Friday, October 23, 2026
News For Internet Marketers
Sansec documented a Magecart skimmer that loads from real Google Tag Manager containers and stores Magento checkout data as fake Stripe customers. Why a CSP allowlist misses it, what PCI DSS 6.4.3 and 11.6.1 expect, and what to check.
Jotform's July Authorize.net announcement offered two sign-up paths. For supplement and hemp sellers, Gateway Only is the one to understand, from supported processors and eCheck underwriting to switching acquirers without new API keys.
An analysis of ATF's plan to drop the 2024 engaged in the business presumptions, including one tied to merchant services, and what it means for gun marketplaces and payment providers.
NSSF told ATF in August that remote same-state gun sales would weaken dealers' role as a first line of defense. An analysis of what the May 8 proposal requires and what it would mean for online FFL checkouts.
Analysis. Stripe's Prohibited and Restricted Businesses page, updated September 22, 2026, says U.S. merchants selling electronic tobacco may only sell FDA-authorized products. Shopify Payments prohibits tobacco outright, and PayPal's 2022 policy puts e-cigarettes in pre-approval.
UPS's hemp shipping page says raw hemp shipments must contain a Certificate of Analysis showing total THC, including THCA, of no more than 0.3% on a dry weight basis from December 11, 2026, the same day most of the new federal hemp definition takes effect.
Shopify opened Shop MCP on October 13 so AI agents can search Shopify Catalog and check out with Shop Pay. Sellers of age-restricted and regulated products have reason to review how their listings, age checks, and order controls work when an agent does the buying.
Enforcement of Pennsylvania's Act 57 began October 19, 2026. Nicotine vapes not on the Attorney General's ENDS directory can be seized, first violations cost $500 per unit, and nicotine-free products sold under a nicotine brand name must be listed too.
Authorize.Net full-card exports need an owner-approved, fee-based request that can take three weeks, NMI imports only through affiliate-initiated PGP files and charges at least $500 to export, and neither gateway imports subscription schedules.
When an acquirer moves a firearm or nicotine account to MCC 5723, 5993, or a new location record, Visa's April 2026 data rules and October 2026 dispute guide make the statement descriptor part of the change, with VAMP's 1.5% merchant line leaving little room for unrecognized charges.
