Fraud and dispute monitoring programs

As part of your financial obligations to card networks, such as Visa and Mastercard, you need to ensure that disputes, which are called chargebacks and inquiries, and fraud in your store are kept at acceptable levels. If the amount of disputes, or the level of fraud exceed the thresholds set by the card networks, then you might be placed in a dispute or fraud monitoring program. As part of these programs, you might incur monthly fines and additional fees.

Visa evaluates your activity monthly against the percentage thresholds established in their monitoring programs. If Visa places you in a program, then you're notified at your store owner's address. You have 12 months to meet the thresholds, or Visa can restrict your ability to accept Visa payments.

This guide outlines new Visa monitoring programs, and previous monitoring programs that are retired.

Visa Acquirer Monitoring Program (VAMP)

VAMP identifies potential fraud based on certain ratios. If you meet both the VAMP ratio threshold, and the VAMP enumeration ratio threshold, then you are placed on the monitoring program. If you meet both the VAMP Ratio and the VAMP Enumeration Ratio, then you are notified that you are enrolled in VAMP. Extended enrollment in VAMP might result in your use of Shopify Payments being restricted.

Review the following information to understand the different types of ratios VAMP uses, and how they are calculated.

VAMP Ratio

The VAMP ratio is calculated by dividing the total number of fraud and non-fraud disputes initiated by your customers, by the total number of transactions processed. Fraud disputes are defined using early fraud warning (EFW) data sourced from Visa’s TC40 reporting. Non-fraud disputes occur when a customer initiates an inquiry or chargeback for reasons such as "Product not received", "Product unacceptable", or “Credit not processed”. Visa identifies businesses when their VAMP ratio reaches a minimum of 1,000 monthly combined fraud and non fraud disputes.

VAMP Enumeration Ratio

The VAMP Enumeration Ratio is calculated by dividing the number of monthly enumerated transactions, by the total number of transactions processed. Enumerated transactions occur when a fraudulent party enters combinations of card values such as Primary Account Number (PAN), card verification value (CVV2), expiration date, and postal code until they find a legitimate combination. Visa identifies businesses when their VAMP Enumeration Ratio reaches a minimum of 300,000 enumerated transactions.

VAMP ratios and related thresholds

Our banking partners notify Shopify if your ratios place you at risk for enrollment into VAMP. VAMP only enrolls accounts it classifies as Excessive when their counts and rates exceed certain thresholds. After the metric falls below the threshold, VAMP releases the account from the program.

Review the following information on the types of ratios and their thresholds.

Information on the types of VAMP ratios, their effective dates, and the thresholds.
Ratio type	Effective date	Threshold ratio or order amount
VAMP ratio	April 1, 2025	1.5% globally (0.9% in Latin America and Caribbean) 1,000 monthly combined fraud and non fraud disputes
VAMP ratio	January 1, 2026	0.9% globally (1.5% in Central Europe, the Middle East, and Africa) 1,000 monthly combined fraud and non fraud disputes
VAMP enumeration ratio	April 1, 2025	20% 300,000 enumerated transactions

VAMP fine schedule

When you exceed the VAMP Ratio or the VAMP Enumeration Ratio, you receive fines for disputes or transactions reported as fraud. You can receive fines for exceeding both ratios.

Information about the thresholds at which businesses are fined for each dispute or fraudulent transaction
Effective date	Fine for exceeding VAMP ratio	Fine for exceeding VAMP enumeration ratio
April 1, 2025	10 USD for each dispute or transaction reported as fraud	10 USD for each dispute or transaction reported as fraud
January 1, 2026	10 USD for each dispute or transaction reported as fraud	10 USD for each dispute or transaction reported as fraud

Visa Fraud Monitoring Program (VFMP) for 3D Secure transactions

Visa has a VFMP program specifically for US businesses who have excessive amounts of domestic 3D Secure fraud on their account. If you're based in the United States, then at the beginning of each month, Visa reviews your previous month's activity to determine if it exceeds their established thresholds. If the amount of 3D Secure fraud is over a certain volume or rate, then the liability for disputes is shifted to you, the business owner, instead of the card issuer.

VFMP volume and rate thresholds

US businesses are placed in the 3DS VFMP if they meet or exceed the thresholds on all of the following criteria:

Fraud volume: The total amount of domestic Visa 3DS fraudulent transactions in USD.
Fraud rate: The total percentage of fraudulent transactions compared to total domestic 3DS transactions.

VFMP warnings and penalities

Review the following information to understand the warnings you receive at each fraud volume and rate, and the related penalties.

Monitoring level	Fraud volume	Fraud rate	Penalties
Early warning	$50,000 USD	0.5%	You receive no fines. Actions can be taken to reduce the amount of fraud before fines are applied. Learn more about early fraud warnings (EFWs).
Standard	$75,000 USD	0.9%	You receive no fines, but you lose liability shift for 3D Secure transactions. Liability shift isn't restored until the program is exited by reducing fraud levels and completing a 3-month tracking period.

Retired dispute and fraud monitoring programs

The following information relates to the disputes and fraud monitoring programs Visa and Mastercard previously used, before introducing VAMP.

Visa Dispute Monitoring Program (VDMP)

The VDMP applies to businesses with an unusually high level of chargebacks on their account. At the beginning of each month, Visa reviews your previous month's activity to determine if it exceeds their established thresholds.

Businesses are placed in the VDMP if they meet or exceed the both of the following thresholds:

Dispute count: The total number of transactions that have been disputed.
Dispute rate: The total percentage of disputed transactions compared to total transactions.

Review the following information to understand the monitoring levels for different dispute volumes and rates, and the related penalties.

Descriptions of monitoring levels in the VDMP.
Monitoring level	Dispute count	Dispute rate	Penalties
Early warning	75	0.65%	No fines. Actions can be taken to reduce the amount of disputes before fines start to be applied. Learn more about EFWs.
Standard	100	0.9%	1-4 months: No fines. 5-9 months: $50 USD for each dispute. 10-11 months: $50 USD for each dispute. Businesses outside the European Union are subject to a $25,000 USD review fee. Businesses might be subject to an audit. 12+ months: $50 USD for each dispute. Businesses are subject to a $25,000 USD review fee. Businesses might be subject to an audit. After 12 months, businesses in this program are eligible for disqualification by Visa. If you're disqualified, then you can no longer process Visa payments.
Excessive	1,000	1.8%	1-6 months: $50 USD for each dispute. 7-11 months: $50 USD for each dispute. Businesses outside the European Union may be subject to a $25,000 USD review fee. 10-11 months: $50 USD for each dispute. Businesses outside the European Union may be subject to a $25,000 USD review fee. 12+ months: $50 USD v dispute. Businesses may be subject to a $25,000 USD review fee. After 12 months, businesses are eligible for disqualification by Visa. If you're disqualified, then you can no longer process Visa payments.

Visa Fraud Monitoring Program

The VFMP applies to businesses who have excessive amounts of fraud on their account. Fraud is defined as a transaction that isn't authorized by the cardholder. This isn't the same as a chargeback, though fraudulent transactions often lead to a chargeback issued by the cardholder. At the beginning of each month, Visa reviews your previous month's activity to determine if it exceeds their established thresholds.

Businesses are placed in the VFMP if they meet or exceed the both of the following threshold criteria:

Fraud volume: The total amount of fraudulent transactions in USD.
Fraud rate: The total percentage of fraudulent transactions compared to total transactions.

Review the following information to understand the different monitoring levels at each fraud volume and rate, and the related penalties.

Descriptions of monitoring levels in the VFMP.
Monitoring level	Fraud volume	Fraud rate	Penalties
Early warning	$50,000 USD	0.65%	You receive no fines. You can take certain actions to reduce the amount of fraud before fines start to be applied. Learn more about EFWs.
Standard	$75,000 USD	0.9%	US businesses lose liability shift for 3D Secure transactions immediately. Businesses in other countries and regions lose liability shift at month 5. Liability shift isn't restored until the program is exited by reducing fraud levels and completing the 3-month tracking period. 1-4 months: No fines. 5-6 months: $25,000 USD. 7-9 months: $50,000 USD. 10-12 months: $75,000 USD. After 12 months, businesses are eligible for disqualification by Visa. If you're disqualified, then you can no longer process Visa payments.
Excessive	$250,000 USD	1.8%	Businesses outside of the US lose liability shift for 3D Secure transactions immediately. Liability shift isn't restored until the program is exited by reducing fraud levels and completing the 3-month tracking period. 1-3 months: $10,000 USD. 4-6 months: $25,000 USD. 7-9 months: $50,000 USD. 10-12 months: $75,000 USD. 12+ months: $75,000+ USD. After 12 months, businesses are eligible for disqualification by Visa. If you're disqualified, then you can no longer process Visa payments.

Visa Fraud Monitoring Program for digital goods businesses

Visa also has a VFMP program specifically for businesses that sell digital goods. This program affects businesses with the following businesses category codes:

5735 — Record Stores
5815 — Digital Goods Media — Books, Movies, Digital artwork/images, Music
5816 — Digital Goods — Games
5817 — Digital Goods — Applications (Excludes Games)
5818 — Digital Goods — Large Digital Goods Merchants

At the beginning of each month, Visa reviews your previous month's activity to determine if it exceeds their established thresholds.

Businesses are placed in the digital goods VFMP if they meet or exceed the thresholds on all of the following criteria:

Fraud volume: The total amount of fraudulent transactions in USD.
Fraud count: The total number of fraudulent transactions.
Fraud rate: The total percentage of fraudulent transactions compared to total transactions.

Review the following information to understand the different monitoring levels at each fraud volume and rate, and the related penalties.

Descriptions of monitoring levels in the digital goods VFMP.
Monitoring level	Fraud volume	Fraud count	Fraud rate	Penalties
Early warning	$15,000 USD	150	0.45%	You receive no fines. You can take certain actions to reduce the amount of fraud before fines start to be applied. Learn more about EFWs.
Standard	$25,000 USD	300	0.9%	businesses lose liability shift for 3D Secure transactions at month 5. Liability shift isn't restored until the program is exited by reducing fraud levels and completing the 3-month tracking period. 1-4 months: No fines. 5-6 months: $25,000 USD. 7-9 months: $50,000 USD. 10-12 months: $75,000 USD. 12+ months: $75,000 USD. After 12 months, businesses are eligible for disqualification by Visa. If you're disqualified, then you can no longer process Visa payments.

Mastercard monitoring programs

Mastercard has two monitoring programs: the Excessive Chargeback Program (ECP) and the Excessive Fraud Merchant (EFM) compliance program. Every month, Mastercard reviews your transactions to determine if you've exceeded the threshold to be placed into a monitoring program.

The ECP has two levels: Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM).

Mastercard removes you from ECM when your level of disputes is reduced to below ECM thresholds for 3 consecutive months. To be removed from EFM, you need to avoid at least one of the conditions for 3 consecutive months.

Mastercard Excessive Chargeback Program

Businesses are placed in the ECP if they meet or exceed the thresholds on both of the following conditions:

Dispute count: The total number of transactions that have been disputed.
Dispute rate: The total percentage of disputed transactions compared to total transactions.

Review the following information to understand the different monitoring levels at each dispute count and rate, and the related penalties.

Descriptions of monitoring levels in Mastercard's chargeback monitoring programs.
Monitoring level	Dispute count	Dispute rate	Penalties
ECM	100-299	1.5%-2.99%	1 month: No fines. 2 months: $1,000 USD. 3 months: $2,000 USD. 4-6 months: $5,000 USD, plus issuer recovery assessment. 7-11 months: $25,000 USD, plus issuer recovery assessment. 12-18 months: $50,000 USD, plus issuer recovery assessment. 19+ months: $100,000 USD, plus issuer recovery assessment. After 4 months, businesses are subject to issuer recovery assessment. This assessment adds an additional $5 USD fee for every chargeback after your 300th chargeback in a month.
HECM	300+	3%	1 month: No fines. 2 months: $1,000 USD. 3 months: $2,000 USD. 4-6 months: $10,000 USD, plus issuer recovery assessment. 7-11 months: $50,000 USD, plus issuer recovery assessment. 12-18 months: $100,000 USD, plus issuer recovery assessment. 19+ months: $200,000 USD, plus issuer recovery assessment. After 4 months, businesses are subject to issuer recovery assessment. This assessment adds an additional $5 USD fee for every chargeback after your 300th chargeback in a month.

Mastercard Excessive Fraud Merchant compliance program

Mastercard's process for determining if a business is placed into EFM is similar to their calculations for ECP, except that the fraud chargeback rate is calculated using only fraudulent chargebacks.

businesses are placed in the EFM program if they meet or exceed the thresholds on all of the following criteria:

Payment count: The total number of ecommerce Mastercard payments.
Fraud volume: The total amount of fraudulent chargebacks in USD, calculated by using dispute reason codes 4837 and 4863.
Fraud rate: The total percentage of fraudulent transactions compared to total transactions.
3DS rate: The total percentage of 3DS Mastercard payments compared to total payments.

Review the following information to understand the different payment count, fraud volume, fraud chargeback rate, total 3DS payment rates thresholds, and their related penalties.

Description of monitoring in the EFM.
Payment count greater than	Fraud volume greater than	Fraud chargeback rate greater than	Total 3DS rate less than	Penalties
1,000 or more	$50,000 USD or more	0.50% or more	10% of total Mastercard count (non-regulated countries) 50% of total Mastercard count (regulated countries)	1 month: No fines. 2 months: $500 USD. 3 months: $1,000 USD. 4-6 months: $5,000 USD. 7-11 months: $25,000 USD. 12-18 months: $50,000 USD. 19+ months: $100,000 USD.

Early fraud warnings (EFWs)

Early fraud warnings (EFWs) are messages sourced from Visa's TC40 reports and Mastercard's System to Avoid Fraud Effectively (SAFE) reports that card issuers on these networks generate to flag payments they suspect might be fraudulent. The networks require issuers to report fraud, but that requirement doesn’t affect an issuer’s decision whether to initiate a dispute.

EFWs can occur on refunded transactions. The only time a refund can prevent a fraud report is when it’s processed as a reversal, which needs to happen within 2 hours of the payment capture.

Although it’s called an EFW, it’s possible to receive an EFW after you receive a fraud-related dispute on a charge. This is generally because the systems the networks use to process EFWs are separate from the systems they use to process disputes, and the systems aren’t necessarily in sync.