Vape Payment Processing: What Acquirers Check and Which Files They Decline
How card acceptance works for online vape and e-liquid stores: the scheme rules behind MCC 5993, how an underwriter reads your catalog and shipping file, and which stores cannot be placed.
- By the OpenGate underwriting desk
- Updated
- 14 min read
Vape payment processing is card acceptance for vape and e-liquid sellers through an acquirer that registers the business in the card schemes’ tobacco category and has checked that the sales are lawful. For an online store, that check covers four things: the FDA status of every product, PACT Act registration, age verification at checkout and at the door, and the states you ship to. This guide explains how each one decides whether your file is placed, priced or declined.
In this guide
Why vape payment processing runs on different rules
Card schemes treat online vape sales as tobacco sales, and tobacco sold without a face-to-face check is a registered category. Mastercard’s Security Rules and Procedures, in the edition of August 4, 2026, require an acquirer to identify every card-not-present tobacco transaction with MCC 5993 (Cigar Stores and Stands), and they count electronic nicotine delivery systems, e-cigarettes included, as tobacco products. Before the first transaction the acquirer must register the merchant in Mastercard’s Specialty Merchant Registration Program, verify that the merchant’s activity complies with the laws that apply to it, and confirm it again at least every 12 months. Visa’s Merchant Data Standards Manual of April 2026 places MCC 5993 among its high-integrity-risk codes for card-absent sales. Outside the United States that applies only to merchants who sell across borders. Online age verification law by sector explains the database check and the adult signature a vape order needs.
The acquirer therefore signs for your legality. It asks for proof a clothing store never has to produce, and many sponsor banks decline to sign at all. The same rule is why a vape merchant account opened as general retail does not last: the store is miscoded, and the acquirer answers to the scheme for it.
Mainstream processors and platforms publish narrower rules. As of October 2026:
| Company | What its published policy says about vapes |
|---|---|
| Stripe | Restricted business. Tobacco products, including e-cigarettes and e-liquid, need Stripe’s review, and in the United States only FDA-authorized products are admitted (list updated September 22, 2026). |
| PayPal | Pre-approval required for e-cigarettes, cigars and other non-cigarette tobacco. Cigarettes are prohibited. |
| Apple Pay on the web | Not allowed on websites that offer tobacco or vaping products. |
| Shopify | No public policy text. A merchant notice dated June 24, 2026, reported by Reuters and confirmed by Shopify, says the company no longer supports the sale of electronic nicotine delivery systems. |
Restricted is a status with consequences of its own, set out in the guide to Stripe’s prohibited and restricted businesses. For a store hosted on Shopify, whether you can still sell vapes on Shopify depends on the platform and no longer on the gateway, because the notice concerns what a store lists.
What changed for vape merchants in 2026
In 2026 the pressure moved from the seller to the companies around the seller. State attorneys general wrote to the payment chain, and the payment chain reacted.
- April 28, 2026. A coalition of 25 attorneys general and the City of New York wrote to nine payment companies, among them Visa, Mastercard, American Express, Stripe and PayPal, asking them to keep unlawful vape sales off their networks.
- May 2026. Mastercard sent acquirers a notice on vaping products. According to Reuters, which obtained it, the notice reminded acquirers that registering a merchant means attesting that controls are in place, and it recommended reviewing merchants’ product inventories.
- May 8, 2026. The FDA published guidance on which unauthorized products it does not intend to prioritize for enforcement.
- June 24, 2026. The date of the notice in which, according to Reuters, Shopify told merchants to remove vape products from their stores.
- July 27, 2026. After network assessments reached convenience retailers, Mastercard wrote to their trade associations that it had decided to temporarily pause assessments while customers carried out remediation plans. The associations published the reply.
- September 22, 2026. Stripe updated its restricted businesses list and noted that it had clarified its stance on tobacco products in the United States.
We found neither the May notice nor the July reply on Mastercard’s own site, so both entries rest on press and trade-association accounts. Read the pause as temporary, and ask your acquirer where it stands on the day you apply.
The practical result is that acquirers still taking vape files read the catalog product by product, and they ask again every year. A lawful catalog with documents still finds acquirers. A catalog the seller cannot document does not.
How the catalog decides the file
The first thing an underwriter does with a vape file is sort the product list into three groups.
| Product group | Federal status as of October 2026 | How acquirers commonly treat it |
|---|---|---|
| FDA-authorized | On the FDA’s list of authorized e-cigarettes: 48 products from five manufacturers. The FDA calls them the only e-cigarettes that may be lawfully sold in the United States. | Accepted by acquirers that take the vertical. The only group Stripe’s US policy admits. |
| Application pending | No authorization, but a premarket tobacco product application that the FDA has accepted and filed. The FDA’s May 2026 guidance says it does not intend to prioritize enforcement against such products when its conditions are met. | Depends on the acquirer. Some accept the product with the application reference. Others apply the authorized list only. |
| No application | Unauthorized and outside the FDA’s enforcement policy. | Declined, and often the whole file with it. |
Three details in the middle row matter. The FDA’s summary of the policy excludes products with features that appeal to minors, such as a cartoon character or a design that disguises what the product is. The agency states that falling under the policy has no bearing on whether a product will be authorized. It also said it would keep a public list of the products the policy covers, so expect to be asked for the listing or the application reference. An acquirer that accepts pending products can change its position when the FDA decides.
Federal status is half the test. States keep their own lists. Pennsylvania’s Act 57 of 2025 created a directory of products that may be sold in the Commonwealth, and the Attorney General’s page on the law states that products missing from it are subject to seizure after October 19, 2026. Louisiana runs a similar directory, California keeps an Unflavored Tobacco List, and several states ban flavors or shipments to consumers outright, as the US market page lists. The underwriter checks each SKU against each state on your shipping map, so a table of SKUs by state is the strongest document a vape file can carry.
Cigars, pouches and other nicotine products sit in the same scheme category under different product law, which the tobacco and nicotine page sets out.
What the underwriter reads in an online vape file
An underwriter reads five documents, and each has a defect that turns up again and again. PACT Act registration is among the first things asked for, and PACT Act vape rules lists the evidence behind it.
| Document | What the underwriter looks for | The usual defect |
|---|---|---|
| Catalog with status per SKU | FDA status, nicotine strength, flavor and destination states for each product | An export with no status column, or products live on the site that are missing from the list |
| PACT Act registrations | Registration with ATF and with each destination state, plus a recent monthly report | Federal registration only, with states added to the checkout later |
| Age verification procedure | A third-party database check at checkout, the rule for a failed match, how long records are kept | A date-of-birth pop-up described as verification |
| Carrier agreement and shipping policy | A carrier that accepts vaping products and checks ID for an adult signature, with blocked states enforced in the checkout | A policy that promises adult signature while the labels show a standard service |
| Processing history | Three to six months of statements with refunds and disputes shown separately | History earned under a different business description |
The gateway runs none of these controls for you. Age verification, licenses and registrations are required at onboarding and stay yours to operate. A store that is not open yet should plan the launch sequence for selling vapes online around them, because registrations and carrier contracts take longer than a payment review. The general logic of the review is in how high-risk underwriting works.
Where vape disputes come from
Vape disputes start at the door more often than at the checkout. Three patterns produce most of them.
- Failed adult-signature deliveries. Nobody of legal age is home, the carrier returns the parcel, and the customer sees a charge with no product. Without a refund, the bank treats it as merchandise not received.
- Family fraud. A teenager orders on a parent’s card and the parent disputes the charge as unauthorized. A database check that failed the buyer would have stopped the order. 3DS2 on first orders shifts liability for fraud-coded disputes to the issuer.
- Refill subscriptions. The customer forgets the renewal and disputes it. A notice before each rebill and a visible cancellation path remove most chargebacks on subscription renewals.
Here is the arithmetic, with illustrative numbers. A store ships 1,000 card orders a month. Adult-signature delivery fails on 4% of them, so 40 parcels come back. If the store waits for each parcel to arrive before refunding, and one customer in four disputes first, that is 10 disputes on 1,000 transactions: a 1% ratio from deliveries alone, before any fraud or subscription dispute. Industry guidance commonly treats ratios under 1% as the healthy zone, and the chargeback ratio guide explains how the schemes count. Refund when the carrier scans the parcel as returning, and the same 40 failures produce no disputes at all.
What a vape account costs to hold
Expect a rolling reserve and pricing above mainstream ecommerce, both set by the file. Four things move the numbers for a vape store: the share of sales from authorized products, the delivery failure rate, the share of volume on subscriptions, and how many months of clean statements you can show. A new store with no history commonly starts with a lower monthly cap and a higher reserve that are reviewed after a few clean months.
The reserve is your money on a release schedule, and the math is in the rolling reserve guide. The three numbers behind any quote are explained on the pricing page. Your written offer is the only binding figure.
Which payment methods work for vapes
Cards are the core of a vape checkout, and every other method depends on its provider’s own rules.
- Visa and Mastercard, through an acquirer that has registered you in the tobacco category.
- 3DS2 on first orders and high-value baskets, with less friction for returning customers.
- Card-on-file billing for refill subscriptions, with a mandate the customer agreed to.
- Wallets only where the wallet admits the product. Apple Pay’s web guidelines exclude vaping products. Wallet rules for high-risk accounts are covered in Apple Pay for business.
- Bank payments such as SEPA for European buyers, in countries where online sales are lawful. France allows online sales of refillable vapes, while Belgium bans distance sales of e-cigarettes to consumers: the France and Belgium pages give the rules. Switzerland, also in the SEPA area, allows online sales to adults with a real age check, as the Switzerland page explains, while Hong Kong bans the import and sale of e-cigarettes outright. Malta bans cross-border distance sales of e-cigarettes to its residents (Malta page), Singapore bans vapes outright, and Australia allows them only through pharmacies (Australia page). Portugal bans internet sales of nicotine vapes, Luxembourg bans their distance sale to consumers, and Ireland requires a separate HSE license for each website that sells them. Spain lets only sellers established in Spain sell vapes online, Italy bans the distance sale of vape liquids to consumers, Mexico bans vapes outright and Brazil bans every electronic smoking device.
No payment method makes an unlawful sale lawful. Dutch law, for example, has barred the online sale of e-cigarettes to consumers since July 2023, whether the seller is in the Netherlands or abroad, so a Dutch bank payment method has no place in a vape checkout. Where a market bans the sale, block it at the address step.
The vape files that get declined
Some files cannot be placed, and it is better to know before you apply.
- A catalog built on flavored disposables with no FDA application on file.
- Shipments sent through USPS, or through a carrier that prohibits vaping products, by describing the contents as something else.
- Interstate consumer sales with no PACT Act registration.
- Age verification that consists of a checkbox or a date-of-birth field.
- Sales into states or countries that ban online or consumer shipments, such as New York for consumer orders.
- A site that calls its products FDA approved. The FDA’s own list states that authorization does not mean a product is safe or FDA approved.
- A store presented as accessories or aromatherapy to obtain a standard account.
Expect one more question: whether the business appears on ATF’s list of non-compliant delivery sellers. A file that fails on one product line can sometimes be placed without that line. A file that hides the line cannot.
What to send with a vape application
Four items make a vape file readable on the first pass: the catalog with status and destination states per SKU, your PACT Act registrations with the latest monthly report, the age verification and carrier documents, and three to six months of statements if you have processed before. Add the closure notice if a processor or platform ended your account.
With those in hand, send your vape file. An underwriter reads it and answers within 1 business day with written terms, a list of what is missing, or a decline that states the reason. If one product line has no acquiring home, you hear it at that stage, before you spend weeks on documents. Applying is free, and the rates, the reserve and the limits are in the written offer before you sign anything.