Knowledge base
Questions and answers | MULENPAY
Short answers to the questions that come up before you start accepting payments and during the first months of running them.
Basics
What is SBP and how does it differ from paying by card?SBP (the Faster Payments System) is a Bank of Russia service that moves money directly from the buyer's account to the merchant's using a QR code or a payment link. Unlike a card payment, no card details are involved at all.What is a payment aggregator and how does it differ from a bank?A payment aggregator is a service that gives a business access to several payment methods through a single contract and a single integration. Instead of separate connections to a bank, SBP and Pay services, the merchant gets one payment form and one dashboard.Can I accept payments from foreign cards?Yes, foreign cards can be accepted, but it is a separate scenario: it carries its own rate — at MulenPay from 8.9% against 2.9% for Russian bank cards — and its own requirements for product descriptions, currency and customer support.What is a payment link and how does it work?A payment link is the address of a payment page with the amount and order description already filled in. The merchant sends it to the buyer in a messenger, an email or on social media, and the buyer pays in a single hop. No website of your own is required.Can a self-employed person accept card payments?Yes. A self-employed person can accept cards, SBP and payment links by connecting to a payment service. No terminal and no website of your own are required: a smartphone and a dashboard are enough.How does a payment widget differ from a payment page?A widget embeds directly into the store page: the buyer pays without leaving your site. A payment page opens at a separate address on the provider side. In both cases card details are entered in the provider's secure form and never pass through your server.How does acquiring differ from internet acquiring?Acquiring is accepting cashless payments in general, while internet acquiring is its online variety. In store acquiring the card physically meets a terminal; in internet acquiring the buyer enters the details on a secure page or pays by QR code.What is a payment gateway and what is it for?A payment gateway is a technical intermediary that passes transaction data between the merchant site, banks and payment systems. It accepts the details, encrypts them, sends the charge request and returns the payment status to the store.What is acquiring in plain words?Acquiring is accepting cashless payments in favour of a merchant. The buyer pays by card or through a faster payments system, the money travels through banks and the payment system, and it reaches the merchant account already net of the fee.What happens between the Pay button and the money arriving?Several stages sit between the button and money on the account: card checks, buyer confirmation, authorisation of the amount, capture and settlement between banks. For the buyer it is seconds; for the merchant it is a chain where every link can fail.What is one-click payment and why is it convenient?One-click payment is when the buyer banking app supplies the details and all they do is confirm. Neither the card number nor the code on the back has to be typed, so there are fewer steps before confirmation.Can I accept payments without a website?Yes. Payment links and QR codes work without a site: the link is sent in a messenger or on social media, the code is shown on a screen or printed at the point of sale. The buyer lands on a secure checkout page and the merchant receives a payment notification.Which payment methods should a store enable?The basic set is Russian bank cards, SBP and one-click payment through Pay services: it covers almost every buyer. The rest depends on your audience — foreign cards for selling abroad, recurring charges for a subscription model.What affects checkout conversion?Checkout conversion is the share of buyers who get from the cart to a confirmed payment. It is lost on small things: extra steps, an unfamiliar-looking checkout page, a missing habitual method, and declines the buyer does not understand.What is an escrow-style deal and when is it needed?An escrow-style deal holds the buyer money until the obligations are confirmed as met, and only then releases it to the seller. The buyer knows their money is safe, and the seller knows the order is paid and the funds are reserved.How does an MCC code differ from a business activity code?A business activity code is declared by you when the business is registered, while the MCC code is assigned by the payment side based on what you actually sell. That is why they regularly diverge: the register may list a broad range while the MCC is a single one matching the real assortment.How does a static QR code differ from a dynamic one?A static QR code is printed once and carries no amount — the buyer enters it themselves. A dynamic one is generated for a specific order with the amount and purpose already filled in, leaving the buyer only to confirm.
Fees and money
What makes up the fee for accepting payments?The fee is split between the parties to a transaction: the bank that issued the card, the payment scheme, and the side that settles the money and supplies the technology. That is why the rate depends on the payment method, your volume and your industry, and is quoted as "from".When does the money reach the settlement account?A customer paying and money reaching the merchant are two different events. First the payment is confirmed by the buyer bank, then the funds go through settlement between the parties, and only after that they are paid out to your account on the agreed schedule.Is the fee refunded when a payment is returned to the buyer?The buyer receives the full purchase amount back — a refund is not reduced by the fee. Whether the merchant gets the fee on an already processed operation back depends on the contract: the work of processing the payment was done, so by common acquiring practice it stays withheld.What limits apply to a single payment?The minimum single operation is 10 roubles and the maximum is 300,000 roubles. The cap applies to an individual payment, not to turnover: there is no daily or monthly ceiling on accepting payments.What is payment splitting and who needs it?Splitting is the automatic division of a single payment between several recipients. The buyer pays once, and the money separates immediately: the platform fee goes to the platform, the rest to the seller of the goods.What is interchange and who receives it?Interchange is the part of the fee that goes to the bank that issued the buyer card. It makes up the largest share of the rate, and its size is set by the payment system rather than the payment service: no individual contract can lower it.Why does the fee differ between cards?The rate depends on who issued the card and under which rules the settlement runs. Russian bank cards, SBP and Pay services share one rate — from 2.9% — while foreign cards cost more, from 8.9%, because their settlement is longer and riskier.What are instalments and pay-later for buyers?Instalments and pay-later let a buyer split a payment into parts while the merchant receives the order amount at once. The difference is carried by a financing partner, who also takes on the risk of the buyer not paying.Is there a monthly fee for accepting payments?No. Onboarding, integration, the dashboard and cloud fiscalisation are part of the plan — you pay only a percentage of each processed payment. No payments means no costs: there is no standing charge for having the service connected.How do I account for the fee in my prices?The fee is withheld before settlement: the buyer pays the full order amount while the merchant account receives it minus the percentage. So the fee belongs in the price rather than as a surcharge for paying by card.
Security
What is 3-D Secure and why does a business need it?3-D Secure is an additional verification protocol that confirms the person paying is the actual cardholder. The issuing bank asks for confirmation — an SMS code, an app login or biometrics — and only then is the transaction sent for capture.What is PCI DSS and why does a merchant need it?PCI DSS is the international security standard for payment card data. It defines how card details must be stored, transmitted and processed. Level 1 is the highest certification tier, held by organisations handling the largest transaction volumes.How do you store payment API keys safely?Payment API keys belong on the server in environment variables or a secrets store — not in code, not in the repository, not in messengers. A key can create payments on behalf of your store, so a leak is equivalent to access to money.What is card tokenisation?Tokenisation replaces card details with a unique identifier that is useless to a fraudster on its own. The merchant stores the token rather than the card number and uses it for repeat charges: subscriptions, one-click payments, plan renewals.What is anti-fraud and why does it decline payments?Anti-fraud is a system that scores the risk of every operation before it goes through and stops the suspicious ones. It looks not at a single buyer but at behaviour: how many attempts in a row, from which country, how typical the amount and the item are for this merchant.Who is liable if a payment turns out to be fraudulent?Liability depends on whether the operation was confirmed through 3-D Secure. If the buyer passed confirmation at their bank, the fraud risk shifts to the issuing bank. Without confirmation, a disputed operation will most likely be charged back to the merchant.Can I store customer card details myself?A merchant cannot store full card details — that requires your own PCI DSS certification, and its requirements are out of proportion for an ordinary online store. Details are entered on the certified provider side, and repeat charges use a token.Why enable two-factor authentication in the dashboard?The dashboard controls real money: refunds are issued there, payout details are changed there and API keys are created there. A password is the only barrier, and a second factor turns a stolen password from a disaster into an inconvenience.Why are payment notifications signed?The address that receives payment notifications is available to anyone who knows it. Without an authenticity check the store would trust an outside request too — so the notification is signed with the secret key, and the handler on the store side must verify that signature.What to do if the secret key ends up in the wrong hands?Reissue the key in the dashboard: the old value stops working immediately and the new one is shown once. After that, update it everywhere it is configured and check whether anyone managed to use the leak.Is accepting payment by link safe?Yes: the link opens the payment provider secure page rather than the merchant site. Card details are entered in the same place as when paying in an online store, and the merchant never sees them — only the operation status.What is an SAQ and does the merchant fill it in?An SAQ (Self-Assessment Questionnaire) is the PCI DSS self-assessment form. The merchant fills it in, but its size depends on how payments are accepted: if card details are entered on the certified provider side, the merchant gets the shortest version.How do I spot a fake checkout page?Looks are easy to copy; the domain and the certificate are not. A genuine checkout page opens on the payment service domain over HTTPS, shows the amount and the purpose of the payment, and never asks for data a payment does not need.Does my site need an HTTPS certificate to accept payments?Yes, and without it payments will not be connected at all. HTTPS is a payment data security standard requirement and one of the first things checked during the site review. Without a certificate the browser marks the page insecure and the buyer never reaches checkout.What should I do about suspicious activity in my store?A run of declines, many small payments from different cards, or orders with no interest in delivery are typical signs of card testing through your store. React immediately: such operations ruin your decline statistics and lead to disputes.What is friendly fraud and how do I reduce it?Friendly fraud is when a purchase is disputed by the buyer themselves rather than by a fraudster. Sometimes by mistake: they did not recognise the merchant name on the statement. Sometimes deliberately: they received the goods and pulled the money back through the bank, bypassing the store.
Paperwork and law
Does an online store need an online cash register?Yes: if an online store accepts payments from individuals, 54-FZ requires a fiscal receipt for every payment, delivered to the buyer. Buying physical cash register hardware is not required, though — a cloud register covers it.What documents are needed to start accepting payments?You need company or sole trader details, proof that the site is yours, and the site itself with product descriptions, prices, payment and refund terms, contacts and seller information. The review looks not only at paperwork but at what the buyer actually sees.What is an MCC code and what does it affect?An MCC (Merchant Category Code) is a four-digit code that payment schemes use to mark a merchant's line of business. It is assigned at onboarding and visible to buyers' banks: it drives cashback and rewards, card restrictions, and how anti-fraud assesses the transaction.Why does a site fail the acquiring onboarding review?Usually it is the site rather than the paperwork: no refund terms, no catalogue description, prices invisible before checkout, or placeholder pages. The review looks at exactly what a buyer would see — and sends the application back when the deal is described unclearly.What must a fiscal receipt contain?A receipt needs clear names of what the customer is buying, quantities, prices, the VAT rate and the settlement method, plus a buyer contact for the copy. Generic wording like "Service" or "Goods" is a frequent source of complaints.Which goods and services cannot be sold through acquiring?Restrictions come from two directions: the law prohibits trade in certain goods, and payment systems additionally close categories with a high rate of disputes and fraud. The review looks not at the wording in the contract but at what is actually sold on the site.Does a website need public offer terms?Yes: public offer terms and a refund policy are part of what is reviewed when payments are connected. The buyer must see who they are contracting with, what exactly they are buying and on what terms they can get their money back.Which documents does a self-employed seller need?A self-employed seller needs a smaller pack than a company: identity details, a tax number, confirmation of professional income tax status and bank details for payouts. The review itself is the same — what and how you sell is still checked.Which documents does accounting need for acquiring?Accounting needs summary data rather than individual payments: an operation register for the period, the amount of fee withheld and confirmation of transfers to the account. All of it exports from the dashboard, while closing documents are set out in the provider contract.Do I need a business bank account to accept payments?An account for payouts is mandatory, but it is not always a business one: payouts can go to a bank card as well. Companies work only through a business account, while sole traders and the self-employed choose what suits them.Is a fiscal receipt needed for a refund?Yes. Under 54-FZ a refund is the same kind of operation as a sale: it gets its own receipt marked as a return. With cloud fiscalisation the receipt is created automatically along with the refund itself.Does a merchant need a licence to accept payments?An ordinary store needs no licence to accept payments: the financial side is handled by licensed providers and banks, while the merchant simply sells their goods. Permits may be required not because of payments but because of what exactly you sell.What buyer data does a fiscal receipt need?An electronic receipt needs a contact to send it to: an email address or a phone number. Identity documents, home addresses and similar details are not part of a receipt — there is no reason to collect them just in case.Is consent for personal data processing required?Yes, if you collect buyer contacts — and without them you cannot send a receipt or arrange delivery. The site needs a personal data policy and explicit consent in the order form, rather than a pre-ticked checkbox.
Operations and disputes
What is a chargeback and how does it differ from a refund?A chargeback is a forced reversal of a payment initiated by the buyer's bank when the customer disputes the transaction. Unlike an ordinary refund, which the merchant issues themselves, a chargeback happens without their consent: the bank or the payment system decides, based on the evidence submitted.How does cancelling a payment differ from refunding it?A cancellation applies to a transaction that has not completed its financial cycle: the funds were held on the card but never captured. A refund applies to a completed payment: the money was taken and has to be sent back. For the customer the difference shows in timing — a cancellation releases funds faster.What is a recurring payment and how does it work?A recurring payment is an automatic charge that runs without the customer's involvement: the card is linked during the first payment, and the amount is charged on a schedule after that. This is how subscriptions, plan renewals and instalments work.Why did the bank decline a payment when there is money on the card?The balance is usually not the issue: payments get declined by bank limits, anti-fraud checks, a typo in the card details, an expired checkout session or restrictions on the transaction type. Only the issuing bank knows the exact reason — the merchant sees just a broad category.What is a payment hold and when do you need one?A hold blocks an amount on the buyer's card without capturing it. The money is reserved but has not reached the merchant: they confirm the capture once the obligation is met, or release the hold if the order falls through.What is a webhook and why does a store need one?A webhook is a notification the payment service sends to your site's address whenever a payment status changes. It — not the buyer returning to a thank-you page — should be treated as the source of truth: it is the only way the store reliably learns about a payment.What are mass payouts and who needs them?Mass payouts send money to many recipients at once from a single register rather than one transfer at a time. Marketplaces, partner programmes and companies working with contractors use them: the money flows out of the company, not into it.What should you do when a customer pays twice?Return the extra payment without waiting for the customer to call their bank — issue the refund from your dashboard. The cause is usually technical: the buyer pressed the button twice, or the store never received the status of the first payment.How do I accept a payment from a company?A company has two routes: pay an issued invoice from its bank account, or pay by corporate card like any other buyer. The first is familiar to accounting, the second clears instantly and needs no waiting for a bank transfer.How do I dispute a chargeback and what documents are needed?A chargeback can be disputed by presenting evidence that the obligations to the buyer were met. The decision is made neither by the merchant nor by the service but by the bank or the payment system — they look at the documents and at whether the merchant met the deadline.The payment went through but the money has not arrived — what now?A successful payment and money on your account are different events: settlement and payout generation happen in between. Before contacting support it is worth checking the operation status and the payout register in the dashboard — usually the answer is right there.What do payment statuses in the dashboard mean?The status shows which stage an operation is at. Created means the payment has only been registered, Processing means confirmation is under way, Completed means the money is in, Hold means the amount is reserved pending your decision, while Cancelled and Error mean the operation did not happen.Why is a payment stuck in processing?Processing normally takes seconds. A stuck status almost always means confirmation at the buyer bank never finished: the page was closed, the code was not entered, or the request did not arrive. Such an operation does not turn into a payment on its own.How do I stop recurring subscription charges?A repeat charge is always initiated by the merchant against a stored token — the bank does not take money on its own. So a subscription ends exactly when you stop sending charge requests, and no approval is needed for that.What if the payment notification never reached my store?If the dashboard shows Completed while your store shows the order unpaid, the notification was either not delivered or not handled. The status itself is never lost: you can always fetch it from the API and update the order yourself.Can the amount of an existing payment be changed?No: the amount is fixed when the payment is created and forms part of the operation signature, so it cannot be changed afterwards. If the order changes, the old operation is cancelled or refunded and a separate payment is created for the new amount.How do I test payments before launch?Testing a successful payment is not enough: declines, refunds and repeat notifications are what usually break in production. Walk each scenario end to end — from creating the payment to what your own system finally shows.How do I return part of the amount to a buyer?A partial refund is issued from the dashboard: you set the amount and it goes back to the buyer the same way they paid. A separate fiscal receipt is generated for the returned part, while the rest of the amount stays with the merchant.What if the buyer never received the receipt?A receipt is generated automatically on every payment, but delivery depends on the contact details the buyer provided. If the email never arrived, the receipt is not lost: it is part of the operation data and can be sent again.Where can I see and export payment history?Operation history lives in the dashboard: every payment is listed with its status, amount, method and date, and data for any period exports to a file. Payout registers are available separately — those are what you reconcile the account against.Can I run several stores in one account?Yes. Each store is set up separately — with its own keys, checkout settings and statistics — while all of them stay in one account. Staff can be given access by role instead of sharing one password.How do I refund when the buyer card is closed?A refund always follows the same route as the payment — back to the same card. If the card was reissued or closed, the buyer bank usually credits the money to their account; if the account itself is closed, the buyer has to contact their bank.Why is a payout smaller than turnover for the period?Three things almost always explain the gap: the fee withheld, refunds during the period and operations that have not made it into a transfer yet. Add them up and the figure matches the payout register.
The short version
Common questions about onboarding
Answers to what people ask before their first payment
Sign up and leave a request: a manager walks you through the technical part, and payments go live within one business day.
Still have questions?
Write to us — we will answer and help you start accepting payments.
Telegram bot
@Mulenpay_support_bot
Quick answers 24/7
Legal address
RBY Commerce Ltd.
8 Copthall, Roseau Valley, 00152, Commonwealth of Dominica
Leave a request
Fill out the form — a manager will get in touch, tailor the terms and help with the integration.
