Understanding merchant underwriters - The gatekeepers of the payments ecosystem

Merchant risk analysis, merchant due diligence, or merchant underwriting—all of these describe one activity: investigating a merchant account before onboarding them as an acquiring bank or payment provider client.

The people doing the vetting are alternatively called analysts, risk managers, compliance officers, or underwriters. They are tasked with assessing the risks associated with merchants, ensuring compliance, and preventing fraud. From understanding business models to tackling challenging cases, their role is both complex and essential.

Anyone who aims to understand the payment ecosystem better can learn a great deal from its gatekeepers.

How does one become a merchant underwriter?

The path to working in merchant risk isn’t always straightforward. Like most things in life, it’s a matter of chance and timing. There is no vocational training path that leads one to this profession. At Web Shield, we asked some of our own underwriters how they got where they are today. Some, like 10-year veteran Philipp Jostkleigrewe, got there by coincidence. Others, like his equally experienced colleague Michael Hartfiel were drawn to underwriting because of its depth: “The broad spectrum of related topics and opportunities to dive deeper into industry standards appeared quite interesting to me, which is why I am still working as an Underwriter.”

As underwriters get more involved in the work, the variety of tasks becomes one of the key elements that makes the role so attractive. For Philipp, it’s not just about ticking off a list of tasks; it’s about thoroughly understanding each unique case like a detective. Different underwriters often have their own way of tackling the problem in front of them or adopt different stances for different types of merchants. He explains: “If a website or application is available, I like to start from there. Do the business model, the products, the pricing, etc., make sense?” This focus on a common sense understanding of how a merchant generates revenue sets the foundation for any further investigation into potential risks.

An analytical mind, a keen eye for detail, and curiosity

As mentioned, underwriting isn’t simply about ticking off risk factors; it’s about assessing vast amounts of data and finding patterns that could indicate potential threats. The skill set required is multifaceted. For Marcus Schurig, another long-time underwriter at Web Shield “analytical skills are key. Underwriters need to evaluate information from many sources, balancing risk against caution.” The ability to spot inconsistencies or red flags in merchant data is crucial. “Red flags can be anything unusual that should be investigated,” ads Michael.

Philipp stresses that, in addition to analytical skills, you need to be well-versed in card scheme regulations and able to quickly interpret business models: “An underwriter needs to be knowledgeable about card scheme rules and regulations, possess the ability to quickly interpret different business models and their implications, and have an eye for detail as every bit of information might matter.”

The party store selling more than balloons

The world of underwriting is far from predictable. Every case brings its own set of challenges, and sometimes, the road to resolution can be long and complex. Gabriela Cernalev, one of the youngest members of the Web Shield underwriting team, recounts one particularly tough case: “A recent extensive crypto case involved sanctions breaches and links to illegal gambling and steroid sales. The complexity was compounded by the merchant’s corporate structure, spanning multiple entities in several European and Asian jurisdictions.” Despite a thorough investigation, the merchant returned months later under a new identity. “It’s a reminder that you always need to be vigilant,” she reflects.

Some cases can be downright bizarre, and for another of our Web Shield underwriters, Philipp Rauchbach, one in particular has stuck in his mind. “There was a case when I started underwriting around nine years ago. It’s not particularly tough by today’s standards, but it’s the one that’s just stuck in my mind,” he recalls. It all started with what seemed like a harmless piñata and party supplies website—until Web Shield’s crawler flagged pharmaceutical and drug-related keywords like “fentanyl” and “MDMA.” “But I couldn’t find them,” Philipp recalls. He wasn’t alone—his colleagues started looking too, each coming up empty-handed. The mystery deepened until one of them tested the most straightforward approach. “A simple Google query that combined the website name with the intent to buy drugs led to a hidden link where you could buy pharmaceuticals galore.”

That’s when the full picture came into focus. What appeared to be a cheerful party shop was actually fronting an illicit drug marketplace. “It was a funny case, imagining these piñatas being filled with cocaine or ecstasy,” Philipp laughs. While far from the toughest case he’s faced, it’s a perfect example of how even the most innocent-looking businesses can hide serious risks. Transaction laundering remains a problem in the industry, even almost a decade after Philipp popped this particular piñata.

How underwriters succeed in their role

Underwriting is often a game of cat and mouse. Fraudsters adapt, so underwriters have to stay one step ahead. “It’s like a classic arms race,” says Philipp. “Underwriting tools get better, and fraudsters find new ways to hide their actions.” The constant evolution keeps things interesting—there’s always a new scheme to uncover, a new tactic to counter.

For Marcus, the reward is more immediate. “It’s the smaller successes that make me proud, like when a website offering illegal products shuts down after our intervention.” Seeing the direct impact of his work makes the challenges worthwhile.

Some days are exciting. “It feels like being a detective, piecing together clues,” says Gabriela. Others… not so much—like in every other job. Michael simply enjoys the breadth of topics. KYC, fraud detection, regulations—it’s an ever-expanding field with plenty to learn.

No two underwriters have the same motivation, but whether it’s solving cases, staying ahead of fraud, or mastering the complexities of compliance, the job offers plenty of ways to stay engaged.

Going head-to-head with fraudsters

The role of an underwriter is never static. With each case, there are new challenges, new risks, and new opportunities to learn. As Michael puts it, “The role of underwriting evolves from day to day with every new challenge that was tackled successfully.” Whether it’s adapting to new regulations or dealing with more complex cases, underwriters are always evolving.

However, underwriting isn’t always about going head-to-head with fraudsters. Sometimes, merchants that seem risky on the surface aren’t necessarily engaging in fraudulent activities. In fact, some of the most challenging cases are those where the merchant appears high-risk but is operating within legal boundaries. As Marcus explains, “Underwriting is about managing risk, not eliminating it entirely.” This distinction is crucial, as not every risky merchant is acting with fraudulent intent. The task for underwriters is to assess whether the merchant poses a legitimate risk, and if so, how that risk can be managed.

Marcus elaborates further on a common misconception: “There’s a cliché that underwriting is always risk-averse: some think that underwriters simply say 'no' to high-risk businesses. In reality, many underwriters approve high-risk merchants, but they may require additional conditions like higher reserves, insurance, or ongoing monitoring to mitigate potential losses.” In these cases, it's about finding a balance between accepting high-risk businesses and ensuring protective measures are in place. Understanding the business model, transaction history, and other risk factors helps underwriters identify merchants that may appear risky but are still acting within the law.

Underwriting is a journey of continuous growth, learning, and vigilance. It’s a role that requires sharp analytical skills, an eye for detail, and a deep understanding of business models and risk. For those who thrive in this environment, the rewards are significant—both professionally and personally.

What it really means to be an underwriter

Underwriters are investigators, analysts, and advisers rolled into one, piecing together fragmented data to reveal a merchant’s true risk. Every case presents a new puzzle, and as Philipp Rauchbach puts it, "No two days are the same. Well, they all start with coffee, but after that, it depends on what unfolds." This unpredictability defines the role—one moment, it's a straightforward verification, and the next, it's uncovering a hidden risk that could have serious consequences.

It’s a job that demands vigilance, adaptability, and an instinct for deception. Fraudsters refine their tactics, regulations shift, and technology evolves, but underwriters remain the first line of defence. They don’t just look at the data—they look beyond it, questioning what doesn’t add up. Web Shield’s investigative tools help make sense of complex risk signals, but it’s the underwriters who connect the dots, ensuring risk isn’t just managed but truly understood.