Clean MID, Dirty Traffic: How Acquirers Detect Transaction Laundering Before the Schemes Do
The short answer
Transaction laundering happens when a merchant processes card payments for another, undisclosed business, usually one that could never get a merchant account of its own. The approved merchant looks legitimate. The money comes from somewhere else. Acquirers detect it by comparing what a merchant claims to be with its real digital footprint, its transaction behavior and the results of controlled test purchases.
What the schemes call it
Both schemes treat transaction laundering as a termination-level offence.
- Visa's terminated merchant file (VMSS) uses reason code 23, Transaction Laundering: the merchant misrepresented the source of transactions or submitted transactions on behalf of another merchant.
- Mastercard's MATCH list uses reason code 03, Laundering: transaction records that were not valid sales between the merchant and a real cardholder.
- A MATCH listing stays for five years, and Mastercard's BRAM program names transaction laundering as one of its core violation types.
For the acquirer, a confirmed case means scheme assessments, a remediation program and, increasingly, a conversation with the regulator.
Anatomy of a laundering scheme
The setups vary, but most follow one of five patterns.
| Pattern | What the acquirer sees | What is really happening |
|---|---|---|
| Front storefront | A modest e-shop selling furniture, flowers or clothing | The site exists to hold a MID; real payments come from gambling, pharma or other prohibited sites |
| Checkout redirect | A legitimate merchant URL | The prohibited site's checkout routes payments through the clean merchant's gateway |
| Sub-merchant abuse | A payment facilitator with hundreds of small sellers | One or more sub-merchants act as payment entry points for undisclosed businesses |
| Shared infrastructure networks | Unrelated merchants with different names and owners | The same operator runs dozens of sites on shared hosting, analytics IDs and payment scripts |
| MCC masking | A low-risk MCC and normal-looking tickets | High-risk activity coded as retail or services to avoid registration and scrutiny |
An illustrative case: the furniture shop that sold no furniture
The case below is a composite built from patterns we see across portfolios. Names and details are illustrative.
- The signal. A home furniture e-shop processes steadily growing volume. Its website traffic is flat and small. Average ticket sizes cluster around round amounts that do not match the product catalogue, and most transactions happen late at night.
- The footprint. Infrastructure analysis links the shop's server, DNS records and tracking scripts to a cluster of online betting sites operating without a local license.
- The proof. A controlled test purchase on one of the betting sites completes. The card statement shows the furniture shop's descriptor, and the transaction traces to its MID.
- The evidence. Screenshots, the redirect chain, the test transaction record and the infrastructure links are captured with trusted timestamps and stored in tamper-proof form.
- The decision. The acquirer terminates the merchant, reports it correctly, and adds the infrastructure fingerprints to its onboarding rules so the same network cannot return under a new name.
No single control found this merchant. The combination did.
Why traditional controls miss it
- Onboarding sees only the declared URL. The front site is built to pass review.
- Transaction monitoring sees amounts, not destinations. Without web context, a spike looks like growth.
- Manual investigation does not scale. Mapping hosting, DNS and payment scripts across thousands of merchants by hand is not realistic.
- Laundering networks adapt. When one front is closed, traffic moves to the next within days.
A five-layer detection framework
1. Map the full digital footprint
Correlate IP addresses, DNS records, site metadata and online presence traces to find every site connected to a merchant, not just the one on the application.
2. Check transactions against web reality
Compare processing volume, ticket size, timing and geography with the merchant's traffic, pricing and catalogue. A shop with 2,000 monthly visitors and 20,000 monthly transactions needs an explanation. So does an MCC that does not match the volume profile.
3. Prove it with test transactions
A controlled test purchase on a suspected site is the strongest evidence available. When the descriptor or routing traces back to your MID, the case is no longer a suspicion.
4. Watch the channels around the website
Unlisted social profiles, messaging links and marketplace stores often carry the real business. Social screening linked to the merchant record closes that gap.
5. Make the evidence defensible
Capture screenshots, redirect chains, test transaction records and metadata with trusted timestamps (RFC 3161) and store them in write-once, tamper-proof form. Strong evidence speeds up termination, scheme reporting and any regulatory review.
The regional picture
In Türkiye and the Gulf, transaction laundering is closely tied to illegal online betting.
- Türkiye. The Central Bank revoked the licenses of several payment and e-money institutions in 2025 and 2026 over flows linked to illegal betting, and the Finance Ministry reported that MASAK blocked billions of lira of illegal betting proceeds in 2025.
- United Arab Emirates. Unlicensed commercial gambling is illegal, and the new AML law, Federal Decree-Law No. 10 of 2025, introduced an offence for allowing a third party to use an account for unlawful activity, with fines for legal entities of up to AED 100 million.
For acquirers and PSPs in these markets, a laundering case is now both a scheme event and a regulatory one.
How Onlayer sets this up with you
The tools
- Transaction Laundering Detection, powered by Onlayer's proprietary C.A.R.V.E.™ AI, correlates IPs, DNS records, metadata and online presence traces, with 4x higher detection accuracy than manual checks or legacy tools.
- Customized Test Transaction and Undisclosed Merchant Detection trace test purchases back to the MID and capture proof.
- Transaction Monitoring Service cross-checks live transaction behavior against website activity, pricing and traffic, and flags MCC-to-volume discrepancies.
- Social Media Screening finds unlisted and alias profiles linked to merchants.
- Merchant Monitoring Service, a Mastercard-certified MMSP, keeps the whole portfolio under continuous watch.
The setup, with our advisory team
- Portfolio sweep. We run footprint mapping across your e-commerce and pay-by-link merchants and rank them by laundering risk.
- Rule tuning. We calibrate traffic-to-volume and MCC-to-volume thresholds to your portfolio so analysts see fewer, better alerts.
- Test transaction program. We design a risk-based test purchase plan for the highest-risk clusters.
- Investigation playbook. We hand over a case workflow, evidence standards and reporting templates aligned with MATCH, VMSS and your local regulator.
Clients using this approach reduce laundering-related BRAM and VIRP violations by up to 70%.
Key takeaways
- Transaction laundering hides behind merchants that pass onboarding.
- Detection needs three views together: digital footprint, transaction behavior and test purchases.
- Defensible, timestamped evidence turns suspicion into action.
- In Türkiye and the GCC, laundering is closely tied to illegal betting and carries license-level risk.
Frequently asked questions
What is transaction laundering?
An approved merchant processing card payments for an undisclosed business, usually one that could not obtain a merchant account itself.
What are the warning signs of transaction laundering?
Volume that outgrows website traffic, ticket sizes that do not match the catalogue, unusual time or geography patterns, redirects at checkout and infrastructure shared with high-risk sites.
Can test transactions prove laundering?
Yes. A test purchase on a suspected site that traces to your MID, through the descriptor or routing, is among the strongest forms of evidence.
What happens when laundering is confirmed?
The acquirer typically terminates the merchant and reports it to MATCH (code 03) or VMSS (code 23). A MATCH listing lasts five years.
Why is transaction laundering linked to illegal betting?
Unlicensed betting operators cannot get merchant accounts, so they route payments through front merchants. Regulators in Türkiye and the GCC are targeting these flows directly.
Want to know what is hiding in your portfolio?
Ask Onlayer for a transaction laundering exposure scan.
Book a demo
