Dispute & Fraud Monitoring Programs
This page covers the monitoring programs plus the obligations they trigger: what a remediation plan has to contain, and the high-risk registrations. Looking for the threshold table?
The fine ladders are the same on both pages. The reference table is for looking a number up; this one is for when you have to write something back.
- Early warning isn't enforcement. Read your processor's metric, limit and reporting period in its warning or terms. Missing one? Ask: "What's my limit, how do you count it, and over what period?" Set your alarm before that limit; network fees also depend on count, eligibility and grace conditions.
- Visa VAMP (Visa's dispute and fraud program): one ratio for fraud reports and disputes on Visa card-not-present (online and phone) transactions. U.S. merchant excessive is at least 1.5% AND 1,500 combined events in a month, when your acquirer (the bank behind your processor) isn't in Visa's Above Standard or Excessive tiers. Other regions differ.
- Mastercard ECM (its chargeback program): enforcement starts at 100-299 chargebacks AND a 1.50-2.99% ratio. HECM, the high tier, starts at 300+ chargebacks and 3.00%+.
- Mastercard EFM (its fraud program): four tests apply together, including transaction count, fraud-chargeback amount, a count ratio and 3DS usage, the extra identity check at checkout. Australia and provider wording differ.
- Consequences: monthly fines can climb into six figures. Use your notice's remediation deadline. A MATCH listing (Mastercard's list of terminated merchants) can follow termination when a reason code applies, even if you initiate the closure.
- Prevention tools (Ethoca, Verifi RDR and CDRN alerts) can keep resolved disputes out of the ratio.
Both networks fine you when disputes or fraud stay high. Here's where that starts.
See Network Programs Reference for thresholds, fees and limits to check. This page carries the full context.
Visa Acquirer Monitoring Program (VAMP)
Background and Consolidation
VAMP consolidated VDMP and VFMP on 1 April 2025. Now fraud reports and all disputes count in one ratio. U.S. Visa Secure excessive-fraud monitoring hasn't ended; Adyen and Stripe still describe it.
Key Dates:
- 1 April 2025: VAMP goes live and the advisory period begins.
- 1 June 2025: Visa revises the program after industry pushback. Fraud disputes join the numerator. Thresholds move up to compensate. The count minimum goes from 1,000 to 1,500. The step-down date slips from January to April 2026. For the thresholds and count minimums that apply to you, use Visa's current VAMP fact sheet for your region and your acquirer's status.
- 1 October 2025: the advisory period ends and fees begin, at the excessive level only.
- 1 January 2026: the acquirer above-standard fee begins at US$4 per TC40 fraud report or TC15 dispute, per the acquirer sources below.
- 1 April 2026: merchant excessive drops from 2.2% to 1.5% in AP, Canada, the EU and the U.S., with at least 1,500 combined events when the acquirer condition applies. LAC already has that ratio and count; CEMEA keeps 2.2%, 150 events AND USD 75,000. Full scope and source.
VAMP Ratio Calculation
Visa combines issuer fraud reports (TC40) and dispute events (TC15) into one count ratio. The denominator is the same month's settled card-not-present VisaNet transaction count, including domestic and cross-border transactions.
Components:
- TC40: issuer-reported fraud notifications
- TC15: fraud and non-fraud disputes
- Denominator: settled card-not-present transactions (TC05)
A transaction reported in both TC40 and TC15 can count twice. Exclusions matter: pre-dispute-resolved disputes and CE 3.0-qualified TC40 are excluded subject to the timing of the data extract. Visa's fact sheet gives the formula. NETWORK
Minimum count: use the regional table. It isn't 1,500 everywhere. Use Visa's network formula even when your dashboard estimate differs from its final report.
Threshold Overview (2025-2026)
Use the sourced regional table for the full tests. U.S. excessive means at least 1.5% AND 1,500 combined fraud reports and disputes, when the acquirer isn't Above Standard or Excessive. CEMEA means at least 2.2%, 150 events AND USD 75,000, with the same acquirer condition. Brazil, Chile and India await separate announcements.
| Who | Threshold | Notes |
|---|---|---|
| Merchant - non-compliant | 0.5% and 5 combined events a month, reported by Stripe | Fees depend on acquirer status |
| Merchant - excessive | Regional ratio and count tests above | Applies when the acquirer isn't Above Standard or Excessive |
| Acquirer - above standard | 0.5% | Portfolio level, since 1 June 2025. Regional count/value minimums apply. The US$4 fee at this tier didn't start until 1 January 2026 |
| Acquirer - excessive | 0.7% | Portfolio level, since 1 June 2025. Regional count/value minimums apply. It was 0.5% when VAMP went live in April 2025 |
Don't merge those two dates. Visa's public fact sheet puts the acquirer lines at 50 bps above standard and 70 bps excessive, effective 1 June 2025. Braintree's March 2026 update dates the US$4 per-count above-standard fee to 1 January 2026. A threshold and a fee are separate events. Fee sources below.
The merchant excessive tests depend on your acquirer's status. Braintree reports US$4 per count at Above Standard or US$8 at Excessive for merchants whose own VAMP ratio is at least 0.5%. Stripe says non-compliant status may bring fees. Confirm your acquirer's status and pass-through. Fee sources below.
Use the applicable 0.5% non-compliant test alongside your processor's own limit. Crossing 0.5% isn't an automatic bill. Fees also depend on acquirer status and pass-through.
Don't apply another region's tests. Match your region and acquirer status to Visa's public fact sheet. LAC's 1.5% line predates the April 2026 reduction elsewhere.
Enumeration Ratio
VAMP also monitors card testing/BIN attacks through the enumeration ratio.
Formula:
Enumeration Ratio = Enumerated Authorizations / All Authorizations
Both halves count approvals and declines. That matters. Declines count here, so a card-testing attack that piles up declines still moves the ratio. A denominator built from settled transactions would never get near the threshold.
Threshold: 20%, over a minimum of 300,000 enumerated authorizations. Detection runs on Visa's Account Attack Intelligence (VAAI) Score.
Exclusions and Prevention Tool Impact
RDR and CDRN can keep disputes out of VAMP ratios. An issuer fraud report (TC40) isn't automatically excluded, even on a resolved dispute, so it may count. CE 3.0 can exclude some TC40/TC15 pairs from Visa's program metrics. Treatment depends on how the transaction qualifies.
Visa clarified TC40 treatment in March 2025. Apply the qualification and extract-timing conditions above when you measure exclusions.
VAMP Fee Structure
Fees can count TC40 fraud reports as well as TC15 disputes.
| Level | Assessment per TC40 fraud report or TC15 dispute |
|---|---|
| Acquirer Above Standard (0.5% portfolio), merchant ratio at least 0.5% | US$4, from 1 January 2026 |
| Acquirer Excessive (0.7% portfolio), merchant ratio at least 0.5% | US$8 |
| Merchant Excessive, with the regional and acquirer conditions above | US$8 |
Sources: Checkout.com's 12 June 2026 update and Braintree's March 2026 update. REPORTED Checked 22 October 2026. Checkout.com gives an AP/Europe unsecured-dispute-fee exception. Its enumeration fee table conflicts with Stripe and Nuvei's no-fee statements. Network Programs carries the comparison. Ask your acquirer what it bills.
Visa's public fact sheet and section 12.5.4 of its public Core Rules (24 October 2026 edition, p. 820) don't publish these VAMP amounts.
Key Program Features:
- Nuvei describes three consecutive grace months after a first identification with none in the preceding 12 months
- That grace runs to completion even if another identification occurs during it; a later identification can incur fees immediately
- Stripe says the identification month is usually the month after the data month
- Read your grace dates in the notice and get fee pass-through terms in writing. Sources and timing
Remediation Requirements
- Use your notice's deadline. Braintree's September 2025 update says 15 days from notification; Nuvei asks its merchants for findings and a plan within ten calendar days. Sources and scope. Ask how often progress reports are due.
- Exit criteria: published VAMP accounts differ. Braintree says one compliant month; Kurv says three consecutive months in an article with older entry figures. Ask your acquirer, in writing: "Which program month am I in, when is my plan due, and what gets me out?" REPORTED
Mastercard Excessive Chargeback Program (ECP)
Program Structure (as of 2025)
Two tiers. Both the count and the ratio have to be met.
| Level | Chargeback Count | Chargeback Ratio |
|---|---|---|
| ECM (Excessive Chargeback Merchant) | 100-299 | 1.5%-2.99% (150-299 bps) |
| HECM (High Excessive Chargeback Merchant) | 300+ | 3.0%+ (300+ bps) |
Ratio Calculation
Basis Points = (First Mastercard Chargebacks Received in Month N) / (Mastercard Sales Transactions in Month N-1) x 10,000
Note: Mastercard divides by the prior month's Mastercard sales count. Its public rules, section 8.3.1, establish that month convention. VAMP uses same-month TC40 plus TC15 over settled CNP VisaNet transactions. Network Programs carries the formula sources. NETWORK
ECM Fine Structure
Braintree's ECP documentation supplies the ECM and HECM ladders below. It lists USD/EUR; these dollar tables use USD. Effective April 2020 globally, September 2020 in Canada. REPORTED Checked 22 October 2026.
| Month in Program | Monthly Assessment |
|---|---|
| 1 | $0 (warning) |
| 2 | $1,000 |
| 3 | $1,000 |
| 4-6 | $5,000 |
| 7-11 | $25,000 |
| 12-18 | $50,000 |
| 19+ | $100,000 |
Braintree's table puts issuer recovery in HECM from month 4. Stripe also shows it in ECM. The public Mastercard rule doesn't resolve that tier difference; confirm it with your acquirer.
Use the assessment schedule for your tier and program month.
HECM Fine Structure
| Month in Program | Monthly Assessment | Issuer Recovery Assessment |
|---|---|---|
| 1 | $0 (warning) | No |
| 2 | $1,000 | No |
| 3 | $2,000 | No |
| 4-6 | $10,000 | Yes |
| 7-11 | $50,000 | Yes |
| 12-18 | $100,000 | Yes |
| 19+ | $200,000 | Yes |
HECM matches ECM's base assessment in month 2, then doubles it from month 3. Issuer recovery is additional.
Braintree puts the Issuer Recovery Assessment in HECM from program month 4. Stripe's guide also shows it in ECM. The checked sources disagree, so an issuer recovery line doesn't prove your tier. Ask your acquirer which tier and program month it used. Mastercard collects it from your acquirer and remits it to the issuers that took the chargebacks. An issuer needs USD 20 owed before it sees a payment. Below that, the issuer with the biggest burden takes the whole amount, and a tie gets split evenly (Mastercard, Security Rules and Procedures - Merchant Edition, 4 August 2026, section 8.3.3).
Exit Criteria
- Three consecutive months below ECM thresholds, per Braintree. Checkout.com explicitly says chargeback count or basis points below threshold, not both. Moving from HECM to ECM isn't a full exit. REPORTED
- Extension available if granted: Braintree says assessments can pause for six months while fines continue to accrue.
- Come in under the thresholds by the end and the accrued fines are forgiven.
- Stay above them and the whole accrued balance falls due.
Mastercard Excessive Fraud Merchant (EFM)
Enrollment Criteria (as of 2025)
You have to meet all four tests: prior-month Mastercard sales count, fraud-chargeback amount, fraud-chargeback count ratio and 3DS usage. The ratio divides this month's fraud-chargeback count by last month's Mastercard sales count. It isn't fraud dollars over sales dollars.
The sourced EFM table carries Braintree's global and Australian figures, plus Stripe's and Checkout.com's different equality wording and country applicability. Use the tests your acquirer confirms for your account. REPORTED
EFM Fine Structure
Braintree's EFM page publishes this ladder in USD/EUR; the dollar table uses USD. It counts months identified in EFM. If EFM and ECP overlap, confirm both counters and which assessment applies. Provider accounts differ on the 12-month qualification. REPORTED Checked 22 October 2026.
| Month in Program | Monthly Assessment |
|---|---|
| 1 | $0 (warning) |
| 2 | $500 |
| 3 | $1,000 |
| 4-6 | $5,000 |
| 7-11 | $25,000 |
| 12-18 | $50,000 |
| 19+ | $100,000 |
Exit: three consecutive compliant months, per Braintree. It explicitly says either count or ratio below threshold makes the month compliant. That isn't a requirement to push every entry measure below its floor. REPORTED
Higher 3DS usage can help you avoid EFM entry. The providers differ on whether exactly 10% or 50% still qualifies for entry. Ask your acquirer which rule applies and whether data-only 3DS counts under its current terms. Braintree, Stripe and Checkout.com don't say whether data-only 3DS counts.
MATCH List (Terminated Merchant File)
What is MATCH?
MATCH is Mastercard's database of terminated merchants. Acquirers have to check it before they take anyone on. The full name is Mastercard Alert To Control High-risk Merchants. Merchants call it the blacklist.
Key Characteristics:
- Entries sit for 5 years, then purge automatically (section 11.10).
- You can ask the listing acquirer to remove you. Mastercard says no lawyer is required (11.5.1).
- Most processors won't touch a listed merchant, though the rules permit it. Stripe says most processors reject listed businesses automatically (Stripe).
- It hits every card brand, not just Mastercard.
MATCH Reason Codes
Eleven codes. Codes 02, 07 and 11 came out in the 11 February 2025 edition. Code 06 read "Reserved for Future Use" until then. If it shows 14 codes, it's quoting an expired rulebook.
| Code | Reason | Description |
|---|---|---|
| 01 | Account Data Compromise | Cardholder data exposed, including Common Point of Purchase |
| 03 | Transaction Laundering | Processing for another party, against the merchant agreement |
| 04 | Excessive Chargebacks | Mastercard chargebacks over the previous three months above 1.5% of Mastercard sales transactions, and USD 5,000 or more in chargebacks |
| 05 | Excessive Fraud | Fraud-to-sales dollar volume of 8% or more over the previous three months, and 10 or more fraudulent transactions, and USD 5,000 or more |
| 06 | Coercion | Forced transactions |
| 08 | Mastercard Questionable Merchant Audit Program | QMAP violation |
| 09 | Liquidation/Insolvency | Merchant insolvent |
| 10 | Violation of Standards | Network rules violation. No published number |
| 12 | PCI Data Security Standard Noncompliance | Failed to maintain PCI compliance |
| 13 | Illegal Transactions | Processed illegal activity |
| 14 | Identity Theft | Merchant was identity theft victim |
Source: Mastercard, Security Rules and Procedures - Merchant Edition, 4 August 2026, section 11.14.1, Table 11.4, p.157. For codes 04 and 05, every condition has to be met. Not any one of them. When an American Express acquirer reports you, code 04 carries no number at all and the call is entirely Amex's.
Mastercard's 4 August 2026 public rules, section 11.5, require listing when either party acts to terminate and the acquirer has reason to believe a listing condition exists. Closing the account yourself doesn't remove that duty. The five-calendar-day clock can start with the termination decision or notice, before the effective closure date. An improper code 04 listing can bring an acquirer assessment (11.4, item 8). NETWORK Checked 22 October 2026.
MATCH Consequences
- Most processors won't take on a MATCH-listed merchant, though Mastercard's rules let them (Stripe on the practice).
- High-risk processors might, at higher fees and with a reserve.
- The listing hits all card brands, not just Mastercard.
- You start the removal request with the listing acquirer. They have 30 calendar days to respond (11.4, item 1). They also have to hand over the listing ICA (the number identifying the acquirer that listed you) and reason code on request (item 10). Code 12 listings can go straight to Mastercard when the acquirer won't file (11.13).
Visa Merchant Screening Service (VMSS)
VMSS is Visa's merchant screening service, covered separately in section 10.17.1.1 (p. 669). The TMF isn't just an acquirer's private file: section 10.10.1.1 (pp. 650 to 652) covers retained records and reporting to a common terminated-merchant database, with regional database duties in 10.10.1.2 (p. 652).
- Read the database and regional rule on your notice. Ask if they're missing.
- Where 10.10.1.1 applies, reporting is due by close of business the day after notice of intent to terminate.
- Sections 10.10.1.1 and 10.10.1.2 don't give a numeric excessive-dispute cutoff.
- Don't assume MATCH's retention clock applies. Confirm the database, region and retention rule with your acquirer.
NETWORK Visa's public rules, 24 October 2026 edition, sections 10.10.1.1, 10.10.1.2 and 10.17.1.1, checked 2 November 2026.
High-Risk Merchant Programs
VIRP (Visa Integrity Risk Program)
VIRP replaced the Global Brand Protection Program in May 2023. It sorts high-risk merchants into three tiers.
Tier Structure:
- Tier 1: adult content, dating and escort, gambling, pharmaceuticals
- Tier 2: cryptocurrency, cyberlockers, file sharing
- Tier 3: other high-risk MCCs
Costs:
- Ask your acquirer for current registration and transaction fees for your category.
- Confirm any non-compliance assessment separately. Don't substitute a registration quote for an assessment schedule.
Use your category's registration and assessment schedules separately.
BRAM (Mastercard Business Risk Assessment and Mitigation)
BRAM protects against illegal or brand-damaging transactions.
Prohibited Categories Include:
- Synthetic drugs
- Illegal pharmaceuticals
- Counterfeit goods
- Unlicensed gambling
- Child exploitation material
- Piracy and IP theft
Requirements:
- Acquirers register with the Merchant Monitoring Program (MMP)
- Reporting is monthly
- Fine mitigation of 75-100% if you use a registered Merchant Monitoring Service Provider
Remediation Strategies
Immediate Actions
- Find the root cause. True fraud, friendly fraud, or an operational mess.
- Turn on prevention alerts. Ethoca and Verifi (RDR/CDRN).
- Look at your worst products. Some of them are worth dropping.
- Audit support and refunds. Easy refunds prevent disputes.
Prevention Tools Impact (as of 2025)
| Tool | VAMP Impact | ECM Impact |
|---|---|---|
| RDR (Visa) | Can exclude associated TC15 disputes; TC40 may count | N/A |
| CDRN (Visa) | Can exclude associated TC15 if resolved | N/A |
| CE 3.0 (Visa) | Can exclude both TC40 and TC15 for qualifying transactions | N/A |
| Ethoca Alerts | Can prevent TC15 if resolved before chargeback filing; TC40 can still count | Can prevent a chargeback if resolved before filing |
| Order Insight | Reduces disputes by providing transaction details to issuers | Reduces disputes |
A resolved dispute doesn't automatically remove its fraud report. Measure them separately, with the qualification and extract-timing conditions above.
Remediation Plan Components
- What you do and where you stand. The business, the current ratios.
- Root cause. Why the chargebacks or fraud are elevated.
- Specific actions with dates. What you'll change and when.
- Timeline. Where you expect the ratio to land.
- Backup plan. For when the first one doesn't work.
- Reporting. How you'll keep them updated.
Issuer Considerations
TC40 Filing Requirements
- Issuers file a TC40 on every fraud claim, however small.
- The TC40 still gets filed when an alert resolves the dispute, for VAMP purposes.
- Skipping the filing creates its own compliance problem.
Visa Issuer Monitoring Program (VIMP)
- Watches issuer-side fraud and dispute levels on card-not-present payments
- Metrics are dispute-to-transaction and fraud-to-sales
- Entry tests, in one month: 750 or more disputes and a 1% dispute-to-sales count ratio, or USD 500,000 or more in reported fraud and a 1% fraud-to-sales dollar ratio. NETWORK Visa's public rules, 24 October 2026, section 10.4.7.1, checked 2 November 2026
Consumer Clarity / Order Insight
- Enrolled issuers show customers the transaction detail
- A customer who recognizes the charge has no "I don't recognize this" dispute to file
- Verifi runs it for Visa, Ethoca for Mastercard
Visa publishes a public VAMP fact sheet. Mastercard's public rule doesn't supply these numerical tiers; they come through acquirer documentation. Use Network Programs for the sourced program tests and your processor's warning or terms for its own limits. If a figure above shows a later check date, use that date for that figure.
Do next
- Set up chargeback alerts - Ethoca, Verifi RDR/CDRN
- Work with your processor - Remediation plan support
- Understand holds and reserves - Program consequences
Deeper
- Chargebacks - The whole chargebacks section
- Chargeback Prevention - Alert networks and strategies
- Fraud Vendors - Prevention vendors
- Fraud Prevention - Reducing fraud before disputes
- Card Testing - Understanding enumeration attacks
- Friendly Fraud - First-party dispute abuse
Understanding your risk?
- Check compliance metrics - Build monitoring dashboards
Implementing prevention?
- Enable 3D Secure - Liability shift and fraud reduction
- Evaluate vendors - Prevention tool options