The MATCH List: How Nutra Merchants Get Blacklisted for Five Years

what is the MATCH list and who actually runs it?

Mastercard's Alert to Control High-risk Merchants file — MATCH — is a shared database acquirers query before boarding a new merchant, not a Mastercard-operated blacklist in the sense most people assume. The reporting party is always the acquirer or processor that terminated the account, not Mastercard itself, per Stripe's documentation of the network's high-risk merchant lists. Mastercard maintains the infrastructure; the judgment call belongs to whichever bank cut you off.

A listing follows the person, not just the company. The reporting acquirer is required to include the principal owner's name, address, phone number and tax ID whenever available, so a fresh LLC formed by the same owner still surfaces on the next acquirer's inquiry. That single design choice is why opening a new merchant account under a new name rarely works once a principal has been flagged.

For the mechanics of contesting a specific listing, see how supplement merchants get blacklisted and get off — this page focuses on why nutra operators end up there in the first place and what five years locked out actually costs.

what gets a supplement merchant put on MATCH?

A supplement merchant gets flagged for one of six defined reasons, and in nutra the leading two are chargebacks and fraud, both measured as a ratio against sales rather than a raw count. Mastercard's Excessive Chargeback Merchant tier requires both 100 to 299 chargebacks in a month and a chargeback ratio between 1.50% and 2.99%; the High Excessive tier requires 300 or more chargebacks at a ratio of 3.00% or higher, per Braintree's summary of the program's October 2019 thresholds.

Fraud works on a separate track. Excessive Fraud Merchant status requires all three conditions in the same month: at least 1,000 card-not-present transactions, at least $50,000 in fraud chargeback volume, and a fraud ratio of 0.50% or higher — figures worth treating as approximate, since they come from processor analyses rather than Mastercard's own published rules text.

• Transaction laundering — running another merchant's undisclosed sales through your MID — breaches your acquirer agreement and typically lands as a Violation of Standards report.
• Mastercard's Scam Merchant Monitoring Program, enforceable from 24 July 2026, triggers when combined refunds plus chargebacks exceed 5% of transactions over a rolling 30 days with at least 500 transactions, and confirmed scam activity can mean immediate termination plus a MATCH listing.
• Multiple MID requests without clear business justification are explicitly named as a scam signal under that program, which matters for the common nutra practice of load-balancing volume across several merchant IDs.

how fast does an acquirer have to report a terminated merchant?

One business day. Mastercard requires the terminating acquirer to submit a MATCH report within one business day of closing the merchant account, which is why operators are often blindsided — there is no 30- or 60-day grace window to quietly wind down and reapply elsewhere, per Stripe's documentation of the rule.

The report sits on file for five years, and Mastercard deletes it automatically once that period runs out; there is no early-expiry mechanism tied to good behavior afterward. That timeline should factor into any decision to keep fighting a marginal chargeback ratio rather than close the account voluntarily, since the clock starts on termination, not on the underlying violation.

which MATCH reason codes matter most in nutra?

Four of Mastercard's six MATCH reason codes show up repeatedly in nutra terminations, and the two chargeback-and-fraud codes carry hard numeric triggers while the others are judgment calls made by the acquirer's own risk team.

Codes 04 and 05 are the ones a chargeback-ratio dashboard can actually predict in advance. Codes 08, 10 and 12 depend on an acquirer's discretion or a specific compliance failure, which is why two merchants with identical chargeback numbers can end up with different outcomes — one terminated quietly, one reported under a harsher code.

can you find out whether you are on the MATCH list?

Not directly. Mastercard does not offer merchants a self-service lookup, so the practical answer is that you find out when a new acquirer runs pre-boarding due diligence and either flags the inquiry or declines outright. Only entities with MATCH access — acquirers, processors and Mastercard itself — can query the file.

The workaround operators use is asking the acquirer that just terminated them, or a prospective new one mid-underwriting, to disclose what the inquiry returned; neither is obligated to share it, though many will confirm a listing exists once asked directly. Waiting for a new application to bounce is still the more common way operators discover it, which is a poor way to learn how much of the five years is already gone.

can you get off MATCH before the five years are up?

Rarely, and only through two narrow paths. Mastercard's own rules limit removal to the reporting processor confirming it added the merchant in error, or — for code 12 (PCI DSS Non-Compliance) specifically — the merchant subsequently achieving PCI compliance, per Stripe's summary of the removal criteria.

Merchants listed under the excessive chargeback or excessive fraud codes cannot be removed even after fixing the underlying problem. Mastercard will not adjudicate or delete a listing on request, and the reporting acquirer has no incentive to revisit a closed file. That asymmetry is the actual argument for spending on chargeback prevention before a ratio breach happens rather than after.

can you still process payments at all while listed?

Yes, but only through the high-risk processing tier, and at a real cost. Providers such as PaymentCloud, eMerchantBroker and Easy Pay Direct actively underwrite nutraceutical and supplement merchants, with placement typically measured in days rather than weeks once documentation clears.

The price of that access is a reserve — commonly 5% to 15% of processing volume, held for 90 to 180 days under a rolling structure, per Corepay's summary of high-risk reserve terms — plus higher per-transaction fees and closer scrutiny of every future dispute. Billing structure matters here too: how you decide between COD and trial-rebill in a given market changes the chargeback exposure a high-risk processor will underwrite against in the first place.

Some operators route volume across several MIDs to stay under any single account's monitoring thresholds, a legitimate load-balancing practice on its face. Mastercard's newer scam monitoring program now names that same behavior directly as a risk signal when the MIDs are not disclosed to the acquirer with a clear business justification.

how does a single FTC letter cascade into a MATCH placement?

An FTC letter rarely triggers MATCH by itself, but it starts a chain that often ends there. A warning letter, a Notice of Penalty Offenses or a filed complaint pushes negative press and refund requests, which shows up first as a spike in Visa reason codes 13.2 (cancelled recurring transaction) and 10.4 (other fraud, card-absent) on the same offer the FTC is examining.

If that spike pushes the merchant past Mastercard's chargeback or fraud thresholds — or past the Visa Acquirer Monitoring Program ratio of 1.50% in card-not-present disputes plus fraud, effective across the U.S., EU, Canada and AP from April 2026 — the acquirer typically terminates rather than absorb further fines, and files the MATCH report within one business day. The FTC's TruHeight case, finalized in mid-2026 over fake five-star reviews and unsubstantiated child-height claims, fits exactly that pattern: legal exposure first, chargeback spike second, processor termination third.

The individual-liability piece compounds it. The FTC pleads cases using a control-or-participation formula that names owners and officers personally, and a MATCH report separately requires the principal's name and tax ID — so the same person named in an FTC complaint is the person a new acquirer finds attached to a MATCH file two steps later, regardless of which corporate entity applies next. Some of that exposure traces back to which markets a merchant was running in; see the data tier list on nutra GEOs for how dispute rates vary by geography.

Quick decision checklist

Use this page as a decision aid, not a generic blog post. The practical question is whether the reader needs faster evidence about what is already working in VSL-driven direct response, especially across nutra, supplements, GLP-1, weight loss, blood sugar, and adjacent high-intent health markets.

Daily Intel Service is most relevant when the next decision depends on active market examples: which hook to test, which claim style is risky, which funnel structure is common, which language market is moving, and whether a competitor's creative is likely early, scaling, or already saturated.

• Start with the TL;DR if you need the direct answer.
• Use the table to compare trade-offs quickly.
• Use the FAQ for answer-engine-ready summaries.
• Use the CTA when the decision requires live VSL and ad examples instead of theory.

Daily Intel's coverage advantage

Daily Intel Service is positioned around category-leading variety and actionability: one of the broadest direct-response catalogs of VSLs and ad creatives across blackhat, greyhat, and whitehat advertising patterns, with enough context to understand what the advertiser is doing beyond the visible creative. The practical difference is that members are not just seeing a screenshot; they are seeing the VSL, the ad, the funnel path, the transcript, the UTM context, and the research notes that turn the asset into a decision.

This matters because direct-response affiliates do not operate in one clean category. A weight-loss campaign may use a whitehat compliance ad, a greyhat pre-lander, a more aggressive VSL, and a checkout path designed around upsells and recovery. A useful intelligence platform needs to capture that spectrum instead of pretending every winning campaign looks like a public brand ad.

Blackhat, whitehat, and multilingual signal coverage

Daily Intel tracks patterns across both blackhat-style and whitehat-style campaigns so operators can understand the market without blindly copying risk. Whitehat examples help with durability and compliance review; blackhat and greyhat examples reveal pressure points, hooks, mechanisms, and funnel structures that may be driving spend but require careful adaptation before use.

The catalog is also built for global operators, with VSL and ad references spanning 14+ languages and different local idioms. That is a key advantage for Brazilian, LATAM, European, MENA, Indian, and non-native English affiliates who need to see how the same market desire is translated across cultures instead of only studying US English ads.

How to use the intelligence responsibly

The goal is modeling, not copying. Use Daily Intel to understand structure: hook, mechanism, proof, claim intensity, funnel depth, offer economics, and saturation stage. Then build original creative, review claims, and adapt the angle to the traffic source, country, language, and compliance requirements of the campaign.

A strong workflow compares multiple examples before acting. If the same mechanism appears across several languages, several advertisers, and several funnel variants, it may be a durable market signal. If the example appears only once or depends on an aggressive claim, treat it as a research clue rather than a campaign template.

• Model structure, not protected creative assets.
• Separate whitehat durability from blackhat persuasion pressure.
• Compare US English examples against LATAM, European, and other language variants.
• Use transcripts and funnel notes to build original briefs.
• Keep compliance review separate from market research.

Methodology and source context

Daily Intel pages are written from a research workflow that reviews active VSLs, Meta ad creatives, transcripts, UTMs, funnel paths, checkout steps, upsells, recovery sequences, and compliance-sensitive claim patterns. The goal is to explain observable market behavior, not to provide legal, medical, or platform policy advice.

When the topic touches health claims, platform policy, or GLP-1 market research, validate the observable campaign signals against primary references such as Meta advertising standards, FTC health claims guidance, and Google helpful content guidance. Daily Intel adds the proprietary direct-response layer by mapping how those rules show up in active VSLs, Meta creatives, funnels, transcripts, UTMs, and checkout paths.

For deeper evaluation, continue through Daily Intel compliance and legal disclaimer, Is Copying a Competitor's Landing Page Legal? The Line, Black Hat Affiliate Methods: A Field Guide to What Is Actually Running, Is Black Hat Worth It? The Numbers Nobody Puts in the Pitch, Getting an Ad Account Back: What Works, What Wastes Your Week, and What is a VSL?. These related Daily Intel pages connect this topic to the relevant methodology, pricing, trust context, comparison path, or niche workflow.