Card networks monitor merchants using ratios alongside minimum count, volume, or value thresholds depending on the programme. Visa and Mastercard measure fraud reports and chargebacks against transaction volume, then apply monitoring or assessments when the relevant thresholds are crossed. Winning a dispute does not necessarily remove the underlying event from those calculations, which is why prevention, not representment, is the more reliable compliance lever.
Who is actually being monitored?
Visa's monitoring programme operates at both the acquirer and merchant level. VAMP measures the aggregate fraud and dispute performance of an acquirer's portfolio, while Visa can also identify individual merchants that exceed its Excessive Merchant thresholds.
The acquirer still carries the direct network relationship and formal compliance obligation. Enforcement therefore reaches the merchant through that chain. When a merchant's ratio climbs, the acquirer may respond by adjusting risk fees, holding reserves, requiring remediation, or issuing offboarding notices. A letter from your payment processor about your dispute activity is Visa's monitoring programme expressing itself through an intermediary.
Mastercard's Excessive Chargeback Programme is more directly merchant-account based. Mastercard tracks each merchant account independently and sends notifications to the acquirer with the expectation that the acquirer acts on the named merchant. The end effect for the merchant is similar – pressure arrives via the processor – but the programme evaluates the merchant's own account rather than only the acquirer's aggregate portfolio.
Understanding this distinction matters when interpreting communications. An acquirer contact about portfolio exposure can involve different remediation mechanics from a Mastercard ECP notification tied directly to your merchant account.
The ratio is the unit of risk, not the chargeback
Neither network looks only at the absolute number of chargebacks. Ratios remain central to the monitoring programmes, but they are often paired with minimum counts, transaction volumes, or fraud values before formal monitoring begins.
That framing changes almost every instinct merchants bring to the problem.
How the formula is constructed
Visa's VAMP ratio is:
(TC40 fraud reports + TC15 disputes) ÷ settled card-not-present transactions
TC40 reports are filed by issuing banks when a cardholder reports fraudulent use of their card. TC15 records are generated when a cardholder formally disputes a charge through the bank. A single transaction can generate both. When an issuer files a TC40 report and the same cardholder then opens a formal dispute, that one transaction can enter the numerator twice – once as a fraud report, once as a dispute.
Merchants who track only unique problem transactions can therefore underestimate their VAMP ratio.
The formula operates on counts, not values. A £4 subscription renewal dispute weighs identically to a £4,000 enterprise invoice dispute in the ratio itself. Business models with high transaction volume and low average order values can therefore generate monitoring ratios that look severe relative to the financial value involved.
The monitoring floor
The merchant ratio threshold does not operate on percentage alone.
For merchants in Asia-Pacific, Canada, the European Union, the United States and Latin America, the VAMP merchant threshold is paired with a minimum of 1,500 combined fraud and dispute events per month.
CEMEA is different. Its Excessive Merchant criteria use a 2.2% ratio, at least 150 combined fraud and dispute events, and at least USD 75,000 in fraud and dispute value.
A merchant below the relevant programme floor does not enter formal Excessive Merchant monitoring simply because its calculated percentage is high.
Worked example
A software company settles 80,000 card-not-present transactions in a month. Issuing banks file 800 TC40 fraud reports against the merchant. Of those 800 affected cardholders, 400 also open formal disputes, generating 400 TC15 records. A further 300 customers dispute their renewal charges for non-fraud reasons, adding 300 more TC15 records.
The numerator is 800 (TC40) plus 700 (TC15) = 1,500. The VAMP ratio is 1,500 divided by 80,000 = 1.875%.
The merchant, counting unique affected transactions, arrives at 1,100 and estimates a rate of 1.375%. Visa counts 1,500 events and calculates 1.875%.
In a region where the 1.5% Excessive Merchant threshold and 1,500-event minimum apply, the merchant's internal estimate appears compliant while Visa's programme calculation places it above the threshold.
Mastercard's denominator is different
Mastercard's Excessive Chargeback Programme divides this month's first-presentment chargebacks by last month's captured transactions, not the current month's.
For a growing subscription business, that lag can inflate the ratio structurally: current chargebacks grow with the customer base, but the denominator reflects the smaller base from the previous month. A business adding 500 new subscribers each month can therefore read higher under Mastercard's formula than it would using current-month transaction volume, even with identical dispute behaviour.
What Visa's programme measures
The Visa Acquirer Monitoring Programme (VAMP) replaced Visa's previous fraud and dispute monitoring framework in 2025. A combined ratio now governs monitoring at both the acquirer and merchant level.
Merchant threshold from 1 April 2026
There is one formal merchant identification tier: Excessive.
From 1 April 2026, the Excessive Merchant threshold is 1.5% in the United States, Canada, the European Union and Asia-Pacific. Latin America is also at 1.5%, but importantly, LAC was already at that level before the April 2026 change.
CEMEA remains at 2.2%.
The April 2026 tightening therefore reduced the merchant threshold from 2.2% to 1.5% in the United States, Canada, EU and Asia-Pacific. Merchants in those regions sitting between 1.5% and 2.2% could move above the programme threshold without any change to their underlying dispute activity.
That "overnight" change did not apply to LAC merchants, whose threshold was already 1.5%.
Acquirer thresholds
Acquirer monitoring runs on two separate bands. An acquirer whose portfolio ratio reaches 0.5% enters Above Standard monitoring. The Excessive acquirer band begins at 0.7%.
Fees and enforcement
Once a merchant is classified as Excessive, the current reported VAMP assessment is $8 per fraud or dispute event included in the relevant calculation. The assessment applies to events in the numerator rather than to every transaction settled during the month.
On a first identification with no VAMP identification in the preceding twelve months, a three-month grace period applies before enforcement assessments begin. Subsequent identifications within that rolling twelve-month period do not receive another first-time grace period.
Enumeration monitoring
VAMP includes a separate Enumeration Ratio for card-testing activity.
A merchant whose Visa-identified enumerated authorisation attempts reach 20% of total authorisations, with at least 300,000 enumerated authorisations in the month, meets the enumeration threshold.
Enumeration monitoring is separate from the standard fraud-and-dispute ratio and currently does not carry the same per-event VAMP assessment on its own.
What Mastercard's programmes measure
Mastercard runs three programmes relevant to SaaS merchants, each measuring something different and carrying different consequences.
Programme | What it measures | Threshold | Enrolment trigger | Consequence |
|---|---|---|---|---|
Excessive Chargeback Merchant (ECM) | Chargeback count and rate | 100 to 299 chargebacks AND 1.5% to 2.99% | Both conditions in one calendar month | Assessments from month two; up to $100,000 per month |
High Excessive Chargeback Merchant (HECM) | Chargeback count and rate | 300 or more chargebacks AND 3.0% or above | Both conditions in one calendar month | Assessments from month two; up to $200,000 per month |
Excessive Fraud Merchant (EFM) | E-commerce fraud performance and 3DS usage | At least 1,000 Mastercard sales transactions, USD/EUR 50,000 in qualifying fraud chargeback value, a fraud ratio of 0.50%, and low 3DS usage | All programme criteria must be met | Monthly assessments; EFM supersedes ECP where both apply simultaneously |
Scam Merchant Monitoring Programme (SMMP) | Behavioural and scam-risk signals | Approval-rate collapse, Mastercard GRIP notification, approved monitoring-provider alert, plus additional signals for new merchants | Any applicable trigger | 72-hour acquirer investigation; immediate Mastercard and Maestro processing termination if scam activity is confirmed |
A few mechanics are worth isolating.
ECM and HECM require both conditions simultaneously. A merchant with 250 chargebacks and a rate below 1.5% does not enter ECM. A merchant with a 2.0% rate but only 80 chargebacks does not enter ECM either. Breach of one threshold without the other leaves the merchant outside both tiers.
EFM has four criteria, not a 100-fraud-chargeback threshold. A merchant must meet the programme's transaction-volume requirement, fraud-chargeback value requirement, fraud ratio and 3DS condition.
The standard global EFM criteria use at least 1,000 Mastercard sales transactions, USD/EUR 50,000 in qualifying fraud chargeback value, a fraud ratio of 0.50%, and 3DS usage below the applicable limit.
The 3DS limit is below 10% in non-regulated countries and below 50% in regulated countries. That final condition is particularly relevant for European SaaS businesses: merchants with high SCA and 3DS coverage are less likely to meet the EFM 3DS condition, although SCA does not mean every transaction will necessarily use 3DS.
SMMP became enforceable on 24 July 2026 across Mastercard markets other than Jordan. Unlike ECP and EFM, it does not put the merchant onto a monthly fine ladder. It gives the acquiring bank or payment facilitator a 72-hour investigation obligation. If that investigation concludes that the merchant is operating a scam, Mastercard and Maestro processing must stop.
For all merchants, one trigger is a sharp authorisation approval-rate collapse: a drop of 50 percentage points or more, or an approval rate falling below 30%, measured over a period of at least 72 hours with at least 25 purchase transactions.
BIN attacks and acquirer or system outages are excluded from that calculation.
Other triggers include a Mastercard GRIP notification linking the merchant to suspected scam activity or an alert from an approved Merchant Monitoring Service Provider.
Mastercard applies additional tests to new merchants, meaning merchants with less than six months of Mastercard processing history. These include:
more than 5% of purchases resulting in refunds and chargebacks combined over a rolling 30-day period once the programme's transaction-volume minimum is reached;
reports from two separate issuers involving fraud type 56, Manipulation of Cardholder; or
fraud or non-fraud chargebacks from two or more issuers whose supporting documentation refers to a scam, manipulation, or similar activity.
A merchant can clear every ECP and EFM ratio and still meet an SMMP trigger. A severe approval-rate deterioration, GRIP notification, issuer signals or monitoring-provider alert can trigger an investigation independently of the merchant's monthly chargeback ratio.
Ratio compliance and SMMP compliance are separate questions.
Three responses that do not work
Merchants who cross a monitoring threshold typically reach for one of three responses. None of them, by themselves, reliably reduce the monitoring ratio.
Representment. Winning a chargeback through representment returns the funds to the merchant and corrects the financial loss. It does not necessarily remove the dispute event from the network's monitoring count. The event was recorded when the chargeback was filed, and monitoring calculations are based on the events recorded during the relevant period.
Representment is a revenue-recovery tool. It is not a reliable ratio-reduction tool.
Tightening fraud rules. Blocking more transactions reduces the volume of settled payments, which shrinks the denominator. If the fraud reports and disputes already generating monitoring events are not simultaneously reduced, a smaller denominator produces a higher ratio from the same numerator.
Merchants who respond to an elevated VAMP ratio by adding blanket transaction blocks without addressing the sources driving the numerator can therefore find that the percentage gets worse rather than better.
Waiting for normalisation. Both networks measure performance on recurring reporting periods. Visa's first-identification grace period delays enforcement assessments but does not stop the underlying ratio from being calculated.
Mastercard's ECP requires three consecutive months below its thresholds to exit fully, meaning recovery from an extended problem can take longer than the original period of non-compliance.
What actually moves the ratio
The ratio improves most directly when the numerator falls. The numerator falls when fewer fraud reports and disputes are generated.
For subscription SaaS businesses, many disputes originate from operational issues around billing, renewals, cancellation, refunds and customer recognition, which means fraud tooling alone does not address every source of the numerator.
Billing descriptors are frequently the first lever. A cardholder who does not recognise the name on their bank statement opens a dispute. That dispute can enter the monitoring count regardless of whether the underlying charge was legitimate. A descriptor that matches the brand name customers see at checkout and in account confirmation emails reduces confusion-driven disputes before any other intervention.
Renewal notices sent ahead of billing cycles give customers the option to cancel before a charge appears rather than dispute it afterwards. An annual renewal a customer has forgotten about is a predictable source of disputes; an email sent five to seven days prior converts some of those into clean cancellations instead.
Failed-payment handling matters structurally. When a renewal fails and the merchant retries without notification, the cardholder may see a later charge they were not expecting. A dunning sequence with clear notice around retries converts some potential disputes into either successful payments or explicit cancellations – both preferable to a formal dispute.
Cancellation friction drives friendly fraud. If a customer cannot easily cancel a subscription, the dispute process can become the cancellation mechanism of last resort. That dispute then feeds the same monitoring metrics as other customer disputes.
Pre-dispute alert services sit between the customer complaint and the formal chargeback process. Visa's Rapid Dispute Resolution and services such as Ethoca can allow merchants to resolve qualifying cases before they become formal disputes. Under VAMP, qualifying disputes resolved through recognised pre-dispute solutions can be excluded from the ratio depending on the programme rules and timing.
Refund speed has a narrower but real effect. When a customer requests a refund and the merchant delays, the customer may contact their bank instead. Processing legitimate refund requests promptly reduces the window in which a complaint can escalate into a formal dispute.
3D Secure helps reduce fraud and can shift financial liability for qualifying fraud disputes from the merchant to the issuing bank. But liability shift and network monitoring are separate concepts.
Fraud can still occur on a successfully authenticated 3DS transaction. If the issuer subsequently reports that transaction as fraud, the resulting TC40 can still count toward the merchant's VAMP metrics even if the merchant is not financially liable for the fraud chargeback.
3DS should therefore be treated as a fraud-reduction and liability-management tool, not as a mechanism that automatically removes authenticated transactions from monitoring ratios.
What changes under a merchant of record
When a SaaS business routes payments through a Merchant of Record, the MoR becomes the seller and payment merchant for the transactions it processes. Chargebacks and network monitoring for those transactions therefore attach to the MoR's acquiring setup rather than to a separate merchant account operated by the software company.
Paddle and FastSpring, alongside tiun, operate using this general model. A software company processing exclusively through a MoR does not build VAMP or Mastercard ECP exposure on its own separate merchant account for transactions processed by the MoR.
That does not mean the software company becomes indifferent to chargebacks.
The MoR is responsible for managing fraud and dispute performance across the transactions it processes and will normally impose its own risk controls on the businesses using the platform. If a software company's dispute behaviour becomes unacceptable, or if the MoR needs to tighten portfolio-wide risk controls, it can impose reserves, payment restrictions, additional reviews, or ultimately offboard the business.
The software company's exposure under an MoR arrangement therefore shifts from direct card-network monitoring on its own merchant account toward the MoR's risk policies, compliance standing and willingness to continue processing the business.
Each MoR's dispute policy, reserve practices and offboarding rules are material considerations that do not appear in headline take-rate comparisons.
Frequently asked questions
How is a chargeback ratio calculated?
Visa calculates its VAMP ratio by adding TC40 fraud reports and TC15 dispute records, then dividing that count by settled card-not-present transactions for the relevant reporting month. The merchant threshold also includes minimum event-count requirements.
Mastercard's Excessive Chargeback Programme divides this month's first-presentment chargebacks by the previous month's captured transactions. Mastercard then combines the resulting percentage with a minimum chargeback-count requirement.
Both are primarily count-based ratio calculations rather than measures of the monetary value of individual transactions.
Does winning a chargeback lower my ratio?
Not necessarily. When a chargeback is overturned through representment, the funds can be returned to the merchant, but the underlying dispute event may already have been recorded for network monitoring purposes.
Representment improves revenue recovery. Merchants should not assume that winning the dispute will retroactively remove the monitoring event.
What is the current Visa dispute threshold?
From 1 April 2026, the Visa VAMP Excessive Merchant threshold is 1.5% in the United States, Canada, the European Union and Asia-Pacific. Latin America is also at 1.5%, having already been at that threshold before the April 2026 change. CEMEA remains at 2.2%.
For AP, Canada, EU, U.S. and LAC merchants, the percentage threshold is paired with at least 1,500 combined fraud and dispute events per month. CEMEA instead uses a minimum of 150 events plus at least USD 75,000 in fraud and dispute value. The acquirer Excessive threshold is 0.7%, while Above Standard begins at 0.5%.
Can reducing fraud make my ratio worse?
Yes, under specific conditions. Adding broad transaction blocks reduces the number of settled payments, which shrinks the denominator. If the fraud reports and disputes already in the numerator are not also reduced, the ratio rises because the same numerator is being divided by fewer settled transactions. Interventions that reduce fraud and dispute events improve the ratio. Interventions that reduce only approved transaction volume can make the percentage worse.
Does a merchant of record remove chargeback risk?
A MoR arrangement removes direct card-network monitoring exposure from the software company's own merchant account for transactions genuinely processed by the MoR as merchant of record. It does not remove the commercial consequences of chargebacks.
The MoR still monitors the software company's dispute behaviour and can impose reserves, restrictions or offboarding under its own risk policies. The risk therefore changes form: instead of managing VAMP or ECP directly on its own merchant account, the software company depends on the MoR's risk controls and continued willingness to process its transactions.