 3. **Response codes** - your team knows what the common ones mean 4. **Escalation path** - everyone knows who to call on an edge case ### Process Controls 1. **Auth-capture matching** - no approval code, no capture 2. **Decline logging** - keep every decline, not just approvals 3. **Override audit** - flag every forced sale for review 4. **Daily reconciliation** - catch mismatches while they're still fixable ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Proof of approval (with code) | 85-95% | | Processing error (good faith) | 30-50% | | Override was performed | Under 5% | ## Common Mistakes 1. **Re-running a declined card** - each attempt is its own violation 2. **Voice auth with no approval code** - the call proves nothing 3. **Treating a system error as approval** - it isn't one 4. **Bypassing for a "good customer"** - you're still liable ## Related Codes - 11.1 - Card Recovery Bulletin - 11.3 - No Authorization - 12.1 - Late Presentment ## Next Steps **Got this chargeback?** 1. Check auth logs โ†’ Did you get a valid approval code? 2. Verify no "force" or override was used โ†’ Staff bypassed decline? 3. If you processed after decline โ†’ Accept the chargeback (no defense) **Prevent future 11.2 chargebacks:** 1. Never charge a card after a decline response 2. Train staff to accept "no" from the authorization system 3. Use proper retry logic for soft declines only 4. [Review auth optimization](/docs/payments/auth-optimization) --- ## See Also - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Decline Handling](/docs/payments/auth-optimization) - [Staff Training](/docs/operations) --- ## Visa 11.3 - No Authorization Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/11-3-no-authorization # Visa 11.3 - No Authorization :::info[TL;DR] - The transaction went through with no authorization at all. That's automatic liability - Usual causes: offline terminals, floor limits, a system failure, or voice auth nobody documented - Card-not-present has a zero floor limit. Every online sale needs an auth, however small - Dispute window is 120 days from the transaction date - Fight it only with proof an auth existed. Otherwise pay it and fix the terminal ::: Transaction was processed **without obtaining authorization** from the issuer. ## Overview Every card transaction needs an authorization, and skipping it makes you automatically liable. Offline terminals, floor limits and system failures are the usual causes. ## When This Code Applies - No auth request ever went out - The sale sat under a floor limit - A system failure killed the auth - Someone keyed the sale in manually - Voice auth happened but nobody documented it ## Conditions for Valid Dispute ### Issuer Must Verify 1. There's no authorization on file for the sale 2. You captured and settled it anyway 3. The cardholder says they didn't approve it ### Scenarios - The terminal was running offline - The sale fell under a floor limit - Paper or backup processing - A timeout with no retry ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction date | ## Floor Limits ### Current Floor Limits Most card-not-present transactions carry a **zero floor limit**, so every online sale needs an auth, however small. Set your CNP floor limit to zero and move on. | Transaction Type | Typical Floor Limit | |-----------------|---------------------| | E-commerce | $0 (auth required) | | Card-present | $0-$25 (varies) | | Some hospitality | Higher limits may apply | ### Floor Limit Rules - Zero floor limit is standard for CNP - Even small transactions need auth - Floor limits are processor/acquirer dependent - Airlines and hotels have special rules ## Representment Options This one turns entirely on whether an authorization exists, so pull the record before you write a word of rebuttal. No auth on file means a win rate under 10%. Accept the chargeback and fix the terminal instead. ### 1. Authorization Was Obtained **Evidence required:** - Authorization code - Auth request/response logs - Network records - Matching timestamps ### 2. Voice Authorization **Evidence required:** - Voice auth approval code - Call recording (if available) - Operator reference number - Time and date of call ### 3. Special Circumstances **Evidence required:** - System outage documentation - Processor confirmation - Good faith processing proof ## Why This Happens ### Common Causes 1. **Offline mode** - the terminal lost its connection 2. **Floor limit assumption** - thinking small amounts don't need auth 3. **System failure** - the auth system went down mid-sale 4. **Manual processing** - paper backup with no auth code 5. **Incremental transactions** - adding to an existing auth ## Prevention Strategies ### System Configuration 1. **Always online** - no store-and-forward, no offline mode 2. **Zero floor limit** - require auth for all amounts 3. **Auth validation** - block any capture that doesn't have a code 4. **Backup procedures** - know what to do when auth is down ### Technical Controls 1. **Real-time monitoring** - know when auth is down 2. **Queue and retry** - Don't skip auth, wait for it 3. **Auth code validation** - verify the code before you capture 4. **Fallback alerts** - somebody gets paged when a terminal drops ### Process Controls 1. **No paper backup** - or strict auth requirements for paper 2. **Voice auth procedures** - log the code, the operator and the time 3. **Training** - your staff knows an auth is mandatory 4. **Daily reconciliation** - catch the missing auths early ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Proof of authorization | 85-95% | | Voice auth documented | 60-80% | | No authorization on file | Under 10% | ## Common Mistakes 1. **Assuming offline is okay** - It's not for CNP 2. **Floor limit misunderstanding** - zero floor limit is standard 3. **Voice auth without code** - you need the operator's approval code 4. **Incremental without new auth** - each increment needs its own ## Related Codes - 11.1 - Card Recovery Bulletin - 11.2 - Declined Authorization - 12.1 - Late Presentment ## Next Steps **Got this chargeback?** 1. Pull authorization logs โ†’ Was auth actually obtained? 2. Check for voice auth โ†’ Do you have an approval code? 3. Verify system records โ†’ Auth request/response logs? 4. If no auth exists โ†’ Accept the chargeback (limited defense) **Prevent future 11.3 chargebacks:** 1. Never process without authorization 2. Set zero floor limits for CNP transactions 3. Implement queue-and-retry for system outages 4. [Review authorization basics](/docs/payments/reference/authorization-basics) --- ## See Also - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Auth Optimization](/docs/payments/auth-optimization) - [System Reliability](/docs/operations) --- ## Visa 12.1 (Retired) - Late Presentment Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/12-1-late-presentment # Visa 12.1 (Retired) - Late Presentment :::info[TL;DR] - No live 12.1 can exist. Visa merged authorization and clearing into one clock on 13 April 2024 and the old filing windows have closed - A 12.1 on a current notification means a stale template or a legacy system. Ask your acquirer for the real condition and expect 11.3 - Current windows are 10 calendar days card-not-present and 5 card-present, counted from the authorization approval date - The substance doesn't change either way. Prove you cleared inside the window, or that an industry exception applied ::: :::warning[This code is retired - don't use it for new disputes] **12.1 no longer exists.** Visa folded late presentment into **11.3 (No Authorization)** for transactions completed **on or after 13 April 2024**. **Working a dispute today?** Use [11.3 - No Authorization](/docs/reference/reason-codes/visa/11-3-no-authorization). Late presentment is now a condition inside it. That's where you argue the defense. **Seeing 12.1 on a current notification?** No live 12.1 can exist. The change covered transactions completed on or after 13 April 2024, and the filing windows for anything older closed long ago. So a 12.1 today is stale material: an old processor template, a legacy internal system, or out-of-date vendor docs. Ask your acquirer for the real dispute condition on the case. Expect 11.3, and answer that. The substance doesn't change either way. Prove the transaction cleared inside the allowed window, or that an industry exception applied. ::: *Everything below describes how 12.1 worked while it was live. It's preserved because old notifications, archived case files and legacy vendor content still cite the code. The presentment windows themselves still matter under 11.3.* The transaction was presented for clearing **past the allowed timeframe** after authorization. Miss the window and you owned the liability. It didn't matter whether the sale itself was good. ## When This Code Applies - Transaction cleared too long after authorization - Delayed batching or settlement - System failure causing delayed clearing - Manual processing delays ## Time Frame Limits ### Standard Presentment Windows (historical, pre-13 April 2024) :::danger[These numbers are dead] The windows below describe the old framework. Back then Visa ran authorization validity and clearing as two separate clocks. On 13 April 2024 it merged them into one authorization-to-clearing timeframe, and every number changed. Card-not-present is now 10 calendar days, card-present is 5. **Don't use this table for anything current.** See [Authorization Windows Reference](/docs/payments/reference/auth-windows) for the rules in force today. ::: | Transaction Type | Presentment Window | |-----------------|-------------------| | Standard card-present | 2 days | | Card-not-present | 1 day | | T&E (hotels, car rental) | 15-31 days | | Cruise lines | 60 days | | Delayed delivery | Varies by industry | ### Counting Days - Day 0 = Authorization date - Extensions require specific MCC codes Under the current framework it's all calendar days, counted from the authorization approval date. ## Conditions for Valid Dispute The issuer had to show three things. The transaction was presented late, an authorization was obtained, and the window was exceeded. Late presentment was automatic liability. Without a valid exception, you didn't have a case. ## Representment Options ### 1. Within Presentment Window **Evidence required:** - Transaction date/time - Clearing date/time - Proof within allowed window ### 2. Valid Exception Applies **Evidence required:** - Industry exception documentation - MCC code showing exception eligibility - Delayed delivery proof (if applicable) ### 3. Cardholder Authorized Delay **Evidence required:** - Pre-authorization agreement - Cardholder acknowledgment of delayed charge - Booking/reservation records ## Special Industry Rules ### Hospitality (Hotels) - Pre-auth at check-in - Final charge at checkout - Extended window for final charges - Incidentals must be charged promptly ### Car Rental - Pre-auth at pickup - Final charge at return - Extended window for damage discovery - Fuel charges may have extended window ### Airlines - Auth at booking - Extended window for travel dates - Ancillary charges follow standard rules ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Within window (with proof) | 85-95% | | Valid industry exception | 70-85% | | Late presentment confirmed | Under 5% | ## Where This Breaks Batching causes almost all of these. If you're settling weekly, you're already late. Settle daily, or more often. Failed settlements are the quiet killer. A batch fails, nobody's watching the queue, and the window closes while it sits there. Alert on it and retry the same day. Capture at fulfillment, not later. The longer you hold an auth, the more ways to miss the clock. Your MCC mattered too. Hotels, car rental and cruise lines got extended windows, but only under the right code. On the wrong code you got the standard window and nothing to argue. Log timestamps for everything. Without them you can't prove you cleared on time, and that's the only defense that ever worked. ## Related Codes - [11.3](./11-3-no-authorization.md) - No Authorization (**the live condition that absorbed 12.1**) - [11.2](./11-2-declined-authorization.md) - Declined Authorization - [12.5](./12-5-incorrect-amount.md) - Incorrect Amount ## Next Steps **Holding a notification that cites 12.1?** 1. Confirm the real condition โ†’ Ask your acquirer; expect [11.3](/docs/reference/reason-codes/visa/11-3-no-authorization) 2. Check transaction timestamp vs. settlement date โ†’ How late? 3. Verify your MCC โ†’ Some categories have extended windows 4. If clearly late โ†’ Accept the dispute (limited defense) **Prevent future late presentment disputes (now filed under 11.3):** 1. Settle batches daily (or more frequently) 2. Monitor for failed settlements โ†’ Retry immediately 3. Automate batch closing โ†’ Don't rely on manual process 4. [Review settlement process](/docs/payments/settlement) --- ## See Also - [Settlement & Reconciliation](/docs/payments/settlement) - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Operations](/docs/operations) --- ## Visa 12.2 - Incorrect Transaction Code Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/12-2-incorrect-transaction-code # Visa 12.2 - Incorrect Transaction Code :::info[TL;DR] - The transaction cleared under the wrong type code. A credit posted as a purchase, a purchase as a cash advance, that kind of thing - Dispute window is 120 days from the transaction date - You'll win by showing the correct code was used, backed by processor and network records - It's a processing bug, not a customer problem. Fix it in the integration and it stops happening ::: The transaction went through with the wrong **transaction type code**. Nothing's wrong with the sale itself, it just didn't post the way it should have. ## Overview Transaction codes tell the network how to handle a transaction: purchase, refund, cash advance and so on. Send the wrong one and it doesn't just look wrong, it moves money the wrong way or bills the cardholder for interest they shouldn't owe. You won't see it until the dispute arrives. ## When This Code Applies - Wrong transaction type used - Credit processed as purchase - Purchase processed as cash advance - Refund processed incorrectly - Forced post with wrong code ## Conditions for Valid Dispute ### Issuer Must Verify 1. Transaction code is incorrect 2. Cardholder was negatively impacted 3. Correct code would have different outcome ### Common Code Errors | Intended | Actual | Problem | |----------|--------|---------| | Purchase | Cash advance | Higher fees, interest | | Refund | Purchase | Wrong direction of funds | | Debit | Credit | Wrong funding source | | Pre-auth | Sale | Funds captured prematurely | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction date | ## Representment Options ### 1. Correct Code Was Used **Evidence required:** - Transaction records showing correct code - Processor confirmation - Network records ### 2. Code Error Did Not Impact Cardholder **Evidence required:** - No financial impact to cardholder - Transaction processed correctly despite code - Cardholder received expected outcome ### 3. System/Processor Error **Evidence required:** - Processor confirmation of error - System logs showing correct submission - Error was downstream ## Why This Happens ### Common Causes 1. **Manual entry errors** - Wrong code selected 2. **System misconfiguration** - Default code incorrect 3. **Integration bugs** - API sending wrong values 4. **Processor issues** - Mapping errors 5. **Terminal settings** - Wrong configuration ## Prevention Strategies ### System Configuration 1. **Correct default codes** - Verify terminal/gateway setup 2. **Code validation** - Check codes before submission 3. **Integration testing** - Verify API sends correct codes 4. **Regular audits** - Review transaction code usage ### Technical Controls 1. **Code mapping review** - Ensure correct mappings 2. **Test transactions** - Verify in sandbox first 3. **Response validation** - Check what was actually processed 4. **Monitoring** - Alert on unexpected codes ### Process Controls 1. **Staff training** - Know when to use which codes 2. **Documentation** - Clear procedures for each transaction type 3. **Escalation** - Path for unusual scenarios 4. **Reconciliation** - Catch code mismatches ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Correct code proven | 85-95% | | No cardholder impact | 60-75% | | Wrong code used | Under 15% | ## Common Mistakes 1. **Refund as purchase** - Money goes wrong direction 2. **Recurring as one-time** - Missing recurring indicator 3. **Manual with wrong code** - Staff selects incorrectly 4. **No code validation** - System accepts any code ## Related Codes - 12.1 - Late Presentment - 12.3 - Incorrect Currency - 12.5 - Incorrect Amount ## See Also - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Settlement & Reconciliation](/docs/payments/settlement) - [Terminal Configuration](/docs/operations) --- ## Visa 12.3 - Incorrect Currency Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/12-3-incorrect-currency # Visa 12.3 - Incorrect Currency :::info[TL;DR] - Checkout showed one currency. The card got billed in another. That's the code. - DCC is the usual culprit. The terminal converted, and nobody asked the cardholder. - Cardholder filing window: 120 days. Your response window: 30 days. - DCC is only a defense if you logged the opt-in. A pre-ticked box isn't consent. - If the currency really was wrong, don't fight it. Refund and fix the checkout. ::: The cardholder got billed in a currency they never agreed to, and usually that's a conversion nobody asked for. ## When This Code Applies - Charged in different currency than shown - Dynamic Currency Conversion (DCC) applied without consent - Incorrect conversion rate - Currency code mismatch in processing ## Conditions for Valid Dispute ### Issuer Must Verify 1. Currency charged differs from agreed 2. Cardholder didn't consent to the currency change 3. Financial impact to cardholder ### Common Scenarios | Scenario | Issue | |----------|-------| | Checkout showed USD, charged EUR | Currency mismatch | | DCC without opt-in | Unauthorized conversion | | Wrong currency code | Processing error | | Rate manipulation | Incorrect conversion | ## Time Frames | Scenario | Window | |----------|---------------| | Cardholder files | 120 days from transaction date | | You respond | 30 days from the dispute | ## DCC (Dynamic Currency Conversion) DCC pays the merchant a cut of the markup. That's why terminals push it too hard. Done right, the cardholder sees both currencies and the rate, picks one, and gets both on the receipt. Declining has to be as easy as accepting. Anything less and you have no defense. Unless you can log the opt-in, turn DCC off. An unlogged conversion is an unauthorized one, and that's the whole basis of this code. ### DCC Red Flags - Pre-selected conversion - No rate disclosure - No opt-out option - Rate significantly above mid-market - Receipt only shows one currency ## Representment Options ### 1. Currency Was Correct **Evidence required:** - Transaction records showing correct currency - Checkout screenshot/logs - Currency displayed to cardholder - Order confirmation with currency ### 2. DCC Consent Obtained **Evidence required:** - DCC disclosure screen - Cardholder acceptance record - Receipt showing both currencies - Consent checkbox/signature ### 3. Pricing Was Accurate **Evidence required:** - Price as displayed at purchase - Currency matching order - No undisclosed conversion ## Prevention Strategies Put the currency code next to the price, not in the footer. Default to the customer's country, then let them change it. Show it again on the confirmation screen. Never pre-select DCC. Show the rate and the markup, make declining one click, and log which way the customer went. Check that the settled currency matches the one you displayed. Use ISO codes, not symbols, and test with a foreign card. ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Correct currency proven | 85-95% | | DCC consent documented | 70-85% | | Currency mismatch confirmed | Under 20% | A confirmed mismatch is a refund, not a representment. Fix the checkout instead. ## Common Mistakes 1. **USD-only for international** - Offer the local currency 2. **Currency code typos** - EUR billed as USD 3. **No currency on the receipt** - Can't prove what was agreed ## Related Codes - [12.2](/docs/reference/reason-codes/visa/12-2-incorrect-transaction-code) - Incorrect Transaction Code - [12.4](/docs/reference/reason-codes/visa/12-4-incorrect-account) - Incorrect Account Number - [12.5](/docs/reference/reason-codes/visa/12-5-incorrect-amount) - Incorrect Amount ## See Also - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - [International Payments](/docs/payments/payment-methods/international) - [Going Global](/docs/payments/going-global) --- ## Visa 12.4 - Incorrect Account Number Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/12-4-incorrect-account # Visa 12.4 - Incorrect Account Number :::info[TL;DR] - You charged the wrong card. Not the wrong amount, the wrong account - Almost always your side. A keyed digit, a bad token map, a card they didn't pick - Auth record and settled account match? You win. They don't? Pay it - The window is 120 days ::: The charge landed on a card the customer didn't use. That's 12.4. ## When This Code Applies - Transaction posted to the wrong card - Wrong number keyed by hand - System error posting to the wrong account - Digits transposed - Tokenization mapped to the wrong card ## Conditions for Valid Dispute The issuer checks three things. The cardholder's account was charged, they didn't use that card here, and your records point at different credentials. ### Common Scenarios | Scenario | Cause | |----------|-------| | Multi-card customer | Charged wrong saved card | | Manual keyed entry | Digit transposition | | Token confusion | Wrong token used | | Copy/paste error | Wrong credentials copied | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction date | ## Representment Options ### 1. The Right Account Was Charged **Evidence required:** - Transaction records matching the card - Last four digits match - Auth record with the correct account - Customer confirmation ### 2. The Cardholder Picked This Card **Evidence required:** - Order showing this payment method - Record of the customer selecting it - Account profile records - IP and device at time of selection ### 3. System Error, Not Yours **Evidence required:** - Processor error documentation - System logs showing a correct submission - Third-party confirmation ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Correct account proven | 85-95% | | Customer selected this card | 70-85% | | Wrong account charged | Under 10% | ## Where This Breaks Checkout is where most of these start. A customer with four saved cards sees four near-identical rows, and can't tell which one they're picking. Print the last four digits and the brand. Silent defaults are worse. You auto-select a card, nobody notices, and the charge hits an account they'd stopped using. Make the customer pick. Keying is the other half. Read the number back before you submit it. It costs ten seconds, and nothing else reliably catches a transposed digit. One rule covers the rest. Authorize and capture against the same account, because if those two disagree you have no defense worth filing. Pay it and fix whatever caused the mismatch. ## Related Codes - 12.2 - Incorrect Transaction Code - 12.5 - Incorrect Amount - [12.6](./12-6-duplicate.md) - Duplicate Processing ## See Also - [Checkout Conversion](/docs/payments/checkout-conversion) - [Tokenization](/docs/fraud/prevention) - [Card on File](/docs/payments/subscriptions-recurring) --- ## Visa 12.5 - Incorrect Amount Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/12-5-incorrect-amount # Visa 12.5 - Incorrect Amount :::info[TL;DR] - You took an amount the cardholder never agreed to. That's the whole code. - Most of these are tips. Restaurants get 20% over the authorization, and no more. - Cardholder filing window: 120 days. Your response window: 30 days. - Standard retail has zero tolerance. Auth $50, settle $75, and you own the $25. - A signed receipt showing the total wins this. Nothing else comes close. ::: The settled amount didn't match what the cardholder agreed to. The gap is yours unless you can prove consent. ## When This Code Applies - Amount charged differs from receipt/agreement - Auth amount differs from settled amount - Unauthorized tip added - Tax or shipping overcharge - Conversion resulted in different amount ## Conditions for Valid Dispute ### Issuer Must Verify 1. Amount charged differs from agreed amount 2. Cardholder has proof of correct amount 3. Variance isn't explained by legitimate adjustments ### Common Scenarios | Scenario | Issue | |----------|-------| | $50 auth, $75 charge | Exceeded authorization | | Receipt shows $100, charged $125 | Amount mismatch | | Tip added without consent | Unauthorized addition | | Gratuity included twice | Double charge | ## Time Frames | Scenario | Window | |----------|---------------| | Cardholder files | 120 days from transaction date | | You respond | 30 days from the dispute | ## Authorization Tolerance | Transaction Type | Tolerance | |-----------------|-----------| | Standard retail | 0% (exact match) | | Restaurants/hospitality | 20% over (for tips) | | Hotels | 15% over | | Car rental | 15% over | | Fuel | Specific rules | Go over the tolerance and you eat the overage. No partial credit. ## Representment Options ### 1. Amount Was Correct **Evidence required:** - Invoice/receipt showing correct amount - Order confirmation - Itemized breakdown - Customer agreement ### 2. Within Authorized Tolerance **Evidence required:** - Original authorization - Final amount - Proof within allowed tolerance - Industry code (MCC) ### 3. Cardholder Authorized Difference **Evidence required:** - Signed receipt with total - Tip line filled by cardholder - Change order documentation - Written confirmation ## Why This Happens A server keys a tip the cardholder didn't write. That's most of them. The rest come from partial shipments settled at the original total, tax recalculated after checkout, and plain keying errors. ## Prevention Strategies Show the total before you take the money. Itemize it. Put shipping and tax on the price screen, not a step later. Authorize the final amount, not an estimate. If it goes up, re-authorize. If you take tips, read what the cardholder wrote before you key it. Then keep the signed copy. It's the only thing that reliably wins this code. ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Signed receipt with amount | 80-90% | | Within tolerance (with proof) | 70-85% | | Authorized amount documented | 65-80% | | No documentation | Under 20% | ## Common Mistakes 1. **Exceeding tip tolerance** - 20% is the restaurant max 2. **No final confirmation** - Customer never saw the total 3. **Lost signed receipts** - Can't prove the cardholder agreed ## Related Codes - [12.3](/docs/reference/reason-codes/visa/12-3-incorrect-currency) - Incorrect Currency - [12.4](/docs/reference/reason-codes/visa/12-4-incorrect-account) - Incorrect Account Number - [12.6](/docs/reference/reason-codes/visa/12-6-duplicate) - Duplicate Processing - [13.1](/docs/reference/reason-codes/visa/13-1-not-received) - Not Received ## See Also - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Checkout Conversion](/docs/payments/checkout-conversion) - [Receipt Requirements](/docs/operations) --- ## Visa 12.6 - Duplicate Processing Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/12-6-duplicate # Visa 12.6 - Duplicate Processing/Paid by Other Means :::info[TL;DR] - The cardholder was charged twice for one sale, or paid by card and by another method - Dispute window is 120 days from the duplicate charge, and each extra charge can be disputed on its own - You win only if the two charges were genuinely separate sales. Separate receipts, different items, timestamps days apart - If it really is a duplicate, refund it before it becomes a chargeback. You keep the fee and your ratio ::: Used when a cardholder was charged multiple times for a single transaction, or when a charge appeared on both card and another payment method. ## When This Code Applies ### Duplicate Processing - Same transaction submitted twice - Multiple authorizations cleared separately - Batch submitted multiple times - Technical error caused duplicate ### Paid by Other Means - Charged to card AND paid cash - Charged to card AND different card - Charged to card AND via check - Charged to card AND bank transfer ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from duplicate transaction date | | Each duplicate | Can dispute each extra charge | ## Conditions for Valid Dispute ### Cardholder Must Show 1. Same goods/services charged multiple times 2. Only one transaction should have occurred 3. Additional charge(s) were unauthorized 4. Not separate valid transactions ### Evidence of Duplicate - Same amount - Same/similar date - Same merchant - Single purchase occasion ## Representment Options ### 1. Not a Duplicate **When to use:** - Two separate, valid transactions - Different items/services purchased - Different dates (days apart) - Cardholder made both purchases **Evidence required:** - Separate receipts for each transaction - Different items on each receipt - Proof cardholder participated in both - Transaction timestamps showing separation ### 2. One Charge Already Refunded **When to use:** - Duplicate was identified and refunded - Credit already processed for extra charge **Evidence required:** - Refund transaction details - Refund ARN - Date refund processed ### 3. Split Transaction **When to use:** - Large purchase split into multiple smaller charges - Disclosed to cardholder at time of purchase - Common for high-value items **Evidence required:** - Receipt showing split - Cardholder acknowledgment - Total matches purchase amount ### 4. Different Services/Products **When to use:** - Multiple charges for different things - Cardholder confused but both valid **Evidence required:** - Itemized receipts for each charge - Service dates (if different) - Order numbers (if different) ## Required Documentation | Evidence Type | Strength | |--------------|----------| | Separate receipts + different items | Strong | | Refund already processed | Strong | | Split transaction documentation | Medium-Strong | | Same receipt, different totals | Weak | ## Representment Time Frames | Stage | Window | |-------|--------| | Response | 30 days | | Pre-arbitration | 30 days | | Arbitration | 45 days | ## Prevention Strategies ### Technical Prevention 1. **Transaction IDs** - Unique identifier per transaction 2. **Duplicate detection** - Real-time at POS/gateway 3. **Batch review** - Check before settlement 4. **Timeout handling** - Proper retry logic 5. **Error recovery** - Don't resubmit blindly ### Process Prevention 1. **Single swipe/entry** - One entry per transaction 2. **Receipt verification** - Customer sees charge 3. **Confirmation screen** - Digital transactions 4. **Staff training** - Avoid accidental duplicates 5. **End-of-day review** - Catch before settlement ### Monitoring 1. **Duplicate alerts** - Flag same card, same amount 2. **Same-day review** - Multiple transactions review 3. **Batch analysis** - Look for patterns 4. **Exception reporting** - Investigate anomalies ## Technical Causes of Duplicates | Cause | Prevention | |-------|------------| | Timeout retry | Wait for response, don't auto-retry | | Double-click | Disable button after first click | | Batch resubmission | Mark processed batches | | Network hiccup | Implement idempotency | | Terminal error | Staff training on error handling | ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | Separate valid transactions | 65-80% | | Refund already issued | 80-95% | | Split transaction documented | 55-70% | | Cannot prove separate | Under 25% | ## Common Mistakes 1. **No duplicate detection** - Duplicates not caught 2. **Same receipt** - Can't show different transactions 3. **No unique IDs** - Hard to prove separation 4. **Slow refunds** - Customer files before credit 5. **Poor batch process** - Resubmitting settled items ## Distinguishing Duplicates from Legitimate ### Likely Duplicate - Same exact amount - Same day (within hours) - Single purchase scenario - Customer bought once ### Likely Separate Transactions - Different amounts - Different days - Different items - Customer returned/bought again ## Related Codes - 12.5 - Incorrect Amount - [13.1](/docs/reference/reason-codes/visa/13-1-not-received) - Not Received ## Next Steps **Got this chargeback?** 1. Compare transaction records โ†’ Are these truly different transactions? 2. Check if refund already issued โ†’ Already credited one? 3. Pull separate receipts/orders โ†’ Show different purchases 4. Respond within 30 days โ†’ [Representment Workflow](/docs/operations/representment-workflow) **Prevent future 12.6 chargebacks:** 1. Implement duplicate detection at POS/gateway 2. Add unique transaction IDs to all charges 3. Review batches before settlement 4. [Check operations checklist](/docs/operations/checklist) --- ## See Also - [POI Error Handling](/docs/payments) - [Reconciliation](/docs/operations) --- ## Visa 12.7 - Invalid Data Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/12-7-invalid-data # Visa 12.7 - Invalid Data :::info[TL;DR] - The transaction record had missing fields, bad formatting, a wrong MCC or a bad terminal ID - Dispute window is 120 days from the transaction date - You win by producing a complete, correctly formatted transaction record - This is an integration defect. Your developer fixes it, not your support team ::: Transaction contains **invalid or improperly formatted data** that caused processing issues. ## Overview Invalid data disputes occur when transaction records contain errors, missing fields, or formatting issues that prevent proper processing or create discrepancies. ## When This Code Applies - Missing required transaction fields - Improperly formatted data - Invalid merchant category code - Incorrect terminal identifier - Data integrity failures ## Conditions for Valid Dispute ### Issuer Must Verify 1. Transaction data is invalid or missing 2. Data issue caused incorrect processing 3. Cardholder was impacted ### Common Data Issues | Field | Issue | |-------|-------| | MCC | Wrong or invalid code | | Terminal ID | Mismatched or missing | | Transaction date | Wrong format or value | | Amount | Invalid format | | Card number | Formatting errors | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction date | ## Representment Options ### 1. Data Was Valid **Evidence required:** - Complete transaction record - All required fields present - Proper formatting - Processor confirmation ### 2. Data Issue Did Not Impact Cardholder **Evidence required:** - Transaction processed correctly - No financial harm - Cardholder received goods/services - Issue was technical only ### 3. Data Corrected **Evidence required:** - Original submission - Corrected resubmission - Processor acceptance - No duplicate processing ## Why This Happens ### Common Causes 1. **API integration errors** - Missing or malformed fields 2. **System migrations** - Data mapping issues 3. **Manual entry** - Incomplete information 4. **Terminal issues** - Hardware/software problems 5. **Third-party errors** - Gateway or processor issues ## Required Transaction Data ### Standard Required Fields | Field | Requirement | |-------|------------| | Card number | Valid, complete | | Expiration | MM/YY format | | Amount | Correct format, currency | | Date/time | Valid timestamp | | MCC | Valid 4-digit code | | Terminal ID | Assigned identifier | | Authorization code | From issuer approval | ### CNP-Specific Fields | Field | Requirement | |-------|------------| | CVV2 | If collected | | AVS | Address data | | 3DS | Authentication data | | IP address | Customer location | ## Prevention Strategies ### Technical Controls 1. **Validation before submission** - Check all fields 2. **Schema enforcement** - Reject malformed data 3. **Integration testing** - Verify data flows correctly 4. **Error handling** - Don't submit incomplete records ### System Configuration 1. **Correct MCC** - Verify with acquirer 2. **Valid terminal IDs** - Properly configured 3. **Date/time sync** - Accurate timestamps 4. **Currency codes** - ISO 4217 format ### Monitoring 1. **Rejection tracking** - Know when data fails 2. **Field validation** - Pre-submit checks 3. **Error alerting** - Quick notification 4. **Regular audits** - Review data quality ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Valid data proven | 85-95% | | No cardholder impact | 70-80% | | Data was indeed invalid | Under 15% | ## Common Mistakes 1. **No pre-submission validation** - Bad data gets through 2. **Wrong MCC code** - Impacts interchange and rules 3. **Missing required fields** - Causes rejections 4. **Timezone issues** - Date/time discrepancies ## Related Codes - 12.2 - Incorrect Transaction Code - 12.4 - Incorrect Account Number - 12.5 - Incorrect Amount ## See Also - [Authorization Basics](/docs/payments/reference/authorization-basics) - [Terminal Configuration](/docs/operations) - [Integration Best Practices](/docs/payments) --- ## Visa 13.1 - Merchandise/Services Not Received Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-1-not-received # Visa 13.1 - Merchandise/Services Not Received :::info[TL;DR] - The customer paid and never got the goods or the service - The clock starts at expected delivery, not at the sale. 120 days from expected delivery for physical goods and services, 120 from the transaction for digital - You win with signed delivery confirmation or carrier tracking showing delivery to the address on the order - Digital goods are the hard case. There's no carrier to point at, so log access timestamps and IP from day one ::: Used when the cardholder paid for merchandise or services that were never received. ## When This Code Applies - Physical goods never delivered - Digital goods not accessible - Services not performed - Order cancelled but not refunded - Merchant went out of business before delivery ## Cardholder Requirements Before filing, cardholder must: 1. **Wait for expected delivery date** - Can't file too early 2. **Attempt to contact merchant** - Good faith effort 3. **Allow reasonable time** - For delayed delivery 4. **Not receive the goods/services** - Or substantial portion ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Physical goods | 120 days from expected delivery date | | Services | 120 days from expected service date | | Digital goods | 120 days from transaction date | | Cancelled order | 120 days from cancellation | ### Calculating Expected Delivery - Merchant-stated delivery date, OR - Reasonable shipping time if not stated, OR - 15 days from transaction if no information ## Representment Options ### 1. Goods/Services Were Delivered **Requirements:** - Proof merchandise was delivered - Proof services were rendered - Delivery to correct address **Evidence:** - Signed delivery confirmation - Carrier tracking showing delivered - Proof of service completion - Customer signature on work order ### 2. Delivery Confirmation **For physical goods:** - Tracking number with delivery status - Signature confirmation (if obtained) - Photo proof of delivery - GPS coordinates of delivery **For digital goods:** - Download logs - Access timestamps - Email delivery confirmation - Account usage after purchase ### 3. Refund Was Issued When merchant already provided credit: - Refund transaction details - Date refund processed - Refund confirmation email ### 4. Cardholder Picked Up Goods For in-store pickup: - Signed pickup receipt - ID verification records - Store security footage (if available) - Pickup confirmation email ### 5. Services Were Rendered For service businesses: - Service completion documentation - Work orders signed by customer - Before/after photos - Appointment records with outcomes ## Required Documentation ### For Delivery Claims | Evidence Type | Strength | |--------------|----------| | Signed delivery + correct address | Strong | | Tracking delivered + correct address | Medium-Strong | | Tracking delivered + different address | Weak | | No tracking | Very Weak | ### For Service Claims | Evidence Type | Strength | |--------------|----------| | Signed service completion | Strong | | Work order + photos | Medium-Strong | | Appointment record only | Weak | | No documentation | Very Weak | ## Representment Time Frames | Stage | Window | |-------|--------| | Response to chargeback | 30 days | | Pre-arbitration | 30 days | | Arbitration | 45 days | ## Prevention Strategies ### Shipping Best Practices 1. **Always use tracking** - Every shipment 2. **Require signature** - For high-value orders 3. **Ship to verified address** - AVS match preferred 4. **Send shipping notifications** - With tracking links 5. **Insure valuable items** - Carrier liability ### Delivery Confirmation 1. **Photo proof** - Where carrier supports 2. **GPS confirmation** - Delivery location 3. **Recipient name** - Who signed 4. **Date/time stamps** - When delivered ### For Digital Goods 1. **Instant delivery** - Reduce wait time 2. **Download logging** - IP, timestamp, device 3. **Access confirmation** - Email with details 4. **Multiple delivery methods** - Email + account ### For Services 1. **Completion documentation** - Always get signature 2. **Before/after evidence** - Photos, videos 3. **Appointment confirmations** - Written records 4. **Follow-up communication** - "How did we do?" ## Win Rate Expectations | Evidence Type | Expected Win Rate | |--------------|------------------| | Signed delivery + AVS match | 70-85% | | Tracking delivered only | 50-65% | | Digital access logs | 55-70% | | Service completion signed | 65-80% | | No delivery proof | Under 20% | ## Common Mistakes 1. **No tracking** - Can't prove delivery without it 2. **Wrong address** - Shipped to different address 3. **Missing signature** - High value without confirmation 4. **Late response** - Missing 30-day window 5. **Insufficient logs** - Digital goods with no access proof ## Partial Delivery When only some items delivered: - Document what was delivered - Provide tracking for delivered items - Explain missing items (backorder, etc.) - Offer partial refund if appropriate ## Related Codes - 13.3 - Not as Described - 13.7 - Cancelled Merchandise ## Next Steps **Got this chargeback?** 1. Pull tracking info โ†’ Was it delivered? Get carrier confirmation 2. Check signature โ†’ Do you have signed proof of delivery? 3. Gather evidence โ†’ [Representment Workflow](/docs/operations/representment-workflow) 4. Respond within 30 days **Prevent future 13.1 chargebacks:** 1. Always use tracking on shipments 2. Require signature for orders over $100 3. Send proactive shipping updates with tracking links 4. [Set up dispute alerts](/docs/playbooks/setup-dispute-alerts) to catch early --- ## See Also - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Refund Fraud](/docs/fraud/types/refund-fraud) - Return abuse patterns - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [AVS & CVV](/docs/fraud/prevention/avs-cvv) - Address verification - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Mastercard 4853](/docs/reference/reason-codes/mastercard/cardholder-dispute) - MC equivalent - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Customer clarity - [Processor Management](/docs/operations/processor-management) - Dispute handling --- ## Visa 13.2 - Cancelled Recurring Transaction Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-2-cancelled-recurring # Visa 13.2 - Cancelled Recurring Transaction :::info[TL;DR] - The customer says they cancelled a subscription and you kept billing - Dispute window is 120 days from the disputed charge, and every recurring charge can be disputed separately - You win by proving no cancellation reached you, or that you billed before it did. Dated cancellation logs are the evidence - Cheapest prevention: cancel on the spot, confirm by email, stop billing the same day ::: Used when a cardholder claims they cancelled a recurring billing arrangement but continues to be charged. ## When This Code Applies - Subscription cancelled but charges continue - Free trial ended and charges began without clear consent - Recurring billing after account closure - Automatic renewal without proper notice - Charge after explicit cancellation request ## Cardholder Requirements Before filing, cardholder must: 1. **Notify merchant of cancellation** - Attempt to cancel 2. **Allow reasonable processing time** - For cancellation to take effect 3. **Keep proof of cancellation** - Confirmation emails, reference numbers 4. **Transaction must be recurring** - Not one-time charge ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from disputed transaction date | | Each charge | Can dispute each recurring transaction separately | ## Recurring Transaction Requirements ### Valid Recurring Setup Visa requires merchants to: 1. **Obtain explicit consent** - Clear agreement to recurring charges 2. **Disclose terms** - Amount, frequency, duration 3. **Provide confirmation** - Written record of agreement 4. **Easy cancellation** - Clear process to stop billing 5. **Cancellation confirmation** - Acknowledge when stopped ### Credential-on-File Indicators Proper coding required: - Transaction initiated as recurring - MIT (Merchant Initiated Transaction) flags - Original CIT reference included ## Representment Options ### 1. Cancellation Was Not Received **When to use:** - No record of cancellation request - Request went to wrong channel - Incomplete cancellation process **Evidence required:** - Cancellation policy - Communication logs (no cancellation found) - Account history showing active status ### 2. Transaction Before Cancellation **When to use:** - Charge occurred before cancellation request - Final billing cycle per terms - Prorated charge after cancellation **Evidence required:** - Cancellation request date/time - Transaction date/time - Terms showing billing timing ### 3. Terms Allow Post-Cancellation Charge **When to use:** - Terms disclose final charge after cancellation - Annual billing already processed - Service period not yet ended **Evidence required:** - Signed/accepted terms - Terms language re: cancellation - Billing cycle explanation ### 4. Cardholder Used Service After "Cancellation" **When to use:** - Access logs show continued use - Service benefits received - Account remained active **Evidence required:** - Login/access logs - Usage records - Account activity history ### 5. Refund Already Issued **When to use:** - Credit already processed - Pending refund in progress **Evidence required:** - Refund transaction details - Refund confirmation ## Required Documentation | Evidence Type | Strength | |--------------|----------| | No cancellation + usage logs | Strong | | Accepted terms + policy | Medium-Strong | | Transaction before cancel request | Strong | | Refund already processed | Strong | ## Representment Time Frames | Stage | Window | |-------|--------| | Response | 30 days | | Pre-arbitration | 30 days | | Arbitration | 45 days | ## Prevention Strategies ### Clear Terms and Consent 1. **Explicit opt-in** - No pre-checked boxes 2. **Terms clearly displayed** - Before purchase 3. **Amount and frequency** - Clearly stated 4. **Cancellation process** - Explained upfront 5. **Confirmation email** - With all terms ### Pre-Billing Notifications 1. **Reminder emails** - 7+ days before charge 2. **Include amount** - What will be charged 3. **Include date** - When charge will occur 4. **Easy cancellation link** - One-click unsubscribe 5. **Contact information** - How to reach support ### Easy Cancellation 1. **Same channel as signup** - Online signup = online cancel 2. **Self-service option** - Account portal cancellation 3. **Quick processing** - Honor immediately 4. **Confirmation** - Send cancellation receipt 5. **No dark patterns** - Don't make it difficult ### Documentation 1. **Log all communications** - Emails, calls, chats 2. **Record consent** - Timestamp and method 3. **Track cancellation requests** - With confirmation 4. **Maintain usage logs** - Prove service access ## Trial Conversions ### Best Practices 1. **Clear trial terms** - Duration, conversion date 2. **Conversion notice** - 7+ days before 3. **Opt-out option** - Easy to cancel before charge 4. **Confirmation at conversion** - Receipt email 5. **Explicit consent** - For conversion to paid ### Common Trial Issues | Issue | Prevention | |-------|------------| | No conversion notice | Send email 7 days before | | Surprise charge | Clear terms at signup | | Hidden billing | Transparent pricing | | Difficult cancellation | Easy self-service | ## Win Rate Expectations | Scenario | Expected Win Rate | |----------|------------------| | No cancellation record + usage | 60-75% | | Transaction before cancellation | 65-80% | | Accepted terms clearly shown | 45-60% | | Post-cancellation with notice | 40-55% | | No documentation | Under 20% | ## Common Mistakes 1. **No cancellation logs** - Can't prove no request received 2. **Difficult cancellation** - Drives chargebacks 3. **No pre-billing notice** - Surprises cardholders 4. **Poor terms display** - Can't prove consent 5. **Ignoring cancellations** - Guaranteed chargebacks ## Visa's Payment Cancellation Service Visa allows cardholders to request stops through their issuer: - Merchant receives cancellation notification - Must honor within 3 business days - Failure to honor = automatic chargeback ## Related Codes - [13.1](/docs/reference/reason-codes/visa/13-1-not-received) - Not Received - 13.6 - Credit Not Processed - 13.7 - Cancelled Merchandise ## Next Steps **Got this chargeback?** 1. Check cancellation records โ†’ Did you receive a cancellation request? 2. Check billing dates โ†’ Was transaction before or after cancellation? 3. Pull usage logs โ†’ Did customer continue using the service? 4. Respond within 30 days โ†’ [Representment Workflow](/docs/operations/representment-workflow) **Prevent future 13.2 chargebacks:** 1. Make cancellation as easy as signup 2. Send pre-billing reminders 7+ days before charge 3. Honor Visa's Payment Cancellation Service immediately 4. [Review subscription compliance](/docs/compliance/subscriptions/recurring-billing) --- ## See Also - [Recurring Billing Compliance](/docs/compliance/subscriptions/recurring-billing) - Subscription rules - [Reduce Chargebacks Playbook](/docs/playbooks/reduce-chargebacks-fast) - Crisis response - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - Billing fundamentals - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party disputes - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR deflection - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Descriptors and Communication](/docs/chargebacks/prevention/descriptors-and-comms) - Customer clarity - [Mastercard 4853](/docs/reference/reason-codes/mastercard/cardholder-dispute) - MC equivalent - [Time Frames](/docs/reference/time-frames) - Response deadlines - [Digital Wallets](/docs/payments/payment-methods/digital-wallets) - Tokenization benefits --- ## Visa 13.3 - Not as Described / Defective Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-3-not-as-described # Visa 13.3 - Not as Described / Defective :::info[TL;DR] - The customer got the item. They're saying it isn't what you sold, or it showed up broken - Visa expects them to contact you first. If they never did, lead with that - Your listing on the day of the sale is the evidence. Photos, specs, return policy - The window is 120 days. You get 30 days to answer ::: Your customer received the order and says it's wrong or broken. That's a 13.3. ## When This Code Applies - Product doesn't match the description - Wrong item shipped - Merchandise arrived defective - Service fell short of what you promised - Features or components missing - Counterfeit goods received ## Conditions for Valid Dispute The cardholder has to have received the goods, and to say what's wrong with them. They're also expected to try you first. Returns matter. If the item was returnable and they kept it, that's a hole in their case. ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction | | From delivery | 120 days from delivery date | ## Representment Options ### 1. Product Matched Description **Evidence required:** - Product listing and description at time of sale - Photos of the actual item - Specifications comparison - Proof nothing was defective ### 2. Cardholder Never Returned It **Evidence required:** - Return policy, clearly stated - Return instructions you sent - Proof they kept the merchandise - No return receipt ### 3. Refund Already Issued **Evidence required:** - Refund confirmation - Transaction showing the credit - Settlement records - Customer acknowledgment ### 4. Issue Resolved **Evidence required:** - Replacement sent - Repair completed - Credit issued - Customer confirmed the fix ### 5. As-Is or Final Sale **Evidence required:** - Clear disclosure of condition - No warranty terms - Cardholder acknowledgment - Policy shown in the checkout flow ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Product matches (with photos) | 60-75% | | No return attempted | 50-70% | | Refund already issued | 85-95% | | Description was accurate | 55-70% | | No evidence | Under 25% | ## Where This Breaks Most 13.3 losses trace back to the listing, not the dispute. Thin photos are the big one. Show three angles when the buyer expected six and you'll lose. Wrong dimensions count too. So does a color that reads differently on a screen. The rest is process. A hard return policy sends people straight to their bank. So does ignoring the first complaint email. Photograph what you ship, before you ship it. That habit wins more 13.3 cases than anything else here. ## For Digital Goods There's no package to return, so the argument shifts to use. Access logs, download records and login timestamps show they got what they paid for. Your terms of service help too, if they clicked to accept. Trials prevent more of these than any refund policy. People who tried it first don't dispute it. ## Related Codes - [13.1](./13-1-not-received.md) - Not Received - [13.2](./13-2-cancelled-recurring.md) - Cancelled Recurring - 13.4 - Counterfeit Merchandise - 13.5 - Misrepresentation ## Next Steps **Got this chargeback?** 1. Compare the listing to what shipped โ†’ Does it match? 2. Check for prior contact โ†’ Did they complain first? 3. Pull your photos of the shipped item 4. Respond within 30 days โ†’ [Representment Workflow](/docs/operations/representment-workflow) **Prevent the next one:** 1. Shoot more photos than you think you need 2. Photo-document every item before it ships --- ## See Also - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - [Refund Policy](/docs/chargebacks/refund-policy) - [Winning Evidence](/docs/chargebacks/representment/compelling-evidence) --- ## Visa 13.4 - Counterfeit Merchandise Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-4-counterfeit # Visa 13.4 - Counterfeit Merchandise :::info[TL;DR] - The customer says what you sold is fake. Not broken, not wrong, fake - This one carries risk past the chargeback. Brands sue, customs seizes, acquirers terminate - Your defense is paperwork from before the sale. Supplier invoices, license letters, serial numbers - The window is 120 days. No documentation means you lose ::: A customer got your product and says it's counterfeit. That's 13.4, and the disputed amount is the least of what you're risking. ## When This Code Applies - Product is alleged to be counterfeit - Item lacks authenticity markers - The brand says the item is fake - Product fails authenticity verification - Unauthorized reproduction of branded goods ## Conditions for Valid Dispute The cardholder claims the merchandise is fake. Usually they're expected to try you first, and they may also have to return the item. What they point at is predictable. Missing tags or certificates, quality that differs from genuine, packaging that doesn't match, serial numbers that don't check out. ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction | | From delivery | 120 days from delivery date | ## Representment Options Only one of these matters: the one you can document. Proof of authenticity wins most often, whether that's a certificate or a letter from the brand. Lead with it. ### 1. The Merchandise Is Genuine **Evidence required:** - Authenticity certificate - Proof of authorized distribution - Brand letter confirming authenticity - Documentation of purchase from the manufacturer - Serial number verification ### 2. You Never Claimed a Brand **Evidence required:** - Product listing with no brand claims - Generic description used - No trademark usage - Clear non-branded marketing ### 3. Licensed or Authorized Product **Evidence required:** - License agreement - Authorization letter from the brand - Authorized dealer documentation - Supply chain proof ### 4. Cardholder Never Returned It **Evidence required:** - Return instructions provided - No return received - Proof they kept the merchandise ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Authenticity certificate | 70-85% | | Authorized dealer proof | 65-80% | | Never claimed branded | 60-75% | | No documentation | Under 20% | No documentation means the fight isn't worth your hours. Take the loss and fix your sourcing. ## Where This Breaks You can't build this defense after the dispute lands. Either you kept the supplier invoice or you didn't. Grey market goods are the usual trap, because the item is real but you can't show a clean chain back to the manufacturer. Unknown suppliers cause the same problem for a worse reason. Listings cause the rest. Don't name a brand you can't document. "Inspired by" is a legal minefield, not a workaround. Photograph serial numbers and authenticity markers before the item ships, and keep every supplier invoice. That's the whole defense. ## Legal Considerations A counterfeit claim can cost more than the chargeback. Brands file trademark suits, customs seizes shipments and acquirers close accounts over it. If you can't document authenticity, stop selling the brand. Selling genuine branded goods? Get authorization documentation in writing, before you list. Getting counterfeit claims on goods you know are real? Contact the brand, because their letter is the strongest evidence you'll get. ## Related Codes - 13.3 - Not as Described - 13.5 - Misrepresentation - [13.1](./13-1-not-received.md) - Not Received ## See Also - [Brand Protection](/docs/fraud/types) - [Supply Chain](/docs/operations) - [Legal Compliance](/docs/reference) --- ## Visa 13.5 - Misrepresentation Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-5-misrepresentation # Visa 13.5 - Misrepresentation :::info[TL;DR] - The customer says you materially misled them about what they were buying - This sits a step above "not as described". It alleges you did it deliberately - Dispute window is 120 days from the transaction, or 120 days from when the customer discovered it - You win with the actual product page, the terms shown at checkout, and proof the customer saw them before paying ::: Cardholder claims the **transaction was misrepresented** in terms of product, service, or terms of sale. ## Overview Misrepresentation goes beyond "not as described" to allege the merchant intentionally or materially misled the cardholder about the nature of the transaction. ## When This Code Applies - False advertising claims - Hidden terms or conditions - Bait-and-switch allegations - Material omissions in description - Misleading pricing - Terms changed after agreement ## Conditions for Valid Dispute ### Cardholder Must 1. Show representation was materially false 2. Demonstrate reliance on representation 3. Show harm from misrepresentation ### Types of Misrepresentation | Type | Example | |------|---------| | Product | "New" was actually refurbished | | Service | "24/7 support" but no support available | | Pricing | Hidden fees not disclosed | | Terms | "Free trial" auto-converts to paid | | Origin | "Made in USA" was imported | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction | | From discovery | 120 days from discovering misrepresentation | ## Representment Options ### 1. No Misrepresentation Occurred **Evidence required:** - Original listing/advertisement - Terms clearly stated - All information accurate - No hidden conditions ### 2. Information Was Disclosed **Evidence required:** - Terms visible at checkout - Disclosure before purchase - Cardholder acknowledgment - Email confirmations with terms ### 3. Cardholder Continued Use **Evidence required:** - Used service after learning "truth" - Didn't cancel when could have - Accepted product/service - Usage logs ### 4. Terms Were Clear **Evidence required:** - Plain language terms - Conspicuous placement - Pre-purchase visibility - Confirmation of acceptance ## Prevention Strategies ### Pricing Transparency 1. **All-in pricing** - Show total including fees 2. **No hidden charges** - Disclose everything 3. **Clear currency** - State which currency 4. **Tax disclosure** - Before checkout ### Terms and Conditions 1. **Plain language** - No legal jargon 2. **Visible placement** - Not buried 3. **Checkbox acknowledgment** - Proof of acceptance 4. **Summary of key terms** - Highlight important items ### Product/Service Accuracy 1. **True descriptions** - Factual, not puffery 2. **Condition stated** - New, refurbished, used 3. **Origin disclosed** - Where made/from 4. **Limitations noted** - What it won't do ### Free Trials/Subscriptions 1. **Clear conversion terms** - When billing starts 2. **Reminder before charge** - Email before conversion 3. **Easy cancellation** - Simple process 4. **No dark patterns** - Honest UX ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Terms clearly disclosed | 65-80% | | Cardholder acknowledged | 60-75% | | No misrepresentation (with proof) | 55-70% | | Vague terms or hidden | Under 25% | ## Common Mistakes 1. **Buried terms** - Hiding important conditions 2. **Bait pricing** - Showing low price, charging more 3. **Dark patterns** - Deceptive UX design 4. **Automatic renewals** - Without clear disclosure 5. **Changed terms** - After cardholder agreed ## Legal Overlap Misrepresentation can involve: - Consumer protection law - FTC regulations - State consumer statutes - False advertising claims Chargebacks may be the least of concerns if practices are truly misleading. ## Related Codes - 13.3 - Not as Described - 13.4 - Counterfeit Merchandise - 13.6 - Credit Not Processed - [13.2](./13-2-cancelled-recurring.md) - Cancelled Recurring ## See Also - [Subscriptions & Recurring](/docs/payments/subscriptions-recurring) - [Checkout Conversion](/docs/payments/checkout-conversion) - [Compliance](/docs/reference) --- ## Visa 13.6 - Credit Not Processed Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-6-credit-not-processed # Visa 13.6 - Credit Not Processed :::info[TL;DR] - You promised a refund and the customer never got it - Dispute window is 120 days from the expected refund date, or 120 days from when your return was delivered - You win by showing the credit actually went out, with the refund transaction ID and date - Process refunds the day you agree to them. A slow refund turns into a chargeback plus a fee ::: Cardholder claims they were **promised a refund that was never received**. ## Overview This dispute occurs when a merchant agreed to issue a refund but the cardholder's account was never credited. Can also apply when a return was received but refund not issued. ## When This Code Applies - Refund promised but not issued - Return received, no credit processed - Cancellation refund not given - Partial refund missing - Credit delayed beyond reasonable time ## Conditions for Valid Dispute ### Cardholder Must 1. Have been promised a refund 2. Returned merchandise (if applicable) 3. Not received credit 4. Waited reasonable time ### Common Scenarios | Scenario | Issue | |----------|-------| | Return shipped | Merchant received, no refund | | Cancellation | Agreed to refund, not processed | | Partial refund | Promised $100, received $50 | | Service issue | Credit promised, never issued | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from expected refund date | | After return | 120 days from return delivery | ## Representment Options ### 1. Refund Was Issued **Evidence required:** - Credit transaction record - Settlement confirmation - Date credit processed - ARN (Acquirer Reference Number) - Statement showing credit ### 2. No Refund Was Owed **Evidence required:** - Return policy violation - Merchandise not returned - Outside return window - Condition/use disqualification ### 3. Return Not Received **Evidence required:** - Tracking showing no delivery - Warehouse receiving logs - Return label not used - Package not scanned ### 4. Partial Credit Appropriate **Evidence required:** - Restocking fee policy - Condition of return - Missing items - Agreed deductions ## Prevention Strategies ### Refund Processing 1. **Process promptly** - Within 3-5 business days 2. **Notify cardholder** - Email when refund processed 3. **Include ARN** - Reference number for tracking 4. **Follow up** - Confirm receipt ### Return Tracking 1. **Prepaid labels** - Easy tracking 2. **Scan on receipt** - Log when received 3. **Photo returned items** - Document condition 4. **Notify on receipt** - Tell customer you have it ### Communication 1. **Set expectations** - Timeline for refund 2. **Confirmation emails** - When refund processed 3. **Reference numbers** - For customer tracking 4. **Contact info** - If issues arise ### Record Keeping 1. **Return shipping proof** - Tracking numbers 2. **Refund transactions** - Full records 3. **Customer correspondence** - All communications 4. **Policy acknowledgments** - Terms accepted ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Refund issued (with proof) | 85-95% | | Return not received (tracking) | 70-85% | | No refund owed (policy) | 60-75% | | Refund delayed, now processed | 80-90% | ## Common Mistakes 1. **Slow refund processing** - Cardholder files before refund 2. **No notification** - Customer doesn't know refund processed 3. **Missing ARN** - Can't prove credit issued 4. **Different card** - Refund to wrong card 5. **No return tracking** - Can't prove return wasn't received ## Refund Best Practices ### Timing | Stage | Action | |-------|--------| | Return received | Process within 48 hours | | Cancellation | Process same day | | Service credit | Process within 24 hours | | Cardholder email | Send immediately after processing | ### Documentation Keep for every refund: - Original transaction - Return tracking (if applicable) - Refund transaction - ARN - Customer notification - Settlement confirmation ## Related Codes - [13.1](./13-1-not-received.md) - Not Received - [13.2](./13-2-cancelled-recurring.md) - Cancelled Recurring - 13.3 - Not as Described - 13.7 - Cancelled Merchandise/Services ## See Also - [Refund Policy](/docs/chargebacks/refund-policy) - [Refund Strategy](/docs/chargebacks/refund-strategy) - [Settlement & Reconciliation](/docs/payments/settlement) --- ## Visa 13.7 - Cancelled Merchandise/Services Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-7-cancelled-merchandise # Visa 13.7 - Cancelled Merchandise/Services :::info[TL;DR] - The customer cancelled before delivery and was charged anyway, or never refunded - Different from 13.2, which covers recurring subscriptions - Dispute window is 120 days from the transaction, or 120 days from the cancellation date - You'll win by showing the goods or services were already delivered before the cancellation landed ::: The cardholder **cancelled an order** and the charge stayed. Either it never got reversed, or it shipped after they'd already told you not to. ## Overview This one lands when a cardholder cancelled before the goods or services arrived and the charge wasn't reversed. It isn't 13.2: that code is for subscriptions, this one is for a single order. If you can't show delivery happened first, you don't have much of a case. ## When This Code Applies - Order cancelled before shipment - Service cancelled before delivery - Event/booking cancelled - Cancellation acknowledged but charged anyway - Deposit not refunded after cancellation ## Conditions for Valid Dispute ### Cardholder Must 1. Have cancelled the transaction 2. Cancelled before receiving goods/services 3. Not received refund for cancellation ### Timing Matters | Scenario | Likely Outcome | |----------|---------------| | Cancelled before shipment | Refund expected | | Cancelled after shipment | May need return first | | Non-refundable stated | Merchant may win | | Within cancellation window | Refund expected | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction | | From cancellation | 120 days from cancellation date | ## Representment Options ### 1. Services/Goods Already Delivered **Evidence required:** - Delivery confirmation - Service completion proof - Cancellation was after delivery - Tracking showing receipt ### 2. Cancellation Was After Cutoff **Evidence required:** - Cancellation policy - Cutoff timing - Cancellation request timestamp - Policy was disclosed ### 3. Non-Refundable Purchase **Evidence required:** - Clear non-refundable disclosure - Cardholder acknowledgment - Terms at checkout - Confirmation email with terms ### 4. Refund Was Issued **Evidence required:** - Credit transaction record - Settlement confirmation - ARN for cardholder to trace ### 5. No Cancellation Received **Evidence required:** - Communication logs - No cancellation request on file - System records - Email history ## Prevention Strategies ### Cancellation Policy 1. **Clear policy** - Visible before purchase 2. **Cutoff disclosed** - When cancellation is free 3. **Non-refundable items** - Clearly marked 4. **Acknowledgment required** - Checkbox or similar ### Cancellation Processing 1. **Confirm receipt** - Acknowledge cancellation request 2. **Process promptly** - Same day if possible 3. **Document everything** - Keep records 4. **Notify of outcome** - Confirm refund or denial ### Order Status 1. **Real-time updates** - Customer knows status 2. **Cancellation window** - Allow before shipment 3. **Easy cancellation** - Simple process 4. **Confirmation emails** - At each stage ### Non-Refundable Items 1. **Prominent disclosure** - Not hidden 2. **Multiple confirmations** - Checkout + email 3. **Valid reasons** - Custom, perishable, etc. 4. **Consider exceptions** - Good customer service ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | Already delivered | 70-85% | | Non-refundable (disclosed) | 60-75% | | Cancelled after cutoff | 55-70% | | Refund was issued | 85-95% | | No cancellation record | 50-65% | ## Common Mistakes 1. **Buried cancellation policy** - Not visible 2. **Slow cancellation processing** - Shipped anyway 3. **No confirmation** - The customer doesn't know if it worked 4. **Ignoring cancellation requests** - That's how you end up here 5. **Non-refundable hidden** - Disclosed too late ## Special Cases ### Events/Tickets - Often non-refundable - Must disclose clearly - Consider transfer options - Force majeure policies ### Travel/Hospitality - Cancellation windows vary - Deposits may be non-refundable - Clear policy required - Consider flexibility for loyalty ### Custom/Made-to-Order - Non-refundable often valid - Disclose before production - Offer modifications instead - Document customization ## Related Codes - [13.1](./13-1-not-received.md) - Not Received - [13.2](./13-2-cancelled-recurring.md) - Cancelled Recurring - 13.6 - Credit Not Processed ## See Also - [Refund Policy](/docs/chargebacks/refund-policy) - [Refund Strategy](/docs/chargebacks/refund-strategy) - [Checkout Conversion](/docs/payments/checkout-conversion) --- ## Visa 13.8 - Original Credit Transaction Not Accepted Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-8-original-credit # Visa 13.8 - Original Credit Transaction Not Accepted :::info[TL;DR] - They're owed a refund and the money never reached them. - Usually it went to a card that's been replaced or closed. - Best defense is matching last four digits. Same card in, same card out. - Dispute window is **120 days from the credit date**. ::: You issued the refund. It landed somewhere they can't get to it. ## Overview You refunded the sale, so you think you're done. The cardholder never saw the money. It went to a card that's been replaced, an account that's closed, or a different method entirely. ## When This Code Applies - You refunded a different card than the one they paid with - The card was replaced or closed after the sale - The credit went to an expired card number - The account can't accept credits at all - The refund went out by a method they never agreed to ## Conditions for Valid Dispute The cardholder has to clear three bars here. They can't get their hands on the credit. No one has paid them by another route. And the refund is genuinely owed to them. ### Common Scenarios | Scenario | Issue | |----------|-------| | Card replaced | Refund to old number | | Different card | Paid Visa, refunded MC | | Closed account | Card no longer active | | Fraud replacement | New card issued after fraud | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from credit date | ## Representment Options ### 1. Refund to Same Card - The last four digits from the original sale - The last four digits from the refund you sent - Proof that the two numbers are the same - A note telling the cardholder to call their issuer ### 2. Card Was Updated or Replaced You refunded the card on file and the network changed it under you. - Proof the refund went to the card on file - The Account Updater record showing when the number changed - Credits to the old card should route to the new one - Routing them is the issuer's job, not yours ### 3. Refund Was Received - A cardholder statement showing that the credit landed - Settlement confirmation from your processor showing the credit - The cardholder's own bank confirming they got it ### 4. Alternative Refund Arranged - Proof of the check, ACH or wire you sent - Store credit they accepted, confirmed in writing ## Why This Happens Nearly always, it's a card that moved on you. The customer swapped the one on file. Or the bank replaced it after fraud or expiry. Sometimes you had two cards stored and picked wrong. ## Prevention Strategies 1. **Refund to the same card by default**, as a system rule 2. **Alert on mismatch** when the refund card differs from the sale 3. **Keep Account Updater data current**, because stale numbers cause this 4. **Ask whether the card changed** on anything a few months old 5. **Confirm the refund in writing** with method, amount and date 6. **Offer a check or ACH** once the original card is gone ## Special Situations **Card replaced after fraud.** The new card should receive credits sent to the old one. Routing them is the issuer's job. Send your documentation anyway. Some of these need issuer-to-issuer resolution. **Closed accounts.** The credit just bounces back to the issuer. You'll need a check or ACH instead. Tell the customer before they work it out themselves. **Prepaid and gift cards.** Plenty of them won't accept credits at all. Check the terms first, then refund another way. ## Account Updater Impact Visa Account Updater refreshes stored card numbers automatically. It routes credits through to the new card. That helps. It also means the number you refunded isn't always the number you think. ## Win Rate Expectations These aren't promises. They're what each defense tends to be worth. | Defense Type | Expected Win Rate | |--------------|------------------| | Refund to same card (matched) | 80-90% | | Account Updater updated | 60-75% | | Alternative refund issued | 75-85% | | Wrong card refunded | Under 30% | ## Related Codes - 13.6 - Credit Not Processed, where no refund went out at all - 12.4 - Incorrect Account Number, where the sale hit the wrong card - [13.1](./13-1-not-received.md) - Not Received, the plain non-delivery code ## See Also - [Refund Policy](/docs/chargebacks/refund-policy) - Setting terms customers can live with - [Card on File](/docs/payments/subscriptions-recurring) - Storing and updating card data --- ## Visa 13.9 - Non-Receipt of Cash Source: https://paymentsandrisk.com/docs/reference/reason-codes/visa/13-9-non-receipt-cash # Visa 13.9 - Non-Receipt of Cash :::info[TL;DR] - The cardholder says they **never got the cash** from an ATM withdrawal, a cash advance, or cash-back at your register. - Two audiences here: ATM operators and retailers who hand out cash-back. The evidence differs. - Video plus a machine journal or a balanced drawer wins this. Nothing else reliably does. - Cardholder filing window: 120 days from the transaction. - Most of these are real machine failures, so check your own logs before you assume you're being worked. ::: The cardholder says the cash never arrived but the account got debited anyway. Covers ATM withdrawals, cash advances, and cash-back at the register. ## When This Code Applies - ATM never dispensed the cash - ATM dispensed a partial amount - Cash-back not received at POS - Machine error during withdrawal - Cash jammed or returned to the ATM ## Conditions for Valid Dispute ### Cardholder Must 1. Have attempted cash withdrawal 2. Not received cash (or partial) 3. Account was debited ### Transaction Types | Type | Scenario | |------|----------| | ATM | Cash not dispensed | | ATM | Partial dispense | | Cash-back | POS did not provide cash | | Cash advance | Cash not received | ## Time Frames | Scenario | Dispute Window | |----------|---------------| | Standard | 120 days from transaction | ## Representment Options ### 1. Cash Was Dispensed **Evidence required:** - ATM journal showing dispense - Cash cassette reconciliation - Video footage of transaction - No errors logged for transaction ### 2. ATM Balanced **Evidence required:** - End-of-day ATM balance - No shortage matching dispute - Cash cassette audit - Physical cash count ### 3. Cash-Back Given **Evidence required:** - POS register tape - Staff witness statement - Video footage - Drawer balanced at end of shift ## For ATM Operators ### Investigation Steps 1. Pull ATM journal for transaction 2. Check error logs for that time 3. Review cassette balancing 4. Check video footage 5. Compare to other claims ### Evidence to Preserve - Electronic journal - Sensor logs - Video recording - Cash cassette counts - Maintenance logs ### Common ATM Issues | Issue | Result | |-------|--------| | Jam during dispense | Cash returns to cassette | | Customer didn't take cash | ATM retracts after timeout | | Partial dispense | Some notes jammed | | Power failure | Transaction incomplete | ## For Retailers (Cash-Back) ### Investigation Steps 1. Review POS transaction log 2. Check register tape 3. Interview cashier 4. Check drawer balance 5. Review video if available ### Prevention 1. **Verify cash count** - Count in front of customer 2. **Confirmation** - Customer acknowledges receipt 3. **Drawer balance** - Track cash-back given 4. **Limits** - Cap cash-back amounts ## Win Rate Expectations | Defense Type | Expected Win Rate | |--------------|------------------| | ATM journal + video | 80-90% | | ATM balanced | 60-75% | | POS receipt + witness | 50-70% | | No evidence | Under 20% | ## Common Mistakes ### ATM Operators 1. **No video retention** - Footage deleted 2. **Poor journal records** - Incomplete data 3. **Late investigation** - Evidence lost 4. **No dispense confirmation** - System gaps ### Retailers 1. **No camera on register** - Can't prove cash given 2. **Drawer not tracked** - No cash-back log 3. **No witness** - One-on-one dispute 4. **No acknowledgment** - Customer didn't confirm ## Fraud Considerations Most of these are real machine failures. The rest split three ways: - Cardholder error - took the cash, forgot about it - Cardholder fraud - got the cash, disputes it anyway - Third-party fraud - someone else made the withdrawal Video is the only evidence that separates the three. Everything else is inference. ## Related Codes - [10.4](/docs/reference/reason-codes/visa/10-4-fraud-cnp) - Card Not Present Fraud - [11.2](/docs/reference/reason-codes/visa/11-2-declined-authorization) - Declined Authorization - [12.5](/docs/reference/reason-codes/visa/12-5-incorrect-amount) - Incorrect Amount ## Next Steps **Got this chargeback?** 1. Pull the journal or register tape โ†’ Does it show a completed dispense? 2. Check the end-of-day balance โ†’ Does a shortage match the disputed amount? 3. Pull the video before it ages out โ†’ Most systems overwrite inside 30 to 90 days 4. Respond within 30 days โ†’ [Representment Workflow](/docs/operations/representment-workflow) **Prevent future 13.9 chargebacks:** 1. Count cash-back into the customer's hand, out loud 2. Keep a camera pointed at the register and the ATM face 3. Reconcile cassettes and drawers daily, not weekly 4. Cap cash-back amounts --- ## See Also - [Terminal Operations](/docs/operations/terminal-operations) - POS and device handling - [Representment Workflow](/docs/operations/representment-workflow) - How to file the response - [Fraud Prevention](/docs/fraud/prevention) - Screening and controls - [Visa Reason Codes](/docs/reference/reason-codes/visa) - All Visa codes --- ## ACH Return Codes Source: https://paymentsandrisk.com/docs/reference/return-codes/ach # ACH Return Codes :::info[TL;DR] - ACH return codes tell you why a bank transfer failed and whether you're allowed to retry - R01 insufficient funds is the common one worth retrying. Wait 2-3 days - R02 account closed, R03 no account found and R10 customer unauthorized are terminal. Stop and fix the underlying data - R10 is the ACH equivalent of a fraud chargeback. Investigate it, don't just re-run the debit - NACHA caps you at 0.5% unauthorized returns, 3.0% administrative and 15% overall. Blow the 0.5% and you can lose ACH origination entirely ::: A bank pushed your debit back and handed you a code. It tells you why, and whether you're allowed to try again. Get that second part wrong and NACHA starts counting. Most returns are boring account problems you can fix. A few mean stop, and those are the ones that cost you ACH. ## Quick Reference: Most Common Returns | Code | Name | Retry? | Action | |------|------|--------|--------| | **R01** | Insufficient Funds | Yes (2-3 days) | Wait and retry | | **R02** | Account Closed | No | Request new account | | **R03** | No Account Found | No | Verify account info | | **R10** | Customer Unauthorized | No | Stop immediately, investigate | | **R20** | Non-Transaction Account | No | Request different account | --- ## Administrative Returns (R01-R17) These are account and routing problems, and most of them are fixable. Correct the details or wait for the funds and the debit usually clears next time. One on its own isn't a fraud signal. A pattern of them is. | Code | Description | Retry? | Typical Cause | Action | |------|-------------|--------|---------------|--------| | **R01** | Insufficient Funds | Yes* | Balance too low | Retry in 3-5 days (payday timing) | | **R02** | Account Closed | No | Account no longer exists | Request new account from customer | | **R03** | No Account/Unable to Locate | No | Wrong account number | Verify and correct account info | | **R04** | Invalid Account Number | No | Malformed account number | Correct account number format | | **R05** | Unauthorized Debit (consumer) | No | Customer disputes authorization | Stop debits, investigate | | **R06** | Returned per ODFI's Request | Maybe | Bank-initiated return | Contact your bank for details | | **R07** | Authorization Revoked | No | Customer canceled permission | Stop debits, obtain new auth | | **R08** | Payment Stopped | No | Customer issued stop payment | Contact customer directly | | **R09** | Uncollected Funds | Yes* | Check deposited, not yet cleared | Retry in 5-7 days | | **R10** | Customer Advises Not Authorized | No | Disputes authorization | Stop immediately, investigate | | **R11** | Check Truncation Entry Return | No | Check conversion issue | Process/technical problem | | **R12** | Branch Sold to Another DFI | No | Bank merger/sale | Update routing number | | **R13** | Invalid ACH Routing Number | No | Routing number doesn't exist | Correct routing number | | **R14** | Representative Payee Deceased | No | Account representative died | Update account | | **R15** | Beneficiary/Account Holder Deceased | No | Account holder died | Account must be closed | | **R16** | Account Frozen | No | Legal hold on account | Customer must resolve with bank | | **R17** | File Record Edit Criteria | No | ACH file formatting error | Fix technical submission | *Retry with appropriate delay (3-5 business days minimum, after funds expected) --- ## Unauthorized Returns (R05, R07, R10, R29) **Critical:** These aren't administrative problems, they're accusations. Too many and your ODFI can pull your ACH origination. ### Consumer ACH Authorization Disputes | Code | Description | Window | What Happened | |------|-------------|--------|---------------| | **R05** | Unauthorized Debit Entry | 60 calendar days | Customer says they never authorized | | **R07** | Authorization Revoked | 60 calendar days | Customer canceled recurring authorization | | **R10** | Customer Advises Not Authorized | 60 calendar days | Customer disputes authorization | ### Corporate ACH Authorization Disputes | Code | Description | Window | What Happened | |------|-------------|--------|---------------| | **R29** | Corporate Customer Advises Not Authorized | 2 banking days | Business customer disputes | ### Handling Unauthorized Returns 1. **Stop all debits immediately.** Don't retry. Ever. 2. **Review your authorization records:** - Do you have signed ACH authorization? - Did customer consent via web/phone? - Is the authorization date before the transaction? 3. **Investigate the customer:** - First transaction or established? - Other returns in history? - Fraud pattern indicators? 4. **Document everything** - you'll want the authorization, the timestamps, the whole trail 5. **Respond to the ODFI** if they ask for records 6. **Update your fraud rules** if you see a pattern ### Unauthorized Return Prevention | Prevention | Implementation | |------------|----------------| | **Prenotes** | Send $0 verification before first debit | | **Micro-deposits** | Verify account ownership with small deposits | | **Bank verification APIs** | Instant account validation (Plaid, MX, etc.) | | **Clear authorization language** | Explicit consent, saved and timestamped | | **Email confirmation** | Send receipt immediately after authorization | --- ## Extended Returns (R20-R39) | Code | Description | Retry? | Notes | |------|-------------|--------|-------| | **R20** | Non-Transaction Account | No | Savings account with transaction limits | | **R21** | Invalid Company Identification | No | Fix your company ID in file | | **R22** | Invalid Individual ID Number | No | Fix customer ID in record | | **R23** | Credit Entry Refused by Receiver | No | Customer refused incoming payment | | **R24** | Duplicate Entry | No | Already processed this transaction | | **R25** | Addenda Error | No | Fix addenda record format | | **R26** | Mandatory Field Error | No | Required field missing/invalid | | **R27** | Trace Number Error | No | Fix trace number | | **R28** | Routing Number Check Digit Error | No | Last digit of routing number wrong | | **R29** | Corporate Customer Advises Not Authorized | No | Corporate unauthorized (2-day window) | | **R30** | RDFI Not Participant in Check Truncation | No | Bank doesn't support this | | **R31** | Permissible Return Entry | Maybe | CCD/CTX specific return | | **R32** | RDFI Non-Settlement | No | Bank settlement issue | | **R33** | Return of XCK Entry | No | Check conversion return | | **R34** | Limited Participation DFI | No | Bank has restrictions | | **R35** | Return of Improper Debit Entry | No | Wrong SEC code for debit | | **R36** | Return of Improper Credit Entry | No | Wrong SEC code for credit | --- ## Return Timeframes ### Standard ACH | Return Category | Window | From When | |-----------------|--------|-----------| | **Administrative (R01-R04, etc.)** | 2 banking days | Settlement date | | **Unauthorized Consumer (R05, R07, R10)** | 60 calendar days | Settlement date | | **Unauthorized Corporate (R29)** | 2 banking days | Settlement date | | **Extended (most R20-R39)** | 2 banking days | Settlement date | ### Same-Day ACH Returns Same-Day ACH compresses everything. You're down to end of day, or the next banking day on the late window. | Settlement Window | Return Deadline | |-------------------|-----------------| | **10:30 AM ET** | End of day | | **2:45 PM ET** | End of day | | **4:45 PM ET** | Next banking day | --- ## Retry Strategies ### When to Retry | Return Code | Retry Recommended? | Optimal Wait Time | |-------------|-------------------|-------------------| | **R01 (NSF)** | Yes (limited times) | 3-5 business days, align with payday | | **R09 (Uncollected)** | Yes | 5-7 business days | | **R02-R04** | No | Correct info first | | **R05, R07, R10** | Never | Don't retry | | **R16 (Frozen)** | Maybe | After customer confirms resolved | ### NACHA Retry Rules | Rule | Requirement | |------|-------------| | **Max retries for NSF** | 2 retries per debit (3 total attempts) | | **Same amount** | Retry must be for original amount | | **Timing** | At least 2 business days between attempts | | **Consumer notification** | Required if retry fee charged | ### Smart Retry Timing | Strategy | When to Use | |----------|-------------| | **Payday alignment** | Retry on 1st, 15th of month | | **End of week** | Friday afternoon (deposits cleared) | | **Customer confirmation** | Ask customer to confirm funds available | | **Staggered retry** | Day 3, then Day 7 if still failing | ### Retry Decision Tree ```mermaid flowchart TD A[R01 Return Received] --> B{Which attempt?} B -->|First| C[Wait 3-5 days] C --> D[Retry] B -->|Second| E[Confirm with customer] E -->|Confirmed| D E -->|Not confirmed| F[Request alternative payment] B -->|Third| F style A fill:#f59e0b,color:#fff style D fill:#10b981,color:#fff style F fill:#ef4444,color:#fff ``` --- ## Fraud Indicators ### High-Risk Return Patterns | Pattern | Risk Level | What It Suggests | |---------|------------|------------------| | **Multiple R10s from same account** | Critical | Authorization fraud or dispute abuse | | **R02/R03 after prior success** | High | Account takeover or closed in panic | | **R05 after legitimate pattern** | Medium | Friendly fraud or buyer's remorse | | **Velocity of R01s** | Medium | Financial stress or testing accounts | | **New account + immediate return** | High | Fraudulent account linkage | ### Red Flags - First transaction returns R10 (never authorized) - Same bank info used across multiple accounts - Returns after long dormancy - Pattern of small tests then large returns - Customer provides incorrect info multiple times ### Fraud Response | Indicator | Action | |-----------|--------| | **First R10 ever** | Investigate, may be one-off | | **Second R10 same customer** | Block customer | | **R10 + other fraud signals** | Block immediately, investigate | | **Pattern across customers** | Check for common vector | --- ## ACH Return Fee Liability Every return costs somebody a fee. R01 usually lands on the customer. The rest you're eating. ### Fee Structure by Return Type | Return Type | Your Fee | Customer Impact | Who Typically Pays | |-------------|----------|-----------------|-------------------| | **R01 (NSF)** | $2-15 ODFI fee | May incur bank fee | Usually passed to customer | | **R02/R03 (Account issues)** | $2-15 ODFI fee | None | Merchant absorbs | | **R10 (Unauthorized)** | $5-25 + potential penalties | Refund issued | Merchant absorbs | | **R29 (Corp unauthorized)** | $5-25 ODFI fee | Refund issued | Merchant absorbs | ### Fee Sources | Fee Type | Who Charges | Range | |----------|-------------|-------| | **ODFI return fee** | Your bank | $2-15 per return | | **Processor return fee** | Your processor | $0-10 per return | | **NACHA violation penalty** | NACHA (via ODFI) | $5-100+ for rule violations | | **Excessive return fee** | ODFI/NACHA | Triggered above thresholds | ### NACHA Return Rate Thresholds | Return Category | Threshold | Consequence | |-----------------|-----------|-------------| | **Overall unauthorized (R05/R07/R10/R29)** | > 0.5% | ODFI notification, potential action | | **Administrative** | > 3.0% | ODFI notification | | **Overall return rate** | > 15% | Potential origination suspension | **Critical:** Cross 0.5% unauthorized and you can lose ACH origination. That's not a fine you pay, that's ACH switched off. ### Passing Fees to Customers | Consideration | Guidance | |---------------|----------| | **R01 (NSF) fees** | Often passed to customer; check state law | | **R10 (Unauthorized) fees** | Never pass to customer; you're at fault | | **Disclosed in terms** | Fee passing must be disclosed upfront | | **State law limits** | Some states cap NSF fee pass-through | | **Customer relationship** | First-time courtesy waiver builds goodwill | ### Fee Mitigation Strategies | Strategy | Impact | |----------|--------| | **Pre-validation** | Reduce R01-R04 with account verification | | **Clear authorization** | Reduce R10/R29 with strong consent | | **Smart retry timing** | Retry R01 at strategic times (paydays) | | **Customer notification** | Contact before retry to confirm funds | | **Account update prompts** | Proactive requests when issues appear | --- ## Same-Day ACH Considerations Same-Day ACH mostly reuses the same return codes. What's different is the speed and the per-transaction ceiling. ### Same-Day ACH Return Codes | Scenario | Return Code | |----------|-------------| | **RDFI doesn't support same-day** | R31 (Permissible Return Entry) | | **Same-day rejected** | Original code + same-day indicator | ### Same-Day ACH Limits | Limit | Amount | |-------|--------| | **Per-transaction limit** | $1,000,000 | | **Return window** | Same day or next banking day | ### When Same-Day ACH Returns Faster Same-day ACH can return the same business day for: - Insufficient funds - Account issues - Format errors **Operational impact:** You can know the same day instead of waiting 2+ days. That's days back to chase the customer. --- ## Account Validation Best Practices The cheapest return is the one you never get. Validate the account before you debit it. ### Pre-Transaction Validation | Method | What It Checks | R Codes Prevented | |--------|----------------|-------------------| | **Prenote** | Account exists, accepts debits | R02, R03, R04, R13 | | **Micro-deposits** | Account active, customer has access | R02, R03, ownership | | **Bank verification API** | Account status, ownership | R02, R03, R20 | | **Balance check** | Available balance | R01 (not guaranteed) | ### Validation Trade-offs | Method | Cost | Speed | Coverage | |--------|------|-------|----------| | **Prenote** | Free | 3-4 days | Limited | | **Micro-deposits** | ~$0.05 | 2-3 days | Good | | **Instant verification** | $0.10-0.50 | Instant | Best | --- ## SEC Codes and Returns Your SEC (Standard Entry Class) code sets how long the customer has to dispute. That's 60 days on consumer codes and 2 banking days on corporate. | SEC Code | Use Case | Unauthorized Window | |----------|----------|---------------------| | **PPD** | Personal (recurring) | 60 days | | **WEB** | Web-initiated | 60 days | | **TEL** | Telephone-initiated | 60 days | | **CCD** | Corporate | 2 days (R29) | | **CTX** | Corporate trade exchange | 2 days | **Using wrong SEC code:** Can result in R35 (Improper Debit) or R36 (Improper Credit). --- ## Reporting and Monitoring ### Key Metrics to Track | Metric | Target | Action If Exceeded | |--------|--------|-------------------| | **Overall return rate** | < 3% | Investigate patterns | | **Unauthorized return rate** | < 0.5% | Critical: immediate action | | **R01 rate** | < 2% | Review customer quality | | **R10 rate** | < 0.25% | Review authorization process | ### Monthly ACH Health Report Track monthly: - Total return count and rate - Return breakdown by code - Unauthorized return rate - Top returning accounts - Return trend (improving/worsening) --- ## Scale Callout Your ACH volume decides what's worth building here. | ACH Volume | Focus | |------------|-------| | **Under $50k/mo** | Use basic validation. Watch unauthorized rate. | | **$50k-$250k/mo** | Implement instant verification. Track metrics monthly. | | **$250k-$1M/mo** | Optimize retry logic. Automate monitoring. | | **Over $1M/mo** | Advanced fraud rules. Dedicated ACH operations review. | --- ## Next Steps **New to ACH returns?** 1. [Learn ACH operations](/docs/operations/ach-operations) - Bank payment management fundamentals 2. [Understand bank transfers](/docs/payments/payment-methods/bank-transfers) - ACH fundamentals and risk **Reducing return rates?** 1. [Implement identity verification](/docs/fraud/detection/identity-verification) - Account validation methods 2. [Set up velocity rules](/docs/fraud/detection/velocity-rules) - Pattern detection for fraud prevention **Investigating unauthorized returns?** 1. [Review Regulation E](/docs/compliance/consumer-protection/reg-e) - Consumer protection requirements 2. [Understand first-party fraud](/docs/fraud/types/first-party) - Authorization fraud patterns 3. [Check AML basics](/docs/compliance/aml-basics) - Compliance requirements --- ## Related Pages - [Bank Transfers](/docs/payments/payment-methods/bank-transfers) - ACH fundamentals and fraud - [FX and Settlement](/docs/payments/reference/fx-and-settlement) - Cross-border considerations - [Fraud Detection](/docs/fraud/detection) - Fraud monitoring - [Operations](/docs/operations) - Payment operations - [Real-Time Payments](/docs/payments/payment-methods/real-time-payments) - RTP/FedNow alternatives - [Payments Metrics](/docs/payments/metrics) - Success rate tracking - [Identity Verification](/docs/fraud/detection/identity-verification) - Account validation - [Velocity Rules](/docs/fraud/detection/velocity-rules) - Pattern detection - [First-Party Fraud](/docs/fraud/types/first-party) - Authorization fraud patterns - [Decline Codes](/docs/reference/decline-codes) - Card decline comparison - [AML Basics](/docs/compliance/aml-basics) - Compliance requirements - [Processor Management](/docs/operations/processor-management) - Bank relationships --- ## Chargeback Time Frames Source: https://paymentsandrisk.com/docs/reference/time-frames # Chargeback Time Frames :::info[TL;DR] - Miss a deadline and you lose automatically. There's no appeal for a late response - Representment windows: Visa 30 days, Mastercard 45, Amex 20, Discover 30 - Cardholders get 120 days to dispute on every network. Issuers get 120 days to file, except Mastercard at 90 - Pre-arbitration and arbitration are 30 and 45 days on Visa and Mastercard. **Amex and Discover don't run those stages**, so there's no window to miss - Regional variations exist. Check the tables below before you assume the US numbers apply ::: **Missing a deadline means automatic loss.** This reference covers all networks and regional variations. --- ## Quick Reference ### Standard Time Frames (US/Global) | Stage | Visa | Mastercard | Amex | Discover | |-------|------|------------|------|----------| | Cardholder to dispute | 120 days | 120 days | 120 days | 120 days | | Issuer chargeback | 120 days | 90 days | 120 days | 120 days | | Representment | 30 days | 45 days | 20 days | 30 days | | Pre-arbitration | 30 days | 30 days | No such stage | No such stage | | Arbitration | 45 days | 45 days | No such stage | Exists, window not published | **The Amex and Discover columns used to say 45 days.** They were wrong, and the number was borrowed from Visa. Neither closed-loop network runs the open-loop escalation ladder. Amex's own dispute chapter goes representment, then re-dispute, then done. There's no pre-arbitration and no arbitration in it. If the cardholder brings new information, Amex reinvestigates and asks you for more (_Merchant Reference Guide - U.S._, section 11.9). Amex decides. That's the end of it. Discover has arbitration but no pre-arbitration. The procedures live in its Dispute Rules, which aren't public, so the filing window isn't a number anyone outside can quote. Ask your acquirer. :::tip[Using This Table] **Got a chargeback?** Check your representment window above, then see [Representment Guide](/docs/chargebacks/representment) for how to respond and [Compelling Evidence](/docs/chargebacks/representment/compelling-evidence) for what to submit. **Approaching a deadline?** Use the [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) playbook for emergency steps. ::: --- ## Mastercard Time Frames ### Chargeback Filing Windows | Region | Standard Codes | ATM/Maestro | |--------|---------------|-------------| | Global (default) | 90 calendar days | 90 calendar days | | Europe (ATM/Maestro) | 120 calendar days | 120 calendar days | | Mainland China domestic | 5-90 calendar days | N/A | ### Second Presentment (Representment) Windows :::danger[Critical Regional Differences] Mastercard representment windows vary **dramatically** by region. Missing these can result in automatic loss. ::: | Region | Window | Notes | |--------|--------|-------| | **Standard** | 45 calendar days | From chargeback settlement | | **Costa Rica domestic** | 10 calendar days | From Central Site Business Date | | **Kazakhstan domestic** | 30 calendar days | From Central Site Business Date | | **Mainland China domestic** | 30 calendar days | From settlement date | | **Nigeria domestic** | **2 business days** | โš ๏ธ Extremely short! | | **Tanzania domestic** | 20 calendar days | From Central Site Business Date | ### Pre-Arbitration Windows | Region | Window | |--------|--------| | Standard | 30 calendar days | | Costa Rica domestic | 10 calendar days | | Tanzania domestic | 10 calendar days | ### Documentation Submission Windows After receiving chargeback/representment, how long to provide supporting documents: | Transaction Type | Window | |-----------------|--------| | Standard | 8 calendar days | | ATM/Maestro | 10 calendar days | | Costa Rica domestic | 3 calendar days | | Tanzania domestic | 4 calendar days | ### Arbitration Windows | Region | Window | |--------|--------| | Standard | 45 calendar days from pre-arbitration response | | ATM/Maestro (Europe) | 75 calendar days from second presentment | --- ## Visa Time Frames ### By Dispute Category | Reason Code Category | Chargeback Window | |---------------------|-------------------| | 10.x (Fraud) | 120 days from transaction or delivery | | 11.x (Authorization) | 120 days from transaction | | 12.x (Processing Errors) | 120 days from transaction | | 13.x (Consumer Disputes) | 120 days from transaction or expected delivery | ### Special Situations | Situation | Time Frame | |-----------|------------| | Merchandise not received | 120 days from **expected delivery date** | | Services not rendered | 120 days from **expected service date** | | Recurring billing | 120 days from **transaction date** | | Delayed delivery | 120 days from **actual delivery date** | ### Visa Response Windows | Stage | Window | Notes | |-------|--------|-------| | Chargeback response | 30 calendar days | From chargeback date | | Pre-arbitration response | 30 calendar days | From pre-arb filing | | Arbitration filing | 45 calendar days | From pre-arb response | --- ## American Express Time Frames ### Inquiry vs. Chargeback Amex often sends **inquiries** before chargebacks: | Stage | Window | Consequence | |-------|--------|-------------| | Inquiry response | **20 calendar days** | Non-response = auto chargeback | | Chargeback response | **20 calendar days** | Non-response = loss | | Documentation | **10 calendar days** | When requested | ### Dispute Windows | Type | Window | |------|--------| | Fraud | 120 days from transaction | | Service/Merchandise | 120 days from expected delivery | | Processing errors | 120 days from transaction | --- ## Discover Time Frames ### Retrieval Requests Discover sends retrieval requests before some chargebacks: | Stage | Window | |-------|--------| | Retrieval response | 14 calendar days | | Chargeback response | 30 calendar days | | Second chargeback | 30 calendar days | --- ## Calculating Day Zero Understanding when the clock starts is critical: ### Mastercard - **Settlement Date**: Present in DE 15 of clearing message - **Central Site Business Date**: Present in PDS 0158, subfield 5 - Day zero = the date being counted **FROM** (exclusive) ### Visa - **Transaction Date**: Date the transaction occurred - **Delivery Date**: Date goods were delivered (if applicable) - Day zero = event date (exclusive) ### Example Calculation ``` Transaction Date: January 1 Chargeback Filed: March 15 (Day 73) Representment Due: April 14 (30 days later) Timeline: Jan 1 โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Mar 15 โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€ Apr 14 Transaction Chargeback Response Filed Due ``` --- ## Calendar Days vs. Business Days | Network | Standard | Exceptions | |---------|----------|------------| | Mastercard | Calendar days | **Nigeria = business days** | | Visa | Calendar days | None | | Amex | Calendar days | None | | Discover | Calendar days | None | ### Business Day Definition (Nigeria) - Monday through Friday - Excludes Nigerian public holidays - Bank holidays count as non-business days --- ## Hardship Variances ### Mastercard Hardship Variances During natural disasters or severe operational difficulties: - Mastercard may grant time frame extensions - Announced via network bulletins - Removes time frame edits for specific period - **Not supported in Single Message System** ### Visa Business Continuity - Similar provisions for major disruptions - Contact Visa directly - Documentation of business impact required --- ## Authorization to Clearing Deadlines Two different rules get called by the same name, and merchants pay for the confusion. Mastercard runs two clocks: a presentment deadline and a separate chargeback protection period tied to message reason code 4808. They carry identical numbers today, so people treat them as one rule. They're not, and they can diverge. Visa used to run two clocks as well. Since 13 April 2024 it runs one. Authorization validity and the clearing deadline were merged into a single authorization-to-clearing timeframe. "How long is my auth good for" and "when do I have to clear by" are now the same question with the same answer. **Count in calendar days, always.** Every number below is calendar days on all three networks. Visa and Mastercard count from the authorization approval date, not the transaction date. Weekends and holidays are inside the window. Nothing here uses business days. ### Mastercard: message reason code 4808 chargeback protection period | Authorization Type | Window | |-------------------|--------| | Preauthorizations | 30 calendar days | | Final auth (India domestic) | 4 calendar days | | Final auth (all other) | 7 calendar days | | Deferred authorizations | 7 calendar days | | Undefined authorizations | 7 calendar days | | Refund transactions | 5 calendar days | *Source: Mastercard Transaction Processing Rules, 9 December 2025, sections 2.5.1, 2.6, 2.7, 2.8 and 2.9. India's 4 days took effect 3 April 2024. The 5-day refund period took effect 12 April 2024. Costa Rica final authorizations get 30 calendar days for presentment.* Mastercard splits by authorization type, not by channel. There's no card-present versus card-not-present table here because Mastercard doesn't write one. The 30 days only applies if the message was flagged as a preauthorization. Being a hotel isn't enough. You can extend the clock. Submit an additional preauthorization for the same transaction, even a zero-amount one, and the 4808 period restarts (section 2.9). Let it expire and the authorization isn't stale, it's gone. Section 2.8 says the approved amount of an authorization with an expired 4808 period "is deemed to be zero." Capture on day 8 against a 7-day final auth and Mastercard treats you as never having authorized at all. ### Visa: authorization-to-clearing timeframe | Authorization Type | Window | |-------------------|--------| | Card-not-present, cardholder-initiated | 10 calendar days | | Card-present, all other | 5 calendar days | | All merchant-initiated (recurring, installment, unscheduled COF, advance payment) | 5 calendar days | | Card-not-present with the extended authorization indicator | 30 calendar days | | Cruise line, lodging, vehicle rental with the estimated authorization indicator | 30 calendar days | | Smaller rental MCCs with the estimated authorization indicator | 10 calendar days | | Automated Fuel Dispenser preauthorization | 2 hours | *Source: Visa Core Rules and Visa Product and Service Rules, 18 October 2025, section 5.7.3.5, Table 5-11. This structure took effect 13 April 2024.* The fuel number is hours, not days. An AFD preauthorization needs a completion message or a reversal within 2 hours of the approval response. Not all rentals are equal. Cruise, lodging and vehicle rental get 30 days. Aircraft, bicycle and e-scooter, boat, clothing and costume, DVD and video, equipment and tool, furniture, motor home, motorcycle, and trailer parks and campgrounds get 10. **Incremental authorization does not extend any Visa window.** The rule says so outright: "An Incremental Authorization Request does not extend the processing timeframes." That's the exact opposite of Mastercard. If your hotel or rental software sells incremental auths as a way to hold longer, it works on Mastercard and does nothing on Visa. On Visa the only route to 30 days is the right indicator on the original authorization. Visa's Table 5-12 carries country-specific overrides for India, Japan, Malaysia, Nepal and Argentina. If you process in those markets, get the current numbers from your acquirer. Miss the window and the issuer disputes under [Condition 11.3 No Authorization/Late Presentment](/docs/reference/reason-codes/visa/11-3-no-authorization). Visa retired [Condition 12.1 Late Presentment](/docs/reference/reason-codes/visa/12-1-late-presentment) on 12 April 2024 and folded it into 11.3. ### Amex One number, no channel split. An authorization approval is valid for 7 days, and that same 7 days is the submission window. The exception is lodging, cruise line and vehicle rental on estimated charge amounts. There the authorization stays valid for the life of the stay or the rental agreement. That's open-ended, not a fixed 30 days. *Source: American Express Merchant Reference Guide - U.S., section 5.4 "Authorization Time Limit."* ### Discover: nobody publishes a current number Discover doesn't publish a current edition of its Merchant Operating Regulations. The last public full edition is Release 11.1 from 2011, which set 30 calendar days of validity and 10 calendar days to submit sales data. Those numbers are more than a decade old, and processors enforce far shorter windows in practice. Get your Discover window from your acquirer in writing. Anyone printing a current Discover number is guessing. ### Your processor's window is not the network's window Processors set their own limits inside the network limits, and theirs are usually shorter. Stripe caps Visa at 4 days and 18 hours where Visa allows 5, and caps card-present Mastercard, Amex and Discover at 2 days where the networks allow 7. Stripe's own footnote explains why: "to allow time for clearing processes." That's a reasonable buffer and you should plan to it. But know which wall you're hitting. A merchant who needs day 6 on a card-present Mastercard isn't asking for something the network prohibits. They're asking their processor to change a setting. One is a fulfillment rebuild, the other is one email. --- ## Best Practices ### Track Deadlines Religiously 1. **Use dispute management system** - Automated tracking 2. **Set alerts** - 7 days, 3 days, 1 day before due 3. **Document receipt dates** - When did you receive notice? 4. **Build in buffer time** - Never wait until last day ### Account for Time Zones - Networks operate on specific time zones - 11:59 PM your time may be past deadline - Build in 24-hour buffer ### Consider Weekends/Holidays - Calendar days include non-business days - Monday deadline after holiday weekend = still due Monday - Plan submissions before weekends ### Document Everything - **Screenshot submission confirmations** - **Keep email timestamps** - **Record case numbers** - **Save all communications** --- ## Time Frame Summary by Network ### Mastercard at a Glance ``` Chargeback โ†’ 45 days โ†’ Representment โ†“ 30 days โ†“ Pre-Arbitration โ†“ 45 days โ†“ Arbitration ``` ### Visa at a Glance ``` Chargeback โ†’ 30 days โ†’ Representment โ†“ 30 days โ†“ Pre-Arbitration โ†“ 45 days โ†“ Arbitration ``` ### Amex at a Glance ``` Inquiry โ†’ 20 days โ†’ Response โ†“ (if needed) โ†“ Chargeback โ†’ 20 days โ†’ Response ``` --- ## Next Steps **Responding to a chargeback?** 1. [Check network-specific windows](#quick-reference) - Visa 30 days, MC 45 days, Amex 20 days 2. [Calculate day zero](#calculating-day-zero) - When the clock starts 3. [Account for regional exceptions](#mastercard-time-frames) - Nigeria 2 business days! **Building deadline tracking?** 1. [Follow best practices](#best-practices) - Alerts, buffers, documentation 2. [Track by network](#time-frame-summary-by-network) - Different flows 3. [Account for time zones](#account-for-time-zones) - Build in buffers **Handling special situations?** 1. [Check authorization windows](#authorization-to-clearing-deadlines) - Auth to settlement 2. [Know hardship variances](#hardship-variances) - Disaster extensions 3. [Understand Amex inquiries](#american-express-time-frames) - 20 days response window --- ## See Also - [Mastercard Reason Codes](/docs/reference/reason-codes/mastercard) - MC dispute categories - [Visa Reason Codes](/docs/reference/reason-codes/visa) - Visa dispute categories - [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) - Evidence requirements - [Representment](/docs/chargebacks/representment) - Fighting chargebacks - [Chargeback Lifecycle](/docs/chargebacks/lifecycle) - Full dispute flow - [Chargeback Prevention](/docs/chargebacks/prevention) - Stop disputes before filing - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN - [Network Programs](/docs/chargebacks/reference/network-programs) - VAMP, ECM thresholds - [Monitoring Thresholds](/docs/chargebacks/monitoring/thresholds) - Ratio limits - [Friendly Fraud](/docs/fraud/types/friendly-fraud) - First-party abuse patterns - [Processor Management](/docs/operations/processor-management) - Working with acquirers - [Reduce Chargebacks Fast](/docs/playbooks/reduce-chargebacks-fast) - Crisis playbook --- ## reference/vendor-selection.md Source: https://paymentsandrisk.com/docs/reference/vendor-selection # Vendor Selection (Operator Field Manual) :::info[TL;DR] - Start with the fraud tools your processor already gives you (Stripe Radar, Adyen RevenueProtect). Only pay for a dedicated vendor once false positives or fraud losses cost more than the vendor does - Write down the problem before you take a single demo. "Get chargebacks from 0.8% to under 0.5%" can be evaluated. "Improve fraud" can't - Run a scoped A/B pilot with a clean control before you commit. A vendor's case studies were written about someone else's traffic - Contract for the exit: data export, token portability, sane notice periods. That's what protects you when the tool underperforms or the company gets acquired ::: Pick tools by problem and volume tier, not by brand fame. Start with what's built in, then add only what you can measure, because a tool you can't measure is a tool you'll never be able to cancel. :::info[Looking for Fraud Vendors Specifically?] For fraud-specific vendor evaluation, see the [Fraud Vendor Selection Guide](/docs/fraud/vendors/selection-guide). This page covers general vendor selection across all payment services. ::: ## What Matters - Define the problem first. Fraud guarantees, IDV, alerts and chargeback ops are four different purchases. - Match the tool model to your volume. Guarantees suit a team with no capacity; rules and decisioning suit a team that wants control. - Start with processor-native tools and tune them properly. Most merchants never need more. - Pilot on a clean A/B split. Measure auth rate, fraud, chargebacks and support tickets together, because a tool that fixes one and wrecks another isn't a win. - Contract for exit: data export, token portability, notice periods. ## Minimum Viable Stack by Volume - **Under $100k/mo:** your processor's fraud tools (Radar, RevenueProtect, whatever yours is called), AVS and CVV checks, 3DS on high-risk orders only, and enrichment through Order Insight or Consumer Clarity. You don't need anything else yet. - **$100k-$1M/mo:** add alerts (RDR plus Ethoca or CDRN). Consider piloting a guarantee vendor on one segment. Start IDV on your highest-risk flows. - **Over $1M/mo:** a dedicated fraud tool with rules and ML, automated alert handling, IDV orchestration, and a dispute vendor if your volume warrants one. ## Tool Categories and When to Use - **Fraud guarantees (Signifyd, Forter, Riskified).** Buy these when you haven't got the headcount and you want the liability off your desk. Watch what they do to your approval rate, because that's how they manage their own losses. - **Rules and decisioning (Sift, Kount, decision APIs).** Buy these when you want control and you've got an analyst to spend on tuning. Without that person, you've bought a dashboard. - **Processor-native rules (Stripe Radar, Adyen RevenueProtect, Braintree).** Use these first and tune them before you buy anything else. - **IDV and KYC (Persona, Sardine, Alloy).** For account creation and account takeover problems. These do nothing for card-present fraud. - **Alerts and enrichment (Verifi RDR and CDRN, Ethoca, Order Insight, Consumer Clarity).** For deflecting chargebacks and making your statement line readable. - **Chargeback management vendors.** For high dispute volume. Make them show you win rate broken out by reason code, and confirm they handle Visa Compelling Evidence 3.0. ## Pilot Plan Give it two to four weeks. Less than that and you're reading noise. - **Scope:** one segment, whether that's a country, a payment method or a traffic slice. Keep a clean control group. - **Metrics:** auth rate, fraud rate, chargeback rate, false positives, customer support tickets. - **Success:** net revenue lift, meaning approved-good revenue minus fraud and fees, with customer experience holding steady (tickets flat or down). - **Exit:** a documented rollback, with your original routing ready to switch back on. ## Ask Before You Buy - "How is this priced? Per transaction, percent of GMV, or percent of what you approve or cover? Are there minimums?" - "Can we export our decisions, scores and device data? All of it?" - "How do we turn this off, and how fast? What does it cost us to leave?" - "Which brands and regions do you cover? Do you support 3DS? Do you support CE3.0 evidence?" - "What are your uptime, response latency and support SLAs, in writing?" ## Where This Breaks - **No control group.** You can't prove lift, so you'll renew forever on vibes. - **Blended traffic in a "pilot."** It hides false positives, which is usually the point. - **Guarantee vendors quietly tightening.** Lower approvals reduce their liability, not yours. - **Overlapping tools.** Processor rules plus vendor rules means good orders get blocked twice, and neither dashboard shows you the other one's declines. ## Next Steps **Picking your first vendor?** 1. [Check minimum stack by volume](#minimum-viable-stack-by-volume) - What you actually need 2. [Understand tool categories](#tool-categories-and-when-to-use) - Guarantees vs rules vs alerts 3. [Plan your pilot](#pilot-plan) - Scoped test with control **Evaluating a specific tool?** 1. [Ask before you buy](#ask-before-you-buy) - Pricing, data, portability 2. [Watch for pitfalls](#where-this-breaks) - No control group, double-blocking 3. [Run clean A/B](#pilot-plan) - Measure auth, fraud, chargebacks **Need detailed evaluation?** 1. [Review selection guide](/docs/fraud/vendors/selection-guide) - Full process 2. [Explore vendor landscape](/docs/fraud/vendors/landscape) - Market overview 3. [Set up experimentation](/docs/reference/experimentation) - Testing framework --- ## Related - [Processor Rules Configuration](/docs/fraud/processor-rules-configuration) - Native fraud tools - [Vendor Selection Guide](/docs/fraud/vendors/selection-guide) - Detailed selection criteria - [Vendor Landscape](/docs/fraud/vendors/landscape) - Market overview - [Chargeback Alerts](/docs/chargebacks/prevention/alerts) - RDR, Ethoca, CDRN - [Processor Reporting Checklist](/docs/reference/processor-reporting-checklist) - Data requirements - [Risk Scoring](/docs/fraud/prevention/risk-scoring) - Score-based decisioning - [Identity Verification](/docs/fraud/detection/identity-verification) - IDV tools - [Buying Payments](/docs/payments/buying-payments) - Processor selection - [Processor Management](/docs/operations/processor-management) - Ongoing relationships - [Rules vs. ML](/docs/fraud/detection/rules-vs-ml) - Detection approaches - [Benchmarks](/docs/reference/benchmarks) - Performance targets - [Experimentation](/docs/reference/experimentation) - Pilot testing --- # Learning Pathways ## Getting Started with Payments Source: https://paymentsandrisk.com/docs/learning-pathways/getting-started-with-payments # Getting Started with Payments :::info[TL;DR] - Pathway 1 takes you from zero to processing payments. Three lessons, about 20 minutes - Lesson 1 is how money actually moves. Lesson 2 is picking a processor. Lesson 3 is what you're really paying - Finish it and you'll have a processor, or know which one to pick, and understand your fee structure ::: This pathway takes you from zero to processing payments. Three lessons, about 20 minutes total. | # | Lesson | What You'll Learn | |---|--------|-------------------| | 1 | **[Introduction to Payments](./introduction)** | How money moves when a customer pays you, and the key players involved | | 2 | **[Choosing a Processor](./choosing-a-processor)** | How to pick between Stripe, Square, PayPal, and others | | 3 | **[Understanding Fees](./understanding-fees)** | What you're actually paying, and whether it's too much | **Start with Lesson 1:** [Introduction to Payments](./introduction) **After this pathway:** You'll know how payments work, have a processor (or know which one to pick), and understand your fee structure. Next, read [Pathway 2: Handling Your First Chargeback](../handling-your-first-chargeback) or explore [Accept Payments](/docs/payments) for deeper topics. --- ## Handling Your First Chargeback Source: https://paymentsandrisk.com/docs/learning-pathways/handling-your-first-chargeback # Handling Your First Chargeback :::info[TL;DR] - Pathway 2 walks a chargeback from notification to resolution. Three lessons, about 25 minutes - Lesson 1 is how disputes work and what they cost. Lesson 2 is the evidence. Lesson 3 is when to fight and when to accept - Finish it and you'll know how to respond instead of guessing ::: This pathway walks you through a chargeback from notification to resolution. Three lessons, about 25 minutes total. | # | Lesson | What You'll Learn | |---|--------|-------------------| | 1 | **[How Chargebacks Work](./how-disputes-work)** | How chargebacks work, what they cost, and why they happen | | 2 | **[Gathering Evidence](./gathering-evidence)** | What evidence to collect and how to organize it for a win | | 3 | **[Responding to a Dispute](./responding-to-a-dispute)** | When to fight, when to accept, and how to respond | **Start with Lesson 1:** [How Chargebacks Work](./how-disputes-work) **After this pathway:** You'll understand the dispute process and know how to respond to chargebacks. Next, read [Pathway 3: Protecting from Fraud](../protecting-from-fraud) to stop disputes before they happen, or jump to [Handle Disputes](/docs/chargebacks) for deeper topics. --- ## The Guide Source: https://paymentsandrisk.com/docs/learning-pathways # The Guide :::info[TL;DR] - Five pathways, three short lessons each. Start wherever your biggest question is - Roughly 20-25 minutes per pathway, about 105 minutes for all fifteen lessons - You don't have to go in order. Pathway 2 works fine if a chargeback just landed and you've never read pathway 1 - Want a fix rather than an education? Go to [Playbooks](/docs/playbooks) ::: Five learning pathways, each with 3 short lessons. Start wherever your biggest question is. | Pathway | You Should Start Here If... | Time | |---------|---------------------------|------| | **[1. Getting Started with Payments](./getting-started-with-payments/introduction)** | You're choosing a processor or just set one up | ~20 min | | **[2. Handling Your First Chargeback](./handling-your-first-chargeback/how-disputes-work)** | You got a chargeback and don't know what to do | ~25 min | | **[3. Protecting from Fraud](./protecting-from-fraud/fraud-basics)** | You're worried about fraud or seeing suspicious orders | ~20 min | | **[4. Running Payments Daily](./running-payments-daily/daily-weekly-tasks)** | You need to understand your daily payment operations | ~19 min | | **[5. Reducing Costs](./reducing-costs/understanding-your-costs)** | You want to pay less in processing fees | ~21 min | ## How to Use This Guide **Pick one pathway.** Read the 3 lessons in order. Each lesson links to deeper content in the reference sections if you want more detail. **Most businesses start with Pathway 1 or 2.** If you're brand new to payments, start with Getting Started. If you just got hit with a chargeback, start with Handling Your First Chargeback. After finishing a pathway, the rest of the site is organized by topic: [Accept Payments](/docs/payments), [Handle Disputes](/docs/chargebacks), [Prevent Fraud](/docs/fraud), [Operations](/docs/operations), and [Reference](/docs/reference). --- ## Protecting from Fraud Source: https://paymentsandrisk.com/docs/learning-pathways/protecting-from-fraud # Protecting from Fraud :::info[TL;DR] - Pathway 3 covers what fraud actually looks like for a small business. Three lessons, about 20 minutes - Lesson 1 is the fraud types that really hit SMBs. Most of it is friendly fraud, not stolen cards - Lesson 2 is the free and cheap controls to switch on now. Lesson 3 is the weekly numbers check - Finish it and you'll have basic protection in place and know what to watch ::: This pathway covers what fraud looks like for small businesses and how to protect yourself. Three lessons, about 20 minutes total. | # | Lesson | What You'll Learn | |---|--------|-------------------| | 1 | **[Fraud Basics](./fraud-basics)** | The types of fraud that actually affect small businesses (hint: most of it is friendly fraud) | | 2 | **[Setting Up Protection](./setting-up-protection)** | Free and low-cost tools to enable now: AVS, CVV, velocity limits, billing descriptors | | 3 | **[Monitoring for Fraud](./monitoring-for-fraud)** | How to check your numbers weekly and spot problems before they become crises | **Start with Lesson 1:** [Fraud Basics](./fraud-basics) **After this pathway:** You'll have basic fraud protection in place and know what to watch for. Next, read [Pathway 4: Running Payments Daily](../running-payments-daily) to build your operational routine, or explore [Prevent Fraud](/docs/fraud) for deeper topics. --- ## Reducing Costs & Scaling Source: https://paymentsandrisk.com/docs/learning-pathways/reducing-costs # Reducing Costs & Scaling :::info[TL;DR] - Pathway 5 is about understanding and cutting what you pay. Three lessons, about 21 minutes - Lesson 1 separates what's negotiable (processor markup) from what isn't (interchange, assessments) - Lesson 2 is getting competing quotes and comparing effective rates. Lesson 3 is when to add tools or switch - Finish it and you'll know whether you're overpaying, and have a plan if you are ::: This pathway helps you understand, reduce, and optimize your payment costs. Three lessons, about 21 minutes total. | # | Lesson | What You'll Learn | |---|--------|-------------------| | 1 | **[Understanding Your Costs](./understanding-your-costs)** | What's negotiable (processor markup) vs. what's fixed (interchange, assessments) | | 2 | **[Negotiating and Comparing](./negotiating-and-comparing)** | How to get competing quotes and compare effective rates | | 3 | **[Scaling Decisions](./scaling-decisions)** | When to add tools, switch processors, or invest in optimization | **Start with Lesson 1:** [Understanding Your Costs](./understanding-your-costs) **After this pathway:** You'll know whether you're overpaying and have a plan to fix it. Explore the full site by topic: [Accept Payments](/docs/payments), [Handle Disputes](/docs/chargebacks), [Prevent Fraud](/docs/fraud), or browse [Reference](/docs/reference) for quick lookups. --- ## Running Payments Daily Source: https://paymentsandrisk.com/docs/learning-pathways/running-payments-daily # Running Payments Daily :::info[TL;DR] - Pathway 4 builds your operating routine. Three lessons, about 19 minutes - Lesson 1 is the 5-minute daily check and the 15-minute weekly review. Lesson 2 is reading your statement. Lesson 3 is when to call for help - Finish it and you'll have a routine that catches problems before they turn into crises ::: This pathway builds your operational routine for managing payments. Three lessons, about 19 minutes total. | # | Lesson | What You'll Learn | |---|--------|-------------------| | 1 | **[Daily and Weekly Tasks](./daily-weekly-tasks)** | The 5-minute daily check and 15-minute weekly review that keep you on top of things | | 2 | **[Reading Your Statements](./reading-your-statements)** | How to calculate your effective rate and spot hidden fees | | 3 | **[When to Get Help](./when-to-get-help)** | What to handle yourself vs. when to call your processor or hire outside help | **Start with Lesson 1:** [Daily and Weekly Tasks](./daily-weekly-tasks) **After this pathway:** You'll have a payment operations routine and know how to read your statements. Next, read [Pathway 5: Reducing Costs](../reducing-costs) to start paying less in fees, or explore [Operations](/docs/operations) for deeper topics. --- ## Choosing a Payment Processor Source: https://paymentsandrisk.com/docs/learning-pathways/getting-started-with-payments/choosing-a-processor # Choosing a Payment Processor :::info[TL;DR] - Your processor sets your fees, your cash flow, and how much work lands on you when something breaks - Launching now? Square or Stripe. Both are free to set up, no monthly fee, live in under an hour - Square publishes 2.6% + 15c in person and 3.3% + 30c online on the Free plan. Note the 15 cents, not 10 - Stripe reads 2.9% + $0.30 online and 2.7% + $0.05 on Terminal from a US connection. Their pricing page resolves by your IP, so check it from where you sit - All-in-one fits most businesses under $1M a year. A gateway plus your own merchant account gets cheaper above that, and more complicated ::: Your [payment processor](/docs/payments/buying-payments) is one of the bigger calls you'll make. It sets your fees. It sets your cash flow. And it decides how much work lands on you when something goes wrong. :::tip[Just Starting Out?] Launching now and want to take payments today? Sign up for **Square** or **Stripe**. Both are free to set up with no monthly fee. You can be live in under an hour. Square publishes its rates plainly. **2.6% + 15c in person, 3.3% + 30c online** on the Free plan ([squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02). Note the 15 cents. Plenty of comparison content still says 10 cents. It's wrong. Stripe reads **2.9% + $0.30 online and 2.7% + $0.05 Terminal** from a US connection ([stripe.com/pricing](https://stripe.com/pricing), verified 2026-08-02). stripe.com resolves country by request IP, not by URL path, so a non-US connection serves Canadian numbers. Check the page from where you sit. Read the rest of this page when you're ready to optimize. ::: ### What You Need to Sign Up Before you pick a processor, have these ready: - **Business name.** Or your legal name if you're a sole proprietor. - **Bank account and routing number** for deposits. - **Tax ID (EIN), or SSN** for sole proprietors. - **Business address.** - **Estimated monthly sales volume.** A rough guess is fine. - **Website, online store, or a description of what you sell.** Most all-in-one providers approve you instantly. A small share get flagged for manual review. That takes 1-3 business days. ### Which Setup Is Right for You? Use this flowchart to find your starting point: ```mermaid flowchart TD A[How much do you sell per month?] --> B{Under $10K} A --> C{$10K - $100K} A --> D{Over $100K} B --> E[โœ… **All-in-One Provider**Square or Stripe for the simplest setupHelcim for the lowest published costonce your ticket is above about $9There is no volume floor on interchange-plus] C --> F{Do you have a developeror technical partner?} F -->|No| G[โœ… **All-in-One Provider**e.g., Stripe, Square, PayPalEasy integrations, good supportAsk about volume discounts] F -->|Yes| H{Selling internationallyor subscriptions?} H -->|No| G H -->|Yes| I[โœ… **All-in-One with Advanced Features**e.g., Stripe, Braintree, AdyenBuilt-in global & recurring toolsNegotiate interchange-plus pricing] D --> J{Want to optimize everypenny in fees?} J -->|Not yet| I J -->|Yes| K[โœ… **Gateway + Merchant Account**e.g., Authorize.net + bank processorMore work to set upBest rates at scale] ``` **Bottom line:** unsure? Start with an all-in-one provider. You can switch or add processors later, once your needs are clearer. --- ### All-in-One vs. Gateway + Merchant Account Two main ways to set this up: | Setup | Pros | Cons | Best For | |-------|------|------|----------| | **All-in-One flat rate** ([Stripe](/docs/payments/processors/stripe), [Square](/docs/payments/processors/square), [Shopify Payments](/docs/payments/processors/shopify-payments)) | Fast setup, single contract, predictable pricing | You overpay on cheap cards to underpay on expensive ones | Anyone who values a predictable number over the lowest number | | **All-in-One interchange-plus** ([Helcim](/docs/payments/processors/helcim)) | Transparent pricing, published volume bands, no monthly fee | Statement is more complex to read | Most merchants with a debit-heavy or standard-credit card mix, above about a $9 card-present ticket. No volume threshold to reach first | | **Gateway + Merchant Account** (Authorize.net + bank) | Most control over routing and pricing structure | Complex setup, multiple contracts, and **nobody in this category publishes a rate**, so you can't compare before you ask | High-volume businesses over $100K/month, and only if a quote actually beats a published interchange-plus band | :::note[The volume threshold for interchange-plus mostly went away] The old rule: stay on flat rate until you're doing $25-50K a month, because interchange-plus carries a monthly fee. Helcim's interchange-plus has **no monthly fee, no setup fee, no PCI fee, no statement fee and no cancellation fee** ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). There's no fixed cost to amortise. That changes the question from volume to **card mix and average ticket**. Square Free is 2.6% + 15c in person. Helcim's entry band is interchange + 0.40% + 8c. They cost the same when your **interchange alone averages 2.06% + 5c**. Make it 2.20% + 7c if the figure you're reading already includes the 0.14% + $0.02 of network assessments this site models. Those assessments are unverified. A debit-heavy retail mix sits well below that line. Interchange-plus wins from day one, with no volume to reach first. A premium-rewards or commercial-card-heavy B2B mix sits above it. There the flat rate wins at every ticket size. Ticket size is the other variable. It's the one most comparisons drop. On this site's blended card-present mix the two are equal at a **$9.23 ticket**. Above it Helcim is cheaper. Below it Square is. And below about $19.53, PayPal Zettle's 9-cent fixed fee beats both. Pull your last statement. Check your average ticket as well as your card mix. See [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) for how the blend is built. ::: --- ### Quick Comparison: Popular Providers | | [Square](/docs/payments/processors/square) | [Helcim](/docs/payments/processors/helcim) | [PayPal](/docs/payments/processors/paypal) | [Shopify Payments](/docs/payments/processors/shopify-payments) | [Stripe](/docs/payments/processors/stripe) | |---|--------|--------|--------|--------|--------| | **In-Person** | 2.6% + 15c (Free plan) | IC + 0.40% + 8c ($0-50K/mo band) | 2.29% + 9c (Zettle) | US Basic 2.6% + 10c (0c in Canada) | Terminal 2.7% + $0.05 | | **Online** | 3.3% + 30c (Free plan) | IC + 0.50% + 25c ($0-50K/mo band) | 3.49% + 49c Checkout; 2.99% + 49c standard card | US Basic 2.9% + 30c | 2.9% + $0.30 domestic | | **Keyed / card on file** | 3.5% + 15c | Billed as online | 3.49% + 9c keyed | Not published | +0.5% on manual entry | | **Chargeback fee** | **$0**, stated outright | **$0 if you win, $15 if you lose** | $15 wallet ($0 if you win), $20 card, $30 above a 1.5% ratio | $15, returned if you win | $15 to receive + $15 to counter | | **Monthly Fee** | $0 on Free | $0 | $0 standard commercial | US Basic $39/mo, or $29/mo billed annually | $0 stated | | **Instant payout** | 1.95% per transfer | Not published | 1.50%, $0.50 min | Not published | 1.5% (US), 1% (CA/EU/UK/SG) | | **Contract** | Month-to-month | Month-to-month | Month-to-month | Month-to-month | Month-to-month | | **Best For** | Retail + online, non-technical, the strongest POS here | Lowest published cost for a standard card mix above about a $9 card-present ticket, with no monthly fee to earn back | Customer trust, PayPal and Venmo buyers. Zettle is also the cheapest in-person option this site can rank below about a $19.53 ticket, on its 9-cent fixed fee | Already on Shopify (see the gateway fee note below) | Online, tech-savvy, SaaS, broadest product surface | | **Sign Up** | [squareup.com](https://squareup.com) | [helcim.com](https://www.helcim.com) | [paypal.com/business](https://www.paypal.com/business) | [shopify.com](https://www.shopify.com) | [stripe.com](https://stripe.com) | Sources, all read on the vendor's own page and verified 2026-08-02: [Square](https://squareup.com/us/en/payments/our-fees) and [Square Instant Transfer](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options), [Helcim](https://www.helcim.com/pricing/), [PayPal](https://www.paypal.com/us/business/paypal-business-fees), [Shopify](https://www.shopify.com/pricing), [Stripe disputes](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes) and [Stripe instant payouts](https://docs.stripe.com/payouts/instant-payouts). **Both Stripe and Shopify resolve country by request IP, not by URL path.** So a rate you find quoted online may be another country's card with the dollar sign swapped, and there's no US-specific URL to check it against. Open [stripe.com/pricing](https://stripe.com/pricing) and [shopify.com/pricing](https://www.shopify.com/pricing) from where you sit and confirm the currency before you budget. One number to drop entirely: the widely repeated Stripe Terminal figure of 2.6% + $0.10 matches no Stripe geography at all. **"Lowest published cost" in that Helcim column is a conditional claim, not a slogan.** It holds card-present above roughly a $9.23 ticket. It comes from modelling these processors across two channels, three ticket sizes and four volume levels. Helcim is cheapest in 20 of those 24 cells. PayPal Zettle takes 3, all of them $15 card-present tickets. Stax takes 1, a $25 online ticket at around $20,000 a month. All of it runs on one pass-through assumption: 1.03% + $0.178 card-present and 1.50% + $0.172 online. That's set out in [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). **Three things in that table are worth more than the headline rates:** 1. **A dispute you win is free at three of these five.** Square charges $0 outright. Helcim charges $0 on a win. Shopify returns the $15. Stripe doesn't. PayPal stops once your dispute ratio passes 1.5%. 2. **PayPal's two dispute fees don't stack.** The $15 covers PayPal-account and Guest Checkout transactions. The $20 covers card transactions that went through neither. One dispute, one fee. The $35 you'll see quoted is those two added together, and they can't both apply. Watch the 1.5% line instead. There the $15 becomes $30 and stops being refunded on a win. 3. **Shopify's in-person rate carries 10 cents in the US, and nothing in Canada.** The zero gets quoted as true in every market. It isn't. Shopify also charges a gateway fee on every order if you *don't* use Shopify Payments: 2% on Basic, 1% on Grow, 0.6% on Advanced, 0.2% on Plus. That fee is the real lock-in on that platform. :::note[Stripe versus Braintree, on price, is a coin flip] Braintree publishes 2.89% + $0.29 for cards and digital wallets ([paypal.com/us/enterprise/paypal-braintree-fees](https://www.paypal.com/us/enterprise/paypal-braintree-fees), page stamped "Last Updated: May 7, 2026", verified 2026-08-02). Stripe is 2.9% + $0.30. That's 0.01% and one cent apart. Call it **1.25 cents on a $25 order, 1.5 cents on a $50 order**. Braintree is cheaper on both components. So there's no crossover ticket to find and no breakeven worth publishing. Seen a breakeven analysis saying Braintree wins above a certain ticket size? It was built on an older Braintree rate card of 2.59% + $0.49. That card no longer applies. Choose on features. Braintree gives you native PayPal and Venmo in one integration. Stripe gives you a broader product surface and better documentation. ::: :::tip[Want More Options?] See [Processor Comparison](/docs/payments/processor-comparison) for **50+ processors** across North America, Europe, Africa, Asia-Pacific, and Latin America - with pricing tables, regional picks, and recommendations by business type. ::: --- ### Test to Run Before you commit, run a small test: 1. **Sign up for a free account** with your top 2 choices. Most are free to create. 2. **Process a real $1 transaction** on each, using your own card. 3. **Check your dashboard.** Can you find the transaction? See the fee breakdown? Export data? 4. **Submit a support ticket.** How fast do they respond? Is it helpful? This takes 30 minutes and tells you more than any sales call. --- ### Going Deeper: What to Look For This is what separates a good processor from a bad one. Already picked a provider and want to start processing? Skip to the [checklist](#blank-checklist) and come back later. #### Security and PCI Compliance **If you use Stripe, Square, or PayPal's checkout page, PCI compliance is handled for you. You can skip this section.** [PCI DSS](https://www.pcisecuritystandards.org/) is a set of security requirements for anyone handling card data. The initials stand for Payment Card Industry Data Security Standard. Get breached while non-compliant and you're liable for fines and fraud losses. **What to ask:** - "Are you PCI Level 1 certified?" (This is the highest level) - "Do I need to fill out a Self-Assessment Questionnaire (SAQ), or does your integration handle that?" - "What fraud protection is included?" (Look for: 3D Secure, tokenization (replacing card numbers with secure tokens so you never store actual card data), fraud scoring) :::tip[SMB Shortcut] All-in-one providers handle most PCI compliance for you. Use their hosted checkout or payment elements and you never touch raw card numbers. That cuts your compliance burden hard. ::: **Your integration choice determines your compliance burden:** ```mermaid flowchart TD A[How will customersenter card details?] --> B{Redirect toprocessor's site} A --> C{Embedded formfrom processor} A --> D{Build yourown form} B --> E[โœ… **SAQ A** - simplest questionnaire~22 questionsFor merchants who never touch card data] C --> F[โœ… **SAQ A-EP**Still simple - ~140 questionsEmbedded payment forms] D --> G[โš ๏ธ **SAQ D**Complex - 300+ questionsYou handle card data directly] G --> H[Unless you really need this,choose a hosted option instead] ``` --- #### Payment Methods Cards aren't enough anymore. Customers expect options. | Payment Method | Why It Matters | |----------------|----------------| | **Apple Pay / Google Pay** | 2x faster checkout, higher mobile conversion | | **PayPal** | Trust signal for new customers who don't know you | | **Buy Now Pay Later (BNPL)** (Klarna, Affirm, Afterpay) | Increases average order value 20-30% | | **ACH / Bank Transfer** | Lower fees for high-ticket items | | **Local methods** (iDEAL, Bancontact, PIX) | Essential if selling internationally | **What to ask:** - "Which wallets and Buy Now Pay Later providers are included vs. extra cost?" - "Can I add new payment methods later without re-integrating?" --- #### Settlement Speed Cash flow matters. The gap between a sale and the money landing can make or break a small business. | Provider Type | Settlement Speed | |---------------|-----------------| | PayPal, Square | Next business day (sometimes instant for a fee) | | Stripe | 2 business days standard, next-day available | | Traditional merchant account | 2-3 business days | | High-risk processors | 7+ days, often with [rolling reserves](/docs/operations/holds-and-reserves) | **How money moves from customer to your bank:** ```mermaid timeline title Standard Settlement Timeline Day 0 : Customer pays : Card authorized Day 1 : Transaction captured : Batch sent to processor Day 2 : Processor settles with network : Funds in transit Day 2-3 : Money hits your bank account ``` **What to ask:** - "What's the standard settlement time?" - "Is next-day or instant payout available? What does it cost?" - "Will you hold a reserve? For how long?" (See [holds and reserves](/docs/operations/holds-and-reserves)) --- #### Uptime and Reliability If your processor goes down, you can't accept payments. Every minute of downtime is lost revenue. **What to ask:** - "What's your uptime guarantee?" (Look for 99.9%+) - "Do you publish real-time status?" (Good sign: a public status page) :::info[Real Numbers] 99.9% uptime = ~8.7 hours of downtime per year 99.99% uptime = ~52 minutes of downtime per year 99.999% uptime = ~5 minutes of downtime per year ::: --- #### Contract Terms Some processors lock you into multi-year contracts with expensive exit fees. Others are month-to-month. **What to ask:** - "Is this month-to-month or a fixed term?" - "What's the early termination fee?" (Can be $300-500+) - "Can I take my stored payment tokens if I leave?" (Important for subscriptions) :::warning[Red Flags] - Contracts longer than 1 year for a new business - Early termination fees based on "projected revenue" - Vague language about "rate adjustments" - No clear answer on token portability ::: --- #### Chargeback Handling Every business gets [chargebacks](/docs/chargebacks) eventually. How your processor handles them affects both your costs and your win rate. **What to ask:** - "What's the chargeback fee, and do I get it back if I win?" The second half of that question is what separates these processors. Helcim charges **$0 when a case is resolved in your favour and $15 if you lose**. Stripe charges $15 to receive the dispute, and you never get that back. Countering costs another $15, refunded only on an outright win. A partial win returns neither, so fighting costs $30. PayPal charges $15 on wallet and Guest Checkout disputes, waived if you win. Card chargebacks are $20, charged either way. Above a 1.5% dispute ratio it's $30 on everything, wins included. Square charges **$0** and says so outright. - "Is it in writing?" Square's silence isn't the same as a written $0. Its Payment Terms still reserve the right to recover "the amount of any Chargeback and any associated Fees, fines, or penalties listed in the Fee Schedule." Ask support. Get the answer in email. Keep it. - "Do you provide tools to help me fight disputes?" - "What happens if my chargeback rate gets too high?" (See [network monitoring programs](/docs/chargebacks/reference/network-programs).) *Dispute fees verified 2026-08-02: [Helcim](https://www.helcim.com/pricing/), [Stripe](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes), [PayPal](https://www.paypal.com/us/business/paypal-business-fees), [Square](https://squareup.com/us/en/payments/our-fees).* --- ### Blank Checklist Use this when comparing other processors: | Question | Processor A | Processor B | |----------|-------------|-------------| | PCI Level 1 certified? | | | | Hosted checkout available? | | | | Apple Pay / Google Pay? | | | | Buy Now Pay Later available? | | | | Settlement time | | | | Contract length | | | | Early termination fee | | | | Chargeback fee | | | --- ### Processor Profile Pages Want a deeper look before deciding? Each profile covers pricing details, common gotchas, and when to use (or avoid) each provider: - [Stripe](/docs/payments/processors/stripe) - Online, SaaS, developer-led businesses - [Square](/docs/payments/processors/square) - Retail, card-present, service businesses - [Shopify Payments](/docs/payments/processors/shopify-payments) - Best if you're already on Shopify - [Helcim](/docs/payments/processors/helcim) - Interchange-plus transparency, six published volume bands that apply automatically - [Stax](/docs/payments/processors/stax) - Subscription pricing at interchange + 0% markup + 8c in person, 15c online. **The volume bands are annual, not monthly.** $99/mo up to $150K a year, $139/mo for $150-250K a year, $199+/mo above that. Helcim's bands key off monthly volume, so the two don't compare without converting. Against Helcim the maths tips to Stax above **$58,000-$70,000 a month card-present**, depending on ticket size. **Online** it happens far earlier, from about **$11,000 a month** at a $25 ticket. That online answer isn't a single threshold. It flips to Stax, back to Helcim when the subscription steps from $99 to $139, then back again. Read [Stax](/docs/payments/processors/stax) for the actual windows. Above $250K a year Stax stops publishing a subscription and says only "$199+", so anything modelled up there is the earliest point Stax *could* win, not a price - [Clover](/docs/payments/processors/clover) - Best POS hardware for restaurants and retail. Clover Direct publishes **2.3% + 10c** card-present for restaurants and quick service, **2.6% + 10c** on entry retail and services, and **3.5% + 10c** keyed and online. But Clover is distributed by Fiserv through banks and ISOs, so your actual rate depends on the reseller. Clover says as much on its own pricing page. Benchmark any quote against the direct rate - [Toast](/docs/payments/processors/toast) - Restaurant-specific POS and processing. It publishes **2.49%** on Traditional and **3.09%** on Pay-as-you-Go, on its shop pages rather than its pricing page. The "+ 15c" that every comparison attaches is reported by third parties, not published by Toast. Ask for the fixed cents in writing - [Lightspeed](/docs/payments/processors/lightspeed) - Complex retail with advanced inventory. US retail plans are $89/$149/$289 a month. Card-present on X-Series is **2.6% + 10c** and the chargeback fee is **$15**. The online rate isn't published on either product line. Ask for it first and hardest - [Braintree](/docs/payments/processors/braintree) - Cards + PayPal + Venmo in one integration, 2.89% + $0.29. Effectively the same price as Stripe - [PayPal](/docs/payments/processors/paypal) - Brand recognition and buyer trust, at the highest dispute cost on this list - [Moneris](/docs/payments/processors/moneris) - Canada's largest processor. All figures CAD: 2.65% + $0.10 in person, 2.85% + $0.30 online, CA$25 chargeback fee plus a CA$80 authorization chargeback handling fee - [Checkout.com](/docs/payments/processors/checkout-com) - Mid-market global, developer-friendly. **No published rates.** It offers both flat-rate and Interchange++ models, priced per business profile - [Adyen](/docs/payments/processors/adyen) - Enterprise, global processing. **No published SMB rate card.** Expect Interchange++ plus a $0.13 processing fee, with an indicative card markup of 0.60%. It has **no $10M/year volume minimum**, whatever you may have read. Adyen says only that it has "a minimum invoice depending on industry or business model." No amount is attached. Ask for that number in writing *All figures verified 2026-08-02 against each vendor's own pricing page.* :::tip[What to ask when a processor won't publish a price] That's most of the market. It isn't automatically a bad sign. It just moves the burden to you. - **Clover:** effective rate including all markups, monthly software plan cost per device, chargeback fee, contract term, early termination fee, and whether the hardware is leased or bought. Leased hardware on a multi-year term is where the cost hides. - **Toast:** blended effective rate, whether payments are contractually locked to Toast, hardware cost and financing, software cost per terminal, and termination terms. The lock-in is the one that matters. A Toast contract typically means you can't switch processors without replacing the POS. - **Adyen and Checkout.com:** which pricing model applies, how scheme fees are treated under Interchange++, and the monthly minimum. - **Everyone:** the chargeback fee, in writing, and whether you get it back when you win. ::: See [all processor profiles](/docs/payments/processors) for the full list and the [50+ Processor Comparison](/docs/payments/processor-comparison) for National Processing, Payment Depot, Payline Data, and more. --- ### Where This Breaks This guide assumes you're running a standard retail or e-commerce business. It doesn't fully apply if: - **You're high-risk** (CBD, adult content, gambling, firearms, cryptocurrency). Most all-in-one providers will reject you. You need a specialized high-risk processor. Been rejected already? Search for "high-risk payment processor", or see the guide on [buying payments](/docs/payments/buying-payments). - **You're a marketplace.** Splitting payments between sellers needs specific features, like Stripe Connect or PayPal for Marketplaces. - **You process over $1M/month.** The economics change, though less than people assume. Helcim publishes its $1M-5M band openly at interchange + 0.15% + 6c in person. So you can benchmark any quote against a public number before you pay anyone to negotiate. Custom pricing genuinely starts above $5M/month. - **You're heavily international.** Local acquiring in each country often beats cross-border processing. --- ### Next Steps [ โ–ถ๏ธ Continue: Understanding Fees Learn about interchange, assessments, and how pricing models affect your costs. ](/docs/learning-pathways/getting-started-with-payments/understanding-fees) [ ๐Ÿ“š Go Deeper: 50+ Processor Comparison Full pricing tables, regional picks, and recommendations by business type. ](/docs/payments/processor-comparison) --- ## Introduction to Payments Source: https://paymentsandrisk.com/docs/learning-pathways/getting-started-with-payments/introduction # Introduction to Online Payments :::info[TL;DR] - Four players in every card payment: the customer, you, your acquirer, and the customer's issuing bank - Authorization takes seconds. Settlement into your bank takes one to three days. They're separate steps - A gateway carries the transaction. A processor moves the money. All-in-one providers do both - You don't need to master any of this. Knowing it just means better questions and fewer surprises ::: Welcome to online payments. Here's how money gets from your customer's card to your bank account. And what you need to know to get paid on time. :::tip[You Don't Need to Master This] Most of this happens automatically once you sign up with a provider. But the basics help. You ask better questions, spot problems faster, and avoid overpaying. ::: ### What You'll Learn - The key players in a payment transaction. - How money moves from your customer to your bank account. - The difference between a [payment gateway and payment processor](/docs/payments/buying-payments). ## What Happens When Someone Pays You | Step | What Happens | How Long | |------|-------------|----------| | 1. Customer taps "Pay" | Your processor sends card details to the card network | Milliseconds | | 2. Authorization | Issuing bank approves or declines | 1-2 seconds | | 3. Capture | You confirm the sale (automatic or manual) | Same day | | 4. Settlement | Money transfers from issuer to your processor | 1-2 business days | | 5. Funding | Your processor deposits into your bank account | 1-3 business days | That's the whole flow. The rest of this guide explains each step and what to do when things go wrong. ### The Payments Ecosystem Every online transaction involves four key players: | Player | Who They Are | What They Do | |--------|--------------|--------------| | **Customer** | The person buying | Enters their card details | | **Merchant** | You | Sells the product, receives the money | | **Acquirer** (your processor's bank) | Your payment provider's bank | Deposits money into your account | | **Issuer** (customer's bank) | Customer's bank (Chase, Citi, etc.) | Approves or declines the transaction | Sign up with Stripe or Square, and they handle the acquirer relationship. You don't need a separate merchant account. A merchant account holds your card funds before they land in your regular business account. All-in-one providers include one automatically. ### The Flow of a Transaction Here's what happens when a customer clicks "buy": ```mermaid sequenceDiagram participant C as Customer participant M as Merchant participant G as Gateway participant P as Processor participant N as Card Network participant I as Issuer Bank C->>M: 1. Enter card details M->>G: 2. Send payment data G->>P: 3. Forward transaction P->>N: 4. Route to network N->>I: 5. Authorization request I-->>N: Approve/Decline N-->>P: Response P-->>G: Response G-->>M: 6. Authorization result M-->>C: Show confirmation Note over I,M: 7. Settlement (1-2 days) ``` You don't need to memorize this. But payments fail and money goes missing. This is how you figure out where it got stuck. 1. **The customer enters their [payment details](/docs/payments/payment-methods/cards) on your checkout page.** 2. **That information goes to your payment gateway.** 3. **The gateway passes it to the [payment processor](/docs/payments/buying-payments).** 4. **The processor routes it to the card networks: Visa, Mastercard, and the rest.** 5. **The network asks the customer's bank whether to [approve the transaction](/docs/payments/auth-optimization).** 6. **The approval or [decline](/docs/reference/decline-codes) travels back through the chain.** Your website notifies the customer. 7. **If approved, the funds move from the issuer to your merchant account.** That's settlement, and it usually takes 1-2 business days. The whole thing takes a few seconds. :::info[Gateway vs. Processor: Do I Need Both?] A **payment gateway** collects card details. A **payment processor** moves the money between banks. Stripe, Square, and Shopify Payments bundle both into one service, so you don't set them up separately. You'd only deal with a standalone gateway on a traditional merchant account. Those usually start at $500K+/month. ::: ### What This Means for Your Business A few practical takeaways: - **You get paid in 1-3 days, not instantly.** Authorization is immediate, but the money takes time to settle into your bank. - **Declines happen.** About 10-15% of transactions get declined. Some you can recover, some you can't. - **Every step costs money.** The card networks, issuing banks, and your processor all take a cut. That's why fees exist. - **Problems usually trace back to one player.** When something goes wrong, this flow tells you who to call. ### Your One Action Pick a processor and create a free account. You can run a test payment in under 15 minutes. - **Selling online?** Start with [Stripe](https://stripe.com) or [Square](https://squareup.com). - **On Shopify?** Use [Shopify Payments](https://www.shopify.com). Processing elsewhere adds a Shopify gateway fee on every order. That's 2% on Basic, 1% on Grow, 0.6% on Advanced, 0.2% on Plus ([shopify.com/pricing](https://www.shopify.com/pricing), verified 2026-08-02). - **Retail/in-person?** Start with [Square](https://squareup.com) at 2.6% + 15c with a free reader. [Helcim](https://www.helcim.com) runs interchange + 0.40% + 8c with no monthly fee. Cheaper, but the statement takes more reading. - **Not sure?** The [next lesson](./choosing-a-processor.md) compares them with published rates and sources. ### Next Steps [ โ–ถ๏ธ Continue: Choosing a Processor The biggest decision you'll make. Find the right partner for your business. ](/docs/learning-pathways/getting-started-with-payments/choosing-a-processor) [ ๐Ÿ“š Go Deeper: Payments Full guides on authorization, settlement, and checkout optimization. ](/docs/payments) --- ## Understanding Payment Processing Fees Source: https://paymentsandrisk.com/docs/learning-pathways/getting-started-with-payments/understanding-fees # Understanding Payment Processing Fees :::info[TL;DR] On a $100 sale you'll pay roughly **$3.20**. About **$1.94** goes to banks and card networks. You can't change that part. About **$1.26** goes to your processor. You can change that part, and not only by negotiating. For scale, against a real published rate: Square's Free plan is 2.6% + 15c in person, so that $100 sale costs $2.75. Online it's 3.3% + 30c, so $3.60 ([squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02). ::: Payment processing fees are confusing. Here's what you actually need to know. :::note[Deep Dive Available] This is the guided path version. For hidden fees and statement auditing, see the [Processor Fees Guide](/docs/payments/processor-fees-guide). For qualifying for lower rates, see [Interchange Optimization](/docs/payments/interchange-optimization). ::: ### Where Your Fees Go Here's a real example of a $100 Visa credit card transaction: ```mermaid pie title $100 Transaction Fee Breakdown "Interchange (Issuing Bank)" : 1.80 "Assessment (Visa)" : 0.14 "Processor Markup" : 1.26 ``` | Component | Amount | Who Gets It | Can You Negotiate? | |-----------|--------|-------------|-------------------| | **Interchange** | ~$1.80 | Customer's bank (Chase, Citi, etc.) | No | | **Assessment** | ~$0.14 | Card network (Visa, Mastercard) | No | | **Processor Markup** | ~$1.26 | Your processor (Stripe, Square, etc.) | Yes, at volume | | **Total** | **~$3.20** | | | *Rates vary by card type, transaction type, and your pricing model.* **On American Express:** Amex cards usually cost 0.3-0.5% more than Visa or Mastercard. Amex is both the network and the issuer. ### The Three Components Explained 1. **[Interchange](/docs/payments/reference/interchange) Fee:** The biggest piece. It goes to the bank that issued the customer's card, the [issuer](/docs/payments/buying-payments). You're paying that bank to carry the risk that the charge is good and the customer pays their bill. The card networks set the rates. You can't negotiate them. 2. **Assessment Fee:** A smaller fee, and it goes to the network itself. Visa and Mastercard charge it for running the wires between banks. Also non-negotiable. 3. **Processor Markup:** What your [payment processor](/docs/payments/buying-payments) charges you. It pays for software, fraud protection, support and infrastructure. This is the only piece you can move. ### How Pricing Models Affect Your Fees **On flat-rate pricing (Stripe, Square, PayPal)?** You pay one rate on every transaction. Skip to [When Should You Care](#when-should-you-care-about-this). * **Flat-rate:** You never see the components. The processor bundles everything into one rate. Square's Free plan is 2.6% + 15c in person and 3.3% + 30c online. It's simple and predictable. You overpay on cheap cards so you can underpay on expensive ones. See our [processor comparison](/docs/payments/processor-comparison). * **[Interchange-plus](/docs/payments/reference/interchange):** The most transparent model. You pay the real interchange and assessment on each sale, plus a published markup. Helcim's entry band is interchange + 0.40% + 8c in person and interchange + 0.50% + 25c online, no monthly fee ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). You see what you pay and who gets it. * **Tiered:** Sales get sorted into buckets: qualified, mid-qualified, non-qualified. Each bucket has its own rate. Good luck finding out why a sale landed where it did. It's the least transparent model and usually the worst deal. ### When Should You Care About This? | Your Monthly Volume | What to Do | |---------------------|-----------| | **Under $10K** | Focus on growing. But spend 20 minutes checking your card mix, because interchange-plus with no monthly fee can beat flat rate even here. | | **$10K - $50K** | Get one interchange-plus quote and compare it properly. Also ask your current processor about volume discounts - a simple email can save you 0.1-0.2%. | | **$50K - $100K** | If you're still on flat rate, this is where it starts costing real money. Published interchange-plus bands drop automatically at $50K. | | **Over $100K** | Negotiate the markup, not the headline rate. Every 0.1% saved is $100+/month in your pocket. | :::note["Wait until you're bigger" is out of date] That advice made sense when interchange-plus carried a monthly fee you had to grow into. It doesn't any more. Helcim charges $0 a month. No setup, PCI, statement or cancellation fee either. It publishes six volume bands that apply automatically as you grow ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). There's no fixed cost to amortise now. So the deciding factor is **ticket size**, not volume. Square Free in person and Helcim's entry band cost the same on a **$9.23 ticket**. Above that, Helcim's lower percentage wins. Below it, Square's smaller fixed fee wins. See [how we model processing cost](/docs/payments/reference/cost-model-assumptions). ::: ### Reading Your Statement Here's the fastest way to check if you're overpaying: 1. Log into your processor dashboard 2. Find last month's total sales and total fees 3. Divide fees by sales. That's your effective rate 4. Healthy range for most small businesses in person: **2.5-3.2%**. Online runs higher Before you panic at a high number, check your published rate. It may be doing exactly what it says. Square's Free plan online is 3.3% + 30c. A store with a $50 average ticket lands at **3.90%**. That's design, not a mistake. If that's you, the fix is a new plan or a new processor. Not a rate review email. Is your effective rate well above the published rate for your channel and ticket size? Then something else is going on. Email your processor and ask for a rate review. Or compare current pricing in the [Processor Comparison](/docs/payments/processor-comparison). :::warning[Watch Out for Hidden Fees] Some processors bury extra fees in your statement. Common ones to look for: - **PCI non-compliance fee** if you haven't completed your annual PCI (the security standard for handling card data) questionnaire - **Monthly minimum fee** if your processing volume is too low - **Statement fee** for mailing a paper statement These are real. The amounts are processor-specific, not an industry standard. Moneris publishes a CA$5.00 minimum merchant discount rate, a CA$5.00 Moneris Go software fee and a CA$2.00 paper statement fee ([moneris.com/en/pricing](https://www.moneris.com/en/pricing), verified 2026-08-02). Ask yours for its full fee schedule. Don't assume a range. Four processors say on their own pages that they charge nothing like this. Square: "no monthly subscription costs" on the Free plan. Stripe: "does not charge setup fees, monthly fees, or any other hidden fees." PayPal: none on standard commercial accounts. Helcim is the bluntest of the four: "no setup, PCI, cancellation, or statement fees." All verified 2026-08-02. ::: On a flat-rate plan, your statement is simple. On interchange-plus or tiered, ask for a detailed breakdown if you don't get one. For help reconciling, see [settlement and reconciliation](/docs/payments/settlement). ### Your First Week Action Log into your processor dashboard. Find your effective rate: total fees divided by total sales. Write it down. That number tells you when optimizing is worth the time. ### You've Completed the Payments Basics You now understand: - The players in the [payments ecosystem](/docs/payments) - How to [choose a payment processor](/docs/payments/buying-payments) - The different types of payment processing fees ### Next Steps [ โ–ถ๏ธ Next Pathway: Handling Your First Chargeback Learn what happens when a customer disputes a charge. ](/docs/learning-pathways/handling-your-first-chargeback/how-disputes-work) [ ๐Ÿ“š Explore: Full Payments Section Deep dives on auth optimization, checkout conversion, and more. ](/docs/payments) *Come back to these after finishing The Guide:* [ ๐Ÿ’ฐ Interchange Optimization Qualify for lower rates ](/docs/payments/interchange-optimization) [ ๐Ÿ“ˆ Auth Optimization Improve approval rates ](/docs/payments/auth-optimization) [ ๐Ÿ›’ Checkout Conversion Reduce abandonment ](/docs/payments/checkout-conversion) --- ## Gathering Evidence for Chargebacks Source: https://paymentsandrisk.com/docs/learning-pathways/handling-your-first-chargeback/gathering-evidence # Gathering Evidence for Chargebacks :::warning[Set This Up Before Your Next Sale] If you're reading this after getting your first chargeback, you've already learned the hard way. The evidence you need to win must be collected at the time of sale, not after the dispute. ::: :::info[TL;DR] - **Collect evidence at transaction time:** You can't gather proof of delivery after you've already shipped. - **Match evidence to [reason codes](/docs/reference/reason-codes):** Fraud claims need different evidence than "not received" claims. - **Digital goods need usage proof:** IP logs, download records, and login history. - **Services need acknowledgment:** Signed contracts, milestone approvals, or customer confirmation emails. ::: You win [chargebacks](/docs/chargebacks) with evidence collected before you needed it, because once a dispute hits you can't go back and log what you didn't. ### Essential Evidence for All Transactions For every transaction, you should be collecting: * **Customer's name and email address:** Basic AVS match data. * **Billing address:** For [address verification](/docs/fraud/prevention/avs-cvv) matching. * **IP address and device fingerprint:** Links the transaction to a specific device/location. * **A detailed description of the goods or services purchased:** Order details with SKUs (product IDs). * **The date and time of the transaction:** Timestamp with timezone. ### Evidence for Physical Goods For [13.1 Not Received](/docs/reference/reason-codes/visa/13-1-not-received) claims, you need: * **Shipping address:** Must match billing or have customer-confirmed alternate address. * **Tracking number:** Carrier tracking showing delivery status. * **Delivery confirmation with signature:** Critical for high-value items. Without signature, the customer can claim they never got it. ### Evidence for Digital Goods Digital goods are harder to prove. You need: * **Proof of download or access:** Server logs showing the customer's IP downloaded the file or accessed the service. * **Usage logs:** Login history, feature usage, or in-app activity timestamps. * **Customer communication:** Any emails or chat logs where the customer acknowledges receipt. See the [What proof each network accepts](/docs/chargebacks/representment/compelling-evidence) for digital goods best practices. ### Evidence for Services For [13.3 Not as Described](/docs/reference/reason-codes/visa/13-3-not-as-described) or [13.6 Credit Not Processed](/docs/reference/reason-codes/visa/13-6-credit-not-processed) claims: * **Signed contract or agreement:** Scope of work and payment terms. Must be timestamped before service delivery. * **Milestone approvals:** Written customer acknowledgment that deliverables were accepted. * **Proof of service delivery:** Timesheets, project files, or confirmation emails. Your [refund policy](/docs/chargebacks/refund-policy) should be crystal clear and presented before purchase. For detailed evidence types by service category (contractors, consultants, salons, repair shops), see [Representment for Service Businesses](/docs/chargebacks/representment/service-businesses). ### Quick Setup Checklist Do these now to be ready for your next dispute: | If You Sell... | Set Up Today | |----------------|--------------| | **Physical goods** | Require signature on delivery for orders over $100 | | **Digital goods** | Log IP address and download/access timestamps | | **Services** | Get written approval at each milestone | | **Subscriptions** | Save the signup confirmation and renewal notices | | **Everything** | Screenshot your checkout page showing terms acceptance | ### Next Steps [ โ–ถ๏ธ Continue: Responding to a Dispute Now that you know what evidence to collect, learn when to fight and how to build your case. ](/docs/learning-pathways/handling-your-first-chargeback/responding-to-a-dispute) [ ๐Ÿ“š Go Deeper: Compelling Evidence The complete guide to what actually wins disputes. ](/docs/chargebacks/representment/compelling-evidence) --- ## Responding to a Dispute Source: https://paymentsandrisk.com/docs/learning-pathways/handling-your-first-chargeback/responding-to-a-dispute # Responding to a Dispute When you receive a [chargeback](/docs/chargebacks), you have a [limited window](/docs/reference/time-frames) to respond. Missing the deadline means automatic loss. Here's how to decide whether to fight and how to build your case. :::info[TL;DR] - **Decide fast:** You typically have 20-45 days to respond. Check your [processor portal](/docs/operations/processor-management) immediately. - **Don't fight everything:** Small amounts or weak cases cost more than the loss. - **Match the reason code:** Your evidence must address the specific claim, not just prove the transaction happened. - **Quality over quantity:** A focused [rebuttal letter](/docs/chargebacks/representment) with 3 strong documents beats a dump of irrelevant files. ::: --- ## FIRST 30 MINUTES: Emergency Checklist **Just received your first chargeback email? Do this RIGHT NOW:** ### Minutes 1-5: Find the Transaction **Where to find disputes:** - **Stripe:** Dashboard > Payments > Disputes > click the dispute - **Square:** Dashboard > Balance > Disputes > click the dispute - **Shopify:** Orders > click the order > "Chargeback" banner at top - **PayPal:** Resolution Center > Open cases > click the case ``` โ˜ Find the disputed transaction in your processor dashboard โ˜ Note the chargeback deadline (usually 20-45 days from today) โ˜ Write deadline on calendar (minus 3 days for safety) ``` ### Minutes 5-10: Understand What Happened ``` โ˜ Read the reason code. Each code is a number assigned by the card network (Visa, Mastercard, etc.) telling you the customer's specific claim (10.4, 4837, 13.1, etc.) โ˜ What is customer claiming? - Fraud ("I didn't do this") - Not received ("Never got it") - Not as described ("Different than listing") - Cancelled ("I already cancelled") - Other โ˜ Check the amount (Transaction - Fee already deducted) ``` ### Minutes 10-20: Were They Right? **Ask yourself honestly:** - Did we fail to deliver? - Is their complaint legitimate? - Was this actually fraud? - Did we mess up? **If YES - Accept it**: - Click "Accept" in processor dashboard - Fix what went wrong so it doesn't happen again - Move on (don't waste time fighting legitimate disputes) **If NO - Continue to gather evidence** ### Minutes 20-30: Start Gathering Evidence **For "Fraud" disputes (10.4, 4837, F29)**: ``` โ˜ Find order confirmation with customer info โ˜ Check if customer has prior successful orders โ˜ Look for delivery confirmation (if physical goods) โ˜ Check IP address, device fingerprint if available ``` **For "Not Received" (13.1, 4855, RG)**: ``` โ˜ Find tracking number โ˜ Check delivery status (delivered? signed for?) โ˜ Pull delivery photo/signature if available ``` **For "Cancelled" (13.2, C28, AP)**: ``` โ˜ Find subscription agreement/consent โ˜ Check cancellation logs (did they actually cancel?) โ˜ Pull email communications ``` --- **YOU'RE DONE FOR NOW.** You have 20-45 days to respond. Calendar is set. Evidence collection started. **Next**: Take a breath and read the rest of this guide to decide if you should fight and how to build your case. --- ### Should You Fight This Chargeback? Use this to decide: ```mermaid flowchart TD A[New chargeback] --> B{Was the customerright to dispute?} B -->|Yes| C[Accept it.Fix what went wrong.] B -->|No| D{Transactionover $50?} D -->|No| E{Do you havestrong evidence?} D -->|Yes| F{Do you havestrong evidence?} E -->|No| G[Accept it.Not worth the time.] E -->|Yes| H[Maybe fight.Weigh your time.] F -->|No| I[Accept it.You'll probably lose.] F -->|Yes| J[Fight it.Submit evidence.] ``` **Reality check:** The average merchant wins about 20-30% of disputed chargebacks. With strong evidence and the right reason codes, you can hit 40-60%. But if you don't have proof, you'll waste hours for nothing. ### The Three Questions Before you spend time on a response, answer these: 1. **Was the customer right?** If you billed wrong, didn't deliver, or ignored refund requests, accept the chargeback and fix your process. 2. **Is it worth your time?** A $30 dispute takes the same effort as a $300 one. Know your break-even. 3. **Do you have evidence?** No proof of delivery? No customer communication? You're unlikely to win. ### Gathering Your Evidence If you decide to fight, gather [compelling evidence](/docs/chargebacks/representment/compelling-evidence) that directly addresses the [reason code](/docs/reference/reason-codes). The evidence you need depends on the specific claim: * **Proof of delivery:** Tracking number and delivery confirmation with signature. For [13.1 Not Received](/docs/reference/reason-codes/visa/13-1-not-received) claims, this is essential. * **Customer communication:** Emails, chat logs, or support tickets. Shows the customer acknowledged receipt or used the service. * **[Terms of service](/docs/chargebacks/refund-policy):** A screenshot with the relevant section highlighted. Critical for [13.7 Cancelled Merchandise](/docs/reference/reason-codes/visa/13-7-cancelled-merchandise) disputes. * **[Device fingerprint](/docs/fraud/detection/device-fingerprinting) and IP address:** For [fraud claims](/docs/fraud/types/third-party), shows the same device/IP used in prior legitimate purchases. ### Writing Your Rebuttal Letter Your [rebuttal letter](/docs/chargebacks/representment) is your opportunity to tell your side of the story. Keep it short, factual, and tied to the evidence. Here's what to include: * **A summary of the transaction:** The date, amount, and what was purchased. * **A direct response to the [reason code](/docs/reference/reason-codes):** Don't ramble. Address the specific claim and explain why it's wrong. * **A list of the evidence you're providing:** Number each document and reference it in your letter. For templates and examples, see [Winning Evidence](/docs/chargebacks/winning-evidence). ### You've Completed the Chargeback Basics You now understand: - What a [chargeback](/docs/chargebacks) is and why they happen - What kind of [evidence](./gathering-evidence.md) wins cases - How to decide whether to fight and build your response ### Next Steps [ โ–ถ๏ธ Next: Protecting Your Business from Fraud Understand what fraud looks like for small businesses and set up your defenses. ](/docs/learning-pathways/protecting-from-fraud/fraud-basics) [ ๐Ÿ“š Go Deeper: Full Chargebacks Section Deep dives on representment, metrics, and network programs. ](/docs/chargebacks) [ ๐Ÿ”ข Reason Codes Know what you're fighting ](/docs/reference/reason-codes) [ ๐Ÿ“‹ Compelling Evidence What actually wins ](/docs/chargebacks/representment/compelling-evidence) [ ๐Ÿ” Fraud Prevention Stop fraud chargebacks ](/docs/fraud/prevention) --- ## Lesson 1: How Chargebacks Work Source: https://paymentsandrisk.com/docs/learning-pathways/handling-your-first-chargeback/what-is-a-chargeback # Lesson 1: How Chargebacks Work First of three lessons in **Handling Your First Chargeback**. For the full reference, see [What Is a Chargeback?](/docs/chargebacks). Answering one right now? Go straight to [Your First Chargeback](/docs/chargebacks/your-first-chargeback). A chargeback is a customer disputing a charge with their bank instead of asking you for a refund. The bank reverses it and the money leaves your account. Then you prove the charge was legitimate to get it back. :::tip[Don't Panic] Your first chargeback feels alarming. It isn't. Every business gets them eventually. What matters is how you respond, and what you change after. ::: :::info[TL;DR] - A chargeback is a forced refund. The bank pulls the money before you get a say. - The real cost beats the sale price. Add the fee, the product, and your time. - Three causes: real fraud, something you got wrong, or a customer lying. - You get 20-45 days to respond, and missing that loses by default. ::: A chargeback costs you more than the sale was worth, and the transaction amount is only part of it. ### The Real Cost of a Chargeback A chargeback costs more than just the transaction amount: | Cost | Typical Amount | |------|----------------| | **Transaction amount** | Whatever you sold | | **[Chargeback fee](/docs/payments/processor-fees-guide)** | $0 to $30 per dispute, usually $15 | | **Product/shipping** | Already gone if you shipped | | **Your time** | 1-2 hours to respond | | **Ratio damage** | Too many = account termination | Add it all up and a $50 chargeback costs you $100+. ### Why Chargebacks Happen Customers file for all sorts of reasons, and they sort into three buckets. 1. **[Fraud](/docs/fraud/types/third-party):** the cardholder says they didn't authorize it, and they're right. Someone used a stolen card 2. **Merchant error:** the customer has a real problem with the order. * Billed the wrong amount * Never got the goods * The product wasn't as described * Couldn't get a [refund](/docs/chargebacks/refund-policy) out of you 3. **Friendly fraud:** the cardholder disputes a real charge to get it free, and it's growing fast. See [friendly fraud](/docs/fraud/types/friendly-fraud) for the detail. ### The Chargeback Process Here's what happens when a customer disputes a charge: ```mermaid flowchart LR A[Customer disputeswith their bank] --> B[Bank reversesthe charge] B --> C[Money takenfrom YOUR account] C --> D{You respondwith evidence} D -->|Win| E[Money returnedto you] D -->|Lose| F[Money stayswith customer] D -->|No response| F ``` **The timeline:** 1. The customer disputes with their bank 2. The bank gives them a temporary refund 3. Your processor pulls the money and tells you 4. You get **20-45 days** to respond with [evidence](/docs/chargebacks/representment/compelling-evidence) 5. The bank decides who wins Miss the deadline and you lose automatically. See [chargeback lifecycle](/docs/chargebacks/lifecycle) for the full process. ### Next Steps [ โ–ถ๏ธ Continue: Gathering Evidence Learn what evidence to collect before your next dispute, and what to set up now. ](/docs/learning-pathways/handling-your-first-chargeback/gathering-evidence) [ ๐Ÿ“š Go Deeper: Chargebacks Full guide with reason codes, prevention strategies, and representment. ](/docs/chargebacks) --- ## Understanding Fraud as a Small Business Source: https://paymentsandrisk.com/docs/learning-pathways/protecting-from-fraud/fraud-basics # Understanding Fraud as a Small Business :::info[TL;DR] - Most small businesses worry about stolen cards. That's real, but it isn't the main problem - 60-80% of chargebacks come from your own customers. They bought something, then disputed it - Work out which one you've got before you buy a tool. Pull your last 20-30 chargebacks and sort them: stolen card, or real customer disputing a real order - If it's mostly real customers, you have a communication problem. Better descriptors and easier refunds fix more than fraud software will ::: Most small businesses worry about stolen credit card numbers. That's real. It just isn't your main problem. **60-80% of chargebacks come from your own customers.** They bought something, then disputed it. Work out what you're dealing with before you buy a tool. :::tip[The First Thing to Do] Pull your last 20-30 chargebacks. Ask one question of each. Stolen card, or real customer disputing a real order? That answer tells you whether this is a fraud problem or a communication problem. ::: ### The Three Types of Fraud That Hit Small Businesses | Type | What It Is | How Common | Example | |------|-----------|------------|---------| | **Third-party fraud** | Someone uses a stolen credit card on your site | ~20-30% of disputes | You ship a laptop to a stranger who used someone else's Visa | | **Friendly fraud** | A real customer disputes a legitimate purchase | ~60-80% of disputes | Customer buys your course, watches it, then says "I didn't authorize this" | | **Card testing** | Fraudsters run small charges to check if stolen cards work before spending big | Varies | You see 50 transactions for $1.00 from different cards in an hour | :::warning[The Expensive Mistake] Most merchants misdiagnose this. They see chargebacks, assume stolen cards, and buy an expensive tool. If your disputes are friendly fraud, the tool won't help. You need a clearer billing descriptor and an easier refund path. ::: ### Why Friendly Fraud Is Your Biggest Problem A customer doesn't recognize a line on their statement. They call the bank, not you. The bank files a chargeback. You lose the money and the fee, usually $15. **Common reasons customers dispute legitimate purchases:** - Your billing descriptor says "PAY*ACME LLC" instead of your business name - They forgot about a subscription renewal - A family member used their card without telling them (that one is [genuinely unauthorized](/docs/reference/fraud-classification#worked-example-my-family-member-used-my-card), not friendly fraud) - They had buyer's remorse and found disputing easier than returning - They genuinely don't remember the purchase The fix for most of these is **communication**, not technology: - Use a billing descriptor that matches your business name - Send purchase confirmation emails immediately - Send reminder emails before subscription renewals - Make your refund process easy and obvious ### When Stolen Cards Are the Real Problem If you see these patterns, you likely have a third-party fraud problem: - Shipping address doesn't match billing address - New customer places an unusually large order - Customer requests rush shipping on a first order - Multiple orders from different cards going to the same address - You sell high-resale items (electronics, gift cards, luxury goods) **The good news**: your processor already ships AVS, CVV checks and 3D Secure. Those catch most of it. You probably don't need to buy anything. ### What You Lose When Fraud Happens A $100 fraud loss doesn't cost you $100. It costs more: | Cost | Amount | |------|--------| | The product or service | $100 | | Chargeback fee | $0 to $30, usually $15 | | Shipping costs (if physical goods) | $5-15 | | Processing fees (non-refundable) | $3 | | Time spent responding | 1-3 hours | | **Total real cost** | **$130-150+** | Let your chargeback ratio run above 0.9% and your processor can fine you. Or close the account. ### The "Do Nothing" Threshold **Under $100K a year, you probably don't need fraud tools beyond your processor's.** The built-in rules handle the obvious stuff. A few chargebacks a year cost less than a subscription. Spend the effort on your descriptor and your customer emails. **When to start investing in fraud prevention:** - Your chargeback ratio is above 0.5% - You're seeing patterns (same device, same shipping address, burst of orders) - You sell high-risk products (digital goods, electronics, gift cards) - Your volume is growing past $100K/year When you're ready, the [Fraud Vendor Landscape](/docs/fraud/vendors/landscape) covers what exists. The [Vendor Selection Guide](/docs/fraud/vendors/selection-guide) ranks it by business type and ROI. ### Next Steps [ โ–ถ๏ธ Continue: Setting Up Protection Turn on the free and low-cost fraud tools your processor already offers. ](/docs/learning-pathways/protecting-from-fraud/setting-up-protection) [ ๐Ÿ“š Go Deeper: Fraud Prevention Full guides on fraud types, detection methods, and vendor selection. ](/docs/fraud) --- ## Monitoring for Fraud Source: https://paymentsandrisk.com/docs/learning-pathways/protecting-from-fraud/monitoring-for-fraud # Monitoring for Fraud You've set up your [fraud protections](./setting-up-protection.md). Now you need to know what to watch and when to worry. Fraud monitoring doesn't need to be a full-time job. A weekly check takes 10 minutes and catches problems before they become crises. :::info[TL;DR] - **Check your chargeback ratio weekly.** The one number that matters most - **Watch for pattern changes,** like sudden spikes in orders, declines, or chargebacks - **Know your escalation triggers:** the numbers that mean "act now" - **Don't over-monitor.** Weekly is enough for most small businesses ::: One number decides whether the card networks fine you or shut you down, and it's your chargeback ratio. ### The One Number That Matters: Your Chargeback Ratio Your chargeback ratio is the percentage of transactions that become disputes. Card networks use this number to decide whether to fine you or shut you down. **How to calculate it:** ``` Chargeback ratio = Chargebacks this month รท Transactions this month ร— 100 ``` **Example:** 5 chargebacks out of 1,000 transactions = 0.5% That formula is Visa's. Mastercard uses a different denominator: this month's chargebacks over **last month's** transaction count. On identical numbers, a growing business looks worse to Mastercard. Check which one your dashboard is showing you. **The thresholds to know:** | Ratio | Status | What Happens | |-------|--------|-------------| | Below 0.5% | Healthy | Nothing. Keep doing what you're doing. | | 0.5% - 0.9% | Watch carefully | You're getting close to processor-enforced thresholds. Review your recent chargebacks. | | 0.9% - 1.5% | Danger zone | Your processor will likely flag you. Acquirers often act well below network thresholds. See [Network programs](/docs/chargebacks/reference/network-programs). Take action now. | | Above 1.5% | Crisis | Visa VAMP merchant excessive threshold (1.5% since 1 April 2026; 2.2% in CEMEA only), and only once you also hit 1,500 combined fraud reports and disputes in a month. Mastercard ECM needs 100-299 chargebacks **and** a 1.50-2.99% ratio. Past 299 and 3.00% together it's HECM, at double the fines. Fees and account freezes likely. See the [0.9% Panic Guide](/docs/chargebacks/zero-point-nine-panic). | :::warning[Where to Find Your Ratio] - **Stripe:** Dashboard > Radar > Overview (dispute rate shown at top) - **Square:** Dashboard > Balance > Disputes (calculate manually: disputes / transactions) - **Shopify Payments:** Settings > Payments > View payouts > Disputes tab - **PayPal:** Resolution Center > Open cases If your processor doesn't show the ratio directly, divide your dispute count by your transaction count for the month. Confirm they're using **count-based** calculation - that's what Visa and Mastercard use. ::: ### Your Weekly 10-Minute Check Every Monday (or whatever day works), spend 10 minutes on these: **1. Check your chargeback ratio** (2 minutes) - Log into your processor dashboard - Look at chargebacks received this month vs. transaction count - If the ratio is above 0.5%, dig into the individual disputes **2. Scan for unusual patterns** (3 minutes) - Any spike in decline rates? (Could mean card testing) - Any orders from new locations or new customer segments? - Any repeat disputes from the same customer? **3. Review new chargebacks** (5 minutes) - Read the reason code for each new chargeback - Is it fraud, "not received," or "not recognized"? - If "not recognized," check if your billing descriptor is the problem ### Patterns That Mean "Act Now" These signals mean something has changed and you need to investigate immediately: | Signal | What It Might Mean | First Action | |--------|-------------------|-------------| | Decline rate jumps 5%+ in a day | Card testing attack | Check velocity rules, look for burst patterns from single IPs | | 3+ chargebacks from same reason code in a week | Systemic problem | Fix the root cause (descriptor, shipping, product description) | | New orders to unfamiliar region spike | Fraud ring testing your site | Review orders manually, tighten geographic rules if needed | | Customer complaints about unrecognized charges | Billing descriptor issue | Fix your descriptor immediately | | Processor sends you an email about chargebacks | You're on their radar | Reply immediately with your remediation plan | :::tip[Processor Emails Are Urgent] If your processor sends you an email about chargebacks, elevated risk, or account review, **reply within 24 hours** even if you don't have a complete answer. Silence makes processors nervous. A response like "We've seen this and are investigating. Here's what we've done so far" buys you time and goodwill. ::: ### What to Do When You Catch Something **If it's a card testing attack** (burst of small transactions, high decline rate): 1. Check your velocity rules. Are they active? 2. Block the offending IP addresses or devices 3. Add CAPTCHA to your checkout if you don't have one 4. The attack usually stops within hours **If it's a friendly fraud spike** (real customers disputing real orders): 1. Check your billing descriptor. Is it recognizable? 2. Review your confirmation emails. Do they clearly explain the charge? 3. Make your refund process easier to find 4. Consider adding [pre-dispute alerts](/docs/chargebacks/prevention/alerts) (Verifi/Ethoca) if volume justifies the cost **If it's a stolen card pattern** (orders to unusual addresses, high-value items): 1. Enable manual review for orders matching the pattern 2. Consider adding [3D Secure](/docs/fraud/prevention/3ds) for the risky segment 3. Contact your processor if the pattern is aggressive ### When to Get Professional Help Most small businesses can handle fraud monitoring themselves. But consider getting help if: - Your chargeback ratio is above 0.65% and you can't bring it down - You're seeing organized fraud (same device, multiple cards, coordinated timing) - Your processor has sent you a formal warning letter - You need to implement 3D Secure or advanced rules and aren't sure how **Where to get help:** - Your processor's risk team (free, and they want to help you stay below thresholds) - A payments consultant (for strategy, not tool sales) - [Chargeback alert services](/docs/chargebacks/prevention/alerts) like Verifi or Ethoca (if your volume justifies the per-alert cost) ### You've Completed the Fraud Protection Pathway You now understand: - [What fraud looks like](./fraud-basics.md) for small businesses - [How to set up basic protections](./setting-up-protection.md) using free tools - What to monitor and when to escalate ### Next Steps [ โ–ถ๏ธ Next: Running Your Payments Day-to-Day Learn the daily and weekly tasks that keep your payments running smoothly. ](/docs/learning-pathways/running-payments-daily/daily-weekly-tasks) [ ๐Ÿ“š Go Deeper: Full Fraud Section Advanced fraud types, detection methods, device fingerprinting, and vendor selection. ](/docs/fraud) [ ๐Ÿ” Fraud Types All the ways fraud happens ](/docs/fraud/types) [ โšก Velocity Rules Advanced rule configuration ](/docs/fraud/detection/velocity-rules) [ ๐Ÿšจ 0.9% Panic Guide If your ratio spikes ](/docs/chargebacks/zero-point-nine-panic) --- ## Setting Up Fraud Protection Source: https://paymentsandrisk.com/docs/learning-pathways/protecting-from-fraud/setting-up-protection # Setting Up Fraud Protection :::info[TL;DR] - **Turn on AVS and CVV.** Free, catches obvious fraud - **Set up velocity limits.** Blocks card testing attacks - **Fix your billing descriptor.** It'll stop friendly fraud before it starts - **Consider 3D Secure** for high-risk transactions. It'll shift fraud liability to the issuer ::: You know [what fraud looks like](./fraud-basics.md). Now turn on your defenses. Most of the effective ones are free. They're already sitting in your processor dashboard. ### Step 1: Enable AVS and CVV (Free) [AVS](/docs/fraud/prevention/avs-cvv) checks the billing address against the issuer's records. That's Address Verification Service. [CVV](/docs/fraud/prevention/avs-cvv) checks the 3-4 digit code on the card. Both are free. **What to do:** 1. Log into your processor dashboard 2. Find fraud rules or risk settings 3. Enable CVV requirement for all transactions 4. Enable AVS checking **Where to find it by processor:** - **Stripe:** Dashboard > Radar > Rules (AVS/CVV are on by default) - **Square:** Dashboard > Account & Settings > Risk Manager - **Shopify Payments:** Settings > Payments > Fraud analysis (basic fraud analysis is automatic) - **Braintree:** Control Panel > Fraud Management **How to use the results:** | Signal | What to Do | |--------|-----------| | CVV doesn't match | **Decline.** The card isn't present. This is almost always fraud. | | AVS full match (address + zip) | Good signal. Process normally. | | AVS partial match (zip only) | Moderate risk. Fine for most orders. | | AVS no match | Higher risk. Review the order manually if it's large. | | AVS unavailable (international cards) | Don't auto-decline. 40-60% of non-US cards can't check AVS. Use other signals. | :::warning[Don't Hard-Decline on AVS Alone] About 20-30% of legitimate customers fail AVS checks. They've moved recently. They typed the address differently. Their bank's records are stale. Decline every AVS mismatch and you'll lose sales. More than you save in fraud. ::: ### Step 2: Set Up Velocity Limits (Free) Velocity limits cap transactions from one card, IP or device. You set the window. They're your best defense against card testing. **Start with these limits:** | Rule | Threshold | Why | |------|-----------|-----| | Transactions per card per hour | 3 | Normal customers don't buy 4+ times in an hour | | Transactions per IP per hour | 5 | Catches automated testing | | Failed authorizations per card (10 min) | 3 | Fraudsters test until one works | | Unique cards per device per day | 5 | One person doesn't normally use 6 cards | **Where to set these:** - **Stripe:** Dashboard > Radar > Rules > Add rule (e.g., "Block if :card_count_for_ip: > 5") - **Square:** Dashboard > Account & Settings > Risk Manager > Velocity rules - **Shopify Payments:** Settings > Payments > Fraud analysis (limited built-in; use Shopify Flow for custom rules) - **Braintree:** Control Panel > Fraud Management > Advanced Fraud Tools :::tip[Test Before You Block] Run rules in "shadow mode" first, if your processor supports it. Flag transactions without blocking them. After 2 weeks, check how many flags were actually fraud. Under 30% and your rule's too aggressive. ::: ### Step 3: Fix Your Billing Descriptor (Free) It's the highest-impact change on this list. Your billing descriptor is what shows on the customer's statement. **Bad descriptors that cause disputes:** - `PAY*ACME LLC` - `SP * JOHN DOE` - `STRIPE 8472910` **Good descriptors that prevent disputes:** - `ACME WIDGETS` (your recognizable business name) - `PETSTORE.COM` (your website URL) - `ACME 800-555-0199` (name + phone number) **How to fix it:** - **Stripe:** Dashboard > Settings > Public details > Statement descriptor - **Square:** Dashboard > Account & Settings > Business information > Statement descriptor - **Shopify Payments:** Settings > Payments > Statement descriptor - **PayPal:** Settings > Payment preferences > Statement descriptor Set it to your recognizable business name or website URL. If your processor allows it, add your phone number. **Test it:** make a $1 purchase on your own card. Check your statement in 2-3 days. Can't immediately tell what the charge is for? Your customers can't either. ### Step 4: Send Purchase Confirmations (Free) Email or SMS confirmations immediately after purchase do two things: 1. Remind the customer what they bought (prevents "I don't recognize this" disputes) 2. Give them a way to contact you instead of their bank **Your confirmation should include:** - Your business name (matching the billing descriptor) - What they bought (specific items, not just "Order #12345") - The amount charged - Your contact information for questions - How to request a refund ### Step 5: Consider 3D Secure for High-Risk Orders [3D Secure](/docs/fraud/prevention/3ds) is the prompt you sometimes get at checkout. "Visa Secure" or "Mastercard Identity Check." The older names were "Verified by Visa" and "Mastercard SecureCode." It's powerful because it **shifts fraud liability to the card issuer**. A fraud chargeback on a 3DS-authenticated transaction? The issuer eats it, not you. **The tradeoff:** 3DS adds friction to checkout. Expect a 2-5% drop in authorization rate at first. **When 3DS is worth it:** - Your fraud rate is above 0.5% - You sell digital goods (no shipping address to verify) - You're approaching [chargeback warning thresholds](/docs/chargebacks/reference/network-programs). Acquirers often act well below the 1.5% VAMP line - Individual orders are high value **When to skip 3DS:** - Your fraud rate is low - You sell low-value items where chargebacks are cheaper than lost sales - Your customers are mostly repeat buyers, so they're low risk **How to enable it:** - **Stripe:** Dashboard > Settings > Payments > 3D Secure rules (or use Radar rules to trigger selectively) - **Square:** Not available for most SMB accounts - **Shopify Payments:** Enabled automatically for high-risk transactions - **Braintree:** Control Panel > Processing > 3D Secure **How to roll it out:** 1. Start with your highest-risk segment only. New customers, plus orders above your average fraud amount 2. Run for 2-4 weeks. Measure the impact on auth rate and fraud 3. Auth rate drops more than 5% with no fraud improvement? Scale it back ### Your Protection Setup Checklist Do these in order, this week: ``` โ–ก Enable CVV requirement (5 minutes) โ–ก Enable AVS checking (5 minutes) โ–ก Set velocity limits on your processor (15 minutes) โ–ก Fix your billing descriptor (10 minutes) โ–ก Set up purchase confirmation emails (30 minutes) โ–ก Make a test purchase and check your own statement (2 days to verify) โ–ก Review if 3DS makes sense for your risk level (15 minutes) ``` ### Next Steps [ โ–ถ๏ธ Continue: Monitoring for Fraud Learn what to watch for and when to escalate. ](/docs/learning-pathways/protecting-from-fraud/monitoring-for-fraud) [ ๐Ÿ“š Go Deeper: Fraud Prevention Advanced detection methods, risk scoring, and device fingerprinting. ](/docs/fraud/prevention) --- ## Negotiating Rates and Comparing Processors Source: https://paymentsandrisk.com/docs/learning-pathways/reducing-costs/negotiating-and-comparing # Negotiating Rates and Comparing Processors Now that you [understand your costs](./understanding-your-costs.md), you can either negotiate better rates with your current processor or find a cheaper alternative. Both start with knowing your numbers. :::info[TL;DR] - **Get 2-3 competing quotes** before negotiating. This is your leverage - **Compare effective rates**, not advertised rates - **Only switch if the savings are meaningful.** 0.3%+ effective rate difference is worth it - **Month-to-month contracts** protect you, so avoid long-term commitments ::: Negotiating leverage tracks your volume, and under $10,000 a month you have almost none. ### When Negotiating Makes Sense Not every merchant has negotiating power. Here's a realistic view: | Monthly Volume | Negotiating Leverage | Best Strategy | |---------------|---------------------|---------------| | Under $10K | Minimal | Don't waste time negotiating - but do compare flat rate against a published interchange-plus band, because that comparison costs you nothing and can beat any discount you'd have won | | $10K - $50K | Some | Ask for fee removal (PCI, statement fees), compare 2-3 quotes | | $50K - $200K | Meaningful | Negotiate processor markup, get interchange-plus pricing | | $200K+ | Significant | Negotiate everything, consider direct processor relationships | :::note[Switching pricing models usually beats negotiating the rate] Negotiating a flat rate typically wins you 0.1-0.2%. Moving from flat rate to a published interchange-plus band typically wins you more, and it doesn't need a phone call. At $250,000 a month card present, 0.2% off a flat rate is worth $500 a month; the published gap between Square's 2.6% + 15c and Helcim's $100K-500K band is roughly $1,300 a month on a typical card mix. Do the bigger one first, then negotiate. Sources verified 2026-08-02: [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), [helcim.com/pricing](https://www.helcim.com/pricing/). ::: ### Step 1: Get Competing Quotes Before you talk to your current processor, get 2-3 quotes from competitors. You need leverage. **Where to start:** See [Processor Comparison](/docs/payments/processor-comparison) for verified published rates and a regional shortlist to get quotes from, or check individual [processor profiles](/docs/payments/processors) for detailed breakdowns of Stripe, Square, Helcim, Shopify Payments, and more. **What to ask each processor:** 1. "What's your interchange-plus rate for my volume and business type?" 2. "What are ALL the monthly and per-transaction fees?" (Get a complete list, not just the headline rate) 3. "What's the contract length and cancellation policy?" 4. "Can you show me a sample statement for a business like mine?" 5. "What would my effective rate be on $[your monthly volume]?" **Red flags in processor quotes:** - They won't give you a straight answer on effective rate - The quote only shows "qualified" rates (tiered pricing) - Long-term contract (3+ years) with early termination fees - Liquidated damages clause (you owe future fees if you leave early) - They refuse to show a sample statement ### Step 2: Negotiate With Your Current Processor Once you have competing quotes, call your current processor's retention or account management team (not general support). **The script:** > "I've been processing with you for [X months/years] and I've been reviewing my fees. My effective rate is [X%], which is higher than what I'm seeing from other processors who've quoted me [Y%]. I'd like to stay, but I need my rate to be competitive. What can you do?" **What's negotiable:** | Fee | Negotiability | How to Ask | |-----|-------------|-----------| | Processor markup (per-transaction) | High | Quote a published band back at them. Helcim publishes interchange + 0.40% + 8c card present at $0-50K/month, + 0.35% + 7c at $50-100K, + 0.25% + 7c at $100-500K, + 0.20% + 6c at $500K-1M and + 0.15% + 6c at $1M-5M. Ask: "Can you match interchange + 0.25% + 7c?" with the band that fits your volume | | Monthly fees | High | "Can you waive the statement fee and monthly minimum? Helcim charges neither." | | PCI compliance fee | High | "Can you remove this? I'm using your hosted payment page, and several processors don't charge a PCI fee at all." | | Chargeback fee | Medium | "Can you match Helcim, which charges $0 when I win and $15 when I lose?" That's the most merchant-friendly published policy in the market, and it's a fair benchmark to name | | Per-transaction fee | Medium | "Can you lower the per-transaction fee?" Published card-present figures run from 6c (Helcim at $1M-5M) to 8c (Stax, Helcim entry band) to 15c (Square) | | Early termination fee | Medium | "Can you switch me to month-to-month?" | | Interchange | Not negotiable | Don't waste time on this. It's set by card networks | | Network assessments | Not negotiable | Same as interchange | :::tip[The Best Time to Negotiate] - **After 6+ months** of clean processing history (low chargebacks, consistent volume) - **When your volume increases.** Use the growth as leverage - **When you have competing quotes.** Never negotiate without alternatives - **At contract renewal.** This is when they most want to keep you ::: ### Step 3: Compare Apples to Apples Processor quotes are designed to be hard to compare. Here's how to cut through the noise: **The only comparison that matters:** ``` Processor A effective rate = Total estimated fees รท Your monthly volume Processor B effective rate = Total estimated fees รท Your monthly volume ``` Ask each processor: "Based on my volume of $[X]/month with [Y] transactions, what would my total monthly fees be?" If they can't answer that clearly, that's a red flag. **Things to include in the comparison:** - Per-transaction processing fees - Monthly fees (statement, PCI, minimum, gateway) - Chargeback fees (multiply by your average monthly chargebacks) - Setup or integration costs (one-time) - Contract terms (length, cancellation cost) ### Step 4: Decide Whether to Switch Switching processors is disruptive. Only do it if the savings justify the effort. **Worth switching:** - Effective rate difference of 0.3%+ at your volume - Current processor has poor support or reliability issues - Current processor has restrictive terms (long contract, high termination fees) - Better features you'll actually use (better reporting, faster payouts) **Not worth switching:** - Effective rate difference under 0.1% - You're locked in a contract with expensive termination fees - The new processor doesn't support your payment methods or integrations - You're switching just because of one bad support experience ### If You Decide to Switch **Migration checklist:** ``` โ–ก Confirm the new processor supports your integration (Shopify, WooCommerce, custom, etc.) โ–ก Check if the new processor can handle your chargeback rate (ask about risk appetite) โ–ก Set up the new processor in parallel (don't cancel the old one yet) โ–ก Test with real transactions before switching fully โ–ก Update subscription/recurring billing to the new processor โ–ก Keep the old processor active for 120+ days (chargebacks on old transactions will still come in) โ–ก Notify your bank of the new deposit source ``` :::warning[Don't Turn Off Your Old Processor Too Early] Chargebacks can arrive up to 120 days after a transaction. If you shut down your old processor before this window closes, you won't be able to respond to disputes on older transactions. Keep it active (even if not processing new transactions) for at least 4-6 months. ::: ### Quick Wins You Can Do Today Even without switching processors, these save money immediately: 1. **Remove junk fees.** Call and ask to remove PCI non-compliance, statement, and annual fees 2. **Complete PCI questionnaire.** Eliminates $10-150/month in non-compliance penalties 3. **Switch from tiered to interchange-plus.** Ask your current processor if they offer IC+ pricing 4. **Settle transactions daily.** Late settlement can cause interchange downgrades (higher fees) 5. **Submit AVS/CVV data.** Missing verification data triggers higher interchange rates ### Next Steps [ โ–ถ๏ธ Continue: Scaling Decisions Know when your business has outgrown its current payments setup. ](/docs/learning-pathways/reducing-costs/scaling-decisions) [ ๐Ÿ“š Go Deeper: Buying Payments Full processor selection guide with comparison frameworks. ](/docs/payments/buying-payments) --- ## Scaling Your Payments Source: https://paymentsandrisk.com/docs/learning-pathways/reducing-costs/scaling-decisions # Scaling Your Payments The setup that worked at $10K/month breaks at $100K/month. This lesson is about spotting that, and about not buying too early. :::tip[The #1 Scaling Mistake] Buying enterprise tools before you need them. A business doing $30K/month doesn't need a fraud vendor, a representment service or a multi-processor strategy. Those pay for themselves at higher volume. Below that they're a cash drain. ::: :::info[TL;DR] - Match the tools to the volume. Most scaling mistakes are early purchases. - Under $25K a month, an aggregator and your processor's defaults are enough. - At $25K-$100K, get an interchange-plus quote. Negotiate the markup, not the headline rate. - Alert services and fraud vendors earn their keep above $100K, if your ratio says so. - Run the annual review at the bottom. One hour, once a year. ::: What you should do about processors, fraud and chargebacks changes at four volume tiers, and the first one starts under $25,000 a month. ### What Changes at Each Volume Tier | Monthly Volume | Processor Strategy | Fraud Strategy | Chargeback Strategy | |---------------|-------------------|----------------|-------------------| | **Under $25K** | Aggregator (Square, Stripe) for simplicity, or interchange-plus with no monthly fee if your card mix is debit-heavy | Processor defaults + clear descriptors | Handle yourself, focus on prevention | | **$25K - $100K** | Get an interchange-plus quote and compare it properly. Negotiate the markup, not the headline rate | Enable processor rules, add velocity limits | Consider alert services if ratio > 0.5% | | **$100K - $500K** | Shop around, direct processor relationship | Custom rules, possibly 3DS for segments | Alert services (Verifi/Ethoca), track metrics weekly | | **$500K+** | Multi-processor consideration | Fraud vendor evaluation, possibly ML scoring | Representment vendor, dedicated chargeback management | ### Signs You've Outgrown Your Current Setup **Your processor is too expensive:** - Your effective rate is 0.5%+ above benchmark for your business type. - You're paying flat-rate pricing above $50K/month. At $250K/month card present, Square's 2.6% + 15c against Helcim's $100K-500K band of interchange + 0.25% + 7c is roughly $1,300 a month on a typical card mix. - You're on tiered pricing at any volume. **Your processor can't keep up:** - Payouts are late more often than not. - Support takes days to answer anything. - Their dashboard doesn't show the metrics you need. - They can't support the payment methods your customers want. **Your fraud tools are insufficient:** - Fraud losses are growing faster than revenue. - You're getting organized attacks that processor rules can't stop. - Your manual review queue eats hours every day. - Your chargeback ratio sits above 0.5% month after month. **Your operations are too manual:** - Reconciliation takes hours because your tools don't integrate. - You can't see chargeback data alongside transaction data. - Reporting means exporting CSVs and building spreadsheets. - You're managing disputes through email instead of a system. ### Upgrades Worth Making (And When) **Level 2/3 data submission** (if you sell B2B) - **What it does:** sends extra detail, like tax amount and customer code, to qualify for lower interchange. - **Savings:** 0.5-0.8% on corporate card transactions. - **When it's worth it:** you do $50K+/month in B2B. - **How:** ask your processor if they support Level 2/3 data capture. **Chargeback alert services** (Verifi CDRN, Ethoca) - **What they do:** intercept disputes before they turn into chargebacks. - **Cost: not published.** Neither Verifi nor Ethoca publishes alert pricing. You buy through a reseller, so the quote is their margin decision. It's negotiable. Ask for the per-alert fee, the monthly minimum and the contract term in writing. - **How to judge a quote:** work out what a prevented dispute is worth to you. You don't save the sale. Resolving an alert means refunding the customer. You save the dispute fee, plus the 1-3 hours of your own time. That fee is $15 on Stripe or Braintree. It's $15 or $20 on PayPal depending on the channel, $0 on Square, and $0 on Helcim if you'd have won anyway. All read 2026-08-02. At $20-40 an alert, the fee saving alone never covers it. You're buying the ratio and your own time. - **When they're worth it:** your ratio is above 0.5% and the quote sits below the number you just worked out. - **How:** ask your processor, or sign up directly with Verifi or Ethoca. **3D Secure implementation** - **What it does:** shifts fraud liability to the card issuer. - **Cost:** often included with your processor. Expect a small auth rate hit. - **When it's worth it:** fraud chargebacks are your main dispute type. - **How:** turn it on in your processor's dashboard. Start with high-risk segments. **Dedicated fraud vendor** - **What they do:** advanced fraud scoring, device fingerprinting, ML models. - **Cost: almost nobody publishes one.** SEON is the exception. Starter is **$699 a month for 2,500 fraud checks**, 10 users and 50 custom rules, with Premium quote-only ([seon.io/pricing](https://seon.io/pricing/), verified 2026-08-02). Call it about **28 cents a check**, the only public anchor you have for judging any other quote. Signifyd publishes its model but no numbers: a percentage of the order total on approved orders, nothing when an order is declined for fraud ([signifyd.com/pricing](https://www.signifyd.com/pricing/)). Sift, Riskified, Forter, Sardine, Accertify and Equifax (formerly Kount) publish nothing at all. - **When they're worth it:** you're over $200K/month AND fraud is a real problem. - **What to ask:** is this priced per screened transaction, per approved order, or as a subscription? What's the monthly minimum and the contract term? On a guarantee, what does it cover and when does reimbursement land? - **How:** see the [Fraud Vendor Selection Guide](/docs/fraud/vendors/selection-guide). ### Upgrades to Skip Until You're Bigger | Tool/Service | Skip Until | Why | |-------------|-----------|-----| | [Multi-processor strategy](/docs/operations/multi-processor) | $500K+/month | Management overhead isn't worth it at lower volumes | | Guaranteed chargeback tools | $200K+/month | The per-transaction cost exceeds the chargeback cost at low volumes | | Custom ML fraud models | $1M+/month | You don't have enough data to train a model below this | | In-house fraud analyst | $500K+/month | A part-time consultant is more cost-effective below this | | [Automated reconciliation](/docs/operations/accounting-integration) | $100K+/month | A spreadsheet works fine until then | | Payment orchestration layer | $1M+/month | Adds complexity without enough benefit at lower volumes | ### The Annual Review Once a year, spend an hour on this checklist: ``` Volume & Growth โ–ก What's my monthly volume now vs. 12 months ago? โ–ก Am I approaching a volume tier where my strategy should change? Costs โ–ก What's my effective rate? Has it changed? โ–ก Am I paying for tools or services I'm not using? โ–ก Should I renegotiate or switch processors? Risk โ–ก What's my average chargeback ratio over the last 6 months? โ–ก Am I seeing new fraud patterns? โ–ก Do I need to add or upgrade fraud tools? Operations โ–ก Is my reconciliation process working? โ–ก Am I spending too much time on manual tasks? โ–ก Are there integrations that would save significant time? ``` ### You've Completed The Guide Congratulations. You've worked through all five pathways: 1. [Getting Started with Payments](/docs/learning-pathways/getting-started-with-payments/introduction): how money moves 2. [Handling Your First Chargeback](/docs/learning-pathways/handling-your-first-chargeback/how-disputes-work): disputes and evidence 3. [Protecting from Fraud](/docs/learning-pathways/protecting-from-fraud/fraud-basics): prevention and monitoring 4. [Running Payments Daily](/docs/learning-pathways/running-payments-daily/daily-weekly-tasks): operations and statements 5. [Reducing Costs](/docs/learning-pathways/reducing-costs/understanding-your-costs): fees, negotiation, and scaling You have the foundation now. The rest of this site goes deeper on every topic. Use it as a reference when something specific comes up. ### Where to Go From Here [ ๐Ÿ“‹ Playbooks Step-by-step guides for specific situations: crises, projects, and decisions. ](/docs/playbooks) [ ๐Ÿ“š Full Documentation Deep dives on every topic: payments, fraud, chargebacks, compliance, and operations. ](/docs) [ ๐Ÿšจ 0.9% Panic Guide When your ratio spikes ](/docs/chargebacks/zero-point-nine-panic) [ โŒ Decline Codes Why transactions fail ](/docs/reference/decline-codes) [ ๐Ÿ”ข Reason Codes Chargeback categories ](/docs/reference/reason-codes) --- ## Understanding Your Payment Costs Source: https://paymentsandrisk.com/docs/learning-pathways/reducing-costs/understanding-your-costs # Understanding Your Payment Costs :::info[TL;DR] - **Three layers of fees.** Interchange goes to the card networks, assessments go to Visa and Mastercard, markup goes to your processor. - **Only processor markup is negotiable.** The networks set the rest. - **Your effective rate** is total fees divided by total volume. It's the only number that matters. - **On a $50 card-present ticket, flat rate costs about 95 basis points more than a published interchange-plus band.** That's $238.50 a month at $25,000 of volume. Below about a $9.23 ticket the flat rate wins instead. - Every figure here uses one blended pass-through. That's 1.03% + $0.178 card-present and 1.50% + $0.172 online. See [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). ::: Several companies take a cut of every card payment, some of it fixed and some of it negotiable, and knowing which is which is the whole job. ### Where Your Money Goes Charge a customer $100 online and the fees break down like this. The interchange range is wide. It depends entirely on which card the customer hands you: | Fee Layer | Who Gets It | On a $100 online sale | Can You Negotiate? | |-----------|------------|----------------|-------------------| | **Interchange** | Customer's bank (issuer) | $0.27 on a regulated debit card, $2.89 on a commercial card, **$1.51 on this site's blended mix** | No, set by Visa/Mastercard | | **Assessments** | Card networks (Visa/Mastercard) | about **$0.16**, modelled at 0.14% + $0.02 and **unverified** - neither network publishes a US assessment schedule | No, set by networks | | **Processor markup** | Your processor | $0.15 - $0.50 on interchange-plus, buried inside the headline rate on flat rate | **Yes** | | **Total** | | $0.58 - $3.55 across card types, **$1.82 - $2.17 on the blended mix** | | Interchange and assessments together are what this site calls pass-through. Every worked example below uses one figure for it. That's **1.50% + $0.172 online and 1.03% + $0.178 card-present**. Where those come from, and which inputs are dials rather than published rates, is in [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). Interchange is the biggest chunk. You can't negotiate it. You can control which interchange rate applies, though. And you can negotiate your processor's markup. ### Why Different Cards Cost You Different Amounts A basic debit card costs far less to accept than a premium rewards card. The same card also costs more online than it does in person: | Card Type | Card-present interchange | Online interchange | Why | |-----------|------------------------|--------------------|-----| | Regulated debit (US) | 0.05% + $0.22 | 0.05% + $0.22 | Issuer holds over $10B in assets, so the Durbin Amendment caps it | | Exempt debit (US) | 0.80% + $0.15 | 1.65% + $0.15 | Smaller issuer, no cap applies | | Interac debit (Canada) | ~$0.05-$0.10 flat | Separate product | Canadian debit network, flat fee per transaction | | Consumer credit, no rewards | 1.51% + $0.10 | 1.89% + $0.10 | Plain card, nothing to fund | | Standard rewards credit | 1.65% + $0.10 | 2.05% + $0.10 | You're funding someone's cashback | | Premium rewards credit (Signature Preferred) | 2.10% + $0.10 | 2.50% + $0.10 | You're funding someone's airline miles and lounge access | | Top consumer tier (Visa Infinite, MC World Elite) | 2.30% + $0.10 | 2.60% + $0.10 | The most expensive consumer card either network issues | | Commercial / corporate | 2.26% + $0.10 | 2.79% + $0.10 | Higher limits, richer rebates to the cardholder's employer | | Non-qualified | 3.15% + $0.10 | 3.15% + $0.10 | What you pay when a transaction fails qualification | US figures come off Visa's published schedule dated 18 April 2026, cross-checked against Mastercard's dated 17 April 2026. Both networks publish the same number at every bound that matters, so nothing here is Visa-anchored. :::warning["Rewards credit, 1.80% + $0.10" is not a card mix average] Plenty of comparison content uses **1.80% + $0.10** as the average interchange for a whole business. It isn't an average. It's one card type. That card is a consumer rewards credit card. Use it as a blend and you overstate card-present cost by about 79 basis points. On $20,000 a month that's roughly $159 of cost that doesn't exist. All of it lands on the interchange-plus side of the comparison. Every number on this page now uses one blended pass-through instead. That's 1.03% + $0.178 card-present, 1.50% + $0.172 online. See [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). ::: You can't tell customers what card to use. But this explains why your effective rate moves month to month. A month with more corporate card orders costs you more. ### The Three Pricing Models (Know Which One You're On) **Flat rate (Square, Stripe, PayPal, Shopify Payments)** - Same rate on every transaction. Square Free is 2.6% + 15c in person and 3.3% + 30c online ([squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02). - Simple and predictable. - You overpay on cheap cards like debit. You underpay on expensive ones like corporate. - Best for: anyone who wants a predictable number more than the lowest number. **Interchange-plus (Helcim, Stax, most traditional processors)** - You pay actual interchange plus a published or negotiated markup. Helcim's entry band is interchange + 0.40% + 8c in person, with **no monthly fee** ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). - Your rate varies by card type. The markup stays the same. - Most transparent. Cheapest in 20 of the 24 channel, ticket and volume scenarios this site models. - Best for: most merchants above roughly a $9 card-present ticket. There's no volume threshold to reach first. The exception is a card mix that runs unusually rewards-heavy. :::note[Where the crossover actually sits] Square Free and Helcim's entry band cost the same at one point. That point is **your interchange alone averaging 2.06% + 5c**. Add the 0.14% + $0.02 of network assessments this site models and it's 2.20% + 7c. Those assessments are unverified. So check which of the two your statement shows you before you compare. On the blended card-present mix this site publishes, the two are equal at a **$9.23 ticket**. Above it Helcim is cheaper. Below it Square is. That single number hides a lot, though. The crossover moves with the card: | Card the customer hands you, in person | Helcim is cheaper above | |---|---| | Exempt debit | $7.94 | | Regulated debit | $8.46 | | Consumer credit, no rewards | $9.09 | | Standard rewards credit | $12.20 | | Premium rewards credit | Never. Square is cheaper at every ticket | | Commercial / corporate | Never. Square is cheaper at every ticket | The "unusually rewards-heavy" caveat is real, and it has a shape. Add Helcim's 0.40% + 8c to the pass-through on a premium rewards card and you get 2.64% + 20c. Square's 2.6% + 15c is lower on both components. No ticket size rescues that. A debit-heavy retail mix is nowhere near the line. A B2B business running mostly commercial cards sits on the wrong side of it permanently. That's also why the old "wait until $20K a month" rule is dead. It was built for interchange-plus products that charged a monthly fee. Helcim's entry band charges none. So the answer depends on your card mix and your average ticket, not your volume. Full method in [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions). ::: **Tiered/bundled (avoid)** - Your processor sorts transactions into "qualified", "mid-qualified" and "non-qualified" buckets. - The qualified rate looks great in a sales pitch. Most transactions land in the pricier buckets. - Least transparent. Almost always the most expensive. - Best for: nobody, really. :::warning[If You're on Tiered Pricing, Switch] Tiered pricing exists to make fee comparison impossible. A processor advertising a "1.69% qualified rate" can land you at a 3.5% effective rate. Most transactions get downgraded. Get an interchange-plus or flat-rate quote and compare. ::: ### Hidden Costs Most Merchants Miss Beyond processing fees, these add up: **Chargeback fees:** these vary far more than people expect, and the difference compounds. Published per-dispute costs, verified 2026-08-02. **Helcim** charges $0 if the case resolves in your favour and $15 if you lose. **Stripe** charges $15 to receive the dispute, and you never get that back. Countering costs another $15, refunded only on an outright win. A partial win still costs you $30. **Braintree** charges $15. **PayPal** charges $15 on PayPal-account and Guest Checkout disputes, or $20 on card chargebacks. The two never both apply to one dispute. **Square** charges **$0** and says so outright. Five chargebacks a month at a $100 average ticket costs you $500 in lost sales. On top of that: $75 on Stripe or Braintree, $75 to $100 on PayPal, nothing at all on Square. One PayPal number is worth watching. Cross a 1.5% dispute ratio with more than 100 sales in the prior three months and the $15 becomes **$30**. PayPal also stops waiving it on disputes you win. **Refund processing fees:** most processors keep the processing fee when you refund. Refund $100 on Square's Free plan card-present rate and the $2.75 you already paid is gone. You don't get it back. **Non-compliance fees:** PCI non-compliance fees are pure waste. Fill out the questionnaire and they go away. Some processors never charge a PCI fee at all. Helcim states plainly that it has no setup, PCI, cancellation or statement fees. **Reserve holds:** some processors hold back a share of your deposits as a reserve. That's money you can't use. Typical reserves run 5-10% of volume, held for six months. **Currency conversion:** international transactions often carry a 1% markup on top of the exchange rate. ### Your First Cost Audit Do this right now. It takes 15 minutes: ``` 1. Pull last month's processor statement 2. Find total fees charged: $_____ 3. Find total volume processed: $_____ 4. Calculate effective rate: fees รท volume ร— 100 = ____% 5. Compare to benchmarks: โ–ก In-person: 1.8-2.3% is healthy โ–ก E-commerce: 2.5-3.2% is healthy โ–ก High-risk: 3.0-4.5% is healthy 6. If above the healthy range, identify: โ–ก Any junk fees (PCI non-compliance, statement fee)? โ–ก Are you on tiered pricing? โ–ก Has the rate been creeping up month-over-month? ``` ### How Much Could You Save? Published numbers, not a round guess. The comparison is Square's Free plan **card present** at 2.6% + 15c against Helcim's published interchange-plus bands. The ticket is **$50**. Pass-through is this site's blended card-present figure, **1.03% + $0.178**. Change the channel, the ticket or the card mix and the answer changes. Read [Cost Model Assumptions](/docs/payments/reference/cost-model-assumptions) before you lift these into a spreadsheet. | Monthly Volume | Square Free effective | Helcim band | Helcim effective | Monthly gap | Annual | |---|---|---|---|---|---| | $25,000 | 2.90% | IC + 0.40% + 8c | 1.95% | $238.50 | $2,862 | | $50,000 | 2.90% | IC + 0.35% + 7c | 1.88% | $512 | $6,144 | | $100,000 | 2.90% | IC + 0.25% + 7c | 1.78% | $1,124 | $13,488 | | $250,000 | 2.90% | IC + 0.25% + 7c | 1.78% | $2,810 | $33,720 | Sources verified 2026-08-02: [squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), [helcim.com/pricing](https://www.helcim.com/pricing/). The gap **widens** as you grow. Helcim's published bands step down automatically. Flat rate doesn't move. Even at $25,000 a month the gap is nearly $2,900 a year. That's far more than most merchants expect at that size, and it's why the 1.80% + $0.10 assumption matters so much. Run this table on that figure instead and the $25,000 row comes out at $85 a month rather than $238.50. **If you've compared processors before and decided the switch wasn't worth the hassle, check which interchange number the comparison used.** The real gap is two and a half to three times what the inflated assumption shows. At a smaller ticket the picture changes rather than just shrinks. Below about $9.23 card-present, Square is the cheaper of the two at any volume. Below about a $19.53 ticket, PayPal Zettle's 9-cent fixed fee beats both. Migration is a headache. But it's a one-week headache against a recurring cost. See [Processor Comparison](/docs/payments/processor-comparison) for current rates across 50+ processors and benchmark where you stand. ### Next Steps [ โ–ถ๏ธ Continue: Negotiating & Comparing How to negotiate with your current processor or find a better deal. ](/docs/learning-pathways/reducing-costs/negotiating-and-comparing) [ ๐Ÿ“š Go Deeper: Fee Audit Guide Detailed line-by-line fee analysis and red flag identification. ](/docs/payments/processor-fees-guide) --- ## Daily and Weekly Payment Tasks Source: https://paymentsandrisk.com/docs/learning-pathways/running-payments-daily/daily-weekly-tasks # Daily and Weekly Payment Tasks :::info[TL;DR] - Daily, 5 minutes: confirm the deposit landed and check for new chargebacks - Weekly, 10-15 minutes: chargeback ratio, decline rates, and reconcile sales against deposits - Under 100 transactions a month? Do the daily check and skim the rest. Come back when you're busier - None of this takes hours. Skipping it is what takes hours later ::: Running payments isn't just about accepting cards. There's a small set of tasks that keep your money flowing, your processor happy, and your customers not calling their bank. Most of this takes minutes, not hours. :::tip[You Don't Need All of This on Day 1] If you're just starting out, focus on the daily tasks. Add the weekly and monthly tasks as your volume grows. Under 100 transactions a month? Skim this page and come back when you're busier. ::: ### Daily Tasks (5 Minutes) **1. Check that deposits arrived** Your processor batches your transactions and deposits them into your bank account, usually 1-2 business days after the sale. Check that yesterday's batch arrived. - Log into your bank account - Compare the deposit amount to what your processor dashboard shows - If there's a mismatch or a missing deposit, check your processor dashboard for holds or errors **Where to check deposits:** - **Stripe:** Dashboard > Balances > Payouts - **Square:** Dashboard > Balance > Transfers - **Shopify Payments:** Settings > Payments > View payouts - **PayPal:** Activity > All transactions > filter by "Money received" :::info[Weekend Timing] Friday sales won't hit your bank until Monday or Tuesday. This is normal. Batches don't process on weekends or bank holidays. For help planning around settlement delays, see [Cash Flow Forecasting](/docs/operations/cash-flow-forecasting). ::: **2. Check for new chargebacks or disputes** Most processors send email notifications for new disputes, but don't rely on email alone. Log in and check. **Where to check disputes:** - **Stripe:** Dashboard > Payments > Disputes - **Square:** Dashboard > Balance > Disputes - **Shopify Payments:** Orders > Disputed (or Settings > Payments > View payouts > Disputes) - **PayPal:** Resolution Center If you have a new dispute, note the deadline (you typically have 20-45 days to respond depending on the network). Start gathering evidence immediately. Don't wait until the deadline. See [Responding to a Dispute](/docs/learning-pathways/handling-your-first-chargeback/responding-to-a-dispute) for how to handle it. **3. Process any pending refunds** Refunds waiting in a queue cost you money the longer they sit. Frustrated customers file chargebacks instead. Process refunds the same day they're requested when possible. ### Weekly Tasks (10-15 Minutes) **1. Check your chargeback ratio** This is the most important number in your payments operation. ``` Chargebacks this month รท Transactions this month = Chargeback ratio ``` Keep it below 0.5%. If it's creeping up, review your recent disputes to spot patterns. See [Monitoring for Fraud](/docs/learning-pathways/protecting-from-fraud/monitoring-for-fraud) for the full monitoring guide. **2. Review decline rates** Your processor dashboard should show your authorization (approval) rate. A healthy rate is 85-95% depending on your business type. | Auth Rate | Status | Action | |-----------|--------|--------| | Above 90% | Healthy | Nothing needed | | 80-90% | Worth investigating | Check for common decline codes | | Below 80% | Problem | Review your top [decline codes](/docs/reference/decline-codes) and contact your processor | **3. Reconcile sales to deposits** Once a week, compare your total sales (from your sales system or processor) to your total bank deposits for the same period. They won't match exactly. Processor fees, chargebacks, and refunds create differences. But large unexplained gaps need investigation. **Quick reconciliation:** ``` Expected deposit = Gross sales - Processing fees - Refunds - Chargebacks ``` If your actual deposit is significantly lower than expected, check for: - Holds or reserves your processor placed on your account - Fees you weren't expecting - Chargebacks you missed For detailed reconciliation workflows, see [Settlement & Reconciliation](/docs/payments/settlement/reconciliation). If you use QuickBooks or Xero, see [Payment-to-Accounting Integration](/docs/operations/accounting-integration) for mapping processor data to your books. ### Monthly Tasks (30 Minutes) **1. Review your processor statement** Your processor sends a monthly statement with all fees charged. Read it. See [Reading Your Statements](/docs/learning-pathways/running-payments-daily/reading-your-statements) for what to look for. **2. Calculate your effective rate** ``` Effective rate = Total fees paid รท Total volume processed ร— 100 ``` This is the real cost of accepting payments. Track it monthly. If it's creeping up without explanation, something changed. | Business Type | Healthy Effective Rate | |--------------|----------------------| | In-person (chip/tap) | 1.8% - 2.3% | | E-commerce | 2.5% - 3.2% | | High-risk e-commerce | 3.0% - 4.5% | | Subscriptions | 2.4% - 3.0% | Check your published rate before you treat a high number as a problem. Square's Free plan is 2.6% + 15c in person and 3.3% + 30c online ([squareup.com/us/en/payments/our-fees](https://squareup.com/us/en/payments/our-fees), verified 2026-08-02), so a small online store with a $50 average ticket sits at 3.90% by design. That's a pricing decision to revisit, not an anomaly to investigate. **3. Check for pattern changes** - Is your average transaction size changing? - Are you seeing more international cards? - Has your refund rate changed? - Any new customer complaints about billing? ### Setting Up Alerts Don't rely on remembering to check. Most processors let you set up alerts for: - **New chargebacks:** set to email immediately - **Deposit failures:** set to email immediately - **Account holds:** set to email immediately - **Large transactions:** set to email for orders above your typical range (possible fraud signal) **Where to set up alerts:** - **Stripe:** Dashboard > Settings > Emails (disputes, payouts) + Radar > Alerts - **Square:** Dashboard > Account & Settings > Notifications - **Shopify Payments:** Settings > Notifications (disputes are emailed automatically) - **PayPal:** Settings > Notifications > Transaction notifications If your processor doesn't offer these, check your dashboard daily until you can switch to one that does. See the [Alerts Configuration Guide](/docs/operations/alerts-configuration) for a detailed setup walkthrough. ### Tasks You Can Skip (For Now) If you process under $100K/month, these can wait: - Multi-processor strategy (you only need one processor) - Interchange optimization (savings are minimal at low volume) - Automated reconciliation tools (a spreadsheet works fine) - Fraud scoring models (processor defaults are enough) ### Next Steps [ โ–ถ๏ธ Continue: Reading Your Statements Understand what your processor is charging you and whether it's fair. ](/docs/learning-pathways/running-payments-daily/reading-your-statements) [ ๐Ÿ“š Go Deeper: Operations Full guides on processor management, payout strategy, and operations programs. ](/docs/operations) --- ## Reading Your Processor Statements Source: https://paymentsandrisk.com/docs/learning-pathways/running-payments-daily/reading-your-statements # Reading Your Processor Statements Your processor statement is a monthly record of everything they charged you. Most merchants never read it carefully. This is how processors quietly raise rates and add fees. They count on you not checking. :::info[TL;DR] - **Calculate your effective rate every month.** Total fees รท Total volume - **If you're on flat-rate pricing** (Stripe, Square), your statement is simple - **If you're on interchange-plus**, read the markup line. That's the negotiable part - **Watch for new fees.** They appear without fanfare and add up fast ::: Before you can read your statement, you need to know how your processor charges you. ### Start Here: What Pricing Model Are You On? **Where to find your statement:** - **Stripe:** Dashboard > Balances > Reports > Downloads - **Square:** Dashboard > Balance > Statements - **Shopify Payments:** Settings > Payments > View payouts > Export - **PayPal:** Activity > Statements > Monthly or Custom | Pricing Model | How It Works | Who Uses It | Transparency | |--------------|-------------|-------------|-------------| | **Flat rate** | One rate for everything. Square Free is 2.6% + 15c in person, 3.3% + 30c online | Square, Stripe, PayPal, Shopify Payments | High, simple but you overpay on cheap cards | | **Interchange-plus** | Actual card cost + a published or negotiated markup. Helcim's entry band is IC + 0.40% + 8c in person | Helcim, Stax, most traditional processors | High, complex statement but best value | | **Tiered/bundled** | "Qualified," "mid-qualified," "non-qualified" tiers | Older processor contracts | Low. Avoid this model if you can | :::warning[Avoid Tiered Pricing] Tiered pricing looks cheap ("Qualified rate: 1.69%!") but most transactions get classified as "mid-qualified" or "non-qualified" at much higher rates. If you're on tiered pricing, switching to interchange-plus or flat-rate will almost always save you money. ::: ### The One Number That Catches Everything: Effective Rate No matter what pricing model you're on, this formula tells you what you're actually paying: ``` Effective rate = Total fees charged รท Total volume processed ร— 100 ``` **Example:** You processed $50,000 last month. Your processor charged $1,500 in total fees. Your effective rate is 3.0%. **Is that good?** Compare to these benchmarks: | Business Type | Healthy Range | Investigate If Above | |--------------|--------------|---------------------| | In-person (chip/tap) | 1.8% - 2.3% | 2.5% | | Standard e-commerce | 2.5% - 3.2% | 3.5% | | High-risk e-commerce | 3.0% - 4.5% | 5.0% | | Subscriptions/recurring | 2.4% - 3.0% | 3.5% | Track this number monthly. If it's increasing and your business mix hasn't changed, your processor has raised rates or added fees. ### Reading a Flat-Rate Statement (Square, Stripe) If you're on flat-rate pricing, your statement is straightforward: | Line Item | What It Means | |-----------|--------------| | Processing fees | Your published rate. Square Free is 2.6% + 15c card present, 3.3% + 30c online, 3.5% + 15c keyed or card on file | | Dispute fees | Depends heavily on the processor, and the whole published US range is $0 to $30. Stripe charges $15 to receive a dispute plus $15 to counter it. PayPal charges $15 on wallet disputes or $20 on card chargebacks, never both. Square charges $0 | | Refunds | Processing fee is not returned on refunds | | Instant transfers | Square charges 1.95% per transfer; Stripe charges 1.5% in the US | | Payouts | Deposits to your bank account | *All figures verified 2026-08-02: [Square fees](https://squareup.com/us/en/payments/our-fees), [Square Instant Transfer](https://squareup.com/help/us/en/article/3807-set-up-and-edit-transfer-options), [Stripe disputes](https://support.stripe.com/questions/june-2025-pricing-updates-for-disputes), [Stripe instant payouts](https://docs.stripe.com/payouts/instant-payouts), [PayPal](https://www.paypal.com/us/business/paypal-business-fees).* **What to check:** - Are you being charged the rate you agreed to? Note that Square's card-present fixed fee is 15 cents, not the 10 cents a lot of comparison content still quotes - Count your disputes and verify the fee count matches - Add up your instant transfer fees for the month. At 1.95% they get large quietly - Look for any new line items you haven't seen before ### Reading an Interchange-Plus Statement Interchange-plus statements are more complex but more transparent. You'll see three layers of fees: **Layer 1: Interchange (non-negotiable)** This is what Visa and Mastercard charge. It varies by card type. - Debit card: ~0.05% + $0.21 to 0.80% + $0.15 - Regular credit: ~1.50% + $0.10 - Rewards credit: 1.65% + $0.10 in person, 2.05% + $0.10 online ([why the channel matters](/docs/payments/reference/cost-model-assumptions)) - Corporate card: ~2.50% + $0.10 **Layer 2: Network assessments (non-negotiable)** These are small fees charged by the card networks. - Commonly quoted at 0.13% - 0.15%, but **neither network publishes a schedule**. Visa's own 18 April 2026 fee document doesn't contain the word. This site assumes 0.14% + $0.02 and labels it unverified ([how we model it](/docs/payments/reference/cost-model-assumptions)) - Usually lumped together on your statement, which is why nobody can check the range **Layer 3: Processor markup (negotiable)** This is the only part you can negotiate. It's your processor's profit. You don't have to guess whether yours is fair, because Helcim publishes its whole card-present ladder ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02): | Your monthly card volume | Helcim's published card-present markup | |--------------------------|----------------------------------------| | $0 - $50K | 0.40% + 8c | | $50K - $100K | 0.35% + 7c | | $100K - $500K | 0.25% + 7c | | $500K - $1M | 0.20% + 6c | | $1M - $5M | 0.15% + 6c | | Over $5M | Custom | Online runs 0.50% + 25c, 0.45% + 20c, 0.35% + 20c, 0.25% + 15c and 0.15% + 15c across the same bands. Stax publishes a 0% markup plus 8c in person on top of a monthly subscription. Find your volume band, then judge your own markup against it. If yours is materially higher and your processor can't explain what you're getting for the difference, that's your negotiation. ### Fees That Shouldn't Be There Watch for these common junk fees: | Fee Name | What It Is | Should You Pay It? | |----------|-----------|-------------------| | **PCI Non-Compliance Fee** | Penalty for not completing a compliance questionnaire | No. Fill out the questionnaire or ask your processor to help | | **Statement Fee** | Fee for sending you a bill. Moneris publishes CA$2.00 for a paper statement | Negotiate to remove. Many processors waive this | | **Monthly Minimum** | Penalty if your fees don't reach a threshold. Moneris publishes a CA$5.00 minimum merchant discount rate | Okay for very low volume, but negotiate if you're growing | | **Batch Fee** | Fee for each daily settlement batch | Normal but small. Should be pennies | | **Annual Fee** | Yearly maintenance charge | Often negotiable or removable | The dollar amounts on these vary by processor and most don't publish them, which is exactly why they're worth auditing. Ask for the full fee schedule in writing rather than assuming an industry-standard range. :::tip[Several processors charge none of these] Helcim states plainly that it has **no setup, PCI, cancellation, or statement fees** and no monthly fee ([helcim.com/pricing](https://www.helcim.com/pricing/), verified 2026-08-02). Stripe says it "does not charge setup fees, monthly fees, or any other hidden fees." Square's Free plan has "no monthly subscription costs." If your statement is carrying a PCI non-compliance fee, that's usually because you haven't filled out a Self-Assessment Questionnaire, not because the fee is unavoidable. If you use a hosted payment page you're already compliant and just need to complete the paperwork. Ask your processor how, and the fee disappears. ::: ### Red Flags on Your Statement Investigate immediately if you see: - **Your effective rate increased** more than 0.1% from last month with no change in business mix - **New fee names** you haven't seen before (processors add fees mid-contract) - **Chargeback count** on your statement doesn't match your records - **Double-charging** (both an authorization fee AND a transaction fee, when it should be one or the other) - **Rate increase notification**, buried in fine print or a separate letter ### What to Do If Your Rates Are Too High 1. **Calculate your effective rate** and compare to the benchmarks above 2. **Identify junk fees** and call your processor to remove them 3. **Get competitive quotes.** Contact 2-3 other processors and ask for interchange-plus pricing. See [Processor Comparison](/docs/payments/processor-comparison) for verified published rates, plus a regional shortlist of others to price yourself 4. **Negotiate with your current processor.** A competing quote gives you leverage. See [Negotiating & Comparing](/docs/learning-pathways/reducing-costs/negotiating-and-comparing) for scripts and tactics 5. **Only switch if the savings are meaningful.** A 0.3%+ difference in effective rate is worth the migration hassle. Less than that, probably not. ### Next Steps [ โ–ถ๏ธ Continue: When to Get Help Know when to handle things yourself and when to call in professional support. ](/docs/learning-pathways/running-payments-daily/when-to-get-help) [ ๐Ÿ“š Go Deeper: Statement Reading Detailed line-by-line statement analysis with examples. ](/docs/operations/reading-statements) --- ## When to Get Professional Help Source: https://paymentsandrisk.com/docs/learning-pathways/running-payments-daily/when-to-get-help # When to Get Professional Help Most payment problems are solvable on your own with the right information. But some situations genuinely need outside help. Knowing the difference saves you money (no unnecessary vendors) and protects your business (no missed crises). :::info[TL;DR] - **Handle it yourself:** routine chargebacks, statement review, basic fraud prevention, processor settings - **Call your processor:** account holds, rate questions, compliance questionnaires, technical integration issues - **Get outside help:** chargeback ratio above 0.65%, organized fraud attacks, processor termination, PCI compliance requirements ::: There are four tiers here: what you handle yourself, what your processor handles, what needs an outside specialist, and who not to hire at all. ### Things You Can Handle Yourself These are normal parts of running a business that accepts payments. You don't need a consultant or vendor. | Situation | What to Do | Where to Learn More | |-----------|-----------|-------------------| | Got a chargeback | Gather evidence, respond before deadline | [Responding to a Dispute](/docs/learning-pathways/handling-your-first-chargeback/responding-to-a-dispute) | | Decline rate seems high | Check your top decline codes, contact processor if systemic | [Decline Codes](/docs/reference/decline-codes) | | Suspicious order | Review manually, check AVS/CVV results, refund if unsure | [Fraud Basics](/docs/learning-pathways/protecting-from-fraud/fraud-basics) | | Processor fees seem high | Calculate effective rate, compare benchmarks, get competing quotes | [Reading Statements](./reading-your-statements.md) | | Customer says charge is unauthorized | Check your records, offer refund if legitimate concern | [Chargeback Prevention](/docs/chargebacks/prevention) | ### When to Call Your Processor Your processor has a support team. Use them. You're paying for it. **Call immediately if:** - Your deposits stopped or are delayed without explanation (see [Holds & Reserves](/docs/operations/holds-and-reserves)) - You received a notice about account review or reserve increase - You see fees on your statement you don't understand - You need help completing your PCI compliance questionnaire - You want to enable or adjust fraud rules (AVS, CVV, velocity) **How to get useful help:** 1. Have your merchant ID ready 2. Be specific about the problem ("My deposit for March 15 is $500 less than expected" beats "something's wrong with my money") 3. Ask for written confirmation of anything they tell you 4. If frontline support can't help, ask for the risk or underwriting team :::tip[Processor Warning Emails] If your processor sends you an email about "elevated chargebacks," "account review," or anything related to risk, **reply within 24 hours**. Even if you don't have a complete answer, acknowledge the email and share what you're doing about it. Silence is the #1 reason processors escalate from warning to termination. ::: ### When You Need Outside Help These situations are beyond normal self-service. Getting the right help quickly matters. **Chargeback ratio above 0.65%** You're approaching [Visa's monitoring thresholds](/docs/chargebacks/reference/network-programs). If you can't bring it down within a month, consider: - A [chargeback alert service](/docs/chargebacks/prevention/alerts) (Verifi CDRN or Ethoca). These intercept disputes before they become chargebacks - A payments consultant who can audit your dispute sources and recommend targeted fixes - The [0.9% Panic Guide](/docs/chargebacks/zero-point-nine-panic) if you're already in crisis territory **Organized fraud attack** If you're seeing coordinated fraud (multiple cards to the same address, burst of orders from one region, card testing attacks that overwhelm your velocity rules), you may need: - Your processor's fraud team (not general support; ask specifically for their risk or fraud team) - A [fraud prevention vendor](/docs/fraud/vendors) if attacks are persistent and your processor's tools aren't enough - See [Survive a Fraud Attack](/docs/playbooks/survive-fraud-attack) for the emergency playbook **Processor termination or MATCH listing** If your processor terminates your account, they may place you on the MATCH list (often called the TMF, though that's a separate Visa file), which makes it very difficult to get a new processor. This is serious. - Ask your processor explicitly: "Will this result in a MATCH listing?" - If you're MATCH-listed, you'll need a high-risk processor (they exist but charge more) - If you think the listing is wrong, ask the acquirer for the reason code and file a removal request. Mastercard's rules say you don't need a lawyer for that **PCI compliance requirements** If you handle card data directly (not through a hosted payment page), you may need: - A PCI Qualified Security Assessor (QSA) for formal compliance audits - A security consultant to help implement required controls - See [PCI DSS Guide](/docs/compliance/pci-dss) for what's required at your level ### Who NOT to Hire Be skeptical of: - **"Guaranteed chargeback elimination" vendors.** Nobody can guarantee zero chargebacks. If they promise it, they're either eating the cost (and charging you a premium) or lying. - **Generic "payment consultants" who lead with tool recommendations.** Good consultants diagnose first, recommend tools second. If they're pushing a specific vendor in the first meeting, they're getting a referral fee. - **Vendors who require long-term contracts for small businesses.** At SMB volumes, you should be able to cancel monthly. Long contracts protect the vendor, not you. ### The Decision Framework ``` Is my chargeback ratio above 0.65%? Yes โ†’ Get help (alert services, consultant, or processor risk team) No โ†’ Am I under active fraud attack? Yes โ†’ Call processor fraud team + see Survive a Fraud Attack playbook No โ†’ Has my processor sent me a warning or review notice? Yes โ†’ Reply immediately, consider consultant if you can't resolve No โ†’ Can I find the answer in this site's documentation? Yes โ†’ Handle it yourself No โ†’ Call your processor's support team first ``` ### You've Completed the Operations Pathway You now understand: - [What to do daily and weekly](./daily-weekly-tasks.md) to keep payments running - [How to read your processor statements](./reading-your-statements.md) and spot overcharges - When to handle things yourself and when to escalate ### Next Steps [ โ–ถ๏ธ Next: Reducing Costs & Scaling Understand what you're paying, negotiate better rates, and know when to upgrade. ](/docs/learning-pathways/reducing-costs/understanding-your-costs) [ ๐Ÿ“š Go Deeper: Full Operations Section Processor management, payout strategy, holds and reserves, and team operations. ](/docs/operations) [ ๐Ÿข Processor Management Advanced relationship tactics ](/docs/operations/processor-management) [ ๐Ÿ’ฐ Holds & Reserves When they hold your money ](/docs/operations/holds-and-reserves) [ ๐Ÿ“‹ Playbooks Step-by-step crisis guides ](/docs/playbooks) ---