What a Merchant's Website Tells a Payments Rep

The question a category can't answer

"High risk" is a payments classification, not a kind of business. It's the list of things a mainstream processor restricts or refuses: vape, CBD, nutraceuticals, telehealth, adult, firearms, travel, anything sold on a subscription to someone who never walks into the shop. A rep selling processing to those merchants works a territory the way everyone else does, by searching Google Maps for a category and a city. The trouble is that the categories were written for people looking for a place to go, not for people looking for a type of merchant.

We ran into this on a real search. A customer in payments searched "peptides" across Los Angeles and San Diego and got 189 businesses. Google called 42 of them "medical clinic", 24 "medical spa", 20 "wellness center", 14 "medical supply store", 14 "health and beauty shop" and 9 "biotechnology company". Our relevance check, which reads each site and asks whether it's the business the search was for, confirmed 95 and rejected 51. That's the first filter, and it's still a category: it tells you which rows are peptide businesses, not which of them a high-risk processor would want to call.

What the site says, read as text

So we added a set of detections that read what a merchant's website says, the way our hiring detection reads "we're hiring". We call the category Merchant Signals. They fall into four groups, and every example below is a real sentence from a real page in that search, with the business left out.

How they take money

"Pay by Zelle or Venmo and get $5 off your order." A merchant that discounts bank transfers is one that pays too much for cards, or can't get them at all. "We accept credit cards, debit cards, HSA and FSA payments." A clinic that says so takes cards and bills no insurance, which is a processing relationship worth a conversation. Beside those we read cash-only notices, card minimums, cash-discount and dual-pricing programmes, card surcharges and crypto acceptance.

What they sell that a mainstream processor restricts

This is the group that splits a Google category open. One med spa's menu lists "Medical Weight Loss and GLP-1s", a clinic's page offers "Hormone Replacement Therapy for Men", and the service pages around them read "Vitamin IV Drips", "Peptide Therapy" and "Botox and Dysport". At the other end of the market a shop writes "Los Angeles Peptides operates as a research chemical supplier" in its footer, under a gate that says "You must be 18 years or older to access this website." The same reading covers vape products, kratom, nicotine pouches, delta-8, hookah and firearms dealers.

The policies that generate chargebacks

Chargebacks come from a few sales shapes, and merchants describe them on their own sites. "20% off your Monthly Membership rate." "Services expire after this period with no refund, credit, or extension available." "Multi-month programs are prepaid and non-refundable after the first visit." We read recurring billing, free trials and cancel-anytime offers, no-refund policies, deposits, pre-orders, international shipping, and the word "chargeback" itself, which only appears in the terms of a merchant that has had them.

Business status that times a switch

A "Grand Opening" page, "under new ownership", "visit our locations". A new merchant is making its first processing decision; a new owner re-papers everything; a chain is a bigger account. None of these is a category either.

Around the text signals sit the vendors: the processor or gateway the site runs, from Square, Stripe, Shopify Payments and PayPal to Elavon Converge, Worldpay, Heartland, NMI and USAePay; the booking platform that bundles its own card processing, such as Vagaro, Boulevard, Zenoti or Mindbody; consumer financing like CareCredit, Cherry, Acima and Snap; and fraud tools like Signifyd, Riskified, Kount and Forter. A med spa with Cherry's widget on its booking page sells four-figure treatments on a payment plan.

The peptide search, re-read

We re-read every readable site in that search with the new detections. 136 of the 189 loaded. 27 had no website at all, and 23 either failed to load or now serve a bot challenge. Of the 136, 111 said at least one of the things above.

These figures are from the last read on 12 October. Pages change and sometimes load differently, so a later read of the same sites moves a row by one or two, and the monthly re-check keeps the column current.

Read the top five rows against Google's "42 medical clinics" and the point of the exercise is visible. The category said clinic. The sites say GLP-1, testosterone, IV drips and peptides, which are the merchants a high-risk processor is looking for and the ones a mainstream one drops after a review. The four age-gated shops are the direct-to-consumer sellers. The six research-chemical suppliers are the grey market, and they say so in their own disclaimers.

What didn't fire is worth a sentence too. None of the eleven gateways and none of the fraud tools appeared on any of the 136 sites. Those are clinics and shops, not online stores, and a detector that says nothing when there's nothing is doing its job.

What we got wrong first, and how we check

A word appearing on a page isn't the same as the business meaning it, so before any of this reached a customer we fetched every readable site in the search and read the sentence behind each match, all of them, about 320. Most matched a service menu, a treatment page, a membership offer, a refund clause or a financing widget, which is what they claim to match. Four patterns didn't.

Our recurring-billing detection fired on two shops whose sites say "No subscriptions, no recurring charges, and no hidden fees at checkout." The pattern matched the phrase and missed the "no". Our cash-only detection fired on a wellness center whose site builder ships a hidden dictionary of every amenity label it knows, "Cash only" included, whether or not the business is. Our IV-therapy detection counted clinics that offer vitamin or NAD injections, which is a needle, not a drip. And our nutraceuticals detection counted a modafinil prescription, an IV cocktail called Fat Burner, and the FDA disclaimer "not for use as a dietary supplement". So the statement detections now read only the text a visitor can see, never scripts or hidden strings, check the clause in front of a match for a negation, and the two loose patterns are tightened. The traps live in the test suite so they can't come back, and the audit that found them is a tool we can run on any account.

A third mistake was older. Some Google Maps listings put a WhatsApp number where the website should be. In this search, 13 of the 27 listings with no real website had exactly that, several of them the same seller under different numbers. We used to fetch the link, read WhatsApp's own landing page, and report WhatsApp's payment vendors as the merchant's. A chat link now counts as no website, and the row says so.

The rest of the sample matched service menus, treatment pages, membership offers, refund terms and financing widgets, which is what we claim they match.

How to use it

Search the categories you sell into, in the city you work. Every business comes back with the Merchant Signals beside the processor and booking platform it runs, and you filter on any of them: clinics with GLP-1 and recurring billing, shops with an age gate and online checkout, med spas on Cherry with 100 or more reviews. Nine one-click views do the common combinations, such as a restricted product sold through Square or Stripe, and the guide to high-risk merchant leads walks through each one, and the merchant services leads guide covers the territory workflow around them. If you'd rather have a file than a login, we build territory lists to agreed criteria and quote them per lead.