October 8, 2026
Bust out fraud is a scheme where a merchant behaves like a good customer long enough to earn trust, then pushes through a burst of transactions, collects the settlement and disappears before the chargebacks arrive. The acquirer or payment facilitator that onboarded the merchant is left holding the losses. This guide explains how a bust out scheme unfolds, the signals that give it away, and what acquirers should look for in a detection tool.
1. Bust out fraud at a glance
2. What is bust out fraud?
3. How a bust out scheme works, stage by stage
4. Why acquirers carry the loss
5. Warning signs of merchant bust out fraud
6. Why transaction scoring misses it
7. How to detect bust out fraud
8. How to choose a bust out fraud detection tool
9. Everything you need to know about bust out fraud
10. FAQs
| Question | Short answer |
|---|---|
| Who commits it | A merchant, often set up for the purpose, sometimes a real business in distress |
| Who loses money | The acquirer or payment facilitator that settled the funds |
| Typical timeline | Weeks to a few months of normal trading, then a spike lasting days |
| Main signal | A break from the merchant's own history and from its peer group |
| Best control | Merchant-level monitoring with the ability to hold settlement |
Bust out fraud, in the merchant context, is fraud committed *by* a merchant against the institution that processes its payments. The merchant opens an account, trades normally to build a clean record, then runs a large volume of transactions through the account in a short window. The acquirer pays out settlement. By the time cardholders dispute the charges, the merchant has emptied the account and gone.
The term also appears in consumer credit, where a borrower builds a good credit line and then maxes it out with no intention of repaying. The mechanics are similar. This guide covers the merchant version, which is the one acquirers, payment facilitators and independent sales organisations deal with.
Bust out fraud sits alongside transaction laundering in the family of merchant-initiated fraud. The difference is intent at the point of the spike: transaction laundering processes payments for a hidden business over time, while a bust out is built to end.
The fraudster opens a merchant account, often with real or stolen business documents. Digital onboarding has made this faster. Checks at the door confirm the business exists; they can't confirm what it intends to do.
For weeks or months, the merchant processes small, ordinary volumes. Refund and dispute rates stay low. Risk limits may be raised as the account ages, which is exactly what the fraudster is waiting for.
Volume jumps. Average ticket size rises. Card-not-present share climbs. Sometimes the merchant runs stolen cards through its own terminal, sometimes it takes prepayments for goods it will never deliver.
Settlement lands, the funds are withdrawn, and the merchant stops responding. Chargebacks start arriving two to eight weeks later, depending on the scheme's dispute windows, and every one of them becomes the acquirer's loss.
When a merchant disappears, card scheme rules place the liability for chargebacks on the acquirer. Payment facilitators carry the same exposure for their sponsored merchants. There is no one left to recover from.
The damage goes beyond the direct loss. A spike in disputes can push the acquirer's portfolio ratios toward scheme monitoring thresholds. Visa's acquirer monitoring program and Mastercard's merchant programs both look at those ratios, and Mastercard's Scam Merchant Monitoring Program now gives acquirers 72 hours to investigate a flagged merchant. A bust out that goes unnoticed can trigger all of it.
Payment fraud in the EEA reached €4.2 billion in 2024, up from €3.5 billion in 2023, according to the joint report the European Banking Authority and European Central Bank published in December 2025. Merchant-initiated schemes are a smaller slice of that figure than consumer fraud, but each incident concentrates the loss on one institution.
No single signal proves a bust out. Several appearing together, against a merchant's own history, should trigger a review.
| Signal | What it looks like |
|---|---|
| Volume break | Daily volume several times the merchant's trailing average |
| Ticket size jump | Average transaction value rising sharply with no change in product mix |
| Channel shift | A card-present merchant suddenly processing mostly card-not-present |
| Card concentration | Many transactions from a small set of cards or BIN ranges |
| Refund pattern | Refunds to cards that never made a purchase, or refunds far above sales |
| Settlement pressure | Requests for faster payout or higher limits shortly before the spike |
| Peer deviation | Behaviour far outside merchants with the same category code and size |
The peer comparison matters. A florist doubling its volume in February is normal. A florist doubling its volume in July, all card-not-present, is not.
Transaction-level fraud scoring asks whether a single payment looks fraudulent. In a bust out, many of the payments are made with valid cards by the merchant itself, or by accomplices, and pass every check at authorisation.
The fraud only becomes visible when you look at the merchant as an entity: its volume over the past 90 days, its refund ratio this week against last month, and how it compares with similar merchants. That is a different model from payment scoring, built around the merchant instead of the transaction.
Monitor merchants continuously, from the first transaction. The riskiest period for many schemes is the first few months after onboarding, before a normal baseline is established.
Score behaviour against the merchant's own history and its peers. Anomaly detection on volume, ticket size, channel mix and refunds catches the spike. Supervised models trained on past bust outs catch the patterns that come before it.
Tie alerts to actions. An alert that sits in a queue for a week doesn't help. The control that saves money is the ability to hold settlement while an analyst investigates.
Keep the evidence together. Transaction history, dispute data and peer comparisons in one view shorten an investigation from days to hours, which matters when scheme programs set 72-hour clocks.
Greek payments company Viva Wallet caught merchant fraud attempts three weeks earlier than with its previous tooling after deploying Fraudio's merchant fraud detection, and reported an 8x return on investment.
Ask whether the tool models merchants over time. If it only scores individual transactions, it will miss most bust outs.
Check that it compares each merchant against others in the same category and size band.
Look for alert levels that map to actions: monitor, investigate and hold settlement, block.
Merchant risk teams often buy after a loss. A tool that takes a year to deploy won't help the next one.
Merchants increasingly accept alternative payment methods and instant payments. Bust outs move to whichever rail is least monitored.
For a side-by-side view of vendors, see our roundup of the best merchant fraud detection platforms.
| Topic | Key point |
|---|---|
| Definition | A merchant builds trust, spikes volume, collects settlement and exits |
| Victim | The acquirer or payment facilitator |
| Timing | Chargebacks arrive two to eight weeks after the spike |
| Hardest part | Each transaction can look normal on its own |
| Detection method | Merchant-level anomaly and peer analysis over time |
| Control that saves money | Holding settlement during investigation |
| Related schemes | Transaction laundering, merchant-initiated fraud |
Fraudio monitors merchants as entities over time, comparing each one with its own history and its peers. Its merchant fraud product raises alerts at three levels, including one that starts an investigation and holds funds by stalling settlement. It goes live in days to weeks, prices per transaction with no setup fees, and runs on the same integration as payment fraud scoring and AML.
It is built for acquirers, payment facilitators and independent sales organisations that carry merchant liability.
Talk to our team about merchant fraud detection
Bust out fraud is a scheme where a merchant trades normally to build trust, then processes a burst of transactions, collects settlement and disappears before chargebacks arrive. The acquirer that settled the funds absorbs the losses. Chargebacks typically land two to eight weeks after the spike. Detecting it requires watching merchant behaviour over time instead of scoring single payments.
A bust out scheme usually runs for several weeks to a few months of normal trading before the spike. The spike itself often lasts only days. Fraudsters time the exit to settlement cycles, so funds are withdrawn before the first disputes reach the acquirer.
The acquirer is liable for bust out fraud losses under card scheme rules, because the merchant who should repay the chargebacks has disappeared. Payment facilitators carry the same liability for their sponsored merchants. Repeated incidents can also push the acquirer toward scheme monitoring program thresholds, adding fines to direct losses.
The warning signs of merchant bust out fraud are sudden volume increases, rising average ticket size, a shift to card-not-present payments, concentration on a few cards and unusual refund patterns. Requests for faster settlement shortly before a spike are another common signal. Each should be measured against the merchant's own history and its peer group.
Bust out fraud is built to end with the merchant disappearing after a volume spike, while transaction laundering processes payments for a hidden business over a long period. Both are forms of merchant-initiated fraud. Both are detected through merchant-level monitoring, though transaction laundering often also needs website content checks.
Bust out fraud can rarely be prevented at onboarding alone, because the merchant usually presents as a legitimate business at the door. Onboarding checks confirm identity and business details; they can't reveal intent. Continuous monitoring after onboarding is what catches the behaviour change.
Acquirers stop bust out fraud in progress by holding settlement once monitoring flags a merchant, then investigating before releasing funds. Viva Wallet caught merchant fraud attempts three weeks earlier after moving to merchant-level monitoring. The earlier the hold, the more of the settlement is still recoverable.
Bust out fraud monitoring doesn't have to create excessive false alarms if it compares each merchant with its own history and its peers. Seasonal businesses spike for legitimate reasons, and peer comparison separates those from genuine anomalies. Tiered alert levels let teams monitor low-risk changes and act only on high-risk ones.
How about trying our solution and experiencing the next generation for yourself?
