Managing High-Risk Merchants

It can be a delicate balancing act for acquirers, but it remains the case that the ones that perform proper due diligence can thrive. 

Whether it is the sale of subscription-based services, nutraceuticals, cryptocurrency, or vaping products, there is no shortage of opportunities for acquirers to service high-risk merchants.

And now one trend helping to fuel the expansion of the high-risk category is the legalization by several states of iGaming and sports betting and the sale of recreational cannabis.

Despite the expanding pool of high-risk merchants, however, many acquirers are not in a position to service these sellers, as they lack specialized risk-management and fraud-detection systems, as well as strict customer-verification processes, to properly manage them.

Servicing high-risk sellers properly starts with vetting the merchant’s business to gauge the just how much risk is involved. It continues with regular audits to spot  red flags that can signal excessive chargebacks or fraud, as well as signs the business is coming under financial stress.

“Whether or not an acquirer handles high-risk merchants depends on their risk appetite and risk-management capabilities, which go hand-in-hand,” says David Mattei, a strategic advisor for Datos Insights. “The high-risk merchant category is a specialized market, which is why there are some acquirers that simply won’t touch it.”

For acquirers willing to play in the high-risk merchant space, it can be a lucrative business. High-risk merchants bear higher-than-average fees to reflect the risk the acquirer takes on. But merchants must generate sales, and will pay higher fees out of the need to offer the kind of payments options consumers expect, such as credit cards and digital wallets.

When it comes to merchant vetting, acquirers should put in the time to understand the merchant’s business and the potential risks around it, payments experts say. Considerations can include such factors as vulnerability to fraud, return and refund policies that can lead to excessive chargebacks, and the financial health of the merchant and its owners.

Understanding these risks helps acquirers determine whether they can put a strategy in place to mitigate them. “Understanding what creates potential risk around a merchant account is the key to managing it at an acceptable level,” says Don Apgar, director of merchant payments for Javelin Strategy & Research. “There are a lot of reputable merchants in [the high-risk] category, but if an acquirer doesn’t have the resources or time to properly monitor high-risk merchants, they should stay away.”

‘A Better Job’

Not all acquirers playing in the high-risk merchant space have the resources to scrutinize every detail of a high-risk merchant’s business, but they do have options that can help them navigate these dangerous waters. One option is to partner with independent sales organizations to work closely with high-risk merchants prior to the application process. An ISO can work with a high-risk merchant to clarify its return and refund policies prior to applying for a merchant account, for example.

“One role ISOs are playing for acquirers is providing merchants guidance on ways to align their business to meet customer expectations and reduce the potential for chargebacks,” Apgar says. “ISOs, independent software vendors, and agents are doing a better job of providing this type of guidance to high-risk merchants so they can accept cards, versus having acquirers write them off from the start.”

With subscription services, one area acquirers should closely scrutinize is how difficult it is to cancel a subscription. “A lot of subscription-based merchants will bounce the customer around in the hope he will eventually find it so difficult to cancel, he stops trying,” says Adam Ennamli, chief risk and security officer for Edmonton, Alberta, Canada-based General Bank of Canada.

Giving consumers the runaround, observers say, is also common to providers of travel insurance, which covers such unexpected events as lost or stolen luggage, emergency medical expenses, and accidental death. While such insurance policies can provide travelers peace of mind, collecting on a claim can be difficult. As a result, it’s recommended that acquirers look at the number of claims filed against claims paid before signing this type of merchant, Ennamli says.

“This type of insurance was never really tested from a claims standpoint before it began to roll out, so it can be tough to get a claim paid,” Ennamli adds.

The Payoff From Payfacs

Signing new merchants through a payment facilitator is another way acquirers can vet and monitor high-risk merchants. The benefit of working with a payfac is that it signs merchants through a master merchant account it holds with the acquirer. This makes the payfac responsible for underwriting and onboarding merchants, assessing a merchant’s risk, and ensuring the merchant’s compliance with legal and financial regulations.

In addition, many payfacs will provide an advisory service that can help merchants operate their business, which provides them with deeper insights into the merchant’s risk level. “Payfacs can see things in a merchant’s business at a level acquirers and ISOs can’t,” says Deana Rich, co-chief executive and co-founder of Infinicept, a Denver-based payfac. “Providing business-advisory services also helps prevent merchants from tripping over their own toes.”

Insights payfacs can have into a sub-merchant’s business include whether the merchant accepts orders that exceed current inventory levels, transaction velocity at certain times of the day—which can indicate a fraud attack—as well as the frequency and nature of customer complaints and the merchant’s creditworthiness.

“Payfacs know the vertical markets their merchants serve so they can spot when merchant behavior or consumer behavior [on the merchant’s e-commerce site] begins to slide in the wrong direction,” says Rich.

Other best practices used by payfacs include tiered underwriting and risk-based monitoring to manage and mitigate associated risks, according to Jonathan D. Hancock, head of product and innovation for The ai Corp. Ltd., a provider of fraud-prevention and processing services to retail and fleet-fueling merchants.

“Payfacs’ specialized expertise in specific industry verticals further strengthens their ability to manage risks,” says Hancock.

Monitoring Programs

E-commerce remains a high-risk merchant segment because transactions are conducted in a card-not-present environment. When taking on e-commerce clients, acquirers should be careful to determine whether the merchant uses affiliate marketers and how thoroughly it monitors the affiliates.

Affiliate marketers promote products or services on an e-commerce merchant’s behalf and are paid a commission when a consumer makes a purchase using the affiliate’s unique links. An important to question get answered about merchants that use affiliate marketers is whether they have, or are willing to, shut down an affiliate that engages in such practices as click fraud or creating fake leads and sales to earn commissions.

Affiliate click fraud occurs when the affiliate artificially generates clicks on its link, typically through the use of bots. The practice is considered fraudulent.  “Merchants need to understand the harm an affiliate that runs wild can do to the products they sell, the customer experience, and their business,” adds Infinicept’s Rich.

Merchants that create bad customer experiences attract the wrong kind of attention from the card networks. “The networks don’t want merchants in their ecosystem that reflect poorly on their brand,” says Javelin’s Apgar. “That’s why it’s important for acquirers to keep the ecosystem clean.”

While acquirers are taking more steps to vet and manage high-risk merchants, the card networks are continually changing and implementing new rules to help manage merchant risk. These rules include enhanced monitoring for cryptocurrency merchants, additional due diligence for subscription/recurring-billing merchants, stricter requirements for adult content platforms, including mandatory age and content verification, and additional authentication measures for high-ticket remote transactions, according to Datos Insights.

“The card networks maintain stringent monitoring programs to track fraud ratios and identify high-risk merchants early and hold merchants and acquirers with excessive fraud and chargebacks accountable, potentially imposing fines and conducting on-site audits,” Hancock says.

Other compliance standards include enhanced monitoring requirements for merchants with high refund rates, more stringent requirements around transaction descriptors to reduce customer confusion, enhanced know-your-customer and due-diligence requirements for digital-goods merchants, and compliance programs specific for buy-now-pay-later merchants.

New network rules and regulations “are continuously evaluated and released via bulletins” and require implementation by the acquirer “to maintain compliance and ensure secure high-risk merchant services,” adds Hancock.

‘A Balancing Act’

While some high-risk merchant categories can pose more risk than others, the decision on whether to sign a merchant depends on the acquirer’s risk tolerance.

Research by Datos Insights found that acquiring banks are reluctant to take on high-risk merchant segments that could expose them to regulatory or reputational risk, while non-bank acquirers are willing to take on more risk because they have frameworks in place that can mitigate risk.

“Which [merchant] categories are avoided depends on the risk appetite of the acquirer,” says Ron van Wezel, a strategic advisor for Datos Insights. “Acquirers should balance the additional risk of taking on a new merchant against the business benefits. Risk is a cost of doing business. However, our research found only a few organizations managed risk that way.”

Building a tiered portfolio of low-, medium-, and high-risk merchants can help acquirers balance their risk. “It comes to managing chunks of risk and what portion of the acquirer’s portfolio is allocated to high risk,” says General Bank of Canada’s Ennamli. “When the cost of monitoring a merchant exceeds profits, it’s best to drop that merchant.”

Lastly, acquirers should always be on the lookout for changes in management or ownership at the merchant, as that can be a catalyst for changes to the business that can open the door to increased chargebacks and fraud. For example, a change in ownership may usher in less consumer-friendly return and refund policies or lower-quality products or services.

“New ownership or management can raise red flags,” Ennamli says. “Acquiring for high-risk merchants is a balancing act, and acquirers that know how to strike that balance can be extremely profitable.”