"Why Did I Get Banned From Stripe?" | Stripe Match list | Biz To Biz Podcast

Yo, what's up everybody? It's Justin live from B2B Vault, the biz to biz podcast sponsored by Nationwide Payment Systems, hosted by this guy, the Mike Piazza of payment processing himself, Allen Kopelman. And we'll be providing you educational information about fintech, small business payment processing, and the technology businesses are using in the world today. And in today's podcast, we'll be answering the, uh, age-old question: why am I on the atch lists, or why are they hating on my business? Uh, anyway, um, how are you doing today, sir?

I'm doing good. That was a tongue twister.

The Mike Piazza payment processing had me twisted.

Yes, yes, that was definitely— and Rocky had a vet visit, vet visit, vet appointment for his annual checkup. He passed flying colors. Everything was good. No heartworm, no parasites. That's good, that's good stuff. Everything is good. How are you doing?

I mean, he's still a grumpy sheesh. He's old. Yeah, he is.

He's old and he only likes to nap now.

Should nap at home anyway.

This is home for him.

I know, I know, I know. But anyway, yeah, I mean, I'm getting— I'm still healing from my, uh, sickness.

You sound better.

I, I, I do, but I have very short breath.

Yeah, and that makes you kind of grumpy.

I can't sleep. I know, that's what I haven't slept all week.

You ever try those Breathe Right strips on your nose?

Like, I can breathe through my nose.

Yeah, but sometimes that helps, like, with the— when you have a cough. Yeah, when you have a cough, it helps you breathe better. This Breathe Right strips.

I might, I could try that next time, but I don't know. I'm going to the gym tonight again and sweat it out. Hopefully it'll be done. I'm very exhausted. I know that my back hurts from coughing in the morning time, but that's how I was when I was sick.

I would wake up in the morning and I would sometimes I would cough so hard, then all of a sudden I would just be exhausted from it.

Yeah, I went back to sleep this morning. It's, uh, I was telling Samantha that, uh, I got out the shower, man. I had a, like, a coughing attack inside of the shower, and I got out and I just had to go back to sleep. I couldn't—

yeah, it takes— knocks the wind out of you.

Yeah. Anyway, um, everything else is going well, I guess, man. You know?

Yeah, we've been pretty busy, which is good. I need a freaking haircut. Yeah, I need a haircut too. My beard is getting very, very snowy-ish.

Yeah, it's that time of season. Maybe I should grow it for—

you can be Santa. Okay, Santa. Yeah, we're coming up. This is the, you know, we're in, uh, end of October, November, December. You know, it's always good in business to take this time of the year and start thinking about what you're going to do for 2024.

Agreed.

And start to develop a plan.

Yeah, especially if you're on the match list.

Yeah, well, match list is—

What is the match list?

So the match list is, so Visa has one list and then MasterCard has another list and then Amex uses the MasterCard. MasterCard's list is called the match list, and Visa has their own list, which is the same thing, called TMF, Terminated Merchant File. So, you know, this week I did get a call from a guy and he said, hey, you know, I'm trying to get a merchant account. I applied at like 10 places.

That's fine, but you didn't answer my question.

How do you get on there?

No, what is it?

So what it is, is you got terminated by the bank for violation of the merchant agreement. So the violation of the merchant agreement could be you violated an anti-money laundering situation, or they said that you did something that maybe you didn't do, or you did something that somebody told you you could do, and then you found out you can't do that. Too many chargebacks, too many chargebacks will land you on there, especially if they think there's fraud. You don't ship out. Let's say you're shipping and you're not shipping stuff out and you're getting a ton of chargebacks. You're going to end up on the match list. You owe fees to the bank. You're going to end up on the match list. So they go to debit your fees and they can't get the money from you. You're going to be on the match list.

Okay.

You, you know, that's, that's pretty much the most basic. Or you selling stuff you're not supposed to sell. Like you get set up and you say, oh, I'm selling cigars on my website. And instead of cigars, you're selling hemp. You got like, you know, you got some pages down the, you know, a few pages in and all of a sudden there's a bunch of hemp products and you're not approved for that. You know, listen, people do stupid stuff all the time. Like, you know, we had a guy—

I think that a lot of times people, they don't know that it's them making a mistake. I mean, sometimes I'm sure people are trying to get over, right?

Right.

Sometimes it's willful and some people are just genuinely like uneducated on what they can and can't do with their merchant account. I would assume that would be more of the case than—

Yeah, a lot of it is. Some of it is willful, like people get set up for a product where they send me a website with like electronics on it and everything's priced evenly. You know, they're selling either cannabis or there's some kind of gambling situation going on.

You're assuming that.

We've caught people doing that.

Right.

So we know that that's what they're doing. Or somebody doesn't know and, Listen, we had a guy who was selling cigars and then he put a, he had a picture of Snoop Dogg with a humidor and it said, "Keep your weed fresh." Okay. In the humidor. Well, the bank called me up and they go, "You need to talk to your cigar guy. Look at this link we sent you. That's gotta be off the website by the end of business today." So we had the guy take it off the website. You can't use, you know, you can't use the words marijuana, cannabis, weed, weed can't be on your website. That's, that's a big no-no. And, you know, you could say keep your stupid tobacco, you can say keep your tobacco products fresh in here.

And what about flower?

You could say the word flower. You could say hemp flower, but you can't say the word cannabis or weed or weed. Keep your weed fresh. Can't do that.

Keep your medicine.

No, no. But I'm just saying, you know, so the guy took it off and he had a couple of blog posts also that needed to be removed.

You know, it's killing me, ladies and gentlemen. I'm sorry.

But if you're working with a good provider, you know, they're going to come to you and go, hey, you made this change. You know, you're not supposed to do that. Another big no-no of selling is there's, you know, it's very hard for merchants to get set up, especially if you're selling like name brand products. So we have guys that sell watches and wallets and stuff, and a lot of it's, you know, from high-end retail, high-end brands. And you have to, you know, you have to have a licensing agreement to be a reseller. All right.

So now You know, we know what a match— do we know what the match list is? The match list and, uh, TMF. TMF, that's when you get booted off. You done— you broke the rules, you're non-compliant, there's suspensions and fines headed for yourself. Uh, um, what, what should the business owner do? Um, and well, anyway, say, okay, J Class— Jay's running his CBD shop online, doing great. I accidentally upload some products, not, you know, realizing that it's THC Delta-8 instead of just, you know, Delta-9 or whatever, right?

Right.

And I'm selling, I'm making a killing, boom, they kill me, they kill the account, I'm done. What can I do immediately to get that site up and running again.

You're done. So basically I tell people like, if you're going to make changes to your business model, you're going to add products that weren't there before, you want to make sure you get that approved by the bank.

Pre-approved?

Yeah, you want to get it pre-approved. Like, all right, so there's ways to avoid not getting shut off.

You answered my question. All right, so now I'm done. I'm officially a Rapsky. I can't do, I'm up poop creek without a paddle. And what can I do to, do I start a new business? What do I do?

Yeah, you're gonna have to have a new corp, a new website. Everything's on the match list. They'll put your website, your URL, your name, your home address, your tax ID. Everything is flagged, you're flagged, everything's flagged.

So you have to find a new person to put the business in?

Pretty much. People have, I've had people do that before. Get a new sign.

So you're saying that if I get on the match list, I can no longer get another merchant account under my name ever?

For about 6, 7 years, and some companies will never take you.

Wow. That is mind-blowing.

Now there are companies, so we had a situation where this guy called me up the other day. He goes, I made a mistake several years ago. I had a Shopify store, and the guys I was working with, said, oh, we want to— can we use your merchant account on another website? He should have never done that, right? He was stupid and young, and they got a bunch of chargebacks. He shut their website down because, you know, he killed the merchant account. He owed the bank about $7,000, $8,000. He had the money, so he paid it off, you know, paid off the chargebacks. But they put them on the match list because it's a violation. You know, you can't— let's say someone comes to us. We have a— we have a couple of clients that have 5, 6, 7 websites. Right. But each URL is approved by the bank.

Right. That makes sense to me.

So if it's not approved by the bank and then you get caught, you're going to end up on the match list. Now, are there companies that will give you a second chance? Yes. If the story sounds credible, this guy's story was credible. Right. He has another business now. So now we got him set up with an eCheck product so he can use the eCheck product for now, for about the next 90 days. If everything works out, they'll give him some credit card processing and then he can, you know, he'll have credit card processing again. But like I said, you're going to pay higher rates. You're going to go through a PayFac type of a deal. Where it's a submerchant account under somebody under the credit card processor. They're going to watch you like a hawk. Everything's going to be on RDR. You know, I tell people all the time, what's RDR? RDR, where somebody says they're going to do a chargeback and it does an automatic refund.

Okay.

Okay. So you want to, you know, you got to take steps not to get chargebacks. You want to, you want to make sure if you're not sure of the rules, like we have another client guy that came to me, we tried to get them processing. It became the guy with the merchant. The business owner was, was not— he was not very— he was forthcoming on the whole thing. What happened? So what happened was he got approved for a website. And then the sales rep told them he could put the— use the merchant account on any other websites that he had, which was not true. And the guy had like 5 websites, and one of the websites was selling— I don't know what happened, but got a bunch of chargebacks. And then the bank saw the chargebacks come through and they're like, we didn't approve this URL. So they shut the guy down. It's anti-money laundering. You know, that's considered money laundering. They don't know. Does the guy own the URLs that connected to the merchant? Right. Wasn't at the same address. It was a whole bunch of stuff. So he ends up on the match list and then we kind of told them, we were like, listen, you know, you're going to have to be— you have to be a lot more— you got to be humble when you want to get back into the game because especially if you're a business doing $1 million a month. They were doing over $1 million a month and they got the plug pulled on them out first by the credit— by a mainstream credit card processor, and then they went to Square and then Square found them on the match list and then Square pulled the plug on them and held the million dollars. Ooh, you know, and then you got to get lawyers and try to get your money back. And I don't think they've gotten their money back.

No.

And then, you know, and then it's hard to start over because, you know, but I've had people like we had after the pandemic, I had a couple of hotels come to me and they owed money to the credit card processor. One guy said, I don't owe them a dime. They got all their money. So I said, well, give me the bank statements. So the guy got the bank statements. The hotel was closed for like a year. I got the bank statements. We called up the credit card processor. They wouldn't talk to us on the phone. So then I said, you're going to have to call my friend, an attorney that can get a hold of their attorney. Paid him a few thousand. He didn't want to pay the attorney. Meanwhile, he spent about 10 grand with an attorney that's not involved in the payments business and got nowhere because they just sent him to the collection company. He hired the attorney I told them about for a couple of thousand bucks. The guy made one phone call, got the counsel on the phone for the credit card processor, sent them over the bank statements, showed that they got all their money. And they took the guy off the match list and the guy was able to get a merchant account. Nice. But you have to, you've got to make sure you're doing what you're supposed to do. And I've had other people where the person got on the match list and the whole, and you need to make sure if you're in a business that's kind of higher risk that you're working with partners that understand, like, oh, if, if my website— or somebody, like, we had a guy recently, they had their site roboted, right?

Yeah.

And now ever since then, all the gateways made changes. I made a little video about it. I think there's a blog post. You know, you need to go into your velocity settings and change one of the velocity settings. So if you get someone who does robot your site, it won't authorize the credit cards at all, you won't get hit.

I set them really low, like as a web developer. Yeah, like when you said— I forget what you said—

set it at like 50 or something for the day from one credit card though. No, 50 transact for how many you want to allow for a day. 100, it depends how busy your website is.

Yeah, no, I guess I'm thinking of something because you can—

there's—

well, then the back end of WooCommerce, I can like set it up so like if there's a credit card or a, or an IP address coming back, you know, I can monitor that and it won't let the purchases, right? But a lot of people, the velocity thing, I, I didn't— I thought it was per IP address, not per transaction.

But those people are, those people are tricky. They'll have that, they'll run a robot, it'll be changing the IP address every—

for sure. But okay, yeah, that makes sense.

And they'll kind of get past your shopping cart and then get into the— onto the payment page and start banging off credit cards. So what you do is you set it to where after 50 or 100, all of a sudden it's going to go into a queue, but it's not going to authorize. It's not going to send anything to the credit card processor and all that. They'll probably get really bored with you because they're not going to be getting back any responses like approved, declined, approved.

Right, right.

So they'll probably just go away from your website. But, you know, there was a big instance where a couple of months ago there was a lot of robotting going on. So you got to protect your website, you know, and then like that happens and then you get— you can't just say, oh, I'm an idiot. I woke up, you know, we had a client also where they, they called, you know, on Monday. I see I get a message and I get a phone call from them like, oh, over the weekend someone ran like 50,000 transactions on our website. I was like, you didn't think to like call us, you know, contact customer service? It's open 24 hours a day. We could have just shut the whole thing down. And it was kind of— we got really messy. Some of the transactions actually went through. Money ended up in their bank account. It was, it was very messy. But we got it all cleaned up and, you know, and did some additional protection.

How did he— I did, you know, I've been building websites for over a decade, bro, and knock on wood, I'm not even going to speak it into existence, but how does somebody do that? No, how do you get hacked?

And because what they do is they get on, they figure out—

no, because these people aren't managing their websites.

Well, no, they saw the transaction, they saw getting a million emails, but they didn't do anything about it.

Oh, we talked about this guy, right?

They didn't do anything about it.

But I'm just saying, in general, like, you hear these stories about people and it just blows my mind.

Yeah, like, they have no monitoring set up on their checkout pages. There's like a lot of stuff very like lacking. One of them was a big company, and I said, you guys have like no security on there? But the other thing is, is these hackers, they, they figured out a hole on somebody's—

well, they find the— they— there's a— there's simple ways of finding websites that are still running on outdated technology. That is very easily defensible.

Right, but what they did was is they actually found a hole in some, in a couple of the gateways, and they got to the payment page, and then they were able to bypass the shopping cart and just start banging out credit cards. Nice. So that, I'm just saying, stay safe. But then all the companies went back and they all started putting in velocity filters and blah, blah, blah. I don't want to name them off, but all the major gateways definitely put in velocity filters. AuthNet just added that new one where it says, oh, you can let the transaction go through, but it doesn't author— does not authorize. That's the best thing because that way you're not paying for gateway fees or authorization fees.

Got it.

Because that can run, you know, we had a guy, the bill was $80 grand.

All right, man. So now we're stuck. You're, you're, you're, you've decided you can't do anything. You're on a match list. You got to restart your company. Man, that is terrible. I didn't—

I mean, you used to be able to— the big workaround was before Visa started sharing the information internationally, you could go offshore, get an offshore merchant account set up and do an offshore. There was this—

can you set up offshore first now?

No, you can't do anything now. They changed all these rules with what's called meaningful presence. So meaningful presence means that you have to have a meaningful presence. Means you have to have it. Yeah, you got to have a place to live and all that. An actual office, not just the address to a PO box, right? You can't— you can't just say, oh, it's Wyoming PO box or Delaware PO box. That's not going to—

they're still letting you do that now.

You can do it for a business, but you have to show them like a driver's license or home address or something. Like, I have a lot of companies They get all their mail sent to these, um, to these companies like in Vegas, Wyoming, Alabama, Delaware, and they're big companies. And all their mail, physical mail, gets received in there. And then those companies have people that open all the mail, scan it, and put it into a portal for you. Wow. It's crazy. I was like, are you serious? Yeah, and that's like a whole business.

That's pretty cool though. It's a pretty cool business.

Yeah. And it used to be when I first started it, what do call it. It's just like a corporate address. Corporate management. Yeah, it's like— yeah, it's like mail. They just like— it's like you rent like a UPS mailbox except it's on steroids.

Cool, man.

Like a mailbox.

I'm gonna have to do some— that type of stuff like makes my gears turn in my head. Like, that's— those are— this sounds like a really simple business model.

And even like companies like, you know, like Regus has those virtual offices. They do stuff like that too, where you can get your mail there and then they'll actually open it all up and scan it and upload it to you.

That's cool.

So, you know, there's quite— there's a few companies that do stuff like that, but the Matchless—

man, my shoulder hurts. I'm so sorry. Okay, I, I, I can't even explain. It's like someone is sticking me in my shoulder with a hot needle.

Wow.

And I don't know what is going on. So what did you say?

I said you want to avoid getting on the match list. You want to— if you're in a business and you're worried about chargebacks, you're worried about keeping your merchant account open. We just had to move a bunch of accounts off one processor because I don't know why, but they really cracked down on their underwriting.

On which type of business?

Travel. They started booting people off.

Yeah, that's because of all the, the travel restrictions, the plane, the planes. That's why we were talk— we, you and I kind of were talking about this a while. I didn't realize how much of a high risk, you know, like those types of businesses are. But then, you know, it's— you're a third party buying a plane ticket for me on my website, but it's being, you know, whatever. And then you never catch the plane and you're trying to not my fault, right?

The, yeah, third-party plane tickets, that's really hard to get approved right now.

I wouldn't do that.

No process.

Why would you? I don't believe anybody's still buying that type of stuff. Well, I get it because you're booking us like a vacation.

They do, but some of the sites are— some of the businesses are legitimate because they actually buy the ticket for you, but they're registering you with the airline. So if something does go wrong The airline is going to help.

So they just like handle the actual booking of the ticket, not when they're booking the ticket for them and then adding you to a name, like a list of names for their— Yeah, right. They're not buying it like third-party tickets because they buy like 10 seats at a time. Right.

But some people do that. They'll buy 10 seats like to New York and then they sell them. But then you just have a number. The ticket's not in your name. It's in the name of the travel agency. So let's say the flight doesn't go. You go to the desk and you go, oh, I couldn't get on my flight. They're like, call the travel agent.

They just see, yeah, exactly.

They gotta deal with it. Even though your name's on there, was purchased by them. But legitimate places have figured out how to like get around that, have the person's name on the ticket. And so it's legit.

You would think that like these airlines would try to partner with more types of businesses like that.

They don't want people to do that. How those businesses happen is they buy miles from people who have tons of miles. And then they convert them into plane tickets and it's very complicated. But the ones that are legit, you know, actually get your name on the ticket and not their name. And then that way you don't have a problem because even though your name is there, it's the purchaser name. Like I could go, let's say me, you and Sean are going to Vegas and I buy all 3 tickets. Me and Sean get to the airport, we're on the plane to Vegas. Justin got in traffic, misses his flight, then they go. Well, you didn't buy the ticket. It's under— just— it's under Allen Kopelman. Allen's on the airplane. How's Justin going to get to Las Vegas?

I buy myself a ticket, right?

So I'm just saying, that's what ends up happening with those tickets. You got to make sure, even if you're buying a ticket for more than yourself, that their name is on the ticket. So if they miss the plane, they can still fix it. The airline can fix it.

So you know what a matchless is? You know what not to do to get on the match list or the TMF or the TMF list. And you should know if that does happen, then you got to start from scratch.

But you can call us and we'll help you get—

Allen has been able to still get you an account. A couple of people—

there are people that will give you an account if the story sounds credible. Right.

So that's it, man, for the podcast today. Everybody have a wonderful weekend. We appreciate all the listeners out there. Thanks for listening and tuning in faithfully every week. Smash that subscribe button, hit the like, comment, share, send this to your folks, family members, constituents, coworkers, you know, educate the babies. I don't know what else.

Peace out. Carpe diem.

Go Diamondbacks.

Go Diamondbacks. All right.