The Blog
Landing in a card scheme monitoring program is not a warning to ignore, but it does not always mean the same thing. This guide explains how Visa VAMP and Mastercard's current fraud, chargeback and scam monitoring frameworks work, what the key thresholds and investigation processes mean, and what merchants can do to reduce risk before their acquiring relationship is put under pressure.
20 August 2026
Landing in a card scheme monitoring program is not a warning to ignore, but it does not always mean the same thing. This guide explains how Visa VAMP and Mastercard's current fraud, chargeback and scam monitoring frameworks work, what the key thresholds and investigation processes mean, and what merchants can do to reduce risk before their acquiring relationship is put under pressure.
There is one email that changes the mood of an entire finance team in about four seconds: "Your account has been identified under a card scheme monitoring program."
No account closure yet, no frozen funds yet, just a paragraph of neutral language and a monthly ratio you may never have looked at closely. Many merchants read it as a warning. In reality, it is a signal that your acquiring relationship is now being examined more closely.
The consequences depend on the scheme and on the specific program involved. Some programs focus on excessive chargebacks or fraud ratios. Others are designed to identify potential scam activity much earlier and require the acquirer or payment facilitator to investigate within a defined period.
The important distinction is that not every Mastercard monitoring mechanism works like a traditional chargeback-ratio program. The latest Mastercard framework introduces a much faster response to certain scam indicators, while Mastercard's broader merchant-risk strategy combines network intelligence, monitoring and investigation capabilities.
Here is how the current landscape works and what you can do if your merchant account starts attracting attention.
Visa and Mastercard do not process your payments themselves. They operate the card networks and establish rules that govern how acquirers, issuers and merchants manage fraud, disputes and risk.
When a merchant generates excessive disputes, fraud signals or other risk indicators, the schemes have mechanisms that require the acquiring side to investigate and, where necessary, take corrective action.
Your acquirer is normally the party communicating with you because it is the entity directly managing your merchant account and carrying responsibility for complying with the scheme rules.
Visa consolidated its previous dispute and fraud monitoring approach into the Visa Acquirer Monitoring Program (VAMP).
One of the most important changes is that Visa now brings fraud and dispute activity into a combined framework rather than treating the two as completely separate merchant problems.
That changes the way merchants should look at their risk exposure. A business can no longer assume that a low dispute ratio automatically means its overall Visa monitoring position is healthy if fraud activity is increasing at the same time.
The exact thresholds and applicable calculations can change according to Visa's current program rules and implementation dates, so merchants should confirm the figure applicable to their region and account with their acquirer rather than relying on an outdated percentage.
The practical lesson is simple: monitor both disputes and fraud signals together and do not wait for an official program notification before investigating an upward trend.
Mastercard's approach in 2026 has expanded beyond traditional chargeback monitoring.
The new Scam Merchant Monitoring rules are designed to identify potential scam activity much earlier, particularly in card-not-present environments. Rather than operating as another simple monthly chargeback-ratio program, the framework can require an acquirer or payment facilitator to investigate specific scam indicators within 72 hours.
This distinction matters.
A merchant does not simply cross a monthly percentage and receive a fine under this framework. Instead, certain signals can trigger an investigation. Reported triggers include significant authorization approval-rate deterioration, Mastercard compliance signals and alerts from approved monitoring providers. For newer merchants, additional scam-related indicators can also apply, including certain combinations of issuer reports and refund or chargeback activity.
If the investigation confirms scam activity, the consequences can be considerably more immediate than those associated with a traditional monitoring ratio: Mastercard and Maestro acceptance can be stopped.
This means merchants need to think about evidence and operational readiness, not simply their monthly chargeback percentage.
Your acquirer may need to review information such as your onboarding documentation, transaction activity, refund behaviour, chargeback records, website content, billing descriptors and customer communications. Having that information organised before an investigation starts can make a significant difference when the response window is measured in hours rather than weeks.
Mastercard's Global Merchant Audit Program (GMAP) is another important part of the updated merchant-risk landscape.
Historically, GMAP was designed to identify merchants displaying unusually high levels of fraud and to classify them according to fraud-related criteria. Mastercard's published rules have also stated that GMAP identifications can prompt acquirers to evaluate the merchant's fraud controls and training procedures.
However, there is an important 2026 update that merchants should be aware of: Mastercard's February 2026 Security Rules and Procedures manual stated that GMAP was suspended until further notice.
More recent industry reporting has described a July 2026 update to Mastercard's merchant fraud and chargeback monitoring framework that includes GMAP. Because Mastercard's public rule documentation and industry reporting are not perfectly aligned on the status and detailed implementation of the latest GMAP changes, merchants should confirm the current GMAP requirements with their acquirer before relying on specific thresholds or fee schedules.
That caveat is important for this article. Do not present the old GMAP thresholds as current Mastercard rules without verification.
The traditional Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM) categories remain relevant to Mastercard's chargeback monitoring framework.
Mastercard's rules define the chargeback basis-point calculation using the number of chargebacks received for a merchant in a calendar month divided by the number of Mastercard transactions from the preceding month, multiplied by 10,000. Acquirers whose merchants exceed the applicable ECM or HECM thresholds must monitor those merchants through Mastercard's compliance systems.
ECM and HECM describe excessive chargeback monitoring. Scam Merchant Monitoring addresses a different risk: potential scam activity requiring rapid investigation. GMAP belongs to Mastercard's broader merchant fraud-monitoring framework.
They are related, but they are not interchangeable.
For traditional chargeback monitoring, the ratio remains one of the most important numbers in the room.
The problem is that merchants often focus entirely on the numerator.
You cannot simply assume that winning a representment will remove the original dispute from every scheme calculation. A successful representment may recover the transaction value, but it does not necessarily mean the original event disappears from the monitoring metric.
The denominator matters too.
A subscription business experiencing increasing disputes after renewals has a different problem from a seasonal merchant whose transaction volume has suddenly fallen while older disputes continue arriving.
The two situations can produce similar ratios but require completely different responses.
The first requires better customer communication, cancellation processes and dispute prevention. The second may require a closer look at transaction timing, sales volume and the way disputes are developing after a peak period.
And under Mastercard's newer scam-monitoring framework, merchants also need to look beyond the traditional chargeback ratio. Authorization behaviour, issuer fraud reports, refund activity and other risk signals can become relevant depending on the applicable program and the merchant's history.
The process now depends heavily on the program involved.
For traditional chargeback or fraud monitoring, the pattern can include:
Scam monitoring is different.
Under Mastercard's new scam-focused rules, the important factor is the speed of the investigation. Mastercard has said that its revised standards require acquirers and payment facilitators to actively monitor merchant behaviour and initiate an investigation within 72 hours when certain potential scam activity reaches the relevant risk threshold.
If the activity is confirmed as scam activity, Mastercard says the merchant must be stopped from accepting Mastercard transactions.
This is why merchants should not treat every Mastercard monitoring notification as if it were simply another ECM ratio issue.
For traditional dispute monitoring, prevention is usually more valuable than simply fighting disputes after they arrive.
Dispute-alert and deflection solutions can give merchants an opportunity to resolve legitimate customer complaints before they become formal chargebacks.
The economics should be evaluated against the value of the transaction, the cost of the intervention and the potential impact of the merchant's monitoring position.
3-D Secure can provide additional authentication and, where the applicable requirements are satisfied, may shift liability for certain fraudulent transactions to the issuer.
However, applying authentication indiscriminately can damage conversion and approval rates.
The objective is not to challenge every customer. It is to use authentication strategically where the additional protection justifies the potential friction.
A significant number of disputes originate from customers who do not recognise a transaction on their statement.
A clear billing descriptor, accessible customer support, transparent cancellation terms and advance communication about recurring charges can reduce unnecessary disputes.
For subscription businesses, this becomes particularly important around renewals.
Refunds have traditionally been treated primarily as a customer-service and dispute-prevention tool.
Under Mastercard's newer scam-monitoring framework, however, certain reported triggers can take combined refund and chargeback activity into account for newer merchants. This means a business should understand not only its chargeback ratio but also how its refund behaviour interacts with the applicable monitoring rules.
The answer is not to stop legitimate refunds.
The answer is to understand the pattern, document why refunds are occurring and make sure your acquirer can see that the business has a legitimate, consistent refund process.
Aggressive retry strategies can create additional risk when they repeatedly submit transactions that an issuer is already declining.
Understanding credit card decline codes and distinguishing recoverable soft declines from transactions that should not be retried can help protect both approval rates and the overall quality of your payment traffic.
Cutting marketing activity or transaction volume is not automatically a solution.
A lower transaction count can change the denominator while existing disputes, fraud reports or other risk signals continue arriving.
The objective should be to improve the quality of transactions and reduce the events that generate risk signals, rather than simply turning down the volume.
When a merchant enters a monitoring situation, the acquirer is managing its own exposure as well as the merchant's account.
This is where an independent specialist can add value: preparing a credible remediation plan, analysing the source of disputes and fraud, improving the merchant's payment setup and, where appropriate, distributing processing across suitable acquiring relationships.
A multi-acquirer structure can also reduce dependence on a single processing relationship, although it does not remove the merchant's responsibility to comply with card-scheme rules.
At www.nextgenpayment.eu we work with more than twenty acquiring partners and over a thousand active merchant accounts, giving us experience across different acquiring environments and risk profiles.
The same multi-acquirer approach can also support merchants looking to optimise their processing costs through an ISO able to lower payment processing fees.
For merchants operating in higher-risk industries, having a specialist partner that understands scheme monitoring can be particularly valuable when an account starts showing signs of elevated risk.
A chargeback or fraud monitoring notification should never be ignored, but not every Mastercard program works according to the old ECM model.
Visa's VAMP combines key fraud and dispute considerations within a single monitoring framework. Mastercard continues to operate chargeback monitoring through its excessive chargeback framework while also introducing a much faster scam-monitoring process and updating its broader merchant-risk strategy. GMAP should also be treated as part of the current Mastercard landscape, but merchants should verify the precise implementation and thresholds with their acquirer because Mastercard's public documentation has been changing.
The practical response is the same: monitor your numbers before they become a problem, prevent disputes instead of only fighting them, document your business practices and make sure your acquirer can quickly understand why your transaction, refund and dispute patterns look the way they do.
If you are already receiving warnings from your acquirer, or your fraud and chargeback indicators have been increasing for several months, talk to our team at NextGen Payment. We can review your current processing structure, identify the areas creating the greatest risk and help you build a more resilient acquiring setup.
.png)
