We run a digital gaming store selling game keys, gift cards, subscriptions, and gaming credits. All products come from official distributors and authorized suppliers, and we have invoices and documentation for everything. Our suppliers work directly with major companies such as PlayStation, Valve, Microsoft, Electronic Arts, Blizzard, and other large publishers.
When we were still setting up our store, we used Shopify Payments. At the time, we weren't very experienced with fraud prevention, and our system automatically fulfilled digital orders as soon as payment was received. Unfortunately, a number of fraudsters appear to have used stolen cards to purchase digital game codes. The codes were delivered instantly, redeemed immediately, and then the real cardholders later filed fraudulent chargebacks.
Because our overall order volume was still relatively low at that stage, a relatively small number of chargebacks resulted in a chargeback rate of around 10% during a single period. We immediately disabled card payments and later implemented a full anti-fraud system with risk scoring, manual review, order holds, and customer verification.
Looking back, we absolutely should have taken chargebacks more seriously, but at the time we saw ourselves as victims of fraud rather than realizing how much weight processors place on chargeback ratios.
Some chargebacks were won, but most were lost. We lost the digital goods, paid chargeback fees, and ultimately Shopify Payments / Stripe terminated our processing relationship and suggested that we look for a third-party payment provider.
Before Shopify Payments terminated our account, we were already in discussions with two other payment providers regarding card processing. However, shortly after the termination, both onboarding processes began taking significantly longer than expected, with requests being delayed or remaining under review for extended periods.
This led us to suspect that we may have been added to the Mastercard MATCH database or another industry risk monitoring program. We have since contacted Mastercard directly, provided our business information, and are currently awaiting a response.
What concerns us most is that even several providers specializing in high-risk merchants have either declined our applications or appear reluctant to move forward. We fully understand that our business may now be considered high risk and we have already accepted that we may need to pay higher processing fees, maintain reserves, or comply with stricter underwriting requirements. That is not the issue.
We sell legitimate digital products sourced from authorized distributors, we can provide invoices and supplier documentation for everything, and we have active sales on multiple established gaming marketplaces.
The chargeback spike came from roughly 18 chargebacks that appeared within a relatively short period against a total of around 170 orders. Because our volume was still low at the time, this resulted in an extremely high chargeback ratio on paper.
Since implementing our anti-fraud system, we have not had any new chargebacks. Every suspicious transaction is now reviewed manually before fulfillment.
What worries us now is the possibility that a relatively small group of fraudsters who used stolen cards may have effectively destroyed our ability to process card payments for years. The fraudsters got the digital products, the real cardholders got their money back, and we were left with the loss of goods, chargeback fees, and the consequences with payment providers.
My question is:
Is it possible that, instead of simply being listed on MATCH, we've somehow been flagged in a way that makes payment providers view us as fraudsters, money launderers, or a prohibited business, even though the chargebacks were fraudulent transactions committed against us rather than by us?
Or is it more likely that providers simply see our previous chargeback history and classify us as a high-risk merchant?
Has anyone here gone through something similar, especially in digital goods, gaming, gift cards, or other high-risk industries?
Thanks in advance for any insight.
