Billing a White-Label VPN: Cards, Tax, and Failed Payments

A payment platform moves cards. A merchant of record is the legal seller on the statement. Those jobs get mashed together in pitch decks. They should not be mashed in your head.

If your company name is on the Visa descriptor, you own disputes, refunds, tax registration, and the angry email. If another company is merchant of record, you may get a cleaner night and less control over pricing, refunds, and how the charge looks. White-label usually means you want the brand on the app. That often means you want to be merchant of record. Sometimes it means you want a MoR partner because you cannot open a merchant account yet. Both can be adult choices. Mixing them in the same checkout without a lawyer and a processor who agrees is how users pay the wrong entity and then dispute both.

A VPN subscription is a digital service. Banks treat digital services as high-risk when the product is 'privacy' and the user forgot they subscribed. Plan for that forgetfulness. It is not a moral failure. It is the category.

Chargebacks that say 'unrecognized' are often a descriptor problem. CRYPTO*KLOX or a random LLC name the user has never seen will lose. Use a descriptor that matches the brand on the app and the URL on the receipt. Put the URL in the email. Put cancel instructions in the email. This is not copywriting fluff. This is evidence.

If you run multiple brands on one merchant account, descriptors collide. Users search the charge, land on the wrong site, and dispute. Separate merchants or painfully clear descriptors. I prefer separate. Painful is cheaper than a 1% dispute rate.

Soft declines are 'try again': insufficient funds, issuer timeout, suspected fraud that might clear. Hard declines are 'this card is done': lost, stolen, do not honor, account closed. Your retry logic should not treat them the same. Retrying a stolen card is how you look like a criminal to the issuer.

Dunning is the sequence of emails (and in-app banners) that ask the user to update the card before you pause the tunnel. I like 3–7 days of retries with clear copy, then pause, then cancel if still dead. Infinite grace creates freeloaders. Instant lockout on the first fail creates chargebacks from people who were traveling and whose bank declined a foreign merchant.

Write the copy yourself. 'Your payment failed' is incomplete. 'Your VPN will pause on Thursday if we cannot charge the card on file; update it here' is a runbook. Include the brand name and the amount.

VAT and sales tax will turn a pretty $4.99 into $5.99 if you display inclusive, or into a nasty surprise if you add it at the last step. Pick a display rule and keep it. Digital services sold into VAT countries often need collection. This is not legal advice. It is a warning that processors and marketplaces will freeze you faster than a tax authority will write a nice email.

Use a tax engine if you sell in more than a handful of countries. Do not hardcode 20% for 'Europe' and hope. Hope is how you under-collect and then owe. Over-collecting without a registration is also a mess. An accountant for your geos is cheaper than a payout freeze.

FX is a cousin of tax. If you price in one currency and pay hosts in another, a thin margin dies on a bad month. That is still billing ops.

Card networks group disputes: fraud, product not received, not as described, subscription cancelled, credit not processed. VPN merchants see a lot of 'I don't recognize' and 'I cancelled.' Your pack should include: checkout timestamp, IP/country if you store it for billing (this is account data, not browsing history), terms accepted, emails sent, whether the app was used, refund policy, and whether you already refunded.

Do not invent traffic logs to win a dispute. If your no-logs story says you cannot show destinations, do not suddenly produce destinations for Visa. Produce what you actually keep: account, invoices, device count, maybe last-authenticated-at if the admin has it. Inconsistency here is how a journalist and a bank both get interested.

Treat a dispute rate climbing toward 1% of transactions as an emergency. Processors vary. Fix descriptors, cancel UX, and traffic quality before you write a manifesto to Visa.

Klox consumer is seven days. Your brand can differ. Fast refunds inside the window prevent many chargebacks. Slow refunds to 'save' a month of cash buy you a $15–$25 dispute fee plus the amount plus a risk score.

App Store and Play refunds follow store rules if the user paid there. Do not refund web and store for the same period unless you enjoy donating. Your support macro should ask where they paid before you hit refund on the processor.

Partial refunds on annual plans need a written rule. Pro-rata sounds fair and creates arguments. Full-then-none is cleaner if the window is short.

If you sell through store billing, their price tiers, cuts, and refund buttons apply. Your web price and your store price will drift if nobody owns the matrix. Users pick the cheaper path and then ask for the other path's features.

Store refunds will not fire your Stripe webhook. Your entitlement system must listen to both, or you will have users who refunded in Play and still have a live tunnel, or worse, users who paid and got cut because the web subscription ended. This is plumbing. It is also how you lose a merchant account if entitlements look like you are double-charging.

Dashboards you need in week one: authorization rate, decline reasons, retry recovery, refund rate inside window, refund rate after window, chargeback count and reason, tax collected versus expected, dunning emails sent versus cards updated, tickets tagged 'billing.' If you cannot see decline reasons, you cannot tell a bank problem from a descriptor problem.

Set alerts. A day of 0% auth is an outage. A week of climbing 'fraud' declines is a traffic-quality problem. Do not wait for the processor's weekly email.

TLS on your checkout matters because you are sending card data through someone else's hosted fields. Cite boring standards if you must: RFC 8446 is TLS 1.3. Do not turn that into a security badge. Turn it into 'we are not rolling our own card form.'

Be MoR if you want control, brand on the statement, and the margin that comes with doing the work. Pick a MoR partner if you cannot get a merchant account, if VAT across twenty countries will eat the team, or if you are still validating a niche and do not want a processor relationship yet.

MoR partners take a cut and set rules. Some will not let you sell VPN at all. Some will. Read the acceptable-use list before you design the homepage. Switching MoR later means every subscriber may need a new checkout. That is a migration, not a toggle.

Reseller is the calmer cousin: you sell Klox, Klox (or our program terms) owns more of the billing mess. Less brand. Fewer 2 a.m. packets. Choose on purpose.

Before paid traffic: descriptor approved, receipt template, tax display rule, dunning sequence, grace and pause behavior, refund macro, store-versus-web matrix, chargeback mailbox watched, 3-D Secure policy, test cards in live-like mode, a human who owns the Stripe (or other) dashboard on weekends.

Before you scale spend: chargeback reason report, affiliate clawback terms, a buffer for rolling reserve, and a written rule for annual refunds. If this list feels heavier than choosing WireGuard versus OpenVPN, good. The protocols are the delivery truck. Billing is the company.

Klox consumer remains five devices, both protocols, from $2.83 a month, seven-day money-back. Your brand can look similar on the product and still fail on cards if you skip this list. I would rather you launch a week late with a descriptor that matches than launch tomorrow with a charge that says LLC-random. One more habit: a weekly billing review that is not a revenue celebration. Thirty minutes. Authorization rate. Top decline codes. Refunds inside versus outside the window. Open disputes. Dunning recovery. Store versus web mismatch tickets. If that meeting only happens after a processor warning, you are already late. The warning lags. The dashboard was screaming two weeks earlier and nobody had a calendar block.

Europe in particular will ask the cardholder to approve a charge. That is Strong Customer Authentication, usually implemented as 3-D Secure. It cuts some fraud. It also drops people who are on a train with a dying phone and a bank app that hates them. You will feel this on monthly renewals more than on the first checkout, because the first checkout is when they are staring at the screen.

Decide where you require it: first charge always, renewals when the issuer demands it, high-risk countries, or never until the processor forces you. 'Never' is how you get a sudden mandate and a week of dead renewals. 'Always' is how you lose honest travelers. I like: first charge yes, renewals when the issuer or Radar-like tool says so, and a dunning email that explains 'your bank asked us to confirm' instead of 'your payment failed' which sounds like you stole money.

This is still not a Klox-is-Stripe claim. Whatever processor you use, ask how SCA is configured before you buy ads in the EEA. Finding out in week two is a cash event.