A guide for underwriters at ISOs and Acquirers onboarding MCC 5993 cigar and smoke shop merchants, covering risk assessment, fraud signals, and the underwriting questions that matter.
If you're underwriting a smoke shop or cigar store, MCC 5993 is a high-risk category because of age restrictions, FDA tobacco rules, and the frequent presence of vape and adjacent products that mainstream processors decline. Licensing and product mix drive the decision. Here's what to look for.
Key Information
This guide covers cigar stores, smoke shops, and tobacco retailers, a high-risk category shaped by FDA regulation, age verification, and product mixes that often include vape and CBD.
Typical Business Types
Cigar Lounges and Retailers
#1
Shops focused on premium cigars, humidors, and accessories.
Smoke and Vape Shops
#2
Retailers carrying tobacco, vape hardware, and e-liquids.
Tobacco and Convenience Outlets
#3
Stores combining tobacco with general convenience items.
Payment Processing Information
Transaction Types
1
In-Person Counter Sale
Age-verified purchases at the register.
2
Online Tobacco Orders
Web orders requiring age verification and compliant shipping.
3
Phone Orders
Card-not-present orders by phone for pickup or shipment.
4
Subscription Clubs
Recurring cigar or accessory shipments charged on file.
5
Mobile and Contactless
Tap-to-pay at the counter.
Common Payment Methods
Credit and Debit Cards - Primary in-store method where accepted
Cash - Common given processing restrictions in the category
Mobile Payments - Contactless and digital wallets
ACH and Bank Transfer - Used for some online and subscription orders
Store Gift Cards - Branded stored value applied at checkout
Underwriting MCC
5993
at scale?
See how Gratify automates the risk assessment and gets applications decision-ready in minutes.
Product Misclassification - Vape or CBD sold under a tobacco MCC creating coding risk
Regulatory Challenges
FDA Tobacco Regulation - Deeming rules covering cigars, vape, and related products
Age Verification - Federal minimum age and state ID requirements
PACT Act - Registration and shipping rules for tobacco and vape
State Tobacco Licensing - Permits and excise tax obligations
PCI Compliance - Payment card data security
Common Fraud Signals
Online Order Verification Gaps
Web orders shipping without robust age checks raise compliance and fraud risk.
Subscription Chargeback Rise
Recurring club disputes suggest weak consent or notice.
Product Mix Drift
Growth in vape or CBD sales under a tobacco code signals coding misalignment.
Example Scenarios and Red Flags
Age Verification Failure
Patterns suggesting ID checks are skipped in store or online.
Card-Not-Present Tobacco Fraud
Online and phone orders on stolen cards that later dispute.
Subscription Club Disputes
Recurring charges contested by customers who forgot enrolling.
PACT Act Noncompliance
Shipping tobacco or vape without required registration and reporting.
MCC Misclassification
High-risk products processed under a code that understates risk.
Common Underwriting Questions
UW Tips Business
Verify state tobacco licensing and excise registration
Confirm product mix and whether vape or CBD is sold
Check PACT Act registration if shipping tobacco or vape
UW Tips Financial
Assess revenue split across tobacco, vape, accessories, and CBD
Review online and subscription revenue and dispute history
Examine reserve needs given the high-risk profile
UW Tips Risk
Evaluate age-verification controls in store and online
Assess card-not-present and shipping compliance
Confirm products are coded to the correct MCC
UW Questions Business
What products do you sell beyond cigars and tobacco?
Are your state tobacco license and excise registration current?
Do you ship tobacco or vape and are you PACT Act registered?
UW Questions Payments
What share of sales is online, phone, or subscription?
How do you verify age for shipped and in-person orders?
How are recurring subscription charges authorized?
UW Questions Fraud
How do you prevent underage and card-not-present fraud?
What verification covers online and phone orders?
How do you handle returns and disputes on restricted products?
UW Questions Compliance
Are you compliant with FDA deeming and PACT Act rules?
How do you meet age verification and excise requirements?
Are PCI assessments current?
UW Questions Chargebacks
What is your chargeback ratio and what drives disputes?
How do you capture consent for subscription billing?
Do you retain age and shipping records for representment?
UW Questions Infrastructure
What POS and online platforms handle age verification?
How do you segment and protect payment data?
Do you support EMV and contactless at the counter?
Ongoing Monitoring
Transaction Monitoring
Monitor subscription and recurring-charge disputes
Flag card-not-present orders without age verification
Track product mix shifts toward vape and CBD
Compliance Checks
Maintain tobacco licensing and PACT Act registration
Keep age-verification and shipping records current
Confirm MCC alignment as product mix changes
Security Updates
Use EMV and contactless at the counter
Apply strong age and identity verification online
Encrypt and tokenize stored card data
Risk Assessment
Reassess risk as vape and CBD share grows
Track regulatory changes affecting tobacco and vape
Review reserve levels against dispute trends
Merchant Communication
Help the merchant confirm correct MCC coding as product mix shifts toward vape and CBD. Share guidance on PACT Act shipping and age verification. Support subscription consent practices to reduce recurring disputes.
Overwhelmed with Applications?
Gratify offers instant merchant application enrichment to get the full picture of your customers in real-time
