Dispute & Fraud Monitoring Programs
This page covers the monitoring programs plus the obligations they trigger: what a remediation plan has to contain, and the high-risk registrations. Looking for the threshold table?
The fine ladders are the same on both pages. The reference table is for looking a number up; this one is for when you have to write something back.
- Early warning is not enforcement. Set your alarm before your processor's written limit. Check the program's count and other conditions too; a ratio alone doesn't tell you when fees apply.
- Visa VAMP: one ratio for fraud reports and disputes. U.S. merchant excessive is at least 1.5% AND 1,500 combined events, when the acquirer isn't Above Standard or Excessive. Other regions differ.
- Mastercard ECM: enforcement starts at 100-299 chargebacks AND a 1.50-2.99% ratio. HECM starts at 300+ chargebacks and 3.00%+.
- Mastercard EFM: four tests apply together, including transaction count, fraud-chargeback amount, a count ratio and 3DS usage. Australia and provider wording differ.
- Consequences: monthly fines can climb into six figures. Use your notice's remediation deadline. A MATCH listing can follow termination when a reason code applies, even if you initiate the closure.
- Prevention tools (Ethoca, Verifi RDR/CDRN) can keep resolved disputes out of the ratio.
Both networks fine you when disputes or fraud stay high. These are the lines where that starts.
See Network Programs Reference for thresholds, fees and limits to check. This page carries the full context.
Visa Acquirer Monitoring Program (VAMP)
Background and Consolidation
VAMP consolidated VDMP and VFMP on 1 April 2025. Now fraud reports and all disputes count in one ratio. That doesn't establish that U.S. Visa Secure excessive-fraud monitoring ended; Adyen and Stripe still describe it.
Key Dates:
- 1 April 2025: VAMP goes live and the advisory period begins.
- 1 June 2025: Visa revises the program after industry pushback. Fraud disputes join the numerator. Thresholds move up to compensate. The count minimum goes from 1,000 to 1,500. The step-down date slips from January to April 2026. Most stale pages predate this revision.
- 1 October 2025: the advisory period ends and fees begin, at the excessive level only.
- 1 January 2026: the acquirer above-standard fee begins at US$4 per TC40 fraud report or TC15 dispute, per the acquirer sources below.
- 1 April 2026: merchant excessive drops from 2.2% to 1.5% in AP, Canada, the EU and the U.S., with at least 1,500 combined events when the acquirer condition applies. LAC already has that ratio and count; CEMEA keeps 2.2%, 150 events AND USD 75,000. Full scope and source.
VAMP Ratio Calculation
Visa combines issuer fraud reports (TC40) and dispute events (TC15) into one count ratio. The denominator is the same month's settled CNP VisaNet transaction count, including domestic and cross-border transactions.
Components:
- TC40: issuer-reported fraud notifications
- TC15: fraud and non-fraud disputes
- Denominator: settled CNP transactions (TC05)
A transaction reported in both TC40 and TC15 can count twice. Exclusions matter: pre-dispute-resolved disputes and CE 3.0-qualified TC40 are excluded subject to the timing of the data extract. Visa's fact sheet gives the formula. NETWORK
Minimum count: use the regional table. It isn't 1,500 everywhere. A dashboard estimate can differ from Visa's final report; that doesn't change the network formula.
Threshold Overview (2025-2026)
Use the sourced regional table for the full tests. U.S. excessive means at least 1.5% AND 1,500 combined fraud reports and disputes, when the acquirer isn't Above Standard or Excessive. CEMEA means at least 2.2%, 150 events AND USD 75,000, with the same acquirer condition. Brazil, Chile and India await separate announcements.
| Who | Threshold | Notes |
|---|---|---|
| Merchant - non-compliant | 0.5% and 5 combined events, reported by Stripe | Not an automatic fee; confirm the applicable acquirer condition |
| Merchant - excessive | Regional ratio and count tests above | Applies when the acquirer isn't Above Standard or Excessive |
| Acquirer - above standard | 0.5% | Portfolio level, since 1 June 2025. Regional count/value minimums apply. The US$4 fee at this tier didn't start until 1 January 2026 |
| Acquirer - excessive | 0.7% | Portfolio level, since 1 June 2025. Regional count/value minimums apply. It was 0.5% when VAMP went live in April 2025 |
Don't merge those two dates. Visa's public fact sheet puts the acquirer lines at 50 bps above standard and 70 bps excessive, effective 1 June 2025. Braintree's March 2026 update dates the US$4 per-count above-standard fee to 1 January 2026. A threshold and a fee are separate events. Fee sources below.
The merchant excessive tests depend on your acquirer's status. Braintree reports US$4 per count at Above Standard or US$8 at Excessive for merchants whose own VAMP ratio is at least 0.5%. Stripe says non-compliant status may bring fees. Confirm your acquirer's status and pass-through. Fee sources below.
That doesn't make 0.5% safe to ignore. Check whether the non-compliant line applies to you and ask your acquirer for its own limit. Crossing 0.5% just isn't an automatic bill. Don't let anyone sell you a service on the claim that it is.
Threshold numbers change. Check Visa's public fact sheet and ask your acquirer which regional and portfolio conditions apply. LAC's 1.5% line predates the April 2026 reduction elsewhere.
Enumeration Ratio
VAMP also monitors card testing/BIN attacks through the enumeration ratio.
Formula:
Enumeration Ratio = Enumerated Authorizations / All Authorizations
Both halves count approvals and declines. That matters. A card-testing attack is mostly declines. A denominator built from settled transactions would never get near the threshold.
Threshold: 20%, over a minimum of 300,000 enumerated authorizations. Detection runs on Visa's Account Attack Intelligence (VAAI) Score.
Exclusions and Prevention Tool Impact
RDR and CDRN can keep disputes out of VAMP ratios. Issuer fraud reports (TC40) often still count anyway, even on a resolved dispute. CE 3.0 can exclude some TC40/TC15 pairs from Visa's program metrics. Treatment depends on how the transaction qualifies.
How prevention tools hit VAMP keeps moving. Visa clarified TC40 treatment in March 2025. Verify the current exclusion rules before you rely on them.
VAMP Fee Structure
Fees can count TC40 fraud reports as well as TC15 disputes.
| Level | Assessment per TC40 fraud report or TC15 dispute |
|---|---|
| Acquirer Above Standard (0.5% portfolio), merchant ratio at least 0.5% | US$4, from 1 January 2026 |
| Acquirer Excessive (0.7% portfolio), merchant ratio at least 0.5% | US$8 |
| Merchant Excessive, with the regional and acquirer conditions above | US$8 |
Sources: Checkout.com's 12 June 2026 update and Braintree's March 2026 update. REPORTED Checked 22 October 2026. Checkout.com gives an AP/Europe unsecured-dispute-fee exception. Its enumeration fee table conflicts with Stripe and Nuvei's no-fee statements. Network Programs carries the comparison. Ask your acquirer what it bills.
Visa's checked public fact sheet and the public Core Rules section 12.5.4 don't supply these VAMP amounts. That's a limit of those documents, not evidence that no provider publishes fees.
Key Program Features:
- Nuvei describes three consecutive grace months after a first identification with none in the preceding 12 months
- That grace runs to completion even if another identification occurs during it; a later identification can incur fees immediately
- Stripe says the identification month is usually the month after the data month
- Get your grace dates and pass-through in writing. Sources and timing
Remediation Requirements
- Use your notice's deadline. Braintree's September 2025 update says 15 days from notification; Nuvei asks its merchants for findings and a plan within ten calendar days. Sources and scope. Ask how often progress reports are due.
- Exit criteria: published VAMP accounts differ. Braintree says one compliant month; Kurv says three consecutive months in an article with older entry figures. Ask your acquirer for the applicable exit conditions in writing. REPORTED
Mastercard Excessive Chargeback Program (ECP)
Program Structure (as of 2025)
Two tiers. Both the count and the ratio have to be met.
| Level | Chargeback Count | Chargeback Ratio |
|---|---|---|
| ECM (Excessive Chargeback Merchant) | 100-299 | 1.5%-2.99% (150-299 bps) |
| HECM (High Excessive Chargeback Merchant) | 300+ | 3.0%+ (300+ bps) |
Ratio Calculation
Basis Points = (First Mastercard Chargebacks Received in Month N) / (Mastercard Sales Transactions in Month N-1) x 10,000
Note: Mastercard divides by the prior month's Mastercard sales count. Its public rules, section 8.3.1, establish that month convention. VAMP uses same-month TC40 plus TC15 over settled CNP VisaNet transactions. Network Programs carries the formula sources. NETWORK
ECM Fine Structure
Braintree's ECP documentation supplies the ECM and HECM ladders below. It lists USD/EUR; these dollar tables use USD. Effective April 2020 globally, September 2020 in Canada. REPORTED Checked 22 October 2026.
| Month in Program | Monthly Assessment |
|---|---|
| 1 | $0 (warning) |
| 2 | $1,000 |
| 3 | $1,000 |
| 4-6 | $5,000 |
| 7-11 | $25,000 |
| 12-18 | $50,000 |
| 19+ | $100,000 |
Braintree's table puts issuer recovery in HECM from month 4. Stripe also shows it in ECM. The public Mastercard rule doesn't resolve that tier difference; confirm it with your acquirer.
Mastercard sets these amounts and updates them. Confirm current assessments with your acquirer.
HECM Fine Structure
| Month in Program | Monthly Assessment | Issuer Recovery Assessment |
|---|---|---|
| 1 | $0 (warning) | No |
| 2 | $1,000 | No |
| 3 | $2,000 | No |
| 4-6 | $10,000 | Yes |
| 7-11 | $50,000 | Yes |
| 12-18 | $100,000 | Yes |
| 19+ | $200,000 | Yes |
HECM matches ECM's base assessment in month 2, then doubles it from month 3. Issuer recovery is additional.
Braintree puts the Issuer Recovery Assessment in HECM from program month 4. Stripe's guide also shows it in ECM. The checked sources disagree, so an issuer recovery line doesn't prove your tier. Ask your acquirer which tier and program month it used. Mastercard collects it from your acquirer and remits it to the issuers that took the chargebacks. An issuer needs USD 20 owed before it sees a payment. Below that, the issuer with the biggest burden takes the whole amount, and a tie gets split evenly (Mastercard, Security Rules and Procedures - Merchant Edition, 4 August 2026, section 8.3.3).
Exit Criteria
- Three consecutive months below ECM thresholds, per Braintree. Checkout.com explicitly says chargeback count or basis points below threshold, not both. Moving from HECM to ECM isn't a full exit. REPORTED
- Extension available if granted: Braintree says assessments can pause for six months while fines continue to accrue.
- Come in under the thresholds by the end and the accrued fines are forgiven.
- Stay above them and the whole accrued balance falls due.
Mastercard Excessive Fraud Merchant (EFM)
Enrollment Criteria (as of 2025)
You have to meet all four tests: prior-month Mastercard sales count, fraud-chargeback amount, fraud-chargeback count ratio and 3DS usage. The ratio divides this month's fraud-chargeback count by last month's Mastercard sales count. It isn't fraud dollars over sales dollars.
The sourced EFM table carries Braintree's global and Australian figures, plus Stripe's and Checkout.com's different equality wording and country applicability. Use the tests your acquirer confirms for your account. REPORTED
EFM Fine Structure
Braintree's EFM page publishes this ladder in USD/EUR; the dollar table uses USD. It counts months identified in EFM. If EFM and ECP overlap, confirm both counters and which assessment applies. Provider accounts differ on the 12-month qualification. REPORTED Checked 22 October 2026.
| Month in Program | Monthly Assessment |
|---|---|
| 1 | $0 (warning) |
| 2 | $500 |
| 3 | $1,000 |
| 4-6 | $5,000 |
| 7-11 | $25,000 |
| 12-18 | $50,000 |
| 19+ | $100,000 |
Exit: three consecutive compliant months, per Braintree. It explicitly says either count or ratio below threshold makes the month compliant. That isn't a requirement to push every entry measure below its floor. REPORTED
Higher 3DS usage can help you avoid EFM entry. The providers differ on whether exactly 10% or 50% still qualifies for entry. Ask your acquirer which rule applies and whether data-only 3DS counts under its current terms. The checked current sources don't settle that last point.
MATCH List (Terminated Merchant File)
What is MATCH?
MATCH is Mastercard's database of terminated merchants. Acquirers have to check it before they onboard anyone. The full name is Mastercard Alert To Control High-risk Merchants. In practice it's the industry blacklist.
Key Characteristics:
- Entries sit for 5 years, then purge automatically (section 11.10).
- You can ask the listing acquirer to remove you. Mastercard says no lawyer is required (11.5.1).
- Most acquirers won't touch a listed merchant, though the rules do permit it.
- It hits every card brand, not just Mastercard.
MATCH Reason Codes
Eleven codes. Codes 02, 07 and 11 came out in the 11 February 2025 edition. Code 06 read "Reserved for Future Use" until then. Anything showing 14 codes is quoting an expired rulebook.
| Code | Reason | Description |
|---|---|---|
| 01 | Account Data Compromise | Cardholder data exposed, including Common Point of Purchase |
| 03 | Transaction Laundering | Processing for another party, against the merchant agreement |
| 04 | Excessive Chargebacks | Mastercard chargebacks over the previous three months above 1.5% of Mastercard sales transactions, and USD 5,000 or more in chargebacks |
| 05 | Excessive Fraud | Fraud-to-sales dollar volume of 8% or more over the previous three months, and 10 or more fraudulent transactions, and USD 5,000 or more |
| 06 | Coercion | Forced transactions |
| 08 | Mastercard Questionable Merchant Audit Program | QMAP violation |
| 09 | Liquidation/Insolvency | Merchant insolvent |
| 10 | Violation of Standards | Network rules violation. No published number |
| 12 | PCI Data Security Standard Noncompliance | Failed to maintain PCI compliance |
| 13 | Illegal Transactions | Processed illegal activity |
| 14 | Identity Theft | Merchant was identity theft victim |
Source: Mastercard, Security Rules and Procedures - Merchant Edition, 4 August 2026, section 11.14.1, Table 11.4, p.157. For codes 04 and 05, every condition has to be met. Not any one of them. When an American Express acquirer reports you, code 04 carries no number at all and the call is entirely Amex's.
A ratio alone doesn't list you. Mastercard's 4 August 2026 public rules, section 11.5, cover termination initiated by either party while a listing condition exists. A voluntary exit doesn't remove that duty. The five-calendar-day clock can start with the termination decision or notice, before the effective closure date. An improper code 04 listing can bring an acquirer assessment (11.4, item 8). NETWORK Checked 22 October 2026.
MATCH Consequences
- Most acquirers won't onboard a MATCH-listed merchant.
- High-risk processors might, at higher fees and with a reserve.
- The listing hits all card brands, not just Mastercard.
- You start the removal request with the listing acquirer. They have 30 calendar days to respond (11.4, item 1). They also have to hand over the listing ICA and reason code on request (item 10). Code 12 listings can go straight to Mastercard when the acquirer won't file (11.13).
Visa Merchant Screening Service (VMSS)
VMSS is Visa's merchant screening service, covered separately in section 10.17. The TMF isn't just an acquirer's private file: section 10.10.1.1 covers retained records and reporting to a common terminated-merchant database, with regional database duties in 10.10.1.2.
- Ask which database and regional rule apply to your notice.
- Where 10.10.1.1 applies, reporting is due by close of business the day after notice of intent to terminate.
- The cited listing grounds don't give a numeric excessive-dispute cutoff.
- Don't assume MATCH's retention clock applies. Confirm the database, region and retention rule with your acquirer.
NETWORK Visa's public rules, 18 April 2026, sections 10.10 and 10.17, checked 22 October 2026.
High-Risk Merchant Programs
VIRP (Visa Integrity Risk Program)
VIRP replaced the Global Brand Protection Program in May 2023. It sorts high-risk merchants into three tiers.
Tier Structure:
- Tier 1: adult content, dating and escort, gambling, pharmaceuticals
- Tier 2: cryptocurrency, cyberlockers, file sharing
- Tier 3: other high-risk MCCs
Costs:
- Ask your acquirer for current registration and transaction fees for your category.
- Confirm any non-compliance assessment separately. Don't substitute a registration quote for an assessment schedule.
Visa updates VIRP pricing by bulletin. Check current fees with your acquirer.
BRAM (Mastercard Business Risk Assessment and Mitigation)
BRAM protects against illegal or brand-damaging transactions.
Prohibited Categories Include:
- Synthetic drugs
- Illegal pharmaceuticals
- Counterfeit goods
- Unlicensed gambling
- Child exploitation material
- Piracy and IP theft
Requirements:
- Acquirers register with the Merchant Monitoring Program (MMP)
- Reporting is monthly
- Fine mitigation of 75-100% if you use a registered Merchant Monitoring Service Provider
Remediation Strategies
Immediate Actions
- Find the root cause. True fraud, friendly fraud, or an operational mess.
- Turn on prevention alerts. Ethoca and Verifi (RDR/CDRN).
- Look at your worst products. Some of them are worth dropping.
- Audit support and refunds. Easy refunds prevent disputes.
Prevention Tools Impact (as of 2025)
| Tool | VAMP Impact | ECM Impact |
|---|---|---|
| RDR (Visa) | Can exclude associated TC15 disputes; TC40 usually still counted | N/A |
| CDRN (Visa) | Can exclude associated TC15 if resolved | N/A |
| CE 3.0 (Visa) | Can exclude both TC40 and TC15 for qualifying transactions | N/A |
| Ethoca Alerts | Can prevent TC15 if resolved before chargeback filing; TC40 can still count | Can prevent a chargeback if resolved before filing |
| Order Insight | Reduces disputes by providing transaction details to issuers | Reduces disputes |
How tools affect program ratios keeps changing. Confirm the current behavior with your acquirer.
Remediation Plan Components
- What you do and where you stand. The business, the current ratios.
- Root cause. Why the chargebacks or fraud are elevated.
- Specific actions with dates. What you'll change and when.
- Timeline. Where you expect the ratio to land.
- Backup plan. For when the first one doesn't work.
- Reporting. How you'll keep them updated.
Issuer Considerations
TC40 Filing Requirements
- Issuers file a TC40 on every fraud claim, however small.
- The TC40 still gets filed when an alert resolves the dispute, for VAMP purposes.
- Skipping the filing creates its own compliance problem.
Visa Issuer Monitoring Program (VIMP)
- Watches issuer-side fraud and dispute rates on CNP
- Metrics are dispute-to-transaction and fraud-to-sales
- Minimum volume thresholds vary by region
Consumer Clarity / Order Insight
- Enrolled issuers show cardholders the transaction detail
- That kills a lot of "I don't recognize this" disputes
- Verifi runs it for Visa, Ethoca for Mastercard
These thresholds move, and VAMP has already changed twice since April 2025. Visa publishes a public VAMP fact sheet; Mastercard program figures here come through acquirer documentation. Check Network Programs for sources, and confirm your own limits with your acquirer before you decide anything on them.
Do next
- Set up chargeback alerts - Ethoca, Verifi RDR/CDRN
- Work with your processor - Remediation plan support
- Understand holds and reserves - Program consequences
Deeper
- Chargeback Prevention - Alert networks and strategies
- Fraud Vendors - Prevention vendors
- Fraud Prevention - Reducing fraud before disputes
- Card Testing - Understanding enumeration attacks
- Friendly Fraud - First-party dispute abuse
Understanding your risk?
- Check compliance metrics - Build monitoring dashboards
Implementing prevention?
- Enable 3D Secure - Liability shift and fraud reduction
- Evaluate vendors - Prevention tool options