Honestly it\u2019s a miracle that the merchant is still solvent.<\/p>\n\n\n\n
Time to switch processors.<\/p>\n\n\n\n
Ignoring the outrageous Shaft4 termination fee<\/a>, which is, somehow, basically just legalized racketeering at this point, the merchant needs to move over their cards on file.<\/p>\n\n\n\n What are cards on file?<\/p>\n\n\n\n Well, the information on the face of a credit and debit card has been deemed a \u201csecurity risk\u201d, so it \u201cmust\u201d be protected with a bunch of expensive, nonsense compliance\u2026 that earn the makers of said arbitrary rules even more money, because we guess there wasn\u2019t enough money just ripping basis points on every transaction as a duopoly.<\/p>\n\n\n\n Imagine that there was only one source of food, and you had to buy utensils every time you ate from\u2026 the only manufacturer of said food.<\/p>\n\n\n\n Think those forks are going to be reasonably priced?<\/p>\n\n\n\n If you want history on how this \u201csecurity\u201d body came to be (it\u2019s called PCI, btw), feel free to read this piece<\/a>. <\/p>\n\n\n\n So anyway, these cards are tokenized, meaning that the super-sensitive-better-never-let-it-leak-but-let\u2019s-ignore-the-easier-and-more-effective-means-of-ssecurity card numbers are hashed into a string of characters that the gateway generates.<\/p>\n\n\n\n As an example, assume your card number is 4242 4242 4242 4242.<\/p>\n\n\n\n Can\u2019t have that number just floating around.<\/p>\n\n\n\n So the gateway – in this case Shaft4 – turns that card number into a unique token that represents that card, but if someone were to ever access that token they couldn\u2019t easily decrypt it back into the original card number.<\/p>\n\n\n\n Make sense?<\/p>\n\n\n\n Well the only party that can<\/em> reasonably read that token is Shaft4.<\/p>\n\n\n\n Meaning that if you wanted to move that card on file into your new gateway partner, you can\u2019t.<\/p>\n\n\n\n Not without Shaft4 giving you the original card number, at which point your new gateway partner would convert that card number into its own token.<\/p>\n\n\n\n On a technical level, the hand-off needs (according to arbitrary PCI rules, mind you) to happen directly between Shaft4 and your new gateway in a PCI-secure environment.<\/p>\n\n\n\n Anyone who\u2019s not operating a PCI-secure environment cannot touch the data.<\/p>\n\n\n\n But this is technical.<\/p>\n\n\n\n On a business level, things are different.<\/p>\n\n\n\n When Shaft4 – or really any processor – hears that their merchant is leaving, they throw up blockers.<\/p>\n\n\n\n \u201cMother f*cker, I worked hard to induce that piece of sh*t merchant, and I want to bleed them out; there\u2019s still blood left Godd*amnit!\u201d<\/p>\n\n\n\n Literally the first – and only – thought that traverses the big brains of the legacy payment bros.<\/p>\n\n\n\n This then goes one of two ways.<\/p>\n\n\n\n First, Shaft4 just entirely refuses to cooperate. <\/p>\n\n\n\n Doesn\u2019t respond to communications. <\/p>\n\n\n\n Tells the merchant it\u2019s impossible to leave. <\/p>\n\n\n\n You know what this looks like. The more desperate the processor, the worse this behavior.<\/p>\n\n\n\n Second, the processor allows the merchant to leave but they make it so economically punitive it\u2019s impossible in reality. Like\u2026<\/p>\n\n\n\n Termination fees that are 20 years of a merchant\u2019s margin (not kidding, here\u2019s Shaft4\u2019s termination fee schedule as proof:<\/p>\n\n\n\n Absurd costs to move the tokens. <\/p>\n\n\n\n How about 6 figures for 1,000 tokens? Sounds fair, right?<\/p>\n\n\n\n It turns out that there are<\/em> rules for what you can and can\u2019t do in these situations, at least if you participate in card acceptance through the duopolies. Because Visa and Mastercard are absolutely nothing if not fantastic as setting (and capriciously enforcing<\/a>) arbitrary rules.<\/p>\n\n\n\n To get to the bottom of this, we tapped the inimitable Jason Kafer<\/a>, who is incredibly well versed on most everything payments.<\/p>\n\n\n\n First, the rules on tokens:<\/p>\n\n\n\n So no, processors\/acquirers CANNOT obstruct the migration of tokens.<\/p>\n\n\n\n Hard stop.<\/p>\n\n\n\n If you stick your hand in the payments cookie jar you have to let other people snack, too.<\/p>\n\n\n\n \u201cSometimes the processors forget the rules they signed up to follow, and you need counsel to send them a letter reminding them,\u201d shares Jason.<\/p>\n\n\n\n But sometimes there are legitimate reasons to pause before token release.<\/p>\n\n\n\n Most of the time the person going to the processor is the merchant, who is not PCI level 1 certified. The merchant shouldn’t be doing this: they should connect the new service provider with their existing processor. The new service provider should draft a PDF of answers to objections that the existing processor might raise, and send this to the merchant to forward on to their existing processor. If you don\u2019t do this, the best case is you have 3-4 weeks of back and forth before anything happens.<\/p>\n<\/blockquote>\n\n\n\n Jason wants to be clear that there can be legitimate fees associated with transferring tokens.<\/p>\n\n\n\n There\u2019s no black and white rule against charging for token release. Of course there are reasonable and legitimate costs, but then there\u2019s just greed. You need someone with experience to provide you guidelines sometimes.<\/p>\n<\/blockquote>\n\n\n\n Even if you cross this rubicon and get the tokens released for a fair exchange, there are still pitfalls.<\/p>\n\n\n\n \u201cPeople need to be very clear and specific on what they want, and what they get. Detail out the data you need or you\u2019re likely to receive tokens that are worthless.\u201d<\/p>\n\n\n\n What does that mean?<\/p>\n\n\n\n \u201cProcessors will export the minimum amount required to the new party. I\u2019ve often seen tokens come over that are entirely lacking AVS or CVV data, which means you\u2019ll never be able to leverage network tokens or even modern payment tools.\u201d <\/p>\n\n\n\n If you really want to understand the pitfalls in more detail, you need to read<\/a> Jason\u2019s post on the matter. There are a lot of gotchas with network tokenization, and the large processors in particular can take months to port tokens. <\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/reformingretail.com\/wp-content\/uploads\/2026\/04\/image.png?resize=361%2C366&ssl=1\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/reformingretail.com\/wp-content\/uploads\/2026\/04\/image-1.png?resize=609%2C132&ssl=1\")
<\/figure>\n\n\n\n\n
\n