Two clocks
A pack or rip platform sells a pull and pays two parties from it. The buyer's card pays the platform on the day. The affiliate who sent the buyer is paid a share of the gross sale, on a published calendar, usually within weeks. The cardholder can dispute the charge months after that. So the same money can leave twice before anyone at the platform knows: once to the affiliate, once back to the cardholder.
When the affiliate is paid
On impact.com a brand sets a locking period and a payment period; the help page's example locks actions "0 months and 47 days after the end of the month" and pays 20 days after the month they lock, so a January sale is paid on 20 April (impact.com, read 20 October 2026). On CJ a standard transaction locks on the 10th of the month after the sale and payments go out around the 20th and the 28th (CJ, 5 May 2022). On Awin, which now carries ShareASale's help pages, publishers are paid on the 1st and the 15th for commissions the advertiser has approved (Awin, 8 April 2026); within the validation period an advertiser may decline a commission for an order "cancelled or fully returned", and one not reviewed in time is approved automatically (Awin, 19 October 2026). The networks' defaults put the payout between two weeks and ninety days after the sale.
When the dispute can arrive
The card networks give the cardholder far longer. Adyen's published timeframes put the limit for Visa and Mastercard at 120 calendar days from the transaction date, and at up to 540 days where the goods are delivered later (Adyen, read 20 October 2026). Stripe states the same 120 days and adds that for a future delivery the window starts on the delivery date (Stripe, read 20 October 2026). A pack bought today and shipped from a vault months later can fall under that later start. A dispute opened on day 100 lands after every cadence above has paid out, and is decided weeks or months after that.
The thresholds that exist
Visa's Acquirer Monitoring Program counts fraud reports and disputes against settled card-not-present transactions each month. Its fact sheet sets the Excessive Merchant level at 220 basis points with at least 1,500 fraud reports and disputes in the month in the US, Canada, Europe and Asia Pacific, falling to 150 basis points on 1 April 2026 (Visa, 14 May 2025). The advisory period ended on 30 September 2025 (Visa, 9 October 2025). A merchant above the level must put control measures in place; Stripe adds that Visa assesses fees above it. Mastercard's Excessive Chargeback Program, as Stripe publishes it, identifies a merchant at 100 to 299 chargebacks and 1.5 to 2.99 percent in a month, and a High Excessive merchant at 300 and 3 percent; assessments begin in the second month and rise, a merchant leaves after three consecutive months below the line, and one that does not remediate can lose processing (Stripe, read 20 October 2026). Mastercard divides this month's chargebacks by last month's transactions, so a month of falling sales raises the rate on its own.
Why pulls see disputes
The networks sort disputes into categories, and the categories describe the pull business without judgment. Visa's category 10, fraud, covers a cardholder who says they "did not authorize or participate in a transaction" (Visa Dispute Management Guide for Merchants, October 2026); a minor using a parent's card arrives here. Category 13, consumer disputes, covers a cardholder who took part in the purchase and later says the goods were not received, not as described, or not refunded; a buyer unhappy with what the pack held, who asks the bank rather than the platform, arrives here. Mastercard draws the same line: 4837, no cardholder authorization, and 4853, cardholder dispute (Stripe, read 20 October 2026). Every one counts toward the ratio, won or lost.
What the record should hold
For a platform report BSJ reads five things.
- The affiliate terms. The base rate, the payout cadence, and whether a clawback for refunded or disputed sales is written down.
- The refund and dispute language in the platform's own terms, including what it says about a pack once opened.
- The age and identity check at sign-up, and whether it runs before the first purchase.
- The processor named in the terms or at the checkout, and the dispute ratio if the platform discloses one.
- An independent count of what is in the vault, kept separately, because when processing stops the vaulted cards remain.
The first four are read from the platform's public pages and dated. Brich House's Platform Record carries the terms per platform. This is what BSJ reads for a platform report, and where the free report starts.
Describes published rules; not legal or financial advice.
BSJ Ventures, 20 October 2026.
← The Intelligence Center