Control card spending
Last updated: June 19, 2024
Card spending controls help you to manage your card spending budget and prevent fraud. You do this by applying controls to a card.
A control can contain one of the following rule types:
- a merchant category code (MCC) allowlist or blocklist rule, which determines the types of businesses a card can process transactions from
- a merchant identifier (MID) allowlist or blocklist rule, which determines the merchants a card can process transactions from
- a velocity spending limit, which determines how much a card can spend over a given period of time - optionally, you can add a list of MCCs and MIDs to a velocity limit
For example, you can apply a control that allows a card to spend up to €500 per month at food businesses.
Information
Alternatively, you can create a control profile to apply a set of rules to a group of cards.
You can apply multiple controls to a card, but the strictest control will always override the others. In the following example, the second control overrides the first control:
- allow the card to spend up to €500 per month at food businesses
- limit the card's overall spending to €400 per month
Controls can be set per card, so a cardholder can have a unique set of spending controls applied to each card they've been issued.
Alternatively, a control can be applied to a group of cards using control profiles. To do this, set the control profile as the control's target and add cards. There is no limit on the number of cards that can be added. Each card will be assessed individually against the control profile.
Information
Depending on your card program configuration, you may have pre-configured client controls. These controls are global and apply to every card product or card you create. Contact your Account Manager or [email protected] for more information.
Transactions approved before controls are created are not affected by the controls. If a velocity limit control is deleted and recreated, the remaining amount is reset and tracked as per the new control.
If you want to apply spending controls to an individual card, you'll need to retrieve the card's ID and use it as the target for the control.
If you've just created a card, you'll find the card ID in the response's id
field.
Alternatively, you can use the following endpoint to retrieve a list of cards issued to the specified cardholder:
get
https://api.checkout.com/issuing/cardholders/{cardholderId}/cards
1{2"cards": [3{4"id": "crd_fa6psq242dcd6fdn5gifcq1491",5"cardholder_id": "crh_d3ozhf43pcq2xbldn2g45qnb44",6"card_product_id": "pro_7syjig3jq3mezlc3vjrdpfitl4",7"client_id": "cli_vkuhvk4vjn2edkps7dfsq6emqm",8"last_four": 1234,9"expiry_month": 5,10"expiry_year": 2025,11"status": "active",12"display_name": "John Smith",13"type": "virtual",14"billing_currency": "USD",15"issuing_country": "US",16"reference": "X-123456-N11",17"created_date": "2021-09-09T19:41:39Z",18"last_modified_date": "2021-09-09T19:41:39Z"19}20]21}
From the list of cards returned in the response, make a note of the id
value of the card you want to apply spending controls to. If you want to apply controls to a control profile, you'll need to retrieve the control profile ID and use it as the target for the control.
A velocity limit determines how much a card can spend over a given period of time.
- In your Dashboard, go to the Card Issuing > Cards screen.
- Select the card you'd like to apply the velocity limit to. You can use search or filters to help find the card.
- In the Card details screen that appears, scroll to Controls and select Add controls, or Edit if the card already has controls.
- Select Add control in the Velocity controls section.
- In the screen that opens, choose the time frame and amount.
- Optionally, you can add merchant category codes.
- Select Confirm to save.
Use the API to apply a velocity limit. For example, you can apply a velocity limit that limits the monthly spend to 1000 EUR:
post
https://api.checkout.com/issuing/controls
1{2"description": "Limit spend to €1000 per month",3"control_type": "velocity_limit",4"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",5"velocity_limit": {6"amount_limit": 1000,7"velocity_window": {8"type": "monthly"9}10}11}
1{2"id": "ctr_gp7vkmxayztufjz6top5bjcdra",3"description": "Limit spend to €1000 per month",4"control_type": "velocity_limit",5"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",6"created_date": "2023-03-12T18:20:12Z",7"last_modified_date": "2023-03-12T18:20:12Z",8"velocity_limit": {9"amount_limit": 1000,10"velocity_window": {11"type": "monthly"12}13}14}
You also have the option to apply more granular velocity limits by specifying which MCCs or MIDs the given velocity limit applies to. For example, you can apply a velocity limit that limits the monthly spend at food businesses to 500 EUR:
Information
You cannot set both an MCC list and an MID list on a velocity limit. The velocity limit will be applied separately for each MCC or MID on the list.
For example, if a control restricts a card's spending to 500 EUR per month for MCCs 7995 and 7994, the card will have a total spending limit of 1000 EUR: 500 EUR for MCC 7995 and 500 EUR for MCC 7994.
1{2"description": "Limit food spend to €500 per month",3"control_type": "velocity_limit",4"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",5"velocity_limit": {6"amount_limit": 500,7"velocity_window": {8"type": "monthly"9},10"mcc_list": ["5812", "5814"]11}12}
1{2"id": "ctr_gp7vkmxayztufjz6top5bjcdra",3"description": "Limit food spend to €500 per month",4"control_type": "velocity_limit",5"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",6"created_date": "2023-03-12T18:20:12Z",7"last_modified_date": "2023-03-12T18:20:12Z",8"velocity_limit": {9"amount_limit": 500,10"velocity_window": {11"type": "monthly"12},13"mcc_list": ["5812", "5814"]14}15}
After creating a velocity limit control, you can use the API to retrieve the control using its ID if you need to update it at a later date. You can also retrieve a list of all controls applied to a specified card.
You can restrict the types of businesses a card can process transactions from.
To do this, provide a list of MCCs to either allow or block.
- In your Dashboard, go to the Card Issuing > Cards screen.
- Select the card you want to control spending for. You can use search or filters to help find the card.
- In the Card details screen that appears, scroll to Controls and select Add controls, or Edit if the card already has controls.
- Select Restrict categories.
- In the screen that opens, choose Allow or Block and specify the MCCs.
- Select Submit to save.
Use the API to restrict MCCs. For example, you can block all authorization requests coming from gambling institutions.
post
https://api.checkout.com/issuing/controls
1{2"description": "Block all gambling transactions",3"control_type": "mcc_limit",4"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",5"mcc_limit": {6"type": "block",7"mcc_list": ["7994", "7995"]8}9}
1{2"mcc_limit": {3"type": "block",4"mcc_list": ["7994", "7995"]5},6"id": "ctr_ixy6g5hndwuudmuz5tsgct36ae",7"description": "Block all gambling transactions",8"control_type": "mcc_limit",9"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",10"created_date": "2023-03-15T07:02:15.840206Z",11"last_modified_date": "2023-03-15T07:02:15.840206Z"12}
While you can specify which MCCs to block using multiple rules, you can only use a single rule to define which MCCs to allow. If you need to update an MCC control's allowlist, update the control itself.
After creating an MCC rule control, you can use the API to retrieve the control using its ID if you need to update it at a later date. You can also retrieve a list of all controls applied to a specified card.
You can restrict the merchants a card can process transactions from.
To do this, create an allowlist or blocklist of merchant IDs. For example, you can block all authorization requests coming from a specific merchant.
post
https://api.checkout.com/issuing/controls
1{2"description": "Allow the card to be used only in AZ Pizza",3"control_type": "mid_limit",4"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",5"mid_limit": {6"type": "allow",7"mid_list": [8"593278",9"541114"10]11}12}
1{2"id": "ctr_gp7vkmxayztufjz6top5bjcdra",3"description": "Allow the card to be used only in AZ Pizza",4"control_type": "mid_limit",5"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",6"created_date": "2023-03-12T18:20:12Z",7"last_modified_date": "2023-03-12T18:20:12Z",8"mid_limit": {9"type": "allow",10"mid_list": [11"593278",12"541114"13]14}15}
You can use the Dashboard or API to view, update, or remove a card's controls.
If you're an administrator or an administrator has given you permission, you can view a card’s controls using either the API or the Dashboard.
To view a card's controls using the API, use the Get a target's controls endpoint to retrieve the controls applied to a card. The response will return the controls and their corresponding details. For any controls that are a velocity limit, the control details also include the remaining amount available to spend.
You can also view the control details for a control ID. To do this, use the Get control details endpoint to retrieve the control details by ID. The response will return the control type, and the specific settings for the control.
If a control targets a card through a control profile instead of being applied directly to the card's ID, that control will not be returned when you retrieve the target's controls with the card ID.
To view all controls applied to the card using API:
- Get a target's controls and set the
target_id
to the card's ID. - Retrieve the list of control profiles that target the card and set the
target_id
to the card's ID. - Get a target's controls for each control profile ID returned in the previous step.
To view a card's controls using the Dashboard:
- Go to the Card issuing > Cards screen.
- Use search or filters to find a card.
- Click on the card to view its details.
- Scroll to the Controls section. The card's controls will be displayed, if you have the required viewing permission. Controls set globally for all client spending will not be displayed.
You can update an existing velocity limit to change the limit amount or the list of MCCs or merchant IDs it applies to.
Information
You cannot change the period of time a velocity limit applies to, after creation.
Similarly, you can add or remove:
- MCCs from your MCC blocklist or allowlist rule
- MIDs from your MID blocklist or allowlist rule
To update a control via the Dashboard:
- Go to the Card Issuing > Cards screen.
- Use search or filters to find a card.
- Select the card and scroll to the Controls section.
- In the Card details screen, scroll to Controls and select Edit.
- Click on the three dots next to the control you want to update and select Edit control.
- Update the required details.
- Select Submit.
Alternatively, you can update a control using the API:
put
https://api.checkout.com/issuing/controls/{control_id}
1{2"mcc_limit": {3"type": "block",4"mcc_list": ["7995"]5}6}
1{2"mcc_limit": {3"type": "block",4"mcc_list": ["7995"]5},6"id": "ctr_ixy6g5hndwuudmuz5tsgct36ae",7"control_type": "mcc_limit",8"target_id": "crd_fa6psq42dcdd6fdn5gifcq1491",9"created_date": "2023-03-15T07:02:15.84Z",10"last_modified_date": "2023-03-15T07:08:24.1761739Z"11}
Removing a control from a card deletes the control entirely.
To apply an equivalent control at a later date, you'll need to create a new velocity limit, MCC, or MID rule.
To update a control via the Dashboard:
- Go to the Card Issuing > Cards screen.
- Use search or filters to find a card.
- Select the card and scroll to the Controls section, and click Edit.
- Click on the three dots next to the control you want to update and select Delete control.
Alternatively, you can delete a control using the API:
delete
https://api.checkout.com/issuing/controls/{control_id}
1{2"id": "ctr_ixy6g5hndwuudmuz5tsgct36ae"3}