Your merchant passed KYB. Are they processing sales for a business you never approved?

You onboard a merchant that sells low-cost household items. The company is registered, the applicant's authority is established and the required people checks are complete.

Months later, its payments become much larger. Customer complaints describe a different service from the one on its website.

That is an illustrative review trigger, not proof of a crime. It asks a question KYB alone cannot answer: are these payments still for the business you agreed to serve?

Understand the difference between growth and concealment

A merchant can legitimately change products, prices or distribution channels. A seasonal promotion can explain a volume spike. Treating every change as fraud will punish growing businesses.

Transaction laundering is a different concern. Visa's merchant-screening terminology (opens in a new tab) includes misrepresenting the source of transactions or submitting them for another merchant. The company receiving your checks may be genuine while the underlying business remains undisclosed.

Your investigation needs evidence about the activity, not a second registry lookup that repeats the fact the company exists.

Keep a usable record of what you approved

At onboarding, record the merchant's business model, relevant trading names and sites, expected payment patterns and the arrangements your agreement permits. Include the review date and evidence supporting the description.

Make the record specific enough to compare later. “E-commerce” tells an investigator very little. A description of the actual products, customers and fulfilment model gives them something to test.

Keep approved changes alongside the original record. A reviewer should be able to tell whether a new activity was disclosed and accepted, rather than guessing from the latest website.

Investigate mismatches across evidence

Visa's 2026 merchant-risk discussion (opens in a new tab) points to changes in volumes, transaction amounts, declines and disputes, and recommends considering website and transaction context together.

A practical review should compare what the merchant says with what your permitted evidence shows. For example:

• Do transaction amounts fit the products or services offered?

• Do complaints describe goods or a trading name you do not recognise?

• Do invoices and fulfilment records support the sales being processed?

• Has the merchant disclosed a new site, product line or commercial arrangement?

• Are the payments attributable to the approved merchant or another business?

A single mismatch rarely explains the whole case. A new website may be a genuine expansion. A repeated pattern of unexplained differences needs closer attention.

Ask a question the merchant can answer with evidence

Start with the specific inconsistency. “Please explain these selected transactions and provide the related order and fulfilment records” is more useful than a generic demand to prove the business is legitimate.

Choose a representative sample and document why you selected it. Reconcile orders, amounts, timing and customer descriptions where those records are available. A sample of only the most suspicious transactions cannot tell you how the whole book behaves.

In the household-items example, a legitimate explanation might be newly introduced wholesale orders with matching invoices and deliveries. A different response might reveal that another business is using the account. Those are different findings and should lead to different decisions.

Act within your authority and arrangements

Assign an owner who can decide the permitted response. That may include requesting more information, revising the approved activity, applying a contractual restriction or escalating to your acquiring or compliance partners.

Check the relevant scheme, legal and contractual requirements rather than treating this article as a complete rulebook. Do not promise that a particular threshold or review schedule satisfies every obligation.

Preserve the evidence and the reason for the action. If a restriction is temporary, make its conditions and next review clear. Handle customer communication under your applicable disclosure requirements.

This is separate from fraudulent payout-bank changes. One concerns the business behind the transactions; the other concerns authority to redirect settlement.

What Toden can support

Toden Business Verification provides company and people evidence. Transaction Monitoring can assess the events your integration sends, and case tools help organise the investigation.

Do not assume that this automatically discovers every website, inspects every invoice or identifies the goods behind a payment. Your operation must collect the relevant context and act on the result.

Review one merchant whose activity changed materially. Can your team connect its original approval to the sales it processes now? If that evidence is scattered, talk to Toden about connecting the customer, event and investigation records.