High Risk Payment Gateway: What It Does and Who Approves You

Every online card payment passes through three pieces:

1. Your shopping cart or checkout collects the order.
2. The payment gateway encrypts the card details and sends them for approval. It returns "approved" or "declined" in a second or two.
3. The merchant account is your account with an acquiring bank (the bank that accepts card payments on your behalf). Approved sales settle here and are then deposited to your business bank account.

Only the third piece involves underwriting: a person at the bank or its partner reviewing your business, products, website and processing history. That review is where a business gets labeled high risk, and where it gets approved or declined. Our guide to what makes a business high risk explains the card-network categories behind that label.

Merchant account vs. payment gateway, in one line

The merchant account is permission to take cards. The gateway is the pipe the payments travel through. A gateway without an approved merchant account can't process a single sale.

Is Authorize.Net OK for high-risk businesses?

Authorize.Net's gateway agreement and website terms of use don't publish a list of prohibited industries (checked September 2026). Whether you can use it depends on the merchant account it connects to, and on that bank's rules for your industry. That's the opposite of all-in-one apps like Stripe, Square and PayPal, where the platform is also the merchant account and writes its own list of banned products. If an app closed your account, our guide to what to do after Stripe or Square shuts you down covers next steps.

So the real question isn't "which gateway accepts high risk?" It's "which bank will approve a high risk merchant account for what I sell, and which gateway does it support?"

You can get the gateway and the merchant account from the same company, or from two different ones. Both work. The difference is who you call when something breaks.

START sets up both as one package: the merchant account and the Authorize.Net gateway, linked before you go live. We're a Registered MSP/ISO of Elavon, and we've set up more than 60,000 Authorize.Net accounts over 20+ years as an Authorize.Net partner. If you already have a merchant account and only need the gateway, read about pairing Authorize.Net with your own merchant account. For a tour of the gateway's features, see how the Authorize.Net gateway works.

Authorize.Net is pre-integrated with more than 1,000 shopping carts and billing systems, so most stores can connect it without custom code. The big three platforms all support it, but two of them charge extra when you don't use their built-in payments.

Those platform fees are on top of your card processing costs, so build them into your math. Two more things to know:

• The platform's product rules still apply. A merchant account approved for your business doesn't override Shopify's or BigCommerce's own terms for hosting your store. Read them before you build.
• WooCommerce puts you in charge. It runs on your own hosting, so no platform company sets product rules. You're also responsible for updates and security, or for paying someone to handle them.

For a worked example of one industry's setup, see our guide to online gun store payments.

High-risk accounts live or die by their chargeback and fraud numbers. Your gateway is the first place to stop a bad order before it becomes a dispute. Authorize.Net's Advanced Fraud Detection Suite (AFDS) is included with every Authorize.Net plan. It has 13 configurable filters. Useful ones for high-risk sellers include:

• Velocity filters: limit how many transactions come through per hour or per day, or from the same IP address per hour. They catch "card testing," where fraudsters run hundreds of stolen card numbers through a checkout.
• Enhanced AVS and CCV handling: decide what to do when the billing address (AVS, the Address Verification Service) or the 3-digit security code (CVV) doesn't match what the card issuer has on file.
• Amount filter: flag orders above or below the amounts you normally see.
• Shipping-billing and IP-shipping mismatch filters: flag orders shipped far from where the card or the buyer's internet connection is.
• Regional IP address filter: review or block orders from countries you don't ship to.

For each filter you choose an action: decline the transaction, hold it for review without authorizing, authorize and hold it for review, or process it normally and just report that the filter was triggered. Start with "hold for review" so you can see what gets caught before you decline anything automatically.

Our fraud prevention tools guide covers setup in more detail. To see how those numbers are measured by Visa and Mastercard, read chargeback ratio limits and how to stay under them.

PCI DSS is the card industry's security standard. Every business that takes cards has to comply with it. How much work that takes depends on whether card numbers ever touch your website or servers.

• Hosted payment form. Authorize.Net's Accept Hosted form is hosted by Authorize.Net, so the card number goes straight to the gateway. Authorize.Net says this lets merchants keep SAQ A-level compliance, the shortest PCI self-assessment. Its Simple Checkout payment button is another low-effort option for small catalogs.
• Tokenization. The Customer Information Manager (CIM) stores card and bank details at Authorize.Net and gives you a token (a stand-in reference number) to charge later. You never store the card number yourself.

This matters more for high-risk businesses than most. A data breach can end an account, and PCI non-compliance is one of the reasons a bank can list a business on Mastercard's MATCH list (reason code 12, as of the August 2026 rules). See our PCI compliance guide for the steps, and how the MATCH list works for what a listing means.

Subscriptions, memberships and payment plans run on two Authorize.Net tools: Automated Recurring Billing (ARB) charges a customer on a schedule, and CIM stores the payment details securely. Both are included with Authorize.Net accounts set up through START.

The tools are the easy part. The card-network rules are where subscription sellers get into trouble. Visa's rules for merchants that offer free trials or introductory prices that roll into a subscription (in effect since April 18, 2020) require you to:

• Get the customer's express consent to the ongoing subscription at sign-up
• Send a confirmation by email or text with the terms, start date, amount, billing frequency and a way to cancel
• Send a reminder at least 7 days before the first full charge after a trial or promotion ends, or when the price or billing period changes
• Offer a simple way to cancel online

Mastercard has its own subscription rules and requires banks to register merchants that sell physical products on a negative-option basis (billing that continues unless the customer cancels). The simplest rule of thumb for both: make canceling as easy as signing up, and make the price and billing date impossible to miss. Unclear subscriptions are one of the fastest ways to a high chargeback ratio.

Our automated recurring billing guide covers setting up ARB schedules.

Authorize.Net's eCheck service lets customers pay straight from a bank account, online or by phone. For a high-risk business, a second payment method helps in two ways:

• Some customers prefer it, especially for large orders and recurring payments.
• It's a backup. If card processing is ever paused, you still have a way to collect.

ACH payments follow their own rules and returns, and bank-account payments get their own underwriting. Read how eCheck payments through Authorize.Net work.

Many companies selling a "high risk payment gateway" are really offering a merchant account with a bank outside the United States (an offshore acquirer). That can be the right fit for some businesses, especially ones that sell mostly overseas. But know what you're signing up for:

• Currency. Sales may settle in a foreign currency, with conversion costs before the money reaches your U.S. bank.
• Cross-border costs. When the bank is in another country, card networks can charge cross-border fees, and some U.S. customers see foreign transaction fees on their statements. Some card issuers also decline more cross-border payments.
• Reserves and payout timing. Offshore accounts often hold back a share of each sale as a reserve for months. Get the percentage, the hold period and the release schedule in writing. Our guide to high-risk rates, fees and reserves shows what to ask.
• Where disputes are settled. Your contract may be governed by another country's law, which makes it harder to resolve a held-funds problem.

A U.S. business with U.S. customers is usually better served by a domestic merchant account, if one will approve it. Start there, and look offshore only if domestic banks can't approve what you sell. Our guide on how to get approved for a high-risk account covers the documents that improve your odds.

1. Who is the acquiring bank, and is it approving my business knowing exactly what I sell?
2. Does the gateway connect to my shopping cart, and what does my platform charge for an outside gateway?
3. Which fraud tools are included, and who helps me set them up?
4. Is there a hosted payment form so card numbers never touch my site?
5. Does it support recurring billing and stored cards, if I sell subscriptions?
6. Is there a reserve, and when is it released?
7. Who do I call when a payment is declined or a deposit is late?