Mastercard's Scam Merchant Monitoring Program (SMMP) is live — 72 hours, not 30 days.
The Scam Merchant Monitoring Program counts refunds and chargebacks together, moves at acquirer speed, and ends in termination — not fines. Built for card-not-present subscription businesses.
Key facts
- Threshold: 5% — Combined refunds + chargebacks over any rolling 30 days (min. 500 transactions) — the trigger for merchants under six months old.
- Effective: JUL 24, 2026 — Enforcement is live today. Acquirers are already reviewing the Fraud and Loss Database daily.
- Window: 72 HRS — Once a merchant is flagged, the acquirer must investigate within 72 hours. There is no monthly review cycle.
- Outcome: TERMINATION — Confirmed scam = Mastercard and Maestro authorization and clearing blocked immediately, plus MATCH listing. No fines, no grace period.
- Scope: ALL CNP — Every card-not-present merchant worldwide, including payment facilitators and sub-merchants. The only exclusion is Jordan.
What changed
The Scam Merchant Monitoring Program (SMMP) is a Mastercard rule that requires acquirers to detect, investigate, and shut down merchants suspected of running scams — fast.
- Refunds count too: The headline threshold combines refunds AND chargebacks — most programs only count chargebacks.
- Acquirer-driven: Your acquirer flags, investigates, and acts. You may never get a Mastercard letter first.
- 72-hour clock: Investigation happens in 72 hours, not on a monthly report cycle.
- Termination, not fines: A confirmed case ends in immediate shutdown and MATCH listing — there is no fee to pay your way out.
How it compares
| What it measures | ECP: chargeback ratio · EFM: fraud ratio | Refunds + chargebacks + behavioral signals |
|---|---|---|
| Primary threshold | ECP ≥1.5% / 100+ CBs · EFM ≥0.5% / $50K+ fraud | 5% combined refunds + CBs (new merchants) |
| Who acts | Mastercard bills the acquirer; acquirer bills you | Acquirer detects and investigates directly |
| Timeline | Monthly measurement, staged enrollment | 72-hour investigation once flagged |
| Consequence | Fines + remediation period | Immediate termination + MATCH |
| Does representment help the ratio? | Yes — a won chargeback reverses it | No — the refund/chargeback already counted |
| Can you pass this and still trip it? | ECP and EFM are ratio-only | Yes — SMMP is signal-based, runs concurrently |
The details
Authorization-rate collapse — Did approvals suddenly crater?
A sharp, sudden drop in your approval rate reads as a compromised or fraudulent operation. This trigger applies to merchants of any age, so an established business is not exempt.
- Approval rate drops 50+ percentage points within 72 hours, OR
- Approval rate falls below 30%
- Measured on a minimum of 25 purchase transactions
- BIN attacks and acquirer/system outages are excluded
GRIP letter — Has Mastercard already named you?
A Global Rules Investigation Program (GRIP) notification means Mastercard has independently linked the merchant to suspected scam activity. Once the acquirer receives it, the investigation clock starts. Applies to all merchants.
- Acquirer receives a GRIP letter tied to the merchant
- The letter references suspected scam or manipulation
- Investigation must begin within 72 hours
Monitoring-provider alert — Did a network monitor flag you?
An approved Merchant Monitoring Service Provider (MMSP) can raise one or more alerts identifying potential scam or illegal activity. That alert alone is enough to open an investigation. Applies to all merchants.
- An approved MMSP flags the merchant
- Alert cites potential scam or illegal activity
- One alert is sufficient to trigger review
New-merchant scam signals — Are you under six months old?
Merchants with six months or less of Mastercard acceptance history face an extra set of early-warning triggers — this is where the widely-quoted 5% number actually lives. Any ONE of the conditions below is enough. Established merchants are NOT subject to these.
- Two different issuers report fraud reason code 56 (manipulation of cardholder), OR
- Two or more issuers file chargebacks documenting scams or manipulation, OR
- Combined refunds + chargebacks exceed 5% of purchase transactions in any rolling 30-day period
- The 5% test requires a minimum of 500 transactions
Scenarios
The new MID that crossed 5% on refunds
A subscription brand spun up a fresh MID for a new offer. Cancellations ran hot, and the team issued refunds fast to keep chargebacks down. Chargebacks stayed under 1% — but refunds plus chargebacks combined hit 5.4% inside three weeks. The MID was under six months old.
Moved to a single combined refund + chargeback ratio per MID, refreshed hourly, with a hard alert at 3.5% for any MID under six months.
The offer was reworked and refund velocity throttled before the MID crossed the line a second time. The refunds-suppress-chargebacks reflex was the exact trap SMMP is built to catch.
The auth-rate cliff nobody watched
An established merchant’s approval rate fell from 88% to 34% over a weekend after a processor rule change. No one saw it until Monday. That 54-point drop is a standalone SMMP trigger — age gives no protection.
Set per-MID auth-rate alerts that fire on any 50-point drop or a fall below 30%, excluding known BIN-attack windows.
The next processor hiccup was caught in under an hour and corrected before it looked like a fraudulent operation to the acquirer.
The representment that didn’t save the ratio
A merchant won back a run of chargebacks at representment and assumed their SMMP exposure fell with them. It did not — under SMMP, the chargeback counted when it was filed, and the refund would have counted too. Winning later does not un-count it.
Refocused spend from post-dispute fighting to pre-dispute prevention: alert deflection, refund-policy tuning, and combined-ratio monitoring.
Prevention is the only lever that moves the SMMP number. The team stopped optimizing for a metric SMMP does not read.
Frequently asked questions
What is the Mastercard Scam Merchant Monitoring Program?
SMMP is a Mastercard rule, effective July 24, 2026, that requires acquirers to detect, investigate within 72 hours, and shut down merchants suspected of running scams. It applies to all card-not-present merchants worldwide except Jordan, and it works from behavioral signals — including a combined refund-plus-chargeback rate — rather than a single chargeback ratio.
When does the Scam Merchant Monitoring Program take effect?
The revised standards take effect July 24, 2026. Acquirers review the Mastercard Fraud and Loss Database daily and must investigate any flagged merchant within 72 hours, so there is no monthly grace cycle to hide in.
Who does SMMP apply to?
Every card-not-present merchant globally, including payment facilitators and their sub-merchants. The only stated exclusion is Jordan. Acquirers hold primary responsibility for monitoring and enforcement.
How is SMMP different from the Excessive Chargeback Program (ECP) or EFM?
ECP measures your chargeback ratio and EFM measures your fraud ratio; both use fines and remediation periods. SMMP is signal-based — it combines refunds and chargebacks, adds behavioral triggers like auth-rate collapse, and ends in immediate termination rather than fines. You can pass ECP and EFM and still trip SMMP, because they run concurrently and measure different things.
Does the 5% refund-and-chargeback threshold apply to all merchants?
No — and this is the most common misreading of the rule. The 5% combined refund-plus-chargeback threshold (over any rolling 30-day period, minimum 500 transactions) is a trigger for merchants with six months or less of Mastercard acceptance history. Established merchants are monitored through the other triggers: auth-rate collapse, GRIP letters, and monitoring-provider alerts.
What are the SMMP triggers?
There are four. (1) Authorization rate drops 50+ percentage points within 72 hours or falls below 30%, on 25+ transactions. (2) A Mastercard GRIP letter links you to suspected scam activity. (3) An approved Merchant Monitoring Service Provider raises an alert. (4) For merchants under six months old only: two issuers reporting reason code 56, two issuers filing scam-documented chargebacks, or a combined refund-plus-chargeback rate above 5%.
How is the 5% rate calculated?
It is your refunds plus your chargebacks, added together, as a percentage of purchase transactions, measured over any rolling 30-day period. It only counts once you have processed at least 500 transactions, and it is a trigger specifically for merchants under six months old.
What is Mastercard reason code 56?
Reason code 56 is "Manipulation of Cardholder" — a fraud report indicating the cardholder was deceived or coerced into the transaction. Under SMMP, two different issuers filing code 56 against a newer merchant is enough to open an investigation.
Does winning a chargeback at representment lower my SMMP risk?
No. Under SMMP the refund or chargeback is counted at the point it happens. Winning it back later at representment does not un-count it. That makes prevention — not dispute-fighting — the only lever that moves your SMMP exposure.
What happens if a merchant is confirmed as a scam under SMMP?
Mastercard and Maestro authorization and clearing are blocked immediately, the merchant is terminated, and they are placed on the MATCH list. There are no fines and no grace period — it is a shutdown, not a penalty you can pay down.
What is the MATCH list and why does it matter here?
MATCH (Member Alert to Control High-risk Merchants) is Mastercard’s shared blacklist of terminated merchants. A MATCH listing makes it very hard to get a new merchant account with any acquirer, often for years, which is why an SMMP termination is close to an existential event for a business.
Can refunds alone get me terminated?
Refunds alone do not confirm a scam, but they count toward the 5% combined trigger for newer merchants and can open an investigation. Using refunds to suppress chargebacks — a common tactic under chargeback-only programs — backfires under SMMP because both are counted together.
How do I prepare for SMMP?
Start with three things: (1) see your combined refund-plus-chargeback rate per MID on a rolling 30-day basis; (2) flag every MID under six months old and watch it against the 5% line; (3) alert on any auth-rate drop of 50 points or a fall below 30%. If you can’t do all three today, that is your gap.
Does SMMP mean I should stop issuing refunds?
No — it means you should stop using refunds as a hidden chargeback-avoidance tactic and start counting them. Legitimate refunds are fine; what SMMP penalizes is a refund-plus-chargeback pattern that looks like a merchant papering over a scam.
How does Beast Insights help with SMMP?
Beast Insights gives subscription businesses a combined refund-plus-chargeback ratio per MID, refreshed hourly, with new-MID age flags, auth-rate alerts, and reason-code tracking — the exact signals SMMP watches. You see the drift before the acquirer opens a 72-hour investigation. Beast is not a payment processor; it reads your data and sits on top of your existing stack.
Do I need to switch processors to use Beast Insights for SMMP monitoring?
No. Beast Insights is a layer on top of your existing CRM and processor stack — it reads the data, it does not move your money. Most subscription merchants running 10 or more MIDs are onboarded inside two weeks.