Payments12 min readUpdated October 14, 2026

Digital Goods Merchant: How to Take Payments for Downloads, Software and Courses

The Visa MCCs for digital goods, why processors watch them, dispute evidence that wins without tracking, VAT on e-services, and how to pick a processor.

Nick Bonnassies, CMO at Tagada · checked against 14 sources

Article summary

TL;DR

A digital goods merchant sells products delivered electronically: e-books, music, films, games, apps and software. Visa gives them MCCs 5815 to 5818. Processors watch them closely because stolen cards are easy to cash out on instant downloads and there is no tracking number to win a dispute, so your evidence has to come from access logs.

Visa has four digital goods codes: 5815 media, 5816 games, 5817 apps and software, 5818 large digital goods merchants. Streaming subscriptions use 4899.
5816 is high-risk for Visa only for skill games with wagering, such as daily fantasy sports. The other digital codes aren't on Visa's high-risk list.
A digital dispute is won with logs: purchase IP, device, account and download or login after the payment. Visa lists exactly which ones count.
In the EU, VAT on e-services is due in the customer's country. A non-EU seller has no threshold and can file through the OSS non-Union scheme.
Before you sign, check the processor's own list: Stripe restricts cyberlockers, in-game currency and stored value, and prohibits skill games with prizes.

Want to go further? Ask

On this page

A shipped order ends with a tracking number. A download ends with a log line, and that log line is all you have when a bank asks whether the customer got what they paid for. Here is how payments work for a digital goods merchant: the codes Visa uses, what processors check, the evidence that wins disputes, and the tax you owe on each sale.

What is a digital goods merchant?

A digital goods merchant sells products delivered in electronic form, not shipped. Visa has four merchant category codes (MCCs) for them, and each one is defined in its April 2026 MCC manual.1

MCC	Visa name	What it covers
5815	Digital Goods Media	Books, movies, digital artwork and images, music delivered electronically
5816	Digital Goods – Games	Games delivered electronically, including games of skill and in-app purchases in games, excluding games of chance
5817	Digital Goods – Applications	Applications and software delivered electronically, excluding games
5818	Large Digital Goods Merchant	Digital goods merchants with at least 25 million transactions a year; in Europe, those at PCI DSS Level 1 with over 6 million Visa transactions a year

Some products that feel digital sit on other codes:

Streaming on subscription uses 4899, the code for pay television, radio and streaming. Visa says so in the 5815 definition.1
Computer software stores use 5734, which can also cover hardware. Visa sends sellers of mobile apps to 5817.1
Courses aren't named in the digital goods codes. Visa's 8299 covers educational courses and services not classified under a more specific code, so your acquirer decides which one fits your catalog.1
Cyberlockers and file-sharing access are sold under 4816, and that use of the code is on Visa's high-risk list.1

Digital subscriptions are not 5968

Visa's 5968 is for subscriptions sold through direct marketing. The same definition says merchants that sell subscriptions for digital goods or content may use 5815 to 5818, and streaming must use 4899.1

Which digital goods MCCs are high-risk?

Only one, and only in one case. Visa's high-risk list includes 5816 for transactions involving skill games with wagering, such as daily fantasy sports. That puts them in Tier 2 of the Visa Integrity Risk Program, with registration before the first transaction.1 Selling a game, an app or an e-book isn't on the list. See high-risk MCC codes for the full list and what each tier changes.

Your main activity sets the code
The MCC follows the activity with the most annual sales. If you sell courses and a few e-books, the courses decide, unless you get one MCC per activity.
A high-risk line gets its own code
If one product line is high-risk, such as skill games with wagering, it must run on its own MCC, separate from the rest of your sales.
One code per Stripe account
Stripe sets one MCC per account from the industry you declare and your website, and can change it after review.

Sources: Visa MCC manual, p. 19 and 21;1 Stripe Docs.7 Visa also lets acquirers grant digital goods merchants on 5815 to 5818 extra merchant locations, after they prove real business activity there, such as the location of servers.1 That matters if you want local processing in more than one country.

In some markets the code also brings 3-D Secure. Visa's rules require acquirers in Singapore to process e-commerce transactions on 5815, 5816, 5817 and 5818 with Visa Secure (EMV 3DS). Hong Kong and Macau have the same requirement for 5816.2

Why processors watch digital goods closely

The risk isn't in the code, it's in how the product is delivered. Delivery is instant, so a stolen card turns into a usable product before anyone notices. And when a customer says they never got it, there is no carrier to call.

Instant downloads and license keysA stolen card is cashed out in seconds, and keys can be resoldFraud screening before delivery, 3-D Secure on risky orders
Low-priced itemsCard testers use small payments to check stolen cardsCAPTCHA, rate limits, a login before payment
No physical deliveryNo tracking number to answer a 'not received' disputeAccess logs tied to the customer account
Subscriptions to content or softwareRenewals the customer forgot about become disputesClear terms, reminders before renewal, easy cancellation
Credits, coins and gift cardsStored value can be resold or launderedLimits per account, extra review, check the processor's policy

None of this means no. It means questions at onboarding, sometimes a reserve, and an account that is watched more closely. Our guide to ecommerce fraud prevention covers the screening layers in detail.

Card testing: the attack digital checkouts see first

Card testing is when someone checks whether stolen card numbers work by running many small payments or card setups, usually with scripts.4 Digital checkouts are a natural target: low prices, no shipping address to fake, often a guest checkout.

The damage goes beyond the fraudulent payments. Stripe lists the consequences: disputes when cardholders notice the charges, a higher decline rate that can stick after the attack stops, extra fees, and possible entry into card monitoring programs.4 Visa now counts it too. Its acquirer monitoring program flags a merchant for enumeration when both of these are reached:3 14

20%

Share of authorizations, approved and declined, identified as enumeration (2,000 basis points)

300,000

Enumerated transactions in the month, the second condition Visa requires

1.5%

VAMP 'Excessive' merchant ratio of fraud plus disputes in the US, Canada, EU and Asia-Pacific since April 1, 2026

Spot it. A spike in failed or blocked payments, in generic declines, and in small payments with nonsense names and emails.
Refund what got through. Refunding suspicious payments before cardholders notice avoids disputes.
Put a CAPTCHA on every payment and card-saving request, validated on the server.
Make the payment form harder to reach. A login or session check before payment, CSRF tokens.
Add rate limits. Cards per account, customers per IP address, purchases of the same product.
Don't retry cards from fraudulent customers. Retries in spikes with a low success rate look like card testing to issuers.

Source: Stripe Docs, Protect yourself from card testing. Most of these need code changes: show them to whoever built your checkout.

Can you sell digital products with Stripe?

Usually yes. Each processor publishes its own list of what it refuses or reviews, and that list can be stricter than Visa's. Here is what Stripe's list says about the categories a digital goods merchant runs into.5

What you sell	At Stripe
Your own digital products or content, on your own website	AllowedCreators distributing their own content don't need preapproval
A platform where creators sell exclusive content or digital goods	RestrictedNeeds review before approval
Cyberlocker and file-sharing services	RestrictedNeeds review
In-game currency or game items	RestrictedUnless you are the operator of the virtual world
Gift cards, virtual credits, stored value	RestrictedNeeds review, with possible limits
Skill games and fantasy sports with a money or material prize	Prohibited
Adult content	Prohibited
Music, films or software sold without the right license	Prohibited
"Get rich quick" offers promising high rewards for little effort	Prohibited

Verdict

Selling your own e-books, templates, software or courses is standard business at Stripe. Reselling other people's content, selling stored value or adding prizes is what triggers a review or a refusal.

Other processors have their own lists and their own reading of the same categories. Read the list of each one before you apply, and keep the answer in writing.

How to win a "product not received" dispute for digital goods

Stripe's dispute guidance says it plainly: digital products don't have trackable shipping data, so focus on evidence of usage, login or download.6 For a "product not received" dispute on a digital product, Stripe asks for:6

the customer's IP address at the time of purchase;
the customer's name and email address;
server or activity logs showing the customer accessed or downloaded the product after paying, ideally with IP addresses and timestamps;
your messages with the customer, and whether they contacted you before disputing;
anything that invalidates the claim: device location at the time of purchase, device ID, a refund already issued.

Fig. 1The evidence file of a disputed download

Dispute · Product not receivedOrder #48213 · Course bundle · $129.00

Purchase IP: 203.0.113.24 · Austin, TX
Customer: Jane Cooper · jane@example.com (account created May 2)
Access log: Login + module 1 opened 4 minutes after payment, same IP
Device: Same device ID as an earlier undisputed order
Contact before dispute: None

Illustrative record.

every line comes from your own logs

Illustrative example. Field names follow Stripe's evidence fields for digital products.

When the dispute is coded as fraud instead, Visa's Compelling Evidence rules apply. For an e-commerce sale of digital goods, Visa accepts a description of what was sold, the date it was downloaded, and two or more of these:2

IP address · Device ID number · Purchaser's name and email address linked to the customer profile held by the Merchant · Evidence that the profile set up by the purchaser on the Merchant's website or application was accessed by the purchaser and has been successfully verified by the Merchant before the Transaction Date · Evidence that the Merchant's website or application was accessed by the Cardholder for merchandise or services on or after the Transaction Date · Evidence that the same device and Payment Credential has been used in an undisputed Transaction

Visa Core Rules, Table 11-6: Allowable Compelling Evidence, item 4 (April 2026)

That list tells you what to log from day one: IP, device, verified account, logins after purchase. Fraud reports covered by Visa's Compelling Evidence 3.0 are also left out of the VAMP ratio.3 Mastercard has dedicated dispute reasons too: Stripe's mapping lists "Digital Goods Purchase of USD 25 or Less" among Mastercard's codes.6 To turn the evidence into a response, use our chargeback rebuttal letter template.

Refunds and the EU right of withdrawal

A download can't be returned, so the refund policy has to do the work a return policy does for physical goods. Two rules shape it.

EU: 14 days, unless the customer gave it up

EU consumers can cancel an online purchase within 14 days without a reason. For digital content, that right is lost once the customer expressly agreed to lose it and the download or streaming started.11 Collect that agreement at checkout, with a checkbox, and keep the record: it is your evidence if the customer later disputes.

Visa adds its own rule. A cardholder can dispute for misrepresentation when digital goods were bought through a trial, promotional period, introductory offer or one-off purchase and they weren't clearly told about further charges.2 If a one-time download quietly turns into a subscription, expect to lose that dispute. More on refunds against disputes in chargeback vs refund.

Sales tax and VAT on digital goods

Tax follows the customer, not you, in most of the markets that matter.

European Union. Digital products sold to consumers are electronically supplied services: delivered over the internet, essentially automated, with minimal human intervention.10 VAT on these sales is charged at the rate of the customer's country, and since July 1, 2021 the One Stop Shop lets you declare it all in one place.8 9

Your situation	Where VAT is due	How to file
Based in one EU country, under EUR 10,000 a year of cross-border B2C sales	Your own country, at your own rate	Your normal VAT return
Based in the EU, above EUR 10,000	Each customer's country, at its rate	Register in each country, or the OSS Union scheme: one quarterly return in your home country
Based outside the EU (US, UK…), any amount	Each customer's country, at its rate, from the first sale	Register in each country, or the OSS non-Union scheme in one EU country of your choice

Sources: European Commission OSS portal; Your Europe; Irish Revenue.8 9 10 The EUR 10,000 threshold covers the current and preceding calendar year, and Irish Revenue states it doesn't apply to suppliers established outside the EU.10

United States. There is no federal sales tax: each state decides whether digital products are taxable. New Jersey, for example, taxes "specified digital products", meaning electronically transferred audio-visual works, audio works and digital books, whether bought for permanent use or not.12 Check each state where you have customers with a tax advisor.

Or let a merchant of record carry it

A merchant of record sells to your customer in its own name. It collects and files the tax, takes the payment and handles the disputes, and pays you what's left.

Your own merchant account

You own the customer, the checkout and the payment data
You choose processors and can add more
Your name on the card statement

What you take on

VAT and sales tax registrations and returns
Disputes, fraud screening and refunds
The processor's review of your business

A merchant of record suits a small catalog selling worldwide with no tax team. Your own merchant account suits a brand that wants control over checkout, routing and customer data.

Subscriptions for digital access

Memberships, software licenses and content libraries usually bill on renewal. The card network rules are the same as for any subscription, and Visa's April 2026 rules are specific:2

CheckoutPrice, frequency and trial terms shown at consent, apart from the general terms
ConfirmationAgreement confirmed; in Europe within 2 business days
7 days beforeReminder before a trial or intro price ends, with amount, date and a cancel link
RenewalCharged on the stored card, on the terms the customer agreed to
CancellationSimple, and online if the sign-up was online

How stored cards, renewals and card updates work is covered in subscription payment processing. Billing until the customer cancels, sold through aggressive direct marketing, is the territory of negative option billing and MCC 5968.

In-app purchases: the app store comes first

If you sell inside an iOS app, Apple's rules apply before any processor's. Apple's App Review Guidelines require in-app purchase to unlock features or content inside the app, such as subscriptions, in-game currencies, game levels or premium content. Apps on the US storefront may include buttons and links to other ways to pay. Elsewhere, a link to an outside purchase needs a StoreKit entitlement that Apple offers only in some countries.13 Selling on your own website, outside the app, is where your own checkout and processor take over.

How to choose a payment processor for digital goods

Every vendor page in this space lists the same features. These are the questions that separate them, in the order to ask them.

Which MCC will you give me, and why? 5815, 5816, 5817, 5818, 4899 or 8299 change the reviews, and sometimes 3-D Secure.
Is my product on your prohibited or restricted list? Stored value, in-game items, file sharing and third-party content are the usual triggers.
Will there be a reserve, how much and for how long? Ask how it's released and what makes it grow.
Which evidence fields can I send in a dispute? IP, device ID, access logs. Check that your logs can feed them automatically.
What fraud tools are included? 3-D Secure, CAPTCHA on the payment form, velocity rules, a rules engine you can edit.
Who handles VAT and sales tax? You, a tax tool, or a merchant of record.
How are renewals handled? Stored credentials, card updater, retries that follow network limits.
Can I export my customers' cards if I leave? Without that, changing processor means asking every subscriber for their card again.

Use the answers in writing: a policy that changes later is easier to contest when you have it on file.

What a second processor is for, and what it isn't

A second processor keeps you selling during a review or an outage. It isn't a way to dodge a decline or a monitoring program. Visa forbids changing the acquirer, country, MCC or other authorization data when retrying a declined payment (rule 1.7.2.1), and fines acquirers up to USD 25,000 a month per merchant when a merchant's name, data or performance is altered to avoid VAMP or the Integrity Risk Program (rule 12.5.3.2).2

Where Tagada fits

How Tagada helps

One checkout for your digital catalog, more than one processor behind it

Tagada routes payments across TagadaPay and processors such as Stripe, NMI and Airwallex, with one logic and a cascade to another processor when one is down or times out. The card vault lets you switch processors without re-onboarding customers, so running subscriptions keep charging. The checkout runs native 3DS2, device intelligence and a rules engine, plus subscriptions with trials, billing cycles, retries and automatic recovery, and one-click upsells. Every TagadaPay account is underwritten, and deceptive trial and subscription marketing is refused. See pricing for plans. Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Apply for processing

Updated on October 14, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What is a digital goods merchant?

A business that sells products delivered in electronic form, such as e-books, music, films, digital art, games, in-game items, apps and software. Visa classifies them under MCCs 5815 to 5818. Streaming subscriptions are classified separately under 4899, and educational courses can fall under 8299 when no more specific code applies.

What does 'Large Digital Goods Merchant' mean on my card statement?

It's the Visa name of MCC 5818, the category code for digital goods merchants with at least 25 million transactions a year (outside Europe). It names a type of business, not a company. Open the transaction in your banking app to see the merchant's name, and ask your bank if you still don't recognize it.

Are digital goods high-risk for payment processors?

Not on Visa's list, except MCC 5816 for skill games with wagering, which is Tier 2. Processors still watch digital goods closely: stolen cards are easy to cash out on instant downloads, card testing targets small payments, and there is no shipment to prove delivery. Expect fraud screening, 3-D Secure and questions about refunds.

Can I sell digital products with Stripe?

Yes, in most cases. Creators selling their own content on their own website don't need preapproval. Stripe restricts platforms selling third-party content, cyberlockers, in-game currency sold by anyone other than the game operator, and stored value such as gift cards. It prohibits skill games with prizes, adult content and unlicensed media.

Do I have to charge VAT on digital products sold to EU customers?

Yes. VAT on electronically supplied services sold to consumers is due at the rate of the customer's country. EU sellers can stay on their home VAT below EUR 10,000 a year of cross-border sales; non-EU sellers have no threshold. The One Stop Shop lets you register once and file one quarterly return for all EU countries.

How do I win a 'product not received' dispute for a download?

Show that the customer got access after paying: purchase IP address, customer name and email, and server or activity logs with IP addresses and timestamps of the download or login. Add your refund policy and any messages with the customer. For fraud claims, Visa's Compelling Evidence rules list which data points count.