How to Spot Which MIDs Are at Risk With Visa and Mastercard

Visa and Mastercard score each merchant ID on its own monthly numbers, so a portfolio average proves nothing. Here is how to rebuild every program ratio per MID, and what to do first when one account crosses a line.

No card network calculates a portfolio average. Visa identifies each account by the static part of its billing descriptor plus its acquiring bank. Mastercard reviews each merchant ID (MID) on its own, every month. Both networks report a month late. So the account that gets identified is usually the small one you watch least.

The MIDs at risk are the ones whose own monthly numbers cross a program line. The ones that look bad in a blended report are a different set. Visa identifies an Excessive Merchant at 1.5% with 1,500 counted events. Mastercard identifies one at 100 chargebacks and 1.5% in the same month. MID risk monitoring is a measurement problem. Here is how to rebuild each program ratio per MID, and what to do first when one account crosses a line.

Which Visa and Mastercard programs can actually put a merchant account at risk?

Nine merchant monitoring programs can flag one MID. Two of them ignore your dispute ratio entirely. Visa runs VAMP (the Visa Acquirer Monitoring Program), VIRP (the Visa Integrity Risk Program) and a US Visa Secure fraud program. MERP, the Merchant Elevated Risk Program, is live in Asia Pacific. Mastercard runs its chargeback and fraud programs, Scam Merchant Monitoring and BRAM (Business Risk Assessment and Mitigation).

VIRP is a legality program, not a ratio program. Visa calls it a framework to deter, detect and remediate illegal activity in its payment system. VIRP also carries a registration process in three acquirer tiers. The acquirer must attest in writing that no transaction in a VIRP category has entered VisaNet. Visa approves the registration only after that attestation. That is why Visa can stop a newly reclassified MID before its first settled transaction.

BRAM, Mastercard's Business Risk Assessment and Mitigation program, is the same shape of risk on the other network. It holds acquirers accountable for illegal or brand-damaging merchant activity. Category and content drive it, not performance. A confirmed violation can force immediate termination plus a listing in MATCH, Mastercard's file of terminated merchants.

Thresholds are as published on October 13, 2026. Two of the nine programs, VIRP and BRAM, never look at your ratio.

What does each program count, over what measurement window, and at what threshold?

Three choices define each program: the numerator, the denominator, and the month each one comes from. Visa counts fraud reports (TC40) plus disputes (TC15) over settled card-not-present transactions (TC05) in the same calendar month. Mastercard divides this month's chargebacks by last month's sales. Nothing rolls, so no quarter averages out a spike.

Each line is two tripwires rather than one. Visa's own fact sheet puts the Excessive Merchant threshold at 1.5% in Asia Pacific, Canada, the EU and the US. That threshold applies from 1 April 2026, down from 2.2%. The fact sheet also requires at least 1,500 counted fraud and dispute events in the month. CEMEA (Central Europe, Middle East and Africa) stays at 2.2%, with a floor of 150 events and USD 75,000.

Mastercard sets its lines the same way. The ECM tier, short for Excessive Chargeback Merchant, needs 100 to 299 chargebacks and a ratio of 1.5% to 2.99% in one month. HECM, the High Excessive Chargeback Merchant tier, needs 300 chargebacks and 3%. Below both sits a baseline of one chargeback and 25 cleared transactions. Neither tier can fire below that baseline.

Two much lower lines matter more for a small MID. Visa has a Non-Compliant tier at a count of 5 and a ratio of 0.5%, and Visa can assess fees there. MATCH reason code 4 needs no minimum chargeback count. Chargebacks above 1% of the month's Mastercard sales count, totaling USD 5,000 or more, qualify a terminated merchant for a listing. Six chargebacks on a small MID can clear that bar.

Three measures do not use a dispute denominator at all. VAMP's enumeration ratio divides enumerated authorizations, approved and declined, by all authorizations. It triggers at 20% with 300,000 enumerated transactions. EFM, the Excessive Fraud Merchant program, needs four conditions in one month. The MID needs 1,000 e-commerce payments and USD 50,000 of fraud chargebacks in the month. It also needs a 0.5% fraud chargeback rate and 3-D Secure (3DS) coverage at or below 10% in a non-regulated country. Scam Merchant Monitoring runs on a rolling 30 days.

Why does a portfolio average across your MIDs hide the one account that is failing?

No program computes that average. Visa identifies an account by the static component of its billing descriptor plus its acquiring bank. One business with four descriptors is four monitored accounts. Mastercard reviews each merchant account ID monthly. A blended rate under threshold protects nothing. It is also the number that pushes your acquirer toward its own 0.5% line.

Take Northbeam Studio, a subscription business running four MIDs with one acquirer. In October it settles 100,000 card-not-present transactions and takes 540 counted fraud and dispute events, a blended 0.54%. Per MID the picture breaks apart. The main brand takes 240 events on 62,000 transactions, which is 0.39%. The second brand takes 150 events on 20,000 transactions, which is 0.75%. The EU descriptor takes 48 events on 12,000 transactions, which is 0.40%. The trial funnel takes 102 events on 6,000 transactions, which is 1.70%. Those figures are illustrative, not a customer's result.

The trial funnel MID is over Visa's 1.5% merchant line, and the blended report never says so. Visa also cannot name it this month, because 102 events sit far below the 1,500 event floor. The portfolio figure moves instead. At 0.54% the portfolio is already past the acquirer's 0.5% Above Standard band. So the acquirer acts on the trial funnel while Visa stays quiet. To monitor multiple merchant accounts, weight each one by its own denominator, never by group volume.

How do you rebuild each ratio per MID, and what must you request from the acquirer?

Count events, not dollars, and count them per descriptor. The VAMP ratio per MID counts fraud reports (TC40) plus disputes (TC15) received in the month. Divide that count by the settled card-not-present transactions (TC05) in that same month. Mastercard's ratio is this month's first-presentment chargebacks over last month's sales for that merchant location.

1. Pull 90 days of fraud report (TC40) and dispute (TC15) records per MID from the acquirer, because there is no network portal a merchant can log into.
2. Date each series the way the network does: fraud reports by post date, disputes by central processing date, both assigned to the month the network received them.
3. Count the Visa denominator as settled card-not-present transactions in the same calendar month, counted by successful settle date.
4. Count the Mastercard denominator as the previous month’s sales for that same merchant location, then multiply by 10,000 to read the result in basis points.
5. Keep fraud and disputes as two series, and keep the double count, because one fraudulent transaction can appear in both feeds and be counted twice.
6. For US accounts, count payments across the calendar month but count disputes from the 5th of that month to the 5th of the next, to absorb the reporting delay.
7. Subtract only the two documented carve-outs: disputes resolved through pre-dispute products, and fraud that qualified for Compelling Evidence 3.0.

The acquirer holds the series you need, and Visa requires it to keep them. Visa's acceptance risk standards list five series per merchant. Those are gross sales volume, average transaction amount and number of transactions received. They also include average time between transaction and settlement dates, and number of disputes. Ask for those per MID and per calendar month. Fraud report data is different, because no rule obliges banks to share it. Put that request in writing and repeat it on a schedule.

• A per-MID, per-month fraud report extract (TC40 on Visa, the Fraud and Loss Database on Mastercard), broken out by fraud reason code rather than as a single total.
• A per-MID dispute file carrying the Visa condition code (10, 11, 12 or 13) and the date the network received each dispute.
• A per-MID settled transaction count split into card-not-present and card-present, since VAMP counts only card-not-present and the Mastercard program counts both.
• The previous month’s sales count per MID, which is the denominator Mastercard actually divides by.
• Your acquirer’s current VAMP standing, Above Standard or Excessive, because the merchant thresholds apply only when the portfolio is clean.
• The acquirer’s own internal ratio limit per MID, in writing, together with the action the bank takes when a MID reaches it.
• Approved and declined authorization counts per MID, which feed the enumeration ratio and the decline-rate warning signal.
• CSV files on a monthly cadence aligned to the calendar month, not a rolling 30 days, and not a PDF summary.

Which warning signs arrive before your acquirer calls, and why is its limit stricter than Visa's?

The merchant account risk warning signs that arrive earliest are not ratios. A fraud report lands before any chargeback, and it counts even when no chargeback follows. Visa's own per-descriptor data reaches you a month late. So a same-month estimate you compute yourself is the only per-account early warning. Visa built its pre-threshold warning channel for acquirers, not merchants.

• Fraud report volume per MID, week over week, because these count in the numerator whether or not a chargeback ever follows.
• Approval rate per MID, since Mastercard treats a 50 point authorization drop inside 72 hours, or a fall below a 30% approval rate, as a scam-program trigger.
• Refunds plus chargebacks per MID on a rolling 30 days, where anything above 5% is a Mastercard trigger rather than a defense.
• Your 3DS share per MID, because coverage at or below 10% in a non-regulated country is one of the four EFM conditions.
• Settled volume per MID month over month, since Mastercard divides by last month’s sales and a volume dip lifts the ratio on its own.
• Renewal cohort dispute rate, because one subscriber disputing three rebills at once creates three counted events in a single month.

The approval-rate view per MID matters here, because it moves first and you own the data. The acquirer's limit is stricter for a structural reason. Its portfolio is Above Standard at 0.5% and Excessive at 0.7%, a third of the 1.5% merchant line. Merchant thresholds apply only when Visa has not identified the acquirer itself. A portfolio sitting near 0.5% therefore draws attention to your MID long before that MID reaches 1.5%.

Visa began enforcing the 0.5% band on 1 January 2026. That is why acquirers now push remediation down to individual accounts. Some acquirers set merchant limits below Visa's and act at their own number, with fines or termination. The acquirer termination warning signs are contractual rather than published. Ask for the limit, the trigger and the notice period in writing. Our VAMP threshold breakdown has the current numbers to check yours against.

What should you do first when one MID crosses a line, and what goes in the remediation plan?

Reconcile first, then file. The notice names the program, the month and the counted events. Check those counts against your own before anything else. Descriptor formatting, multiple MIDs and double-counted charges are the usual causes of a gap. After that the clock is short: a remediation plan is due within 15 calendar days on the Visa side.

1. Read the identification notice for the four things it states: reason for identification, response timeline, consequences of noncompliance, and best practices.
2. Confirm with the acquirer whether this is a first identification in a rolling 12 months, which carries a three-month grace period with remediation but no enforcement fees.
3. Confirm which program caught the account, because an EFM identification replaces the chargeback program assessments for that same month.
4. Turn on pre-dispute deflection for that MID, since a dispute resolved before it posts drops out of the numerator rather than being won later.
5. Check the exit arithmetic: a VAMP account exits after one month below threshold, and only one of the two metrics has to drop, while the Mastercard program needs three consecutive clean months.
6. Ask for the Mastercard fine suspension only if you expect three clean months, because a suspension that fails bills the accrued stack at once.

Mastercard publishes what the plan must contain. The plan needs a business description and the events that caused the increase. It also needs the actions taken with their implementation dates, plus an inventory of every fraud tool currently enabled. Visa's version must set out root cause and a mitigation strategy that brings dispute, fraud and enumeration levels back below threshold. Visa weighs what you file when it assesses fines. Under VAMP the filing is monthly rather than a one-off document.

For a subscription book, the root cause section usually lands on the same four levers. Checkout disclosure and the renewal reminder decide how many customers recognize the charge. The cancellation path decides how many customers dispute instead of canceling. Correct recurring flagging and a stable descriptor decide how many charges customers recognize on a statement. Visa even allows added descriptor language on the first charge after a trial, such as END TRIAL, so customers recognize the regular price.

Prevention and representment do different jobs, and only one of them moves the ratio. A pre-dispute resolution removes the event from the numerator before it posts. That is the fastest lever on a flagged MID. A representment protects the revenue but leaves the event in the numerator, because monitoring programs ignore dispute outcomes and refunds. Compelling Evidence 3.0 is the exception: a successful representment on a fraud dispute can remove the associated fraud report from the count.

How do you move volume off an at-risk MID without breaking live rebills?

Move the stored-credential chain before you move the volume. Visa requires each merchant-initiated charge to carry the transaction identifier of the original cardholder-initiated one as proof of consent. Network tokens bind to the merchant ID plus the credential, not to the card alone. So a rebill arriving on a new MID with no history can read as unauthorized.

Two identifiers have to survive the move. Visa's Network MIT Service, for merchant-initiated transactions, can hold the original transaction identifier at the network. It then populates that identifier into the merchant-initiated authorization. Acquirers have been able to register for it since 22 April 2022. Mastercard's Transaction Link Identifier runs its own clock. The stored identifier must be present in each economically related merchant-initiated authorization from 23 October 2026, with non-compliance fees from 31 January 2027.

Where an identifier did not travel, the fix is mechanical. Run one charge against the credential, capture the identifier the acquirer returns, store it, and use it from then on. Then stage the rest rather than cutting over. Dual-write new cards to both vaults for two to four weeks. Then move about 10% of the book a week, with reconciliation between batches. Re-enroll the new acquirer in Visa Account Updater. Apply returned updates within five business days, or two business days for a token vault.

One piece of arithmetic decides the order you move in. Cutting volume on a Mastercard MID raises next month's ratio, because the denominator is the previous month's sales. Visa works the opposite way, since its denominator moves in the month you move the volume. Splitting volume across fresh accounts also stops working on 1 April 2027. On that date GMAP, the Global Merchant Audit Program, moves monitoring to the submerchant ID and adds tiers that start at 5 cleared transactions. Plan the second acquirer before you need it.

One more constraint applies to the new account. A fresh MID is not a clean slate. Visa's MERP, effective October 2026 in Asia Pacific, judges accounts early in their life, before they are large enough for ratio monitoring. Visa does not publish its thresholds for MERP. The published monitoring rules also bar renaming a descriptor to escape aggregation, since the merchant name must be the one cardholders recognize.

Frequently Asked Questions

Do non-fraud chargebacks count toward Visa’s VAMP ratio?

Yes. The consolidated VAMP numerator counts all cardholder dispute condition codes, 10, 11, 12 and 13, so cancellation and quality disputes count alongside fraud ones. Fraud reports (TC40) are then added on top. One fraudulent transaction can appear in both feeds and be counted twice in the same month.

What chargeback ratio gets a merchant account shut down?

No single ratio closes an account, but the published lines are clear. Visa identifies an Excessive Merchant at 1.5% with 1,500 counted events, and Mastercard at 100 chargebacks with a 1.5% rate in one month. Termination usually follows missed remediation, and acquirers act at their own stricter limit first.

Can I lose my merchant ID number?

Yes, and the consequence outlasts the account. An acquirer can terminate a flagged MID, and termination normally produces a MATCH listing, which is Mastercard’s terminated merchant file. That entry stays active for five years. Closing the account yourself does not prevent the listing, and only the bank that filed it can remove it.

Why would I need multiple MIDs?

Separate brands, channels, countries and billing descriptors each tend to need their own merchant ID, and many operators add a second acquirer for continuity. The trade-off is measurement. Visa scores each descriptor and acquiring bank separately, so four MIDs are four monitored accounts with four ratios to watch.

When do Visa’s October rule changes affect my merchant account?

Two dates govern the current numbers. Visa cut the Excessive Merchant threshold from 2.2% to 1.5% on 1 April 2026, and the advisory period closed on 30 September 2025, so enforcement is live now. MERP, the Merchant Elevated Risk Program, applies to Asia Pacific businesses from October 2026.

Who decides how strictly the card-brand rules apply to my MID?

Your acquirer does, within the network floor. Visa applies merchant thresholds only when the acquirer’s own portfolio is not Above Standard or Excessive, and acquirers may set merchant limits below Visa’s. Ask for that internal limit in writing, along with the action the bank takes when you reach it.