Tuesday, September 29, 2026
News For Internet Marketers
Mastercard's Scam Merchant Monitoring Program, effective July 24, 2026 under bulletin GLB 12772, compresses scam-signal response into a 72-hour acquirer investigation clock that high-risk card-not-present stores cannot treat as optional ops theater.
FDA's September 18, 2026 warning letter to Empower Pharmacy ties high-volume compounded GLP-1 combinations to telehealth-style menus that preselect significant-difference language under section 503A.
After active exploitation of WooCommerce Wholesale Lead Capture CVE-2026-27540, high-risk stores need file integrity monitoring on uploads, checkout templates, and admin users before acquirers ask for forensics.
As of Admin API 2026-10, updating a shipping address on an unfulfilled Shopify order recalculates destination taxes. Restricted-catalog operators that edit addresses in ops tools must re-read tax lines and balances.
Authorize.Net Account Updater in the New Merchant Interface (2.0) refreshes Visa and Mastercard cards on ARB and CIM profiles. Misread ACL and CCH responses can suspend subscriptions and spike retries that look like card testing.
Federal hemp deadlines do not erase stricter state milligram caps. Virginia's 2 mg per-package rule and Minnesota's 5 mg per-serving LPHE limits show why zip-to-SKU cart matrices need versioning.
Square told merchants to purge CBD and hemp catalog items by October 15, 2026, ahead of federal hemp dates that later shifted under P.L. 119-103. Processor calendars, not statutes, set settlement risk.
USPS generally bars consumer mailing of cigarettes, smokeless tobacco, and ENDS except narrow exceptions, while private carriers add tobacco agreements, adult signature, and vape bans. Nicotine pouch classification still turns on product facts.
Processors and card networks draw different lines between serialized firearms, ammunition, regulated parts, and non-firearm tactical accessories. Mapping SKUs to the right MCC and MID is the operational fix.
PCI SSC FAQ 1588 clarifies how e-commerce merchants using provider-hosted iframes confirm they are not susceptible to script attacks for SAQ A eligibility under PCI DSS v4.0.1.
