Stripe and PayPal Holds for Dropshippers in 2026 (Education Only)

Read this before you panic, call a lawyer, or pay an escalation service

Stripe and PayPal holds are one of the highest-stress events in a dropshipping business. When funds get frozen, your instinct is to panic, escalate to support, threaten legal action, or pay an escalation service. However most holds resolve through patient compliance with the processor's documented review process, not through escalation. The framing here is operator-honest: lean on the system that exists rather than fight it from outside.

This post explains the publicly disclosed processor policies, the card-network dispute windows that drive hold lengths (Visa and Mastercard set 120-day chargeback windows under their Core Rules), and the merchant behavior patterns that processors weight in their automated review. Anything beyond that requires a qualified attorney who can review your specific account, contract, and transaction history. The content here should make the conversation with that attorney more productive, not replace it.

Why we wrote this: we have run dropshipping operations through both Stripe and PayPal at scale, we tracked $41.9M in attributed revenue across 2,300+ Godmode-built stores at a 14.2x average ROAS, and we have personally been through a Stripe hold large enough to require attorney involvement. So the playbook below is both publicly sourced and operator-tested. We are not selling you a hold-recovery service. We are explaining what the system actually does so you can navigate it.

3 patterns that freeze dropshipping funds (and none are personal)

Three patterns trigger most dropshipping holds, and all three are documented in the processors' public risk frameworks:

• Volume spike outside your application profile. When you opened the account, you described an expected monthly volume. Scaling from $1K to $50K daily in a week looks like a high-risk pattern to the processor's automated risk model. Stripe's public Account Reviews documentation confirms reviews trigger when volume materially exceeds disclosed estimates. The fix is graduated scaling: typically processors tolerate 2-3x weekly growth, but a 10x weekly jump may trigger an automated review.
• Dispute or chargeback rate climbing. Visa's Dispute Monitoring Program flags merchants who exceed 0.9% chargeback rate or 100 monthly disputes (whichever comes first). Mastercard's Excessive Chargeback Program kicks in at 1.5%. Above either threshold, the processor may freeze the account or impose a rolling reserve. Tools like Chargeblast (catches inbound chargeback notifications) and Disputifier (compiles evidence packets) typically help operators stay below the threshold.
• Category watchlist flag. Visa's Integrity Risk Program (formerly BRAM) flags categories like CBD (cannabidiol), nutraceuticals, and certain consumer electronics as elevated-risk merchant categories. Processors mirror these card-network categories in their own AUPs (Acceptable Use Policies). However the fix is reading the AUP before opening the account, not after the freeze lands.

Holds are not personal. They are automated risk responses to patterns that Visa, Mastercard, and the processors' own models read as elevated. Understanding the pattern lets you prevent the trigger or respond to it without panicking. More on the hidden cost side: reading real profit on Shopify.

Why every Stripe hold is 120 days (the Visa rule nobody mentions)

Stripe holds are typically 90 to 180 days, with the most commonly reported window being around 120 days. The reason is structural: Visa and Mastercard set chargeback dispute windows at 120 days from the original transaction date under their Core Rules. After the dispute window closes plus a small buffer, Stripe releases remaining funds minus reserves for any unresolved disputes or refunds. So Stripe is not holding your funds arbitrarily; it is waiting until the network can no longer claw back transactions.

However the standard escalation steps you should run, in order:

1. Submit a Stripe Dashboard support ticket. Stripe's official review request flow is the documented path. Include full documentation: supplier invoices, fulfillment proof, dispute evidence, customer correspondence. Stripe's public SLA is generally 5 to 10 business days for an initial response.
2. Provide additional documentation fast. Stripe may ask for tax documentation, bank statements, supplier contracts. Provide everything within 24 to 48 hours of the request. Slow response on documentation is the most common reason holds extend.
3. Wait through the review checkpoints. Most holds get reviewed at 30, 60, 90, and 120 days under the documented review cadence. Some funds may be released incrementally if your evidence package is strong and dispute volume on the held funds is low.
4. If the hold runs the full window without release (education only): some operators consult payments attorneys at this point. We have done this ourselves on a Stripe hold of meaningful size. The attorney evaluates whether legal action is warranted based on the specific contract terms and your fact pattern.
5. Formal lawsuit (last resort, attorney-led): in some operator-reported cases, filing a formal complaint has prompted Stripe to settle and release funds rather than litigate. The mechanism appears to be that defense costs typically exceed small-to-mid held amounts. We had this experience directly. None of this is legal advice and your fact pattern may differ.

Note: every situation is fact-specific. Consult a qualified payments attorney before taking any escalation action. The operators who run this playbook successfully are the ones who exhaust internal channels first, document everything, and engage counsel only when the standard process has been exhausted. Reach out if you want a referral to a payments attorney we have worked with.

Patient PayPal beats every escalation service ever built

PayPal's hold logic is more responsive to merchant-side action than Stripe. PayPal's User Agreement documents a 21-day rolling reserve as the default for new merchants, with risk-based reserves of up to 30% for flagged accounts. However when you consistently demonstrate trust signals, PayPal will lift holds incrementally rather than all-or-nothing. Here is the patient compliance path that tends to work:

• Upload tracking within 24 hours of fulfillment. PayPal's Seller Protection program requires valid tracking uploaded to qualifying transactions. Tools like Trakipal automate this for AliExpress, CJ Dropshipping (Chinese supplier network), and most major suppliers. However manual uploads work too, just with drift risk. Tracking is the single biggest fulfillment trust signal in PayPal's automated review.
• Respond to every dispute in PayPal Resolution Center within 24 hours. Even when you cannot win the dispute, the response signals active business management. Disputes you ignore confirm to PayPal that the business is not legitimate, which feeds back into hold severity.
• Provide evidence packets on disputes. Order details, tracking, customer correspondence, supplier invoice, refund/return policy. Build a template so each dispute response is consistent and you can ship one in under 10 minutes.
• Maintain customer correspondence inside PayPal. Respond to buyer messages through the PayPal interface, not just your store email. Visible activity inside PayPal feeds the trust score directly because PayPal can read those messages.
• Be patient with the review cadence. PayPal reviews holds every 30 to 60 days under their documented review process. Compliant merchants commonly report partial release at 60 days and full release at 90 to 120 days, even on flagged accounts. So the patient path tends to work, but it does require the patience.

PayPal is also the highest-CVR-lift processor for dropshipping. Baymard Institute's checkout research has shown that adding PayPal as a checkout option lifts completion rate measurably for younger demographics, who default to PayPal balance or BNPL (Buy Now Pay Later) through PayPal. So losing PayPal access does not just freeze funds, it materially hurts your future conversion rate. However the patient path preserves PayPal access. The escalation-service path often loses it. Hold-prevention compounds with checkout-protection: CVR 1.5% to 4%+ playbook.

Behave like a real business. The system actually protects you.

Most processor holds happen to merchants whose behavior signals they are not running a real business. However when you respond to disputes in 24 hours, upload tracking automatically, communicate with the processor proactively, and treat customer service like a profession, you do not get held the same way the merchant who ignores all of that does. The processor models track these signals directly.

Here is the operator hygiene that prevents most holds (and that incidentally also grows the business durably):

• Customer service that responds within 24 hours. Not a chatbot, not auto-responses. Real responses to real concerns. Baymard Institute's checkout usability research has shown that visible support responsiveness reduces dispute filings before they happen.
• Clear refund and return policy on the storefront. Not buried, not deceptive, prominently displayed near the buy button. You can defend disputes more easily when the policy is transparent because both Stripe and PayPal accept the published policy as evidence.
• Honest shipping time disclosure. If your supplier ships from China and takes 14-21 days, say so on the product page and at checkout. Hidden long ship times trigger refund-class disputes (Visa Reason Code 13.1, Mastercard Reason Code 4855) that destroy the processor relationship and feed the chargeback rate.
• Tracking number on every order, uploaded fast. Trakipal automates this. PayPal's Seller Protection program explicitly requires tracking on qualifying transactions, and Stripe's dispute evidence flow accepts tracking as proof of fulfillment. So this single habit covers two processors at once.
• Reserves for operational continuity. Keep 10-20% of monthly revenue in a separate account. A hold should be inconvenient, not catastrophic. The 90-180 day window is the worst case, so plan working capital accordingly.

When you run dropshipping like a real business, you rarely face full-window holds. The processors that flag risky merchants are the same processors that protect compliant merchants when disputes arise. Reciprocity is the model. So behave like a real business and the system mostly works in your favor.

The 5-layer stack that stops the freeze before it starts

The full operator hygiene stack costs roughly $200 to $600 per month in tooling, but it eliminates the majority of hold risk. Compared to the cost of a single full-window hold (90-180 days of frozen working capital), the prevention stack pays for itself many times over. We have seen this play out across the 2,300+ Godmode-built dropshipping stores tracked through our pipeline. So hold prevention compounds with the broader profit-protection stack: reading real profit on Shopify and the dispute-related winner-decay pattern at why your dropshipping winner died.

Independent references for processor policies: Stripe Restricted Businesses, PayPal Acceptable Use Policy. Card network rules: Visa Core Rules, Mastercard Excessive Chargeback Program. Chargeback economics: Stripe Chargebacks 101. UX research: Baymard Checkout Usability.

Frequently asked questions