.png?width=365&height=122&name=BTLogo%20(1).png)
So you’re a high-risk merchant, now what?
The card networks and payment gateways designate a high-risk merchant as less safe because of evidence like high chargeback rates (above 1%) or guilt by association in an industry associated with risk, like gambling, cannabis, and, surprisingly, e-commerce.
Looking at the broader payments ecosystem, it can be arduous for a high-risk merchant even to acquire an account with a payment service provider (PSP). Even the most prominent merchants struggle to maintain a connection with card networks, requiring companies to engage with one or more PSPs. These operate as payment gateways or intermediaries, passing information to and from the card networks.
This requires high-risk merchants to pass muster with the card networks and the payment gateways, who essentially represent them in all payment transactions.
Why am I considered a high risk merchant?
Card networks or payment processors flagged you as high risk for one of two reasons: what you sell, or how you are selling it.
Some industry categories carry elevated risk designations regardless of how well a specific business operates. Adult content, gambling, cannabis and CBD subscription services, even mainstream e-commerce can fall here. These categories carry a history of chargebacks, regulatory scrutiny, or fraud.
Some transaction behavior, even outside a flagged industry, can mark a merchant as high risk. New merchants without a proven processing history, sales outside of the United States, Canada, Japan, Australia, or Europe, and chargeback ratios above one percent will draw scrutiny.
Every card network or payment gateway has its own set of criteria for characterizing an account as “high-risk.” Whether it’s a “red, yellow, green” type of matrix or scoring system, each network has specific programs and criteria. Visa has its Global Acquirer Risk Standards (GARS), Mastercard uses programs like High-Risk Merchant (HRM) Monitoring and American Express employs the Merchant Risk Management framework.
Merchants designated as high-risk endure more complex application periods for what are known as “high-risk merchant accounts,” which come with transaction costs approximately 1.5% higher than normal.
Adding insult to injury, high-risk merchants are often required to maintain merchant account reserves: their PSP may hold as much as 5% of each transaction for a designated period before payout to cover anticipated chargebacks.
Here are a few other guidelines for determining who may be labeled as “high-risk.”
- With high dollar amounts, abnormally high volumes could signify potential chargebacks or risks of fraud.
- Selling in countries (excluding the United States, Canada, Japan, Australia, or Europe).
- If the merchant has no history of processing transactions or a very minimal track record, it is likely to be labeled as “high-risk.”
- Newly established businesses without a proven track record can be considered high-risk. This is most commonly seen with startup status.
- Even with a spotless record, a merchant operating in an industry that is considered “high-risk” because of fraud, returns, or chargebacks. It is common for subscription-based companies to be labeled as “high-risk” because many people will sign up for a trial and forget to cancel their payment, often leading to a chargeback when they see a forgotten charge.
What is high-risk payment processing?
Several providers specialize in high-risk payment processing. PaymentCloud, NMI, Ecrypt, Soar Payments, and Durango all offer high-risk merchant services to businesses in high-risk categories that the overall payment ecosystem is not hugely welcoming to.
Carefully examine the services offered and the fees charged by any high-risk payment processor you are considering.
Because the participants in the payment ecosystem are justifiably concerned about the risks associated with high-risk industries, merchants can expect to pay higher chargeback fees and potentially lock into longer contract terms. It’s common to pay a monthly fee until a transaction history is established to verify that there’s no elevated risk of chargebacks.
Can a high-risk merchant become a low-risk merchant?
The short answer is yes. There is theoretically nothing permanent about a high-risk merchant designation. The longer answer, however, requires some nuance.
Businesses that attain a high-risk designation can win their way back into the good graces of the payment ecosystem by tightening their processes and reducing their chargeback numbers. Even those in the e-commerce business who may enter into their payment relationship listed as high-risk merchants can move into a lower-risk designation by maintaining low chargeback ratios over a reasonable period of time.
By contrast, merchants designated as high-risk due to their industry—gambling, tobacco, and CBD products are prime examples—are likely to remain in this category for as long as the payment industry regards those industries with mistrust. However, there are best practices:
- Become knowledgeable about the standards the card networks and PSPs have in place regarding chargebacks, fraud, disputes, fraud prevention, reporting, and compliance. Stay on top of industry trends to keep your business operational as the industry evolves.
- Partner with reputable payment processors who have a history of working successfully with your MCC code.
- Make it easy for new customers and partners to understand what your business is, how the purchasing process works and what the terms of use are. This makes it significantly easier to fight fraud but for any partners to do the same.
- Ensure that inquiries into refunds, issues or general questions are addressed promptly to keep chargebacks below any threshold.
- Maintain PCI DSS compliance.
- Have programs and systems in place that routinely monitor transaction data to identify trends, patterns, and anomalies that could identify suspicious activity. High-performing merchants diagnose and address issues before they ever threaten business continuity.
- Enlist trusted partners to assist with operating in highly regulated environments.
Escaping the mantle of a high-risk merchant is most effectively executed by having relationships with multiple PSPs. Some specialize in delivering a suite of services that help offset fraud risks merchants face.
What questions should a high-risk merchant be asking?
Does a tokenization vault provider remove a high-risk designation?
No. The high-risk label comes from the card networks and PSPs based on your industry or transaction. What a vault does is decouple your cardholder data from any single processor, so a high-risk designation doesn't leave you stuck if that processor drops you.
How do I know if I’m a high risk merchant?
The clearest signal is your PSP or card network telling you through a rejected application, a request for additional documentation, or terms that include a reserve requirement or above-standard transaction fees. Check your merchant category code, if it falls under a gambling, adult content, cannabos/CBD, subscription, or similar category, you’re likely high-risk.
It’s worth assuming a high-risk status and planning around it, rather than wait for a processor to confirm it after the fact.
What happens if my account is frozen or shut down without warning?
PSPs can freeze funds or terminate a merchant's account with little or no warning, citing elevated chargeback risk or a shift in how they view the specific category. The practical risk isn't just losing the account, it's losing access to the transaction history and payment methods tied to it. Keeping cardholder data in a processor-independent vault allows for the merchant to route transactions to a backup or alternative PSP without asking customers to re-enter payment data.
How can a high-risk merchant hedge their risk?
Assuming the merchant isn’t engaged in a business that the payments industry considers inherently and inescapably high-risk, there are several things they can do, including:
- Ensure processes, including refund and cancellation rules, are clearly communicated and executed to reduce chargebacks
- Protect cardholder information by employing a tokenization strategy that keeps all cardholder data safely stored in a secure third-party vault
- Create and maintain a multi-PSP strategy, gaining more control over costs, customer information, and solution innovation
While a high-risk payment processor, specializing in servicing high-risk merchants, is a must early on. Their elevated cost structure is unlikely to make them the ideal long-term partner.
For this reason, it is essential for the merchant to partner with a tokenization service provider like Basis Theory to switch between PSPs while continuing to own their existing customers’ cardholder data.
Because of its industry, Passes, a creator platform enabling fans to access exclusive content and experiences, is labeled as a high-risk merchant. Creators can monetize on their own by enabling seamless and secure transactions between the creator and their fans.
However, because of the perceived high-risk nature of the platform, many PSPs were difficult to work with and had the ability to freeze any transactions without warning.
A member of the tech team said, “We were working with a PSP and they said they were ok with our business, but ended up going back on their word and shutting us off without warning.”
This led Passes to integrate with another payment provider essentially overnight—but still with the risk of a potential shutdown.
“We needed to make sure that we’re always in a position where we will have a provider even if something happens,” the tech lead said.
Appsmarket, a company with a suite of apps and subscription-based services, shared the same concern.
Fedir Bobylev, a Solutions Architect at Appsmarket, said roughly 80% of its transactions were done through Apple Pay, and Stripe was its payment processor. Because the processor was collecting and storing payment data, failed payments because of outdated information was out of their control. These failures kept Bobylev in a constant state of paranoia, worrying about being shut down.
“Stripe was great for a long time, but they got to be unpredictable and say that despite business going great, we would get a notification that they are closing down our account,” Bobylev explains. “We got a scare about a year and a half ago, so we needed to safeguard ourselves from essentially being shut down by Stripe to have another provider.”
This kicked off a project to make Basis Theory the vault for sensitive credit card and Apple Pay data, while also unlocking the ability to work with multiple payment processors.
More stories like this exist on the Basis Theory Case Study page.
