Mastercard Scam Merchant Monitoring (SMMP)

Last updated 22 October 2026. Copy page as text

TL;DR

Heard about SMMP? Start with the questions for your acquirer.
Live since 24 July 2026, on card-not-present merchants. It's enforceable now, not a proposal.
It's an acquirer obligation. The public rule requires an investigation to start within 72 hours of a qualifying trigger. Blocking follows if scam activity is confirmed
Refunds count. The 5% trigger adds refunds and chargebacks together. Refund hard to protect your chargeback ratio and you build the exact number this program watches.
The 5% test is limited to six months or less of acceptance history, with at least 500 purchases in the rolling 30-day window. Use affected purchases, not unchecked event totals
Mastercard now publishes the rule. Read section 7.2.1 of its 4 August 2026 merchant rules, and ask your acquirer how it applies

You just heard "SMMP" from your processor or a forum thread. You want to know if you're in trouble. Check which trigger the notice names. Some tests apply only during the first six months of Mastercard acceptance; approval-rate and monitoring alerts can apply later too. The public rule excludes Jordan.

The monthly ratio programs do apply to you forever. See Network Programs Reference.

Don't panic

The public rule doesn't set out a monthly fine ladder. It does require investigation, and acceptance can be blocked if scam activity is confirmed. More than six months of Mastercard acceptance history puts you outside the new-merchant refund-and-chargeback test, not outside every trigger.

An approval-rate trigger can still apply. Check the measured window, baseline and transaction count. Don't assume a drop proves your gateway or fraud rule is broken. The rule excludes BIN attacks and system issues at the acquirer or its service provider.

What SMMP actually is

Mastercard calls the public provision Potential Scam Merchant Investigation Requirement. You'll also hear SMMP in processor explanations. Ask about section 7.2.1 if the acronym doesn't help. NETWORK Security Rules and Procedures, Merchant Edition, 4 August 2026, checked 22 October 2026.

The mechanism is a screening and investigation duty on acquirers and payment facilitators. Certain signals oblige them to open a file on you and act fast. It isn't a ratio program. There's no scoreboard you can log in and check.

An investigation isn't a confirmed scam. Prepare records your acquirer can check. The 72 hours is its deadline to start, not your deadline to assemble everything or a promise the review will end then.

The existing acquirer-set approval alert remains in section 6.2.2.2. Section 7.2.1 adds a separate network investigation duty. It doesn't replace every internal alert.

Section 8.9.1's separate monitoring process still has its own timetable. Don't turn that comparison into a guarantee about how quickly your case will close.

The triggers, and the numbers attached to them

Mastercard publishes these triggers in section 7.2.1 of its 4 August 2026 merchant rules. NETWORK Checked 22 October 2026. The table is a summary; ask which condition the notice names.

If you've been on Mastercard more than six months

Trigger	The number	What it really catches
Authorization approval rate collapse	At least 25 purchases over at least 72 hours. Compare the average with a baseline from the preceding seven calendar days or longer: a 50 percentage point fall, or a rate below 30%, can trigger investigation. BIN attacks and acquirer/service-provider system issues are excluded	Investigate the cause with your acquirer; the signal alone doesn't establish it
GRIP letter	No threshold. Receipt of the letter is the trigger	A Mastercard compliance investigation already reached your acquirer
Monitoring provider alert	No threshold	A Mastercard-approved monitoring vendor flagged your website

That's the full list for an established merchant. There's no refund test, no chargeback test and no dollar amount.

If you've been on Mastercard six months or less

These new-merchant tests apply alongside the triggers above:

Trigger	The number
Two issuers report fraud type 56	Two different card issuers file transactions under code 56, Manipulation of Cardholder
Two issuers cite scam language	At least two issuers file chargebacks, fraud or non-fraud, where the supporting documentation mentions scams, manipulation or similar
Combined refund and chargeback rate above 5%	Purchases affected by refunds or chargebacks, or both, exceed 5% in a rolling 30-day period with at least 500 purchases

Section 7.2.1 doesn't list a request for multiple Merchant IDs as a separate trigger. Your acquirer can still ask why you need them.

How settled are those minimums?

The public rule now states both transaction minimums. It also limits the refund-and-chargeback test to an entity with six months or less of Mastercard acceptance history. That resolves the older vendor summaries' disagreement about that scope.

What to do about it: ask your acquirer which trigger it identified, how it counts affected purchases and which acceptance-history date it used.

Refunds count toward SMMP, and toward nothing else

Every other network program on this site counts chargebacks. ECM and HECM divide chargebacks by the prior month's transactions. EFM looks at fraud chargebacks, with other entry tests too. Visa's VAMP combines fraud reports and disputes. Refunds appear in none of them.

Stripe's EFM guide names reason codes 4837 and 4863 in its fraud volume definition. Braintree's EFM page still prints 4387 and 4863. The 4837 reference treats 4863 as retired. Those aren't a verified current code list. Ask your acquirer which codes it counts. REPORTED, processor explanations checked 22 October 2026.

So the standard advice when your ratio climbs is simple. Refund faster. Refund on request. Refund pre-emptively through alerts. That advice is right for ECM and right for VAMP. Every chargeback vendor, every processor risk email and most of this site will tell you so.

The new-merchant test counts purchases affected by a refund or chargeback, or both. Don't assume every event is an additional purchase.

Worked example only: take 800 purchase transactions in a 30-day window, four months into Mastercard acceptance. Assume full refunds and chargebacks affect separate purchases, with no duplicates or overlaps:

Scenario	Transactions	Chargebacks	Refunds	Chargeback rate	Combined rate
Baseline	800	10	28	1.25%	4.75%
Alert deflection: 6 disputes refunded before they land	800	4	34	0.50%	4.75%
Plus a no-questions refund policy adding 12 goodwill refunds	800	4	46	0.50%	6.25%

The first two rows have the same combined rate. The third doesn't.

Deflection is neutral in this example. (10 + 28) / 800 x 100 = 4.75%. After six prospective chargebacks become six refunds, (4 + 34) / 800 x 100 is still 4.75%. That assumes the acquirer's report treats those as the same six affected purchases.

Net new refunds aren't neutral here. (4 + 46) / 800 x 100 = 6.25%. The extra twelve affected purchases put this example above 5%. A 0.50% chargeback-only rate doesn't establish compliance with this separate test.

Refunds are the half of that number you fully control. So they're the half you can accidentally blow up. Nobody accidentally issues 12 extra chargebacks.

During your first six months or less of acceptance history, extra refunded purchases can bring this test closer. Keep necessary refunds and prevention work going, while tracking the affected-purchase count with your acquirer.

Who genuinely runs a high combined rate

For most businesses, 5% combined is a long way off. The verticals that sit near it in normal operation:

Free-trial and trial-to-paid subscriptions. Cancellation refunds and first-bill disputes stack in the same window.
Apparel, footwear and anything with sizing. Track refunded purchases separately from returns and returned units.
Ticketing and events. One cancelled event refunds an entire month of sales at once.
Digital goods and app subscriptions. Low friction to buy, low friction to regret.
Anything with a 30-day money-back guarantee you actually honour.

In one of those and under six months old? Watch this number weekly, not quarterly. A high refund rate isn't evidence you're doing anything wrong. It isn't something to stop doing. It just means the trigger sits closer to you than to a hardware store. Be ready to explain your refund pattern in one sentence when your acquirer calls.

The 72-hour window, and what your acquirer actually pulls

Once a trigger fires, your acquirer or payfac has to begin investigating within 72 hours. Not resolve it. Begin it.

Keep your onboarding records, transaction and refund records, dispute documentation, website terms, descriptors and customer replies ready. The public rule also requires acquirers to check the Fraud and Loss Database daily for new scam-merchant listings.

If the investigation confirms scam activity, Mastercard and Maestro authorization and clearing get blocked immediately.

The investigation duty sits on your acquirer. Section 7.2.1 doesn't set out a merchant appeal or notification process. Ask who'll contact you and which records they'll need.

Prepare that pack now. Don't assume the acquirer's 72-hour start deadline gives you 72 hours to respond.

What actually happens to a merchant

Outcome	Does SMMP do this?
Monthly fine	Section 7.2.1 doesn't specify one; ask about other applicable assessments
Escalating ladder	Not set out in that section
Warning tier before enforcement	Not set out in that section
Remediation plan with a deadline	Follow the notice; no merchant plan timetable is set out there
Documented appeal	Not set out in that section
Loss of Mastercard and Maestro acceptance	Yes, if the investigation confirms scam activity

A confirmed scam finding can stop acceptance. Ask what your acquirer needs before it reaches that decision.

The MATCH question

You'll see claims that SMMP puts you on the MATCH list. One source asserts it. No source documents it. Mastercard's published MATCH reason code table has no scam-specific code.

A confirmed scam investigation can also lead to termination. A MATCH listing then depends on the actual listing conditions, not the acronym SMMP. Ask which reason code applies and get the answer in writing.

Fraud code 56, and why one scam complaint counts three times

Code 56 is Manipulation of Cardholder. In merchant language: the cardholder really did make the payment, and somebody tricked them into it.

The issuer files it into Mastercard's Fraud and Loss Database. It never appears on your statement. You can't see it and you can't dispute it. Mastercard's Chargeback Guide (19 May 2026) says it "encourages" issuers to report scam-related disputes this way. Doing so doesn't invalidate the chargeback itself.

"Encourages" matters. Reporting is discretionary. So the two-issuer trigger depends entirely on which banks bother to file. Two banks that do can start a clock on you. Two that don't, can't. It isn't a measure of how bad you are.

Now the part that catches people. A scam victim did authorise the payment. Mastercard's cardholder dispute chargeback requires that the cardholder engaged in the transaction. So scam complaints arrive as 4853 Cardholder Dispute chargebacks, not as fraud codes. One complaint lands in three different places:

Program	Does this scam complaint count?
ECM and HECM	Yes. They take any reason code, so a 4853 counts like any other chargeback
SMMP and QMAP	Yes, separately, through the code 56 entry the issuer files into the Fraud and Loss Database
EFM	Not as a non-fraud 4853 chargeback. EFM measures fraud chargebacks; confirm the counted codes with your acquirer

That's why a merchant can run a clean fraud ratio, pass EFM comfortably, and still be the subject of a scam investigation. The two systems read different data.

How SMMP differs from ECM, HECM, EFM and VAMP

Program	What it measures	What it costs	Who acts, and how fast
SMMP	Scam signals: refunds plus chargebacks, approval rate collapse, issuer scam reports	No fine. Acceptance switched off if confirmed	Your acquirer, within 72 hours
ECM / HECM	Chargeback count and ratio, any reason code	$1,000 to $200,000 a month	Mastercard, monthly
EFM	Fraud chargebacks, sales count, fraud amount and 3DS penetration; see all entry tests	Escalating assessments	Mastercard, monthly
Visa VAMP	Fraud reports plus disputes combined	Fees can cover TC40 fraud reports and TC15 disputes; confirm exclusions and pass-through	Visa, monthly
QMAP	Fraud-to-sales ratio, three of four conditions met	Audit, and MATCH code 08	Mastercard

One structural point worth having straight. ECM, HECM and EFM all sit inside the Acquirer Chargeback Monitoring Program, or ACMP. SMMP isn't part of ACMP. It lives in the merchant screening and monitoring rules. Different mechanism, different consequence. It runs in parallel and it replaces nothing.

Its closest live relative isn't ECM at all. It's QMAP, the Questionable Merchant Audit Program. QMAP is fraud-driven and identified from the same Fraud and Loss Database. One of its four conditions is literally that the merchant has been submitting transactions for fewer than six months. Same six-month concept, same database, same instinct.

Where these numbers come from

Read the current public rule before acting

The 4 August 2026 Security Rules and Procedures now publish the scam investigation requirement at section 7.2.1. Older descriptions based on the February edition missed it. The provision gives the trigger tests, exclusions and investigation duty. It doesn't give your account's response deadline or every provider's reporting method.

The acronym SMMP isn't the test for whether a rule is public. Search for the provision's title instead.

What to do about it: ask your acquirer: "Which trigger applies to my account? How did you count the purchases and acceptance history? What do you need from me, and by when?" Keep the answer with the notice.

NETWORK Mastercard's public merchant rules, 4 August 2026, section 7.2.1, checked 22 October 2026.

The earlier vendor reports remain useful history. They aren't needed as substitutes for the now-public trigger rule.

Source tiers used here: NETWORK for Mastercard's published requirement, REPORTED for attributed third-party accounts. How the tier system works.

Scale Callout

Volume	Focus
Under $100k/mo	Count purchases. Under 500 in the rolling 30-day window puts you below the refund-and-chargeback test's count floor, not outside every trigger
$100k-$1M/mo	Check purchase count and acceptance history directly. Dollar volume alone doesn't establish 500 purchases
Over $1M/mo	Watch approval trends and monitoring notices. Keep a named contact and records ready; high volume doesn't prove which trigger applies

Test to Run

An hour of work that tells you exactly where you stand.

Pull 30 days of purchases. Count purchases affected by a refund or chargeback, checking overlaps with your acquirer. Divide that count by purchases in the same window.
Check your acceptance history. Ask which entity and date your acquirer uses. Six months or less, with at least 500 purchases, is the scope for the above-5% test.
Find your worst approval window. Use at least 72 hours and at least 25 purchases, compared with the preceding seven-day or longer baseline. Check the exclusions before calling it a trigger.
Read your own descriptor. Pull a real statement line for a real order. If it doesn't obviously say who you are, some of your "I was tricked" complaints are just people not recognising the charge. Fix that first. It's the cheapest item on this list.
Build the 72-hour pack now. Fulfilment and delivery records, terms and refund policy as they appeared on the day of sale, customer service logs, and a one-paragraph explanation of your refund pattern. Put it in one folder. If your acquirer calls, you're forwarding a link, not starting a project.
Make the call. Ask: "Do the new Mastercard scam monitoring rules apply to my account, and which triggers do you apply?" Then: "If one fires, do you contact me before you act?"

Where This Breaks

An old summary drops a condition. Use the current public rule, then confirm the facts on your own notice. Don't rely on a majority vote among vendor articles.
The counting method isn't your event total. A purchase may have more than one refund or a later dispute. Ask how the acquirer counts affected purchases.
Partial refunds need a counting answer. Keep purchase IDs and refund records so you can reconcile the report.
Acceptance history needs a start date. Ask which entity and history your acquirer used. Don't silently substitute the first transaction on the current MID.
GRIP has a published expansion here. Section 7.2.1 calls it Global Rules Investigation Program. Use the response deadline on the letter; a separate provider's process isn't a universal deadline.
Your acquirer can set its own rules. Ask for its monitoring and termination conditions separately. Don't assume every processor applies a stricter version of every network test.

Sources

Source	What it gave us	Kind	Date
Mastercard Security Rules and Procedures, Merchant Edition	Public scam investigation rule and exclusions (7.2.1); existing monitoring alert (6.2.2.2), monitoring process (8.9.1), QMAP (8.4), MATCH code table (11.14.1)	Primary, Mastercard's own published rules; NETWORK	Edition dated 4 August 2026, checked 22 October 2026
Mastercard Chargeback Guide, Merchant Edition	The verbatim code 56 language, that reporting is "encouraged" rather than required, and that a cardholder dispute chargeback requires the cardholder to have engaged in the transaction	Primary, Mastercard's own published rules	Edition dated 19 May 2026, accessed 2026-08-02
Payments Dive	The effective date. Reported Monday 27 July 2026 that the rules "went into effect Friday"	Trade publication with a named editor and no product to sell	27 July 2026
Mastercard newsroom	Confirmation of the 72-hour acquirer investigation duty, under the umbrella name "Merchant Trust Services"	Primary, vendor announcement	19 May 2026
Austreme	The trigger detail and both transaction minimums, plus the only document reference in existence (GLB 12772) and the BIN attack and outage exclusions. A Mastercard-approved merchant monitoring vendor, so it sells into this program	Approved vendor blog	20 February 2026
Global Payments Consultants	Independent corroboration of the 24 July date and the 5% combined trigger, plus the absence of any warning tier	Consultancy, not a chargeback vendor	14 July 2026
Solidgate, Chargeback Gurus, Chargeflow, cside, merchanto, Fraudbeat	The six-month scoping of the 5% trigger, the 500 and 25 transaction minimums, and the scope of the acquirer's review. All sell chargeback or payment services	Vendor blogs	May to July 2026
Justt	The 50 point / 30% approval rate figures, and the dissenting unscoped reading of the 5% trigger. Sells chargeback services	Vendor blog	20 May 2026
Nuvei PSP documentation	The GRIP process, the 5-business-day response window, and the alternative expansion of the acronym. Written before SMMP existed, so uncontaminated by it	Vendor documentation	October 2025

Public investigation rule checked 22 October 2026. Historical vendor accounts above retain their original dates.

Next Steps

Just heard the term and want to know if you're exposed?

Test to Run - the one-hour version, above
Refund Strategy - when refunding is right and when it's expensive
Descriptors and Communication - the cheapest fix on the list

Under six months old on Mastercard?

Underwriting - what your acquirer already knows about you
Recurring Billing Compliance - free trials, cancellations and the rules around them
SMB Prevention Priorities - what to do first with limited time

Already in a ratio program?

Network Programs Reference - VAMP, ECM, HECM, EFM thresholds
Chargeback Ratio Crisis - the crisis playbook
Processor Warnings - how to answer the email you just got

What SMMP actually is​

The triggers, and the numbers attached to them​

If you've been on Mastercard more than six months​

If you've been on Mastercard six months or less​

Refunds count toward SMMP, and toward nothing else​

Who genuinely runs a high combined rate​

The 72-hour window, and what your acquirer actually pulls​

What actually happens to a merchant​

The MATCH question​

Fraud code 56, and why one scam complaint counts three times​

How SMMP differs from ECM, HECM, EFM and VAMP​

Where these numbers come from​

Scale Callout​

Test to Run​

Where This Breaks​

Sources​

Next Steps​

See Also​