The short answer
Scheme monitoring programs measure ratios such as fraud and disputes per settled transaction. Those ratios are lagging indicators: by the time a merchant breaches one, the losses and the fees are already locked in. Acquirers that stay out of these programs watch leading indicators instead, combining their own transaction data with what is happening on the merchant’s website, reviews and traffic.
The thresholds that matter in 2026
Both schemes tightened their monitoring programs over the last 18 months.
| Program | Who it measures | Key threshold (2026) | Notes |
|---|---|---|---|
| Visa VAMP: merchant “Excessive” | Card-not-present merchants | 1.5% from 1 April 2026 in the US, Canada, Europe and Asia-Pacific; 2.2% in CEMEA | Ratio = (TC40 fraud reports + TC15 disputes) ÷ settled CNP transactions; USD 8 per fraud or dispute when excessive |
| Visa VAMP: acquirer | Acquirer CNP portfolio | Above Standard ≥ 0.50%; Excessive ≥ 0.70% | USD 4 per fraud or dispute for Above Standard acquirers from 1 January 2026 |
| Visa VAMP: enumeration | Card-testing attacks | ≥ 20% of authorizations enumerated and ≥ 300,000 enumerated transactions per month | Same per-transaction fee logic |
| Mastercard Excessive Chargeback Merchant | Merchants | ECM: ≥ 100 chargebacks and ≥ 1.5%; HECM: ≥ 300 and ≥ 3% | Escalating monthly assessments the longer a merchant stays in the program |
| Mastercard Excessive Fraud Merchant | E-commerce merchants | ≥ 1,000 transactions, ≥ USD 50,000 fraud and ≥ 0.50% fraud ratio, with low 3DS usage | Applies on top of chargeback monitoring |
| Mastercard scam merchant monitoring | Merchants with scam signals | Investigation must start within 72 hours of a trigger | Effective July 2026; confirmed scam activity requires blocking the merchant |
Two things stand out. Thresholds are moving down, and response windows are getting shorter. A 72-hour investigation clock does not work with a monthly ratio report.
Why ratios arrive too late
A chargeback can arrive weeks after the transaction. A fraud report often arrives later still. When a merchant crosses 1.5%, the transactions that caused it are long settled. The ratio confirms a problem. It does not warn you about one.
For merchants in CEMEA, which includes Türkiye and the GCC, the VAMP merchant threshold remains 2.2% for now. Every other major region moved to 1.5%. Planning around the higher number is a short-term bet.
Eight leading indicators worth watching
| Signal | What it can mean | First response |
|---|---|---|
| Volume grows much faster than website traffic | Transaction laundering or undisclosed sales channels | Footprint and redirect review |
| Ticket size drifts or clusters on round amounts | Product mix change, gambling or reselling of value | Compare with catalogue and pricing |
| Processing volume does not fit the MCC | Miscoding or a new line of business | MCC re-assessment from live site content |
| Approval rate collapses | Card testing, enumeration or a scam operation | Velocity rules, block or step-up authentication |
| Card issuer countries do not match site traffic | Cross-border fraud or traffic routed from another site | Geography review, sanctioned country check |
| Refunds and disputes spike in a young merchant | Bust-out or scam merchant | Early review within the first 90 days |
| Activity at unusual hours or in bursts | Automated attacks or laundering batches | Time-pattern rules |
| Website goes inactive while transactions continue | The merchant is processing for something else | Immediate investigation |
None of these signals is proof on its own. Two or three together are a strong reason to act before the scheme does.
Building an early warning model in four steps
- Baseline by cohort. Compare each merchant with peers of the same MCC, channel, size and age. A 30% month-on-month jump means different things for a new travel agency and an established grocery chain.
- Join internal and external data. Combine authorization and clearing data with website activity, traffic, pricing, reviews and complaint trends. Transaction data alone sees amounts. External data shows what those amounts are buying.
- Tier the alerts. Use three levels: watch, act and escalate. Give each level an owner and a response time that fits the scheme clock, including the 72-hour scam investigation window.
- Feed outcomes back. Every confirmed case and every false positive should tune the thresholds. A model that never learns from its alerts produces noise.
The first 90 days deserve special attention
New merchants are the riskiest part of any portfolio. Scam and bust-out merchants rarely survive long, so they try to process as much as possible early. Carry the onboarding risk score into monitoring, set tighter thresholds for young merchants, and review them more often until they have a track record.
How Onlayer sets this up with you
The tools
- Transaction Monitoring Service with real-time ISO 8583 and API payload capture, an adaptive rule engine, velocity checks and white, black and watch lists.
- Cross-verification of live transaction behavior against website activity, pricing and traffic, including MCC-to-volume discrepancy detection.
- Merchant Monitoring Service for behavioral change, traffic spikes and inactive-site detection.
- Reputation Checks across 50+ external platforms to catch complaint spikes before they become chargebacks.
- Automated Decision Engine to apply consistent outcomes and a full audit trail to every alert.
The setup, with our advisory team
- Threshold workshop. We map your portfolio’s exposure to VAMP, ECM, EFM and scam monitoring triggers by region and merchant cohort.
- Signal design. We configure leading indicators and cohort baselines on your data.
- Alert playbooks. We define watch, act and escalate rules with owners and response times that fit scheme deadlines.
- Monthly risk review. We review hit rates and tune rules with your team until the model runs on its own.
Onboarding plus monitoring together helps clients cut early-stage chargebacks by up to 60%.
Key takeaways
- Scheme ratios are lagging indicators; leading indicators live in the gap between transaction data and web reality.
- Thresholds are falling and response windows are shrinking, with a 72-hour clock for scam investigations.
- CEMEA’s 2.2% VAMP threshold is the exception, not the trend.
- New merchants need tighter thresholds for their first 90 days.
Frequently asked questions
What is the VAMP ratio?
Fraud reports plus disputes divided by settled card-not-present transactions, measured monthly.
What is the VAMP merchant threshold in 2026?
1.5% from 1 April 2026 in the US, Canada, Europe and Asia-Pacific; 2.2% in CEMEA, which includes Türkiye and the GCC.
What are Mastercard’s chargeback monitoring thresholds?
Excessive Chargeback Merchant starts at 100 chargebacks and a 1.5% ratio; High Excessive at 300 chargebacks and 3%.
Why are chargeback ratios a lagging indicator?
Chargebacks and fraud reports arrive weeks after the transaction, so a breached ratio confirms a problem that already happened.
What are leading indicators of merchant risk?
Volume growing faster than web traffic, ticket size drift, MCC-to-volume mismatch, approval rate collapse, geography mismatch, refund spikes in young merchants and inactive sites that keep processing.
Ask Onlayer for a scheme threshold exposure review.
Book a demo
Thresholds and fees reflect Visa’s published VAMP fact sheet and publicly reported Mastercard program parameters as of October 2026. Confirm against your current scheme documentation.
