pmtbox blog

Stripe Shut Down Your Account. Did Your Business Outgrew Stripe? What to Do in the Next 72 Hours.

jlieb@pmtbox.com (pmtbox Staff Writer) — Wed, 07 Oct 2026 22:19:18 GMT

The short answer

A Stripe closure feels like a crisis. New payments stop and Stripe can hold some or all of your balance to cover future refunds and chargebacks.

For many merchants, it’s a sign of growth. Stripe approves accounts at signup and then watches risk with automated models. Your sales jump, your average ticket rises, or disputes climb as order counts grow, and those models flag you. Your business stays yours, and so do your customers. In the first 72 hours, export your data, get the reason in writing, answer open disputes, and apply for a dedicated merchant account underwritten for the size you are now.

The email arrives without warning. Checkout stops working, your balance freezes, and every hour without payments costs you sales. Look at what set it off. Stripe built its model for fast signups and small, steady volume. When your sales outpace the profile Stripe approved, its risk systems read your growth as risk. A dedicated merchant account works the other way. A sponsor bank underwrites your business up front, sets limits for your real volume, and plans for your growth. This post walks you through the next 72 hours, explains why closures happen, and shows you how to move to a payments partner built to grow with you.

What happens when Stripe closes your account?

Your payments stop first. New charges fail at checkout, and any customer trying to buy sees an error.

Next, Stripe holds funds. A reserve is money a processor holds back from your payouts to cover refunds and chargebacks on sales you already made. Stripe does not publish a fixed hold period after closure. Its support pages say reserves normally run 30 to 90 days, and attorneys who handle Stripe disputes report post-termination holds of 90 to 120 days. Some run longer.

Your saved cards stay in Stripe's vault. If you run subscriptions, those card details matter. Stripe exports saved card data only on request and only to another PCI DSS Level 1 compliant processor, so plan for this early.

Your open disputes stay open, too. Every dispute you lose comes out of your held balance, which makes your dispute responses more important now than before the closure.

What should you do in the first 72 hours?

Hours 0 to 24: Protect your data and your record

Start by exporting everything from your Stripe Dashboard. Download your transactions, customers, disputes, refunds and payouts as CSV files. You need this history to apply for a new account, answer disputes and understand what went wrong. Do it now: Stripe's agreement does not oblige it to keep your data after the relationship ends, and its card data export does not include payment history or subscriptions.

Then reply to Stripe's closure email and ask for the reason in writing. Ask which policy applies and which activity triggered the review. Keep your reply short and factual. Anger won't reverse the decision, and a clear written record helps you later.

Finally, stop sending charges to Stripe. Pause checkout or route payments to a backup processor if you have one.

Hours 24 to 48: Get back to selling

Apply for a dedicated merchant account. Underwriters typically ask for three to six months of processing statements, your business formation documents, your refund policy, your fulfillment timelines, and Stripe's closure notice. Gather these before you apply and your review moves faster.

Once you choose a new processor, ask Stripe to export your saved card data to it. Stripe needs the new processor's PCI Attestation of Compliance (or its Visa service provider listing) and an encryption key before it sends the file. With the cards moved, you rebuild your subscription plans on the new platform and most subscribers keep paying without re-entering their cards. Cards saved through Stripe's Link wallet do not transfer.

Hours 48 to 72: Protect your balance and fix the cause

Answer every open dispute with evidence before its deadline. Each win protects money Stripe is holding.

Tell customers only what they need to know. Subscribers whose cards won't transfer need a link to update their payment method. Everyone else needs nothing from you.

Then find the cause. Before you process anywhere else, figure out what triggered the closure, so it doesn't follow you to the next processor.

Your 72-hour checklist

Window	Action	Why it matters
Hours 0 to 24	Export all Stripe data as CSV files	Your history powers your new application and your dispute evidence
Hours 0 to 24	Get the closure reason in writing	Underwriters ask for it, and it tells you what to fix
Hours 24 to 48	Apply for a dedicated merchant account	Every day without payments costs you sales
Hours 24 to 48	Request your saved card data export	Subscribers keep paying without re-entering cards
Hours 48 to 72	Answer every open dispute	Each win protects your held balance
Hours 48 to 72	Find and fix the cause	The same problem follows you to the next processor

Why does Stripe close accounts?

Most closures trace back to a handful of causes.

Disputes and fraud above network limits: Since April 1, 2026, Visa labels a US merchant "Excessive" at a 1.5 percent ratio under the Visa Acquirer Monitoring Program (VAMP), down from 2.2 percent. The ratio counts fraud reports plus disputes, divided by settled card-not-present transactions, and Visa applies it once a merchant reaches 1,500 fraud and dispute events in a month. Processors step in well before you reach that line, because they carry the risk if you cross it. See our guide to Visa VAMP thresholds for 2026.
Card testing: Bots run stolen cards through your checkout in small amounts to see which ones work. Declines and fraud reports spike within hours. Most merchants don't notice until approval rates drop or the processor places a reserve hold.
Sudden volume jumps: A sales spike far above your history looks like risk to an automated model, even when it comes from a successful launch or a holiday rush.
Restricted business types: Stripe publishes a list of businesses it restricts or prohibits, and a change in what you sell can put you on the wrong side of it.
Long fulfillment windows: Pre-sales and long delivery times raise the chance of disputes on money Stripe already paid out to you.

Why do closures happen without warning?

Stripe works as a payment facilitator. A payment facilitator is a provider that lets many businesses process card payments under its own merchant account, so each business is a sub-merchant. Stripe approves you in minutes at signup and reviews your risk later, through automated models. Its Services Agreement lets it suspend or close an account at any time, and when its models flag your account, it can end the relationship to protect its own standing with the card networks.

A dedicated merchant account works the other way. A sponsor bank underwrites your business before you process a single sale. Your terms, reserves and pricing reflect your risk from day one, so growth and seasonality are planned for instead of flagged. Read more about shared payment accounts vs dedicated merchant accounts.

How do you get your held funds back?

Your fastest lever is your open disputes. Each one you win stays out of the reserve, so treat every response as money on the table.

Ask Stripe for your release schedule in writing and put the date in your calendar. Keep records of every refund and delivery confirmation, since proof of fulfillment wins disputes.

If funds stay held past the dispute window, read your agreement closely. Stripe updates its Services Agreement over time, so check the version tied to your account. An attorney who handles processor disputes can review your terms and tell you where you stand.

How do you keep it from happening again?

Closures rarely come from nowhere. The warning signs show up in your data first.

Watch your VAMP ratio every week, not every month. A ratio climbing from 0.6 percent to 1.1 percent tells you to act long before a processor does.
Catch card testing in the first hour. Look for bursts of small transactions, high decline rates from one location or device, and many cards tried against a single account.
Represent every chargeback. Sort the causes by category: delivery issues, product issues, and others. Each category points to a different fix in your operations.
Work with a partner who calls you first when your numbers move, instead of one who sends a closure email.

How pmtbox helps

pmtbox is an end-to-end payments partner. We are a registered ISO of Commercial Bank of California and Chesapeake Bank, and we underwrite your business up front, so your account rests on an approval made before you process.

We see your full transaction lifecycle: shopping cart, payments, fraud attempts, disputes and chargebacks. That view lets us spot card testing early, before it drags down your approval rates or triggers a reserve hold.

With Fraud Ownership, we cover the full cost of every fraudulent transaction our system approves. With Chargeback Automation, we represent your disputes automatically, and your team collects no documents. When you call, a real person answers, and one number covers your fraud, disputes and payments.

We earn more only when your approved sales grow, which ties our revenue to yours.

Tell us your monthly card volume, your industry, the reason Stripe gave, the date your funds froze and whether you are on the MATCH list, and a real person will walk you through your options. Talk to the pmtbox team.

Frequently asked questions

Does Stripe reverse an account closure?

Sometimes, but do not plan around it. Ask for the reason in writing and respond with facts and documents. Line up a new processor while you wait for an answer.

How long does Stripe hold funds after closing an account?

Stripe sets the hold based on your risk of future refunds and chargebacks and does not publish a fixed period for closed accounts. Its reserve guidance cites 30 to 90 days as normal, and attorneys who handle these cases report 90 to 120 days after termination. Ask Stripe for your release date in writing.

Will I end up on the MATCH list?

Not always. Mastercard's MATCH list records merchants terminated for specific reasons, such as excessive chargebacks or fraud, and a listing generally stays for five years. Ask Stripe whether your business was reported. Our MATCH list guide explains the reason codes and what a listing means for your next application.

Should I open a new Stripe account?

No. Stripe's Services Agreement bars a user whose account was suspended or terminated from creating another Stripe account unless Stripe approves. A second account that gets closed makes underwriting harder everywhere.

How fast do I get a new merchant account?

It depends on your business, your history and your documents. Having your processing statements, formation documents, refund policy and closure notice ready is the biggest factor you control.

Do I lose my subscription customers?

Not if Stripe exports your saved card data to your new processor and you rebuild your plans there. Request the export as soon as you choose a PCI DSS Level 1 compliant processor. Cards saved through Link do not transfer, so those customers need an update link.

Sources

Visa VAMP's Tighter Threshold Is Now Live: What Merchants Need to Know, Justt
Request a payment data export, Stripe Docs
Stripe Services Agreement, Stripe
Reserves, Stripe Support
Prohibited and Restricted Businesses, Stripe
Stripe Disputes FAQ, terms.law
MATCH List, Chargebacks911

Visa VAMP Threshold 2026: What the 1.5% Line Means for You

jlieb@pmtbox.com (pmtbox Staff Writer) — Wed, 07 Oct 2026 21:20:00 GMT

The short answer

The Visa Acquirer Monitoring Program (VAMP) tracks fraud and disputes on card-not-present sales. Since April 1, 2026, the Visa VAMP threshold for US merchants is a 1.5 percent ratio, down from 2.2 percent, once you reach 1,500 combined fraud reports and disputes in a month. Cross it and your acquirer faces Visa fees, which often reach you as fees, reserves or a closed account.

What is Visa VAMP?

VAMP is Visa's monitoring program for fraud and disputes on card-not-present transactions. In 2025, Visa folded its separate fraud and dispute monitoring programs into VAMP, creating one combined measure. The new rules took effect April 1, 2025, with an advisory period through September 30, 2025, and enforcement starting October 1, 2025.

Visa monitors acquirers, the banks that sponsor merchant accounts. Acquirers, in turn, watch every merchant in their portfolio. That chain explains why your processor reacts long before you reach Visa's line: your ratio affects their standing with Visa.

How is the VAMP ratio calculated?

The VAMP ratio is your monthly count of fraud reports plus disputes, divided by your count of settled card-not-present transactions. In Visa's terms, add your fraud reports (TC40s, filed by issuers when a cardholder reports fraud) to your disputes (TC15s), then divide by your settled transactions (TC05s) for the month.

Here is an example. You settle 100,000 card-not-present transactions in a month. Issuers file 900 fraud reports and cardholders open 700 disputes. Your VAMP count is 1,600, which is above the 1,500 minimum, and your VAMP ratio is 1,600 divided by 100,000, or 1.6 percent. You are over the line.

Two details matter:

Fraud can count twice. A transaction that appears as a fraud report and later as a dispute counts once in each report.
Some items drop out. Visa excludes disputes resolved through pre-dispute solutions, such as Visa's Rapid Dispute Resolution (RDR) and the Cardholder Dispute Resolution Network (CDRN), and fraud reports that qualify under Compelling Evidence 3.0. Exclusions depend on timing: the item and its resolution generally need to land in the same reporting month. A dispute stopped through RDR or CDRN can still leave a fraud report in your count.

Refunds and dispute wins do not remove items from the count. Visa measures how well you prevent fraud and disputes, not whether you win them.

What are the Visa VAMP thresholds in 2026?

Level	Ratio	Minimum monthly count	Applies to
Merchant: Excessive	1.5 percent from April 1, 2026 (was 2.2 percent)	1,500 fraud reports and disputes	US, Canada, Europe, Asia-Pacific
Merchant: Excessive	1.5 percent (unchanged since launch)	1,500 fraud reports and disputes	Latin America and the Caribbean
Merchant: Excessive	2.2 percent	150 fraud reports and disputes, plus USD 75,000 in fraud and dispute volume	Central Europe, Middle East and Africa
Acquirer: Above Standard	0.5 percent or more across the portfolio	Varies by region	Acquirers
Acquirer: Excessive	0.7 percent or more across the portfolio	Varies by region	Acquirers

The 1,500 minimum counts fraud reports and disputes, not sales. A merchant with a high ratio but a low count is below Visa's Excessive line, though the acquirer still sees it.

Look at the acquirer levels closely. An acquirer gets flagged at 0.7 percent across its whole portfolio, less than half the merchant line. That gap is why many acquirers set their own internal limits well below 1.5 percent, and why you should ask yours what its limit is.

An acquirer gets flagged at 0.7 percent across its whole portfolio, less than half the merchant line.

VAMP also monitors card testing separately. Visa flags enumeration at a 20 percent enumeration ratio with at least 300,000 enumerated authorization attempts in a month, counting both approved and declined attempts.

What happens when you cross the threshold?

Visa assesses fees on acquirers with Excessive merchants. Visa's public fact sheet does not list the amounts, but processors and industry trackers report a fee of $8 per counted fraud report or dispute for merchants at the Excessive level. Acquirers pass those costs on, add reserves to your payouts, or end your account.

A closure for excessive disputes or fraud also puts your business at risk of a MATCH list entry, which follows you to the next processor for five years.

How do you stay well under 1.5 percent?

Track your ratio weekly, not monthly. A ratio climbing from 0.6 to 1.1 percent tells you to act while you still have room.

Resolve disputes before they count. Pre-dispute tools such as RDR let you refund a disputed charge before it becomes a dispute, which keeps it out of your dispute count. Any fraud report the issuer already filed can still count, so pre-dispute tools reduce your ratio but do not clear it.

Use Compelling Evidence 3.0. It lets you answer fraud claims from repeat customers who have a clean purchase history with you, and qualifying fraud reports leave your count.

Fix the causes behind your disputes. A billing descriptor customers don't recognize, slow shipping and unclear refund terms all create avoidable disputes.

Stop card testing fast. Approved test charges on stolen cards can turn into fraud reports, and heavy testing can trigger VAMP's enumeration monitoring on its own. Our guide to card testing attack detection covers the warning signs.

How pmtbox keeps you under the line

pmtbox sees your full transaction lifecycle: shopping cart, payments, fraud attempts, disputes and chargebacks. You see your ratio move as it moves, with chargeback causes sorted by category: delivery issues, product issues, and others. Each category points to a fix.

With Chargeback Automation, we represent your disputes automatically, and your team collects no documents. We catch card testing before it turns into a wave of fraud reports. With Fraud Ownership, we cover the full cost of every fraudulent transaction our system approves.

Talk to the pmtbox team about where your VAMP ratio stands today.

Frequently asked questions

What is the Visa VAMP threshold in 2026?

For US merchants, Visa labels a merchant Excessive at a 1.5 percent VAMP ratio with at least 1,500 fraud reports and disputes in a month. The 1.5 percent line took effect April 1, 2026, down from 2.2 percent. The same line applies in Canada, Europe and Asia-Pacific, while Central Europe, Middle East and Africa stays at 2.2 percent.

How is the VAMP ratio calculated?

Add fraud reports (TC40) and disputes (TC15) for the month, then divide by settled card-not-present transactions (TC05). A fraudulent transaction that appears as both a fraud report and a dispute counts twice.

Does VAMP apply to in-store sales?

No. VAMP's fraud and dispute ratio measures card-not-present transactions, such as online and phone orders, both domestic and cross-border.

Does a refund remove a fraud report?

No. A refund before the cardholder disputes can prevent the dispute, but it does not remove a fraud report the issuer already filed. Issuers report fraud on captured payments even when they are refunded.

Does winning a dispute lower my VAMP ratio?

No. Visa counts disputes when they are filed, whatever the outcome. Representment recovers revenue, but only prevention and qualifying pre-dispute resolutions keep items out of the count.

Does Mastercard have its own program?

Yes. Mastercard runs separate programs, including the Excessive Chargeback Program and the Excessive Fraud Merchant program, with their own thresholds and fines. Your ratio under one network does not carry over to the other.

Sources

Visa Acquirer Monitoring Program Fact Sheet 2025, Visa
Introducing the Visa Acquirer Monitoring Program, Visa
Dispute and fraud card monitoring programs, Stripe Docs
Exclusions from VAMP ratio, Checkout.com
Visa Announces Even More VAMP Changes, Chargeback Gurus
Visa VAMP's Tighter Threshold Is Now Live: What Merchants Need to Know, Justt

MATCH List Explained: Reason Codes, Removal, Next Steps

jlieb@pmtbox.com (pmtbox Staff Writer) — Wed, 07 Oct 2026 20:20:00 GMT

The short answer

The MATCH list is a Mastercard database of merchants whose acquirers terminated them for specific reasons, such as excessive chargebacks, excessive fraud or PCI DSS non-compliance. Acquirers screen new applicants against it, and the entry includes the business and its principal owners. Listings are deleted automatically after five years, and most merchants learn they are listed only when a new application is declined.

What is the MATCH list?

MATCH stands for Mastercard Alert to Control High-Risk Merchants (older guides expand it as Member Alert to Control High-Risk Merchants). Mastercard now runs it as MATCH Pro. It replaced the older Terminated Merchant File (TMF), and many people in the industry still use "TMF" to mean the MATCH list.

How does the MATCH list work?

When an acquiring bank, or a processor acting for it, terminates a merchant for a qualifying reason, it uploads the merchant's details to MATCH with a reason code. The record covers the business (legal name, DBA, address, tax ID, website) and its principal owners, so opening a new company under the same owners does not clear it. Acquirers must check MATCH when they review new applications. Only acquirers and their processors can search the database.

MATCH list reason codes

Code	Reason
01	Account data compromise
02	Common point of purchase
03	Laundering
04	Excessive chargebacks
05	Excessive fraud
06	Not in use (reserved)
07	Fraud conviction
08	Mastercard Questionable Merchant Audit Program
09	Bankruptcy, liquidation or insolvency
10	Violation of standards
11	Merchant collusion
12	PCI DSS non-compliance
13	Illegal transactions
14	Identity theft

Codes 04 and 05 are the most common, and they have numeric triggers. Code 04 applies when a merchant's Mastercard chargebacks in a calendar month exceed 1% of its Mastercard sales transactions and total $5,000 or more. Code 05 applies when fraud reaches 8% or more of sales volume in a month, with 10 or more fraudulent transactions totaling $5,000 or more. Winning the disputes later does not change whether the merchant qualified. Closing the account before termination does not prevent a listing either.

How do you find out if you are on the MATCH list?

You will not usually receive a notice when you are added, and merchants cannot search the database themselves. Ask your former processor in writing whether it reported your business to MATCH and under which reason code. If you do not know which acquirer listed you, Stripe's documentation says you can email Mastercard at matchbusinessowner@mastercard.com to request your listing details. Any new acquirer will also see the entry when it screens your application.

Can you get off the MATCH list early?

Most entries stay for the full five years and then drop off on their own. Mastercard's rules allow early removal in two cases: the acquirer added the merchant in error (for example, the wrong business or the wrong reason code), or the merchant was listed under code 12 and the acquirer later verifies full PCI DSS compliance. In both cases the request goes through the acquirer that added you. Resolving the chargeback problem that caused a code 04 listing does not qualify for removal. An attorney who handles processor disputes can help you build the request.

Can a MATCH-listed merchant still process cards?

Many processors, Stripe included, generally decline MATCH-listed merchants. Some high-risk acquirers do accept them, usually with a reserve (see our guide to rolling reserves), higher pricing and closer monitoring. Your reason code, the story behind it and what you changed since all shape the decision.

Be upfront. An underwriter who finds a listing you didn't mention stops trusting the rest of your application.

Visa runs its own separate database, the Visa Merchant Screening Service (VMSS), with its own reason codes and a five-year listing period. If a processor ended your account, ask about both.

How pmtbox approaches merchants with a processing history

Whatever your situation, pmtbox tells you where you stand quickly and plainly. We see your full transaction lifecycle, so the problems behind most listings, such as card testing and rising disputes, get caught before they become a termination. When you call, a real person answers.

Talk to the pmtbox team.

Frequently asked questions

What is the MATCH list?

It is a Mastercard database of merchants whose acquirers terminated them for specific reasons, such as excessive chargebacks or fraud. Acquirers screen new applicants against it before approving them.

How long does a MATCH listing last?

Five years. Mastercard deletes the listing automatically at the end of that period.

Does a Stripe closure put me on the MATCH list?

Not always. A closure leads to a listing only when the account meets one of the MATCH criteria. Ask Stripe in writing whether it reported your business, and see our guide to what to do in the first 72 hours after a Stripe shutdown.

Does a new LLC get around the MATCH list?

No. Listings include the principal owners, so a new entity with the same owners still matches. Hiding a listing on a new application creates bigger problems.

Can I get off the MATCH list early?

Only if the acquirer listed you in error, or if you were listed under code 12 and later prove PCI DSS compliance. The acquirer that added you submits the removal.

What chargeback rate triggers a MATCH listing?

Code 04 applies when monthly Mastercard chargebacks exceed 1% of Mastercard sales transactions and total $5,000 or more in the same month. The acquirer must also terminate the account for the listing to happen.

Sources

MATCH Pro Privacy Notice, Mastercard
Security Rules and Procedures: Merchant Edition, Mastercard
Terminated merchant files (MATCH and VMSS), Stripe
Everything you need to know about the MATCH list, Heartland
The MATCH List: A Merchant's Guide, Chargeback Gurus

How to Detect a Card Testing Attack in the First Hour

jlieb@pmtbox.com (pmtbox Staff Writer) — Wed, 07 Oct 2026 19:20:00 GMT

The short answer

A card testing attack is when fraudsters use bots to run stolen card numbers through your checkout in small amounts to learn which cards work, then use the good ones for bigger fraud elsewhere. You pay in fees, disputes and a falling approval rate. Spot it early by watching for a burst of small, mostly declined authorizations, then add checkout friction and void approved test charges.

How does a card testing attack work?

Card testing (also called carding or enumeration) is the use of automated scripts to check whether stolen card details are valid before using them for larger fraud.

A fraudster buys a batch of stolen card numbers, often thousands at a time. Many are dead: expired, cancelled or already blocked. To find the live ones, the fraudster points a bot at a checkout with weak defenses and submits small charges, one card after another. A $1 donation page, a low-price digital product or a free trial with a card on file all make easy targets. Some attackers skip the charge entirely and use "save card" or card setup flows, because those checks rarely show up on a cardholder's statement.

Some attacks go further. In an enumeration attack, the bot guesses missing details, cycling through expiry dates and security codes until an authorization goes through. Either way, the pattern is the same: a burst of small authorizations, most of them declined, from a rotating set of devices and IP addresses.

The problem is growing in targeted industries. HUMAN Security's 2026 guide to cyberthreats in travel and hospitality found that at the most heavily attacked travel businesses (the 90th percentile of its customers), attempted carding reached 17.6 percent of checkout traffic in 2025, up from 3.1 percent in 2022. Those figures measure attempts, not successful fraud, and come from HUMAN's own customer base.

What does card testing cost a merchant?

Card testing costs you in four ways: fees, disputes, network monitoring and your relationship with your processor.

Fees. Depending on your pricing, you may pay an authorization fee on every attempt, approved or declined, plus a dispute fee on every test charge that turns into a chargeback.
Fraud reports and disputes. Approved test charges turn into fraud reports and disputes once real cardholders spot them. Both count toward Visa's Visa Acquirer Monitoring Program (VAMP) ratio. For US merchants, Visa's "Excessive" threshold dropped from 2.2 percent to 1.5 percent on April 1, 2026. Our guide to Visa VAMP thresholds for 2026 covers the math.
Lower approval rates. A wave of declines tied to your merchant account makes issuers see your traffic as riskier, which can push down approvals for real customers even after the attack stops.
Processor action. When your processor sees the spike in declines and fraud reports, it can add a rolling reserve or close your account to protect itself.

Visa also measures enumeration on its own. The VAMP enumeration ratio counts enumerated authorizations, approved and declined, against all authorizations. A merchant is flagged at 20 percent or higher once it has at least 300,000 enumerated transactions in a month. Visa reports that, globally, enumerated accounts carry fraud rates 22 times higher than regular accounts.

Most merchants miss card testing until approval rates drop or the processor places a reserve hold.

What are the warning signs of card testing?

Card testing leaves a clear trail in your data, if you look in the right place at the right time.

Attempt spikes: a sudden jump in authorization attempts with no matching jump in traffic or marketing.
Small, repeated amounts: many transactions at the same low amount, often your lowest price point.
Decline code patterns: a wave of generic, incorrect security code, expired card and do-not-honor declines.
Many cards, one source: different cards tried from one device, IP address or email.
Junk customer data: nonsensical names and email addresses on new orders or saved cards.
Odd hours: spikes at times when your real customers sleep.

Decline rate and authorization velocity belong on your daily fraud dashboard. Our fraud detection metrics plan shows which numbers to track and how often.

How do you stop a card testing attack in progress?

Act fast. Every hour of an active attack adds fees, fraud reports and processor attention.

Add friction at checkout. Turn on bot detection or a CAPTCHA on the payment page and on any save-card endpoint, and limit how many attempts one device, IP address or session gets.
Tighten card checks. Require the security code on every card-not-present payment and use address verification where it is available.
Protect your soft spots. Raise the minimum on donation pages, require login or session validation before payment, and lock down free trials.
Clean up approved test charges. Void them before they settle. If they have already settled, refund them, so they are less likely to become disputes.
Stop retrying. Do not keep retrying cards saved during the attack, since that repeats the attack in your own traffic.

Finally, call your processor and tell them what happened and what you fixed. A processor who hears it from you first treats you differently than one who finds it in a report.

Why do most merchants find out late?

Most merchants run payments, fraud screening and disputes on separate tools. Your shopping cart sees the traffic. Your gateway sees the declines. Your fraud tool sees its own scores. Your chargeback tool sees disputes weeks later. No single tool sees the full attack while it happens, so the pattern stays hidden until approval rates drop or the processor places a reserve hold.

How pmtbox catches card testing early

pmtbox sees your full transaction lifecycle in one place: shopping cart, payments, fraud attempts, disputes and chargebacks. Because we see the whole picture, we can spot the burst of small authorizations and the decline-code pattern while the attack is under way, instead of weeks later in a dispute report.

We flag the attack, show you what is happening, and act before your approval rates drop or a processor places a reserve hold. With Fraud Ownership, we cover the full cost of fraudulent transactions our system approves. And when you call, a real person answers.

Talk to the pmtbox team about protecting your checkout from card testing.

Frequently asked questions

What is card testing?

Card testing is when fraudsters run stolen card numbers through a checkout in small amounts to find out which cards work. It is also called carding, account testing or enumeration. The valid cards are then used for larger purchases or resold.

What is an enumeration attack?

An enumeration attack is a type of card testing where bots guess missing card details, such as expiry dates and security codes, until an authorization goes through. Visa tracks it separately through the VAMP enumeration ratio.

Can card testing get my merchant account closed?

It puts your account at risk. Approved test charges become fraud reports and disputes, and a spike in both can trigger processor reserves, card network monitoring programs and account closure.

Should I refund card testing charges?

Void approved test charges before they settle, so they never post as completed charges. If a charge has already settled, refund it. Either step makes it less likely the cardholder files a dispute.

How do I know if I'm being card tested?

Look for a burst of small transactions, a sharp rise in declines (especially generic, security code and expired card declines), and many cards tried from one device or IP address. Junk names and email addresses on new orders are another sign.

Sources

Most targeted travel sites face stolen card tests at 17.6% rate, HUMAN finds, PPC Land (reporting HUMAN Security, "The 2026 Guide to AI, Agentic Traffic, and Cyberthreats for Travel and Hospitality")
Visa Account Attack Intelligence, Visa
Introducing the Visa Acquirer Monitoring Program, Visa
Visa monitoring programs (VAMP thresholds and enumeration ratio), Solidgate
Protect yourself from card testing, Stripe

Rolling Reserve Explained: How It Works and How to Reduce It

jlieb@pmtbox.com (pmtbox Staff Writer) — Wed, 07 Oct 2026 18:20:00 GMT

The short answer

A rolling reserve is a share of your daily sales that your processor or acquiring bank holds back to cover future chargebacks, refunds and fraud. Industry sources commonly cite reserves of 5 to 15 percent of sales, held for 30 to 180 days, then released on a rolling schedule. A reserve protects your processor. It also ties up cash you need to run your business.

How does a rolling reserve work?

Each day, your processor keeps a fixed percentage of your settled sales. After the hold period ends, it releases that day's reserve back to you, while still holding back a share of new sales. The reserve rolls forward with your business.

Here is what it means in dollars. You process $100,000 a month, or about $3,333 a day, under a 10 percent reserve held for 90 days. Each day about $333 goes into the reserve. After 90 days, each day's release matches each day's new withholding, and the balance levels off at about $30,000 (90 days times $333). That $30,000 is your money, sitting with your processor at any given time.

At $100,000 a month, a 10 percent reserve held for 90 days ties up about $30,000 of your cash.

What are the main types of reserves?

Type	How it works
Rolling	A fixed percentage of each day's sales, held for a set period, then released on a rolling schedule
Capped	A percentage of sales is withheld until the reserve balance reaches a dollar ceiling, then withholding stops
Fixed or minimum	The processor holds a set dollar amount, built from withheld payouts or a deposit, for as long as the terms require
Upfront	A lump sum collected at account opening, before you process, and released after the account performs

A reserve is different from a funding hold. A funding hold delays a payout, usually for days. A reserve holds a share of your money for months.

Why do processors add reserves?

Processors add reserves when they see risk of losses they would have to cover. Common triggers include:

A rising dispute or fraud ratio
A card testing attack
A sudden jump in sales volume
Long fulfillment windows, such as presales
A new business with no processing history
An industry with higher dispute rates

Merchants stay responsible for refunds and disputes on past sales after an account closes, so a processor that ends the relationship may keep funds in reserve for months to cover them. Many reserves arrive without warning. A processor that relies on automated monitoring can add one as soon as its model flags your account.

How do you get a reserve reduced or released?

Start by getting the terms in writing: the percentage, the hold period, the release schedule and the date of the next review. You can't negotiate terms you haven't seen.

Then build the case. Processors review reserves over time and can remove, reduce or extend them. They look for a steady, low dispute rate sustained over several months. Fix the causes behind your disputes, stop card testing, and share financial statements that show your business can cover refunds. Ask for a cap, so withholding stops at a set dollar amount. If your reserve came from a sales spike, show the order data behind it.

If your processor won't move, look for a partner who underwrites your business up front. A reserve set during underwriting reflects a review of your actual business. A reserve added by an automated model reflects what the model inferred from your recent activity.

How pmtbox helps

pmtbox underwrites your business before you process, so your terms are based on a review of your business from day one.

We see your full transaction lifecycle: shopping cart, payments, fraud attempts, disputes and chargebacks. That view helps us catch the problems behind many reserves, such as card testing and rising disputes, before they reach your payouts. With Chargeback Automation, we represent your disputes automatically. With Fraud Ownership, we cover the cost of fraudulent transactions our system approves. And when your numbers move, we call you first.

Talk to the pmtbox team about your reserve and your processing terms.

Frequently asked questions

What is a rolling reserve?

A rolling reserve is a share of your daily sales that your processor holds back for a set period to cover future chargebacks, refunds and fraud. Each day's withheld amount is released when its hold period ends.

How much is a typical rolling reserve?

Industry sources commonly cite 5 to 15 percent of sales, and Braintree publishes a typical range of 1 to 20 percent. Low-risk merchants with a strong history often carry no reserve.

How long does a processor hold a reserve?

Hold periods commonly run 30 to 180 days per transaction, released on a rolling schedule. Higher-risk accounts can see longer holds, and processors can extend a reserve when they review it.

What's the difference between a reserve and a funding hold?

A funding hold delays a payout, usually by days. A reserve holds a share of your money for months.

Does Stripe use rolling reserves?

Yes. Stripe says it uses fixed and rolling reserves, reviews them before they expire, and may remove, reduce or extend them. Merchants remain responsible for refunds and disputes after a Stripe account closes. If Stripe has closed your account, see our guide on what to do in the first 72 hours.

Sources

Reserves, Braintree (PayPal) Developer Documentation
What is a Rolling Reserve for Merchant Accounts?, chargeback.io
Reserves: Frequently Asked Questions, Stripe Support
Refunds and disputes after closing a Stripe account, Stripe Support

Shared Payment Account vs Dedicated Merchant Account

jlieb@pmtbox.com (pmtbox Staff Writer) — Wed, 07 Oct 2026 17:20:00 GMT

The short answer

A dedicated merchant account is a card processing account that belongs to your business alone, with its own merchant ID, underwritten by an acquirer and its sponsor bank before your first sale. Stripe, Square and PayPal instead place most businesses on a shared account as sponsored sub-merchants. Shared accounts open in minutes; a dedicated account trades a slower start for terms built around your actual risk and volume.

How does a shared payment account work?

A shared payment account is one where your business processes as a sub-merchant under a payment facilitator's master merchant account. You sign up online, enter your bank details, and start taking payments within minutes. The facilitator holds the relationship with the acquiring bank and the card networks. You hold a login.

Speed is the selling point, and it comes with a trade. The facilitator checks your identity at signup, but most of its risk review happens after you start processing. Automated models watch your disputes, your fraud reports, your sales volume and your business type. When those models flag your account, the facilitator can hold your funds, add a reserve or close the account to protect its own standing with its acquirer and the card networks. Stripe's services agreement, for example, lets Stripe suspend an account immediately for reasons that include elevated fraud rates, and close an account at any time. Your account depends on the facilitator's view of your risk, and that view can change without warning.

If that has already happened to you, read what to do in the first 72 hours after Stripe shuts down your account.

How does a dedicated merchant account work?

A dedicated merchant account flips the order. An independent sales organization (ISO) or acquirer underwrites your business with a sponsor bank before you process a single sale. The underwriter reviews your processing history, your business model, your refund policy and your fulfillment timelines up front.

Once approved, your business gets its own merchant identification number (MID). Your sales, deposits and dispute history belong to your business alone. Your terms, reserves and pricing are set against your actual risk and volume from the start, so a strong holiday season or a big launch can be planned for in your terms instead of flagged by a model. A named team watches your account and contacts you when your numbers move.

Shared payment account vs dedicated merchant account

Factor	Shared payment account	Dedicated merchant account
Setup speed	Minutes	Days, after underwriting
Underwriting	Identity check at signup, most risk review after you start processing	Before your first sale
Account ownership	Sub-merchant under the facilitator's account	Your own merchant ID
Pricing	Flat rate by default (Stripe's standard US online card rate is 2.9% plus 30 cents); custom pricing for large volumes	Priced to your volume and risk, often interchange-plus
Stability as you grow	Volume spikes can trigger automated reviews	Growth is planned for in your terms
Who watches your risk	Automated models	A named team plus your data
Support	Help center and tickets	A named contact you can call

When does a shared account fit?

Shared accounts serve a real purpose. If you are launching and need to take payments today, a facilitator gets you selling the same day. If your volume is small and steady, and you sell low-risk products with instant delivery, the flat rate keeps your pricing simple and the automated reviews rarely touch you.

Signs you have outgrown a shared account

The signs show up in your numbers and your payouts.

Volume: You process millions in card volume each year, and a flat rate costs you more than pricing built on interchange. Some facilitators, Stripe included, offer custom or interchange-plus pricing at high volume, so compare that offer too.
Payouts: Your payouts get held, or a reserve appears without warning. Our guide to rolling reserves explains how they work.
Disputes: Your combined fraud and dispute ratio is climbing toward the Visa Acquirer Monitoring Program (VAMP) excessive merchant threshold, which dropped from 2.2 percent to 1.5 percent for US merchants on April 1, 2026. Visa applies that threshold to merchants with at least 1,500 fraud reports and disputes in a month, and acquirers and facilitators often set stricter internal limits. See our breakdown of Visa VAMP thresholds.
Business model: Subscriptions, high-ticket items and products with long delivery windows carry more dispute risk, and automated models treat them with more suspicion.
Closure: Your account was already closed or frozen.

What does underwriting ask for?

Underwriting takes more paperwork than a facilitator signup, and the paperwork is the point. Expect to provide recent processing statements (often three to six months), your business formation documents and owner identification, your website, refund policy and fulfillment timelines, and your chargeback and refund history.

If a processor ended your account, include the closure notice. Underwriters respect a merchant who explains a closure up front far more than one who hides it.

How do you switch without losing sales?

Open your new merchant account before you leave your current processor. Once approved, ask your current provider to export your saved card data to your new processor, so subscribers keep paying without re-entering cards. Stripe and Square both document this process, and Stripe will only send card data to a processor that is PCI DSS Level 1 compliant. Stripe does not export payment history or subscriptions, so pull those through its dashboard or API before you close the account. Run both accounts side by side for a short period, test your checkout end to end, then move all traffic to the new account. Planned this way, your customers never notice the switch.

How pmtbox runs dedicated accounts

pmtbox has run merchant payments since 2007 as a registered ISO of Commercial Bank of California and Chesapeake Bank. We underwrite your business before you process, and we own the outcome.

With Fraud Ownership, we cover the cost of fraud on the transactions our system approves. With Chargeback Automation, we represent your disputes automatically, and your team collects no documents. Because we see your full transaction lifecycle, from shopping cart to chargeback, we can catch card testing before your approval rates drop or a processor places a reserve hold.

One partner, one contract and one fee replace your fraud tool, your chargeback manager and your contingency firm. When you call, a real person answers. And we earn more only when your approved sales grow.

See if a dedicated account fits your business. Talk to the pmtbox team.

Frequently asked questions

Is Stripe a merchant account?

For most businesses, no. Stripe operates as a payment facilitator, and your business processes under Stripe's account as a sub-merchant rather than under its own merchant account with an acquirer.

Is a dedicated merchant account harder to get?

It takes more paperwork up front. In return, your account rests on an approval made before you process, not a review after.

Does switching interrupt my sales?

Not when you plan it. Open the new account first, have your saved card data transferred to the new processor, test checkout, then switch traffic.

What is a MID?

A MID is a merchant identification number. It ties your sales, deposits and dispute history to your business alone.

What is interchange-plus pricing?

Interchange-plus pricing passes through the interchange and card network fees on each transaction and adds a fixed processor markup. Your rate tracks the real cost of each card type instead of a single flat percentage.

Sources

The Visa Payment Facilitator Model, Visa
Pricing and fees, Stripe
Stripe Services Agreement, Stripe
Request a payment data export, Stripe Docs
Export card on file to third party payment processors, Square
Visa VAMP's tighter threshold is now live: what merchants need to know, Justt

Fraud Detection Metrics: Formulas and a Measurement Plan

jlieb@pmtbox.com (pmtbox Staff Writer) — Wed, 07 Oct 2026 16:20:00 GMT

The short answer

Fraud detection metrics are the numbers that show whether a fraud tool works on your own transactions. Track six: fraud rate, chargeback rate, false positive rate, approval rate, manual review rate and step-up conversion. Write the definitions into your vendor contract, log every decision against one order ID, review the numbers weekly and send each alert to a named owner.

Why review scores can't tell you how a fraud tool will perform

Analyst and peer-review listings, such as the online fraud detection category on Gartner Peer Insights, are a good way to build a vendor shortlist. They say little about what a specific vendor will do to your approval rate, your chargeback exposure or your customer experience once it is live on your own transaction mix.

Few vendors offer to show you, in your own numbers, whether a lift in approval rate still holds ninety days after signature. You can get that answer yourself with a measurement plan you own, independent of any vendor dashboard. That plan has three parts: shared metric definitions, end-to-end instrumentation, and a fixed reporting cadence with alert thresholds.

What are the six fraud detection metrics?

Six metrics tell the full story of a fraud program. Agree on the definitions before you sign, and put them in the vendor contract as well as your internal wiki. A vendor who resists a shared definition is telling you something.

Fraud rate: confirmed fraud dollars divided by total transaction dollars.
Chargeback rate: chargebacks divided by transactions, tracked by count and by dollar value.
False positive rate: legitimate orders declined, divided by all legitimate orders attempted.
Approval rate: approved transactions divided by attempted transactions.
Manual review rate: orders routed to human review, divided by total orders.
Step-up conversion rate: customers who complete an added verification step, such as 3D Secure, divided by customers presented with it.

Definitions and formulas

Metric	Definition	Formula
Fraud rate	Share of transaction value confirmed as fraudulent	Confirmed fraud $ ÷ total transaction $
Chargeback rate	Share of transactions disputed by a cardholder	Chargebacks ÷ total transactions (by count and by $)
False positive rate	Share of legitimate orders that were declined	Legitimate orders declined ÷ all legitimate orders attempted
Approval rate	Share of attempted transactions cleared for payment	Approved transactions ÷ attempted transactions
Manual review rate	Share of orders sent to a human reviewer	Orders routed to review ÷ total orders
Step-up conversion	Share of customers completing added verification	Completed step-up challenges ÷ challenges presented

Getting the false positive rate right

A false positive, also called a false decline, is a legitimate order your system declines. The false positive rate measures how many of your good customers you turn away, so its denominator is all legitimate orders, not all declines.

Some teams also track the share of declines that turned out to be legitimate (legitimate declines ÷ total declines). That number is a useful check on decision quality, but it is a different metric. Label it separately so the two are never compared as if they were the same thing.

You will rarely know for certain that a declined order was legitimate. Estimate it from evidence you can collect: a customer who retries and succeeds with the same card, complaints to customer service, and periodic manual sampling of declined orders.

How your chargeback rate differs from Visa's VAMP ratio

Your internal chargeback rate is one input. Visa monitors card-not-present merchants with its own measure, the VAMP ratio, which counts fraud reports (TC40) plus disputes (TC15) and divides by the count of settled transactions. Because fraud reports are included, the VAMP ratio can run higher than your chargeback rate alone. Track both, and reconcile them each month against your processor's reports. For the current thresholds and how they apply, see our guide to Visa VAMP thresholds.

How should you instrument fraud decisions?

A fraud score on its own tells you very little. Log the fraud decision, the review outcome and the final chargeback outcome against the same order ID so you can trace one transaction from end to end. Capture a timestamp at each stage: authorization, review assignment, review resolution and chargeback filing. Tag every declined order with a specific reason code. Without this discipline, a fraud problem and a friction problem look identical in your reporting.

Instrumentation checklist

Assign one order ID that persists across authorization, review and settlement systems.
Log a specific reason code for every decline, beyond a simple accept or reject flag.
Capture timestamps for authorization, review assignment, review resolution and chargeback filing.
Store false positive corrections as a dedicated field linked to the original order ID.
Record step-up challenges presented and step-up challenges completed as separate events.
Tag every manual review with an outcome: approved, declined or escalated.
Feed chargeback outcomes back into the fraud model's training data on a fixed schedule.
Reconcile fraud, chargeback and review data monthly against your payment processor's records.

Good instrumentation also helps you spot attacks early. A sudden spike in small authorization attempts and declines from the same cards or BINs is a classic sign of card testing, and it will distort every metric above if you don't isolate it.

How often should you review fraud metrics?

Review all six metrics every week. Fraud patterns move faster than a quarterly business review. Set an alert threshold for each metric, route each alert to a named owner instead of a shared inbox, and report the same six numbers to leadership every month in the same format. That way a change in performance shows up right away instead of at contract renewal.

Suggested cadence and alert triggers

The triggers below are starting points. Tune them to your own baseline and volume after the first 90 days of data.

Metric	Cadence	Alert trigger	Owner
Fraud rate	Weekly	Rises more than 15% above the trailing 90-day average	Risk or fraud lead
Chargeback rate and VAMP ratio	Weekly	VAMP ratio moves toward 1.5%, Visa's merchant "Excessive" threshold in the U.S. since April 1, 2026 (set your internal trigger well below it)	Risk or fraud lead
False positive rate	Weekly	Rises more than 20% above the trailing 90-day average	Risk lead and CX owner
Approval rate	Weekly	Drops more than 3 percentage points week over week	Finance lead
Manual review rate	Weekly	Exceeds 10% of order volume for two straight weeks	Operations lead
Step-up conversion	Monthly	Drops below 80%	Product or UX lead

Report all six metrics to the board or leadership team monthly, in the same format each time, with a trend line covering the trailing twelve months.

How pmtbox fits into your measurement plan

pmtbox underwrites e-commerce and retail merchants up front, so the terms are clear before you process. With Fraud Ownership, pmtbox covers fraud on the transactions it approves, which puts the cost of a missed fraud decision on pmtbox instead of on you. Chargeback Automation handles representment, and you pay one fee.

That model makes the plan above more useful. You can watch approval rate and false positive rate to confirm good customers are getting through, and use fraud rate and chargeback data to see the coverage working in your own numbers.

Talk to the pmtbox team about how your current metrics would look under Fraud Ownership.

Frequently asked questions

What is a good false positive rate for an online merchant?

There is no single benchmark, because it depends on your product, price points and customer base. Measure your own baseline first, then hold any vendor to improving it. Make sure every comparison uses the same formula: legitimate orders declined divided by all legitimate orders.

What is the difference between fraud rate and chargeback rate?

Fraud rate measures the share of transaction value confirmed as fraudulent. Chargeback rate measures how often cardholders dispute transactions, which includes non-fraud disputes such as "item not received." A merchant can have a low fraud rate and still have a chargeback problem, so track both.

How does Visa measure disputes for merchants?

Visa uses the VAMP ratio: the count of fraud reports (TC40) plus disputes (TC15), divided by the count of settled card-not-present transactions. From April 1, 2026, the merchant "Excessive" threshold in the U.S., Canada, the EU and Asia Pacific is 1.5%, with a minimum of 1,500 fraud reports and disputes in a month.

Should fraud metrics go into the vendor contract?

Yes. Writing the six definitions into the contract means you and the vendor report the same numbers the same way. It also gives you a clear basis for reviewing performance at renewal.

How often should fraud thresholds be reviewed?

Review the metrics weekly and the alert thresholds themselves at least quarterly. Revisit thresholds sooner after a major change, such as a new product line, a new market or a card network rule update.

Sources

Visa Acquirer Monitoring Program (VAMP) Fact Sheet 2025, Visa
Payment fraud detection: How to stop fraud without sinking your approval rate, Stripe
Online Fraud Detection Reviews and Ratings, Gartner Peer Insights