Chargeback Monitoring Programs Explained

01What a chargeback monitoring program is, and the numbers that matter

A chargeback monitoring program is a formal network mechanism that tracks a merchant's chargeback or fraud ratio every calendar month and imposes escalating fines, mandatory remediation, and ultimately termination risk when that ratio stays above a published threshold. Visa, Mastercard, and American Express each run their own version. The programs are not optional, and the consequences flow through your acquirer to you — Shopify merchants included.

The cards below cover every major program. Where a figure is not published by the network, that is noted plainly.

02Who is actually enrolled: your acquirer, not you

Visa and Mastercard hold the acquirer responsible, not the merchant. Both networks measure at the Merchant ID (MID) level — the acquirer-assigned identifier that appears in the clearing record — and they assess the acquirer for noncompliance. The acquirer then passes the fines, the remediation requirements, and the reputational pressure down to the merchant. That chain matters because it shapes everything about how a notice arrives, what it says, and how much room you have to respond.

The number in a notice is always last month's ratio. Network data flows through clearing and settlement, gets aggregated, and is reported on a monthly cycle. By the time your acquirer forwards the placement notice — whether by email, through your payment provider's dashboard, or through Shopify's own notification path — the ratio that triggered it describes a month that has already ended. The disputes that drove it have long since been filed. That lag is not a technicality; it means the ratio you are running right now could already be worse than the one in the letter, or it could have improved, and you will not know which for another month.

Acquirers and processors also run their own internal monitoring lines, and those lines are almost always tighter than the network thresholds. An acquirer may flag a merchant internally well below the Visa VAMP Excessive threshold of 1.5%, because the acquirer itself faces network-level consequences if its aggregate portfolio ratio climbs too high. Visa's acquirer-level Above Standard threshold is 0.5% (enforced from 1 January 2026), and the acquirer Excessive threshold is 0.7%. An acquirer carrying a merchant at 1.2% is already absorbing portfolio risk before that merchant ever crosses the formal merchant program line. The practical result: a processor can impose reserves, reprice your rates, or restrict your processing volume based entirely on its own internal risk model, with no network program involved at all.

03Are you big enough to be enrolled? The arithmetic most guides skip

Most articles on chargeback monitoring programs skip the volume question entirely, which leaves small merchants convinced they are one bad month away from a Visa enforcement action when they are nowhere near the scope threshold. The honest answer requires a little arithmetic.

Visa VAMP's merchant program only applies once a merchant has at least 1,500 fraud reports plus disputes in a single month. That floor counts events — TC40 fraud reports and TC15 disputes combined — not transactions. To generate 1,500 events, you need enough volume that 1,500 of your orders are generating fraud reports or disputes. At a 1.5% ratio, that means 100,000 settled card-not-present transactions in the month. At a 3% ratio, still 50,000. At 5%, still 30,000.

Mastercard ECM requires both a ratio of at least 1.50% and at least 100 chargebacks in the calendar month. To reach 100 chargebacks at exactly 1.5%, you need roughly 6,667 prior-month Mastercard transactions. That is a much lower bar than Visa — but it is still a bar, and a merchant running 500 Mastercard transactions a month who has 20 chargebacks is at a 4% ratio without being anywhere near the 100-chargeback floor.

Most small Shopify stores — a few hundred to a few thousand orders a month — are below both of those floors. The formal Visa VAMP merchant program will not apply to them, and Mastercard ECM is unlikely to apply unless their chargeback rate is extremely high and their Mastercard volume is concentrated. That is the honest answer to the question most merchants are actually asking when they search this topic.

04Visa VAMP in detail

The Visa Acquirer Monitoring Program (VAMP), which took effect 1 April 2025, replaced five earlier Visa fraud and dispute programs — including the Visa Dispute Monitoring Program (VDMP) and the Visa Fraud Monitoring Program (VFMP) — and consolidated 38 separate remediation processes into one. An advisory period ran from 1 April 2025 through 30 September 2025. Enforcement of the Excessive merchant tier began after that, from 1 October 2025.

The ratio and formula

The VAMP ratio is calculated as: (TC40 fraud reports + TC15 disputes) divided by settled card-not-present transactions (TC05). Card-present transactions are excluded entirely. One important wrinkle: a single order can generate both a TC40 fraud report and a TC15 dispute, and if it does, it counts in both the numerator components. That means a merchant with a high rate of fraud-that-becomes-a-dispute can see its event count climb faster than its raw dispute count would suggest.

The 1,500 floor

A merchant is only measured under the formal VAMP merchant program once it has at least 1,500 fraud-plus-dispute events in a month. The 1,500 is a count of events, not transactions. A merchant with 90,000 settled CNP transactions and 1,500 events is right at the floor. A merchant with 40,000 settled CNP transactions and 1,200 events is below the floor regardless of what ratio that produces — the formal program does not apply that month, though the acquirer's own risk team may still act on the ratio.

The 1.5% threshold and the 2025–2026 timeline

The Excessive merchant threshold was 2.2% at launch. It stepped down to 1.5% (150 basis points) from 1 April 2026 for merchants in the US, Canada, the EU, and Asia-Pacific. CEMEA remains at 2.2%. There is no warning tier for merchants — one Excessive line, and crossing it while above the 1,500 floor puts the merchant in scope. Reported: a first-time breach within a rolling twelve months gets a three-month delay before enrollment begins; confirm the current application of that provision with your acquirer.

What is excluded and what that means

Two categories of disputes are excluded from the VAMP ratio: disputes resolved through Compelling Evidence 3.0 (CE 3.0), and disputes stopped by pre-dispute tools. Disputes resolved through Rapid Dispute Resolution (RDR) and through dispute alerts such as Verifi CDRN and Ethoca Alerts are reported as not counting toward the ratio. This exclusion is operationally significant: it means that a merchant close to the 1.5% line has a lever that actually moves the ratio, not just the dispute outcome. A dispute that is filed and then won does not come off the ratio. Only prevention — stopping the dispute before it is filed, or qualifying it under CE 3.0 — keeps it out of the count.

Cost and tiers

There is no merchant warning tier under VAMP — the program goes straight to Excessive. The reported fee is $8 per fraud report or dispute, billed through the acquirer. At 1,500 events, that is $12,000 in a single month. The fee is charged per event, so the cost scales with the count: 2,000 events would be 2,000 × $8 = $16,000 in a month. Acquirers may pass through additional surcharges on top of the network fee; confirm the exact pass-through structure with your processor.

05Mastercard ECP and EFM in detail

Mastercard's Excessive Chargeback Program (ECP), defined in the Mastercard Security Rules and Procedures, Merchant Edition (August 2026), section 8.3.1, runs on a different clock and a different formula than VAMP. The two programs are not interchangeable, and a merchant can be in one without being anywhere near the other.

ECM and HECM thresholds

Excessive Chargeback Merchant (ECM): at least 100 chargebacks received in the calendar month AND a ratio of at least 150 basis points (1.50%). High Excessive Chargeback Merchant (HECM): at least 300 chargebacks AND at least 300 basis points (3.00%). Both conditions must be met simultaneously — a merchant with 150 chargebacks at a 1.2% ratio is not ECM; a merchant with 80 chargebacks at a 2.5% ratio is not ECM either. The program is measured per MID, and Mastercard assesses the acquirer for noncompliance.

The prior-month denominator

This is where Mastercard's formula diverges from intuition. The ratio uses this month's chargebacks in the numerator and last month's transaction count in the denominator. A large sales month inflates the denominator for the following month's ratio calculation, which makes that following month look artificially safe — even if disputes from the big sale are already arriving. The danger arrives one month later, when the sale's disputes are still coming in against a normal-sized denominator. A Black Friday or BFCM spike in November produces a low December ratio (big November denominator) and a potentially dangerous January ratio (normal December denominator, but November's disputes still arriving). Shopify merchants who run seasonal promotions should map this two-month lag explicitly.

Fine schedule

Source: J.P. Morgan Payments, Mastercard Excessive Chargeback Program guide (rev. 12/2019), reproducing Mastercard's fine structure. Amounts can change; confirm current figures with your acquirer.

Issuer recovery assessment

From the fourth month in the program, a separate issuer recovery assessment applies: $5 per chargeback above 300 chargebacks in the month. A merchant with 500 chargebacks in month four pays (500 − 300) × $5 = $1,000 in issuer recovery on top of the monthly fine. This assessment is in addition to, not instead of, the fine.

What Mastercard can require after six months

After a merchant has been ECM or HECM for six months — consecutive or not — Mastercard may advise the acquirer on an action plan and may require the acquirer to undergo a Franchise Management Program Customer Risk Review at the acquirer's own expense. That last clause matters: the acquirer is paying for the review, which means the acquirer has a strong incentive to terminate the merchant before reaching that point rather than absorb the cost and reputational exposure.

Exit

To exit ECP, the merchant's MID must be below the ECM threshold for three consecutive months. The status resets automatically; a later breach is treated as a first-time breach and the fine clock restarts at month one.

EFM

The Excessive Fraud Merchant (EFM) program targets e-commerce fraud specifically. Reported trigger: at least 1,000 e-commerce transactions, at least $50,000 in fraud chargebacks, and a fraud chargeback ratio of at least 0.50%. EFM counts fraud-reason chargebacks only, not all chargebacks. If a MID is noncompliant under both EFM and ECM in the same month, only the EFM assessment applies — the two programs do not stack. EFM thresholds are reported by processors; the Mastercard rulebook points to a separate monitoring manual, so confirm current figures with your acquirer.

06Worked examples

07American Express and Discover

American Express operates its own dispute process and does not use the Visa or Mastercard network rails. The reported excessive chargeback threshold is above 1% for three consecutive months, at which point Amex may contact the merchant or acquirer directly. Amex goes straight to chargeback without a pre-dispute inquiry stage, which means disputes arrive faster and with less warning than on the Visa or Mastercard networks. The specific fine structure and remediation requirements are not published; contact your Amex relationship manager or processor for current program details.

Discover has no published chargeback monitoring program. Processors commonly use an informal rule of thumb of around 1% or roughly 100 chargebacks a month as an internal trigger, but that is a processor convention, not a Discover document. If you process meaningful Discover volume and your chargeback rate is elevated, the risk is an internal processor action rather than a formal network program.

08What happens if you stay in: from first notice to termination and MATCH Pro

The Mastercard fine escalation in practice

Month one in ECM costs nothing in fines — but it is not free. The acquirer is now aware, the clock has started, and the three-consecutive-months exit clock has not. Month two brings a $1,000 fine. Month three, another $1,000. By month four the fine jumps to $5,000 per month and stays there through month six. A merchant that enters ECM in January and cannot get below the threshold until June has paid $17,000 in fines by the time it exits — and that is at the ECM level, with fewer than 300 chargebacks. At HECM, the same six months costs $33,000 in fines ($0 + $1,000 + $2,000 + three months at $10,000), plus the issuer recovery assessment from month four onward.

After six months in the program — consecutive or not — Mastercard may advise the acquirer on an action plan and can require a Franchise Management Program Customer Risk Review at the acquirer's expense. At that point the acquirer's incentive to terminate the merchant becomes very strong, because the acquirer is absorbing both the fine pass-through risk and the cost of the review.

Termination, reserves, and repricing

Acquirer termination is the acquirer's decision, not the network's. Networks do not directly terminate merchant accounts; they pressure acquirers through fines and program requirements, and acquirers act. The practical path looks like this: notice arrives, remediation plan is requested, fines begin accumulating, the acquirer reprices the account or imposes a rolling reserve to offset its exposure, and if the ratio does not improve, the acquirer terminates the MID. Repricing and reserves can happen at any point in that sequence — they do not require a formal network program to be in place.

MATCH Pro

MATCH Pro — Mastercard Alert To Control High-risk Merchants — is a mandatory database that acquirers must check before signing any new merchant. If an acquirer terminates a merchant and a listed reason applies, it must add the merchant to MATCH Pro within five calendar days of the earlier of the termination decision or the merchant's own notice of departure.

The two reason codes most relevant to chargeback monitoring are Reason Code 04 (Excessive Chargebacks) and Reason Code 05 (Excessive Fraud).

A listed merchant can request removal from the acquirer that entered the listing. No lawyer is required. The request must include the merchant name, address, the principal owner's first and last name, and the website URL if applicable. Mastercard can remove a listing that was entered in error.

09How to get out: what moves each ratio and what does not

The levers that actually reduce a monitoring program ratio split into three categories, and conflating them is where most remediation plans go wrong.

Exit conditions

Mastercard requires three consecutive months below the ECM threshold. The status resets automatically; no acquirer action is required. A later breach restarts the clock at month one. Visa's public fact sheet gives no fixed number of months to exit; remediation runs through the acquirer, and the timeline depends on the acquirer's own remediation program structure. If you are in VAMP, ask your acquirer explicitly what the exit criteria look like in their program — the network document does not specify it.

10If you sell on Shopify

Shopify merchants interact with chargebacks through the Disputes list in their Shopify admin, which surfaces individual disputes as they arrive. That list is useful for tracking and responding to disputes, but it does not show your VAMP ratio or your Mastercard ECM status. The ratio that networks and acquirers monitor is calculated by the acquirer from network clearing data — not from your Shopify order count. Any ratio you calculate yourself from the Disputes list is an approximation, and it will differ from the acquirer's number for several reasons: timing differences in when disputes clear, the treatment of fraud reports (TC40s) that never become visible disputes, and the specific transaction types included in the denominator.

If a monitoring program notice is coming, it will arrive through Shopify or your payment provider — not directly from Visa or Mastercard. Shopify Payments merchants will typically see it through their payment provider communications. Third-party gateway merchants will receive it through their gateway or acquirer. The notice will reference last month's ratio, not the current one.

Flash sales and BFCM create the exact Mastercard denominator distortion described in the worked example above. A Shopify merchant who runs a significant November sale should map the two-month lag: November's large transaction count makes December's ratio look safe, but January's ratio — when November's disputes are still arriving against a normal December denominator — is the month to watch. Build that projection in October, before the sale, not in January when the disputes are already filed.