Risk Control S.H.I.E.L.D. | Fraudulent transactions are just the tip of the iceberg — these risks are quietly eating away at your profits

In our last episode, we talked about how risk control is the most underestimated ‘shield’ in the acquiring system. It doesn’t generate revenue directly, but it determines whether the revenue you generate can actually be kept in the end.

In this episode, let’s push the discussion one step further: what exactly is acquirer risk control trying to prevent? Many people’s first reaction is — preventing “fraudulent transactions.” That’s right. Fraud risk is indeed a top priority in risk control, but it’s far from the whole story.

In practice of cross-border card acquiring, risk control doesn’t face a single type of risk, but rather an interconnected set of risks that gradually reveal themselves across different stages. These mainly fall into five categories.

Fraud Risk: The most typical risk
This is the easiest type of risk for people to understand. Fraudulent transactions, credential stuffing, card testing, cashing out via virtual goods — fraudsters use various tactics to buy your products with someone else’s money.

Transactions of this kind typically carry abnormal signals at the very moment of the transaction. Once approved, they are likely to result in chargebacks due to fraud. By the time the goods are shipped and the funds are settled, when the legitimate cardholder initiates a dispute, the loss is already irreversible.

Therefore, anti-fraud is undoubtedly a critical component of acquirer risk control. But it’s not the whole picture.

Chargeback Risk: The risk that erupts after payment
For acquirers, what truly and consistently impacts the business is often not fraud alone, but rather the chargeback risk arising from fraud, disputes, fulfillment irregularities, and other factors combined.

For example: the cardholder claims they never received the goods, the product doesn’t match the description, automatic renewal wasn’t properly disclosed, refunds weren’t processed in a timely manner…

Here’s a key difference in understanding: not all chargebacks come from “fraudulent transactions.”

Very often, a transaction is legitimate at the time it’s initiated, and the cardholder did place the order. But due to issues with the merchant’s fulfillment, service, refunds, shipping timelines, or other factors, the transaction may still end up as a chargeback loss.

So if risk control only looks at “the moment of payment” but not at subsequent fulfillment and transaction management, a significant amount of real risk will be missed.

Merchant Risk: Merchants can be problematic too
When people mention risk control, their first instinct is always to look at the payer. But in acquiring practice, the merchant itself is also a significant source of risk.

The actual products the merchant sells don’t match what was declared, the website terms are misleading, transaction volume spikes abnormally in a short period, poor fulfillment capability leads to consistently high complaint and chargeback rates — these are all merchant risks.

Risk control isn’t just about judging whether a cardholder is suspicious — it’s also about assessing: can we onboard this merchant? Does our current settlement strategy fit them? Have they entered a stage of deteriorating risk? Is the revenue generated actually healthy revenue? And so on.

Compliance Risk: Impacts the entire business eligibility
In cross-border acquiring, the severity of compliance risk often exceeds the loss from a single transaction.

Issues related to anti-money laundering, sanctioned countries or sensitive regions, high-risk industry access, abnormal fund flows, etc., may not simply result in “a bad transaction” — they could lead to channel restrictions, bank investigations, increased reserve requirements, settlement freezes, or even affect the platform’s ability to continue operating.

The underlying value of risk control, beyond loss prevention, also serves as the foundation for compliant operations.

Operational Risk: Can turn into financial and growth problems
There’s another category of risk that isn’t always explicitly called “risk control,” but is fundamentally a core part of it.

Approval rates look decent, but chargeback rates keep climbing; transaction volume continues to grow, but bad debt and dispute costs rise in tandem; high-risk merchants contribute significant GMV, yet also eat away most of the profits; relaxing underwriting standards to chase scale ultimately leads to deterioration across the entire business metrics…

Risk control isn’t about reducing transactions — it’s about making business growth more sustainable.