Most brands find out how Visa and Mastercard measure them when an acquirer sends a warning email. By then the month that triggered it is already over, and the next one is half done. The thresholds aren't secret, but they're spread across network fact sheets, processor docs and acquirer bulletins, and the two networks count in ways that don't match each other or the dispute rate on your processor dashboard.
2026 made this more urgent. Visa cut its merchant threshold for the Visa Acquirer Monitoring Program (VAMP) from 2.2% to 1.5% on 1 April 2026. Mastercard's Excessive Chargeback Program (ECP) hasn't changed its numbers, but acquirer guidance says a new framework arrives in April 2027 with lower ratios phased in after that.
This guide sets out the 2026 numbers for both networks, how each ratio is actually calculated, why the result is often higher than the rate you track, and what subscription brands in particular can do about it. Figures are as of October 2026; your acquirer's contract can be stricter than the network rules.
Key takeaways
- Visa VAMP flags a merchant as Excessive at a ratio of 1.5% or more with at least 1,500 counted fraud reports and disputes in a month (US, Canada, EU and Asia Pacific, from 1 April 2026).
- The VAMP ratio adds fraud reports (TC40) to disputes (TC15) and divides by settled card-not-present Visa transactions in the same month. One fraudulent sale can count twice.
- Mastercard places a merchant in the Excessive Chargeback Merchant (ECM) tier at 100 or more chargebacks and a ratio of 1.5% or more. The ratio divides this month's chargebacks by last month's transactions.
- Refunds and won disputes don't remove anything from either count. Only prevention before a dispute is filed, and a few specific pre-dispute tools, lower the numbers.
- ECM fines reach $192,000 over 12 months on Mastercard's published schedule. Splitting volume across MIDs to stay under the lines is treated as evasion, not compliance.
VAMP vs ECM at a glance
Visa VAMP in 2026: the thresholds
Visa launched VAMP on 1 April 2025, replacing its separate dispute (VDMP) and fraud (VFMP) programs with one combined measure. The current thresholds and ratio formula took effect on 1 June 2025, an advisory period ran until 30 September 2025, and fees for Excessive merchants started from 1 October 2025, according to Visa's VAMP fact sheet and Checkout.com's summary.
VAMP works on two levels. Visa measures each acquirer's whole portfolio, and it measures individual merchants.
- Acquirer level: an acquirer is Above Standard at a VAMP ratio of 0.5% and Excessive at 0.7%. The Above Standard level has been enforced since 1 January 2026.
- Merchant level (Excessive): a ratio of 1.5% or more and at least 1,500 fraud reports and disputes in the month, in the US, Canada, the EU, Asia Pacific and Latin America. Before 1 April 2026 the ratio was 2.2% in the first four of those regions. CEMEA stays at 2.2%, with at least 150 events and $75,000 in fraud and dispute volume.
- Merchant level under a flagged acquirer: if your acquirer's portfolio is Above Standard or Excessive, merchants in it can be identified at a 0.5% ratio with as few as 5 counted events, as Stripe's monitoring-program documentation lists it.
That last point matters more than the headline 1.5%. A brand running 30,000 Visa card-not-present transactions a month can't reach the 1,500-event floor without a 5% ratio. But if its acquirer has a weak portfolio, the same brand can be flagged at 0.5%. Your exposure depends on your acquirer as well as on your own numbers.
VAMP also has a separate card-testing measure. Visa flags enumeration at 300,000 or more card-testing attempts in a month that make up at least 20% of authorizations. Visa doesn't charge fees for enumeration, according to Stripe.
How the VAMP ratio is calculated
Visa's formula is: count of fraud reports (TC40) + count of disputes (TC15), divided by the count of settled card-not-present transactions (TC05) in the same calendar month. Three details change the result more than most brands expect.
- Fraud reports count even without a chargeback. A TC40 is the issuer reporting a transaction as fraud, which Stripe shows as an early fraud warning. It counts toward VAMP even if you refund the order straight away.
- One transaction can count twice. Stripe's docs say it plainly: "Any transaction that appears in both reports will be counted twice for the VAMP count." A stolen-card sale that is reported as fraud and then disputed adds two events.
- Only two exclusions are written into Visa's fact sheet. Disputes resolved through pre-dispute solutions, and fraud reports that qualify for Compelling Evidence 3.0, both depending on when Visa extracts the data. Industry guides add Verifi RDR, CDRN and Ethoca alerts resolved within the same month, but acquirers apply this differently, so confirm with yours.
A worked VAMP example
Take a subscription brand with 40,000 settled Visa card-not-present transactions in a month. It receives 380 disputes. Issuers also file 260 fraud reports, and 150 of those transactions are among the 380 disputes.
- Dispute rate on the processor dashboard: 380 ÷ 40,000 = 0.95%.
- VAMP count: 380 + 260 = 640 events, because the 150 overlapping transactions count once in each report.
- VAMP ratio: 640 ÷ 40,000 = 1.6%.
The brand isn't Excessive, because 640 is below the 1,500-event floor. But it is more than three times the 0.5% level that applies if its acquirer's portfolio is flagged. A team watching only the 0.95% figure would think it had room.
Mastercard ECM and HECM: the thresholds
Mastercard's Excessive Chargeback Program has two tiers. Both need the count and the ratio to be met in the same month.
- Excessive Chargeback Merchant (ECM): at least 100 chargebacks in a calendar month and a chargeback-to-transaction ratio of 1.5% or more.
- High Excessive Chargeback Merchant (HECM): at least 300 chargebacks and a ratio of 3% or more.
The thresholds are the same as in J.P. Morgan's Mastercard ECP guide (revision 12/2019) and in Stripe's current documentation. Fraud has its own program, Excessive Fraud Merchant (EFM), which applies when all four of these are met: at least 1,000 ecommerce Mastercard transactions, more than $50,000 in fraud chargebacks, a fraud chargeback ratio above 0.5%, and 3-D Secure on 10% or less of transactions in non-regulated countries such as the US (50% or less in regulated regions such as Europe).
How the ECM ratio is calculated
Mastercard divides the chargebacks received in a month by the number of transactions in the previous month. Chargebacks belong to the month they arrive, not the month of the original sale. Mastercard counts a chargeback whatever its reason, whether or not you refunded first, and whether or not you win it, as Stripe's docs note.
The lag is where seasonal and paid-acquisition brands get caught. Suppose a brand processes 20,000 Mastercard transactions in August, then pauses ads and processes 12,000 in September. In October it receives 190 chargebacks, many of them from the August cohort.
- Against August volume, that would be 190 ÷ 20,000 = 0.95%.
- Mastercard uses September volume: 190 ÷ 12,000 = 1.58%. With more than 100 chargebacks, that is an ECM month.
The same chargebacks, after a drop in sales, put the brand over the line. Plan this before you cut spend after a big launch or a holiday peak.
What ECM costs
Mastercard's schedule is published in the J.P. Morgan guide and repeated in Stripe's docs. Fines are charged to the acquirer, which normally passes them on.
To leave ECM or HECM, a merchant must stay below the threshold for three consecutive months. A merchant in HECM that falls below 3% but stays above 1.5% moves down to ECM rather than out. The fines are often not the biggest cost. Acquirers can add reserves, delay payouts or cap volume, and an unresolved case can end with the account closed.
Where the count floor stops protecting you
Both programs combine a ratio with a minimum count, so the ratio that actually gets you flagged depends on your volume. Below a certain size, you hit the count floor before the ratio matters.
- Visa Excessive: 1,500 events at 1.5% means the ratio becomes the binding limit at 100,000 settled card-not-present transactions a month. At 40,000 transactions, you would need a 3.75% ratio to reach 1,500 events.
- Mastercard ECM: 100 chargebacks at 1.5% means the ratio binds from about 6,667 transactions in the previous month. Most growing DTC brands are already past that.
- Visa under a flagged acquirer: with a floor of only 5 events, 0.5% applies at almost any volume.
So a mid-sized subscription brand is usually measured by Mastercard at 1.5% and, depending on its acquirer, by Visa at 0.5%. The 1.5% Visa headline is mostly a large-merchant number.
The 2025–2027 timeline
The rules have changed several times in 18 months, and more change is planned. The dates below come from Visa's fact sheet, Stripe's docs, and acquirer and vendor guidance on Mastercard's 2027 plans.
- 24 July 2026: Mastercard's Scam Merchant Monitoring Program (SMMP) took full effect. It runs alongside ECP and looks for scam signals rather than ratios. We covered it in our guide to Mastercard SMMP.
- October 2026: Visa's Merchant Elevated Risk Program (MERP) applies in Asia Pacific. It watches newer merchants on combined signals and doesn't publish thresholds, according to Stripe.
- 1 April 2027 (planned): Mastercard's Global Merchant Audit Program (GMAP) replaces the Acquirer Chargeback Monitoring Program, according to Chargeback Gurus and IXOPAY, which cite a non-public Mastercard bulletin (GLB 14127.1). ECM and HECM move into GMAP, and ECM is to be measured by sub-merchant ID where one exists.
- 2029 to 2031 (planned): the ECM ratio floor steps down from 1.5% to 1.3% (2029), 1.1% (2030) and 0.9% (2031), with the 100-chargeback minimum kept, per the same summaries. Mastercard hadn't published the final rulebook text as of October 2026, so treat these as planned.
Why subscription brands run hotter on both ratios
Subscriptions create a specific kind of dispute: the customer who forgot about the renewal, didn't recognise the descriptor, or couldn't find a way to cancel. These show up as "cancelled recurring" or "not as described" disputes, and often as fraud claims when the customer tells the bank they didn't authorise it. That last case is the expensive one under VAMP, because it can produce both a fraud report and a dispute.
Renewal timing adds a second effect. Renewals bunch around signup cohorts, so a big launch month produces a spike of first renewals 30 days later, and a spike of disputes after that. If new sales slow in the meantime, Mastercard's previous-month denominator shrinks just as chargebacks rise. We looked at the cancellation side of this in why people cancel subscriptions.
How to stay under the thresholds
1. Track the network's numbers, not just your own
Rebuild both ratios every week the way each network calculates them: fraud reports plus disputes over same-month settled transactions for Visa, and chargebacks over last month's transactions for Mastercard. Keep separate numbers for each MID and descriptor, because Visa identifies merchants by descriptor and acquirer, and Mastercard by merchant ID. For US accounts, Stripe suggests counting disputes from the 5th of one month to the 5th of the next, because of a reporting delay between its banking partner and the networks.
2. Stop disputes before they're filed
- Show the billing terms and renewal date at checkout and get an explicit agreement.
- Send a reminder before trials convert and before annual renewals. Stripe suggests 7 days before an annual renewal and 2 to 3 days before a monthly one.
- Make cancellation easy to find. A customer who can cancel in two clicks doesn't need their bank.
- Use a descriptor customers recognise, ideally with your brand name and a support URL.
- Answer billing questions fast. A refund before a dispute is cheaper than any chargeback, even though it won't undo a fraud report that was already filed.
3. Catch fraud before capture
Fraud reports count whether or not you refund. Stripe points out that issuers report fraud on captured payments, not on authorizations that you reverse before capture. Reviewing risky first orders before capturing them, and using 3-D Secure where it makes sense, keeps TC40s out of the count. 3-D Secure also matters for Mastercard's EFM, which only applies at low 3DS usage.
4. Use pre-dispute tools and check how your acquirer counts them
Visa's fact sheet excludes disputes resolved through pre-dispute solutions and fraud reports that qualify for Compelling Evidence 3.0. Order data sharing and alert programs can resolve a case before it becomes a chargeback. Ask your acquirer, in writing, which tools it treats as excluded and in which month.
5. Don't split volume to dodge the lines
Running several brands on several MIDs is normal. Spreading one brand's sales or chargebacks across accounts to keep each one under a threshold is not. The FTC has called it "load balancing" since its 2014 case against Cardflex, and in September 2026 a proposed FTC order against Humboldt Merchant Services bars "tactics to avoid fraud and risk monitoring, including load balancing." Processors that find it can close the account, which can lead to a MATCH listing, as Chargeback Gurus explains. If you run more than one gateway, the reason should be redundancy and approval rates, as we discuss in our guide to recurring billing across multiple payment gateways, not hiding a ratio.
Where Paysight fits
Paysight isn't a payment processor and doesn't underwrite, settle or hold funds. Your acquirers and the card networks still decide your monitoring status, and nothing in Paysight changes how VAMP or ECM are calculated. Paysight is a platform for launching and managing subscriptions on the gateways and merchant accounts you connect yourself, such as Stripe, NMI, Finix or your own MIDs.
What it changes is how quickly you see the problem and how many disputes you prevent. Subscription, transaction and customer data sit in one place, so you can see which offer, cohort or MID is driving disputes instead of stitching exports together at month end. Care Portals give customers a branded page on your domain where they can look up a charge (including by the first six and last four digits of their card), request a refund or cancel a subscription, which is the conversation that otherwise happens with their bank. And the card account updater keeps stored cards current, so renewals don't fail and get retried on outdated details.
Sources
- Visa: Visa Acquirer Monitoring Program fact sheet (thresholds effective 1 June 2025; merchant threshold change 1 April 2026; accessed October 2026)
- Stripe Docs: dispute and fraud card monitoring programs (VAMP, ECM, HECM, EFM, MERP; accessed October 2026)
- J.P. Morgan: Mastercard Excessive Chargeback Program guide (rev. 12/2019)
- Checkout.com: Visa Acquirer Monitoring Program explained (August 2025)
- Merchant Risk Council: stricter VAMP ratio thresholds are now in effect (1 April 2026)
- IXOPAY: Visa Acquirer Monitoring Program updates (May 2025, updated 2026)
- Chargeback Gurus: the new Mastercard Global Merchant Audit Program (July 2026)
- IXOPAY: Mastercard GMAP 2027 guide (August 2026)
- Chargeflow: Mastercard Excessive Chargeback Program guide (updated October 2026)
- FTC: action against Humboldt Merchant Services (8 September 2026)
- Chargeback Gurus: the risks of merchant account load balancing (August 2022)
- PYMNTS: FTC complaint against Cardflex describes load balancing (August 2014)
Since 1 April 2026, Visa flags a merchant as Excessive under VAMP at a ratio of 1.5% or more with at least 1,500 fraud reports and disputes in a month, in the US, Canada, the EU, Asia Pacific and Latin America. CEMEA stays at 2.2% with at least 150 events and $75,000. If your acquirer's own portfolio is above Visa's 0.5% acquirer level, merchants in it can be identified at 0.5% with as few as 5 events.
VAMP adds issuer fraud reports (TC40) to disputes (TC15), and a transaction that appears in both reports counts twice. Fraud reports count even when no chargeback follows and even when you refunded the order. A dashboard that shows only disputes divided by transactions will usually show a lower number than Visa calculates.
No. Visa and Mastercard ignore refunds and dispute outcomes when they count. Once a fraud report or chargeback is filed, a refund or a won dispute doesn't take it out of the count. Refunding before the customer goes to their bank, or resolving the case through a pre-dispute tool your acquirer recognises, is what keeps it out.
Mastercard divides the chargebacks received in a calendar month by the number of Mastercard transactions in the previous month. A merchant enters the Excessive Chargeback Merchant tier at 100 or more chargebacks and a ratio of 1.5% or more, and the High Excessive tier at 300 or more and 3% or more. Because the base is last month's sales, a drop in volume pushes the ratio up even if chargebacks stay flat.
Fines start in month two at $1,000 and rise to $5,000 a month from month four, $25,000 from month seven and $50,000 from month twelve for ECM, with HECM fines twice as high from month three. An issuer recovery assessment of $5 per chargeback above 300 applies from month four. You leave the program after three consecutive months below the threshold. Your acquirer may also add reserves, payout delays or volume caps.
Running separate brands or regions on separate merchant accounts is normal. Splitting one business's sales or chargebacks across accounts to keep each one under a monitoring threshold is called load balancing. The FTC has described it as having no legitimate business purpose, and acquirers treat it as grounds for closing accounts and MATCH listing.
Acquirer and vendor summaries of a Mastercard bulletin say a Global Merchant Audit Program (GMAP) is planned for 1 April 2027. ECM keeps its 1.5% floor and 100-chargeback minimum through 2028, then steps down to 1.3% in 2029, 1.1% in 2030 and 0.9% in 2031. Mastercard hadn't published the final rule text as of October 2026, so confirm the details with your acquirer.
.svg){kind=icon}
.png){kind=icon}
%25201.jpeg)
Company Reg. No. 760371
VAT No. IE4280069RH
