Chargeback ratio thresholds and card network monitoring programs
Visa VAMP and Mastercard ECP and EFM as documented in November 2026: how each ratio is calculated, the thresholds, the key dates, and what it means for you.
By Florian
Card networks watch how many disputes and fraud reports each merchant generates. Cross a threshold and you enter a monitoring program: fees, remediation plans and, if it lasts, the risk of losing the ability to accept that card. For a subscription business, where one confusing renewal can trigger dozens of disputes in a week, these thresholds are worth knowing precisely.
The programs changed significantly in 2025 and 2026, and many articles online still describe the old ones. This guide summarizes what Visa, Mastercard and the major processors document as of November 4, 2026. Sources: Visa’s VAMP fact sheet, Visa’s articles introducing VAMP and evolving VAMP, Mastercard’s Security Rules and Procedures, Merchant Edition (4 August 2026), Stripe’s monitoring programs page and FAQ, Braintree’s pages on VAMP, the Excessive Chargeback Program and the Excessive Fraud Merchant Program, and Adyen’s monitor risk performance page (all accessed November 2026). Your acquirer’s contract can set stricter limits.
Visa: the Acquirer Monitoring Program (VAMP)
Timeline
| Date | What changed |
|---|---|
| 1 April 2025 | VAMP relaunched as one global program, replacing the Visa Dispute Monitoring Program (VDMP) and Visa Fraud Monitoring Program (VFMP) |
| 1 June 2025 | Revised thresholds and methodology took effect |
| 30 September 2025 | Advisory period (no fines) ended, per Visa |
| 1 April 2026 | Excessive merchant threshold lowered from 2.2% to 1.5% in Asia Pacific, Canada, Europe and the US |
If you read about “VDMP” or “VFMP” thresholds, that material predates April 2025.
The VAMP ratio
Visa’s fact sheet describes a single, count-based ratio covering fraud and disputes on card-not-present transactions. Stripe’s FAQ puts it as: the month’s VAMP count (fraud reports plus disputes) divided by the total settled transactions in the same month.
Two details matter for subscriptions:
- Fraud reports count even without a dispute. Stripe’s monitoring page says early fraud warnings are considered fraudulent regardless of their outcome and are included in VAMP.
- Some resolved disputes are excluded. Stripe says disputes resolved through pre-dispute products, such as its dispute prevention tools (Visa Rapid Dispute Resolution, for example), are excluded from the VAMP count.
Merchant thresholds
| Region | Excessive merchant ratio | Minimum monthly count |
|---|---|---|
| Asia Pacific, Canada, Europe, US | 1.5% (2.2% until 31 March 2026) | 1,500 |
| Latin America and Caribbean | 1.5% | 1,500 |
| CEMEA | 2.2% | 150, and at least USD 75,000 |
Both the ratio and the count must be met. A small merchant with 0.5% of transactions disputed but only 40 disputes a month is not identified at merchant level under these numbers.
Acquirer thresholds
This is the part many merchants miss. VAMP also measures each acquirer’s whole portfolio: Above Standard from 0.5% and Excessive from 0.7%. An acquirer near those levels has every reason to push its merchants well below 1.5%. In practice, your processor may contact you long before you reach Visa’s merchant threshold.
Stripe also notes that if you use several processors that share an acquirer, Visa aggregates the data, so you could be identified even if your ratio on one processor looks fine.
Enumeration
VAMP also targets card testing. Visa’s fact sheet sets an enumeration ratio of 20% (2,000 basis points) and a count of 300,000 enumerated authorization attempts. Subscription signup forms are a common target for card testing, so protect them with fraud rules and rate limits.
Fees and exit
Identified merchants face fees, assessed through the acquirer; Braintree’s fall 2025 release guide lists new VAMP fees from 1 October 2025. What is passed on to you depends on your processor’s contract. Stripe’s FAQ says merchants outside CEMEA exit when either the VAMP count or the VAMP ratio falls below the threshold. Stripe estimates VAMP data daily in its Dashboard, while Visa’s official figures arrive with about a month of delay.
Mastercard: ECP and EFM
Mastercard runs two separate programs, defined in section 8 of its Security Rules and Procedures, Merchant Edition.
Excessive Chargeback Program (ECP)
The ratio is the number of chargebacks in a calendar month divided by the number of Mastercard sales transactions in the previous month. Both the count and the ratio must be met.
| Level | Chargebacks per month | Ratio |
|---|---|---|
| Excessive Chargeback Merchant (ECM) | 100 to 299 | 1.5% to 2.99% |
| High Excessive Chargeback Merchant (HECM) | 300 or more | 3.0% or more |
Braintree notes that since April 2020, Mastercard no longer identifies merchants at the older Chargeback Monitored Merchant level (100 chargebacks and 1.0%); some articles still quote it. Assessments start in the second month and escalate the longer a merchant stays in the program. To exit, a merchant must stay below the ECM thresholds for three consecutive months.
The previous-month denominator matters when billing is lumpy. Disputes can arrive weeks or months after the charge (cardholders typically have about 120 days), so a large annual renewal cohort in January can produce chargebacks in March, which are divided by February’s smaller transaction count. Plan for that spike before a big renewal date.
Excessive Fraud Merchant program (EFM)
EFM looks at fraud chargebacks (reason codes 4837 and 4863) on card-not-present transactions. Per Braintree’s and Stripe’s documentation, a merchant is identified when, in a month, all of these are true:
- at least 1,000 Mastercard e-commerce sales in the previous month;
- at least USD 50,000 in fraud chargebacks;
- a fraud chargeback ratio of 0.5% or more;
- 3D Secure used on less than 50% of transactions in regulated countries, or less than 10% elsewhere.
Australia has lower amount and ratio thresholds. If a merchant breaches both EFM and ECP in the same month, only the EFM assessments apply. Exit also requires three consecutive months below the thresholds.
The 3D Secure condition is a useful lever: a merchant that authenticates enough of its transactions is not identified under EFM, whatever its fraud level.
Side by side
| Visa VAMP | Mastercard ECP | Mastercard EFM | |
|---|---|---|---|
| Counts | Fraud reports and disputes | Chargebacks | Fraud chargebacks |
| Denominator | Settled CNP transactions, same month | Sales transactions, previous month | Sales transactions, previous month |
| Main merchant threshold | 1.5% and 1,500 (most regions) | 1.5% and 100 | 0.5% and USD 50,000 |
| Won disputes count? | Yes | Yes | Yes |
What counts, and what does not
- Won disputes still count. Stripe’s measuring disputes page says all disputes, won or lost, count toward your dispute rate. Accepting a dispute counts too.
- Refunds before a dispute do not create one. A customer who gets a refund has no reason to dispute. But a refund does not remove a fraud report that already exists.
- Inquiries on networks that still use them are not chargebacks.
The practical conclusion: you cannot win your way out of a monitoring program. Only prevention lowers the ratio.
A monitoring routine for subscription businesses
- Compute your own ratios monthly, per network, with the right denominator for each. Do not rely on a blended “dispute rate”.
- Watch spikes after billing events: annual renewal cohorts, price increases, trial conversions.
- Act on early fraud warnings before they become disputes, keeping in mind they already count for Visa. See Stripe early fraud warnings.
- Fix the causes: a clear descriptor, renewal reminders, easy cancel and fast refunds. See preventing subscription chargebacks.
- Ask your processor what internal thresholds they apply. They are often stricter than the networks’.
Doing this with NoChurn
NoChurn shows every Stripe and Braintree dispute with its reason, so you can see which causes drive your ratio, and gathers evidence automatically for the ones you contest (cancel flow answers, emails sent, usage you send by API, help desk conversations read only). Replies are drafted with AI and sent only after human review. On Stripe, early fraud warnings come with a one-click refund. Cancel flows keep a one-click cancel visible, which removes one common source of “cancelled recurring” disputes. NoChurn does not calculate network monitoring status; your processor’s dashboard is the reference.