Why on earth is this person not sweeping nightly into their business bank account? Never leave money in your processor account... they are not your bank!
This is the same stuff people complain about with PayPal - failing to realize this scenario (to this extent where it's threatening your business) is almost entirely the business operator's fault due to a severe lack of understanding of how to use a processor.
My guess is this person's processor account went from small benign numbers and then suddenly had a surge of business (possibly seasonal). This sudden increase in volume can (and will) trigger anti-fraud audits from your processor if you do not already have a well established history with them. You go through it, and move on. Generally it's not an issue if you sweep nightly!
Spread the word - your payment processor is not your bank. Sweep nightly, it's almost always a free service they offer.
[1] https://support.stripe.com/questions/understanding-daily-aut...
Reminds me of crypto exchanges too. Don't leave money in an exchange, use it to, well, exchange money, then move it to your bank account or wallet.
The processor has to protect themselves from being used in some sort of Carding-Farm Scheme, has to protect other merchants from the processor being cut off by issuers (for having too many fraudulent transactions/chargebacks), and protect actual Card Holder's from fraud (since the processor/merchant ultimately are responsible for the chargeback).
People are always surprised when their new account with a few hundred a day in revenue suddenly surges to thousands a day in a short period, and the processor wants to investigate why...
Use the tools freely provided by your processor to protect yourself. Sweep the balance into your business bank account every single day - it's usually automatable and free. There is never a reason to store more than 24 hours of revenue in a processor account... they are not a bank!
Best course of action I've found, is to build your initial MVP with one payment provider but as soon as you've validated there is a market and before you move on with other features, add a backup provider you can switch to at any time because chances are you will get blocked at one point. If not permanent, at least temporary.
If you're clever enough when you build the initial integration, you make sure to abstract out the specific payment provider so it's easy to plug in a new one. Shouldn't add too much complexity.
Sucks but the reality we live in...
PCI tokenizer is pure snake oil.
"dear auditor, i do not store the credit card number, only an unique index to fetch it at any time on this rest service. i promisse it is totally not the same thing"
good luck trying to make thay avoid compliance work.
Blatant FUD. https://support.stripe.com/questions/export-customer-card-da...
I don't think the average ISO has the knowledge let alone a published set of credentials to receive card data, the ISO industry really sticks to the tooling platforms provide.
Conversely, if you’re anything but the most plain jane business, I would avoid transitioning from Stripe to Gravity like the plague. I watched them reject a candy company and a knitting goods business that were both reputable, over a decade in business each, and never had an abnormal spike in sales or questionable products on offer. Gravity either couldn’t get Stripe data transferred or properly integrated and ended up turning away both businesses (while blaming them for noncompliance).
If anyone wants to learn more about how Tilled works directly with ISO's who need a payfac solution for ISV customers email us at partners@tilled.com
I don't think it's a bad idea necessarily, but it's very difficult to almost impossible to make this a "flip the switch" setup, particularly for SaaS businesses which are almost always recurring payments.
We're a largish Connect user and for us the key thing is just establishing good relationships with reps in the company and maintaining those. We've had a couple of customers run into freezes and other issues and while standard support is basically a brick wall in those cases, getting someone internal to escalate can be hugely beneficial.