By Rolian Ruiz, Founder / CTO Strictly

If you run a cosmetic surgery practice in Miami-Dade, Broward, or Palm Beach County, you already know the rhythm, a patient signs a quote for $18,000, puts $4,000 down on a Visa, finances the rest, shows up six weeks later, has the procedure, recovers, and somewhere between week two and week six of recovery, when the swelling is at its worst and the patient is convinced something went wrong, a chargeback notification lands in your inbox.

Multiply that by a few patients a month, scale it across a busy practice that pre-collects $2M a month, and you start to understand why acquiring banks treat Florida cosmetic surgery as one of the most scrutinized verticals in card-not-present healthcare. This is not paranoia from the bank’s part, but the data supports it. Also, it means that practices doing things correctly, surgically, ethically, and operationally, get caught in the same risk net as the bad actors.

This article is for the practices doing it right. We’ll walk through what acquirers actually see when they look at your portfolio, why deposits are the single biggest risk variable, how 3DS is causing more harm than good for smaller issuers, why EMV and card-present transactions remain your strongest defense, and the operational practices that keep merchant accounts open instead of frozen.

The View from the Acquiring Bank

When an acquiring bank, Elavon, Worldpay, Fiserv, TSYS, or any sponsor bank underwriting a payment processor, looks at a cosmetic surgery merchant, they see a profile that triggers almost every internal risk model they have:

• MCC 8011 or 8099 (medical services / health practitioners not elsewhere classified), with elective procedures pushing the file toward high-risk underwriting regardless of the doctor’s credentials.
• Average ticket sizes between $4,000 and $25,000, far above the healthcare median.
• Future delivery exposure the patient pays today for a service rendered weeks or months later, which is the textbook definition of a high-risk transaction structure.
• Card-not-present concentration, often above 70% of volume, because deposits are taken over the phone, through patient financing portals, or via emailed payment links.
• Chargeback ratios that historically run between 0.8% and 1.5% in this vertical, against a Visa threshold of 0.9% (VDMP) and a dispute-monitoring trigger at 0.65%.
• Cash flow asymmetry the merchant collects $2M up front, but the operating account routinely shows a balance closer to $200K because surgical supplies, anesthesiologists, facility fees, and payroll consume the rest before procedures are performed.

That last point is the one that gets practices into trouble fastest. From the bank’s perspective, a merchant holding 10% of collected funds in available reserves, with the rest already deployed to vendors and payroll, has no cushion to absorb a chargeback wave. If twenty patients dispute $15,000 each in a single month, entirely plausible after a bad Yelp cycle or a viral TikTok about a single botched outcome, that’s $300,000 in liability against $200,000 in operating cash. The bank now has unsecured exposure, and underwriting will respond accordingly: rolling reserves, delayed funding, or in the worst cases, MATCH listing the principals.

The Deposit Problem

Deposits are the financial instrument that built modern aesthetic surgery, and they are also the structural weakness that makes the vertical so risky.

The standard Florida model, collect 25% to 50% on consultation, balance due seven days before surgery, works beautifully for cash flow but creates a window of dispute exposure that lasts the full 120 day Visa chargeback timeframe from the date of service, not the date of payment. A patient who paid a $5,000 deposit in February for a July surgery has chargeback rights running into November. That’s nine months of liability on a single transaction. If the patient cancels, ghosts, or has a complication, the practice is defending a transaction that happened three quarters ago against a card network that overwhelmingly favors the cardholder in cosmetic medicine disputes.

Compounding this: many practices apply deposits to non-refundable consultation fees, surgical scheduling fees, or “supply ordering” charges. These line items are legally defensible in Florida, the Florida Deceptive and Unfair Trade Practices Act allows non-refundable fees if disclosed clearly, but they do not survive Visa or Mastercard dispute arbitration. The card networks apply their own consumer protection standards, and “service not rendered” wins almost every time the patient claims they never received the surgery, regardless of what the consent form says.

The Good

Before the rest of this gets darker, it’s worth saying clearly: cosmetic surgery is one of the most rewarding verticals in healthcare payments when it’s structured correctly.

• Margins are strong enough to support proper risk infrastructure. Unlike thin-margin specialties, a well-run practice can afford tokenization, recurring billing rails, fraud scoring, and dedicated chargeback representment without the cost crushing the P&L.
• Patient demographics skew toward affluent, repeat customers. A satisfied breast augmentation patient often returns for a tummy tuck, a mommy makeover, and eventually a facelift. Lifetime value in this vertical can exceed $80,000 per patient, which justifies investment in the payment experience.
• Card brands now offer specialized programs. As of April 2026, Visa’s Commercial Enhanced Data Program (CEDP), integrated with Compelling Evidence 3.0 (CE3.0), provides specialized tools for cosmetic merchants to defend against “service not rendered” and fraud disputes, provided detailed transaction data is captured at the point of sale. This, combined with Visa’s new AI-powered tools, enables merchants to fight illegitimate chargebacks more effectively by proving the customer was present, authorized the transaction, and received the services.
• Patient financing has matured significantly. Avvance, CareCredit, and Cherry now absorb a meaningful portion of the credit risk that used to sit on the practice’s merchant account, shifting chargeback exposure to the lender.

When a practice combines strong clinical outcomes with disciplined payment operations, the merchant account becomes a competitive advantage rather than a liability.

The Bad

The bad is what gets practices terminated.

• Reserve impositions can choke working capital overnight. A 10% rolling reserve on $2M monthly volume means $200K sitting at the acquirer for 180 days. Practices that didn’t model this collapse when the reserve hits.
• Chargeback fees stack on top of disputed amounts. Each chargeback runs $15 to $25 in network and acquirer fees, plus representment costs, plus the loss itself if the dispute fails. A practice with twenty disputes a month is paying $400 to $500 just in fees before any losses.
• Excessive chargeback programs (VDMP, VAMP, Mastercard ECP) carry monthly fines and compliance review fees ranging from $25,000 to over $100,000 if the merchant doesn’t exit the program within the cure period.
• MATCH listings end careers, not just merchant accounts. A principal added to the Mastercard MATCH list for excessive chargebacks remains on the list for five years and is effectively unbankable for card processing during that period, even at unrelated businesses.
• Class action exposure is real. Florida has seen multiple putative class actions against cosmetic surgery groups for deposit refund practices, and the discovery process in those cases routinely exposes payment data, leading to follow-on PCI scope problems.

Loss Prevention Reality on the Ground

Most practices don’t have a loss prevention function. The office manager handles chargebacks between insurance verifications and payroll. This is where it falls apart.

Effective loss prevention in cosmetic surgery requires three things almost no single-location practice has natively:

1. A documented dispute response workflow with sub-15-day turnaround
2. A tokenized payment vault that captures pre-authorization and AVS match data on every transaction
3. A representment package template that meets Visa CE 3.0 evidence standards

When a practice gets a chargeback and responds with a copy of the consent form and the surgeon’s notes, it almost always loses. When a practice responds with the consent form, the AVS+CVV match record, the IP address and device fingerprint from the booking session, the email confirmations with read receipts, the pre-op and post-op photo timestamps, the appointment check-in record from the EHR, and the same patient’s prior compliant transaction history – it wins. The difference is process, not luck.

This is not optional infrastructure for a practice doing $5M+ a year in card volume, but it is the price of staying open.

3DS and the Small-Issuer Friction Problem

Three-Domain Secure (3DS), specifically 3DS 2.x, was sold to merchants as the answer to card-not-present fraud. In some verticals it has delivered. In aesthetic surgery, especially in Florida, the rollout has created a new problem: friction at the wrong banks.

Large issuers, Chase, Bank of America, Capital One, Citi, Amex, have invested heavily in frictionless 3DS, where the issuer authenticates the cardholder silently using device fingerprinting and transaction history. The patient never sees a challenge screen. Approval rates stay high.

Smaller issuers, community banks, credit unions, and many of the regional banks that Florida’s diverse patient base actually uses (especially patients from Latin America paying with cards issued in Colombia, Venezuela, Brazil, and Mexico), have implemented 3DS as a hard challenge. Every transaction over a certain threshold triggers an SMS one-time-passcode or an in-app push that often fails to arrive. The patient gives up and the merchant loses the booking.

We have seen practices report 20% to 35% drop-off on deposits over $5,000 routed through 3DS to small issuers. The fraud reduction is real, but the false decline rate erases the gain. The right answer is selective 3DS, challenge only on risk-flagged transactions, exempt low-risk recurring patients via TRA (Transaction Risk Analysis) exemption, and route known good cards through frictionless flows. This is a configuration decision, not a default, and it requires a gateway like Strictly that supports granular 3DS routing rules.

Why EMV and Card-Present Should Be Your Default

The single most underused tactic in this vertical is bringing patients into the office to swipe, dip, or tap a card before the procedure.

Card-present transactions carry a fundamentally different risk profile than card-not-present. EMV chip authentication shifts liability to the issuer for counterfeit fraud, the interchange rate drops by 50 to 100 basis points, and chargeback rights for the cardholder are dramatically narrower. A patient who dipped their card at the front desk on the day of surgery cannot file a “card not present fraud” dispute. They cannot claim “I didn’t authorize this transaction” with any credibility. The dispute reason codes available to them shrink to service-quality grounds, where the merchant’s documentation actually matters.

The practical recommendation is straightforward: take deposits remotely if you must, but charge the balance card-present at the pre-op visit. Use an EMV-certified terminal, the PAX A920 Pro, the Ingenico Lane series, or a Verifone Engage running POSLink-integrated software, and capture the chip dip on the final transaction. The reduction in chargeback exposure on the largest portion of the ticket pays for the workflow change within a single quarter.

For practices already on cloud-based EHR systems, integrated terminals that pull patient and procedure data from the chart and post the payment back automatically eliminate the friction objection. Front desk staff scan a chart, the terminal pre-populates, the patient taps, the receipt prints, and the EHR is updated. This is standard infrastructure in 2026.

Best Practices: A Working Playbook for Florida Practices

The following is what we recommend to every cosmetic surgery merchant in our portfolio. None of it is theoretical.

1. Underwriting and account structure, disclose elective surgery clearly to your processor at onboarding. Hidden MCC misclassification gets accounts shut down faster than honest high-risk underwriting. Negotiate reserve terms in writing and understand exactly when they release. If your processor refuses to put reserve mechanics in the merchant agreement, find a different processor.
2. Deposit handling, cap deposits at 25% of total contract value where commercially viable. Take deposits on a tokenized card that you can re-charge for the balance, rather than running a fresh authorization weeks later. Never refund a deposit by issuing a new charge to a different card, always refund to the original payment method, no exceptions, even if the patient asks.
3. Documentation discipline, capture AVS and CVV on every transaction. Save the IP address, device fingerprint, and session timestamps from any online booking. Have the patient sign a separate cosmetic procedure financial responsibility form that explicitly references the cardholder agreement and the right to dispute. Photograph the patient’s ID and credit card (front only, last four visible) at the in-person consultation, with written consent. Time-stamp pre-op photos and store them with the payment record.
4. Chargeback workflow. Respond to every dispute within 10 days, even unwinnable ones, the response rate itself is a metric acquirers track. Build a representment template aligned to Visa CE 3.0 and Mastercard’s First Party Trust framework. Invest in a chargeback management platform (Chargebacks911, Midigator, Verifi CDRN) for any practice processing over $3M annually.
5. Card acceptance mix Push card-present where possible, use 3DS selectively. Tokenize everything. Offer patient financing through Avvance, CareCredit, or Cherry as the primary path for ticket sizes over $10,000, let the lender carry the credit risk and the chargeback exposure. Accept ACH for balance payments where the patient is established and trusted, with proper NACHA-compliant authorization on file.
6. Operational reserves, keep at least 20% of trailing 90-day card volume in liquid operating reserves. This is non-negotiable insurance against a chargeback wave or a processor reserve imposition. Practices that run lean on cash get terminated when the cycle turns.
7. Vendor selection, work with a Strictly Team and processor that understands healthcare-adjacent high-risk underwriting, holds Level 1 PCI DSS certification, and support EMV-certified terminals, tokenization, recurring billing, ACH, and selective 3DS routing under one platform. Splitting these capabilities across multiple vendors creates reconciliation gaps and PCI scope problems.

The Florida Context

Plastic surgery in Florida is not the same business as plastic surgery in Phoenix or Dallas. The patient mix includes a high percentage of medical tourists, foreign cardholders, cash-equivalent transactions, and procedures performed at AAAASF-accredited ambulatory surgery centers rather than hospitals. The regulatory backdrop includes the Florida Board of Medicine’s heightened scrutiny on office-based surgery following high-profile fatality cases in Miami-Dade. The competitive landscape pushes practices toward aggressive marketing, financing offers, and price competition that compresses margins and increases volume, which means more transactions, more deposits, and more chargeback exposure.

Practices that win in this market in 2026 are the ones treating payment operations as a clinical-grade discipline. The same surgeon who wouldn’t tolerate a sloppy OR doesn’t tolerate a sloppy chargeback response. The same medical director who runs M&M conferences runs monthly chargeback reviews. The infrastructure is boring, the process is repetitive, and the result is that the merchant account stays open while competitors get terminated.

If you are running a Florida cosmetic surgery practice and you have read this far, the takeaway is simple: your payment stack is not a back-office cost center. It is the difference between scaling profitably and waiting for the underwriting letter that ends the business.

About Strictly

Strictly Payment Processing is a Level 1 PCI DSS certified payment gateway operating on Elavon and U.S. Bank infrastructure. We support healthcare practices, automotive retail, and ISO partners across the United States with surcharging, dual pricing, cash discount, ACH, and integrated EMV terminal programs. To discuss merchant services structured for elective healthcare and cosmetic surgery, reach our healthcare team at strictlyzero.com.

This article is provided for informational purposes and does not constitute legal, financial, or compliance advice. Practices should consult qualified counsel and their payment processor regarding specific underwriting, chargeback, and PCI obligations.