Why "High-Risk" Doesn't Mean High Fraud

Why "High-Risk" Doesn't Mean High Fraud

If you're involved in selling supplements, firearms, or running an online tobacco store, then you've most likely come across some form of the following statement from a payment processor: "We can't work with your industry." Now, don't take it personally, though it's not something that concerns you directly or your time in the business; its your industry alone.

That distinction matters more than most merchants realize, and it's worth understanding exactly why it happens, because the gap between "high-risk" and "actually risky" is where a lot of good businesses get boxed out for things completely outside of their control.

It's Not the Code. It's What You're Selling.

A lot of merchants assume there's some official high-risk list they got placed on. In reality, the classification often isn't even tied to a specific Merchant Category Code, because those codes are shared across businesses that get treated completely differently.

For example, supplements typically fall under MCC 5499, the same code used for specialty food stores, gourmet shops, and health food markets that no processor would ever call high-risk. Firearms and ammo dealers often fall under sporting goods codes, the same bucket as your local camping or outdoor gear store. The code itself doesn't distinguish a compliant FFL dealer from a hiking supply shop down the street.

So if it's not the code, what is it? It's the product. Processors build risk models around what you're actually selling and the reputation, legal, and regulatory baggage that comes with it, regardless of how that product happens to get coded on the back end. Supplements get lumped in with an industry history of shady weight-loss claims and FTC actions. Firearms carry political and reputation sensitivity that has nothing to do with fraud math. Online tobacco carries age-verification and interstate shipping concerns that regulators actually do care about.

That's a real distinction worth sitting with: the risk label is being applied to a category of product, not to a technical classification, and definitely not to your specific business.

Underwriting by Assumption, Not by Behavior

Here's the uncomfortable truth: most mainstream processors don't have the infrastructure to underwrite high-risk verticals individually. Doing that well takes specialized compliance knowledge, industry-specific fraud patterns, and a willingness to actually read a merchant's history instead of running it through a generic risk model.

That's expensive and slow. So the easier path for a lot of processors is to draw a line around entire product categories and say no to all of them, regardless of whether the merchant standing in front of them has a clean payment processing history or a proven business model as a startup.

The result is a system where a supplement brand with clean books, real product testing, and zero chargeback issues gets the same "no" as a company running unregulated products out of a garage. A licensed FFL dealer with full ATF compliance gets treated the same as an operation with no oversight at all. An online tobacco retailer with strict age verification, proper state licensing, and a clean shipping compliance record gets the same "no" as a site with none of that in place.

Actual fraud risk and product type are two different things. Processors that only look at the second one are optimizing for their own simplicity, not for accuracy.

What This Actually Costs Merchants

Getting boxed out by what you sell instead of your track record isn't just an inconvenience. It has real downstream effects:

• Account terminations with little warning, because automated risk flags trigger reviews that don't account for context
• Reserve requirements and holds set at a category-wide default instead of based on actual processing behavior
• Longer approval timelines, because high-risk applications get routed through extra manual review even when the merchant's history doesn't warrant it
• Higher processing costs across the board, since the whole category absorbs pricing that's meant to offset the riskiest outliers in it

Merchants end up paying for the bad actors in their product category, even when they've done everything right.

What Merchants Can Actually Do About It

You can't change what you sell. But you can control how much evidence you bring to the table when you're evaluated.

Document everything. Chargeback ratios, refund policies, dispute resolution history, compliance certifications. If you're in firearms, that means your FFL status and any relevant state licensing. If you're running an online tobacco store, that means your age-verification system, state tobacco licenses, and shipping compliance records. The goal is to give an underwriter something concrete to look at instead of leaving them to fall back on assumptions about your product.

Ask how a processor actually underwrites your business, not just your category. A processor that can explain their specific process for supplement, firearms, or tobacco merchants, rather than giving you a generic high-risk pricing sheet, is signaling they've built real infrastructure for your industry instead of just tolerating it.

Look for processors who specialize, not just accept. There's a real difference between a processor that says yes to high-risk merchants because they have the compliance depth to evaluate them properly, and one that says yes because they're charging enough in fees and reserves to not care what happens.

Push back on category-wide terms. If your actual processing history supports better rates or lower reserves than what's standard for your product type, ask for it directly. The merchants who get better outcomes are usually the ones who make their processor look past the label and at the business.

The "high-risk" label isn't going away, and for some parts of these industries, it's earned. But for the merchants doing things right, the gap between what you sell and what your business actually is deserves to be pointed out, not just accepted. Partner with a payment processor like Redde, a high-risk payment processor that understands your business.