Visa VAMP and Mastercard Excessive Chargeback Program in 2026: Thresholds, TC40 vs. TC15, and What High-Risk Merchants Must Do

Call Bridge Capital Partners at 866-305-6454 now for high-risk merchant account support and card not present payment processing guidance.

High-risk merchants face two separate network-monitoring structures in 2026:

• Visa’s Acquirer Monitoring Program, or VAMP.
• Mastercard’s Excessive Chargeback Program, or ECP.

The programs do not use the same formula.

They do not use the same thresholds.

They do not classify transactions in the same way.

A merchant can remain below one network’s threshold and exceed the other’s. A merchant can also have a manageable dispute ratio while facing a separate card-enumeration problem.

The response must begin with accurate measurement.

VAMP and ECP Are Different Monitoring Programs

Visa VAMP combines fraud reports and disputes into one card-not-present measurement.

Mastercard ECP measures chargebacks through a chargeback-to-transaction ratio and monthly chargeback count.

The difference matters for underwriting.

An acquirer reviewing a high-risk merchant account may request:

• Visa TC40 fraud data.
• Visa TC15 dispute data.
• Mastercard chargeback data.
• Card-not-present transaction counts.
• Authorization and decline data.
• Refund and cancellation records.
• Fraud-control settings.
• Dispute-response procedures.
• Customer-service records.
• Processing statements by card brand.

Do not combine Visa and Mastercard data into one internal number.

Use separate dashboards.

Use separate monthly reports.

Use separate remediation plans.

Visa and Mastercard may receive different signals from the same merchant activity. The acquiring bank must understand those signals before approving volume increases, changing reserves, or continuing card not present payment processing.

Visa VAMP Ratio: TC40 Plus TC15

Visa defines the VAMP ratio as:

Fraud TC40 reports plus disputes TC15 divided by settled card-not-present VisaNet transactions.

The formula is:

VAMP ratio = (fraud TC40 + disputes TC15) / settled card-not-present VisaNet transactions

This definition comes from the Visa Acquirer Monitoring Program fact sheet published by Visa corporate:

Visa Acquirer Monitoring Program fact sheet

The denominator is settled card-not-present VisaNet transaction activity.

That point is important.

The denominator is not:

• Total website visits.
• Total authorization attempts.
• Total payment attempts across all card brands.
• Total orders before settlement.
• Total transactions across Visa and Mastercard.
• Total customer-service complaints.

The VAMP ratio uses the Visa-defined transaction population.

The numerator combines two different record types:

• TC40: a Visa fraud report.
• TC15: a Visa dispute or chargeback record.

The two records arise from different processes. Treating them as interchangeable creates reporting errors.

Why the VAMP Ratio Changes Under Pre-Dispute Resolution

Visa’s fact sheet describes exclusions that can apply based on the timing of the data extract and applicable program rules.

Pre-dispute solutions can affect whether a dispute becomes a counted TC15 event.

The operational objective is simple:

• Detect the customer issue early.
• Resolve eligible matters before formal dispute creation.
• Record the resolution.
• Confirm how the acquirer reports the transaction.
• Track remaining TC15 and TC40 activity separately.

Pre-dispute tools do not eliminate fraud exposure.

They do not replace authorization controls.

They do not replace customer-service procedures.

They do not replace dispute-response processes.

Review Bridge’s resource on rapid dispute resolution and Visa RDR for the operational distinction between pre-dispute resolution and post-dispute representment.

Visa’s Acquirer Portfolio Levels

VAMP applies at more than the individual merchant level.

Visa also evaluates an acquirer’s portfolio.

The Visa Acquirer Monitoring Program fact sheet identifies these portfolio levels:

• Above Standard: 50 basis points.
• Excessive: 70 basis points.

A basis point is one hundredth of a percentage point.

These portfolio thresholds apply to the acquirer’s measured exposure. They are not the same as the individual merchant Excessive threshold.

The distinction is critical.

A merchant may fall below the merchant-level threshold while contributing to an acquirer portfolio that requires additional attention. Conversely, a merchant may exceed the merchant-level threshold even when the acquirer’s broader portfolio remains below its portfolio level.

Acquirers therefore monitor:

• Individual merchant ratios.
• Merchant count and transaction volume.
• Card-not-present exposure.
• Fraud concentration.
• Dispute concentration.
• Industry and MCC exposure.
• Geographic exposure.
• Enumeration activity.
• Remediation progress.

A high-risk merchant account is not reviewed in isolation.

The acquirer also evaluates how the account affects its portfolio.

Above Standard Is Not the Same as Excessive Merchant

Use precise labels in internal reports.

• Acquirer Above Standard refers to the acquirer portfolio level at 50 basis points.
• Acquirer Excessive refers to the acquirer portfolio level at 70 basis points.
• Visa Excessive Merchant refers to the merchant-level performance threshold.

Do not describe a merchant as being at the acquirer Excessive level merely because its own ratio is elevated.

Do not describe an acquirer portfolio as compliant merely because one merchant is below the merchant-level threshold.

The labels identify different monitoring positions.

Visa’s 2026 Excessive Merchant Threshold

For the United States, Canada, European Union, and Asia-Pacific regions, Visa reduced the Excessive Merchant threshold to 150 basis points, or 1.5%, effective April 1, 2026.

This threshold is stated in the Visa Acquirer Monitoring Program fact sheet.

The ratio is not the only condition.

Visa also applies minimum monthly fraud and dispute counts in addition to the ratio. A merchant must therefore evaluate both:

1. The VAMP ratio.
2. The applicable monthly count requirement.

A percentage without a count is incomplete.

A count without a percentage is also incomplete.

Monthly reporting should show:

• Visa TC40 count.
• Visa TC15 count.
• Combined TC40 and TC15 count.
• Settled card-not-present VisaNet transaction count.
• Calculated VAMP ratio.
• Any pre-dispute exclusions.
• Any applicable minimum-count result.
• Month-over-month movement.
• Root cause.
• Corrective action.

Do not rely on an annual average.

Network monitoring programs evaluate monthly performance.

A temporary spike can require immediate review even if the annual average appears lower.

TC40 and TC15: The Difference

TC40 and TC15 belong in the same VAMP numerator, but they are not the same record.

TC40 Is a Fraud Report

TC40 represents a Visa fraud report.

It signals reported fraud associated with a Visa transaction.

A TC40 event can reflect:

• Unauthorized use.
• Compromised payment credentials.
• Fraud identified by an issuer.
• Fraud reporting connected to a card-not-present transaction.

The merchant may not receive the same operational detail for every TC40 event. Reporting availability depends on the acquirer, processor, gateway, issuer, and applicable network data.

The merchant should still track:

• Transaction identifier.
• Order identifier.
• Customer account.
• Device and session data.
• Authentication results.
• AVS and CVV results.
• IP and geographic signals.
• Fulfillment status.
• Refund status.
• Customer communication.
• Related transactions.

A TC40 review asks:

Why did the transaction appear legitimate at authorization, and which control should change?

TC15 Is a Dispute Record

TC15 represents a Visa dispute or chargeback record.

It reflects a formal dispute event under the Visa dispute process.

A TC15 event can relate to different customer claims, including:

• Fraud.
• Merchandise or service not received.
• Cancellation issues.
• Processing errors.
• Credit not processed.
• Product or service dissatisfaction.

The exact reason code and case details determine the response.

A TC15 review asks:

Why did the customer dispute the transaction, and what evidence supports the merchant’s position?

The response may involve:

• A refund.
• Pre-dispute resolution.
• Customer-service records.
• Order confirmation.
• Delivery evidence.
• Terms acceptance.
• Cancellation records.
• Authentication data.
• Representment evidence.

Why the Difference Matters

A merchant can reduce TC15 activity through clearer customer disclosures, faster refunds, better cancellation procedures, and pre-dispute tools.

Those measures may not address a TC40 increase caused by stolen credentials or account testing.

A merchant can also improve fraud controls while continuing to generate TC15 events from:

• Confusing billing descriptors.
• Recurring billing complaints.
• Delayed fulfillment.
• Weak cancellation processes.
• Product-service mismatches.
• Customer-support delays.

Use separate root-cause categories.

Do not classify every TC40 or TC15 event as “fraud.”

Do not classify every dispute as a customer-service issue.

The data must identify the actual failure point.

Visa Enumeration Thresholds Are Separate

Enumeration is a separate Visa monitoring concern.

It addresses authorization activity associated with card testing and account-number probing.

The Visa Acquirer Monitoring Program fact sheet defines the enumeration ratio as:

Enumerated authorization transactions, approved plus declined, divided by all authorization transactions, approved plus declined.

The fact sheet identifies these enumeration thresholds:

• Enumeration ratio: 2,000 basis points, or 20%.
• Enumerated-transaction count condition: 300,000 enumerated authorization transactions.

The two conditions must be reviewed together.

Enumeration is not the same as the VAMP fraud-and-dispute ratio.

The inputs are different:

Measurement	Numerator	Denominator
VAMP ratio	TC40 fraud plus TC15 disputes	Settled card-not-present VisaNet transactions
Enumeration ratio	Enumerated authorization transactions	All authorization transactions
Mastercard ECP ratio	Mastercard chargebacks	Mastercard transaction base under the applicable calculation

A merchant can have:

• Low TC40 activity.
• Low TC15 activity.
• A manageable VAMP ratio.
• A serious enumeration problem.

Card testing can create a rapid increase in authorization attempts without creating the same immediate pattern in settled sales.

That is why authorization monitoring must operate separately from settlement reporting.

Review Bridge’s card enumeration and card-testing prevention resource for gateway and checkout controls.

Enumeration Signals to Monitor

Track authorization activity by:

• IP address.
• Device.
• Card token.
• BIN range.
• Geographic source.
• User account.
• Session.
• Response code.
• Attempt frequency.
• Transaction amount.
• Checkout route.
• Customer account age.

Look for:

• Repeated declines.
• Rapid attempts from related infrastructure.
• Multiple cards used from one session.
• Multiple sessions using similar device signals.
• Repeated low-value authorization attempts.
• Unusual geographic concentration.
• Sudden authorization-volume changes.
• Unusual decline patterns.
• Increased CVV failures.
• Increased address-verification failures.

Do not publish unsupported attack-volume claims.

Do not assume that an attack must come from one IP address.

Use layered controls.

Possible controls include:

• Gateway velocity rules.
• Device and session analysis.
• CAPTCHA or equivalent bot controls.
• Rate limiting.
• Customer-account protections.
• BIN and geographic rules.
• AVS and CVV policies.
• Manual review.
• Emergency transaction controls.
• Acquirer escalation.

Mastercard ECP Thresholds

Mastercard’s Excessive Chargeback Program uses a different structure.

The program evaluates a merchant’s chargeback activity through:

• Monthly chargeback count.
• Chargeback-to-transaction ratio, or CTR.

The Mastercard Rules and Mastercard Chargeback Guide establish the core ECP tiers:

• ECM: At least 100 chargebacks in a calendar month and a 1.5% chargeback-to-transaction ratio.
• HECM: At least 300 chargebacks in a calendar month and a 3.0% chargeback-to-transaction ratio.

The applicable Mastercard chargeback guide describes the CTR calculation using chargebacks received for the merchant location in a calendar month divided by the transaction base specified by the program.

A Mastercard ECP report must therefore show both:

• The monthly chargeback count.
• The applicable CTR.

A ratio alone is not enough.

A count alone is not enough.

ECM: Excessive Chargeback Merchant

ECM applies when the merchant reaches both required conditions:

• At least 100 chargebacks in a calendar month.
• A CTR of at least 1.5%.

The merchant should treat the threshold as an operating control, not a reporting surprise.

Track the trend before the threshold is reached.

Review:

• Chargeback reason codes.
• Billing descriptors.
• Subscription cancellation.
• Product delivery.
• Customer-service response time.
• Refund processing.
• Fraud screening.
• Account takeover indicators.
• Marketing-source changes.
• Sudden volume changes.

HECM: High Excessive Chargeback Merchant

HECM applies when the merchant reaches both required conditions:

• At least 300 chargebacks in a calendar month.
• A CTR of at least 3.0%.

HECM represents a more severe chargeback position.

The operating response should be immediate.

Do not wait for a processor warning before:

• Pausing risky campaigns.
• Reviewing new customer traffic.
• Tightening authorization controls.
• Auditing recurring billing.
• Reviewing fulfillment.
• Contacting the acquirer.
• Preparing a written remediation plan.
• Assigning a single response owner.

Mastercard monitoring is tied to the merchant location and applicable program reporting. A multi-MID structure does not eliminate the underlying customer, fraud, or fulfillment problem.

It can make reporting harder if the business does not reconcile activity across locations.

Visa VAMP Versus Mastercard ECP

The following comparison keeps the programs separate:

Issue	Visa VAMP	Mastercard ECP
Primary focus	Combined fraud and disputes, plus separate enumeration monitoring	Excessive chargebacks
Key fraud record	TC40	Mastercard fraud and chargeback records under applicable rules
Key dispute record	TC15	Mastercard chargeback
Main ratio	TC40 plus TC15 divided by settled card-not-present VisaNet transactions	Chargebacks divided by the applicable Mastercard transaction base
Acquirer portfolio levels	Above Standard at 50 basis points; Excessive at 70 basis points	ECP is measured at the merchant level through count and CTR
Merchant threshold	150 basis points for the United States, Canada, European Union, and Asia-Pacific effective April 1, 2026, with applicable minimum monthly counts	ECM at 100 chargebacks and 1.5%; HECM at 300 chargebacks and 3.0%
Separate authorization concern	Enumeration at 2,000 basis points and 300,000 enumerated transactions	Chargeback monitoring remains distinct from Visa enumeration
Primary operating need	Control fraud, disputes, and card testing	Control chargebacks and their causes

This table is a monitoring reference.

The current network rules and acquirer instructions control the final application to a merchant.

MATCH Is a Termination Database

Mastercard MATCH is different from ECP.

MATCH is a termination database used by acquirers during merchant risk review.

It is not:

• A VAMP ratio.
• A Mastercard ECP tier.
• A TC40 report.
• A TC15 dispute.
• A card-enumeration measurement.

An acquirer may use MATCH information when evaluating a new application or an account change.

A merchant with a prior termination issue should prepare:

• Former acquirer information.
• Termination date.
• Stated termination reason.
• Merchant explanation.
• Corrective action.
• Current processing history.
• Evidence of improved controls.
• Current ownership information.
• Current website and business model.

Do not conceal a prior termination.

Incomplete disclosure can create a new underwriting concern.

A specialized broker can help organize the file and identify an acquiring path, but no provider can guarantee approval or remove a legitimate network record.

PCI DSS v4.0.1 Payment-Page Controls

Network monitoring and PCI DSS address different risks.

VAMP and ECP measure fraud and dispute exposure.

PCI DSS v4.0.1 addresses the security of payment data and payment systems.

For e-commerce merchants, the payment page remains a key control point.

The PCI Security Standards Council identifies payment-page protections in Requirements 6.4.3 and 11.6.1.

Source:

PCI Security Standards Council payment-page security guidance

Requirement 6.4.3 addresses payment-page scripts.

The merchant must manage scripts loaded and executed in the consumer’s browser. Controls include:

• Script authorization.
• Script integrity.
• Script inventory.
• Business or technical justification for each script.

Requirement 11.6.1 addresses payment-page change and tamper detection.

The control evaluates changes to:

• Payment-page content.
• Scripts.
• HTTP headers.
• Other security-impacting elements.

These controls help reduce e-skimming and unauthorized client-side changes.

They do not guarantee that the merchant will remain below VAMP or ECP thresholds.

They are one part of the control environment.

A high-risk merchant should document:

• Payment-page architecture.
• Hosted fields or iframe use.
• Third-party scripts.
• Script owners.
• Change approvals.
• Security testing.
• Tamper alerts.
• Incident response.
• Gateway responsibilities.
• Service-provider responsibilities.

What High-Risk Merchants Must Measure Every Month

Create a monthly network-risk report.

Separate Visa and Mastercard.

The report should include:

Visa settlement and dispute data

• Settled Visa card-not-present transactions.
• TC40 count.
• TC15 count.
• Combined count.
• VAMP ratio.
• Applicable minimum-count result.
• Pre-dispute activity.
• Refund activity.
• Reason-code breakdown.
• Month-over-month change.

Visa authorization data

• Total authorizations.
• Approved authorizations.
• Declined authorizations.
• Enumerated authorizations.
• Enumeration ratio.
• Enumerated-transaction count.
• Device and IP patterns.
• Velocity-rule activity.
• Blocked traffic.
• Escalations.

Mastercard chargeback data

• Mastercard chargeback count.
• Applicable Mastercard transaction base.
• CTR.
• ECM status.
• HECM status.
• Reason-code breakdown.
• Refund and cancellation activity.
• Customer-service response.
• Representment results.

Operating data

• Sales by channel.
• Sales by country.
• Average ticket.
• Highest ticket.
• Recurring-billing volume.
• Refund rate.
• Fulfillment time.
• Customer complaints.
• Descriptor changes.
• Marketing-source changes.
• New product or service launches.

The report should identify an owner.

It should identify a deadline.

It should identify the control change.

A dashboard without assigned action is not a remediation program.

Response Plan When Ratios Rise

Act before a formal network notice.

1. Confirm the data

Reconcile processor reports, gateway reports, CRM records, refund records, and dispute records.

Look for:

• Duplicate counts.
• Wrong MID assignment.
• Incorrect card-brand mapping.
• Settlement-period differences.
• Missing pre-dispute records.
• Incorrect transaction denominators.
• Unmatched customer records.

Do not make operational decisions from an unreconciled report.

2. Identify the root cause

Separate:

• Fraud.
• Friendly fraud.
• Fulfillment failure.
• Billing confusion.
• Cancellation failure.
• Customer-service failure.
• Product or service dissatisfaction.
• Card testing.
• Account takeover.
• Marketing or traffic-source problems.

Different causes require different controls.

3. Reduce immediate exposure

Depending on the cause, consider:

• Pausing a campaign.
• Restricting a product.
• Tightening velocity rules.
• Reviewing high-risk geographies.
• Adding manual review.
• Requiring stronger authentication.
• Improving cancellation access.
• Issuing eligible refunds.
• Reviewing recurring transactions.
• Escalating suspicious traffic.

Do not make a broad change without measuring its effect.

4. Notify the acquirer when appropriate

Provide facts.

Include:

• What changed.
• When it changed.
• Which transactions were affected.
• What control failed.
• What control is now active.
• Who owns monitoring.
• When the next review will occur.

Avoid unsupported promises.

5. Track the result

Measure the next reporting period.

Confirm whether:

• TC40 activity changed.
• TC15 activity changed.
• Enumeration activity changed.
• Mastercard chargebacks changed.
• Customer complaints changed.
• Refunds changed.
• Authorization quality changed.

A remediation plan must show results.

Use 3-D Secure Without Treating It as a Complete Solution

3-D Secure can support card not present payment processing by adding an authentication layer.

It may help identify higher-risk transactions before settlement.

It may also support applicable liability-shift processes when the transaction meets network and issuer requirements.

It does not solve every dispute.

It does not eliminate:

• Product-not-received claims.
• Cancellation complaints.
• Billing-descriptor confusion.
• Service-quality complaints.
• Friendly fraud.
• Fulfillment failures.
• Card-testing activity outside the authentication flow.

Use 3-D Secure as one layer.

Combine it with:

• Device analysis.
• Velocity limits.
• AVS.
• CVV.
• Customer-account controls.
• Payment-page security.
• Refund procedures.
• Customer service.
• Dispute alerts.
• Transaction monitoring.

Review Bridge’s 3-D Secure 2.0 resource for high-risk e-commerce merchants for implementation considerations.

Underwriting Implications for a High Risk Merchant Account

Network monitoring now affects more than post-transaction compliance.

It can affect underwriting decisions before approval.

An acquirer may review:

• Expected card-not-present volume.
• Industry and MCC.
• Average ticket.
• Monthly transaction count.
• Chargeback history.
• Fraud history.
• Subscription structure.
• Cross-border activity.
• Gateway configuration.
• 3-D Secure use.
• Enumeration controls.
• Refund procedures.
• Customer-service capacity.
• Prior processor history.
• Reserve capacity.

Prepare a documented risk file.

Include:

• Processing statements.
• Bank statements.
• Product or service descriptions.
• Fulfillment procedures.
• Refund and cancellation policies.
• Fraud-control settings.
• Dispute procedures.
• PCI responsibilities.
• Website screenshots.
• Gateway configuration.
• Prior remediation records.

Bridge’s high-risk merchant account underwriting checklist covers the application materials and risk controls that underwriters commonly review.

A complete file does not guarantee approval.

It gives the acquiring bank usable information.

It also helps identify a suitable processing structure before the account begins accepting volume.

Action Checklist for 2026

Complete these steps now:

• Separate Visa and Mastercard reporting.
• Track Visa TC40 fraud reports.
• Track Visa TC15 disputes.
• Calculate the VAMP ratio using settled card-not-present VisaNet transactions.
• Review the 50-basis-point Visa acquirer Above Standard level.
• Review the 70-basis-point Visa acquirer Excessive level.
• Review the 150-basis-point Visa merchant Excessive threshold for the United States, Canada, European Union, and Asia-Pacific effective April 1, 2026.
• Apply Visa’s minimum monthly fraud and dispute count requirement.
• Track enumeration ratio separately.
• Track the 2,000-basis-point enumeration threshold.
• Track the 300,000 enumerated-transaction condition.
• Track Mastercard monthly chargeback count.
• Calculate Mastercard CTR.
• Review the ECM threshold of 100 chargebacks and 1.5%.
• Review the HECM threshold of 300 chargebacks and 3.0%.
• Audit billing descriptors.
• Audit recurring-billing cancellation.
• Monitor fulfillment and delivery evidence.
• Maintain customer-service records.
• Review payment-page scripts under PCI DSS v4.0.1.
• Maintain payment-page tamper detection.
• Document fraud and enumeration controls.
• Disclose prior processing problems during underwriting.
• Assign one owner for acquirer communications.
• Call 866-305-6454 for high-risk processing support.

Get High-Risk Processing Support Now

Visa VAMP and Mastercard ECP require separate measurement.

TC40 is not TC15.

Visa’s acquirer portfolio thresholds are not the same as its merchant threshold.

Enumeration is not the same as the VAMP fraud-and-dispute ratio.

Mastercard ECP is not MATCH.

PCI DSS payment-page controls are not a substitute for fraud and dispute monitoring.

The correct response is a connected control program with separate reporting.

Bridge Capital Partners helps businesses evaluate high-risk merchant account options, card not present payment processing, gateway configuration, fraud controls, dispute procedures, and underwriting documentation.

Call 866-305-6454 now.