How to audit a merchant statement — find the fake fees and recover the money

The processor statement is engineered to be unreadable. The average operator glances at the effective rate, sees a number they vaguely expected, and moves on. Meanwhile three or four line items are padded, one is fabricated, and one is the processor's actual profit margin labeled as a card brand pass-through.

Audit your statement every quarter. Here is how.

1. The four categories of fees on every statement

1. Interchange — paid to the card-issuing bank. Set by Visa, Mastercard, Amex, Discover. Non-negotiable, pass-through at cost.
2. Assessments and card brand fees — paid to the card networks themselves. Set by Visa, MC, Amex, Discover. Non-negotiable, pass-through at cost.
3. Processor markup — what the processor actually keeps. This is what you negotiated.
4. "Other" fees — PCI, statement, non-compliance, IRS reporting, gateway, batch, monthly minimums. Padding city.

The trick processors play is labeling category 3 (their markup) as if it were categories 1 or 2 (pass-through), so you think you can't negotiate it. Auditing separates what is truly pass-through from what is markup in disguise.

2. Line items to verify against public rate tables

Every one of these has a published card-brand rate. If your statement shows more than the published rate, you are being padded.

Visa assessments

• Visa Assessment Fee (credit): 0.14% of volume (2026 rate)
• Visa Assessment Fee (debit): 0.13%
• Visa Acquirer Processing Fee (APF): $0.0195 per auth (credit), $0.0155 per auth (debit)
• Visa Fixed Acquirer Network Fee (FANF): tiered, but mid-size ecom is typically $40-$400/mo
• Visa Transaction Integrity Fee: $0.10 per non-qualified transaction

Mastercard assessments

• MC Assessment Fee: 0.1375% (under $1k tickets), 0.01% Digital Enablement Fee, 0.0185% "NABU" network access fee
• MC Transaction Processing Fee: $0.0195 per auth
• MC Cross-Border Assessment: 0.60% foreign, 0.40% domestic

Amex OptBlue (if via ISO)

• Amex Assessment: 0.15%
• Amex Inbound Fee: 0.40% on non-US cards

Look these up each year — they shift every April. See our free assessment fee calculator.

3. The most common overcharges

A. Padded assessments

Processor lists "Visa Assessment" at 0.16% instead of 0.14%. Difference: 2 bps. On $3M volume, that is $6,000/year of pure padding labeled as pass-through.

B. Fake compliance fees

• "PCI Non-Compliance Fee" — $25-$35/month. Charged even when you are compliant. Reversible with a single email showing your current PCI attestation.
• "IRS Regulatory Fee" / "IRS Reporting Fee" — $5-$10/month. Required by law for the processor to report, but cost to the processor is effectively zero. Usually negotiable to waive.
• "Annual Regulatory Fee" — $99-$149. Pure margin. Not tied to any specific regulation.

C. Markup disguised as interchange

Some statements label the processor markup as "interchange non-qualified surcharge" or "downgrade." If your statement has a line like "non-qual surcharge 1.25%" and you are on interchange-plus pricing, that is padding. Interchange-plus means interchange plus your negotiated markup and nothing else.

D. Batch and auth fees padded

Standard: $0.05-$0.10 per batch, $0.05-$0.10 per auth. If you see $0.25/auth or $0.50/batch, that is margin.

E. Chargeback fee on won cases

Some processors charge the $25-$35 chargeback fee even when you win the representment. Merchant agreement should refund this — check the clause and reclaim.

4. The audit process

1. Pull the last 3 months of statements in PDF.
2. Extract every fee line item into a spreadsheet. Columns: category, description, dollar amount, % of volume.
3. Sum by category. Compare total pass-through to published rates × your volume mix.
4. Flag every line where actual > published by more than 2%.
5. List all "other fees" and categorize each as "legitimate", "padded", or "fabricated".
6. Write a recovery request email to your acquirer with specific line items and dollar amounts.

Working example: $2.8M annual merchant, $11,400 recovered

Audit findings on one quarterly statement:

• Visa Assessment padded at 0.17% vs published 0.14% — $2,100/qtr overcharge
• "PCI Non-Compliance" $35/mo despite active attestation — $105/qtr
• "Annual Regulatory Fee" $149/yr — reversed in full
• Chargeback fees on 8 won representments — $240 refunded

After submitting audit letter, acquirer:

• Refunded $2,480 of padded pass-through fees (retroactive 6 months).
• Removed PCI non-compliance going forward.
• Waived annual regulatory fee permanently.
• Adjusted chargeback fee policy per agreement.

Year-one recovery: $11,400. Year-over-year savings: $6,200.

5. What to include in the recovery letter

Subject: Statement audit findings — [MID] — [period]

Dear [acquirer risk / support],

We have audited our merchant statements for [date range]
and identified discrepancies between fees assessed and
published card-brand rates, as well as fees inconsistent
with our signed merchant agreement.

Attached: line-by-line variance schedule.

Summary of requested adjustments:
 1. Visa Assessment recalculated at published 0.14% — $X refund
 2. PCI Non-Compliance fees reversed — $Y refund (we are fully compliant, attestation attached)
 3. [Additional line items...]

Total requested adjustment: $[sum]

We appreciate your prompt response.

[Name, title, signature]

FAQ

How far back can I claim? Merchant agreements usually cap claims at 90-180 days. Audit quarterly to stay inside the window.

What if they refuse? Escalate to the acquirer's risk/compliance department. If still refused, a small claims filing is cheap leverage.

Does this work on Stripe? Partially. Stripe's flat-rate pricing absorbs much of this, but you should still audit the line items visible in the dashboard.

How often should I audit? Quarterly minimum. Monthly if you just switched acquirers.

CTA

If you want the audit done for you across every brand, apply to multiflow. We audit statements as part of onboarding and recover overcharges in the first 30 days. Or review pricing.