Merchant Category Code (MCC) Analysis for Risk Detection

Every card transaction includes a Merchant Category Code (MCC) that identifies the type of business. Whistl analyses these codes to detect gambling, crypto trading, and other high-risk spending patterns. This guide explains MCC classification, risk scoring, and how transaction categorisation powers impulse detection.

What Are Merchant Category Codes?

MCCs are 4-digit codes assigned by credit card networks to classify businesses:

• Assigned by: Visa, Mastercard, American Express
• Format: 4-digit numeric code (e.g., 7995 = Gambling)
• Purpose: Interchange fees, rewards categorisation, tax reporting
• Included in: Every card transaction from bank feeds

Whistl uses MCCs as a primary signal for identifying risky spending categories.

High-Risk MCC Categories

Whistl flags transactions with these MCC codes as potentially risky:

Gambling MCCs (Critical Risk)

Crypto & Investment MCCs (High Risk)

Shopping MCCs (Moderate Risk)

Food & Entertainment MCCs (Low-Moderate Risk)

MCC Risk Scoring Algorithm

Whistl calculates a risk score for each transaction based on MCC:

Risk Score Calculation

struct MCCRiskCalculator {
    func calculateRisk(mcc: String, amount: Double, context: TransactionContext) -> Double {
        var baseRisk = getBaseRiskForMCC(mcc)
        
        // Amount multiplier (larger amounts = higher risk)
        let amountMultiplier = min(1.0 + (amount / 1000.0), 2.0)
        
        // Time-of-day modifier (late night = higher risk)
        let timeModifier = getTimeModifier(context.hour)
        
        // Velocity modifier (multiple transactions = higher risk)
        let velocityModifier = getVelocityModifier(context.recentTransactions)
        
        // Budget modifier (over budget = higher risk)
        let budgetModifier = getBudgetModifier(
            category: getCategoryForMCC(mcc),
            spent: context.categorySpent,
            budget: context.categoryBudget
        )
        
        var risk = baseRisk * amountMultiplier * timeModifier * velocityModifier * budgetModifier
        return min(risk, 1.0)  // Cap at 1.0
    }
    
    private func getBaseRiskForMCC(_ mcc: String) -> Double {
        switch mcc {
        case "7995", "7801", "7802": return 0.95  // Gambling
        case "6051", "6050": return 0.80  // Crypto
        case "5966", "5967": return 0.65  // Direct marketing
        case "5817": return 0.55  // Bars/nightclubs
        case "5311", "5732": return 0.45  // Department/electronics
        default: return 0.20  // Low risk
        }
    }
}

Risk Score Interpretation

Transaction Categorisation Pipeline

Raw bank transactions are enriched with MCC-based categorisation:

Processing Steps

1. Fetch transaction: From Plaid/bank API with MCC code
2. Lookup MCC: Match against MCC database
3. Assign category: Gambling, crypto, shopping, etc.
4. Calculate risk: Apply risk scoring algorithm
5. Update budgets: Increment category spending totals
6. Trigger alerts: If risk exceeds threshold

Enriched Transaction Data

{
  "transaction_id": "txn-abc123",
  "amount": -150.00,
  "currency": "AUD",
  "merchant_name": "CROWN CASINO",
  "mcc": "7995",
  "mcc_description": "Gambling Transactions",
  "category": "gambling",
  "subcategory": "casino",
  "risk_score": 0.94,
  "risk_factors": [
    "high_risk_mcc",
    "large_amount",
    "late_night",
    "over_budget"
  ],
  "datetime": "2026-03-05T23:45:00+11:00",
  "location": {"lat": -37.8225, "lng": 144.9586},
  "impulse_detected": true,
  "intervention_triggered": true
}

MCC Limitations and Workarounds

MCC codes aren't perfect. Whistl uses additional signals to improve accuracy:

Common MCC Issues

Merchant Name Analysis

When MCC is unreliable, Whistl analyses merchant names:

class MerchantNameAnalyzer {
    private let gamblingKeywords = [
        "casino", "bet", "poker", "tab", "sportsbet", 
        "ladbrokes", "bet365", "crown", "star", "jackpot"
    ]
    
    private let cryptoKeywords = [
        "coinbase", "binance", "crypto", "bitcoin", 
        "ethereum", "blockchain", "defi"
    ]
    
    func analyzeName(_ name: String) -> Category? {
        let lowercased = name.lowercased()
        
        if gamblingKeywords.contains(where: lowercased.contains) {
            return .gambling
        }
        
        if cryptoKeywords.contains(where: lowercased.contains) {
            return .crypto
        }
        
        return nil
    }
}

Pattern-Based Detection

Unusual transaction patterns can indicate risky behaviour:

• Round amounts: $100, $200, $500 (common for gambling)
• Rapid succession: Multiple transactions in minutes
• Unusual timing: 2-5am transactions
• Amount spikes: 3x+ normal spending for category

Budget Integration

MCC categorisation powers Whistl's budget tracking:

Category Budgets

struct CategoryBudget {
    let category: String
    let monthlyLimit: Double
    var spent: Double = 0
    var transactionCount: Int = 0
    
    var utilisation: Double {
        return spent / monthlyLimit
    }
    
    var status: BudgetStatus {
        switch utilisation {
        case 0..<0.7: return .onTrack
        case 0.7..<0.9: return .warning
        case 0.9..<1.0: return .critical
        default: return .exceeded
        }
    }
}

// Example budgets
let budgets = [
    CategoryBudget(category: "gambling", monthlyLimit: 0),  // Zero tolerance
    CategoryBudget(category: "crypto", monthlyLimit: 0),    // Zero tolerance
    CategoryBudget(category: "shopping", monthlyLimit: 500),
    CategoryBudget(category: "dining", monthlyLimit: 300),
    CategoryBudget(category: "entertainment", monthlyLimit: 200)
]

Budget Alerts

• 70% spent: Warning notification
• 90% spent: Critical alert
• 100%+ spent: SpendingShield activation

Historical Analysis

MCC data enables powerful spending pattern analysis:

Trend Detection

• Month-over-month: Category spending trends
• Day-of-week patterns: High-risk days identified
• Time-of-day patterns: Vulnerable hours detected
• Merchant frequency: Repeat risky merchants flagged

Pattern Visualisation

Whistl displays spending patterns in the app:

• Category breakdown: Pie chart of spending by MCC category
• Timeline: Daily/weekly spending trends
• Heat map: High-risk times highlighted
• Merchant list: Top merchants by risk score

Privacy Considerations

MCC data is processed with strict privacy protections:

Data Handling

• On-device processing: MCC analysis happens locally
• Encrypted storage: Transaction data in SQLCipher database
• No raw data transmission: Only aggregated insights sent to cloud
• Automatic deletion: Raw transactions purged after 90 days

Performance Metrics

MCC categorisation accuracy from production deployment:

User Testimonials

"I didn't realise how much I was spending at the TAB until Whistl showed me the breakdown. Eye-opening." — Jake, 31

"The MCC categorisation is scary accurate. It knows when I'm gambling even when I try to hide it." — Marcus, 28

"Setting a zero budget for gambling and getting alerts when I go over... that's what finally worked for me." — Sarah, 34

Conclusion

Merchant Category Codes provide a powerful signal for detecting risky spending patterns. By analysing MCCs alongside transaction amounts, timing, and user context, Whistl identifies impulse spending with high accuracy—all while keeping data private on your device.

MCC categorisation is just one of 27 risk signals that power Whistl's impulse prediction system.

Related: Plaid Bank Integration | Transaction Velocity Algorithms | 27 Risk Signals