Flagship vertical
Peptides & research products
Payment infrastructure for peptide and research-product businesses, built around underwriting rather than around a single processor.
Protecting revenue
Fraud prevention
Screening rules, velocity limits and verification checks tuned to how a business actually sells.
No screening removes fraud entirely. Rules are tuned to reduce it without rejecting genuine customers.
The basics
Fraud prevention is a trade-off, not a switch
Every fraud control declines something. The question is never whether to stop fraud - it is how much good business you are willing to turn away to do it, and most merchants have never been asked that question directly.
Tighten the rules and fraud falls, along with revenue from customers who did nothing wrong and will not come back after being declined. Loosen them and approvals rise, along with disputes. There is no configuration that only removes the bad transactions.
False declines cost more than most merchants think
A declined legitimate customer is not a neutral event. They do not retry, they do not complain, and they frequently buy the same thing somewhere else within the hour. The loss is invisible precisely because nothing happened.
Fraud losses arrive as a line item somebody can point at. False declines arrive as revenue that never existed. That asymmetry is why fraud controls drift tighter over time, and why reviewing them in both directions matters.
What Apex will not tell you
Apex does not claim to prevent fraud, and no provider honestly can. Screening reduces exposure and shifts liability in some circumstances; it does not eliminate either. Anyone offering a guarantee is describing a commercial arrangement about who absorbs the loss, not a technical one about stopping it.
What you are up against
Four different problems wearing the same word
"Fraud" covers several distinct attacks, and the controls that stop one are largely irrelevant to the others.
-
Card fraud, in person
A physical card or its details used by somebody not entitled to them. Chip and contactless have pushed most of this online, but it persists wherever a card can be keyed in manually - and keyed transactions carry both higher rates and more of the liability.
-
Card-not-present fraud
Stolen card details used online, where nothing physical has to be forged. Tested in small amounts first, then used quickly. Digital goods and anything with immediate fulfilment are hit hardest because there is no delivery window in which to intervene.
-
Account takeover
The attacker uses a real customer account with a stored card. Everything looks legitimate because everything is - the address is on file, the history is genuine, the device may even be familiar. Payment screening alone will not catch it; the signal is in the account behaviour before the purchase.
-
Chargeback fraud
The purchase was legitimate and the dispute is not. No pre-authorisation control catches this, because there is nothing wrong with the transaction. It is answered with evidence and with removing the reasons a customer would rather dispute than contact you.
Transaction screening
The controls, and what each one is for
Layered rather than stacked. Each control answers a different question, and a rule that duplicates another only adds false declines.
-
AVS and CVV
Address and security-code checks. Cheap, useful, and blunt: legitimate customers mistype addresses and international ones frequently fail AVS entirely.
-
Authentication
Cardholder verification at checkout. Adds friction and, in the right circumstances, shifts liability for the transaction. Worth using selectively rather than universally.
-
Velocity rules
Limits on attempts per card, per device or per address in a window. The single most effective control against card testing.
-
Device and behaviour signals
Device fingerprinting, geolocation and session behaviour. Where most account-takeover signal lives, because the card details are genuine.
-
Blocklists and allowlists
Known-bad and known-good. Necessary, easily neglected, and worth reviewing - an allowlist entry from two years ago is now an unmonitored hole.
-
Manual review
A person looking at borderline orders. Slow, expensive, and consistently better than a rule on the highest-value cases.
What is available depends on the gateway, the processing arrangement and the card networks involved. Apex configures against your actual traffic rather than applying a default rule set and hoping.
Monitoring
Rules go stale. Monitoring is what notices
A fraud rule set is correct on the day it is written and decays from then on. Attack patterns move, your product mix changes, you open a market whose legitimate customers look exactly like the profile you blocked last year.
What is worth watching
**The decline rate, by reason.** A rising decline rate is either fraud pressure or a control that has started catching customers. Those need opposite responses, and the reason breakdown is what tells them apart.
**Authorisation rate by segment.** Country, card type, issuer, traffic source. Aggregate numbers hide the segment where something has gone badly wrong.
**Small-amount attempts.** Clusters of low-value authorisations are card testing. Catching it early matters because the testing itself damages your authorisation rate before any fraud lands.
**Disputes by reason code.** The feedback loop on whether screening is working, and the only one that tells you what got through.
Reviewing in both directions
Most merchants only ever tighten. A control is added after an incident and never revisited, and three years later the rule set is a museum of past attacks quietly declining present customers. Loosening deliberately, and measuring what happens, is part of the job.
Operational practice
What sits outside the payment stack
Several of the most effective fraud controls are not payment controls at all.
-
Protect the accounts
Account takeover starts at login, not at checkout. Strong authentication, alerts on address and password changes, and re-verification before a stored card is used at a new address.
-
Watch fulfilment
Mismatched billing and shipping, freight forwarders, and expedited delivery on a first order are fraud signals that live in your warehouse rather than your gateway.
-
Train the phone
Social engineering targets support teams, not systems. A clear script for what staff may never do on a caller's say-so is worth more than another rule.
-
Keep the records
Screening results, IP addresses, device data and delivery confirmation. Evidence for a dispute is assembled at the point of sale, not at the point of dispute.
-
Minimise what you hold
Tokenised storage rather than card data on your systems. The data you never held cannot be taken from you.
-
Review the rules
On a schedule, in both directions, against what actually happened rather than against what somebody was worried about at the time.
Merchant education
The part Apex cannot do for you
Fraud screening is configured by us and encountered by your team. The people taking phone orders, processing refunds and answering support are where most of the practical decisions get made, and they are usually the least equipped to make them.
What a team needs to know
What a declined transaction actually means, and why "just try it again" is often the worst available response. Which requests from a caller should never be honoured regardless of how convincing the story is. What to record when an order looks wrong, and who to tell.
Above all: that declining a suspicious order is a decision they are allowed to make. A team that believes it will be blamed for lost revenue will wave things through.
What Apex provides
Configuration against your actual traffic, plain explanations of what each control does and what it costs you in declines, and the account data to see whether it is working. Not a rule set handed over as a fait accompli.
How it works
What happens after you get in touch
-
Tell us about your business
What you sell, how you sell it, and what your current payment arrangement looks like.
-
We review your requirements
Your industry, ticket size, refund and dispute history and processing volume.
-
Suitable options are evaluated
The payment paths that fit your profile, with the trade-offs of each set out plainly.
-
Integration and onboarding
Account setup, gateway configuration and hardware, done alongside you.
-
Ongoing support
Monitoring, dispute handling and account reviews, with a route to a person.
Apex does not guarantee approval, a rate, a saving or a timeline. Underwriting decisions are made by the acquiring institution, and Apex's work is to put the strongest accurate case in front of it.
Who this helps
The businesses this is usually for
Availability depends on underwriting, and every merchant is reviewed individually.
E-commerce
Online retail on an established platform or a custom build, with checkout tuned for conversion and disputes kept in check.
Cross-border
International e-commerce
Selling across borders, where acceptance rates and settlement currency matter as much as the processing rate.
Specialised vertical
Gaming & casino-related
Gaming operators and suppliers, where licensing and jurisdiction drive what is available.
Questions
Frequently asked
Does Apex only work with high-risk businesses?
No. Most Apex merchants are conventional businesses - shops, restaurants, professional firms, e-commerce stores - underwritten and priced as exactly that. Apex also handles specialised and complex verticals, which is where the deeper capability shows, but a traditional business is not placed on specialised terms because of who else we work with.
How is pricing decided?
Pricing follows underwriting. Card mix, average ticket, refund and chargeback history, the industry and how you take payment all feed into it. Apex does not quote a rate before seeing those, and does not guarantee a rate or a saving in advance.
Can Apex guarantee my account will be approved?
No, and no payment provider can. Approval is an underwriting decision. What Apex does is prepare the file properly before it is submitted - the website, the policies, the documentation and the processing history - which is what usually decides the outcome.
What happens if my current processor drops my account?
That is a common reason merchants come to Apex. Where the profile allows it, accounts are set up with more than one processing path from the start, so a single withdrawal does not stop revenue while a replacement is arranged.
Can I take card, bank and crypto payments together?
Yes, where the business qualifies for each. Card, ACH, eCheck and digital-asset settlement can run alongside one another under the same merchant relationship, with the gateway routing between them. What is available depends on the business type and underwriting.
Will Apex work with my existing website and systems?
Usually. Apex integrates with established storefront platforms, billing systems and CRMs, and does direct API work where an off-the-shelf plugin does not fit. Replacing a working system is rarely the right recommendation.
Related reading
Worth reading before you decide
Guide
Merchant accounts
What underwriting actually looks at
The parts of an application that decide the outcome, and the ones merchants spend time on that make no difference at all.
7 min read
Payment education
Payment education
How to read a processing statement
Interchange, assessments and markup, separated - so you can see which part of your rate is negotiable and which part never was.
6 min read
Guide
Risk and disputes
Keeping chargeback ratios down
Descriptors, refund policy, delivery evidence and alert handling: the four things that move the ratio, in the order they are worth fixing.
8 min read
Get started
Talk through fraud prevention
Tell us how your business takes payment and we will review whether this is the right arrangement for it.
- One conversation Underwriting, integration and support are handled by the same team.
- More than one path Where the profile allows it, accounts are set up with a fallback.
- Nothing overstated No promise of approval, a rate or a timeline before underwriting has looked at your business.
No obligation, and no application submitted without your agreement.
Get in touch
Questions about payments, an existing account, or anything else.