Mastercard GMAP: Suspended Since 2020, Reported Back for 2027
- Two different programs share the GMAP acronym, about seven years apart. Which one someone means changes the whole answer.
- The original is suspended. Mastercard's Security Rules and Procedures, Merchant Edition, 3 February 2026 gives section 8.2 one sentence and nothing else. Suspended since 15 October 2020. It never carried fines even when it ran.
- A second, different GMAP is reported for 1 April 2027. Fraud plus disputes, fine ladders, acquirers included. Three industry sources reported it at the end of July 2026. None could cite a bulletin number. Neither can anyone quoting an ECM or HECM figure REPORTED.
- Right now, in between the two, GMAP measures nothing. No merchant has been assessed under it since October 2020.
- Reason code 4849 is a QMAP code, not a GMAP code. Kount, Justt and Chargeback.io all still label it GMAP on live pages. All three are wrong.
- What you're actually measured against today: ECM and HECM for chargebacks, EFM for fraud, VAMP on Visa, and SMMP if you sell card-not-present.
Search GMAP today and you land on acquirer PDFs from 2019. An orphaned Mastercard eLearning module. Three vendors' reason-code libraries calling 4849 "the GMAP chargeback." Every one of them presents a suspended program as if it's running. Nobody publishes the correction, so here it is.
On this page
For the live programs, see Network Programs Reference.
The direct answer
GMAP stands for Global Merchant Audit Program. Two different Mastercard programs have carried that name. Seen GMAP described as both dead and coming? That's why. Both statements are true. Different programs, different years.
| The original GMAP | The reported 2027 GMAP | |
|---|---|---|
| Status | Suspended 15 October 2020. Still suspended in the 3 February 2026 rules | Reported for 1 April 2027 REPORTED |
| Measures | Fraud only, as a share of sales | Fraud reports plus non-fraud disputes, combined |
| Applies to | Merchant locations | Merchants and acquirers |
| Consequences | A fraud alert and training. No fines, ever | Fine ladders reported into six figures |
| Verified? | Yes, in Mastercard's own rulebook | No. No bulletin number exists in any source we found |
They share an acronym and nothing else. A fraud-only program with no fines isn't the same thing as a combined fraud-and-dispute program with a fine ladder. The likeliest reading is that Mastercard is reusing a shelved name, not restarting the old program. We can't prove that. The February 2027 rulebook settles it either way.
In the meantime, and that means right now, GMAP measures nothing. The gap between 15 October 2020 and 1 April 2027 is where you're sitting.
The original program comes first here. It's what generates the stale material people land on. Skip to the 2027 program if that's what you came for.
The original program
It was a Mastercard fraud program. It isn't running.
Mastercard's Security Rules and Procedures, Merchant Edition, dated 3 February 2026, cuts section 8.2 to one sentence.
The Global Merchant Audit Program (GMAP) has been suspended until further notice.
That's the entire section. No tiers, no thresholds, no dates. The 2021 and 2022 editions carried the same suspension with a date: effective 15 October 2020. We checked seven editions through the Wayback Machine's index. The wording never quietly changed back.
No merchant has been measured against GMAP since October 2020. A compliance checklist, an onboarding pack, a reason-code lookup, a vendor deck: if it put GMAP in front of you, it's stale. That's not a judgment about your account. It's a judgment about the document.
Skip to what actually applies.
What GMAP was (history, not a live threshold)
Historical only. Effective 15 October 2020, suspended until further notice. These aren't thresholds anyone is measured against today.
GMAP watched fraud, not chargebacks. It ran three tiers. Each tier needed the fraud count, the fraud dollar amount and the fraud-to-sales ratio met together.
| Tier | Name | Fraud transactions | Fraud amount | Fraud-to-sales ratio | Consequence |
|---|---|---|---|---|---|
| 1 | Informational Fraud Alert | 3 | USD 3,000 | 3% to 4.99% | Notification |
| 2 | Suggested Training | 4 | USD 4,000 | 5% to 7.99% | Training recommendation |
| 3 | High Fraud Alert | 5 | USD 5,000 | 8%+ | Alert and remediation |
GMAP carried no fines. Not at any tier. You got a notification, a training recommendation, and a remediation conversation with your acquirer. Compare ECM, where month 19 costs USD 100,000 a month. Told you're "in GMAP" and bracing for an assessment? There was never an assessment to brace for.
GMAP didn't supersede ECM or HECM. It sat in Chapter 8 under fraud control, separate from the Excessive Chargeback Program. They ran alongside each other, measuring different things. Anyone saying GMAP replaced the chargeback programs is describing a 2027 claim, not a past fact.
Mastercard's eLearning module still sits at mastercard.com/elearning/gmap/story.html, unlinked from anywhere on the site. That's a big part of why the program still looks alive to a search engine.
Reason code 4849 is a QMAP code, not a GMAP code
Mastercard reason code 4849, Questionable Merchant Activity, belongs to QMAP, the Questionable Merchant Audit Program. Not GMAP. In the Chargeback Guide, Merchant Edition, dated 19 May 2026, 4849 is tied solely to QMAP.
QMAP is live. It's a fraud-driven audit needing three of four conditions. One of them is a fraud-to-sales transaction ratio of 70% or greater. No ordinary business gets near that. QMAP targets merchants whose transactions are mostly fraud. It's the one MATCH reason code (08) tied to a named audit program.
Kount, Justt and Chargeback.io all still market 4849 as the GMAP chargeback on live pages. They're wrong. The error is sticky, too. It gets copied into internal runbooks, dispute training and vendor comparison sheets, and it sits there for years.
What to do about it: a 4849 is a QMAP matter. The response looks nothing like a chargeback-ratio problem. Ask your acquirer whether an audit is open on your MID and what evidence they need. Don't go hunting for a GMAP tier to argue about.
What actually applies to you right now
Five programs. Two networks. GMAP isn't one of them.
| Program | Network | Measures | Live thresholds |
|---|---|---|---|
| ECM | Mastercard | Chargebacks | 100-299 chargebacks AND 1.50%-2.99% ratio |
| HECM | Mastercard | Chargebacks | 300+ chargebacks AND 3.00%+ ratio |
| EFM | Mastercard | Fraud | 1,000+ transactions, USD 50,000+ fraud, 0.50%+ fraud ratio |
| VAMP | Visa | Fraud + disputes combined | 1.5% merchant excessive (2.2% CEMEA), 1,500 count minimum |
| SMMP | Mastercard | Scam signals | Live since 24 July 2026. No ratio you're graded on, a 72-hour acquirer investigation clock |
Last verified: 2 August 2026.
Mastercard divides this month's chargebacks by last month's transactions. Visa uses the same calendar month for both. Growing fast? The Mastercard ratio runs hotter than you'd expect, because the denominator is a smaller month. See Chargeback Metrics for the arithmetic.
The umbrella name is ACMP, the Acquirer Chargeback Monitoring Program. ECM, HECM and EFM live inside it. It has no thresholds of its own. It's the chapter, not the program. That's why the reported 2027 story about "retiring ACMP" reads as bigger news than it is.
One ACMP rule is public and genuinely merchant-facing. It's in the Transaction Processing Rules dated 9 December 2025, section 5.4.1. Four of Mastercard's five subscription standards already bind every recurring merchant, including the online cancellation method. The fifth is a receipt after each individual charge. That one is only a recommendation until you're identified in ACMP for four months or more in the same audit period. Then it becomes a requirement, with Category A assessments on your acquirer on top of the normal ACMP ones. Not-for-profit and charity recurring merchants get all five as recommendations, and the same trigger makes all five mandatory.
Scale Callout
| Volume | Focus |
|---|---|
| Under $100k/mo | GMAP is irrelevant to you, and so is most of this page. Track one number: your Mastercard chargeback count against 100. Count is what a small merchant crosses first, not ratio |
| $100k-$1M/mo | ECM's 100-chargeback floor is genuinely reachable here. Watch count and ratio together, and confirm which transactions land in your acquirer's denominator |
| Over $1M/mo | Ask your acquirer in writing whether they've received anything on a 2027 change. They see the Connect-gated manual and the announcements. You don't |
The reported 2027 GMAP
Everything in this section traces to three industry sources publishing within roughly 48 hours at the end of July 2026:
- Chargeback Gurus, 30 July 2026, chargebackgurus.com. By far the most detailed account, and the only one carrying tier definitions and fine ladders.
- Solidgate, updated 31 July 2026, solidgate.com/blog/mastercard-gmap.
- Corepay, roughly 29 July 2026, posted on LinkedIn.
Not one cites a Mastercard announcement or bulletin number. That objection is worth less than it sounds. The same is true of almost every number on this site. ECM's 1.5% and HECM's 3.0% appear in no public Mastercard document either. Both are defined by cross-reference to a manual behind an acquirer login. Every figure in circulation, ours included, reached the public through an acquirer. Three parties with acquirer channel access publishing inside two days, none able to link a document, is what a real acquirer-facing announcement looks like from outside.
So we treat it the way we treat ECM. Best available account, sourced and dated, not rumor. The caveats below are about specific figures that don't hold up, not about whether the program is real.
We went looking for the primary source and failed. We full-text searched all four current public Mastercard rulebooks: Security Rules and Procedures (3 February 2026), Mastercard Rules (2 June 2026), the Chargeback Guide (19 May 2026) and the Transaction Processing Rules (9 December 2025). The new tier names return zero hits across all four. We probed the public paths where Mastercard publishes announcements and found nothing. Block Chargeback Gurus from a search and the story largely disappears. NOT FOUND
That isn't a debunk. All four rulebooks predate the 30 July reports. Mastercard's threshold manual sits behind an acquirer login on Mastercard Connect, so a real change would be invisible to any public search. A program taking effect in April 2027 has no reason to appear in a February 2026 rulebook yet. We can't confirm it and we can't rule it out. The next honest checkpoint is the February 2027 edition of the Security Rules.
All three agree on this much. A new Global Merchant Audit Program, effective 1 April 2027, tightening dispute monitoring on merchants and acquirers alike. Open audits carry over and month counts don't reset. The ratio is reported as fraud filed to the Fraud and Loss Database plus non-fraud chargebacks, over the prior month's sales. That at least matches how Mastercard already does the arithmetic.
They don't agree on what happens to the programs you're in today. Chargeback Gurus says ACMP is retired and ECM, HECM and EFM fold into the new framework. Corepay says ECM and HECM stay, running in tandem with an updated GMAP. Those are different architectures. Both can't be right. More below.
The reported tiers, all REPORTED:
| Reported tier | Applies to | Reported ratio |
|---|---|---|
| High Dispute Merchant (HDM) | Merchant | 500 bps (5%) |
| Excessive Dispute Merchant (EDM) | Merchant | 5,000 bps (50%) |
| High Dispute Acquirer (HDA) | Acquirer portfolio | 50 bps (0.5%) |
| Excessive Dispute Acquirer (EDA) | Acquirer portfolio | 70 bps (0.7%) |
Which of these numbers hold up
HDA at 0.5% and EDA at 0.7% are VAMP's acquirer portfolio numbers exactly. VAMP gates its own acquirer levels on a combined fraud-and-dispute count of 1,500. That's the strongest thing going for the story. It's what Mastercard's answer to VAMP would plausibly look like. An acquirer already tuned for VAMP wouldn't have much new work to do.
EDM at a 50% ratio is a scam-shop threshold. Half of everything you sell coming back as a dispute isn't a merchant having a bad quarter. If you're here worrying about your 1.2% ratio, EDM isn't a number in your life. HDM at 5% is still more than three times today's ECM trigger.
The transaction-count minimums don't survive arithmetic, so we're not publishing them. The acquirer minimum as printed needs 1,500 cleared transactions and 1,500 reported as fraud or charged back. That's a 100% ratio sitting under a 0.5% threshold. The merchant minimum is printed as 5 cleared transactions, which would sweep in every merchant on the network. It also sits suspiciously close to the suspended 2020 tiers above. Both look like transcription problems.
Chargeback Gurus' High Dispute Acquirer table reads USD 25,000 at months 12 through 18, then USD 10,000 at months 19 and beyond. The fine falls the longer the breach lasts. That's backwards from every other ladder Mastercard publishes, and from the article's own three others.
It's almost certainly a typo in that one table, not a reason to doubt the article. The other three ladders in the same piece escalate normally, HDM topping out at USD 25,000 and EDM at USD 300,000. So we flag it rather than repeat it. We won't silently correct it either, because we don't know which of the two figures is wrong. Solidgate publishes no ladders at all, so every one of these amounts rests on one source.
Where the sources disagree with each other
| Question | Chargeback Gurus | Solidgate | Corepay |
|---|---|---|---|
| What happens to ECM and HECM | Folded into the new program | Not stated in detail | Kept "in tandem with" an updated GMAP |
| Fine ladders | Full tables for four tiers | None published | None published |
| ECM phase-down | 1.5%-2.99% for 2027-2028, 1.3% floor 2029, 1.1% 2030, 0.9% 2031 | 1.5% falling to 0.9% by 2031, starting 2029 | Says ECM thresholds are being reduced |
"Folded into" and "running in tandem with" are different architectures, not two wordings for the same thing. That's a real disagreement from two sources publishing a day apart.
The ECM phase-down is the part most likely to touch an ordinary merchant. It's also the thinnest. One source carries the detail, and even it says nothing changes before 2029. If it's real, today's 1.5% eventually becomes 0.9%. That's where most processors already draw their own line. Treat it as a reason not to get comfortable at 1.2%, not as a calendar date.
Chargebacks911 actively maintains Mastercard threshold pages and has published nothing about a 2027 GMAP. That's silence, not a rebuttal, and we won't dress it up as one. Solidgate is odder. Its marketing blog carries the story. Its own product documentation still lists only ACMP with ECM, HECM and EFM. A vendor that hasn't updated its operational docs hasn't operationalized the claim.
Why this is so hard to verify
Mastercard publishes no numeric ECM, HECM or EFM threshold in any public document. The Security Rules define both chargeback programs by cross-reference to Chapter 8 of the Data Integrity Monitoring Program manual. That manual sits behind an acquirer login on Mastercard Connect. Merchants can't read it.
Visa is no better. Core Rules 10.4.3.1 defers to a VAMP Guide distributed to acquirers and never published. Section 12.5.4, "Dispute Monitoring Fees and Non-Compliance Assessments," is a printed heading with nothing underneath it.
So every threshold number in circulation, including the ones on this site, is an acquirer or PSP relay of a document neither of us can open. That's how a suspended program stays alive online for six years. Nobody who copied the tiers in 2019 had a way to check them in 2021.
We'd rather say that than pretend to a citation we don't have. VENDOR is read from Mastercard's own manual. REPORTED is a named third party with a date. NOT FOUND is a search that failed, with the places we looked written down.
Where This Breaks
Your acquirer's threshold is stricter than the network's. Theirs is the one that ends the relationship. Most processors act around 0.9%, well below any published network line. The network number tells you when you get named. It doesn't tell you when you get offboarded.
A suspended program can come back. "Suspended until further notice" isn't "cancelled." If Mastercard reinstates GMAP, the numbers on this page become history twice over. The reported 2027 program may be exactly that reinstatement, or it may be three vendors amplifying one article.
Legacy tier numbers survive in internal documents. If anyone ever built a fraud dashboard against 3%, 5% and 8% GMAP tiers, those alerts are still firing against a program that stopped existing in 2020. Worth an afternoon to check.
Test to Run
One search and two questions. Fifteen minutes.
1. Search your own documents for GMAP. Onboarding pack, acquirer agreement, internal risk runbook, chargeback vendor dashboard. Anything naming GMAP as a live program is stale. Whatever else that document says deserves the same suspicion.
2. Ask your acquirer the ratio question:
"What's my current Mastercard chargeback ratio and count, which month's volume are you using as the denominator, and what internal threshold do you apply to me before the network's?"
That last clause is the one that gets you the useful answer.
3. Ask the 2027 question neutrally. Don't lead with the vendor blogs, or you'll get a salesperson's answer back:
"Have you received any Mastercard announcement about changes to the Acquirer Chargeback Monitoring Program or merchant monitoring thresholds taking effect in 2027? If so, can you send me the announcement number?"
An AN number means you found the primary source we couldn't. A vendor blog link tells you something too.
Sources
| Source | What it gave us | Kind | Date |
|---|---|---|---|
| Mastercard Security Rules and Procedures, Merchant Edition | The verbatim suspension sentence at 8.2 and QMAP's conditions at 8.4. Its 2021 and 2022 editions, via the Wayback Machine, gave the 15 October 2020 date and the legacy tiers | Network rulebook, publicly published | Edition dated 2026-02-03 |
| Mastercard Chargeback Guide, Merchant Edition | Reason code 4849 tied solely to QMAP | Network rulebook, publicly published | Edition dated 2026-05-19 |
| Mastercard Transaction Processing Rules, section 5.4.1 | ACMP as the umbrella for ECM, HECM and EFM, and the four-month subscription rule | Network rulebook, publicly published | Edition dated 2025-12-09 |
| Solidgate blog | The 2027 program shape, effective date, HDM and EDM ratios, ECM phase-down. Vendor selling chargeback services. Its own product docs still list only ACMP | Vendor marketing blog | Updated 2026-07-31 |
| Chargeback Gurus | The four reported tiers, the fine ladders, the ECM phase-down detail. Vendor selling chargeback services. Sole source for most specific figures | Vendor marketing blog | 2026-07-30 |
| Corepay, LinkedIn post | The "in tandem with" framing that conflicts with Chargeback Gurus | Vendor social post | Approximately 2026-07-29 |
| Chargebacks911 Mastercard threshold pages | Nothing. No mention of a 2027 GMAP on pages they actively maintain | Vendor pages, checked for non-corroboration | Accessed 2026-08-02 |
All rulebooks retrieved 2 August 2026.
Next Steps
Came here because something said GMAP applies to you?
- Network Programs Reference - the thresholds that are actually live
- Chargeback Metrics - work out where you really sit
- Processor Warnings - what a real notice looks like
Dealing with a fraud-side problem?
- Dispute Monitoring Programs - EFM and the fraud thresholds in detail
- Mastercard Reason Codes - what each code actually means
- MATCH and the TMF - reason code 08 and the QMAP listing
Ratio climbing right now?
- Zero Point Nine Panic - the emergency playbook
- Chargeback Alerts - RDR, Ethoca and CDRN
- Reduce Chargebacks Fast - tactical intervention
Related Pages
- Network Programs Reference - VAMP, ECM, HECM, EFM in one table
- SMMP - Mastercard's scam merchant monitoring, live since July 2026
- Dispute Monitoring Programs - the deep dive on each program
- Monitoring Thresholds - threshold detail by network
- MATCH and the TMF - the blacklist and its reason codes
- Mastercard Reason Codes - full code list
- Chargeback Metrics - ratio arithmetic, including the prior-month denominator
- Processor Warnings - reading a real notice
- Zero Point Nine Panic - crisis playbook
- Chargeback Prevention - the prevention hierarchy
- Mastercard Network Guide - QMAP and the wider rule set
- Holds and Reserves - what program enrollment does to your cash