Invest1 publisher3 min readPublished
Polymarket's February deposit rejections ran at eighty times the industry rate
The Wall Street Journal reported that Checkout.com blocked most Polymarket US card deposits at February's peak, and the controls that pulled fraud back to normal by May were a cap on cards per account and an outside vendor.
The Investor · Invest desk
What happened
- The Wall Street Journal reported that criminals linked stolen cards to thousands of Polymarket US accounts, funded them, pushed the money through trading, then withdrew to cards or accounts they controlled.
- At February's peak, Checkout.com rejected more than 80% of the deposits it handled for Polymarket as fraudulent, a rate the Journal set against an industry level of roughly 1%.
- A Sept. 19 report put the attempted total at at least $10 million in illicit withdrawals and wagers on the U.S. platform in February.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- exposure Under Checkout.com's terms the merchant owns the accept-or-cancel decision, so Polymarket carries the consequences of a filter tuned by a third party.
- precedent With Visa pressing processors to tighten screening, the cost of onboarding a US prediction-market customer gets set by card-network dispute rates and not by derivatives status.
- contradiction The headline $10 million is attempted volume and Checkout.com has not confirmed the 80% figure, so the same evidence supports either a large loss event or screening that held.
Eighty times the norm is the relationship between the two rates in the Journal's account [1], and a rejection rate measures screening, not money lost. Fewer than one in five attempted deposits got through at the peak, four blocked for every one approved [2]. The $10 million is what fraudsters allegedly tried to move, and the public reporting reviewed by crypto.news does not provide a final amount successfully withdrawn [11].
The rejection rate is not purely the processor's call. Checkout.com sells merchants fraud-scoring, transaction-filtering and authentication tools, and its current service terms state that merchants remain responsible for deciding whether transactions are accepted or canceled [6]. Checkout.com has not confirmed the 80% figure in a public statement reviewed for the crypto.news report [5].
The controls that worked were payments controls. Polymarket limited how many debit cards a user could connect to an account and brought in Riskified as an outside antifraud provider, whose Polymarket-specific fraud numbers are not public [14], and by May fraud rates had moved back toward industry levels [13]. That is roughly three months between the February peak and the return to normal [3]. Earlier, according to the Journal, Polymarket had required some withdrawals to return to the same payment source that funded the account, then loosened that restriction [16]. A same-source rule sends the money back to the card it came from. Without it, a funded balance can leave to a destination the depositor picked.
QCX LLC, doing business as Polymarket US, has been a CFTC-designated contract market since July 2025 [18], and it is legally separate from the company's international blockchain-based market [19]. The rulebook version certified in April lets the exchange restrict accounts and place customers into liquidation-only status [17]. Those powers reach an account after a deposit has cleared. The authorisation decision sits upstream, and The Information reported Visa pushing payment processors to tighten screening as disputed transactions increased [15]. On this record the repair came from the card stack; what the CFTC asked QCX for on payments screening is not in the reporting.
I'd expect the durable cost here to be deposit conversion in the US, because a filter aggressive enough to stop four in five attempts also turns away customers whose cards are their own, and the exchange cannot tell which without letting some through. The other reading is kinder: an 80% block rate is screening that worked, in which case February was mostly an expense for the processor and the networks. A third reading matters more for anyone pricing the business: a months-long dispute problem requiring an outside vendor makes the acquiring relationship the scarce input.
Current and former employees told the Journal that compliance workers escalated concerns about the surge to chief executive Shayne Coplan [7]. According to people cited by the newspaper, Coplan responded, "Just keep growing and pay a fine if regulators ever find out" [8]. Polymarket has not publicly confirmed that Coplan made the remark [9], and told the Journal that it maintains procedures to identify and respond to suspicious activity and remains committed to cooperating with regulators and law enforcement [10]. The company has hired Warren Jenson as chief financial officer and is expanding compliance, investigations and risk management staffing [20].
What to watch
- Any statement from Checkout.com confirming or disputing the 80% rejection rate attributed to it.
- Whether QCX files rulebook or CFTC amendments that reach payments screening rather than account restrictions.
- Whether Visa or the acquiring chain discloses dispute volumes that show who absorbed the February transactions.