A single occupational fraud case costs a median of $145,000 (ACFE, Occupational Fraud 2024: A Report to the Nations). Losses climb from there once chargebacks, network fines, and reputational damage from a bad merchant relationship start compounding across a portfolio. Financial statement fraud, the least common but costliest category, carries a median loss of $766,000 per case.

For an ISO, payfac, or sponsor bank underwriting hundreds of merchants a month, one missed signal at onboarding can turn into that number six months later. This makes rigorous screening essential.

Identifying high-risk merchants before they cause losses requires evaluating signals across business registration, website presence, ownership structures, transaction monitoring, and transaction patterns. This guide covers the red flags and risk signals that distinguish high-risk merchants from legitimate ones. It includes practical frameworks for detection at onboarding and throughout the merchant lifecycle.

‍

What is a high-risk merchant

High-risk merchants are businesses that payment processors and banks flag for a greater chance of fraud, chargebacks, or financial loss. Processors identify them using specific industry categories, transaction metrics, and financial history, signals that suggest elevated exposure compared to standard merchants.

The classification isn't a judgment on legitimacy. Many high-risk merchants operate legally and profitably, but their business model, industry, or transaction patterns call for additional controls. Acquirers and ISOs assign risk levels during high-risk business screening at underwriting, then adjust them based on ongoing behavior.

‍

Red flags and risk signals for high-risk merchants

Identifying high-risk merchants means evaluating signals across multiple categories. No single indicator tells the full story. Instead, risk teams look for patterns and combinations that suggest elevated exposure.

Business registration and KYB signals

Know Your Business (KYB) verification often surfaces the first warning signs. KYB is the process of verifying a business entity's legitimacy, ownership, and operational status before onboarding. An inactive or dissolved business status in state records, for instance, suggests the merchant may not be operating legitimately.

A few patterns worth watching:

• Address mismatch: The registered address differs from the application or doesn't fit the business type.
• Recent formation: The entity was formed days or weeks before applying, which is common in fraud schemes.
• Inconsistent filings: Business name variations or missing annual reports raise questions about operational continuity.

Here's what this looks like in practice: a merchant applies with a Delaware LLC, but the registered address is a residential mailbox in another state. The entity was formed two weeks prior.

Any one of these signals might be explainable. Together, they warrant closer review.

Website and online presence signals

A merchant's website reveals a lot about operational legitimacy. Fraudulent or high-risk merchants often cut corners here, and the gaps are visible if you know where to look.—fake merchant websites saw a 22% increase in fraud cases—and the gaps are visible if you know where to look.

• Domain age: Domains registered within the last few months warrant closer review.
• Missing policies: No terms of service, refund policy, or privacy policy suggests the merchant hasn't invested in legitimate operations.
• Stock imagery: Generic product photos, placeholder text, or incomplete pages indicate a hastily assembled storefront.
• Contact gaps: No phone number, physical address, or working support email makes customer disputes harder to resolve.

Consider a subscription merchant whose domain was registered two weeks before application. The site uses stock photos, and there's no way to contact support. This combination of signals points toward a merchant that may not be around long enough to fulfill obligations.

Ownership and synthetic identity signals

Synthetic identities combine real and fabricated data to pass validation processes. They often pair a genuine Social Security number with a fictitious name or date of birth (FinCEN, Identity-Related Suspicious Activity Trend Analysis). They're increasingly common in merchant fraud). They're increasingly common in merchant fraud, driving projected losses exceeding $3.1 billion in 2026 according to Mitek and Datos Insights, and harder to catch without cross-referencing multiple data sources.

• Document inconsistencies: ID details don't match application data or public records., a risk amplified by a 311% surge in synthetic document fraud between Q1 2024 and Q1 2025.
• Nominee directors: Owners appear on multiple unrelated business filings, suggesting they're fronting for someone else.
• Opaque ownership: Ultimate beneficial owner (UBO) information is missing or unverifiable.
• Identity fragments: SSN, name, and address combinations that don't appear in credit bureaus.

Synthetic identity fraud is particularly challenging because each individual data point may look legitimate. The fraud only becomes visible when you compare across sources.

A pattern worth knowing: entity-level MATCH screening (see below) checks the business against a terminated-merchant database, not the people behind it. A principal terminated for excessive chargebacks under one LLC can form a new entity.

It passes MATCH cleanly because the new business was never itself terminated. They reapply with a clean-looking file.

The signal that catches this isn't the business registration check. It's cross-referencing UBO identity across applications.

Most onboarding stacks handle this as a separate, easily-skipped step rather than a default part of KYB. Teams that screen entities but not owners are, in effect, only checking half the risk.

Litigation, adverse media, and review signals

External signals often reveal risk that internal data misses. Consumer complaints, lawsuits, and news coverage can indicate problems before they show up in transaction data.

• Consumer complaints: Patterns of unfulfilled orders or unauthorized charges on BBB, Trustpilot, or state attorney general sites.
• Litigation: Pending lawsuits involving fraud, consumer protection, or contract disputes.
• Adverse media: News coverage of regulatory investigations or enforcement actions.

A travel merchant with multiple BBB complaints about unfulfilled bookings presents clear risk. A pending state attorney general investigation adds to that risk, even if transaction data looks clean.

Financial and transaction signals

Pre-approval transaction projections sometimes don't match reality. While detailed transaction monitoring happens post-onboarding, certain signals appear during underwriting. Transaction monitoring at this stage focuses on projected volume and ticket size.

• Volume projections: Stated monthly volume seems inconsistent with business size or industry.
• Ticket size outliers: Average transaction amounts exceed norms for the stated business type.
• Pattern inconsistencies: Projected activity doesn't match the merchant's website or product mix.

A small e-commerce site projecting $500,000 in monthly volume with an average ticket of $2,000 warrants questions. The numbers may be accurate, but they deserve verification.

Chargeback and dispute signals

For merchants with processing history, chargeback data provides direct risk evidence. As of April 1, 2025, Visa consolidated its separate fraud and dispute monitoring programs into the Visa Acquirer Monitoring Program (VAMP). VAMP combines fraud reports (TC40) and disputes (TC15) into a single ratio measured primarily at the acquirer-portfolio level.

An acquirer's portfolio is flagged "Above Standard" at 0.50% and "Excessive" at 0.70%. Per-dispute fees apply once a portfolio crosses those lines (Visa Acquirer Monitoring Program fact sheet).

Because acquirers are accountable for their full portfolio, they typically set individual merchant thresholds well below Visa's own limits. This is why two acquirers can flag the same merchant differently.

Two patterns matter most at the merchant level:

• Ratio trends: Rising chargeback rates over consecutive months.
• Reason code clusters: Multiple disputes citing the same reason codes, which often indicates systemic issues rather than isolated incidents.

‍

High-risk industries and business models

Certain industries carry inherent risk regardless of individual merchant behavior. Card networks and acquirers maintain lists of high-risk Merchant Category Codes (MCCs).

Industry classification alone doesn't determine risk level. A well-established travel agency with clean history presents different risk than a new entrant with no track record. Industry is one input among many.

MATCH list and terminated merchant file screening

The MATCH (Mastercard Alert to Control High-Risk Merchants) list, also called the Terminated Merchant File (TMF), identifies merchants previously terminated by acquirers for specific rule violations, and acquirers are required to screen against it during underwriting under Mastercard's own screening and monitoring standards (Mastercard Security Rules and Procedures, Merchant Edition).

‍

‍

MATCH presence doesn't automatically mean prohibition. Some reason codes like bankruptcy may allow onboarding with appropriate controls, while others like fraud typically require decline.

The reason code matters as much as the listing itself. A listing stays active for five years from the date added, regardless of whether the underlying dispute was later resolved.

‍

Why merchants get classified as high-risk

Risk classification stems from factors present at onboarding and behaviors that emerge afterward. Understanding both helps teams design appropriate controls.

‍

A merchant might pass initial underwriting and later drift into high-risk territory. This is why ongoing monitoring matters as much as onboarding diligence, a distinction covered in more depth in Coris's guide to merchant onboarding automation.

‍

Identifying high-risk merchants at onboarding

Most high-risk merchants are caught during merchant onboarding, assuming the right checks are in place. Here's how risk teams typically structure the process.

Verify business legitimacy through KYB. Start with business registration, ownership verification, address validation, and formation date. Secretary of State records and commercial registries provide baseline data, though aggregating signals from multiple sources improves accuracy.

Coris Merchant Intelligence automates this aggregation across 50+ countries.

Assess website and product risk. Manual and automated website review covers content, policies, domain age, and product mix. The goal is alignment: does what the merchant claims to sell match what the website actually shows?

Screen against MATCH and sanctions lists. MATCH, OFAC, and other sanctions screening are standard pre-approval gates. Adverse media screening adds another layer, catching issues that formal lists might miss.

Score merchant risk before approval. Risk scoring models combine signals into risk tiers, enabling instant approvals for low-risk merchants while flagging high-risk cases for manual review. Effective scoring reduces false positives and speeds legitimate merchants through onboarding, an approach detailed further in Coris's breakdown of automated merchant underwriting infrastructure.

‍

Transaction monitoring for high-risk merchants in portfolio

Risk doesn't end at approval. Merchants change, sometimes intentionally, sometimes through business evolution. Continuous transaction monitoring catches drift before it becomes loss.

Continuous KYB and website change detection. Monitor business status, ownership changes, website content, and domain modifications. A merchant that passed onboarding might later add prohibited products or change ownership without notification.

Transaction anomaly and chargeback monitoring. Track volume spikes, velocity anomalies, and chargeback thresholds. Sudden changes in transaction patterns often precede fraud or compliance issues.

Coris Transaction Monitoring combines merchant and transaction signals to detect anomalies before money moves.

Adverse media and litigation alerts. Screen for news coverage, lawsuits, and regulatory actions on an ongoing basis. Daily or real-time monitoring catches emerging risks faster than periodic reviews, a workflow Coris explores further in its AI risk management overview.

‍

Building a risk tiering model for high-risk merchants

Risk tiering structures operational controls based on merchant risk level. Most teams use three to five tiers with escalating requirements.

‍

‍

Tiering enables proportionate response. Heavy controls apply only where warranted, while low-risk approvals move through quickly. Structuring these tiers within broader risk management operations ensures the model scales as your portfolio grows.

‍

Actions to take once a high-risk merchant is flagged

When a merchant is flagged as high-risk, several response options exist depending on severity:

• Enhanced due diligence: Request additional documentation or verification.
• Reserve requirements: Hold a percentage of processing volume as protection against future losses.
• Payout delays: Extend settlement timelines to allow dispute windows to close.
• Volume caps: Limit monthly processing until risk stabilizes.
• Termination: Exit the relationship if risk exceeds tolerance.

A merchant flagged for rising chargebacks might receive enhanced monitoring and a 10% reserve first. If chargebacks continue climbing, the relationship is terminated before losses escalate further. Programs like Coris's Risk Platform route these escalations automatically so reserve and payout-delay decisions don't sit in an analyst's queue while exposure grows.

‍

Frequently asked questions about high-risk merchants

How is a high-risk merchant different from a prohibited merchant?

High-risk merchants can be onboarded with appropriate controls like reserves, monitoring, and volume limits. Prohibited merchants cannot be onboarded at all. This is typically due to legal restrictions, card network rules, or categories the acquirer decided not to support.

Can a low-risk merchant become high-risk over time?

Yes. Merchants can shift to high-risk status due to rising chargebacks, business model changes, adverse media, or ownership changes. Ongoing monitoring catches this drift, which is why risk tiers assigned at onboarding should be treated as a starting point rather than a permanent classification.

What chargeback ratio triggers high-risk classification under Visa's monitoring program?

Visa's Acquirer Monitoring Program flags acquirer portfolios at a 0.50% dispute-and-fraud ratio ("Above Standard") and 0.70% ("Excessive"). Acquirers typically set individual merchant thresholds well below these figures to protect their portfolio average, so a merchant's effective limit depends on their specific acquirer.

Do high-risk definitions vary across institutions?

Each bank, processor, and card network applies different criteria and risk tolerances. A merchant considered high-risk by one acquirer might be acceptable to another. Different risk appetite, reserve structure, or industry experience can explain the difference.

How long does a MATCH listing stay active, and can it be removed?

MATCH entries remain active for five years from the date added, regardless of how the underlying dispute was resolved. Removal requires the original reporting acquirer to confirm an error. For PCI-DSS noncompliance listings, documented proof of compliance is needed.

Does a MATCH listing for bankruptcy get treated the same as one for fraud?

No. Reason codes matter as much as the listing itself.

Bankruptcy or liquidation listings may still allow onboarding with reserves or enhanced monitoring, since the underlying issue was financial rather than deceptive. Fraud-related reason codes typically trigger an automatic decline across most acquirers.

Identifying high-risk merchants requires combining multiple signals into a coherent risk picture: KYB data, website analysis, ownership verification, transaction patterns, and external intelligence. Coris aggregates these signals automatically through Merchant Intelligence. It monitors more than 1 million merchants and $50 billion in annualized transaction volume.

It has helped risk teams reduce manual review volume by more than 80%. Get a demo to see how Coris applies these signals to your underwriting and monitoring workflows.