The weAudit Gateway Scorecard · No. 3
Cybersource Review: Enterprise Fees, Interchange Impact, and Our Rating
The enterprise gateway of choice for the world’s biggest merchants, graded the way we grade everything: by what it actually costs them.
4.0
out of 10
Last updated July 2026
1994
The year this gateway was built
Cybersource is two years older than Authorize.net, the gateway it would later buy. Three decades of enterprise deployments sit on top of that foundation, wrapped in layers of modules, consultants, and custom contracts. That matters, because complexity is not neutral. Every layer between you and your transaction data is a place where cost can hide, and at enterprise volume, hidden cost compounds fast.
The Paper Trail
Who Owns Cybersource?
1994
Founded in San Jose
2007
Buys Authorize.net
$565 million
2010
Visa buys Cybersource
$2 billion
Owned by Visa
Visa owns Cybersource, and through it, Authorize.net. The network that sets interchange rates owns the two most recommended gateways in America, one for small business and one for the enterprise. Sit with that for a moment.
Follow the Money
The Two Billion Dollar Question
Visa paid $2 billion for Cybersource. Nobody spends $2 billion out of generosity. That price was a calculation: the buyer looked at the fees flowing out of merchants’ accounts every month and decided that stream was worth $2 billion, and then some. Acquisitions in this industry are not bets on technology. They are bets on your processing statement.
So ask the question nobody asks: how much must a gateway be making on merchants for someone to pay $2 billion to own it? Every gateway fee, module fee, and transaction fee you have paid since 2010 has been funding the return on that investment. When a payments company changes hands, the merchants become the payment plan.
The Popularity Trap
Why Is Cybersource So Popular?
Simple: it is the safe enterprise answer. Cybersource is the gateway that systems integrators, enterprise consultants, and banks recommend to large merchants, because it scales globally, checks every procurement box, and nobody ever got fired for choosing it. The recommendation comes with a Visa logo attached, and the deal gets signed.
Here is the problem. The people recommending it are not interchange experts either. Integrators get paid for the implementation, consultants get paid for the project, and banks get paid for the relationship. Not one of them is compensated for lowering your interchange, and not one of them will ever see the downgrade fees buried in your processing statements. At enterprise volume, those fees are not a rounding error. They are a budget line nobody knows exists.
The Scorecard
How Cybersource Scores
Interchange
2/10
Supported, Not Delivered
Interchange makes up over 80% of total processing costs, and Cybersource does support Level 3. But read the fine print: by its own documentation, Cybersource is a pure pass-through. It does not enhance your data on the backend. Your integration must populate roughly 30 line-item fields correctly on every single transaction, and Cybersource performs only minimal validation. Here is the part that should keep CFOs up at night: if required fields are missing or wrong, the transaction does not fail. It processes successfully and quietly clears at a downgraded category like Standard, one of the highest interchange tiers there is. No error. No warning. Just a bigger bill. And even a perfect implementation does not stay perfect: interchange rules and rates change every April and October, so an integration that qualified flawlessly at launch quietly decays twice a year unless someone is paid to maintain it. At enterprise volume, those silent downgrades run into six figures a year.
Opaque Fees
3/10
No Price Tag on the Door
Cybersource does not publish pricing. Even the major software review sites list it as “no pricing available” while its own sister company Authorize.net publishes a rate card. Everything is a custom enterprise contract: per-transaction gateway fees, module fees, support tiers, and implementation costs. And the add-ons pile up. Decision Manager for fraud, tokenization, account updater, each with its own fee, each sold as essential. The question nobody asks: do the add-ons save enough to pay for themselves? We have audited merchants paying over $2,000 a month for fraud services who, when we asked, had next to zero fraud before the service started. They were paying enterprise prices to solve a problem they did not have. Is the juice worth the squeeze? Usually nobody has ever run the math.
Complexity
3/10
The Cost Hides in the Layers
Enterprise implementations take months, require consultants, and produce configurations nobody fully understands two years later. When the person who built your integration is gone, so is the knowledge of how your transactions qualify. Complexity is where interchange leaks start, and Cybersource deployments have more layers than any gateway we audit.
Credit Where Due
8/10
Genuine Enterprise Scale
Credit where it is due: Cybersource operates at a scale few gateways can match. Global acquirer connections, multi-currency support, serious fraud tooling in Decision Manager, and the reliability the world’s largest merchants demand. If you need to process in forty countries, the shortlist is short and Cybersource is on it. Our issue has never been whether it can handle your volume. It is what that volume quietly costs.
“The safe enterprise choice. Safe for whom?”
Beyond the Scorecard
Are You Even on the Right Gateway?
A scorecard tells you about the gateway. An audit tells you about YOUR gateway, on your card mix, your industry, and your statements. Every weAudit engagement reveals:
✓Whether you are on the right payment gateway for your business, or quietly paying for the wrong one
✓Missed interchange qualifications and forced downgrades
✓Incorrect setups: interchange flags, MCC codes, shopping carts, and gateways
✓Hidden, inflated, and made up fees buried in your statement
✓Processor markups and kept interchange rebates
✓PCI non-compliance fees you may not even owe
✓Contract traps: auto renewals, exit penalties, and terms working against you
✓Incorrect MCC codes costing you specialty interchange rates
✓And much more. If it is on your statement, we audit it.
Common Questions
Cybersource FAQ
Does Cybersource support Level 2 and Level 3 processing?
Yes, but support is not delivery. Cybersource’s own documentation describes it as a pass-through service: it does not enhance data on the backend, your integration must supply roughly 30 correct fields per transaction, and validation is minimal. If fields are missing or wrong, the transaction still approves and silently downgrades to a higher interchange category. In our audits of enterprise merchants, assumed optimization is one of the most expensive assumptions on the statement.
How much does Cybersource cost?
There is no published price. Every merchant signs a custom enterprise contract covering per-transaction gateway fees, module fees for tools like Decision Manager and tokenization, support tiers, and implementation. Two merchants with identical volume can pay very different amounts, and neither will ever know. And each add-on raises the same question: does it save enough to pay for itself? We have seen merchants paying over $2,000 a month for fraud tooling with virtually no fraud history. Nobody had ever run the math.
Is Cybersource good for large B2B companies?
Yes and no. Yes, as in it can be, but only if all the custom interchange work has been done and is kept updated. Interchange rules and rates change every April and October, which means a properly optimized Cybersource setup is not a project. It is a job. A much better option is a data-enhanced gateway that fixes interchange on the back end, so your payment gateway does not become a full-time role for a $100,000-a-year employee. Or worse, you do not keep it updated and lose hundreds of thousands in interchange downgrades, which is what many merchants do. Unlike a salary, which you can put an expense number on, interchange losses quietly drain your business bank account without saying a word. Do we need to mention the $2 billion Visa paid to buy this gateway? Cash cow is not an insult here. It is the business model.
Who owns Cybersource?
Visa. Cybersource was founded in San Jose in 1994, bought Authorize.net in 2007 for $565 million, and was acquired by Visa in 2010 for $2 billion. The network that sets interchange rates owns both the leading small business gateway and the leading enterprise gateway.
Should I switch away from Cybersource?
Not necessarily. For genuinely global enterprises, the alternatives list is short, and the fix is often configuration and contract renegotiation rather than replacement. But that determination requires seeing your statements, your implementation, and your agreement, which is exactly what an audit does. Upload a statement and we will tell you where you stand.
Are You Paying the Enterprise Tax?
If you run on Cybersource, your statements and your contract will show exactly what the complexity is costing you in downgrades, module fees, and negotiated terms that favored the other side of the table. Upload a statement and we will show you, line by line. No obligation. Just answers.
Get Your Free Audit
Written by the team at weAudit, founded by a Former Executive for the World’s Largest Credit Card Processor. Forbes Business Council. Entrepreneur Contributor.
weAudit.com