Merchant Fraud and Bust-Out: Detection for Acquirers

When the fraudster is the merchant rather than the shopper, the acquirer, payment facilitator or marketplace that signed them up carries the loss, and a single bad merchant can run up chargebacks faster than any reserve was sized to absorb. Merchant fraud covers applicants who lie at onboarding, merchants who process transactions for a different, undisclosed business (transaction laundering, which US bank supervisors call factoring), and bust-out schemes where an account behaves normally until it suddenly spikes volume, collects settlement and disappears. This guide is about the provider's side: underwriting, sub-merchant oversight, monitoring signals, reserves and exit. It is written for acquiring risk teams, payment facilitators, marketplaces, fintech platforms and sponsor banks. Shopper-side card fraud, 3-D Secure and card testing are covered in the Payment Fraud Guide; this page does not repeat them.

Key takeaways

Chargebacks turn merchant fraud into credit risk. The OCC's Merchant Processing booklet explains that when a merchant cannot pay, the acquirer must cover chargebacks to issuers, that the contingent liability can span several months of sales, and that one problem merchant can generate hundreds of thousands of dollars of chargebacks a day.
Underwriting is the cheapest control. The OCC lists minimum checks: business verification or site inspection, principal credit reports, processing statements, references, correct merchant category code, and OFAC and MATCH checks.
Transaction laundering hides one business behind another. The OCC defines factoring as running transactions through a merchant account for a business other than the one screened and approved, and US law treats some forms as an offence in telemarketing (16 CFR 310.3(c)).
Bust-out shows up as a break from the merchant's own baseline. Exception reports on daily volume, average ticket, repeated amounts, repeated card numbers and keyed versus present transactions are the early warning, as the OCC describes.
Third parties concentrate the risk. The OCC notes many of the most serious merchant losses at banks came from merchants signed by ISOs and MSPs, and FinCEN and the FFIEC set out red flags for payment processors that hide the true merchant.

What merchant fraud and bust-out look like

Merchant fraud is any scheme where a business that accepts payments is itself the source of the fraud or abuse. The provider that boards the merchant, whether an acquiring bank, a payment facilitator with sub-merchants, a marketplace or an embedded finance platform, is exposed in three ways: unpaid chargebacks and refunds, scheme penalties and monitoring programme fees, and regulatory or criminal exposure for processing illicit transactions.

Pattern	How it works (defender's view)	Typical signal	Main loss
Fraudulent application	False or stolen business identity, synthetic principals, or a front business with no real trade	Website with no real operating entity, contact details or refund policy; principals that do not verify	Losses once the account is used for fraud
Bust-out	Account runs small, clean volume to build trust and raise limits, then processes a burst of sales (often fictitious or for goods never delivered), takes settlement and abandons the account	Sudden step change in volume or ticket size; switch to keyed entry; withdrawal of funds as soon as they settle	Chargebacks with no merchant to recover from
Transaction laundering (factoring)	An approved merchant processes payments for an undisclosed business, often one that would be declined: illegal goods, unlicensed gambling, scams	Descriptors and products that do not match the approved business; traffic from unrelated websites; mismatched merchant category code	Scheme fines, regulatory action, complaint and chargeback spikes
Self-dealing and card fraud by the merchant	Merchant runs stolen cards or its own cards through its account to cash out, or colludes with cardholders	Repeated card numbers, repeated identical amounts, cards from one BIN range	Fraud chargebacks
Refund and credit abuse	Refunds issued to cards that never purchased, moving funds out of the account	Refunds exceeding sales, refunds to unrelated cards	Direct funds loss
Deceptive merchant practices	Real merchant using unauthorised recurring billing or misleading offers	High complaint rates and high return or chargeback rates, as FinCEN highlights	Chargebacks, consumer protection action

The term bust-out comes from credit fraud, where an account is built up and then maxed out. In merchant acquiring the same arc appears, and the OCC's description of chargeback exposure explains why it hurts: a merchant that has vanished cannot be charged back.

Merchant onboarding and underwriting

The OCC Merchant Processing booklet sets out minimum underwriting items for bank acquirers, and they are a sound baseline for any provider boarding merchants.

Application and agreement: signed application and processing agreement, and a corporate resolution where relevant.
Understand the business: enough to assign the correct merchant category code. A wrong code hides higher-risk trade.
Verify it exists: on-site inspection or business verification. For online merchants, review the website for the real operating entity name, customer service contacts, privacy and security statements, delivery terms and refund policy, all items the OCC lists.
Check the principals: credit bureau reports on principals as permitted by the Fair Credit Reporting Act, identity verification, and beneficial ownership.
Check the business's history: financial statements or business credit reports, recent processing statements from any previous acquirer, and trade and bank references.
Screen lists: the OFAC SDN list and MATCH (Member Alert to Control High-Risk Merchants), the card scheme file of merchants and principals terminated for risk reasons such as excessive chargebacks, laundering or factoring, or suspected fraud.
Decide and set terms: decline substantial chargeback history, weak finances or no valid business; require senior approval for high-volume merchants; set reserves, delayed settlement or volume caps for higher-risk profiles.

The OCC adds a caution worth repeating: some MATCH listings stem from technical contract breaches, so a listing is a starting point for review, not an automatic decline. Equally, an absence from MATCH proves little about a newly created business. For identity verification techniques, see the Identity Fraud Prevention Guide.

Underwriting depth by risk tier

The tiers and review periods below are illustrative; set your own from your risk appetite and scheme rules.

Tier	Example profile	Checks	Terms
Low	Established face-to-face retailer with processing history	Automated business and principal verification, list screening, statement review	Standard settlement
Medium	Online merchant, subscriptions, delayed delivery	Website review, manual underwriting, delivery and refund terms, test purchase	Rolling reserve, volume cap reviewed after 90 days
High	Telemarketing, travel, high-ticket card-not-present, categories the schemes treat as high risk	Enhanced due diligence, senior approval, site visit, source of funds for principals	Higher reserve or delayed settlement, tighter monitoring thresholds

Transaction laundering and factoring

Transaction laundering is the hardest merchant fraud to see because the approved merchant may be real and well behaved on paper. The OCC describes factoring as running transactions through a merchant account for a business other than the one that was screened and approved, and lists it among the reasons for MATCH listing. In US telemarketing, 16 CFR 310.3(c) of the FTC Telemarketing Sales Rule makes it a deceptive practice, except as expressly permitted by the card system, for a merchant to deposit sales drafts that do not arise from its own transactions with cardholders, for anyone to cause a merchant to do so, or to gain access to the card system through a merchant relationship the merchant agreement does not authorise. Section 310.3(b) extends liability to those who give substantial assistance while knowing or consciously avoiding knowing of a violation.

Detection relies on comparing what the merchant said it would sell with what is actually being sold:

Content and descriptor checks: periodic review of the merchant's website and the descriptors cardholders see; test purchases for higher-risk merchants.
Traffic and referrer analysis: payments originating from websites or apps that are not the boarded business.
Product and ticket mismatch: average ticket or basket patterns inconsistent with the stated product line.
Complaint and dispute reasons: cardholders not recognising the merchant name, or disputes describing goods the merchant does not sell.
Payment processor red flags: FinCEN's advisory FIN-2012-A010 warns that processors may mask illegal transactions, move between institutions quickly, use consolidation accounts that hide return rates, and show acceptable overall return rates while individual originators run much higher. The FFIEC manual adds resubmission under a different name or slightly changed amount, and unexplained shifts between swiped and keyed transactions.

Bust-out patterns and early warning

Bust-out is a timing attack on the provider's trust. The defence is to measure each merchant against its own baseline and against what it declared at onboarding, and to make settlement speed and limits earn-able rather than given.

Signal	Why it matters	Suggested response
Daily volume above an exception threshold (the OCC gives 110% of a prior average as an example of a percentage threshold)	Classic bust-out acceleration, or genuine growth	Review, request invoices or delivery evidence, hold part of settlement while reviewing
Average ticket jump	Fictitious high-value sales	Verify sample transactions with cardholders or delivery records
Repeated identical amounts or card numbers	Self-dealing or card cash-out, both OCC exception parameters	Hold and investigate
Shift from card-present to keyed entry	Manual entry of stolen card data	Restrict keyed entry, review
Rising retrieval requests and chargebacks	The OCC notes excessive retrievals or chargebacks can signal an unscrupulous merchant or a training need	Increase reserve, contact merchant
Change of bank account, principals or business details shortly before a spike	Account takeover of a legitimate merchant, or preparation to abandon	Step-up verification before honouring changes
Refunds exceeding sales, or refunds to cards without prior purchases	Funds extraction	Block unmatched refunds by default

Where suspicious sales are confirmed, the OCC describes the sequence: verification, possible settlement delay, a SAR to FinCEN, account termination and MATCH listing. FinCEN asks filers to include the term "Payment Processor" in the narrative and subject occupation fields where a processor is involved.

Payment facilitators, ISOs and marketplaces

Many merchants are boarded not by the acquirer itself but by an independent sales organisation (ISO), a merchant service provider, a payment facilitator with sub-merchants, or a marketplace that pays out sellers. The OCC is blunt that many of the most serious merchant losses at banks came from merchants signed by ISOs and MSPs, even where the ISO was contractually liable, and that under rent-a-BIN arrangements the BIN owner keeps ultimate liability. The FFIEC manual makes the same point for third-party payment processors: they are often outside BSA/AML requirements themselves, higher-risk merchants use them because they lack direct bank relationships, and a bank that cannot see the nature and source of transactions through a processor account faces higher risk.

For sponsors and acquirers: review the processor's own merchant due diligence standards, require it to identify major merchants with business activity, location and volume, audit merchant lists periodically, and keep contractual rights to timely information, all FFIEC expectations.
For payment facilitators and marketplaces: apply the same underwriting tiers to sub-merchants and sellers, link seller payouts to delivery confirmation for higher-risk categories, and watch for networks of sellers that share devices, bank accounts or addresses.
For everyone: track losses by sales channel and partner, because a single partner with weak boarding can account for most fraud.

Marketplaces sit where merchant fraud meets platform abuse: fake sellers, counterfeit listings and non-delivery scams are also trust and safety problems. See Trust and Safety Operations.

Decision guidance

Instant boarding versus manual underwriting: instant boarding wins merchants but invites bust-out. A common compromise is instant approval with low initial limits and delayed or partial settlement that relaxes as clean history builds.
Reserves versus delayed settlement: the OCC describes reserves funded by a lump sum or by withholding part of each day's proceeds until a target is reached. Delayed settlement is simpler but harsher on genuine small merchants; rolling reserves suit higher-ticket or delayed-delivery models.
Small providers: lean on automated verification, list screening and strict default limits, and buy monitoring rather than build it. See the Fraud Prevention Platform Buyer's Guide.
Large acquirers and platforms: build a merchant risk score combining onboarding data, behavioural baselines, network links between merchants and partner performance, and staff a dedicated merchant investigations team.

How to implement

Baseline the portfolio: chargeback, refund and fraud rates by merchant, category, channel and boarding partner; identify where losses concentrate.
Write the risk appetite: prohibited and restricted categories, tiering criteria, reserve policy, and who can approve exceptions.
Fix onboarding: implement the OCC minimum items, list screening and website review; add identity and beneficial ownership checks for principals.
Turn on exception reports: start with volume, ticket, repeated amounts and cards, keyed share, refunds and chargebacks, running in alert-only mode for a month to tune thresholds.
Add holds and step-up: automatic partial settlement holds for threshold breaches, and verification before honouring changes to bank details or principals.
Bring partners in scope: due diligence on ISOs, processors and facilitators, merchant list audits and performance reviews.
Close the loop: termination, MATCH listing where criteria are met, SAR filing, and feeding confirmed cases back into scoring. Keep a documented release path so legitimate merchants caught by holds can be cleared quickly.

Detection and measurement

Loss rate: merchant fraud and unrecovered chargeback losses as basis points of processed volume.
Time to detect: days from first anomalous transaction to hold, for confirmed bust-out cases.
Reserve coverage: share of losses on terminated merchants covered by reserves or held funds.
Onboarding catch rate: share of later-confirmed fraudulent merchants that were flagged at onboarding.
Partner concentration: share of losses by boarding partner or channel.
False hold rate: holds released as legitimate, to keep friction for real merchants under control.

Framework and regulatory mapping

Area	Reference	What it expects
Merchant underwriting and monitoring (US banks)	OCC Comptroller's Handbook: Merchant Processing	Minimum underwriting items, exception reports, reserves, ISO oversight
Payment processor relationships	FFIEC BSA/AML Manual: Third-Party Payment Processors; FDIC FIL-127-2008	Higher-risk relationship needing extra due diligence and close monitoring
Suspicious activity reporting	FinCEN FIN-2012-A010	Processor red flags and SAR wording
Credit card laundering in telemarketing	FTC Telemarketing Sales Rule, 16 CFR 310.3(b) and (c)	Prohibits laundering sales drafts and assisting violations
Security programme alignment	NIST CSF 2.0 GV.SC, ID.RA, DE.CM	Third-party risk, risk assessment and continuous monitoring

Where identity fits

Merchant fraud is an identity problem twice over. At onboarding the provider verifies a business and its people, so weak know your business checks let synthetic or stolen identities through. After onboarding, merchant dashboards and API keys become targets: an attacker who takes over a legitimate merchant account can change payout bank details or issue refunds, which looks like a bust-out from the outside. Require phishing-resistant MFA for merchant admin users, step-up verification for payout changes, and scoped, rotated API keys for integrations. See the Fraud Prevention Guide for Digital Businesses.

Common failure patterns

Credit-only approval: the FFIEC warns that approval limited to credit risk leaves the bank exposed to illicit or sanctioned transactions.
Treating partner liability as protection: the OCC notes losses from ISO-signed merchants hit banks even where the ISO was contractually liable.
Static limits that never tighten: merchants given full settlement speed on day one, so a bust-out is paid out before the first chargeback arrives.
Portfolio-level metrics only: FinCEN observes that a processor's overall return rate can look fine while individual originators run much higher.
No re-review after boarding: websites, products and principals change; transaction laundering often starts months after approval.
Unverified account changes: payout bank details changed through a compromised merchant login with no step-up check.

Practitioner checklist

Apply the OCC minimum underwriting items, including OFAC and MATCH screening, to every merchant and sub-merchant.
Assign merchant category codes from verified business activity and re-check them on review.
Tier merchants by risk and set reserves, settlement delays and volume caps that relax only with clean history.
Run daily exception reports on volume, average ticket, repeated amounts and card numbers, keyed share, refunds and chargebacks.
Review merchant websites and descriptors periodically and on alerts to detect transaction laundering.
Audit ISO, processor and facilitator merchant lists and their due diligence standards.
Require step-up verification for changes to payout accounts and principals, and MFA for merchant admins.
Document termination, MATCH listing and SAR decisions, and feed confirmed cases back into scoring.

Merchant Fraud and Bust-Out: How Acquirers and Platforms Spot Fraudulent Merchants