When Growth Looks Like Fraud to Your Processor

Jul 6
5 min read

Dark promo graphic with city skyline, headline When Growth Looks Like Fraud, and a Monthly Volume spike chart.

Daily orders at a growing store jump from 40 to 600 in 48 hours after a product takes off. By the third day, the payouts pause, a documentation request lands in the inbox, and the processor places a 10% rolling reserve on the store's revenue.

Nothing went wrong with the business. That is the part most operators find hard to accept. To the processor's risk engine, a sudden surge in volume can look almost identical to a compromised account, and the response is the same either way: pause, review, and protect the funds.

A Processor Funds You Before It Gets Paid

To understand the reaction, it helps to see the exposure. When a customer pays, the processor advances that money to the merchant well before the transaction fully clears and long before the chargeback window closes. For weeks after a sale, the processor is effectively lending against revenue it may still have to refund.

That gap is why risk teams watch velocity so closely. A stable store with predictable volume is a known quantity. A store whose numbers jump overnight is, briefly, an unknown one, and unknown volume sitting inside a chargeback window is exactly what underwriters are paid to flag.

"Sudden spikes in revenue can trigger automated fraud alerts if they don't align with your projected monthly volume." — 2026 merchant underwriting guide, StrictlyZero

The trigger is rarely a human deciding you look suspicious. Most of the first pass is automated. Industry underwriting guidance estimates that automated systems now handle roughly 85% of initial screenings, with manual deep-dives reserved for high-volume or high-risk accounts. A spike is precisely the pattern those systems are tuned to catch.

The Seven Steps Between a Spike and a Hold

Processors tend to follow a consistent sequence once a transaction pattern gets flagged. Knowing the order helps you respond to the right step instead of panicking at the first email. According to payment risk guidance from PayCompass, the process usually runs:

Red flag detection. An automated rule fires on a surge in transaction count, ticket size, or velocity.
Classification. The processor decides whether the issue is transaction-level or account-wide.
Reserve requirement. If future exposure looks likely, a portion of funds is held back.
Underwriting verification. The team rechecks your account details, business model, and stated volume.
Documentation request. You are asked for invoices, supplier agreements, shipping confirmations, and order records.
Decision. The account is released, limited, or escalated.
Ongoing monitoring. The pattern stays watched for recurrence.

"An unexpected surge in the number of transactions, ticket size, or transaction size automatically triggers a fraud review." — PayCompass, on how merchant account holds begin

Underwriting keeps running long after signup. Processors re-score your account with each unusual week, so every spike becomes a fresh data point in an assessment that never fully closes.

2026 Narrowed the Margin for Error

Two card brand updates this year made growth spikes riskier than they were even twelve months ago.

Visa's Acquirer Monitoring Program, updated on April 1, 2026, lowered the merchant threshold that counts as excessive from 220 basis points to 150 basis points across the U.S., Canada, and the EU, applied once a merchant clears roughly 1,500 transactions in a month. The ratio combines fraud reports and disputes against settled transactions, so a spike that arrives with even a modest bump in fraud alerts moves the number quickly.

Mastercard's Scam Merchant Monitoring Program reaches full implementation on July 24, 2026, and it watches authorization behavior directly. For newer merchants, an authorization rate that drops 50 or more percentage points inside 72 hours, or falls below 30% while processing, can open an investigation. A confirmed case can end in immediate processing termination, with no grace period.

A viral moment often brings a wave of new customers, new geographies, and card testing traffic all at once. Approval rates wobble, disputes tick up, and the exact signals both programs monitor start moving in the wrong direction on your best week.

On a Risk Dashboard, Success and Fraud Look Alike

A genuine surge and an attack share a surprising number of features. Both produce a jump in transaction count. Both can raise the average order value. Both often introduce buyers from countries the account has not sold to before. And a real spike frequently attracts opportunistic card testing on the side.

"Even if your system blocks a bot from actually placing an order, the very act of the bot hitting your payment gateway with thousands of different card numbers is what triggers the Enumeration Ratio." — Forter, on why gateways flag traffic

Cross-border volume adds another layer. Payment guidance commonly treats more than 30% of revenue coming from outside your home market as a factor that raises scrutiny, and international expansion is exactly what a breakout product tends to produce. The processor is not judging the quality of your marketing. It is reading velocity, geography, and dispute signals, and those can point the same direction whether the cause is a great campaign or a bad actor.

A growth spike and an attack can look identical on a risk dashboard. The difference is whether your processor heard about it from you first.

A Reserve Is a Cash Flow Event, Not a Formality

When a review ends in a reserve, the operational cost is immediate. Rolling reserves commonly withhold 5% to 10% of revenue and release it on a delay of 90 to 180 days. For a store that just tripled its volume, that is a meaningful share of the exact cash needed to reorder inventory, pay suppliers, and keep winning ad campaigns funded.

That is the quiet trap of a spike-driven hold. The moment your business most needs working capital to sustain momentum is the moment a portion of it can become unavailable. A held payout during a launch is rarely just a payment problem. It quickly becomes an inventory, supplier, and advertising problem.

Glowing blue digital shield with network lines on a dark tech background, symbolizing cybersecurity protection

What to Do Before Your Next Spike

Growth is not the problem. Unexplained growth is. A few operational habits keep a strong week from turning into a frozen one:

Brief your risk team before the surge, not after. If a launch, seasonal peak, or influencer push is coming, tell your processor's risk department your expected volume in advance so the spike is anticipated rather than flagged.
Keep an underwriting file ready. Have recent processing history, supplier agreements, bank statements, and shipping records prepared so a documentation request takes hours to answer, not days.
Forecast volume and share it. Accounts that provide projected monthly volume give the automated systems a baseline to measure against, which is the single thing a spike otherwise lacks.
Watch authorization, dispute, and refund rates weekly. These are the numbers Visa and Mastercard now monitor most closely; a small weekly review catches a drift before it becomes a threshold breach.
Build backup processing before you need it. A second, already-underwritten merchant account means a hold on one processor does not stop your revenue entirely. Backup capacity is only useful if it exists before the freeze.

How Compaytence Helps

Compaytence works with scaling eCommerce brands to review payment risk ahead of growth events, prepare stronger underwriting files, and set up backup processing so a single hold does not interrupt cash flow. If a launch or peak season is on your calendar, it is worth pressure-testing your payment setup before the volume arrives rather than after a payout is already on hold.