Square or Stripe Freeze for Med Spas: What to Know
Find out why Square and Stripe freeze med spa accounts and what steps to take to avoid a long fund hold for your practice. September 2026.
TL;DR
5 key points- 01Square and Stripe pool med spas into shared accounts, letting frozen funds sit for up to 180 days.
- 02A mismatched MCC code is the silent trigger behind most freezes involving GLP-1, peptide, or ketamine services.
- 03Dispute rates above 0.75%-1% or a monthly volume spike can lock your account without any warning.
- 04After a freeze, export all records immediately and plan cash flow around a 90-180 day hold timeline.
- 05Decoda Health processes payments through Rainforest with underwriting that covers semaglutide, ketamine, and TRT/HRT from the start.
Why Square and Stripe Are Not Built for Med Spas
Square and Stripe are built for simplicity at signup. That simplicity comes with a structural trade-off that med spa owners often learn about too late.
Both operate as payment aggregators. When you sign up, you don't get an individually underwritten merchant account for your business type. Instead, you're pooled into a shared account alongside thousands of other merchants, with minimal vetting upfront. That's what makes signup so fast.
The catch: because underwriting happens after the fact, their automated risk systems monitor the shared account continuously. When your transaction patterns look unusual to those models, the system flags you first and investigates later. Aggregators can hold funds for 180 days as a chargeback buffer.
Med spas were never part of the intended customer profile for these tools. A business running $1,500 filler appointments, monthly memberships, and med spa weight loss injections looks genuinely strange to a risk model designed around coffee shops and freelancers.
Your MCC Is the Reason You Get Flagged
Merchant Category Codes are four-digit codes payment networks use to categorize what a business sells. They affect your transaction fees, your perceived risk level, and whether your account stays open when scrutiny arrives.
Most med spas land under one of two codes: MCC 8099 (health and medical services) or MCC 7298 (health and beauty spas). The difference matters. Correct classification affects the fees you pay, the reserves processors require, and your eligibility for certain payment services. A clinic administering semaglutide or peptide protocols is not the same business as a facial bar, and the payment network knows it.
The problem is that standard processors often board med spas under a generic retail or services MCC. That misclassification sits quietly until a GLP-1 or peptide transaction hits the network. At that point, the transaction pattern contradicts the registered business type, and the automated risk system treats it as suspicious activity. You got coded wrong from the start.
Here is how that plays out in practice. A med spa is boarded under MCC 7298 by a Stripe rep who confirms it covers aesthetic services. Six months later the practice adds semaglutide injections. The first GLP-1 transactions clear without issue. Then Stripe's automated system detects pharmaceutical keywords under a day-spa MCC, cross-references a dispute rate nudged up by two Botox chargebacks, and issues a funds hold with no advance notice. The owner finds out when a patient's membership charge fails at the front desk.
The Specific Triggers That Cause a Freeze
Four patterns show up again and again when med spa accounts get frozen.
Dispute rates are the fastest trigger. Stripe's automated risk system flags accounts if the dispute percentage climbs above roughly 0.75% to 1%. Med spas are exposed here because patients sometimes dispute charges after receiving a service, a pattern called friendly fraud. One unhappy Botox patient filing a chargeback can noticeably move a small practice's ratio.
Ticket sizes between $500 and $3,000 for a single visit also draw automated scrutiny. Filler, laser, and injectables sit well above what aggregator risk models expect from a generic services merchant, so large individual transactions get held while the processor investigates.
Volume spikes compound the problem. A sudden monthly volume spike triggers the risk system regardless of whether that growth is real. A successful promotion or a new injector joining the practice looks identical to suspicious activity from the outside.
Service keywords matter too. Automated risk monitoring is tuned to flag terms like semaglutide, tirzepatide, ketamine, and peptides in transaction data. A clinic that starts offering GLP-1 semaglutide protocols after signing up under a generic MCC can see its account frozen without warning. Processing medical services under a mismatched retail or spa MCC can also expose a practice to card-brand compliance fines, assessed separately from any processor-initiated fund hold.
Recurring memberships round out the list. When the billing descriptor on a patient's statement does not match what they remember agreeing to, confusion becomes a dispute, and that dispute feeds a risk profile already under pressure.
What Happens When Your Account Gets Frozen
When Stripe limits or closes an account, it suspends all payouts immediately, freezes remaining funds, and disables the ability to process new transactions. You will get an email, but do not expect much detail. The message is typically short and generic.
Stripe holds frozen funds for 90-180 days as a chargeback buffer. Square follows a similar pattern. Appeals rarely succeed once an account has been flagged as high-risk, and even if reinstatement happens, the account stays under heightened scrutiny.
There is a practical difference between a freeze and a termination. A freeze or suspension holds your funds and pauses processing, but the account can sometimes be reinstated. A termination closes the account permanently and can get your business reported to the MATCH/TMF list, which affects future merchant applications across every processor. Stripe's notification email often does not state which one has happened, so call Stripe support directly to confirm your account status before assuming reinstatement is possible.
For a practice running med spa membership programs and prepaid packages, the timing of a freeze can be brutal. Membership billing cycles do not pause. Payroll does not pause. The cash flow gap between frozen revenue and ongoing expenses falls entirely on the owner.
Dimension | Account Freeze / Suspension | Account Termination |
|---|---|---|
Processing ability | Paused; new transactions blocked while review is active | Permanently disabled; account cannot be reopened |
Funds | Held 90-to-180 days, then released if no disputes materialize | Held 90-to-180 days; a portion may be withheld to cover open disputes |
Reinstatement | Possible if a successful appeal is submitted with supporting documentation | Not possible with Stripe; the account closure is permanent |
MATCH list | Not reported; business is not flagged across other acquirers | Business may be added to the MATCH/TMF, flagging the account across all acquirers for up to five years |
Steps to Take Immediately After a Freeze
A freeze notice rarely comes with much warning, so speed matters here.
- Read the freeze notification carefully. Note any specific reason code cited. Vague language is common, but even partial detail tells you whether the issue is dispute volume, service type, or volume anomalies.
- Respond to any information requests quickly. Gather invoices, state med spa business licenses, service agreements, and patient consent forms. Processors want documentation confirming you run a legitimate medical business, and slow responses extend the hold.
- Export every transaction record and business document from the account immediately, before access is restricted further.
- Set up a backup processor right away so revenue can continue moving while the hold resolves.
- Plan cash flow around a 90-to-180 day timeline. Stripe holds funds for that period as a chargeback buffer, releasing them only if no disputes materialize.
- Understand the MATCH list risk. If a processor formally terminates your account instead of simply freezing it, your business can be placed on the Terminated Merchant File, which is maintained by Mastercard and shared across acquirers industry-wide. Placement typically lasts five years. Businesses on the list are often declined by standard processors and pushed toward high-risk processors with higher fees and stricter reserve requirements. Before applying anywhere new, ask a prospective processor to run a MATCH inquiry on your business so you know where you stand. Document every communication during this process.
How to Prevent a Freeze Before It Happens
Prevention starts with one direct question: does your payment processor actually know what you sell?
Verify your MCC before processing a single transaction. If you offer GLP-1 protocols, peptides, or ketamine, a generic "health services" code is a mismatch waiting to become a problem. Call your processor, confirm the code on file, and get written confirmation that your service menu is covered.
Keep billing descriptors patient-facing and literal. If someone sees an unfamiliar business name or a vague charge on their statement, they call their bank instead of your front desk. A clear descriptor tied to your clinic name cuts that confusion before it becomes a dispute. Staying well below the 0.75% to 1% dispute threshold gives you room for the occasional frustrated patient without tripping an automated flag.
Call your processor before a big promotion. A volume spike from $10,000 to $30,000 in a month looks like a red flag to an automated system, even when it comes from a legitimate membership sale event. A quick heads-up keeps the anomaly from reading as fraud.
Thorough documentation is your best defense against friendly fraud. Signed consents, timestamped treatment notes, and a clear record of what was discussed and administered give you evidence to win a dispute before it lands as a loss.
Migrate to a purpose-built processor early, not after, and keep two processors active at once. A single frozen account should not be able to halt every transaction in your practice.
What to Look for in a High-Risk Payment Processor for Med Spas
Med spas combine recurring memberships, high-ticket single visits, medical services, and sometimes compound medications under one roof. That combination requires high-risk med spa payment processing built around the actual business, not assumptions borrowed from retail. The payment features your practice depends on should be built into your med spa POS system from the start, not bolted on after the fact through workarounds that create reconciliation gaps.
Six things worth confirming before signing with any processor:
Criteria | Square / Stripe | Purpose-Built High-Risk Processor |
|---|---|---|
Underwriting | Post-signup, automated; med spas pooled into shared aggregator accounts | In-house review of the full file before boarding; high average tickets priced in from day one |
MCC Coding | Often assigned a generic retail or services MCC; mismatch with GLP-1 or peptide transactions | MCC matched to actual service mix at signup, confirmed in writing |
High-Risk Service Approval | No explicit written approval; verbal reassurance only, which offers no protection during automated review | Written approval for each high-risk category (semaglutide, ketamine, peptides, TRT/HRT) |
Reserve Policy | Funds held 90-180 days after a freeze; terms not disclosed at signup | Rolling reserve percentage and duration disclosed upfront before boarding |
Recurring Billing | General-purpose billing; descriptor mismatches generate confusion and disputes | Native subscription billing keeps descriptors clean and consistent for membership charges |
EMR / POS Integration | Payment data lives in a separate system; reconciliation gaps complicate dispute responses | Payments integrated with clinical documentation; every charge tied to a treatment note and signed consent |
How Decoda Health Approaches Payment Processing for Elective Care
Decoda Health's payment processing is built around Rainforest, a high-risk-friendly processor that explicitly supports the service categories that get med spa accounts frozen elsewhere. Peptide clinic licensing and operations for semaglutide, ketamine, and TRT/HRT are covered through underwriting from the start, not verbal approvals or workarounds.
Because payments live inside the same system as clinical documentation, every charge connects directly to a patient record, a treatment note, and a signed consent form. Practices that also manage med spa injectable inventory in the same platform eliminate a second reconciliation gap. That documentation chain is the most reliable defence against friendly fraud. When a dispute arrives, the evidence needed to win it is already assembled.
Membership billing, recurring packages, and prepaid series are managed inside the same workflow that handles charting and scheduling, removing the mismatched billing descriptors that trigger disputes in practices running general-purpose processors.
Early data shows our clinic partners see an average of 20% fewer claim denials with integrated billing and documentation, though results vary by practice and sample sizes remain small. For owners running GLP-1 or peptide services on a generic processor, or who have already been through a freeze, Decoda Health removes the need to piece together a separate high-risk processing relationship alongside a standalone EMR.
Final thoughts on Keeping Your Med Spa Payments Running Without a Freeze
A 90- to 180-day fund hold while payroll keeps running is a genuinely painful situation, and it is almost always preventable. The practices that avoid it are the ones that got their MCC right at signup, kept documentation tight, and picked a processor that already understood their service mix. Your payment setup should be the most boring part of running your clinic. A short intro call with Decoda Health is a good place to start if yours currently feels like a liability.
Frequently Asked Questions
What actually triggers a Stripe or Square account freeze at a med spa?
The four triggers are covered in detail above: dispute rates, high ticket sizes, volume spikes, and flagged service keywords. The underlying cause is that both processors board med spas through shared aggregator accounts with minimal upfront underwriting, so their automated risk systems are calibrated for coffee shops and freelancers, not a practice running $1,500 filler appointments and monthly GLP-1 protocols.
My med spa offers semaglutide and peptides. Will Square or Stripe freeze my account?
Yes, this is a documented risk. Automated monitoring at both processors flags those service keywords directly, and if your account was boarded under a generic MCC like 8099 or 7298 instead of one matched to your actual service mix, the mismatch between your registered business type and your transaction data gives the system a second reason to act. Getting written confirmation of your MCC and explicit written approval for each high-risk service category before processing a single transaction is the only way to remove that exposure at a general-purpose processor.
How do I prevent a Square or Stripe account freeze at my aesthetics clinic?
Verify your MCC code before processing, confirm in writing that your specific services are covered, and keep billing descriptors tied to your clinic name so patients recognize charges and call you instead of their bank. Notify your processor before any large promotion, because a spike from $10,000 to $30,000 in one month reads as suspicious to an automated system regardless of the actual source. Keep dispute rates well below the 0.75% threshold by documenting every treatment: signed consents, timestamped clinical notes, and a clear record of what was administered give you the evidence to win a chargeback before it posts as a loss.
What should I look for in high-risk payment processing for a med spa running GLP-1 and peptide programs?
The single most important factor is in-house underwriting that reviews your actual service menu before boarding, so high average tickets and specialty services are priced into your account terms from day one. Beyond that: correct MCC coding matched to your service mix, explicit written approval for each high-risk category (not verbal reassurance at signup), a rolling reserve policy disclosed upfront, and recurring billing infrastructure that keeps descriptors consistent so membership charges don't generate confusion disputes. Integration with your EMR matters too, because when a dispute arrives, you need the charge tied directly to a clinical record and signed consent without pulling data from three separate systems.
Can I use Decoda Health's payment processing if my practice already offers semaglutide or ketamine?
Yes. Decoda Health's payment processing runs through Rainforest, a processor that explicitly covers peptides, semaglutide, ketamine, and TRT/HRT through underwriting from the start. Because payments live inside the same system as clinical documentation, every charge connects directly to a treatment note and a signed consent, giving you the documentation chain you need when a dispute arrives. Practices that have already been through a Stripe or Square freeze, or are running GLP-1 services on a general-purpose processor, can move to a single integrated workflow without standing up a separate high-risk processing relationship alongside a standalone EMR.
How does Rainforest payment processing differ from Stripe or Square for wellness and elective care practices?
Rainforest underwrites your full service menu before boarding — high average tickets, peptides, semaglutide, ketamine, and TRT/HRT are all priced into your account terms from day one. Square and Stripe pool you into a shared aggregator account with no individual underwriting, which means their automated risk systems can freeze your funds without warning the moment your transaction patterns look unusual to a model built around retail merchants.
Is mobile IV therapy considered high-risk by payment processors, and what does that mean for fund freezes?
Yes, mobile IV therapy sits in a risk category that general-purpose processors flag regularly — high ticket sizes, out-of-clinic delivery, and recurring membership billing all contribute to an elevated risk profile. The practical result is that a single volume spike or dispute can trigger the same fund-hold pattern that hits GLP-1 and peptide practices, with frozen funds sitting for 90 to 180 days.
What is an MCC code and why does it matter so much for a med spa account freeze?
A Merchant Category Code is a four-digit number that tells the payment network what type of business you run. When your MCC is mismatched — for example, coded as a generic retail merchant while you process semaglutide or peptide transactions — the network sees a contradiction between your registered business type and your actual transaction data, and automated risk systems treat that contradiction as suspicious activity.
Can a third-party payment processor integrated with an EMR also work on external marketing funnels and landing pages?
Whether payment credentials extend to external funnels or landing pages depends on the specific processor and how it was set up. For Decoda Health's Rainforest integration, whether credentials port to outside platforms like GoHighLevel funnels or physical tap-to-pay terminals is not confirmed, so practices with existing external payment infrastructure should verify portability before assuming compatibility.
What is the MATCH list and how does a med spa end up on it after a payment freeze?
The MATCH list (Terminated Merchant File) is an industry-wide flag that gets added to your business record if a processor formally terminates your account rather than simply placing a hold. Once flagged, future merchant account approvals become significantly harder for years. Documenting every communication during a freeze is the step most owners skip, and it is the one that matters most if a termination escalation happens.
Should my med spa keep two payment processors active at the same time?
Yes, running a backup processor in parallel is one of the most direct ways to prevent a single freeze from halting every transaction in your practice. A frozen account at one processor does not have to mean zero revenue if a second processor is already set up, underwritten, and ready to run membership billing and new transactions while the hold resolves.
How does integrated payment processing inside an EMR help win chargebacks compared to using a standalone processor?
When payments live inside the same system as clinical documentation, every charge is automatically tied to a timestamped treatment note and a signed consent form. Pulling that evidence together takes seconds instead of requiring you to cross-reference three separate systems. That documentation chain is the most reliable way to win a friendly fraud dispute before it posts as a loss against your dispute ratio.
What does a volume spike look like to a payment processor's risk model, and how do I avoid triggering a freeze during a big promotion?
A jump from, say, $10,000 to $30,000 in monthly volume reads as suspicious to an automated system regardless of whether the growth is legitimate. Calling your processor before launching a large promotion or onboarding a new injector gives them the context to mark the volume increase as expected, which keeps the anomaly from reading as fraud in their monitoring system.
How do recurring membership billing descriptors lead to disputes and account freezes at med spas?
When the billing descriptor on a patient's credit card statement shows an unfamiliar business name or vague charge description, the patient calls their bank rather than your front desk. That confusion converts into a chargeback, which feeds a dispute ratio that automated risk systems at aggregator processors watch continuously. Keeping descriptors tied directly to your clinic name and using recurring billing infrastructure designed for membership programs removes that confusion before it becomes a flag.
What documentation should a med spa prepare before switching to a high-risk payment processor?
Gather your state med spa business license, a complete list of services including any high-risk categories like peptides, semaglutide, or ketamine, sample signed patient consent forms, and your current processing statements showing average ticket size and monthly volume. Processors that do in-house underwriting review this file before boarding you, so having it ready speeds up approval and confirms that your high-risk service categories receive explicit written coverage from day one.