Card Network Programs

Firearm and Vape Merchants Need a Descriptor Check Whenever an Acquirer Changes Their MCC

When an acquirer moves a firearm or nicotine account to MCC 5723, 5993, or a new location record, Visa's April 2026 data rules and October 2026 dispute guide make the statement descriptor part of the change, with VAMP's 1.5% merchant line leaving little room for unrecognized charges.

E-commerce 4 Internet Marketers Editorial

Illustration of a small shipping room on a frosty October morning as the owner checks a card statement against packing slips.

Visa’s October 2026 Dispute Management Guide for Merchants tells sellers to review their billing descriptor regularly and keep it aligned with the brand name customers see while they shop, because an unfamiliar name on a statement is one of the most common reasons cardholders call their bank. For online firearm and nicotine sellers, that advice matters most at one predictable moment: when the acquiring bank changes the merchant category code (MCC) on the account, or adds a new location record to carry a different code.

An MCC is the four-digit number card networks use to classify a merchant by its main line of business. The descriptor is the merchant name, plus a contact line, that prints on the cardholder’s statement. The acquirer sets both, both ride on every authorization and clearing record, and Visa’s own data rules tie them together. A recode that touches one and ignores the other can turn ordinary orders into “I don’t recognize this charge” disputes, which feed network monitoring ratios once they are filed.

Why firearm and nicotine accounts get recoded

Firearm codes moved because of state law. Visa’s Merchant Data Standards Manual, April 2026 edition, lists MCC 5723, Guns and Ammunition Shops, with the note that it “should only be used in those jurisdictions where it is legally required.” It names 5941 (Sporting Goods Stores) and 5999 (Miscellaneous and Specialty Retail Shops) as similar merchant codes, and a footnote requires acquirers to assign 5723 to retailers in California, Colorado, and New York that meet each state’s definition of a firearms merchant. EC4IM’s report on the MCC 5723 state-law split covers the states that ban the code and H.R. 1181, the House-passed bill that would preempt both sides.

For sellers, the recode usually arrives through an acquirer review. Bank of America’s merchant help page on MCC 5723, dated December 17, 2025, says the bank asks firearm merchants for their principal place of business, state of incorporation, physical locations, and the states where most sales go before deciding whether e-commerce volume needs the code. The same page says a merchant whose account carries 5723 must request an additional location with a different MCC to sell at a gun show outside California, Colorado, or New York, and the reverse for a merchant coming into those states. Each of those location records is a separate place where the statement name can drift.

Nicotine sellers face a different trigger. The Visa manual defines MCC 5993, Cigar Stores and Stands, as merchants that sell “tobacco, cigarettes, electronic cigarettes, cigars, pipes, and smokers’ supplies,” and it lists 5993 among the high integrity risk codes for card-absent transactions. Visa’s Ecosystem Risk Programs Guide (October 2024) requires acquirers that process high integrity risk merchants to follow the Visa Integrity Risk Program. An online vape shop first boarded under a general retail code has reason to expect a portfolio review against that definition, and Visa’s manual separately says it “strongly recommends” periodic MCC reviews to keep assignments accurate.

What Visa’s data rules say about names and codes

The Visa manual calls the merchant name “the most important factor in cardholder recognition of transactions.” It must be the name the merchant displays most prominently and the one cardholders know it by, while still reflecting the doing-business-as (DBA) name. One rule bears directly on recodes. When a merchant name is inconsistent with its MCC, Visa requires extra words that tell the cardholder what kind of business it is. The manual’s example is a parking garage called John’s Farm, which must appear as “John’s Farm Parking.”

Applied to this audience, a brand name that reads like an apparel or outdoor label could need a clarifying word once the account carries a firearms or tobacco code, and a name that already says “Ammo” or “Vapor” may sit awkwardly on a general retail code. That is EC4IM’s reading of the rule, not a Visa ruling on any specific store, and the acquirer makes the final call on the clearing name.

The second line matters as much as the first. For card-absent sales, the manual says the merchant city field “must contain” a customer service telephone number, a website address, or an email address. Visa’s systems give that field 13 characters. Visa’s risk guide adds that acquirers must keep registered merchant names, MCC, merchant ID, and DBA consistent from authorization through clearing, settlement, and fraud and dispute reporting. A new location record built in a hurry for a gun show or a reclassified vape line is where those values can fall out of step with the storefront.

Why the margin for unrecognized charges is thin

Visa’s Visa Acquirer Monitoring Program (VAMP) fact sheet calculates a merchant’s ratio as fraud reports (TC40) plus disputes (TC15), divided by settled transactions. Since April 1, 2026, a merchant in the United States, Canada, the European Union, or Asia Pacific is identified as Excessive at a ratio of 150 basis points (1.5%) once it also logs at least 1,500 fraud reports and disputes in a month. Disputes resolved through pre-dispute tools and fraud reports that qualify for Compelling Evidence 3.0 are excluded, subject to data extract timing. EC4IM covered the October 24 Compelling Evidence changes separately.

Mastercard’s Excessive Chargeback Program, as documented by Braintree, flags an Excessive Chargeback Merchant at 100 to 299 chargebacks and a 1.50% to 2.99% ratio in the same month, measured against the prior month’s sales count. The High Excessive tier starts at 300 chargebacks and 3%. Exiting takes three consecutive months below the lower threshold. A firearm or vape store already running near those lines does not need many confused cardholders to cross one during the fourth quarter.

A recode checklist drawn from the network rules

None of the steps below is a network mandate in itself. Each one follows from the Visa and acquirer documents cited above.

  • Get notice in writing. Whether the account was placed through a firearms-focused agent such as Blue Payment Agency or boarded directly with a bank, the merchant agreement and any account review are the places to ask for advance written notice of a new MCC, location record, or clearing name, along with the exact values.
  • Match the statement to the storefront. Compare the new DBA with the logo, site header, and order emails a customer sees. If the name and the new MCC point in different directions, ask the acquirer to add a short type word rather than a new brand.
  • Use the contact field. Put a support phone number or short web address in the 13-character city field so a confused cardholder has somewhere to go other than the bank’s dispute button.
  • Tell customers before the charge lands. Add a line such as “This purchase will appear on your statement as” followed by the exact descriptor to checkout, receipts, and shipping notices, as the Visa guide’s advice on consistent naming across touchpoints implies.
  • Buy something and read the statement. After any change, a small live purchase on each card brand shows what cardholders and issuer apps actually display, which can differ from the gateway’s settings screen.
  • Watch the first 60 days. Track Visa 10.4 and Mastercard 4837 fraud claims and any “not recognized” retrieval requests by day, so a spike after a recode is traced to the descriptor before it reaches a monitoring ratio.

EC4IM’s earlier piece on split descriptors for telehealth merchants walks through similar recognition problems when one brand bills on two merchant accounts.

The descriptor belongs in every recode

MCC changes for firearm and nicotine sellers come from state law, acquirer portfolio reviews, and extra location records for events or product lines, and Visa’s rules link the code to the name a cardholder sees. Its April 2026 data manual requires a type word when name and code disagree and a customer service contact in the card-absent city field, and its October 2026 dispute guide tells merchants to review descriptors regularly. With Visa’s Excessive Merchant line at 1.5% and Mastercard’s at 1.5% plus 100 chargebacks, sellers that treat every recode as a descriptor review, confirm it with a live test purchase, and update customer messages to match give their holiday orders a far better chance of staying out of the dispute queue.

Sources