These are the findings that come up repeatedly. Every one is real and every one is checkable against your own statement.
Terminals billed after they were decommissioned
A site closes or re-fits, the hardware goes back or goes in a cupboard, and the rental line carries on. Nobody notices, because nobody receives an invoice.
PCI non-compliance fees
Charged monthly when a self-assessment questionnaire has not been completed. Entirely avoidable — the questionnaire is administrative rather than technical for most merchants. This fee is pure penalty for paperwork not done.
Card-present transactions routed as card-not-present
A point-of-sale configuration error means transactions taken with the card physically present are processed as though they were taken online. Card-not-present carries materially higher interchange and higher fraud exposure. Invisible on the shop floor and obvious in the data.
Commercial and corporate cards
Excluded from the EU interchange caps and costing several times what a consumer card costs. If you serve businesses — hotels taking corporate bookings, wholesale, trade counters — the mix matters, and it is worth knowing what proportion of your turnover it represents.
UK-issued cards used online
Since Brexit, a UK-issued card used in a card-not-present transaction with an Irish merchant carries interchange of 1.15% on debit and 1.50% on credit, against 0.20% and 0.30% for Irish and EEA consumer cards. If you take online bookings from UK customers this is a real line in your cost base, and it is rarely visible under blended pricing.
Authorisation misuse fees
Charged when an authorisation is never cleared or reversed within the scheme’s window. Endemic in hotels and restaurants, where pre-authorisations are taken at check-in or on opening a tab and then never properly closed off. The fee is small and the volume is not.
Duplicate compliance and admin fees per merchant ID
In a multi-site estate the same monthly charge is often applied separately against every merchant ID, whether or not the underlying service is delivered separately.
Blended pricing
One rate for everything, interchange invisible inside it. You cannot audit what you cannot see, which is the point of the structure.