Visa VAMP explained: what high-risk merchants need to know

Visa VAMP, the Visa Acquirer Monitoring Program, is how Visa tracks fraud and disputes on online card payments. Since 2025 it has replaced Visa's separate dispute and fraud monitoring programs with one monthly ratio: fraud reports plus disputes, divided by settled card-not-present Visa sales. As of November 2026, a US merchant reaches the Excessive level at a ratio of 1.5% or more with at least 1,500 fraud reports and disputes in the month.

For a smaller high-risk merchant, that headline is rarely the line that matters first. Because of the 1,500-item floor, a business with 40,000 Visa online sales a month would need a 3.75% ratio to be identified. Long before that, it can be caught through its acquirer's standing in the program or the dispute limits in its own processing agreement.

What Visa VAMP is and what it replaced

Visa's VAMP fact sheet describes folding the earlier VAMP, the Visa Fraud Monitoring Program (VFMP) and the Visa Dispute Monitoring Program (VDMP) into a single global program. Each month Visa measures fraud, dispute and enumeration (card testing) levels and requires acquirers or merchants above its thresholds to put risk controls in place.

The "acquirer" in the name matters. Visa's rules bind acquirers, the banks that sign up merchants, and acquirers pass the requirements on. In an October 2025 interview, Visa told merchants to go to their acquirers first. Its August 2024 announcement blamed card testing at scale for $1.1 billion a year in fraud losses.

VAMP timeline

Dispute volume has grown: in a 2026 announcement, Visa said it processed 106 million disputes worldwide in 2025, 35% more than in 2019.

If you still hear that Visa's line is 0.9%, that was the old VDMP threshold (0.9% with at least 100 disputes), and VDMP has been folded into VAMP.

How the VAMP ratio is calculated

The fact sheet gives one count-based formula, covering card-not-present VisaNet transactions, domestic and cross-border:

VAMP ratio = (TC40 fraud reports + TC15 disputes) divided by TC05 settled transactions

A TC40 is the card issuer's report to Visa that a transaction was fraudulent. A TC15 is a dispute of any kind, so "item not received" and cancelled-subscription disputes count alongside fraud disputes. A TC05 is a settled sale.

• It counts items, not dollars. A disputed $5 sale weighs the same as a disputed $5,000 one.
• The month is the month Visa received the report. Processors report that it counts against that month's settled sales, and that merchants see the figures about a month later. A slow month after a busy one can push the ratio up.

What counts twice

A stolen-card order often draws both a fraud report and a fraud dispute. Visa's formula adds the two counts, and processors confirm that such a transaction counts twice.

What a refund or a win doesn't undo

Processors report that the monitoring programs ignore refunds and dispute outcomes, so a representment win gets your money back but doesn't lower the ratio (our chargebacks guide explains the difference).

Section 1.9.4.3 of the Visa Rules requires issuers to report fraud whether the transaction was approved, declined or not settled: for approved fraud, within 60 calendar days of the transaction date, or within 30 days of receiving the cardholder's dispute notice if that notice arrives after the 60 days. So a fraud report can land on a sale that never became a chargeback, including one you already refunded.

The only two exclusions

The fact sheet excludes exactly two things: disputes resolved through pre-dispute solutions, and TC40 fraud that qualified for Compelling Evidence 3.0. Both are contingent on the timing of Visa's data extract, so late resolutions may not help. 3-D Secure authentication is not on the list.

A worked example

Take a hypothetical online supplement store that settles 40,000 Visa card-not-present sales in March. During March, Visa receives 260 fraud reports and 300 disputes on its sales, and 180 of the disputes are on orders that also drew a fraud report.

• VAMP count: 260 + 300 = 560 (the 180 overlapping orders count twice)
• VAMP ratio: 560 / 40,000 = 1.4%
• Chargeback-only ratio: 300 / 40,000 = 0.75%

If the store tracks only chargebacks, it thinks it is at 0.75%. Visa sees 1.4%, and refunding the reported orders now would change neither number.

VAMP thresholds as of November 2026

Every threshold pairs a ratio with a minimum monthly count, and both must be met. All figures are from Visa's fact sheet.

Merchant Excessive

These apply to merchants whose acquirer is not itself Above Standard or Excessive.

Acquirer portfolio

The April 2026 cut applied only to the merchant line. Some guides say the acquirer bands fell too; the fact sheet shows them unchanged.

Enumeration (card testing)

Acquirers must also take proactive steps to keep merchants below an enumeration ratio of 20% (enumerated authorizations over all authorizations, approved and declined) together with an enumeration count of 300,000. Processors report that Visa doesn't fine for it, but your acquirer must still act.

How VAMP reaches a merchant, and why 1.5% is rarely the first line

Route 1: Merchant Excessive on your own numbers

At exactly 1.5%, 1,500 items means 100,000 settled Visa card-not-present sales in a month. Below that volume you pass 1.5% long before you reach 1,500 items, so the count decides. Above it, the ratio decides. Using Visa's US figures and hypothetical volumes:

So the supplement store, at 1.4% and 560 items, is nowhere near Merchant Excessive. That does not make it safe.

Route 2: your acquirer is flagged

The fact sheet doesn't say what happens to merchants when their acquirer is Above Standard or Excessive. Processors report that merchants in a flagged portfolio with at least 5 counted items and a 0.5% ratio can be identified and charged at the level matching the acquirer's. On that reading, if its acquirer were flagged, the supplement store would be squarely in scope. You can't see your acquirer's portfolio ratio, so ask your processor where it stands this month.

Route 3: your processing agreement

Your merchant agreement can set its own dispute and fraud limits, which can be stricter than Visa's and can be enforced sooner. For merchants in Visa's high-integrity-risk categories, section 10.4.5.2 of the Visa Rules requires the acquirer to track daily sales volume, average ticket, transactions and disputes against your normal daily activity. A dispute spike is visible within days, well before Visa's monthly report. Our high-risk processing guide covers how those triggers turn into holds and freezes.

What happens when you're identified

Visa's fact sheet publishes no fee amounts and no exit criteria.

Fees

Processors report two per-item fees, charged on every counted item, not only on chargebacks:

• $8 per counted item for a Merchant Excessive identification, effective October 1, 2025
• $4 per counted item for merchants under an acquirer that is Above Standard

Acquirer-level fees may be passed through to merchants. Hypothetically, a merchant with 105,000 settled sales and 1,600 counted items (a 1.52% ratio) would face 1,600 × $8 = $12,800. Industry sources describe a three-month grace period for a first identification within a rolling 12 months, but Visa hasn't published it, so confirm with your acquirer.

What the Visa Rules allow

Mastercard keeps its own terminated-merchant list, covered in our guide to the MATCH list.

Getting out

Under section 10.4.3.1, identification and exit work as specified in the VAMP Guide, which Visa does not publish. Ask your acquirer, in writing, which threshold you crossed, how long you must stay under it, and what fees apply meanwhile.

What actually lowers a VAMP ratio

Apart from the two exclusions, counted items don't come off, so almost everything that works happens before the fraud report or dispute is filed.

1. Stop card testing at the door

Limit attempts per card, device and IP address, put a bot check on checkout, and alert on bursts of small or declined authorizations. That protects the enumeration measure and stops your checkout verifying stolen cards.

2. Screen fraud before it settles

Score every order before you fulfil it, and decline or review the risky ones. A blocked stolen-card order never becomes a settled sale with a fraud dispute attached. Issuers must still report fraud on declined transactions, so screening protects your goods and your dispute count first.

3. Make the charge recognizable

A customer who doesn't recognize a charge can dispute it as fraud, and that order can then count twice, as a fraud report and a dispute. Show your brand name plus a phone number or web address in the statement descriptor, use the same name on receipts with a support contact, and answer quickly. Order Insight (step 5) can also show the issuer the purchase details before a dispute is filed.

4. Make cancelling easier than a chargeback

Cancelled-recurring disputes (condition 13.2) count like any other, and Compelling Evidence 3.0 doesn't help with them, because it covers only fraud disputes (condition 10.4). Easy online cancellation, clear renewal terms, and the option to pause or update a card give customers a better path than their bank.

5. Resolve complaints before they become disputes

Pre-dispute resolution is one of the two exclusions. Visa's tools include Rapid Dispute Resolution (RDR) and Order Insight, which gives issuers detailed transaction information. Sources disagree on whether a refunded alert also keeps the fraud report out; Visa names only Compelling Evidence 3.0 as removing a TC40.

6. Collect Compelling Evidence 3.0 data now

Compelling Evidence 3.0 (CE 3.0) defends against a real cardholder disputing a purchase as fraud (condition 10.4), and qualifying fraud reports leave the VAMP count. Under section 11.8.5.6 of the Visa Rules, for disputes processed on or after October 24, 2026, you need:

• 2 earlier transactions on the same card or a related payment credential, at one or more merchants, not reported as fraud
• Both processed 120-365 calendar days before the dispute
• A matching device ID, fingerprint or IP address, plus one more element such as login ID or full delivery address
• A detailed description of what was bought

The catch: the acquirer can submit only transaction data it accepted and processed itself. Before October 24 the earlier transactions had to be on the same credential. You can't add the data later, so log device, IP and login details on every order now. CE 3.0 data can also be shared through Order Insight, before a dispute is filed.

7. Cut off access after a fraud dispute

Under section 10.4.4.3, your acquirer must make sure you try to revoke the goods or services after a fraud dispute and stop it happening again with that cardholder. After an account takeover, the cardholder must be re-authenticated before any further authorization. For digital goods, memberships and gaming accounts, that typically means suspending the account or license.

8. Use 3-D Secure for the right reason

3DS can move the loss on an eligible fraud chargeback to the issuer, but it is not a listed VAMP exclusion and 10.5 disputes have no 3DS carve-out. Use it to protect margin on fraud-prone flows, not to lower the ratio. Our 3-D Secure guide covers when it is worth the friction.

What not to do

• Don't split volume to dilute the ratio. New descriptors or merchant IDs opened to spread disputes thin are, in our reading, the kind of change section 12.5.3.2 lets Visa penalize with a USD 25,000 per merchant per month assessment on the acquirer.
• Don't push good customers off Visa. Moving clean buyers to other payment methods shrinks the denominator and can raise the ratio.

VAMP vs Mastercard's Excessive Chargeback Program

Mastercard runs its own program, with figures as reported by processors.

Because the denominators come from different months, you can be fine on one and in trouble on the other after a swing in volume. This guide is general information, not legal advice. Visa revises these rules, so confirm what applies to your account with your acquirer, and have your attorney review the dispute and fraud limits in your processing agreement.

How Flux fits

No processor can opt you out of the card networks' monitoring programs, Flux included. They apply to the merchant through the acquirer, and Flux has its own acquirer and card-network obligations, which sometimes mean asking for documents or holding funds.

What we can do is tell you where your ratio is heading before the network does, and have a person who already knows your account decide what happens next, early enough to act. You can reach that person on the phone. Every Flux business gets its own merchant account, and an underwriter reviews every application.

Some of the tools above are built in. Flux fraud detection scores each transaction as it comes in and flags or blocks the risky ones before they settle, using rules you control. 3-D Secure runs on hosted checkout, payment links and invoices, on every card payment or only riskier ones. Subscriptions get automatic retries on failed renewals, a secure card-update link, and can be paused. None of it removes a counted item or promises a particular ratio.

Flux works with high-risk businesses deliberately, though not every business qualifies. Apply through the button below or email sales@fluxpayments.com.