Chargeback Rules News: Visa and Mastercard Changes

An operator-grade tracker of what changed in Visa VAMP, Mastercard dispute programs, and Compelling Evidence 3.0 this cycle, mapped to the exact workflow adjustment your risk team should make now.

The chargeback rules moved hard this cycle. Visa's Acquirer Monitoring Program (VAMP) tracks how often merchants get disputes. Its excessive merchant ratio dropped from 2.2% to 1.5% in the US, Canada, EU, and APAC on April 1, 2026. That tightened the allowable dispute ceiling by roughly a third. Mastercard's new Scam Merchant Monitoring Program, a program that terminates processing for confirmed scam activity, begins enforcement on July 24, 2026.

What changed this cycle: Visa VCR/VAMP and Mastercard dispute rules at a glance

This cycle, Visa cut the VAMP excessive merchant threshold from 2.2% to 1.5% on April 1, 2026. That change covers the US, Canada, EU, and APAC. Visa's Compelling Evidence 3.0 (CE3.0), a dispute-defense standard, expanded to non-disputed fraud reports. Mastercard published a net-new scam program that terminates processing rather than fining. Below is what moved and what to do about each.

Visa consolidated three older programs into one global program. It merged the legacy VAMP, the Visa Fraud Monitoring Program, and the Visa Dispute Monitoring Program effective June 1, 2025. The advisory grace period ended September 30, 2025. From Q4 2025, a breach carries real fees, not just a warning. If you still track fraud and disputes on separate dashboards, that model is retired. For a refresher on how the underlying chargeback ratio is calculated, start there before recalibrating alerts.

Visa chargeback rules news: thresholds, reason codes, and time limits that moved

The headline Visa change is the VAMP excessive merchant ratio drop from 2.2% to 1.5% in AP, Canada, EU, and the US on April 1, 2026. That is a roughly 32% cut in the allowable dispute ceiling. CEMEA stays at 2.2%, and LATAM was already at 1.5%. So multi-region portfolios must apply region-specific thresholds rather than one global number.

The VAMP ratio is a single count-based metric. It counts fraud reports (TC40) plus disputes (TC15), then divides by the count of settled transactions (TC05). Visa measures it on card-not-present (CNP) transactions on its VisaNet network. Card-not-present means the card was not physically present, as in online orders. Crucially, the ratio excludes disputes resolved through pre-dispute solutions. It also excludes TC40 fraud that qualifies for Compelling Evidence 3.0. That exclusion is your primary lever. A minimum of 1,500 combined monthly events must attach before the excessive designation applies. So monitor both the count and the ratio, not the ratio alone.

• Acquirer portfolio: Above Standard at 0.50%, Excessive at 0.70%, with stricter Above Standard enforcement from January 1, 2026.
• Merchant excessive: 1.5% in US, Canada, EU, APAC (down from 2.2%); 2.2% in CEMEA; 1.5% in LATAM.
• Enumeration guardrail: card-testing flagged at a 20% enumeration-to-authorization ratio plus 300,000 enumerated transactions.
• Fee exposure: $8 per fraudulent or disputed transaction once enrolled at the excessive level.

Now consider enforcement timing. VAMP fee assessment officially commenced October 1, 2025, after the advisory period. The stricter Above Standard acquirer level of 0.5% took effect January 1, 2026. Even a merchant comfortably under its own 1.5% line can get squeezed if its acquirer's portfolio approaches 0.70%. Expect acquirers to push internal limits tighter than Visa's published merchant number.

Mastercard dispute rules news: what shifted and who it hits

Mastercard's biggest news is the Scam Merchant Monitoring Program (SMMP). Mastercard published it in the July 2025 Security Rules, and it becomes enforceable July 24, 2026. Its primary trigger is combined refunds plus chargebacks exceeding 5% of total transactions over a rolling 30-day period, with a minimum of 500 transactions. Once flagged, the acquirer has 72 hours to investigate. Confirmed scam activity terminates Mastercard and Maestro processing immediately.

Here is the operator caveat. Refunds now count alongside chargebacks under SMMP. So aggressive refunding to suppress the chargeback ratio can itself trip the scam monitor. Refund rate must become a first-class metric, governed together with dispute rate. Mastercard's Excessive Chargeback Merchant program (ECM) uses graduated fines. SMMP has no grace period or fine ladder. The outcome is termination, so pre-flag prevention is the only defense.

Two more Mastercard shifts matter for representment deadlines. Since January 2025, dispute response deadlines vary by transaction type. Digital goods and CNP sales get 30 calendar days, down from 45. Physical goods keep 45 days with proof of delivery. Mastercard also eliminated the 10-day acquirer arbitration response window. So arbitration decisions must be pre-staged. Build automated deadline routing that flags digital and CNP disputes on the tighter 30-day clock.

Mastercard also launched First-Party Trust, its answer to Visa CE3.0. It launched in the US in October 2024 and expanded globally in June 2025 to Canada, LATAM, the Caribbean, and Asia Pacific. It shifts liability when the merchant supplies one data element from each of three categories: device identity, delivery, and an additional identity factor. Unlike CE3.0, it does not require prior transaction history. So a first-time customer can qualify.

Compelling Evidence 3.0 and how rule changes reshape representment

Compelling Evidence 3.0 applies only to Visa fraud reason code 10.4 (Other Fraud, Card-Absent Environment). To qualify, you supply two prior undisputed transactions dated 120 to 365 days before the disputed one. They must match at least two of four data elements: customer login ID, IP address, shipping address, and device fingerprint. At least one of those matches must be IP or device ID.

Two changes reshaped how CE3.0 fits your workflow. From October 17, 2025, Visa began automatically qualifying eligible transactions using Visa Secure or Visa Data Only across all major regions. So some 10.4 disputes now qualify without manual evidence. CE3.0 also expanded on April 18, 2026 to cover non-disputed TC40 fraud reports. It expands again on October 24, 2026 to let transactions from multiple merchants serve as evidence. CE3.0 is now a TC40 and ratio tool, not just a representment tool.

Here is the hard rule across both networks. Winning a chargeback at representment does not reduce your VAMP, ECM, EFM, or SMMP ratio. EFM is Mastercard's Excessive Fraud Merchant program. The chargeback already counted, so representment recovers revenue but not ratio. Non-fraud disputes resolved before becoming formal chargebacks are excluded from VAMP. Merchants resolve these through Verifi CDRN, the Cardholder Dispute Resolution Network, or through Rapid Dispute Resolution (RDR). Fraud-coded 10.4 disputes need CE3.0 qualification through Order Insight to be excluded.

What each change means for your chargeback ratio and monitoring-program risk

The combined-counting model is the single biggest structural change. VAMP counts both TC40 fraud reports and TC15 disputes over settled transactions. So a clean dispute record no longer guarantees a clean ratio. One CNP transaction can hit both the fraud and dispute counts. Stopping the dispute alone via representment does not remove the fraud count. Fraud prevention and dispute defense can no longer be managed as separate KPIs.

On the Mastercard side, the ECM ratio is calculated with a one-month lag. It divides chargebacks received this month by transactions processed last month. A sales dip mechanically inflates next month's ratio. So seasonal or declining-volume merchants must watch the ratio prospectively, not just the raw count. Exiting ECM requires three consecutive clean months. The goal is a sustained streak, not a single good month.

Action checklist: workflow adjustments risk-ops teams should make now

Each rule change maps to a concrete adjustment. Work through this list against your current monitoring stack. Where a control is missing, treat it as the remediation priority. The tightened 1.5% line and per-item fee exposure of $8 per counted transaction raise the stakes.

• Re-baseline internal VAMP alerts well below 1.5%, CNP-only, at the MID level, and apply region-specific thresholds (CEMEA still 2.2%).
• Consolidate fraud (TC40) and dispute (TC15) monitoring into one unified VAMP number instead of separate dashboards.
• Configure RDR rules to auto-refund low-value disputes below the cost of fighting them, reserving representment for high-value winnable cases.
• Capture and persist IP address and device fingerprint at every checkout so CE3.0's mandatory anchor element is available at dispute time.
• Verify your processor passes Visa Secure / Data Only data so eligible transactions auto-qualify for CE3.0.
• Track refund rate as a first-class metric alongside chargebacks ahead of Mastercard SMMP enforcement on July 24, 2026.
• Build automated deadline routing that flags Mastercard digital/CNP disputes on the tighter 30-day clock.
• Onboard Mastercard First-Party Trust and build a three-category evidence template distinct from Visa's two-element rule.

How to stay ahead of the next rule change (alerts + pre-dispute)

Staying ahead is less about reading every bulletin. It is more about instrumenting the levers the rules reward: pre-dispute deflection and early alert resolution. RDR, CDRN, and CE3.0-qualified transactions drop out of the VAMP numerator. So speed on the alert queue is what keeps your ratio down. At $8 per counted item, the return on every deflected alert is directly quantifiable.

Layer the tools to match the rule mechanics. Verifi Order Insight and Ethoca Consumer Clarity push data to issuers to prevent disputes being filed. Ethoca Alerts and Verifi CDRN notify after filing but before a chargeback posts. RDR auto-resolves at initiation. Representment recovers revenue after a chargeback posts. Order Insight became mandatory for all Visa issuers in 2025.

What is the biggest chargeback rules change this cycle?

Visa cut the VAMP excessive merchant ratio from 2.2% to 1.5% in the US, Canada, EU, and APAC effective April 1, 2026, a roughly 32% reduction in the allowable dispute ceiling. CEMEA stays at 2.2%. Any merchant running between 1.5% and 2.2% is now in breach territory.

Does winning a chargeback at representment lower my VAMP or ECM ratio?

No. Winning at representment recovers revenue but does not reduce your VAMP, ECM, EFM, or SMMP ratio, because the chargeback already counted when it posted. Only pre-dispute deflection through RDR, CDRN, or CE3.0 qualification keeps a transaction out of the ratio in the first place.

When does Mastercard's SMMP take effect and what triggers it?

Mastercard's Scam Merchant Monitoring Program becomes enforceable July 24, 2026. The primary trigger is combined refunds plus chargebacks exceeding 5% of total transactions over a rolling 30-day period for merchants with at least 500 transactions. Once flagged, the acquirer investigates within 72 hours and confirmed scam activity terminates processing.

How did Compelling Evidence 3.0 change this year?

From October 17, 2025 Visa began auto-qualifying eligible transactions using Visa Secure or Visa Data Only. CE3.0 then expanded on April 18, 2026 to cover non-disputed TC40 fraud reports, and expands again on October 24, 2026 to let transactions from multiple merchants serve as evidence, making it a ratio tool as well as a representment tool.

Why do refunds now matter for compliance?

Under Mastercard's upcoming SMMP, refunds count alongside chargebacks toward the 5% trigger. Aggressive refunding to suppress your chargeback ratio can itself breach the scam-monitoring threshold, so refund rate must be governed together with dispute rate as a first-class metric rather than a release valve.