Yes, surcharging credit cards is legal in most U.S. states, but the rules stack up fast. Card networks permit a surcharge only on credit cards, capped at the merchant discount rate (MDR) or 3%, whichever is lower, according to Visa's merchant surcharging guidance. Merchants must give 30 days' notice to their acquirer and card brands, disclose the fee before payment, and keep PCI DSS controls in place around any surcharge data.
TL;DR:
- Because restrictions change, verify current statutes for every sale location; multistate and online merchants may need location based checkout rules instead of account wide settings.
- Charge only credit cards, cap fees at the lower of actual acceptance cost or 3%, and give card brands and your acquirer 30 days' notice.
- Show the fee before payment confirmation, list it separately on receipts, and verify that transaction messages populate Visa Field 28 correctly.
- A provider can reduce PCI scope, but merchants remain responsible and should obtain its current Attestation of Compliance in writing before launch.
Table of Contents
- Quick Compliance Checklist Before You Turn On Surcharging
- Which U.S. States Prohibit or Limit Surcharging
- Card Network Rules: Visa, Mastercard, and the 30-Day Notice
- PCI DSS v4.x Considerations When You Add a Surcharge
- Step-by-Step Rollout: Implementing Surcharging the Right Way
- Common Mistakes That Trigger Fines or Forced Refunds
- A Lower MDR Makes Surcharging Easier to Get Right
- How We Help Merchants Launch a Compliant Surcharge Program
- FAQ
- Sources
Quick Compliance Checklist Before You Turn On Surcharging
Before anyone touches a POS setting or a checkout script, we recommend confirming six things in order. Skipping one of these steps is the single biggest reason merchants end up reversing a surcharge program after launch.
- State legality: confirm surcharging is allowed at every outlet location, since a handful of states still restrict or ban it.
- Card type: surcharges apply to credit cards only. Debit and prepaid cards cannot carry a surcharge under Visa's rules.
- Cap calculation: the surcharge cannot exceed your MDR or 3%, whichever is lower, so run the math against your actual acceptance cost.
- Notice period: notify your acquirer and the relevant card brands at least 30 days before your go-live date and keep dated proof.
- Disclosure: checkout and in-store signage must show the surcharge before the customer confirms payment, and receipts need a separate line item.
- PCI scope: confirm which Self-Assessment Questionnaire (SAQ) applies to your setup and whether a third-party service provider (TPSP) reduces your scope.
Treat this as a preflight list, not a formality. Card networks and state regulators both enforce these points independently, so a gap in one area can trigger a penalty even when everything else is correct.
Which U.S. States Prohibit or Limit Surcharging
State law is the first filter, and it varies by location rather than by business type. A handful of states have historically restricted credit card surcharging, including Connecticut, Massachusetts, and Maine, so merchants with outlets in those states need to check the current statute language directly rather than relying on general guidance. Authoritative state pages, such as those maintained by state departments of business or consumer affairs, are the right place to confirm current status, since restrictions have shifted over the past decade as courts and legislatures revisited the issue.
A few practical patterns show up across the stricter states:
- Flat bans: some states prohibit any additional fee for credit card use, meaning surcharging is off the table regardless of amount or disclosure.
- Disclosure-only states: others allow surcharging but only when specific signage and receipt rules are met, which mirrors the card-network disclosure requirements closely.
- No state restriction: most states leave surcharging to card-network rules alone, so merchants there only need to satisfy Visa, Mastercard, and PCI requirements.
For multi-outlet or multi-state merchants, the state that governs a transaction is generally the one where the sale occurs, not where the business is headquartered. That distinction matters for online sales too: an eCommerce merchant shipping nationwide may need to apply the strictest applicable state rule, or build outlet-level and checkout-level logic that applies a surcharge only where it is permitted. A single account-level setting that turns surcharging on everywhere is the most common way merchants end up out of compliance in a restricted state.
Confirming the exact statute language for your state matters more than relying on summaries, since wording changes around what counts as a "surcharge" versus a "discount for cash" can change what is actually allowed. State business resource pages are a good starting point for checking current statute text, and legal counsel should review any multi-state rollout before go-live. Our guide to credit card surcharge laws and the 30-day network notice walks through state-by-state considerations alongside the notice process in more detail.
For outlets operating in or near a restricted state, the safest technical approach is geo-aware logic tied to terminal ID or merchant outlet ID, rather than a blanket account setting. That way, a restaurant chain with locations in both an unrestricted state and a restricted one can run two different checkout configurations without manually toggling settings location by location.
Card Network Rules: Visa, Mastercard, and the 30-Day Notice
Card-brand rules sit on top of state law, and they apply everywhere Visa, Mastercard, or other network cards are accepted, regardless of state restrictions being absent.
Visa's framework is specific. According to Visa's merchant surcharging Q&A, merchants must notify their acquirer at least 30 days before surcharging begins, limit the fee to credit cards only, and cap it at the merchant discount rate or 3%, whichever is lower. Surcharges must be disclosed at the point of entry (such as store signage or a website notice) and again at the point of sale, and receipts must show the surcharge as a separate line item rather than folding it into the total. Visa also requires merchants to populate Field 28 in the transaction message with the surcharge amount, which lets the network and acquirer verify the fee during settlement. Visa notes that acquirers can face fines for violations, with an example penalty of $1,000 cited in its guidance.
Mastercard's approach runs along similar lines. Mastercard's merchant surcharge rules permit either a brand-level surcharge (applied to all Mastercard credit transactions) or a product-level surcharge (applied to a specific Mastercard credit product), and tie the allowable cap to the merchant's actual cost of accepting that card. Mastercard also requires advance notice to both the network and the acquirer, along with the same disclosure expectations: signage before the sale, confirmation at checkout, and a distinct line item on the receipt.
A few operational notes worth keeping in your rollout plan:
- Field 28 accuracy: work with your acquirer to confirm Field 28 is populated correctly in settlement messages, since a mismatch here is a common audit trigger.
- Reconciliation: tie your surcharge percentage to regularly reconciled MDR averages so you can show, if audited, that the fee never exceeded your real acceptance cost.
- Brand-by-brand confirmation: American Express and Discover maintain their own surcharging terms, so confirm current requirements directly with each network or your acquirer before extending a surcharge program across all accepted brands.
- Outlet-level controls: use terminal ID or merchant outlet ID logic rather than one account-wide toggle, especially if you operate in both restricted and unrestricted states.
Mastercard has also moved to lower U.S. interchange costs for smaller merchants and simplify surcharging and discounting mechanics, a shift that affects the practical math behind the surcharge cap for merchants who qualify, according to Mastercard's 2024 announcement. Our breakdown of card brand surcharge rules for U.S. merchants covers Field 28 implementation examples in more depth if your processor needs specific configuration guidance.
PCI DSS v4.x Considerations When You Add a Surcharge
Surcharging touches cardholder data flow, which means it touches your PCI DSS obligations even though surcharging itself is governed by card-network rules rather than PCI standards. PCI DSS v4.x is the active security standard, and most of its new and future-dated requirements became effective March 31, 2025. Compliance here is contractual: your acquirer and the card brands enforce it, and noncompliance can lead to fines, higher processing costs, or a loss of processing privileges.
Your integration method drives which Self-Assessment Questionnaire applies:
- Hosted payment page: typically qualifies for SAQ A, the lightest validation burden, since cardholder data never touches your own systems.
- Hosted page with some direct elements: often falls under SAQ A-EP, which adds requirements around the surrounding environment.
- Direct integration or full control of card data: usually requires SAQ D, the most extensive validation path.
Using a PCI-compliant third-party service provider (TPSP) can reduce your own PCI scope substantially, but it does not remove your responsibility entirely. PCI Security Standards Council guidance notes that merchants should collect an Attestation of Compliance (AOC) or equivalent evidence from each TPSP and confirm in writing which requirements the provider covers. Relying on a TPSP's reputation alone, without documented evidence, leaves a gap that shows up during an acquirer review.
Operationally, a few controls matter most once a surcharge field is live in checkout:
- Quarterly ASV scans: required where your SAQ calls for them, confirming your externally facing systems stay clear of known vulnerabilities.
- Annual scope confirmation: revisit your PCI scope at least yearly, since adding a surcharge field or switching processors can change what counts as in-scope.
- Secure transmission: encrypt cardholder and surcharge data in transit and at rest, consistent with v4.x requirements.
- Logging and monitoring: maintain audit trails that show when the surcharge was calculated, disclosed, and applied, which supports both PCI validation and network audits.
Pro Tip: Request your TPSP's current AOC in writing before go-live, not after an audit request arrives, since a missing attestation is one of the most common gaps acquirers flag.
Our PCI compliance checklist for small businesses walks through these controls in more operational detail if you are mapping out which SAQ applies to your current setup.
Step-by-Step Rollout: Implementing Surcharging the Right Way
A compliant surcharge program follows a fixed order. Skipping ahead, such as updating the checkout before confirming state legality, is how merchants end up reversing a launch.
- Confirm state legality per outlet and online, documenting the statute or state guidance you relied on for each location.
- Calculate your allowable surcharge using MDR or 3%, whichever is lower, and decide whether you'll apply it at the brand level or product level.
- Send 30-day notice to your acquirer and the relevant card brands, keeping a dated copy for your records.
- Update checkout and POS flows so the surcharge displays before payment confirmation and appears as a distinct line item on the receipt.
- Confirm Field 28 population in your transaction messaging and verify settlement reports reconcile surcharge amounts separately from the base sale.
- Re-check your PCI scope, engage a TPSP or ASV scan vendor as needed, and collect AOC documentation as evidence.
- Run test transactions and mystery shopping internally to confirm disclosures appear correctly and that customers can see the fee before confirming payment.
Visa cites a possible $1,000 fine against acquirers for surcharging violations, and acquirers typically pass remediation costs, and sometimes the fine itself, down to the merchant whose program caused the violation. That makes the order above worth following exactly rather than treating it as a rough guide.
Our surcharge program overview breaks down the brand-level versus product-level decision in step two if you're weighing which approach fits your transaction mix.
Common Mistakes That Trigger Fines or Forced Refunds
Most enforcement actions trace back to a small set of repeated errors rather than deliberate rule-breaking.
- Surcharging debit or prepaid cards, which is prohibited outright under network rules regardless of state law.
- Skipping point-of-entry disclosure, meaning the customer never sees the fee until after checkout or on the receipt.
- Exceeding the MDR-or-3% cap, often because the surcharge percentage was set once and never rechecked against actual acceptance costs.
- Missing the 30-day notice window, which leaves no documented proof that the acquirer and brands were informed in advance.
- Leaving Field 28 unpopulated, which shows up during settlement and network audits as inconsistent transaction messaging.
When one of these surfaces, the usual path is an acquirer fine passed to the merchant, a forced refund of surcharges already collected, or a temporary hold on surcharging privileges until the program is corrected. Keeping dated records of your notice, disclosure screenshots, and Field 28 testing is what makes remediation fast rather than drawn out. For the dispute side of this, our partner's chargeback dispute playbook covers the operational controls that help merchants respond quickly when a surcharge-related dispute lands on an acquirer's desk.
A Lower MDR Makes Surcharging Easier to Get Right
The size of a surcharge is a direct function of the merchant discount rate, so the lower your real acceptance cost, the smaller the fee a customer sees at checkout. A smaller surcharge tends to draw fewer customer objections and fewer disputes, which keeps the whole program easier to manage over time.
This is where pricing transparency and surcharge compliance intersect more than most merchants expect: a merchant paying a high blended rate has less room to stay under the 3% cap once PCI and network administrative costs are factored in, while a merchant on a transparent, interchange-based rate structure usually has a lower MDR to work from, which gives more flexibility to set a cap-compliant surcharge that still covers acceptance costs.
— PaySec Marketing Team
How We Help Merchants Launch a Compliant Surcharge Program
We built our Network Offset Pricing to pass through true wholesale interchange rates instead of a flat-rate markup, which lowers a merchant's effective MDR and gives more room to stay under the card-brand surcharge cap. Lower acceptance costs mean a smaller surcharge at checkout, and a smaller surcharge tends to go over better with customers.
We support merchants through the pieces this article covers directly:
- Network Offset Pricing that reduces the baseline MDR your surcharge cap is measured against.
- Detailed transaction reporting that helps confirm Field 28 population and surcharge reconciliation at settlement.
- Merchant services covering in-store processing, eCommerce gateway integration, and mobile payments, so disclosure and receipt requirements are consistent across every channel.
- No long-term contracts and no minimums, allowing flexibility when testing surcharge programs.
Our plans are detailed on our pricing page. If you're planning a surcharge rollout, start by reviewing your current MDR against the 3% cap using our merchant services overview to see which integration path fits your checkout, then reach out to talk through your specific outlets and timeline.
This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.
FAQ
Is PCI Compliance Legally Required?
PCI DSS compliance is not a federal law, it is a contractual requirement enforced by card networks and acquirers as a condition of accepting Visa, Mastercard, and other branded cards. Merchants who process, store, or transmit cardholder data must validate compliance according to their acquirer's program under PCI DSS v4.x, and failing to do so can mean fines or loss of processing rather than a government penalty.
Where Is Surcharging Banned?
A handful of states have historically restricted or banned credit card surcharging, including Connecticut, Massachusetts, and Maine, though statute language changes over time. Merchants should confirm current rules directly through state business resource pages or local counsel for each outlet location before enabling a surcharge.
Is It Legal to Charge 3% on a Debit Card Purchase?
No, surcharges apply only to credit card transactions under card-network rules; debit and prepaid cards cannot be surcharged regardless of the percentage, according to Visa's merchant surcharging guidance. Applying a surcharge to a debit transaction is a network violation even where state law otherwise permits surcharging.
Do I Have to Pay a PCI Compliance Fee?
PCI compliance validation costs and any related fees are set by your acquirer or payment processor rather than by a single industry-wide rate, so the amount depends on your provider's program and your required SAQ level. Merchants should confirm their specific validation requirements and any associated costs directly with their processor rather than assuming a standard fee applies.
Sources
- Visa merchant surcharging Q&A
- Mastercard credit card surcharge rules
- Payment Card Industry Data Security Standard (PCI DSS v4.x)