Here is the uncomfortable truth most new vape store owners learn the hard way: the software that runs a clothing boutique, a coffee shop, or a general ecommerce store will not run a vape shop — at least not for long. Three structural differences separate vape retail from normal retail, and each one demands dedicated tooling.
1.1 Vape is a "high-risk" payment category
Card networks and acquiring banks classify vape merchants under high-risk categories (MCC 5993 — tobacco/vape retailers). High-risk means higher average chargeback ratios, stricter underwriting, and a higher chance of regulatory liability landing on the processor. Mainstream providers simply refuse this business class:
- Stripe, PayPal, and Square all prohibit tobacco/vape sales in their acceptable-use policies. They will terminate accounts and hold funds when they detect vape transactions — sometimes after months of processing.
- Specialized "high-risk" processors (reviewed in depth in our payment processor guide) underwrite vape merchants, offer rolling reserves, and understand FDA/PACT exposure. They cost more — typically 0.3–1.5% over interchange plus a monthly gateway fee — but they don't freeze you.
If your POS or ecommerce platform can only plug into mainstream gateways, you haven't actually solved payments. You've just postponed the freeze.
1.2 Every sale is age-restricted
Federal law (and the PACT Act) requires age verification of 21+ for all tobacco and vaping products — at the point of sale in-store, at checkout online, and again at the door on delivery. A generic POS doesn't scan IDs, a generic checkout doesn't run a database age check, and a generic shipper doesn't verify who signs the package. Each gap is a separate fine waiting to happen, and state enforcement ranges from $500 to $10,000+ per violation, with license revocation as the ceiling.
1.3 Compliance is a recurring workflow, not an event
Beyond the sale itself, vape businesses owe ongoing regulatory obligations:
- FDA: retailer registration, selling only products with marketing authorization or a pending/effective PMTA, record-keeping.
- PACT Act: registering with ATF before shipping, verifying age at delivery, collecting state excise taxes, and filing recurring sales reports to each destination state.
- State-level: licenses, excise taxes on top of sales tax (some states tax per-milliliter or per-nicotine-milligram), flavor bans, and online-sale bans.
Doing all of this in spreadsheets works until the first audit. Dedicated compliance software turns it into automated reporting with audit trails — more on that in our compliance stack guide.
The "just use Shopify" trap Shopify is excellent — until you try to take a payment. Shopify Payments explicitly prohibits vape, so you'll need a third-party high-risk gateway anyway, plus an age-gate app for checkout, plus PACT Act reporting setup, plus a compliant shipping method. By the time you assemble all that, you've built a vape-specific stack on top of Shopify without any of the guardrails. It can work; it is never "just Shopify."
