Fraud Triage Map

Three Buckets, One Honest Answer

Every triage verdict lands in one of three buckets, and the buckets are designed to be boringly honest:

• Known, legitimate merchant — the descriptor matches a charge page we have reviewed, with cited sources and a last-reviewed date. The map shows you who bills under that name, whether it recurs, and what the company actually is when the billing name differs.
• Caution flags in our reviews — the matched charge page carries a caution or warning stamp from our review team. The map points you to that page so you can read exactly what the flags are.
• Not in our database — no match, no guess. The map says plainly that unrecognized descriptors are usually legitimate merchants we have not reviewed, and routes you to the decoder, the browse index, and our report-a-charge pipeline.

What the map will never do is assign a fraud probability or tell you to panic. A descriptor is not evidence of fraud; a merchant is not guilty until a source says otherwise. That is why every verdict links to its source page and every charge page cites its sources.

Why Descriptors Lie Without Meaning To

Most "mystery" charges are just the payment stack formatting names: Square bills under SQ *, Toast under TST*, Stripe under STRIPE, and PayPal under PAYPAL. The merchant name after the prefix is the business that actually took your money. The triage map reads those prefix families through our prefix hubs, so SQ *DAILY GRIND CAFE resolves to the coffee shop you visited, not a fraud alert.

The other classic confusion: the billing name differs from the brand. Many companies bill under their payment processor or parent entity — a Verizon wireless bill posts as ACHMA VISB BILL PYMNT, a streaming charge as PAYPAL *HULU. When our review confirms the real company, the map shows both names so the charge reads as something you recognize.

What the Stamps Mean

Every reviewed charge page carries a stamp — the same one the map shows in its verdict. Our review team applies them from verified sources:

• Verified charge — the merchant is real and the descriptor is confirmed; the page notes billing quirks.
• Beware — caution or warning stamps flag scam-adjacent billing, lookalike domains, or ambiguous fees; the page says exactly what to watch for.
• Varies — the descriptor behaves differently by card network, bank, or country; the page explains the variance.

Stamps are review opinions backed by cited sources, not guarantees. The map inherits them verbatim rather than inventing a new risk language.

The Unauthorized-Charge Playbook

If the charge is genuinely not yours, the playbook is short and fast: call the issuer immediately (every major bank has a 24/7 fraud line), cancel the card, then document. Credit cards cap your liability at $50 under the Fair Credit Billing Act. Debit cards cap it at $50 if you report within 2 business days, and $500 if you report within 60 days of the statement — after that, liability depends on the bank and the transfer.

Documentation means the dispute dossier: statement page, letter, evidence list, and the computed deadline for written notice. The triage map hands you off to those tools when the answer is "wrong," and to the subscription tracker and cancellation generator when the answer is "forgot it again."

Frequently asked questions