Merchant Account for Digital Downloads: Proving Delivery Without a Parcel

A download is fulfilled the moment the card is approved, so no courier scan exists to answer a dispute. Underwriters read the licence terms, the refund policy, the fraud controls and the delivery logs instead. The evidence that replaces a tracking number is download logs, IP and device data, licence activations, terms acceptance and support history. A seller outside the US adds entity, director and bank account with the IBO package.

A merchant account for digital downloads is underwritten on one question: how you prove that a file reached the person who paid for it. Templates, ebooks, presets, software licences and audio files are delivered the second the card is approved, so a dispute cannot be answered with a tracking number. Acquirers file the model as card-not-present high-risk and read the licence terms, the refund policy, the fraud controls and the delivery logs in its place. The evidence stack that replaces the courier scan is download logs, IP and device data, licence activations, terms acceptance and support history. A seller outside the US adds the other half of the file, a US entity, a US-resident principal and a US bank account, with an IBO package on the IBO package.

Why a download is underwritten differently from a parcel

A physical store answers a "not received" dispute with a courier scan that a third party produced. A download store answers it with records it produced itself, and issuers weigh merchant-held records with more scepticism. Tickets are usually small, so a modest dollar volume is a large number of transactions; chargeback ratios are computed on counts, and a few dozen disputes weigh more than they would on a high-ticket store. Fulfilment is instant, so a stolen card is monetised before anyone looks at the order, and low-ticket checkouts are a favourite place for card testing, where bots try stolen numbers with small purchases. Finally, the buyer keeps the product after a refund or a chargeback: nothing comes back, and the refund policy and the licence terms are read as risk controls.

What an underwriter asks a digital-downloads seller for

The application is read like any card-not-present file, with extra items specific to files and licences. The reviewer checks the live checkout against every answer.

• The catalogue and a sample. Product pages with prices, a plain description of each file type, and often a sample file or a test purchase.
• Proof you own the rights. Who created the templates, presets or code, and under which licence any third-party material is resold.
• The delivery mechanism. An expiring link, an email attachment, an account library or a licence key, and which system logs each step.
• The licence and refund terms as they appear on the checkout page, not in an internal document.
• Fraud controls. AVS and CVV enforcement, velocity limits, 3-D Secure, and how the store detects card testing.
• The descriptor and the support channel. What the cardholder sees on the statement and how a buyer who cannot open a file gets help.
• Volume, ticket and history. Expected monthly volume, average ticket, and prior statements with dispute and refund ratios where they exist.

Licence terms and refund policy shown before checkout

A digital licence is a contract the cardholder never signs. It carries weight in a dispute only if the buyer saw it and accepted it before paying, so underwriters look at where the terms sit in the flow. A link in the footer is weak. A short summary next to the buy button, with a checkbox that records the acceptance, the timestamp and the policy version, is strong. Keep dated screenshots of the checkout each time the terms change: the question in a dispute is what the buyer saw at purchase. The terms should settle four points.

• Scope of use. Personal or commercial, the number of seats, devices or projects, and whether resale is allowed.
• What is delivered. File formats, version, compatible software, and whether updates are included and for how long.
• Refunds. A "no refunds on digital goods" line buried in a terms page is contested by cardholders and by issuers. A conditional policy is easier to underwrite and to defend: a refund window before download, a replacement for a corrupt file, a refund when the file does not match its description.
• Cancellation, if anything renews. A store that also sells a monthly preset library is running subscription billing, and the terms and the plan have to say so.

The evidence stack that replaces a tracking number

In representment the merchant assembles a file that an analyst at the issuer reads against the reason code. For a download it is built from logs and has to tie the disputed order to a person, a device and a completed delivery.

Two points about that stack. It exists only if the systems write it from the first sale; a download log cannot be reconstructed afterwards. And card network rules for card-not-present fraud disputes increasingly let a merchant point to earlier undisputed purchases from the same account, IP address or device, which turns one disputed order into a pattern. Keep it exportable; the companion article on delivery proof and compelling evidence covers the assembly and the dispute portal's format.

Fraud controls and the descriptor: disputes you prevent before they exist

Many disputes on digital goods are friendly fraud: the buyer purchased, downloaded, and later did not recognise the line on the statement or wanted the money back. Two things reduce it. The descriptor: the brand the buyer saw at checkout, with a support phone number or website in the second field, disclosed again on the order confirmation; the billing descriptor guide covers the format. And the receipt: an email that names the file, restates the licence and the refund terms and shows where to ask for help. True fraud, where the cardholder never bought, needs a different answer; the friendly fraud versus true fraud article draws the line. Because a download monetises a stolen card instantly, underwriters also want controls that act before fulfilment, and they want the store to show them.

• Card-testing defence. Rate limits per IP address and per card, a CAPTCHA after failed attempts, and an alert on a burst of small declined transactions. One night of card testing can leave a fresh MID with a wave of declined authorisations and fraud disputes.
• 3-D Secure. Where the gateway supports it, a fully authenticated transaction shifts liability for fraud-coded disputes to the issuer; it does nothing against friendly fraud.
• Delivery gating. Expiring links, a download count per order, and a manual review on orders that trip velocity or geography rules.
• Refund before dispute. A buyer who writes "I cannot open this" and gets a refund or a replacement within the day rarely becomes a chargeback.
• Licence revocation. A key revoked when a refund or a chargeback lands limits the loss and shows that fulfilment is controlled.

Where the IBO package fits, next to info-products

The evidence stack, the terms and the controls are yours to build; IBOCore does not sell chargeback management. What a seller outside the US usually cannot supply is the other half of the file: a US entity, a US-resident principal the acquirer can underwrite, and a US bank account for settlements. An IBO package delivers it. An IBO (Independent Business Operator) is a real, KYC-verified US resident who acts as the nominee director of a fresh US LLC or C-Corp. Every IBOCore director has zero criminal record and a credit score of 650 or more, and serves one merchant only. The package arrives with:

• The US entity with its EIN, incorporated in the director's home state, never a Wyoming shell.
• The complete director and business documentation: government ID, proof of address, articles, operating agreement, EIN letter.
• A business bank account at Bluebanc or Relay with full operational access: inbound and outbound wires, debit card, no minimum balance.
• A professional email on the company domain and a dedicated US residential proxy.
• Director collaboration on verification calls and signatures, with zero interference in the business.
• 24/7 support in a private Telegram group with an account manager.

The IBO package costs $999 setup, then $2,999 per month from 30 days after delivery, whatever the vertical or the billing model. The setup fee is paid in USDT or USDC on ERC20 or TRC20, the package ships the same day the payment confirms, and acquirer onboarding then typically takes 3 to 10 business days, on the acquirer's timeline. The document template pack ($499, one-time) includes a refund policy and a terms of service template. The state filing and the EIN show the director as the principal. At the time of writing, under FinCEN's interim final rule of March 2025, domestic companies and US persons are exempt from beneficial ownership reporting, while companies formed under foreign law that register in a US state remain subject to it; verify current FinCEN guidance with a professional, as IBOCore gives no legal or tax advice.

Questions merchants ask

Is a download log enough to win a "not received" dispute?

On its own, rarely. A log shows that a file was fetched; it does not show who fetched it. It carries weight when it is tied to the IP address and the device of the purchase, to a timestamped terms acceptance, to an account login and to the support history. No one can promise the outcome of a dispute; the issuer decides each case. What you control is whether the full stack exists when the dispute arrives.

Can I run a no-refunds policy on digital products?

You can publish one, and the acquirer will ask how it is disclosed and enforced. For downloads the workable line is the download itself: a refund window while the files are untouched, a final sale once they are fetched. Issuers tend to side with cardholders on "not as described" claims whatever the policy says, so a corrupt or mislabelled file is refunded regardless. Whether the clause is enforceable in your market is a question for a professional; the refund policy guide on this blog covers the structure.

My store sells single files and a monthly template club.

Those are two billing models. The IBO package costs $999 setup, then $2,999 per month from 30 days after delivery, whatever the vertical or the billing model. Describe both revenue lines to the IBOCore team on Telegram before paying.

High-risk MID metrics acquirers watch

Once live, your chargeback ratio (CB ratio) is chargebacks divided by transactions; Visa VDMP and Mastercard ECP programs trigger when you breach network thresholds. Rolling reserves (often 10% for 180 days) protect the acquirer against future disputes. MATCH (Terminated Merchant File) is the industry blacklist after a forced termination. MCC (Merchant Category Code) must reflect your real vertical; miscoding is a scheme violation.

• Representment: fighting a chargeback with delivery proof and logs.
• RDR / Ethoca alerts: pre-chargeback refund tools that protect your CB ratio.
• Statement descriptor: keep it recognizable to cut "friendly fraud" disputes.
• Processing cap: volume limit until the acquirer trusts your history.

MID stacking without structure

Spreading volume across many MIDs without separate entities looks like ratio gaming or transaction laundering to risk teams. The durable pattern is one IBO package per MID, clean descriptors, honest MCC, and reserves treated as a cost of doing high-risk volume.

FAQ: quick answers

How fast can I get an IBO package on IBOCore?

Available inventory ships the same day after payment. You receive Articles, EIN letter, registered agent details, bank onboarding pack and signer contact through your merchant dashboard. Processor onboarding typically follows over the next one to two weeks.

Where can I look up payment-processing jargon?

Use the Resources glossary on IBOCore (/resources) for 580+ definitions: MID, chargeback ratio, MATCH, rolling reserve, MCC, RDR, KYB and high-risk vertical vocabulary.