Key takeaways
- Card-not-present is the whole business, so fraud screening and dispute management are core operations, not add-ons.
- Hosted fields and tokenization shrink PCI scope and keep card data off your stack; CCPA/CPRA makes that a privacy decision too.
- Cross-border sales into Mexico and Latin America change your card mix, fraud pattern and settlement options.
For e-commerce brands, payment processing in San Diego has a few local flavors: the surf, outdoor and apparel brands headquartered from Encinitas and Carlsbad down through Pacific Beach, the supplement and wellness companies around Sorrento Valley and UTC, the craft-beverage and coffee roasters shipping from Miramar and North Park, the pet and baby brands that grew out of the region's large military-family market, and a meaningful number of sellers who ship into Mexico and Latin America because the border is fifteen miles away. All of them are 100% card-not-present, which means the processing decisions are about architecture, fraud and disputes rather than terminals.
Checkout architecture and PCI scope
Where the card number goes determines your compliance burden. If your Shopify, WooCommerce or custom checkout posts card data to your own server, you are in PCI SAQ D territory with quarterly scans and a long questionnaire. If the card fields are served from the processor's domain through hosted fields, card numbers never touch your infrastructure and scope drops to SAQ A or A-EP. Pair that with tokenization so repeat customers and subscribers are billed against a vault token. This is also the right answer under the CCPA and CPRA: payment data is personal information, and the less of it you hold, the simpler your deletion and access obligations. Confirm scope with counsel, but architect for minimization regardless.
Fraud: the cost you control
Card-not-present fraud is where San Diego brands lose money silently: chargebacks on stolen cards, plus the shipped product, plus the fee, plus the ratio damage. Baselines:
- AVS and CVV on every order; decline hard mismatches on high-value items.
- Velocity rules for repeated attempts from one device or address.
- 3-D Secure on orders above a threshold you set, which shifts fraud liability to the issuer on authenticated transactions.
- Manual review queues for the patterns you learn: for a Carlsbad apparel brand it might be reshipper addresses; for a supplement brand it might be bulk orders on new accounts.
Real-time fraud detection tuned to your catalog does most of this before authorization, which is cheaper than any dispute.
Chargebacks and the ratio
Visa and Mastercard monitor your ratio monthly, with programs beginning around 0.9% to 1%. E-commerce brands see three main reason codes: fraud, item not received, and not as described. The defenses are tracking with delivery confirmation (signature on high-value), accurate product pages and photos, a recognizable descriptor with your customer-service phone number, and enrollment in issuer alert programs so you can refund before a dispute posts. Refunds do not count against the ratio; won disputes still do. Build a weekly rhythm around the alert queue.
Subscriptions and California's Automatic Renewal Law
Subscribe-and-save on coffee, supplements or pet food is recurring billing under the ARL: clear terms before consent, affirmative consent, a confirmation, and cancellation at least as easy as signup (online signup means online cancellation). Network stored-credential rules add reminders before renewals and trial conversions. A recurring billing system with automatic card updater, pre-charge notices and a self-service cancellation page keeps you compliant and cuts the "I forgot" disputes that dominate subscription chargebacks. Check the current ARL text with counsel; it has been amended.
Selling into Mexico and beyond
San Diego brands that ship south see more foreign-issued cards, which carry cross-border interchange and assessment fees and higher fraud rates. AVS does not work well on most non-US cards, so lean on CVV and 3-D Secure. Consider local payment methods through your platform for Mexican customers. For wholesale accounts in Baja and further south, stablecoin settlement on Solana or the XRP Ledger arrives instantly in the merchant wallet and avoids both wire delay and card dispute exposure. Domestic B2B and wholesale should sit on ACH, which settles in 1-3 business days.
Settlement, payouts and the books
Card settlement is 1-2 business days. If inventory purchasing is cash-flow sensitive (a Miramar roaster buying green coffee, an Encinitas brand paying a Vietnam factory), ask about instant payouts on eligible volume. Flux pushes settled transactions one-way into QuickBooks, which covers most brands until they need a full ERP. Underwriting will ask about your platform, your fulfillment (in-house versus 3PL in Otay Mesa or Riverside), your refund policy and your chargeback history; supplement brands get the nutraceutical underwriting treatment on top.
E-commerce brands in San Diego win on product and marketing, and payments should be the part that just works. Keep card data off your stack, screen fraud before authorization, manage the dispute queue weekly, run subscriptions to the ARL, and give international and wholesale buyers a rail that fits. That is the whole stack.
Ready to get set up with Flux?
Cards, ACH, and stablecoins in one platform, with volume-based pricing. No setup fees or contracts.
Get Started