What 'High-Risk Merchant' Actually Means
Being labeled a high risk merchant is a liability calculation, not a moral judgment. Here is who really decides it, how MCC codes work, and what it costs you.
The first time a processor calls you a “high-risk merchant,” it lands like an accusation. Like they looked at your business, decided it was shady, and caught you at something. I have watched sharp, honest founders carry that sting for weeks.
So let me kill it right now: it is not a verdict on you. It is an actuarial label. Someone ran the numbers on businesses that look like yours and decided you are more likely than a coffee shop to cost them money. That is the entire meaning of the phrase. Once you see it that way, it stops being an insult and becomes a constraint you can actually manage.
Here is how the machine really works.
It is about who eats the loss
Start with the uncomfortable fact under everything: when you take a card, the money is not yours yet. The customer can dispute it for months, and if they win, it gets pulled back. Somebody in the chain absorbs that loss, and it is not the customer. It is the processor and the bank behind it.
So everyone upstream of you is quietly asking one question. If this merchant racks up disputes, stops answering, or disappears, who is left holding the bill? “High-risk” is just the label for the businesses where the answer is “probably us, and probably a lot.”
That risk can come from your industry, your sales model, your country, your average order size, or your history. None of it is a statement about whether you are a good person running an honest shop. A flawless CBD brand with five-star reviews and a guy who runs kids’ birthday parties can land in completely different buckets, and the birthday clown is not the more ethical operator. He is just less likely to generate a wave of chargebacks. That is all the label measures.
You think Stripe decided. It is actually three layers.
Most merchants stop at “Stripe flagged me” and never learn who actually sets the rules. There is a stack above you, and it helps to know who does what.
The card networks (Visa, Mastercard) set the outer fence. They define the dispute thresholds, run the monitoring programs, and fine everyone below them when a merchant runs hot. Mastercard’s excessive line is 1.5% of transactions plus 100 chargebacks a month. Visa’s program flags excessive dispute activity in a similar range. They do not approve your account directly, but every decision underneath them bends to these numbers.
The acquiring bank actually carries your risk. They hold the relationship with the networks and they are on the hook if you default. Their appetite is the real gate. One acquiring bank refuses your entire vertical on sight. Another underwrites it happily, for a price. Same business, opposite answer, because their risk tolerance differs.
The processor is the face you see. Stripe, and tools like it, sit in front of all that and often bundle the bank relationship so smoothly you forget it exists. That is why it feels like Stripe is the whole system. It is not. It is the front desk, enforcing the risk appetite of the bank and the networks behind it, plus a little of its own.
So when you get flagged, it is usually a composite ruling: the networks drew the danger zone, the bank set the tolerance, the processor pulled the trigger. Yelling at the front desk does not change a policy written three floors up.
The four digits that judge you before you sell anything
Every merchant gets a Merchant Category Code, four digits that tell the networks what kind of business you are. Restaurants have one, bookstores another, dating services another. Each code drags a reputation behind it, built from years of data on everyone who ever used it.
This matters more than people expect, because a chunk of your risk rating is decided at the code level before anyone looks at your numbers. Some codes simply live in bad neighborhoods: nutraceuticals and supplements, weight loss and “as seen on TV,” adult, gambling-adjacent, debt and credit repair, and any rebill or subscription model where customers routinely forget they signed up and dispute the charge in a panic.
If your MCC sits in one of those neighborhoods, you start flagged. You can run cleaner than every competitor in your category and still inherit the baseline suspicion stapled to the code. That is exactly why “but I do everything right” does not move the needle on its own. The code talks first. Your track record only gets a word in afterward.
Why squeaky-clean businesses still get flagged
This is the part that feels genuinely unfair, so sit with it for a second. You can be fully legal, fully honest, and still land in the high-risk bucket for reasons that have nothing to do with compliance.
- Your model breeds disputes. Free trials, subscriptions, and upsell funnels generate chargebacks structurally. People forget, misremember, or change their minds, and dispute patterns outweigh good intentions.
- Your prices are high. A 12 dollar dispute is noise. A 600 dollar dispute is real exposure. Bigger tickets mean each unhappy customer costs the chain more, which raises your risk profile by pure arithmetic.
- You grew too fast. From the outside, a breakout month looks identical to an account laundering volume before it bolts. The model cannot read your press coverage or your ad spend. It just sees a curve that scares it.
- Your category got poisoned by people you never met. A few bad actors sharing your MCC ruin the average for everyone stuck under the same code.
Not one of these requires wrongdoing. They are facts about where and how you sell. The system scores properties, not virtue.
What the label actually costs you
Being high-risk is not a ban. It is a worse deal, and it pays to know the exact line items so you can plan around them.
You pay higher processing fees, sometimes a lot higher, because you are priced for your expected dispute load. You often eat a rolling reserve, a slice of revenue held back 60 to 120 days as a cushion against future chargebacks. You get less rope: the same dispute spike that earns a normal merchant a warning email gets you frozen. And you live with less stability, because the bank can re-price its appetite for your whole category and drop you for reasons that have nothing to do with anything you personally did.
Add it up and the real cost is not the fees. It is the fragility. A high-risk merchant built entirely on one account is one risk-model update away from going dark, and the label means that update is more likely to land on you than on the coffee shop.
The useful way to carry this
Here is the reframe I give every client. Stop reading “high-risk” as they think I am a criminal. Read it as the system has priced my category, and I need to build like someone who knows that.
That one shift changes what you do next. Instead of writing long, wounded appeals about how legitimate you are, which the model has no way to weigh, you put your energy where the system actually responds: keeping your dispute numbers clean, making your business trivially easy to verify, and never letting a single account become the thing your entire cash flow depends on.
Nobody survives a hard vertical by convincing a processor to love them. There is no such thing, and chasing it is a slow way to lose. The ones who last understood early that the label was a structural fact, not a personal failing, and they built something resilient enough that no single freeze could end them.
If you want to figure out where your business actually sits and how to stop one account from being able to take you down, reach us on Telegram at @lucimornens.