The ratio that gets you fined is not the ratio in your dashboard, and the US line drops by a third on 1 April 2026

A merchant showed me a dashboard reading 0.61 per cent chargebacks and an email from their acquirer warning them about a monitoring programme. I told them the acquirer had made a mistake, because 0.61 is nowhere near any threshold I knew, and I said it with the confidence of somebody who had never opened the programme document. I was wrong, and it was bad advice given to a shop that then lost two months acting on it.

Every guide to how to reduce chargebacks in ecommerce starts with delivery confirmation and clearer billing descriptors. Both of those help and neither is wrong. They also miss the thing that had bitten this merchant, which is that the number the network watches is not the number in the dashboard, and the actual formula only got read here after that answer turned out to be wrong in public.

Visa counts something your dashboard never shows you

Visa consolidated three programmes into one in 2025. The Visa Acquirer Monitoring Program absorbed the old fraud and dispute monitoring programmes, took effect on 1 April 2025 with thresholds live from 1 June, and the advisory period ended on 30 September 2025, so the numbers below have teeth now rather than warnings.

The formula sits in Visa’s own fact sheet and it is one line: “VAMP Ratio = Count of [Fraud (TC40) + Disputes (TC15)] ÷ Count of Settled Transactions (TC05)”. The fact sheet adds that this covers “key components of fraud and disputes on card-not-present VisaNet transactions (domestic and cross-border)”, so TC40 is the fraud report, TC15 is the dispute and TC05 is the settled sale.

Read the numerator again, because that is where I had been wrong for years, and where I suspect most merchants still are: it adds TC40 fraud reports to disputes, and a TC40 is a report an issuer files when a cardholder says a transaction was fraudulent, which does not have to become a chargeback, does not move any money, and therefore never appears anywhere in the merchant’s own dispute reporting.

So a shop can watch a genuine 0.61 per cent dispute rate while its VAMP ratio runs at two or three times that. The dashboard is not lying. It is answering a different question.

The thresholds, and the one that moves in 2026

Acquirer portfolios are flagged Above Standard at 50 basis points and Excessive at 70. Those are not your numbers unless you are large enough to move your acquirer’s portfolio, which almost nobody reading this is.

The merchant thresholds are the ones to write down. In Asia Pacific, Canada, Europe and the United States the Excessive Merchant line sits at 220 basis points with a minimum of 1,500 fraud and dispute events in the month. Latin America sits at 150 basis points with the same 1,500 count. The CEMEA region uses 220 basis points with a much lower entry count of 150 events, provided the amount reaches 75,000 dollars.

Footnote 5 of the fact sheet is the sentence to put on the wall: “Excessive Merchant threshold reduced to >=150bps in AP, Canada, EU, and U.S. regions on 1 April 2026.” That is a cut of roughly a third, it applies to a ratio that already counts more events than most merchants are watching, and outside the payments teams of large merchants almost nobody appears to have the date in a calendar.

The two exclusions are the entire lever

Here is the part that turns a monitoring formula into a work plan, and it took me a second reading to notice because it is written as two bullet points rather than as advice. Two categories come out of the VAMP numerator.

The first bullet says the ratio “Excludes disputes resolved through pre-dispute solutions, contingent on the timing of the data extract”. That is the mechanism where an issuer queries a transaction and gets order detail back, or where a refund fires automatically under a rule you set, before anything becomes a dispute at all. The event stops existing for ratio purposes.

The second says it “Excludes TC 40 fraud qualified for Compelling Evidence 3.0, contingent on the timing of the data extract”. Both carry that same timing caveat, which in practice means a resolution landing after the monthly extract does not save you that month.

Everything else people sell you as chargeback reduction works on the numerator the slow way, by making customers less likely to dispute. These two work on it directly.

What Compelling Evidence 3.0 actually demands

I had assumed CE3.0 was a better evidence form. It is a data retention requirement wearing an evidence form, and if your checkout is not already logging the right fields you cannot use it at all, which is the kind of thing you want to find out in a planning meeting rather than during a dispute.

Visa’s merchant readiness document requires two previous transactions and puts a clock on them: “The transactions must be at least 120 days old but no older than 365 days (calculated from the dispute date).” Each must have no active fraud report and no active fraud dispute, with the note that codes C and D are not classed as a fraud dispute, and both must come from the same merchant.

Then the matching rule, which is an engineering requirement in disguise: “At least two of the core data elements (User ID, IP Address, Shipping Address, Device ID / Fingerprint) match between prior transactions and the disputed transaction, and one of the two must be either the IP address or Device ID / Fingerprint.”

Shipping address and user ID alone will not do it. So a checkout that does not capture device fingerprint and does not store the IP address against the order, for at least 365 days, has locked itself out of the single largest exclusion in the programme. I asked three shops running headless storefronts and two of them were discarding the IP after the fraud check.

Mastercard divides by last month

Mastercard runs a separate programme with a separate formula and I nearly wrote this piece without checking it. The Excessive Chargeback Merchant programme monitors at Merchant ID level on monthly thresholds, and the tier one line is a minimum of 100 chargebacks in a calendar month together with a chargeback to transaction ratio at or above 1.50 per cent. Tier two, High Excessive, starts at 300 chargebacks and 300 basis points. Fines begin from the second consecutive month above the line.

The formula underneath is the part to read twice, and the acquirer documentation spells it out: “Chargeback to Transaction Ratio (CTR) is calculated by determining the number of chargebacks received for a merchant location in a calendar month. Divide that number by the number of sales transactions received from that merchant location in the preceding month.”

The denominator is last month. For a shop with flat volume that changes nothing at all. For a seasonal one it changes everything, because chargebacks from a strong November arrive in December and January while the denominator has already collapsed back to a quiet month, so the ratio spikes precisely when trading is worst and the arithmetic makes a normal seasonal shape look like a control failure.

That last paragraph is my arithmetic, not Mastercard’s. The formula is theirs and the consequence is mine, and I would rather label it than let it read as a quotation.

The size of the problem, in the network’s own numbers

Visa published its reasoning when it introduced the programme. Consumers in the United States disputed roughly 11 billion dollars of charges with card issuers in a year, up from 7.2 billion in 2019. Enumeration attacks, the brute force card testing that fills your authorisation logs with declines, account for 1.1 billion dollars of losses annually.

Visa says it prevented over 40 billion dollars of fraud in a year, and that the new programme consolidated five separate programmes and 38 remediation processes into one. Whatever you think of the thresholds, that consolidation is the reason the numbers changed under merchants who had not changed anything.

What the rules make worth doing, in order

Four jobs fall out of the formulas above. They are not the four on the usual list, and I would rank them in this order for a shop under ten thousand orders a month.

Ask the acquirer for the TC40 count, monthly, separately from disputes. I put this first because it is the half of the VAMP numerator that no merchant dashboard displays, and a shop cannot manage a ratio whose larger component it has never seen. A shop at 61 basis points of disputes has no idea whether it is at 90 or at 200 on the measure that triggers the programme.

Store the four CE3.0 fields against every order and keep them for 365 days. User ID, IP address, shipping address, device ID or fingerprint. The rule needs two matches with one of them being IP or device, so a checkout that discards the IP after its fraud check has disqualified itself from the largest exclusion in the programme without anybody deciding to.

Wire up pre dispute resolution before optimising representment. I had this backwards for years and argued the other way at two conferences. Winning a dispute recovers the money and leaves the event in the numerator; resolving it before it becomes a dispute takes the event out of the numerator entirely, and only one of those two moves the number that carries fines.

Watch the Mastercard ratio against last month’s volume rather than this month’s. We rebuilt one shop’s alerting around that single change. A December ratio built on a November denominator behaves nothing like the figure in a dashboard that divides by the current month, and seasonal shops discover the difference in January when there is no time left to fix it.

Questions we get

The five that arrive most often.

What representment win rate should we expect? I cannot tell you, and I have stopped quoting the figures that circulate. Neither network publishes a merchant level win rate, the vendor numbers I have seen are drawn from their own customer bases and are marketing rather than measurement, and my honest position is that your own rate over the last 200 disputes is the only number worth planning against.

What is the chargeback fee per dispute? It is set in your acquirer agreement rather than by the network, which is why the answer varies so much between shops of the same size, and it is separate from the programme fines that begin once you cross a threshold. Ask your acquirer for both numbers in writing. I have not found a published schedule for either.

What is the friendly fraud share of disputes? Estimates run from about a third to about three quarters, none of them rests on network data, and I use none of them in planning. What the rules do tell you is that Visa built an entire evidence standard around proving a prior relationship with the same cardholder, which is a reasonable signal about how large the category is without giving you a number you could defend.

What is the chargeback threshold before fines start? On Mastercard it is 100 chargebacks and 1.50 per cent in a month, with fines from the second consecutive month. On Visa the merchant line is 220 basis points today in the United States and 150 from 1 April 2026, against a ratio that includes fraud reports as well as disputes.

Is pre dispute resolution worth wiring up? On the arithmetic above it is the highest leverage thing on the list, because a resolved case leaves the numerator instead of merely being won later. My guess is that most shops under a few thousand orders a month never bother, which is a guess and not a measurement.

A short digression about the word chargeback

Half the confusion here is vocabulary, and I still find that harder to forgive than the rules themselves. A fraud report, a dispute, a chargeback and a representment are four different events with four different effects on the ratio, and the industry uses the word chargeback for all of them depending on who is selling what. I still find it irritating that the fact sheet is clear about this and almost nothing written around it is. Anyway, back to the numbers.

What is not settled here

The exact fine amounts under the Mastercard programme. A fine assessment table exists and is referenced in the acquirer documentation available to me, no legible published version of it turned up anywhere, and so no dollar figure goes in your head from this article.

Whether the April 2026 cut lands with any transition. The footnote states the new number and the date and says nothing about an advisory period, and the 2025 change did have one that ran to 30 September. I do not know whether that is a deliberate difference or simply outside the scope of a fact sheet.

How many merchants sit between 150 and 220 basis points right now. That is exactly the population the April change pulls into scope, nobody publishes it, and it is the one number that would tell you whether this is a large event or a small one. It is the gap that bothers me most.