Payment Processing Checklist

Run an SSL Labs scan on the checkout subdomain (checkout.shopify.com or your custom domain). Confirm cert validity, no mixed content warnings, and TLS 1.2+ only. Expired certs silently break Apple Pay / Google Pay and tank conversion before alerting fires.

Shopify Payments / Stripe Checkout / hosted iframe = SAQ A. Stripe Elements with custom fields = SAQ A-EP. If a developer recently moved card fields onto your domain, scope changes — reconfirm with your acquirer before the next attestation.

If SAQ type is unclear or you suspect SAQ A-EP / D, open a ticket with a QSA before completing self-attestation. Misclassification is the single largest source of merchant-side PCI fines after a breach.

Export the prior business day's payout report from each processor. Match gross sales, processor fees, refunds, and net deposit against the bank deposit. Use a tool like A2X or Bookkeep if volume exceeds ~500 orders/day.

Healthy DTC decline rate runs 8-12%. Above 15% suggests a Radar / fraud rule misconfiguration, an issuer-specific BIN block, or a 3DS challenge flow that customers are abandoning. Filter declines by reason code (insufficient funds vs. do_not_honor vs. fraudulent).

Pull the Radar rule that fired most often on declines and review false-positive rate against confirmed fraud. Loosening a CVC-mismatch block or relaxing a velocity rule often recovers 2-3 points of authorization without measurable fraud increase.

Pull every dispute opened in the last 24 hours. Bucket by reason: 4855 / product not received, 4853 / not as described, 10.4 / fraud. Fraud disputes rarely win and should be conceded; service disputes are winnable with delivery proof and order notes.

Include AVS and CVC match results, signed delivery confirmation, customer IP, prior order history with the same card, and any support tickets. Stripe and Shopify both auto-assemble most of this — review before submission, do not just click through.

Card networks give 7-21 days depending on type and brand. Missing the deadline is an automatic loss with no appeal. Set the calendar reminder for 2 days before the actual deadline.

Visa VAMP and Mastercard Excessive Chargeback Program flag merchants above 0.9% dispute rate or 100 disputes/month. Crossing the threshold triggers fines and risks processor termination. If trending up, escalate to leadership before the next billing cycle.

Export this week's failed renewals from Recharge, Smartrr, or Stripe Billing. Sort by failure reason: expired card, insufficient funds, do_not_honor, lost/stolen. Each maps to a different recovery path.

Stripe's Network Updater and the Visa Account Updater (VAU) refresh expired and reissued cards automatically. Recovers roughly 30-40% of expired-card failures with no customer interaction. Confirm it is on across every Stripe account, not just the primary.

Aggressive retries (every day for 7 days) burn issuer trust and trigger more declines. Stripe Smart Retries or Recharge's intelligent dunning spaces attempts based on issuer signals. Avoid the temptation to layer a second retry tool on top.