Visa and Mastercard Monitoring Programs: How VAMP and Fraud Thresholds Work

Our chargeback coverage has always carried a warning in passing: let disputes climb and you risk “the card brands’ monitoring programs.” This article stops passing by. Those programs are the payment networks’ enforcement machinery for merchants whose fraud and dispute levels endanger the ecosystem, and they have teeth — per-transaction fees, remediation mandates, and ultimately the loss of card acceptance. They have also just been rebuilt: Visa’s consolidated VAMP (Visa Acquirer Monitoring Program) replaced its legacy fraud and dispute programs in April 2025 and tightened sharply in April 2026, catching out merchants whose playbooks still referenced thresholds that no longer exist. Here is how the current regime works, the arithmetic that decides your standing, and how to stay — or get — out.

Quick answer: VAMP measures a single combined ratio — reported fraud (TC40) plus non-fraud disputes, divided by settled card-not-present transactions, by count. Since April 1, 2026, merchants at or above a 1.5% ratio (2.2% in the CEMEA region) are “Excessive” and face enforcement fees around $8 per disputed or fraudulent transaction, with acquirer-level thresholds of 0.5% (Above Standard) and 0.7% (Excessive) driving pressure downstream. Mastercard runs parallel programs (ECM/ECP and fraud monitoring) with their own thresholds.

What changed with VAMP?

Before 2025, Visa ran separate programs: VDMP for disputes and VFMP for fraud, each with its own ratios and remediation tracks. A merchant could sit legally under both while generating plenty of each. VAMP’s consolidation — effective April 1, 2025 — merged fraud reports and disputes into one numerator over one denominator, folding several legacy programs and dozens of remediation processes into a single regime. Three consequences matter operationally:

• One problem now drags the whole ratio. A fraud spike or a service-quality dispute wave lands in the same number; there is no longer a “safe” category to hide volume in.
• The same transaction can count twice. A fraud-reported transaction that also becomes a chargeback can hit the numerator as both a TC40 and a dispute — a detail that surprises merchants reconciling their internal numbers against Visa’s.
• It is count-based, not value-based. A $9 disputed transaction weighs the same as a $900 one, which changes the math for high-volume, low-ticket merchants — and interacts painfully with card-testing attacks, whose thousands of tiny fraudulent authorizations are exactly why VAMP also tracks a separate enumeration ratio for merchants above a large enumerated-transaction floor.

The thresholds as they stand

Minimum-activity floors keep small merchants out of scope until meaningful volume (on the order of 1,500 combined fraud-plus-dispute events for the main ratio). Two cautions belong next to any threshold table. First, these numbers move — the merchant line dropped 32% in a single step in April 2026, and this article’s figures should be verified against Visa’s current published rules before you calibrate anything to them. Second, and more important in practice: your acquirer’s internal limits are almost always tighter than Visa’s. Because Visa enforces against acquirer portfolios at 0.5%/0.7%, acquirers manage their books by warning, repricing, reserving against, or offboarding merchants well before the network’s merchant line — the pressure you actually feel arrives from your acquirer, at thresholds set in your merchant agreement.

What about Mastercard?

Mastercard runs its own parallel machinery: the Excessive Chargeback Merchant / Excessive Chargeback Program tiers keyed to chargeback-to-transaction ratios and counts, plus fraud-oriented monitoring (historically ECF/EFM). Structures and remediation timelines differ from Visa’s, but the shape rhymes — thresholds, escalation tiers, fees that grow with time in program, and acquirer accountability. The operational takeaway is the same for both networks: you are managing one underlying reality (fraud plus disputes relative to volume) that two scorekeepers grade with slightly different rubrics, so track your standing against each network’s own formula, not a blended internal rate — a distinction we flagged in our fraud KPI guide.

Life inside a monitoring program

1. Identification. The network flags the breach; the acquirer notifies you — often the first time a merchant learns the network’s arithmetic differs from their own.
2. Remediation plan. Expect a mandated written plan: root-cause analysis, control changes, and timelines, executed under acquirer supervision.
3. Fees while resident. Per-item enforcement fees accumulate monthly while you remain above threshold — a large merchant sitting modestly over the line can bleed five figures monthly before counting the chargebacks themselves.
4. Exit or escalation. Sustained months below threshold gets you out; persistence above it escalates toward higher fees, and ultimately toward the acquirer’s own remedies — reserves, repricing, termination, and placement on the industry’s terminated-merchant list, which makes reacquiring processing genuinely difficult.

Staying out: the levers that move the ratio

• Cut real fraud at the front door — the full stack this site catalogs, from 3-D Secure 2 to velocity controls against enumeration, since TC40s now count whether or not they become chargebacks.
• Intercept disputes before they file: clear billing descriptors, responsive support, generous-but-governed refunds (the calculus from our refund-abuse guide applies — a refund is cheaper than a chargeback that counts against VAMP), and the network pre-dispute resolution tools that resolve or deflect claims before they become countable disputes. Verify with your acquirer exactly how resolved pre-disputes are treated in the current ratio rules — the accounting details have shifted and materially change the ROI of these tools.
• Mind the denominator. Because the ratio divides by settled transactions, over-aggressive screening that declines legitimate orders shrinks the denominator without touching the numerator — a fraud team can tighten its way into Excessive. Ratio health requires approving more good customers, not just blocking more bad ones: the dual optimization at the heart of modern fraud management.
• Fight friendly fraud with evidence, per our chargeback-fraud playbook — won representments recover revenue, though the dispute may still have counted; prevention beats litigation in this arithmetic.
• Monitor weekly against network math, with alert bands well inside both the network thresholds and your acquirer’s private ones. Nobody should learn their VAMP standing from a warning letter.

Frequently asked questions

Does VAMP cover card-present transactions?

VAMP’s focus is card-not-present fraud and disputes — the domain where enumeration and CNP fraud concentrate. Card-present issues surface through other network rules and the EMV liability framework.

We had one terrible month. Are we in the program?

Identification and remediation mechanics operate on the network’s monthly measurements and program rules; a single anomalous month typically triggers acquirer conversations before formal consequences. Treat the spike itself as the emergency: find the cause — a fraud attack, a fulfillment failure — within days, not billing cycles.

Are the enforcement fees negotiable?

Network fees flow through the acquirer under network rules; what is negotiable is your acquirer relationship — remediation support, timeline advocacy, and whether their private thresholds and fees exceed the network’s. Read your merchant agreement’s monitoring-program clauses before you need them.

Do refunds count against the ratio?

A refund that prevents a dispute keeps that transaction out of the numerator — the core reason proactive resolution is ratio strategy, not just customer service. A refund issued after a dispute files does not un-count it.

Where do I find the authoritative current thresholds?

Visa and Mastercard publish program rules and updates through acquirer bulletins and their public documentation; your acquirer’s risk team is the operational source of truth for both the network numbers and their own. Given how much moved between 2025 and 2026, verify before calibrating.

Monitoring programs are the networks pricing externalities: fraud and disputes cost issuers and cardholders, so persistent generators pay until they stop. The merchants who never meet VAMP are the ones already running the full program this site describes — fraud controls, dispute prevention, and honest measurement — for their own reasons.