The Challenge
When the site says one thing and the mechanics say another, we trust the mechanics.
Merchant onboarding reviews typically focus on the homepage: clean design, professional copy, benign product descriptions. But the homepage is marketing. The truth lives in the checkout items, refund policies, delivery timelines, FAQ sections, metadata, linked domains, and customer support scripts.
We see business model misrepresentation in several contexts:
- High-risk operators presenting as low-risk services: A gambling platform labeled as "entertainment software", a CBD retailer claiming to sell "wellness supplements", or an adult content aggregator described as a "media streaming service"
- Prohibited products hidden behind generic storefronts: Pharmaceuticals sold from "health and beauty" sites, weapons concealed in "sporting goods" catalogs, or copyright-infringing goods within "general merchandise" platforms
- MCC (Merchant Category Code) misclassification: Deliberately selecting incorrect category codes to avoid scrutiny, restrictions, or higher processing fees
The challenge is not catching obvious violations. It is identifying sophisticated operators who build compliant-looking facades while running restricted businesses underneath.
Understanding the Risk
Misclassified merchants create multiple exposures:
Regulatory and scheme compliance risk: Card schemes (Visa, Mastercard, American Express) enforce operating regulations for merchant categories. Misclassification violates these regulations and can result in fines, increased monitoring, or processor termination.
Reputational risk: When acquirers or payment facilitators process transactions for misrepresented businesses, and those businesses later generate consumer harm (fraud, chargebacks, regulatory action), the association damages trust with banking partners and card schemes.
Financial risk: High-risk businesses typically have higher chargeback rates, refund rates, and fraud exposure. When these businesses are processed as low-risk, reserves and risk controls are insufficient, leading to uncovered losses.
Legal liability: In certain jurisdictions, knowingly processing payments for prohibited goods or services creates legal exposure for payment facilitators and their compliance teams.
Detecting misrepresentation is not about rejecting borderline cases. It is about accurately classifying risk so proper controls can be applied.
The Complete Assessment Framework
Deep Catalog Analysis
Why it matters: The homepage shows what the merchant wants you to see. The full catalog shows what they are actually selling.
Risk teams that only review landing pages miss the real inventory. We examine complete product catalogs, hidden categories, and SKUs that do not appear in top-level navigation.
High-Risk Catalog Patterns
Hidden or segregated inventory:
- Products accessible only via direct URLs (not linked from main navigation)
- "Members only" or login-required categories hiding core inventory
- Products discoverable only through site search, not browsing
- Separate storefronts or subdomains hosting different product lines
Why this is high risk: Hiding inventory from casual review suggests the merchant knows those products would trigger concern.
Generic product descriptions masking specific offerings:
- "Health supplements" that are actually controlled substances
- "Entertainment services" that are gambling or adult content
- "Digital goods" that are hacking tools or copyright circumvention
- "Collectibles" that are counterfeit luxury goods
Why this is high risk: Vague language is often deliberate obfuscation.
Volume/pricing inconsistency:
- Site claims to sell consumer electronics but has 5,000 SKUs (small retailers typically carry 50 to 500)
- Luxury goods priced 70 to 90 percent below market (indicates counterfeits)
- Pharmaceuticals or supplements with no regulatory approval numbers or sourcing information
Why this is medium risk: Scale and pricing that do not match stated business model suggest misrepresentation.
Acceptable Catalog Patterns
Transparent, browsable inventory:
- All products accessible through main navigation
- Clear product categorization matching business description
- Detailed product information including brands, specifications, sourcing
- Inventory scale matches business size and stated model
Consistent product types:
- Products align with stated merchant category
- Pricing is consistent with market rates for legitimate goods
- Product descriptions are specific and verifiable
Regulated goods handled properly:
- Age-gated products (alcohol, tobacco) have proper verification flows
- Licensed products display proper authorization
- Restricted goods show compliance with applicable regulations
What to Request from Merchant
Category
Documentation Needed
Complete catalog
- Full product list or catalog export with SKUs, descriptions, and pricing
Category structure
- Site map showing all product categories and access levels
Inventory sources
- Supplier relationships and sourcing documentation for sample high-value or restricted products
Product authorization
- Licenses, permits, or approval numbers for regulated products
Testing Protocol
- Full site crawl: Use tools to discover all pages, including those not linked from navigation
- Search testing: Search for terms associated with high-risk products relevant to the merchant's industry
- Account creation: Create test accounts to verify if login reveals additional inventory
- Checkout simulation: Add various products to cart and proceed to checkout to examine final itemization
Merchant assessment
- All products accessible through main navigation (no hidden categories)
- Product descriptions are specific and match actual offerings
- Pricing aligns with market rates for stated product types
- Inventory scale matches business size and description
- No evidence of segregated or members-only catalogs hiding core business
- Regulated goods display proper compliance documentation
Red flag threshold:
- Hidden inventory accessible only via direct URLs = HIGH RISK
- Generic descriptions masking restricted products = HIGH RISK
- Pricing indicating counterfeits or unauthorized goods = MEDIUM to HIGH RISK
- Massive catalog inconsistent with stated business size = MEDIUM RISK
Checkout and Payment Flow Examination
Why it matters: The checkout process reveals the merchant's actual business model. Payment terms, shipping options, and final itemization expose what is really being sold.
We see discrepancies between storefront presentation and checkout reality constantly: sites presenting as physical goods retailers that offer only digital delivery, or "free trial" offers that become expensive subscriptions at checkout.
High-Risk Checkout Patterns
Misleading transaction descriptors:
- Checkout page shows different business name than storefront
- Credit card descriptor is a shell company or generic name
- Transaction appears to come from different country than merchant claims
- Multiple entities involved in payment flow without explanation
Why this is critical risk: Obscured transaction descriptors indicate the merchant is hiding their identity or business model from customers and payment systems.
Delivery timeline mismatches:
- Physical goods retailer offers only instant digital delivery
- "In stock" items have 30 to 60 day shipping windows (dropshipping or pre-orders)
- No shipping options provided despite claiming to sell physical products
- Delivery terms buried in fine print contradict prominent site claims
Why this is medium to high risk: Delivery mismatches often indicate the merchant does not actually stock or control the products they claim to sell.
Subscription traps and hidden recurring charges:
- "Free trial" automatically converts to expensive subscription
- One-time purchase described on product page becomes recurring charge at checkout
- Cancellation process absent or intentionally difficult
- Subscription terms buried in multi-page terms of service
Why this is high risk: Deceptive subscription practices generate high chargeback rates and consumer complaints.
Payment method restrictions:
- Merchant accepts only cryptocurrency, wire transfer, or prepaid cards
- Refusal to accept major credit cards despite claiming to be established business
- Payment routing through multiple intermediaries or offshore processors
Why this is high risk: Unusual payment limitations often indicate the merchant has been terminated by mainstream processors or is avoiding transaction scrutiny.
Acceptable Checkout Patterns
Transparent transaction information:
- Business name at checkout matches storefront
- Credit card descriptor clearly identifies the merchant
- All parties involved in payment processing disclosed
- Transaction currency and amount clearly stated
Delivery terms match product type:
- Physical goods have realistic shipping timelines and options
- Digital goods clearly labeled as instant delivery
- Pre-orders or backorders explicitly disclosed before purchase
- Shipping costs and timelines presented before payment
Clear subscription terms:
- Recurring charges disclosed prominently at point of sale
- Trial periods explained with clear conversion terms
- Cancellation process accessible and straightforward
- No hidden auto-renewals
Standard payment acceptance:
- Accepts major credit cards and standard payment methods
- Payment processor is reputable and transparent
- No unusual routing or intermediary requirements
What to Request from Merchant
Category
Documentation Needed
Transaction descriptors
- Exact descriptor that appears on customer credit card statements
Payment routing
- Full payment flow diagram showing all intermediaries and processors
Checkout flow
- Screenshots or walkthrough of complete checkout process for sample products
Subscription terms
- Documentation of recurring billing terms and cancellation procedures if applicable
Delivery capabilities
- Fulfillment partner relationships and shipping timelines for physical goods
Testing Protocol
- Test transaction: Conduct test purchase to verify descriptor, checkout flow, and confirmation details
- Multi-product testing: Test checkout for different product types to identify inconsistencies
- Subscription verification: If applicable, test trial signup and cancellation process
- Cross-reference: Compare checkout information against business registration and stated model
Merchant assessment
- Transaction descriptor matches business name and description
- Delivery timelines align with product type (physical vs. digital)
- No hidden subscription conversions or recurring charges
- Payment methods are standard for the business type and geography
- All fees and charges disclosed before final payment
- Checkout items match storefront descriptions
Red flag threshold:
- Obscured or mismatched transaction descriptors = CRITICAL RISK
- Delivery method contradicts product type = HIGH RISK
- Hidden subscription conversions = HIGH RISK
- Unusual payment method restrictions = MEDIUM to HIGH RISK
Policy and Terms Analysis
Why it matters: Refund policies, terms of service, and FAQ sections reveal operational reality. Restrictive or unusual policies often indicate the merchant is selling something different than advertised.
We examine policy documents for internal consistency and alignment with stated business model. Discrepancies are evidence of misrepresentation.
High-Risk Policy Patterns
Restrictive or absent refund policies:
- "All sales final" for products typically eligible for returns
- Refund policy significantly worse than industry standard
- Refund terms hidden or requiring customer to hunt for them
- Policy contradicts consumer protection laws in merchant's jurisdiction
Why this is medium to high risk: Merchants selling legitimate, as-described products typically offer industry-standard refund terms. Overly restrictive policies suggest the products will not meet customer expectations.
Vague or evasive terms of service:
- Terms describe business differently than storefront (e.g., site sells "software" but ToS references "entertainment services")
- Governing law or jurisdiction is offshore or inconsistent with stated business location
- Terms include unusual arbitration or class-action waiver clauses
- Privacy policy describes data collection inconsistent with stated business
Why this is medium risk: Discrepancies between ToS and storefront suggest the merchant is obscuring their actual business model.
Age verification inconsistencies:
- Age gate on homepage but products accessible without verification
- Age verification for benign products (suggesting restricted items are available)
- No age verification for products requiring it (alcohol, tobacco, adult content)
Why this is high risk: Improper age verification indicates either restricted products or inadequate compliance controls.
Liability disclaimers suggesting high-risk products:
- Medical disclaimers for products not typically requiring them
- Disclaimers about legality varying by jurisdiction (suggesting borderline-legal products)
- Extensive liability waivers disproportionate to product type
Why this is medium risk: Over-engineered disclaimers suggest the merchant anticipates problems or legal challenges.
Acceptable Policy Patterns
Industry-standard refund terms:
- Return windows consistent with product type and industry norms
- Clear refund process with contact information
- Policy complies with consumer protection regulations
- Refund terms prominently displayed
Consistent and transparent terms of service:
- Business described in ToS matches storefront
- Jurisdiction and governing law align with business location
- Privacy practices appropriate for business type
- No unusual or overly broad liability waivers
Appropriate compliance controls:
- Age verification present and functional for restricted products
- Verification absent for products not requiring it
- Compliance measures match regulatory requirements
Clear policies accessible to customers:
- Refund, privacy, and terms easily findable from any page
- Policies written in plain language
- Contact information for policy questions provided
What to Request from Merchant
Category
Documentation Needed
Refund policy
- Complete refund and return policy documentation
Terms of service
- Full ToS including jurisdiction, liability, and arbitration clauses
Privacy policy
- Data collection and usage practices
Age verification
- Process for verifying customer age if applicable
Regulatory compliance
- Evidence of compliance with consumer protection regulations
Testing Protocol
- Policy review: Read complete refund policy, ToS, and privacy policy for internal consistency
- Cross-reference: Compare policy descriptions of business against storefront claims
- Jurisdiction verification: Verify governing law matches business registration location
- Competitor comparison: Compare policies against legitimate competitors in same industry
Merchant assessment
- Refund policy is industry-standard and clearly disclosed
- Terms of service describe business consistently with storefront
- Jurisdiction and governing law align with business location
- Age verification appropriate for product type
- Policies comply with applicable consumer protection regulations
- No excessive or unusual liability disclaimers
Red flag threshold:
- Business description in ToS contradicts storefront = HIGH RISK
- Absent or highly restrictive refund policy for returnable goods = MEDIUM RISK
- Offshore jurisdiction inconsistent with claimed location = MEDIUM to HIGH RISK
- Age verification inconsistencies = HIGH RISK (for restricted products)
Technical Infrastructure and Metadata
Why it matters: Domain registration, hosting infrastructure, site metadata, and technical fingerprints reveal operational reality beyond what merchants claim.
We examine technical evidence to identify networks of related sites, shell operations, and sophisticated misrepresentation schemes.
High-Risk Technical Patterns
Domain and hosting red flags:
- Domain registered days or weeks before merchant application (newly created shell)
- Privacy protection hiding domain registrant information
- Hosting in high-risk jurisdiction inconsistent with claimed business location
- Domain history shows previous use for different business or high-risk activity
Why this is medium to high risk: Newly created domains with hidden registration often indicate disposable operations or merchants hiding prior terminations.
Metadata inconsistencies:
- Site title tags or meta descriptions reference different business than storefront
- Image alt text or filename patterns suggest different product categories
- Structured data markup (Schema.org) describes business differently than visible content
- Analytics tracking codes shared with unrelated or high-risk domains
Why this is medium risk: Metadata often reveals the merchant's actual focus or connections to other operations.
Linked domain networks:
- Shared analytics IDs, ad pixels, or tracking codes across multiple storefronts
- Cross-linking between domains selling different product types
- Common ownership or registration information across a network of sites
- Sites share identical design templates, terms of service, or policy language
Why this is high risk: Domain networks often indicate an operator running multiple fronts for restricted businesses or churning through merchant accounts.
Third-party script and service patterns:
- Adult industry verification services on non-adult sites
- Cryptocurrency payment widgets on traditional retail sites
- Gambling or casino-related scripts loaded on game or entertainment sites
- Fraud or proxy detection scripts suggesting high-risk customer base
Why this is medium to high risk: Third-party integrations reveal the merchant's actual operational needs and customer profile.
Acceptable Technical Patterns
Established, transparent infrastructure:
- Domain registered years in advance, consistent with business age claims
- Domain registration information matches business entity
- Hosting location aligns with business operations
- No history of domain use for unrelated businesses
Consistent metadata:
- Site metadata describes business accurately
- Structured data matches visible content
- Analytics and tracking appropriate for business type
- No shared tracking across unrelated domains
Independent operation:
- No evidence of domain networks or shared infrastructure with unrelated businesses
- Third-party scripts and services appropriate for stated business model
- Technical stack consistent with business size and sophistication
What to Request from Merchant
Category
Documentation Needed
Domain ownership
- Domain registration information (WHOIS data)
Related properties
- List of all domains and websites operated by the merchant or related entities
Infrastructure
- Hosting provider and server location information
Third-party services
- List of payment processors, analytics, fraud prevention, and other integrated services
Testing Protocol
- WHOIS lookup: Check domain registration date, registrant, and history
- Site crawl: Examine source code, metadata, and loaded scripts
- Reverse analytics search: Identify other domains sharing tracking codes
- Subdomain enumeration: Discover subdomains that might host different content
- Historical analysis: Use Wayback Machine to check domain's previous content
Merchant assessment
- Domain age consistent with business claims
- Domain registration transparent (not privacy-protected without justification)
- Metadata and structured data match storefront claims
- No undisclosed network of related domains
- Third-party scripts appropriate for business type
- Hosting and infrastructure align with claimed business location
Red flag threshold:
- Newly registered domain (less than 6 months) with hidden registrant = MEDIUM to HIGH RISK
- Metadata describing different business than storefront = HIGH RISK
- Network of related sites with pattern of misrepresentation = CRITICAL RISK
- Third-party services inconsistent with business type = MEDIUM to HIGH RISK
Customer Support and Communication Analysis
Why it matters: How merchants interact with customers reveals operational reality. Support scripts, FAQ responses, and customer communications expose the true business model.
We review customer-facing communications for consistency with merchant representations. Discrepancies indicate misrepresentation.
High-Risk Communication Patterns
Support channels inconsistent with business claims:
- Professional retail operation offers only generic email support (no phone, chat, or physical address)
- Support contact information routes to unrelated business or offshore call center
- Customer service responses use templates inconsistent with stated business
- Refund or dispute inquiries directed to third party without explanation
Why this is medium risk: Inadequate or outsourced support suggests the merchant does not directly operate the claimed business.
FAQ content revealing different business model:
- Questions reference products, services, or transactions not visible on storefront
- Answers contradict storefront claims about delivery, refunds, or product nature
- FAQ discusses regulatory compliance for different industry than claimed
- Legal or liability questions disproportionate to stated business type
Why this is high risk: FAQ sections often contain unfiltered information about actual operations.
Marketing and outreach mismatches:
- Email marketing describes offers or products not on website
- Social media presence promotes different business model
- Advertising (if accessible) targets different audience or product category
- Affiliate or referral programs structured for high-risk industries
Why this is medium to high risk: Marketing communications reveal the merchant's actual customer acquisition strategy and business focus.
Review and reputation issues:
- Customer complaints about receiving different products than ordered
- Reviews mentioning unexpected charges, subscriptions, or business practices
- Pattern of chargebacks or fraud reports related to misrepresentation
- Merchant actively suppresses or hides negative reviews
Why this is high risk: Customer complaints about deception validate suspicions of misrepresentation.
Acceptable Communication Patterns
Professional, consistent support:
- Support channels appropriate for business size and type
- Contact information verifiable and aligned with business entity
- Support responses consistent with storefront claims
- Accessible customer service with reasonable response times
FAQ aligned with business model:
- Questions and answers consistent with products and services offered
- No references to undisclosed products or practices
- Legal and compliance content appropriate for stated industry
Consistent marketing:
- Email, social media, and advertising aligned with storefront
- Target audience matches claimed customer base
- Promotional content describes same products visible on site
Positive reputation:
- Customer reviews generally reflect accurate product descriptions
- Chargeback and dispute rates appropriate for industry
- No pattern of complaints about misrepresentation or deception
What to Request from Merchant
Category
Documentation Needed
Support structure
- Customer service contact methods, hours, and response procedures
FAQ content
- Complete FAQ or knowledge base content
Marketing materials
- Sample email campaigns, social media content, and advertising (if applicable)
Customer feedback
- Summary of customer complaints and resolutions (recent 90 days)
Testing Protocol
- Support contact: Reach out with test inquiry to verify response quality and consistency
- FAQ review: Read complete FAQ for references to undisclosed products or practices
- Social media audit: Review merchant's social media presence for content alignment
- Review aggregation: Check third-party review sites for complaint patterns
- Chargeback inquiry: If accessible, review chargeback reason codes for evidence of misrepresentation
Merchant assessment
- Customer support channels appropriate and accessible
- FAQ content aligns with storefront claims
- Marketing and advertising consistent with stated business
- No pattern of customer complaints about misrepresentation
- Reviews reflect accurate product and service descriptions
- Chargeback rates and reason codes typical for industry
Red flag threshold:
- Minimal or offshore support for claimed professional operation = MEDIUM RISK
- FAQ reveals undisclosed products or practices = HIGH RISK
- Customer complaints about receiving different products or services = HIGH RISK
- Marketing promotes different business than storefront = MEDIUM to HIGH RISK
What Good Looks Like: The Consistent, Transparent Merchant
When all elements align properly, a legitimate merchant presents:
Business Presentation
- Consistent story across homepage, catalog, checkout, and policies
- Product descriptions specific and verifiable
- Transparent about business model and operations
- Professional presentation matching business maturity claims
Product Catalog
- All inventory accessible and browsable
- Product types align with stated merchant category
- Pricing consistent with market rates
- Regulated goods properly documented and compliant
Checkout and Payment
- Transaction descriptors match business name
- Delivery terms align with product type
- No hidden charges or subscription traps
- Standard payment methods accepted
Policies and Terms
- Industry-standard refund and return policies
- Terms of service consistent with storefront
- Appropriate age verification and compliance controls
- Policies comply with consumer protection regulations
Technical Infrastructure
- Established domain with transparent registration
- Metadata and structured data accurate
- No undisclosed networks or related sites
- Third-party services appropriate for business type
Customer Communications
- Professional support channels accessible
- FAQ content aligned with storefront
- Marketing consistent across channels
- Positive customer reputation with minimal complaints
Example: Compliant Merchant Profile
Company: Premium Home Goods Co.
Model: Direct-to-consumer home furnishings and decor
Storefront: Clean, professional site showcasing furniture, lighting, textiles, and accessories. All products browsable through main navigation.
Catalog: 450 SKUs across 12 categories. Pricing aligns with mid-range home goods market. Product descriptions include materials, dimensions, care instructions.
Checkout: Business name "Premium Home Goods Co." appears on checkout and credit card descriptor. Shipping options include standard (5 to 7 business days) and expedited (2 to 3 business days). No hidden charges.
Policies: 30-day return policy for unused items. Terms of service indicate business registered in Delaware, operating from New York warehouse. Privacy policy describes standard e-commerce data collection. Policies accessible from footer on all pages.
Technical: Domain registered 4 years ago to Premium Home Goods LLC (matches business entity). Hosted in US. Site metadata accurately describes home furnishings retailer. Google Analytics and standard e-commerce tracking. No shared tracking with unrelated domains.
Support: Phone, email, and chat support available. FAQ covers shipping, returns, product care. Customer reviews on site and third-party platforms reflect accurate product descriptions. Chargeback rate below 1 percent (within acceptable range for consumer goods e-commerce).
This profile represents acceptable risk with standard monitoring.
Common Classification Errors
Mistake: Stopping at the homepage
The problem: Approving merchants based on a polished landing page without examining the full catalog, checkout process, or operational evidence.
What to do: Treat homepage review as the first step, not the conclusion. Always examine complete catalog, test checkout flow, and review technical infrastructure.
Mistake: Accepting the merchant's category self-selection
The problem: Trusting the merchant's stated MCC (Merchant Category Code) or business category without verification against operational reality.
What to do: Verify the stated category against actual products, delivery methods, customer support structure, and technical patterns. Reclassify when evidence contradicts claims.
Mistake: Ignoring technical fingerprints
The problem: Missing domain networks, shared infrastructure, or metadata inconsistencies that reveal the merchant's true business model or connections to other operations.
What to do: Conduct technical due diligence including WHOIS lookups, reverse analytics searches, and metadata review as standard practice.
Mistake: Not testing the checkout flow
The problem: Reviewing product pages without completing a test transaction to verify descriptors, final itemization, and delivery terms.
What to do: Conduct test purchases (or simulate checkout to final step) to verify transaction presentation matches storefront claims.
Mistake: Overlooking policy red flags
The problem: Not reading refund policies, terms of service, or FAQs that contain evidence of misrepresentation.
What to do: Require and review complete policy documentation. Flag discrepancies between policies and storefront for investigation.
The Critical Question
When evaluating whether a merchant is accurately representing their business, ask:
"If we showed an independent evaluator the checkout flow, policies, and technical infrastructure (without the homepage), would they describe the same business the merchant claims to operate?"
If yes, the merchant is likely presenting their business accurately and consistently.
If no, there is evidence of misrepresentation requiring further investigation or reclassification.
This single question captures the essence of consistency-based verification. The mechanics do not lie.
Ballerine's Role
Ballerine provides infrastructure to make ongoing consistency verification manageable at scale: automated website monitoring to detect when merchants add restricted products or change business models post-onboarding, ecosystem mapping to reveal connections between domains and identify operator networks, and checkout flow analysis to verify that transaction presentation remains consistent with merchant representations.
The foundational knowledge in this guide equips risk teams to ask the right questions during merchant onboarding: what appears in the checkout that does not appear on the homepage, who receives the funds and under what business name, what do the refund policies and FAQs reveal about actual operations, and what does the technical infrastructure tell us about the merchant's network and history. These operational realities determine accurate classification, regardless of what the merchant claims.
For continuous monitoring of merchant consistency across your entire portfolio, our merchant monitoring capabilities maintain visibility into catalog changes, policy updates, and technical infrastructure evolution, detecting business model drift before compliance exposure accumulates.
What is your fastest consistency check?
When you need to quickly evaluate a merchant for potential misrepresentation, what single check gives you the most signal?
We prioritize checkout simulation. Complete the purchase flow (or reach final checkout screen) and compare:
- Transaction descriptor vs. storefront business name
- Final itemization vs. product page descriptions
- Delivery method vs. claimed product type (physical goods should not offer instant digital delivery)
- Total charges vs. advertised pricing (hidden fees, subscriptions)
This one test surfaces the majority of meaningful misrepresentations within minutes. It is where the truth emerges because merchants must disclose operational reality to complete transactions, even when the storefront obscures it.
.png)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.png)
