Payment Processing for Vape and Smoke Shops in San Diego

For vape and smoke shops, payment processing in San Diego is a compliance exercise before it is a pricing exercise. The shops along El Cajon Boulevard, University Avenue in North Park and City Heights, Convoy Street, Pacific Beach's Garnet Avenue and the Chula Vista and National City corridors sell products that Visa and Mastercard permit but scrutinize, that California restricts by flavor and age, that the city and county regulate through their own tobacco retail licensing, and that federal law makes hard to ship. Every one of those layers shows up in underwriting.

The rules that shape what you can sell

California's SB 793, upheld by voters in Proposition 31 in 2022, restricts the retail sale of most flavored tobacco products, including flavored vape products, with limited exceptions. The state has since added enforcement mechanisms including a list of permitted products. San Diego city and county have their own tobacco retail license requirements, and some jurisdictions in the county adopted local flavor restrictions before the state did. Every retailer needs a California Cigarette and Tobacco Products Retailer License from CDTFA, and the state's minimum age of 21 applies to all tobacco and vape sales.

Check the current rule on all of this with counsel, because enforcement has tightened. Underwriters will ask whether your inventory complies, and a shop selling restricted flavors is a shop that gets terminated when the acquirer finds out.

Why aggregators decline you

Tobacco and vape are coded MCC 5993 (cigar stores and stands) or under general retail with a tobacco flag. The category is not prohibited by the card networks for in-person sales, but it is restricted: age-verification obligations, elevated regulatory risk, and a history of enforcement actions mean large aggregators exclude it by policy. Online vape sales add another layer. The federal PACT Act, extended to vape products in 2021, imposes registration, shipping, tax and delivery requirements that led major carriers to stop shipping vape products to consumers. Most San Diego shops sell online for local pickup only, or not at all, for that reason.

The result is that you need a high-risk acquirer that underwrites the category deliberately. Our approach is laid out in how we approach vape and e-cig payment processing at Flux.

The underwriting file

• CDTFA tobacco retailer license and any city or county tobacco retail license, current.
• Business license, seller's permit, and lease or proof of the retail location.
• Product list, with a statement on flavored-product compliance and a description of how you verify inventory against the state's rules.
• Age-verification process: ID scanning at the register, staff training records.
• Prior processing statements, six months if available, with chargeback detail.
• Three months of business bank statements, owner ID, personal guarantee.
• If you sell online: your PACT Act registration and delivery process, or a statement that online sales are pickup-only.

In-store processing: the core of a San Diego shop's account

The good news is that most vape and smoke shop volume is card-present, which is the lowest-risk and lowest-cost form of card acceptance. Chip and tap at the counter, a clear descriptor on the customer's statement, and a receipt with the shop name. Card-present interchange in San Diego's mixed debit and credit environment is manageable, and interchange-plus pricing lets a debit-heavy shop keep the savings.

Where shops get in trouble is keying cards for phone orders or "holding" product on a card over the phone. Keyed transactions cost more, carry full fraud liability, and produce disputes without a consent trail. If you do not need to key, do not.

Chargebacks and fraud in this category

Vape shop disputes tend to be small-ticket and fall into a few patterns: a customer who claims a device was defective, an underage purchase discovered by a parent, or a card used by someone other than the cardholder. The first is a returns-policy question (post it, and honor manufacturer warranty processes). The second is why ID scanning matters; a scan record is evidence in a dispute and in a regulatory inquiry. The third is card-present fraud, which chip and tap largely eliminate because liability shifts to the issuer on a chip transaction.

Keep the ratio well under the 0.9%-1% network thresholds. For a shop doing 1,500 transactions a month, that is a handful of disputes. Chargeback alerts let you refund before a dispute posts. Fraud detection rules matter less for a card-present shop than for an online one, but velocity limits on repeat purchases of high-value devices are still worth setting.

Reserves and account stability

Expect a rolling reserve on a first account (a percentage of settlement held for a period, released on a rolling basis) and a monthly volume cap. Cards settle in 1-2 business days net of reserve. Reserves come down after 90-180 days of clean history. What keeps the account stable is not the ratio alone; it is the absence of surprises. A regulatory action, a change in product mix toward restricted items, or a sudden online sales channel the acquirer did not underwrite are the things that get accounts closed. Tell your processor before you change anything material.

The wholesale and multi-location side

Some San Diego operators run several storefronts and a distribution arm supplying other shops. Distribution invoices should move by ACH (1-3 business day settlement, flat cost, no card chargeback), not cards. Multi-location retail should be reported per location so a problem at one store does not obscure the picture at the others. Our industries page lists the related categories we underwrite, including hemp and CBD, which many smoke shops also carry and which brings its own AB 45 compliance questions.

San Diego vape and smoke shops that stay processing for years are the ones that treat compliance as inventory management: licensed, flavor-compliant, ID-scanned, card-present, and honest with their acquirer about what they sell. The shops that get terminated are the ones that assumed the processor would never look.