High Risk Merchant Accounts

What makes a business high risk?

A bank labels a business high risk when it expects more chargebacks, fraud or legal exposure than usual. The label comes from three places, and high risk isn't the same as prohibited: each provider keeps its own list.

• →What you sell: Visa and Mastercard make banks register some categories before processing, such as online adult content, gambling, online pharmacy, crypto and tobacco or vape.
• →How you sell: online and phone orders, subscriptions, future delivery and big tickets all add risk.
• →Your history: chargeback and fraud ratios, time in business, owner credit and any MATCH listing.

How to get approved

Banks approve high-risk businesses that hand them a complete, honest file. Expect a real review of your products, website, owners and statements. "Instant approval" usually means a pre-approval, or a payment app that reviews you later. A past decline or weak credit makes approval harder, but rarely impossible.

1. 1 · Gather documents

   Owner ID, EIN, voided check, 3–6 months of bank and processing statements.

2. 2 · Fix your website

   Refund, shipping and privacy policies, plus real contact details.

3. 3 · Disclose everything

   Every product, sales channel and past account closure.

Most START merchants are approved in 1–5 business days, with the Authorize.Net gateway set up within 24 business hours of approval.

Rates, fees and rolling reserves

Interchange, the card networks' base cost, is the same whichever processor you use. High-risk pricing differs in the processor's markup, a few extra fees, and often a rolling reserve: part of each day's sales held back and released later.

• →Compare by effective rate: total fees ÷ card sales, from a real statement, not an "as low as" quote.
• →Question the extras: early termination fees, monthly minimums, PCI non-compliance fees and "risk" surcharges.
• →Do the reserve math: 10% held for 180 days on $50,000 a month builds to about $30,000 after six months.

Your payment gateway

A payment gateway connects your website or virtual terminal to your merchant account. It doesn't approve you. The bank behind your merchant account does, which is why "high risk payment gateway" offers matter less than the account behind them. Authorize.Net's own terms list no prohibited industries; acceptance depends on your merchant account.

• →Works with your cart: Authorize.Net is pre-integrated with more than 1,000 shopping carts, including WooCommerce, BigCommerce and Shopify.
• →Platform fees: Shopify and BigCommerce charge an extra fee when you use an outside processor on some plans.
• →Built-in tools: fraud filters, recurring billing and saved-card storage.

Chargeback ratios and the 2026 limits

Visa and Mastercard watch your dispute ratio every month. Cross their limits and your processor pays fines, which usually come back to you as fees, a reserve or a closed account. As of September 2026:

• →Visa (VAMP): 1.5% or more, counting fraud reports plus disputes against your card-not-present sales, once you reach 1,500 in a month (U.S. level since April 1, 2026).
• →Mastercard: 1.5% or more with at least 100 chargebacks in a month puts you in its excessive chargeback program.
• →Old numbers: the 0.9% you may still see quoted online was a threshold in Visa's older dispute program, which VAMP replaced in 2025.

Shut down by Stripe, Square or PayPal

Payment apps close accounts when their automated checks flag your products, a sudden jump in sales or a run of disputes. Your balance is usually held while chargebacks come in. Each app's terms say something different about how long.

• →PayPal: may hold funds for up to 180 days. Square and Stripe: no fixed period in their terms (as of September 2026).
• →First 48 hours: export your data, get the reason and hold terms in writing, and stop taking payments on that account.
• →Don't open a new app account under another name. It will be linked and closed again.

The MATCH list

MATCH is Mastercard's list of businesses whose merchant accounts a bank closed for serious reasons, such as excessive chargebacks, fraud or a data breach. Visa keeps its own terminated merchant file. Banks check both, but a listing isn't an automatic ban: Mastercard's rules let a bank approve a listed business.

• →Five years, then it comes off automatically.
• →Early removal only if you were added in error, or for a PCI listing once you're compliant.
• →Your rights: the bank must answer a removal request within 30 days, and you don't need a lawyer.