Secret buyers for the payment rails

We buy from the illegal operators you can't see.Then we tell you who banked them.

Illegal casinos hide behind clean-looking merchant accounts. We sign up, deposit real money, and follow it — to the descriptor, the acquiring BIN, and the bank processing for them.

We process no payments — we take no revenue from any party we investigate

Book a 30-minute callRequest a sample
One EUR 20 deposit resolving through six domains to a single descriptor
Reconstruction — names, domains and values changed

The two estimates differ on methodology, not on direction. Nobody publishes how much of this runs on cards.

The problem

The laundering is of merchant identity, not money.

An illegal operator does not need to move dirty money. It needs a clean-looking merchant account. The site sells gambling. The merchant record says general retail. The payment settles anyway.

The tools to block exist. The visibility to aim them does not.

For example, for card payments it may appear that the card payer is purchasing beauty products instead of gambling services. This arrangement means that payment service providers cannot see that the card payments are for gambling and therefore cannot reject the transactions as specified in the Gambling Ordinance.
Spelinspektionen — Swedish Gambling Authority — situation report, online gambling outside the licensed market — 20 Mar 2025 — dnr 24Si2002 — p.28
Illegal operators exploit weaknesses across the payments chain – among payment service providers, acquirers, and card networks – to keep reaching European consumers.
EGBA — 10 July 2026

The card rail is a decision they make about you

Same site. Same minute. Cards appear only for the right visitor.

Deposit screen reached from organic search, offering no card option
Arriving from organic searchReconstruction — names, domains and values changed
Deposit screen reached through the affiliate funnel, offering the card rail
Arriving through the funnelThe card rail appearsReconstruction — names, domains and values changed

Crawl it from a data centre and you find a crypto-only casino. The card option is served to targeted traffic only, and it settles under a declared MCC of 5399 where 7995 is required.

The receipt

The only place the truth surfaces.

Issuer authorisation prompt showing the merchant descriptor and settled amount
At the moment of paymentReconstruction — names, domains and values changed
Cardholder transaction list with the gambling deposit shown under an unrelated name
On the statement, laterReconstruction — names, domains and values changed

The authorisation prompt reads SP *DGTLSRV0417, EUR 0.13. A name that means nothing, and thirteen cents that do.

Case #94N2SpecimenAcquirer attributed
Test payment
EUR 20.00
Declared MCC
5399 — misc. retail
Delivered
Online gambling — MCC 7995 required
Descriptor
SP *DGTLSRV0417
Front shop
novavisto.example — EE
Acquiring BIN
400000
Acquirer
Orchestrator
Settlement route

3 fields withheld pending right of reply — full record released to the commissioning institution — right of reply on file

Specimen record — values synthetic and illustrative

A shell changes its name, its descriptor and its storefront overnight. Changing the institution that acquires for it is slow, expensive and visible. That is the fact we sell.

The rule

The rule is already written. It is simply unenforceable.

If the Merchant conducts online gambling transactions, it must use MCC 7995 for all transactions, even if gambling is not the Merchant's primary business.
Visa Merchant Data Standards Manual, Apr 2026, p.21 — card-absent
The Acquirer must ensure that each Merchant … is identified in authorization and clearing Transaction messages with the Acceptor business code (MCC) that reflects the primary business … Any Transaction that includes the sale of products or services properly identified with one of the following MCCs must be identified with such MCC: • Gambling Transactions (MCCs 7800, 7801, 7802, 7995, and 9406)
Mastercard Rules — §5.8.1 — 2 June 2026 — p.116
Acquirers must prohibit agents from utilizing dynamic Merchant descriptors for Gambling Merchants.
Visa Merchant Data Standards Manual, Apr 2026, p.10 — payment facilitators
the most common violations identified during a BRAM investigation are: … Section 5.8.1 'Acceptor Business Code (MCC) Information' … An Acquirer deemed to be in violation … may be assessed, with respect to each Merchant … USD 200,000 or USD 2,500 per day, retroactive to the first day of the noncompliant practice
Mastercard Security Rules and Procedures — Merchant Edition — §8.8.3 — 4 Aug 2026 — pp.104-105

Both schemes already require the correct code. Neither can see when it is wrong without somebody buying.

Method

Five steps. Bounded, documented, repeatable.

  1. 01

    Target

    A priority list built from proactive targeting and a tip channel open to members and the public.

  2. 02

    Onboard as a real customer

    Native-language entry through the affiliate funnel, with correct geography and device signature. Auditors get served the decoy.

  3. 03

    Pay, capped and documented

    A small real payment under a strict cap, with a full audit trail.

  4. 04

    Trace the settlement path

    The acquiring BIN. The descriptor as it lands. The orchestrator in the middle. The settlement route.

  5. 05

    Package to evidentiary standard

    Chain of custody on every artifact. Timestamped, reproducible, formatted for compliance-programme intake.

You cannot buy from your own licensee — evidence generated inside your own network is the first thing opposing counsel impeaches.

Independence →

Economics

Two operators. One orchestrator. One attribution.

  1. starcove-play.exampleoperator a
  2. pf-west2.starcovecash.examplepayment frame
  3. api.pci-gate.examplepci gateway
  1. meridian-slots.exampleoperator b
  2. pf-west1.meridiancash.examplepayment frame
  3. engine.novapay.examplepayment engine
rapidcheckout.exampleshared orchestrator
Two operators with no visible relationship, three hops apart, resolving to the same orchestrator. One attribution covers both.

Obligations

Your deadlines, dated.

These are not our claims. They are dates already binding the institutions reading this page.

In force

Upcoming

Standing exposure

Visa's Integrity Risk Program assesses USD 25,000 per merchant for name or MCC manipulation, and USD 50,000 to USD 400,000 per merchant or URL for processing illegal transactions.

Visa Rules, public edition

All entries last verified 2026-08-09

Independence

We process no payments and take no revenue from any party we investigate.

Collection is capped at minimal value, fully audit-trailed, and our analysts stay unnamed because they are the instrument.

Every party named in a filed attribution gets a right of reply, and it travels with the finding.

Conflicts, disclosed clients, entity and data protection →

Signals

The outside world, moving.

Curated, not aggregated. Four most recent; the record is at /news.

All news →

The weekly filing

One email a week.

No product news. No marketing.

Double opt-in — unsubscribe in every send — Privacy

Telegram

Same items, as they publish.

A read-only channel. No group, no discussion, no direct messages.

Open the channel

Opens telegram.org — nothing is loaded from Telegram on this page

Bounty

You have seen a cashier we have not.

Reached a card checkout at an operator that should not have one, or seen what landed on the statement? Tell us. Reports are read by hand.

Submit a tip

No account needed · Telegram or email · Nothing published without your agreement

Book a 30-minute callRequest a sample