Your Merchant Has an MCC, But Do You Understand the Business?

There is a specific memory I think about whenever a merchant category code (MCC) starts doing more work than four digits reasonably can.

A former boss, a woman I still value enormously, once walked into the office and wrote on the window: “In God we trust. Everything else we check.”

As you do in tech. Perfectly good windows, apparently wasted unless someone writes a management philosophy on them. That sentence stayed on the glass for months. I still work according to it.

Hers was a variation on a line often attributed to W. Edwards Deming: “In God we trust. All others must bring data.” What I love about her version is the “we.” Checking is our job, including when the answer comes from someone smart, persuasive and entirely sincere. Including when we rather like the answer.

What the four digits tell us

An MCC is a four-digit code that card networks, including Visa and Mastercard, use to identify a merchant’s type of business. Each network publishes its own rules and descriptions for applying the codes.

Understanding the business and verifying its classification has always been part of the basics of the job of know your business (KYB). Nothing about that is new. What’s changing is how much business-model complexity we now ask these codes to absorb.

Digital goods already blur the lines between products, services and platforms. AI goes further. It makes possible businesses that could not have existed a few years ago, and no category was written with them in mind. Often nobody is hiding anything. The business is simply new enough that the familiar categories describe pieces of it without explaining the whole.

The manuals remain essential. Expecting them to anticipate every combination a founder can put into production is another matter. The technology doesn’t determine the classification, and the correct classification is only the start of the risk assessment.

A correct code can still leave a lot unexplained

Visa and Mastercard each have categories for digital media, games and software applications, similar but not identical. Those distinctions are useful. They don’t tell us how a merchant earns its money or how customers use the product.

Take two gaming businesses. One sells a game for a single upfront payment. The other earns its revenue from repeated purchases of virtual items. Both may fit the digital-games category. Yet 15 purchases in an evening means something different for each: possibly a warning sign for the first, the product working as designed for the second.

Now look at what AI has made possible. Take AI-generated adult content. Classifying it as adult is the easy part. The hard question is consent. In 2024, San Francisco’s city attorney sued the operators of 16 “nudify” sites, where paying users uploaded photos of real people and generated fake nude images of them. The code describes the content. It says nothing about whose face is in it.

Soon the customer may not be a person at all. Visa and Mastercard are both building payment rails for AI agents that shop on someone’s behalf. When an agent makes 15 purchases in an evening, who is the customer, and what counts as authorization?

None of these businesses fits neatly into categories written before they existed. Our assessment has to keep up with the business in front of us, even when the manual’s vocabulary feels more familiar than the product.

When the MCC label becomes the vertical

The bigger problem starts when an MCC becomes our entire description of a vertical.

“Digital goods” appears in the onboarding file, then in the monitoring rules, then in a portfolio report. The label stays consistent, which is reassuring. The businesses underneath it may differ in their customers, revenue models and ways of moving value.

A category-level view tells management where transactions are classified. On its own, it can’t tell them how much exposure comes from recurring subscriptions, transferable virtual items or platforms paying third-party sellers.

And the business can change while the code stays correct, sometimes without anyone deciding to change it. In 2023, influencer Caryn Marjorie launched CarynAI, an AI clone of herself that fans paid $1 a minute to talk to. The bot soon drifted into sexual conversations she had never intended, and she shut it down within eight months. On a dashboard, nothing would have changed. The original approval would now rest on assumptions that no longer held.

The MCC should be one part of the picture, not all of it. What the merchant does, how it earns, who its customers are and how funds move belong alongside it, and they should shape the controls.

Keep deliberate disguise in perspective

Miscoding matters too. In a 2021 case against Hamid Akhavan and Ruben Weigand, the Justice Department said more than $150 million in marijuana payments had been disguised through phony merchants and incorrect MCCs. Real customers who visited the cover websites were quietly redirected to the marijuana seller. Investigators visiting the same sites saw only the cover businesses.

That is deliberate concealment, better known as transaction laundering, and it deserves investigation. But if we focus only on miscoding, we stay exposed to businesses whose codes are defensible and whose mechanics we have barely examined.

What I would change about MCC codes

Keep verifying the MCC against the actual activity and the network rules. Where the fit is uncertain, resolve it with the acquiring partner and document the reasoning. Novelty does not make classification optional.

Then require a plain-language description of the business that says what the code can’t. “Users buy credits to generate images; credits cannot be transferred or redeemed” gives an analyst far more to work with than “AI platform.” Check it against the product and the payment journey. AI agents in our verification and risk-scoring systems can now run these checks at scale, quickly and cheaply, as long as we train them to doubt and to log every doubt for a human to check.

Use those mechanics to shape monitoring and portfolio reporting. Group merchants by the exposures they share, not only by MCC. When payment features, products or revenue sources change, revisit the assessment, with a named owner responsible for working out what the change means.

A practical place to start: take five merchants with the same MCC. Can you explain what makes their risks similar, and what makes them different, without repeating the category name?

One sentence on a window was enough to shape how I work. Four digits are not enough to describe a business.