Payments Please

This article is an answer to a few questions I had:
Why do merchants get kicked off payment networks?
How does Coinflow probably work?
How do crypto cards probably work?
How does Visa’s Stablecoin Settlement probably work?

Ok first, let’s step back and take a look at how traditional payments flow.

Sample Flow

Let’s imagine you have a user that uses a Visa credit card to pay for some product at a merchant that uses a Square payment terminal.

Here are the key players:

• Cardholder: the person paying with their Visa card

• Issuing Bank: the bank that gave the cardholder their Visa card (e.g. TD)

• Merchant: the business accepting payment

• Acquirer (Acquiring Bank): the bank that processes payments on behalf of the merchant (often Square itself acts as this, or works with one)

• Payment Processor: the tech layer that routes transaction data (Square plays this role too)

• Card Network: Visa in this case, is a network connecting all merchants, issuing banks, acquiring banks

• Payment Terminal / POS Provider: Square’s hardware and software

Here’s how the money flows:

1. Cardholder taps/swipes at Square terminal

The terminal captures this data:
	PAN (Primary Account Number) → your 16-digit card number
	Expiry Date
	CVV2 (card verification value)
	Track 2 Data → magstripe equivalent, contains PAN + expiry + service code
	Cryptogram → a one-time encrypted token generated by the chip

2. Square captures the card data and sends an authorization request to Visa’s network¹

The data on the card is wrapped into an ISO 8583 message and sent over VisaNet:
	MTI (Message Type Indicator): 0100  ← means "Authorization Request"
	Field 2:  Primary Account Number → 4111111111111111
	Field 3:  Processing Code → 000000 (purchase)
	Field 4:  Amount → 000000002500 ($25.00)
	Field 7:  Transmission DateTime → 0319143022
	Field 11: STAN (System Trace Audit Number) → 123456 (unique ID for this txn)
	Field 18: Merchant Category Code → 5812 (restaurants)
	Field 22: POS Entry Mode → 071 (chip read)
	Field 41: Terminal ID → SQ-TERM-00123
	Field 42: Merchant ID → 000123456789
	Field 49: Currency Code → 840 (USD)
	Field 55: EMV Data → cryptogram
(These fields are standardized and consistent across networks, but each network changes how exactly the data is formatted/what they mean)

3. Visa routes it to the issuing bank (e.g. TD Bank)

4. TD checks: Does the cardholder have funds? Is it suspicious? Is the card valid?

5. TD sends back approved or declined

More specifically, an ISO 8583 0110 message (Authorization Response) with a response code:
	00 → Approved
	05 → Do Not Honor (generic decline)
	14 → Invalid Card Number
	51 → Insufficient Funds
	54 → Expired Card
	57 → Transaction Not Permitted
	61 → Exceeds Withdrawal Limit
	65 → Exceeds Activity Limit
	91 → Issuer Unavailable

6. Visa relays that back to Square

7. Square (payment processor) receives the approval or declined message

8. TD (Issuing bank) freezes the funds in the cardholder’s account

9. Issuing Bank settles with the Acquiring Bank via ACH (interbank settlement)

Every day, Square batches all approved transaction into a clearing file
	This gets submitted to Visa in a 0220 message (Authorization Advice) or batch file
	Visa runs a multilateral net settlement; instead of processing every transaction individually,
        they net out all the money flows between all banks simultaneously.
        The result is a single net payment between each pair of institutions
	For example:
		TD Bank owes Chase: $4.2M
		Chase owes Bank of America: $1.1M
		Bank of America owes TD: $2.8M
		→ net these out → TD pays $1.4M, done

Visa Settlement Bank (using Chase Manhattan Bank in New York - BIS doc is from 2003 and may have changed) holds prefunded settlement accounts for every member institution and pulls funds (debits and credits), and then banks, within 24 or latest 72 hours, true up through Fedwire (which transfers funds in minutes for <$100) or FedACH (traditional ACH rails).

There are a few caveats to this: First, the banks that have accounts at JP Morgan and have this float are called Visa Principal Members, though most Principal Members are actually sponsored by a bank rather than having their own account. Second, the largest banks don’t have any cash or collateral with Visa, as they generally have huge reserve accounts at the Central Bank and are considered too big to fail. Smaller banks, however, do have to post collateral. Banks that work with high-risk merchants may even have to post a rolling cash reserve, like 10% of volume being locked at all times in the case of non-payment. Block mentions this program here.
Note: This system only applies to the US; in many other countries like Canada or the EU, these settlement accounts exist at the central bank.

10. Square sends an ACH payment to the merchant’s specific bank account

These are often $0.20-$1.50 flat per transaction.

The fees involved:

• Merchant to TD: Interchange fee paid by the Merchant (via acquirer) to the issuing bank is 1.5-2%. These are the majority of the fees and pay for credit card rewards programs. The interchange fee is set by the network (Visa, Mastercard, etc), charge different rates based on the type of card it is (debit, corporate, rewards), the Merchant Category Code (grocery and utilities get lower rates than gambling), transaction type (chip/tap have lower fees than online payments), and transaction size (larger payments sometimes are charged more)

• Merchant to Visa: Network fee paid by Merchant to Visa 0.13-0.15%

• Merchant to Square: Acquirer fee paid by Merchant 0.2-0.5% + flat fee
  In the US, only debit card interchange fees are capped (The Durbin Amendment, part of the Dodd-Frank Wall Street Reform Act of 2010). Most countries cap interchange fees, but the US does not for credit cards. For example, The EU caps credit card interchange at 0.3% and debit at 0.2%.

The float:

• Square holds onto funds for 1-2 business days before sending the ACH to the merchant. They invest this in short term yield bearing assets. Square also offers instant transfers for an additional 1.95% fee.

• The issuing bank TD, like all banks, continuously invests its deposit base in overnight lending markets and short-term treasuries through fractional reserve banking. When TD freezes the cardholder’s funds for 1-2 days, the money still exists on TD’s books and can be invested.

• Since Visa uses Chase (now under JP Morgan) to hold settlement accounts of other banks, Chase earns overnight interest on it.

Questions I had:

• What if an issuing bank just chooses to not send the ACH to the acquiring one?
  To join Visa’s network, banks are legally bound to settle within 24 hours for most transactions or a 72 hours max outer limit. As mentioned earlier, Visa Principal Members which have direct or sponsored accounts for Visa, generally provide collateral. If a bank’s settlement account is underfunded, Visa has a Settlement Risk Program where banks must have posted collateral (cash, bonds, letters of credit) which are immediately seized. If the collateral is insufficient, Visa absorbs the loss and pursues the bank legally. If a bank becomes insolvent, Visa’s Settlement Indemnification Program kicks in where other member banks collectively backstop the loss. According to Visa’s 2024 10-K “As of September 30, 2024 and 2023, the Company had total collateral of $7.7 billion and $6.2 billion, respectively.”

• How does VisaNet physically work?
  When the POS device accepts a payment, sends the message through the POS’s infrastructure. For example, if this is AWS though us-east-1, it is then sent to a dedicated private circuit to a Visa Point of Presence through a physical fiber. Visa has a couple of core data centers, primarily in Ashburn, VA, Highlands Ranch, CO, London, and Singapore. These physical locations are where Visa flags transactions. They then return a score 0-99 to the issuing bank, where a number that is higher is a higher recommendation to decline the transaction. The issuing bank makes the final decision to reject a transaction. This all happens in ~2 seconds.

How does chargeback work?
A chargeback is a forced reversal of a transaction by the issuer bank (cardholder’s bank).

Chargebacks are a built-in part of credit cards and mandated by the Fair Credit Billing Act of 1974. This was largely included to protect consumers as a built-in backstop to increase confidence in using credit cards.

There are 4 scenarios where chargebacks occur:

1. Card Present, Chip Transaction
   If a customer taps a chip card, the merchant usually wins because there is proof of payment with the EMV. If this transaction is by theft/fraud, the issuing bank eats the loss.

2. Card Present, Swipe (no chip)
   According to the EMV Liability Shift of 2015, by accepting a swipe, the merchant accepted fraud liability and the merchant often loses the chargeback.

3. Card not present (online transaction)
   Liability almost always falls to the merchant, as they cannot prove the card was physically present. Increasingly, merchants use 3D Secure (3DS) to prove the card was present. In the US, adoption is rising, in 2024 was 58%. If 3DS is used, all fraud liability shifts to the issuing bank.

4. Friendly Fraud
   Customer receives goods but claims they didn’t receive it or it isn’t as described.
   Even with delivery confirmation, cardholders win ~60% of disputes. Merchants usually lose.

Some interesting stats about this:

• According to Mastercard, friendly fraud makes up over 45% of all chargebacks

• Merchants identify 45% of their chargebacks as fraudulent

• Digital purchases represent 63% of merchant transactions

• Visa lists 5 trends that have fundamentally shifted how fraud operates:

  • industrialization of fraud (from opportunistic fraudsters to strategic, automated, and AI-powered),

  • monetization playbook (stolen cards increasingly use real-time payments, digital wallets, cryptocurrency, and card details are sat on for months before use),

  • authenticity crisis (with AI, acquiring banks onboard merchants who have legit-looking websites but are fronts for fraud),

  • control erosion (sophisticated schemes to develop fraudulent merchants that can pass compliance checks)

  • third party gaps (data breaches from third parties that expose card data)

  • I love this quote: “Traditional fraud controls — velocity checks, merchant categorization, visual website inspection, delayed fraud monitoring, perimeter-based security — were designed for a world where fraud moved at human speed, fake businesses looked amateurish, stolen data was used immediately, and payment entities were the primary targets. None of those assumptions still hold.”

Chargebacks fees:

• Square charges a flat $15-$25 from merchants as well as the lost transaction amount

• If the merchant loses, the fee is not returned

• If the merchant wins, the transaction amount is returned but the fee is sometimes not returned depending on the processor

Who can reject a transaction?
To protect themselves, players within this stack often pre-emptively block transactions. Issuing banks are exposed to fraud losses for chargeback scenario

• Square (POS) can reject it before it reaches Visa

• VisaNet can reject it based on the user, the issuer (customer’s bank), the merchant, acquirer (merchant’s bank). This is very rare.

• Issuing bank is the player that declines the majority of transactions, based on the merchant and information Visa provides.

The Problem

The core problem as we’ve been able to see is that in the US, merchants are the ones fined and have to pay chargebacks for card swipes, online transactions, and for “friendly fraud” if the product is not up to the customers’ expectations.

This issue bubbles up to the network (Visa or Mastercard). When an acquiring bank (or POS like Square that acts as one) sponsors a merchant (lets the merchant use them), they are vouching for them to Visa. They promise Visa that if the merchant can’t pay chargebacks, they will. This guarantee is legally binding between the acquirer and Visa.

When a dispute does occur, Visa first debits the acquirer bank. The acquirer then debits the merchant’s bank balance. If the merchant does not have the funds, the acquirer eats the loss as well as Visa’s own fines and fees. Acquirers generally have Merchant Service Agreements (MSAs), where acquirers can pursue debt collection, civil suits, and sell the debt to third party collectors.

The fines are extraordinary (which go on top of the actual chargeback losses):
Per chargeback above threshold:

• 0.65% rate: warning issued

• 0.9% rate: standard $50 per chargeback above threshold

• 1.8% rate: $100 per chargeback above threshold

If the merchant stays in monitoring too long, fines escalate, as well as the acquirer being charged $25,000/month after just 4 months or even $50,000/month after 7 months. Visa can also mandate the acquirer to terminate a certain merchant or face suspension themselves.

Why does Visa even care?
You might be thinking; Visa doesn’t lend money or absorb credit risk, why does Visa even care if there are chargebacks? To them, Visa’s product is trust. Both consumers trust that it can be used everywhere and merchants trust they will get paid. When trust gets eroded, merchants and users will go to competitors (or more willingly accept ACH or crypto). Self-policing also keeps government regulators from imposing rules that may hurt Visa (Visa also donates to representatives. Visa notably backs the Electronic Payments Coalition who heavily lobby against expansions of the Durbin Amendment.)

The fines are sized specifically to exceed the profit any acquirer makes from keeping a bad merchant.

In essence, acquirers are on the hook for merchants they sponsor because Visa will fine the acquirer per transaction and a monthly fee if chargebacks rise.

Crypto Cards and Payments:

When a user pays for a product, the MCC (Merchant Category Code standard managed by Visa when using VisaNet) is included in the transaction. Some MCC’s are instantly blocked because of high chargeback rates, which hurt the merchants, the acquiring bank, and the acquiring bank’s relationship with Visa.

Some sample MCC’s with high chargeback rates:
7995 - Gambling:

• High chargeback rate because of buyer’s remorse

• Illegal in some jurisdictions

• AML concerns (money laundering through casinos)

6051 - Cryptocurrency:

• Buying crypto is irreversible, so it is a high fraud target (buying crypto then getting a chargeback)

4829 - Wire Transfer/Money Orders:

• Classic money laundering vehicle

• Irreversible

• Hard to verify recipient

5999 - Miscellaneous Retail:

• Catch-all category = hard to monitor

• Often used for MCC fraud

• No specific product category to screen against

How do Acquirers make money?

Acquirers use two main pricing models.

1. Flat rate

   Square charges 2.6% + 10c per transaction, which makes the profit more on low-cost transactions and less (or lose money) on high-cost ones.

2. Interchange Plus
   For example, Interchange fee (network fee chosen by Visa/Mastercard/etc) + 0.3% + 10c

Acquirers also set different prices based on the MCC. Lower risk MCCs get better rates (grocery, gas station, restaurant), while higher MCCs get worse rates (gambling, crypto, misc retail).

The game of whack a mole

The core insight is that it doesn’t matter if a merchant charges more and offers to cover chargebacks, since Visa punishes chargebacks where the merchant has to pay (which is the majority of online payments) even if merchants can cover the fines.

To prevent this, each player in the stack (processor/acquirer, Visa, issuing bank) has the power to and do decline transactions before they even get the chance to get reach the chargeback state, leading to many “false positive” rejections. Authorization rates for higher-risk MCC’s can drop to the low double digits.

Novel industries also often start off with higher chargeback rates because acquirers lack the historical data or framework to vet merchants in new industries, often leading to fraudulent merchants getting onboarded. These fraudulent merchants explicitly take advantage of this gap, artificially inflating the chargeback ratios for the entire vertical and causing the entire industry to be penalized with high-risk pricing.

So what do merchants of high-risk MCC’s do? I’ve heard stories of a couple of options:

1. Intentionally code incorrectly
   By registering yourself as a different MCC, you can receive a lower acquirer charge and have transactions not blocked. For example, labelling a 6051 (Cryptocurrency )purchase as 7372 (Prepackaged Software).

2. Acquirer relationship and miscoding
   If the merchant has high volumes and is willing to pay higher premium fees, the acquirer can feign plausible deniability. This is to prevent auto-rejecting of transactions by the Issuer bank for some MCC’s that are blocked preemptively.
   For novel industries that don’t fit a specific bucket (crypto cards, merchant platforms like Whop, etc), Acquirer’s work with merchants to pick a MCC that best suits the product.

3. Join High-Risk Acquirers
   Some Acquirers have specialized to work with higher-risk merchants, often having higher collateral posted with Visa. These acquirers are often off-shore, charge significantly higher fees to merchants, and require larger reserves.

4. Multiple Acquirers
   If the Authorization rate for one acquirer is low, some merchants try multiple in a row hoping that at least one authorizes the transaction.

5. Spinning up new merchants
   Large, legitimate operations may split their products into multiple entities so no single entity hits 1% chargebacks. For example, a crypto exchange may have multiple entities such that if one gets closer to 1%, transactions are routed to a different entity to keep all of them below the chargeback threshold.
   Companies that run illegal/unlicensed services may spin up e-commerce companies for a few months at a time before shutting them down or routing transactions through a different company. For example, an illegal online Chinese gambling company operating in Europe.

6. Cash MCC
   Cannabis is federally illegal but legal across some states. since banks are all federally chartered and regulated, processing cannabis transactions means facilitating federal drug crime. Therefore, lots of dispensaries prefer cash, have an ATM in-store, or have the MCC of an ATM. Visa explicitly banned this in 2021 and Mastercard in 2022, but it is still widely used. Some state banks have been specifically built to be a state-legal but federally-ambiguous acquirer.

7. Transaction Laundering
   To stay under chargeback thresholds, some merchants artificially inflate their total transaction count. Merchants may work with specialized providers to run thousands of $1.00 micro-transactions using “friendly” cards (often prepaid or controlled by the provider).

Coinflow:

PayPal achieves “instant” settlement by owning their own ledger, where a transfer from one account to another doesn’t go through ACH rails. If a user uses ACH to pay another user, PayPal fronts the money and retroactively debits the payer. If the payer doesn’t have a PayPal balance or chargeback the PayPal transaction through their bank, PayPal covers the loss. In essence, they got around the “reputation” issue Visa requires by essentially building a bank that nets across its users to use credit card rails as minimally as possible.

It seems reasonable to believe that Coinflow started off as a payment processor (essentially signing up legit crypto-based merchants with low chargeback rates) and negotiating good rates with an acquiring bank (rather than the high-rate “crypto” MCC). Lots of crypto dApps that needed to process payments used them. It seems now, though, that they have pivoted into becoming more like a PayPal with customers like Whop and Novig. Now, they help with payment processing (on/off ramping essentially) but instead of sending an ACH across users/merchants on marketplaces like Whop, they have an internal stablecoin ledger where they transfer balances. They probably invest the float through some kind of token like an RWA.

Crypto Cards
Crypto cards act on the same traditional rails. Visa has an interesting Stablecoin Settlement program where they will allow for crypto cards, in partnership with Cross River Bank and Lead Bank as the issuing banks, to settle with Visa in USDC over Solana, with a future move to Arc. This just means that instead of a card issuer (for example Rain) to have a pre-funded account at Chase in USD, they can have a pre-funded account on Solana.

The flow (probably) goes like this:

1. User swipes their Ether.fi card

2. Rain captures the card data and sends an authorization request to Visa’s network

3. Visa routes this to the issuing bank (Cross River Bank)

4. Cross River Bank/Rain checks that the transaction is valid and that the user has funds (stablecoins)

5. Rain asks Ether.fi to lock the required stablecoins for the purchase/send it to a wallet owned by Rain

6. Rain sends cryptographic proof that the money has been locked/sent to Rain

7. Visa debits money from Rain’s account (possibly through Credit Coop) at Cross River Bank and credits the merchants’

8. At the end of each day, Rain settles the correct amount of stablecoins to Visa. Visa has an agreement to off-ramp with Circle, who sends them USD to Visa’s Chase account

Visa and Crypto
Since 2021, Visa has had a trial with Crypto.com where they tested the issuance side. By “issuance” I mean that Visa takes in USDC and Visa/Crypto.com had to have a relationship with Circle to off/board. Maybe Circle even has an account at Chase and acts as a visa principal member.

Visa is a network, their job is to nudge merchants/issuers to accept tech that helps Visa. They have no actual say in the network participants themselves.

If both issuers and acquirers accept crypto, Visa possibly benefits from:

1. 24/7 settlement, meaning banks may require lower float requirements. Visa even explicitly says “Organizations on the sidelines risk loss of payment volume to blockchain-natives, inability to serve emerging customer segments, and higher capital needs than competitors leveraging faster, programmable money movement.” That’s a very pointed quote.

2. Float generation via each acquiring/issuing bank having their own stablecoin. Visa has a Visa Tokenized Asset Platform (VTAP) to help companies do just that.

3. New markets. Crypto companies (like frontends for crypto trading, prediction markets, etc) are new customers. Increased customers means more transactions on the Visa network, even if stablecoins mean lower interchange fees. Long-tail markets like micropayments might be possible over Visa rails.

Hope you enjoyed the read! Always happy to chat about inaccuracies of this piece, I am definitely not an expert.

1. Overall, about 5–7% of card transactions in the U.S. face declines annually, while e-commerce sees 10–15% decline rates. Source