VAMP, ECM, and the New Math of Chargebacks: What Smaller Merchants Need to Track Now
Visa and Mastercard have spent the last year turning fraud and dispute monitoring from a once-a-quarter surprise into a running scorecard. For small and mid-sized merchants, the ratios were always there — they’re just tighter now, more automated, and more likely to reach you before your processor sends a warning letter. Here’s what changed, what to track, which tools help, and how to intervene early.
Visa’s VAMP, decoded
VAMP (Visa Acquirer Monitoring Program) replaced Visa’s separate fraud and dispute monitoring programs with a single ratio: fraud reports (TC40) plus disputes (TC15), divided by settled card-not-present transactions. One number, two ways to trip it.
The merchant-level “Excessive” threshold dropped from 2.2% to 1.5% this past April, and it only applies past a volume floor — roughly 1,500 combined fraud reports and disputes a month for most U.S. and EU merchants. Below that, you’re not in Visa’s sights yet, but your processor may still be watching: acquirers have their own portfolio thresholds (0.5% “Above Standard,” 0.7% “Excessive”), and your ratio feeds theirs.
Mastercard’s version: ECM and HECM
Mastercard never combined fraud and disputes into one metric; it monitors chargebacks separately through the Excessive Chargeback Program. You land in “Excessive” (ECM) territory at 100–299 chargebacks and a 1.5%–3% ratio, and “High Excessive” (HECM) at 300-plus and 3%-plus. Remember: the denominator is last month’s sales, not this month’s, so a slow month can make a stable chargeback count look worse on paper. Fees escalate the longer you’re flagged — roughly $1,000–$2,000 in the first quarter, $50,000-plus per month past a year — and exiting takes three consecutive clean months, not one.
What to track monthly
Three things, at the merchant ID level, not blended across a multi-MID portfolio: your dispute and chargeback count and ratio, broken out by reason code, since fraud, “goods not received,” and “not as described” call for different fixes; fraud-flagged sales as a share of total volume, even sales that never became a chargeback, since TC40 reports count toward VAMP regardless; and the trend line, not just the level — a ratio climbing from 0.4% to 0.9% over three months is a bigger warning than a flat 1.1%, since thresholds run on rolling windows and momentum matters.
Tools for monitoring — and this depends heavily on your processor
How much of this you can see varies by setup. With a direct merchant account through a traditional acquirer (Fiserv, Worldpay, Elavon, Chase Paymentech), you get your own merchant ID (MID) and a risk portal that reports chargebacks — sometimes fraud-flagged sales—against your ratio. Ask whether it surfaces TC40 data; many portals show only completed chargebacks, understating real VAMP exposure since fraud reports alone can trip it.
Process through a payment facilitator — Stripe, Square, PayPal/Braintree, Shopify Payments — and you’re under their master MID, with visibility that varies widely. Stripe’s Radar and dispute dashboards show ratio and reason codes; several other PayFacs show considerably less by default. Ask how your ratio is calculated and whether they’re absorbing part of your risk into their own aggregate numbers — a spike on your end can get you moved to a dedicated MID, or terminated, with little warning.
Two network-owned services matter regardless of processor: Verifi (Visa-owned) offers the Cardholder Dispute Resolution Network and Order Insight, flagging disputes before they become chargebacks; Ethoca (Mastercard-owned) does the equivalent. Both are typically switched on by your processor or gateway, not the merchant directly, so ask if you’re already enrolled — many are eligible and don’t know it. For a single view across both networks, or help with representment, third-party platforms — Chargebacks911, Chargeflow, Midigator, Justt — track ratios and automate alerts, often for a cut of recovered revenue. Worth the math at real volume; overkill below it.
What your processor is already watching
Acquirers eat the consequences of your ratio before you do — it rolls into their own standing with both networks. Most set internal alert thresholds well below the network’s, often around 0.75%–1%, so they have room to intervene before you trip the actual limit. If you haven’t heard from your processor, that’s not necessarily good news; ask where you sit against both the network threshold and their internal one.
Intervening before it’s systematic
Fix root causes, not individual disputes: unclear billing descriptors and clunky subscription cancellation flows generate a disproportionate share of “friendly fraud” claims. Tighten checkout controls — AVS, CVV, 3-D Secure on higher-risk transactions — before volume grows into a problem. And use pre-dispute tools like Rapid Dispute Resolution and Compelling Evidence 3.0, available through most acquirers, which resolve cases without them ever counting against your ratio.
The programs got stricter this year because the networks decided quarterly self-reporting wasn’t fast enough to stop losses. Waiting for the letter is no longer a strategy — by the time it arrives, you’ve already been counting the wrong numbers for months.