Start here
Need to check a specific charge?
Use the search tool to look up the exact text from your statement and review likely merchant details plus safe next steps.
3 Types of Charges That Look Like Fraud (But Usually Aren't)
How to tell the difference before you dispute.
If you review your statements carefully, you've probably flagged a charge that looked suspicious but turned out to be legitimate. Here are the three most common categories, with ways to confirm each one.
1. Restaurant charges with “TST*” or “SQ*” prefixes
These are point-of-sale system charges, not fraud. The restaurant name follows the prefix. If you've eaten at any independent restaurant recently, the charge likely looks like TST* OAKWOOD BREW or SQ* LOCAL COFFEE.
Common POS system prefixes
TST*: Toast (widely used in independent restaurants)SQ*orSQU*: Square (coffee shops, food trucks, small retailers)CLP*: Clover (another restaurant POS system)
To confirm: Match the date and dollar amount to a receipt or your calendar. The amount usually matches exactly, including any tip added at the table.
2. Charges from payment processors instead of merchants
The statement descriptor sometimes shows the payment processor, not the merchant. A lot of online retailers route payments through intermediaries, so the store name never appears on your statement.
Common payment processor descriptors
PAYPAL *MERCHANT: Etsy, eBay, and many small online stores process payments through PayPalSTRIPE: Millions of online businesses use Stripe; the merchant name may or may not appear alongside itSHOPIFY* MERCHANT: Some Shopify stores show the platform name rather than the merchant
To confirm: Search your email for an order confirmation or receipt with the matching dollar amount from around the same date.
3. Annual subscription renewals you forgot about
Subscriptions billed annually are the most common surprise charge, especially in Q1 when many services renew. The statement descriptor is usually an abbreviated company name, not the product name. That gap is what makes them easy to miss.
What these actually show on your statement
- iCloud storage:
APPLE.COM/BILL - Google One:
GOOGLE ONEorGOOGLE LLC - Dropbox:
DROPBOXorDROPBOX INC - Adobe Creative Cloud:
ADOBEorADOBE SYSTEMS - Microsoft 365:
MICROSOFT*orMSFT*365 - VPN and password managers: usually the company name, sometimes followed by a support phone number
To confirm: Search your email by company name for a receipt. Apple and Google both list active subscriptions and renewal dates in account settings.
If none of the categories above match your charge, it's worth investigating further before disputing. The patterns below are more consistent with unauthorized use.
When it IS actually fraud
Patterns that suggest genuine fraud:
- A charge from a merchant you've never heard of, in a category you don't use, for an amount that doesn't match any common subscription
- Multiple small charges in a row. Card testers often run $1–$2 test charges to verify a card before attempting larger purchases.
- Charges tied to a city or location you've never visited
If research doesn't explain it, you can initiate a dispute with your card issuer. Under federal consumer protections, cardholders generally have 60 days from the statement date. Check your issuer's dispute process for exact requirements and next steps.
See our step-by-step dispute guide for what to document and how to contact your issuer.
Related articles
Dispute Credit Card Charge Guide
Step-by-step guidance for documenting, contacting the merchant, and filing a dispute with your card issuer for unauthorized charges.
Fraud & Disputes10 min readMerchant Descriptors Explained
Learn how statement descriptors work, what prefixes and phone numbers mean, and how to decode recurring billing labels faster.
Statement Basics7 min readSuper+ Charge Explained
Identify the SUPER+ descriptor, why it often appears as a recurring membership fee, and how to verify, cancel, or dispute it safely.
Charge Explanations8 min read