Back when we sold CBD through VapeBeat, getting products onto the site was the easy part. Keeping the payment side of the business running smoothly was where things got complicated.
CBD might be legal, but banks and payment processors do not treat it like an ordinary retail product. Accounts receive more scrutiny, unusual orders attract more attention, and a sudden rise in refunds or chargebacks can quickly become a problem.
We eventually moved away from CBD and now focus solely on nic salts and pod vapes. But the experience taught us something important: if you sell CBD, transaction monitoring is not some optional piece of enterprise software. It is one of the best ways to protect your merchant account.
What Transaction Monitoring Actually Does
Transaction monitoring gives you an early warning when something about your sales activity looks wrong.
It compares new orders with your usual sales patterns and flags anything that falls outside them. That could be an unusually large order, repeated failed payment attempts, several customer names using the same delivery address, or a sudden spike in sales from an unfamiliar location.
None of these things automatically means that fraud is taking place. They simply tell you which orders deserve a closer look.
When we sold CBD, this mattered because processors wanted to know that we had control over what was being sold, who was buying it, and how disputes were being handled.
It is much easier to answer a processor’s questions when you already have the order records, review notes, and supporting documents ready.
Start With a Baseline
You cannot spot unusual activity until you know what normal activity looks like.
For us, that meant keeping track of things such as:
- Typical order value
- Average daily sales
- Refund volume
- Payment decline rate
- Customer locations
- Products normally purchased together
- Differences between new and returning customers
This made genuine changes easier to explain.
For example, a 30% sales increase during a planned promotion was not especially concerning. The same increase coming from new customer accounts, repeated devices, or one delivery address would have required a closer look.
Context is everything. The aim is not to flag every increase in sales. It is to separate real growth from activity that could put the merchant account at risk.
The Orders That Made Us Stop and Look
Several types of order were worth checking before fulfillment:
- Multiple failed payment attempts followed by a successful one
- Billing and delivery information that did not match
- Several customer names sending orders to the same address
- An order worth far more than the store average
- Several small orders placed in quick succession
- A sudden burst of orders from a new location
- The same customer trying several different payment cards
One warning sign on its own was not always enough to reject an order.
A customer might legitimately send a product to a different address. Someone may enter their billing information incorrectly. A larger order might come from a genuine returning buyer.
The problems usually appeared when several signals showed up together.
That is why a sensible monitoring system needs different responses. A low-risk order can proceed normally. A questionable order can be held for verification. A high-risk order can be stopped until someone has reviewed it properly.
False Alerts Are Part of the Process
Automated fraud rules are useful, but they are not particularly good at understanding human behaviour.
We occasionally saw perfectly ordinary customers trigger alerts because they had moved house, mistyped an address, tried a second payment card, or placed an unusually large order.
An address verification service can compare the billing details supplied by a customer with the information held by the card issuer. However, a mismatch does not prove that the card has been stolen.
If every mismatch leads to an automatic rejection, you will lose legitimate customers.
The better approach is to combine the address result with order history, payment attempts, device information, customer contact details, and the value of the order.
Monitor the Business as Well as the Buyer
One of the biggest lessons from selling CBD was that payment risk does not only come from fraudulent customers.
Your own business activity can also create problems.
A processor underwrites an account based on the products, sales volumes, locations, and billing methods disclosed during the application. If those things change without warning, normal transactions can suddenly look suspicious.
Examples include:
- Adding new CBD products without completing a compliance review
- Selling into a new state or country
- Experiencing a large increase in average order value
- Changing the way customers are billed
- Moving into subscriptions or recurring payments
- Processing much more volume than originally forecast
The company handling your payment processing for CBD needs an accurate picture of the business. Keeping your product catalog and sales methods consistent with that account record can prevent a lot of avoidable questions.
Product Records Matter More Than You Think
CBD transaction monitoring works best when every order identifies the exact product sold.
The stock keeping unit should connect the transaction to the product description, batch details, laboratory documentation, and delivery destination. If a processor or bank asks about the sale later, you should be able to pull the complete record without searching through four different systems.
This was one of the more awkward parts of selling CBD.
It was not enough for the payment to look legitimate. The product itself had to match what appeared on the site, what had been approved for sale, and what was recorded in the order system.
If a CBD product was described differently across the website, laboratory report, and order data, that inconsistency could make a perfectly genuine transaction harder to defend.
A simple approval process for new products can prevent those gaps. Do not let a product go live until its description, supporting documents, account status, and order data all line up.
Watch for Coordinated Payment Attempts
Some fraudulent activity is difficult to spot when orders are reviewed one at a time.
Velocity rules solve this by counting activity connected to the same customer account, device, payment card, address, or network location within a set period.
That can expose patterns such as:
- Several small transactions followed by a larger purchase
- Multiple customer accounts using the same delivery address
- Repeated card failures from one device
- A burst of orders placed within a few minutes
- Several cards being tested against the same account
The thresholds need to match the store.
Set them too low and genuine repeat customers get blocked. Set them too high and you may not notice an attack until the orders have already been fulfilled.
We found that rules needed regular adjustment. If an alert repeatedly caught legitimate customers, the threshold was probably wrong. If confirmed fraud passed through without being flagged, the rule was too loose.
Refunds and Chargebacks Tell You What Is Going Wrong
A refund and a chargeback are not the same thing.
A refund is issued by the merchant. A chargeback or dispute begins through the customer’s card issuer.
Both need to be monitored because a sudden increase usually points to a wider problem.
The cause might be:
- Delivery delays
- An unclear product description
- A damaged or missing order
- Poor customer support
- A confusing billing descriptor
- A customer not understanding what they purchased
- Unauthorized card use
- Recurring billing terms that were not obvious enough
Grouping disputes by reason is far more useful than treating every case as a random loss.
If customers do not recognize the name on their bank statement, fix the billing descriptor and make it clearer on receipts. If delivery complaints are increasing, inspect the courier and tracking process. If unauthorized-use claims are rising, tighten the checks applied before fulfillment.
Transaction monitoring should tell you where the problem starts, not simply record the money lost afterward.
Keep Records Before Someone Asks for Them
The worst time to start collecting evidence is after a payment processor has contacted you.
We learned to keep the order data, authorization result, alert, review decision, customer messages, shipping information, refund records, and any later dispute outcome together.
That creates a clear account of what happened and what action was taken.
Formal transaction and controls monitoring also helps demonstrate that decisions are being made consistently. If an acquiring bank asks about a volume spike or group of disputes, you can provide dates, causes, and the steps taken to prevent the same problem happening again.
That is far more convincing than saying you noticed the issue and dealt with it.
Compare Different Sales Channels Separately
Different sales channels produce different kinds of risk.
An online CBD order may need address, device, and payment checks. A physical retail transaction may need closer refund and terminal controls. Wholesale orders may require buyer verification and much higher order limits.
Putting every transaction through the same set of rules creates unnecessary alerts while potentially hiding genuine problems.
At minimum, compare the following across each channel:
| Metric | What It Can Tell You |
|---|---|
| Approval rate | Whether legitimate payments are being rejected |
| Decline rate | Whether payment attempts or customer quality have changed |
| Refund rate | Whether products, delivery, or support are causing problems |
| Dispute rate | Whether customers are challenging transactions |
| Average order value | Whether purchasing behaviour has changed |
| Manual-review outcome | Whether monitoring rules are working properly |
A rise in total chargebacks does not tell you much by itself. Finding that most of those chargebacks came from one product, campaign, or sales channel gives you something you can actually fix.
The Weekly Check We Would Recommend
You do not need an enormous fraud department to do this properly.
For a smaller CBD merchant, one person can run a weekly review covering:
- New alerts
- Unusual sales spikes
- Payment declines
- Refund rates
- Chargeback reasons
- Large or repeated orders
- Recently added products
- Changes by location or channel
- The outcome of manually reviewed transactions
Every problem should have an owner and a review date.
If a fraud rule needs adjusting, assign it to someone. If a product page is causing customer confusion, set a date for correcting it. If delivery complaints are rising, make someone responsible for checking the fulfillment process.
Monitoring only works when alerts lead to action.
What Selling CBD Taught Us
When we sold CBD, the biggest payment problems were not always dramatic cases of obvious fraud.
More often, they were small inconsistencies that started stacking up: an unusual order, a product record that did not match, a group of delivery complaints, or an unexplained jump in refunds.
Any one of these could be manageable. Together, they could make a merchant account look badly controlled.
That is the real benefit of transaction monitoring. It gives you time to find the pattern, correct the cause, and document what you did before the processor decides there is a bigger problem.
We no longer sell CBD and now focus on nic salts and pod vapes. But if we were launching a CBD store again, transaction monitoring would be in place from day one.
In a category where the banking relationship can be more fragile than the products themselves, keeping the payment side of the business boring is exactly what you want.