Chapter 1. Payments: cost center or margin lever?
In most companies, payments are treated like plumbing: as long as the money comes in, nobody looks. That indifference shows up on the books. Between the confirmed cart and the euro reconciled at the bank, every step leaks: abandonment, authorization declines, fraud, fees, reconciliation gaps. Every one of these leaks can be measured. A team that manages these indicators wins back points of revenue and margin without acquiring a single new customer.
The math is brutal. On €100 million in volume, +1 point of authorization rate ≈ +€1 million in revenue at zero acquisition cost, and -10 basis points of MSC = +€100,000 in margin. Conversely, crossing the threshold of a card network monitoring program (VAMP, ECM) costs fines, fees, and at worst the termination of the acquiring agreement.
Chapter 2. The authorization rate: gross, net, and by segment.
The authorization rate is the number of transactions approved by issuers divided by the number of attempts submitted. The catch is agreeing on the denominator. The gross rate counts every attempt, retries included. A customer who fails twice and then succeeds counts as 1 success out of 3 (33%). The net rate works per unique transaction or order, so the same customer counts as 1 success out of 1 (100%). Gross measures the technical health of the checkout flow; net measures the revenue actually captured. Track both, and always say which one you’re quoting, especially with a PSP that will pick whichever flatters it.
| Code | Meaning | Type | Response |
|---|---|---|---|
| 00 | Approved | – | – |
| 05 | Do not honor (generic decline) | Ambiguous, often issuer risk | Analyze by issuer; test routing or adding 3DS |
| 51 | Insufficient funds | Soft decline | Deferred retry makes sense (after payday, at D+3/D+7) |
| 54 | Expired card | Soft decline | Account updater / ask the customer to update the card |
| 59 | Suspected fraud | Hard decline | Do not retry: every retry damages the merchant’s reputation |
| 14 | Invalid card number | Hard decline | Entry error: prompt the customer to correct it, never retry automatically |
Segment, or the overall figure lies
An overall rate of 91% can hide a large issuer at 70% on recurring payments, or a cross-border corridor in free fall. The minimum dimensions are the card’s issuing country, BIN/issuer, card type (debit, credit, commercial, prepaid), channel (first transaction, one-click, recurring MIT, wallet), amount, and 3DS/exemption status. The fixes lie where these dimensions intersect. An authorization rate problem is almost always local, not global.
The levers that move the rate
- Network tokens: replace the PAN with an automatically updated network token, for a typical gain of 1 to 3 authorization points according to data published by Visa and Mastercard, especially on stored-credential and recurring payments.
- Account updater: automatic updates of expired or replaced cards for recurring payments (code 54).
- Smart retries: retry soft declines at the right time, never hard declines. Visa caps retries at 15 attempts per card over 30 days and charges for any excess.
- Local acquiring: processing a Brazilian card through an acquirer in Brazil rather than cross-border can gain several points on the corridors concerned.
- Data quality: accurate MCC, clean descriptor, AVS/CVV fields, correct MIT/CIT indicators, because issuers score message consistency.
- Multi-acquirer routing: route each segment to the acquirer with the best approval rate for it, with automatic failover if an incident occurs.
Chapter 3. Checkout conversion and 3DS metrics.
Checkout conversion is the number of completed payments divided by the number of sessions that reached the payment step. It differs from overall cart abandonment (about 70% according to Baymard), which includes causes unrelated to payment. In between lie measurable points of friction: overly long forms, missing wallets, unhelpful error messages, redirects, and above all a poorly integrated 3DS challenge.
Five 3DS KPIs to track separately
- 3DS trigger rate: share of transactions sent for authentication (the rest are exempted or out of scope).
- Frictionless rate: share of successful 3DS authentications completed with no cardholder action. The issuer’s ACS assesses the risk from the data it receives and authenticates silently.
- Challenge success rate: share of challenges (in-app biometrics, OTP) completed successfully.
- Challenge abandonment rate: cardholders who drop off at the challenge. It is the most painful leak, because purchase intent was at its peak.
- Post-3DS vs. exempted authorization rate: some issuers approve authenticated transactions more readily; others handle exemptions well. Measure this issuer by issuer.
| Strategy | Customer friction | Who bears the fraud loss? | Typical use |
|---|---|---|---|
| TRA exemption requested by the acquirer | None | The merchant/acquirer (no liability shift) | Low order values, repeat customers, fraud under control |
| 3DS frictionless | None to low | The issuer (liability shift) | The default mode in Europe |
| 3DS with challenge | High | The issuer | High order values, risk signals, issuer requirement |
| MIT (outside SCA scope) | None | Depends on the mandate and the dispute reason | Subscriptions, automatic top-ups |
In Europe, most 3DS2 authentications now go through frictionless, roughly 70% to 80% depending on the country and issuer. Challenge abandonment ranges from a few percent with in-app biometric approval to more than 10% with poorly implemented SMS OTPs on mobile. Read this KPI by issuer and by device. A faulty ACS at a single large issuer can cost a point of conversion nationwide.
Chapter 4. Fraud and chargebacks: staying below the VAMP and ECM thresholds.
Two separate ratios, two clocks. The fraud rate divides the amounts issuers report as fraudulent (TC40 at Visa, SAFE at Mastercard) by volume, and it reacts within days. The chargeback rate (disputes actually filed) lags by several weeks. The networks monitor both. Crossing their thresholds triggers remediation plans, fines, and in the worst case termination by the acquirer.
Visa VAMP: one ratio for fraud and disputes
Since April 1, 2025, the Visa Acquirer Monitoring Program has replaced the former fraud (VFMP) and dispute (VDMP) programs with a combined ratio: (TC40 fraud reports + TC15 disputes) / TC05 settled transactions, by count. The same fraudulent sale can therefore count twice, once when the fraud is reported and again at the chargeback. VAMP adds an enumeration ratio (card testing), which flags the merchant when enumeration attempts exceed 20%. Merchants are only identified once they reach a floor of 1,500 fraud reports and disputes a month. Beyond the thresholds, each dispute can be billed at around $8 through the acquirer.
| Program | Monthly criteria | Consequences |
|---|---|---|
| ECM (Excessive Chargeback Merchant) | ≥ 100 chargebacks and a ratio ≥ 1.5% (this month’s chargebacks / last month’s transactions) | Notification, remediation plan, fines that escalate the longer the merchant stays in the program |
| HECM (High Excessive Chargeback Merchant) | ≥ 300 chargebacks and a ratio ≥ 3% | Heavier fines, strong pressure from the acquirer |
| EFM (Excessive Fraud Merchant) | High e-commerce fraud (≥ $50,000 and ≥ 50 basis points) with low use of 3DS | Fraud-specific fines, obligation to strengthen authentication |
Two false fixes are making the rounds. Ethoca/Verifi alerts and RDR automatic refunds prevent the chargeback (TC15), but they do not erase the TC40 fraud report already filed. They ease the dispute ratio, not the fraud ratio. Prevention happens upstream: 3DS targeted at risky segments, well-calibrated fraud rules, a clear billing descriptor, and traceable proactive refunds. Monitor the false positive rate at the same time, because false positives eat into the authorization rate.
Chapter 5. Cost per transaction: effective MSC, blended vs. IC++.
The MSC (merchant service charge), the fee taken on every card payment collected, stacks three layers. Interchange goes to the issuing bank and is capped in Europe for consumer cards. Scheme fees are billed by the network; they are uncapped and trending upward. The acquirer’s margin is the only layer that is truly negotiable.
| Component | Recipient | Typical range | Negotiable? |
|---|---|---|---|
| Interchange | Issuing bank | 0.2% (debit) / 0.3% (credit) under the IFR caps; much higher on commercial cards and outside the EEA | No (regulated), but can be optimized through card mix and brand selection |
| Scheme fees | Visa, Mastercard, CB… | ≈ 0.05% to 0.25% depending on the transaction, rising since 2016 | No, but sensitive to routing (CB vs. international brand) |
| Acquirer margin | PSP / acquirer | 0.1% to 1% or more, depending on volume and sector | Yes, this is what you negotiate |
Blended or Interchange++: two pricing philosophies
| Model | How it works | Pros | Cons |
|---|---|---|---|
| Blended | Single all-in rate (e.g., 1.4% + €0.25) | Simple, predictable, easy to read at low volume | Opaque: the margin swells on the cheapest cards; interchange cuts are not passed on |
| Interchange++ (IC++) | Interchange at cost + scheme fees at cost + fixed contractual margin | Transparent; you benefit from the IFR caps and from every improvement in the mix | Complex invoice, cost varies with the monthly mix, tooling needed to track it |
| Interchange+ | Interchange at cost + a flat fee covering scheme fees and margin | A middle ground on transparency | Scheme fee increases are absorbed… until the flat fee is revised |
Above roughly €1 million to €5 million in annual card volume, standard market practice is to request an IC++ quote and compare. In every case, the deciding figure is the effective MSC: total payment-related fees divided by the volume collected, the only figure that is comparable across PSPs and pricing models.
Volume collected (month) : 2,000,000 EUR
Percentage fees (MSC billed) : 9,800 EUR
Fixed fees (authorizations, gateway,
3DS, monthly minimum) : 1,400 EUR
Dispute fees (62 cases x 20) : 1,240 EUR
--------------------------------------------------
Total payment fees : 12,440 EUR
Effective MSC = 12,440 / 2,000,000 = 0.62%
(vs. 0.49% shown in the contract: +13 hidden basis points)Hunting down hidden fees
- Authorization fees billed per attempt, declines included: a checkout flow that retries badly pays twice.
- 3DS fees per authentication, sometimes charged even for frictionless flows.
- Chargeback fees (€15–€40 per case), which some PSPs keep even when you win.
- Excessive retry penalties (Visa rules) and fees tied to enumeration attacks.
- Monthly PCI non-compliance fees if your SAQ (self-assessment questionnaire) is not up to date.
- FX and DCC: currency margins on multi-currency settlement.
- Monthly minimums, setup fees, exit fees, and data return fees.
- Refunds: most acquirers do not return the interchange or fees on a refund.
Chapter 6. Reconciliation and settlement times.
An authorization is not money. The funds follow their own path: capture, clearing, settlement. They reach the bank at D+1 to D+3 depending on the acquirer and method, often net of fees, and grouped into batches that match neither orders nor accounting days. Reconciliation matches three sources: what the order system sold, what the PSP reports having settled, and what the bank actually credited.
Back-office KPIs
- Auto-reconciliation rate: lines matched without human intervention / total lines. Target: above 95–98%, since every missing point costs hours of work and delayed closes.
- Average settlement time: days between the transaction and funds in the bank, by PSP and by method. An unannounced increase is a warning sign (PSP cash-flow problems, an imposed reserve).
- Age of discrepancies: amount and age of unmatched lines. A discrepancy older than 30 days is rarely resolved without escalation.
- Funds held: reserves (with a rolling reserve, the acquirer typically withholds 5–10% of flows for several months in high-risk sectors) and amounts frozen in disputes.
Discrepancies have recurring, predictable causes: fees deducted at source (net settlement), refunds and chargebacks netted from payouts, batches spanning two days, currency conversions, and rounding. On top of that come transactions settled on a different cycle, such as deferred payments and partial captures. Good upstream mapping, where every line of the settlement file is typed and assigned to an account, turns 80% of “discrepancies” into automatic entries.
Chapter 7. Dashboards, PSP negotiation, and checkout A/B tests.
Building the payments dashboard
A useful payments dashboard breaks every KPI down by the dimensions that make action possible: issuing country, BIN/issuer, card type, payment method, device, 3DS status (frictionless, challenge, exempted), PSP/acquirer, and decline code. Refresh it daily for authorization and fraud, monthly for costs. Above all, set alerts with a threshold and an owner, not charts to admire.
| KPI | Alert threshold (example) | Response |
|---|---|---|
| Authorization rate by issuer | Down 5 points vs. the 7-day rolling average | PSP ticket with decline codes; test alternative routing |
| Share of code 05 declines | > 30% of a segment’s declines | Issuer fraud/risk analysis; consider forcing 3DS on the segment |
| Internal VAMP-style ratio | > 0,75 % | Immediate reduction plan (fraud rules, Ethoca/Verifi alerts, proactive refunds) |
| 3DS challenge abandonment | > 15% on one ACS/issuer | Escalate to the issuer through the PSP; targeted exemptions until the fix is in |
| Effective MSC | +10 basis points month over month | Invoice audit: card mix, new lines, scheme fees |
| Auto-reconciliation | < 95 % | Fix the mapping; file a quality complaint about the settlement file |
Negotiating with your PSP, armed with data
- Know your mix before the meeting: debit/credit/commercial split, domestic/intra-EEA/interregional, share of wallets. The mix determines the real cost, not the headline rate.
- Insist on IC++ and the scheme fee schedule above €1 million–€5 million in volume; compare offers on the effective MSC simulated on YOUR data, never on the headline rate.
- Put it out to tender: running a tender with 2–3 acquirers every 2–3 years, even with no intention of switching, automatically resets the margin.
- Negotiate the fee schedule as hard as the rate: chargeback fees, authorization fees (declines included), monthly minimum, exit fees, and data portability.
- Write performance into the contract: a quarterly review of the authorization rate by segment, and a committed action plan if it slips.
- Dual acquiring: a second live acquirer brings resilience, benchmark data, and permanent negotiating leverage, provided you have the routing to use it.
A/B testing your checkout without fooling yourself
- One variable at a time: order of payment methods, wallets first, form fields, TRA exemption strategy, 3DS routing, but never two changes at once.
- Random split and a sample size calculated in advance: detecting a 0.5-point lift in conversion takes tens of thousands of sessions per arm. Set the duration before you start, and don’t stop the test at the first flattering number.
- Primary metrics: checkout conversion and net authorization rate. Guardrail metrics: fraud rate, chargebacks, effective MSC. A variant that converts better by letting fraud through is a false win.
- Wait for maturity: chargebacks arrive 3 to 8 weeks after the sale, so any conclusion on risk before 30–60 days is premature.
- Document and scale: every test is versioned (hypothesis, result, decision) and feeds the payments backlog, so the gains compound.