Visa established two monitoring programs to identify merchants with excessive disputes and/or fraud and to promote the use of fraud controls and fair business practices.
The Visa Dispute Monitoring Program (VDMP) and the Visa Fraud Monitoring Program (VFMP) ran monthly for 12 months.
At the beginning of each month, Visa reviews the previous month’s processing activity and identifies merchants that exceed the program’s thresholds. Your company must exceed both thresholds to be enrolled in the program.
Visa identifies a merchant based on a descriptor, and conducts a monthly review of all activity under these descriptors. This process applies specifically to merchant accounts that exceed certain thresholds.
Visa calculates the ratio of disputes to sales as follows: the number of disputes you received in a month divided by the number of sales you processed in that month multiplied by one hundred.
Visa’s Fraud Monitoring Program for 3D Secure (VFMP 3DS) is designed for US customers to monitor and manage domestic 3D-Secure transaction fraud.
The fraud ratio for VFMP-3DS is calculated by dividing the amount (in USD) of fraud reported on 3D Secure transactions in a given month by the amount of sales processed through 3DS in the same month.
Timeline, Fines, and Fees:
- Early Warning: No fines or additional fees are imposed for receiving an early warning.
- Remediation: If your account stays below the standard program thresholds for three consecutive months, it will be removed from VFMP-3DS.
- Uses US domestic 3DS (ECI 5 and 6) fraud and sales transactions processed in the previous calendar month.
- Only the first ten fraudulent transactions in a given month, between you and a single account number, are included.
- Excludes fraud type code 3 (fraud application).
VDMP
- 75 or more disputes, and 0.65% ratio of disputes to sales transactions
- 100 disputes, and 0.9% ratio of disputes to sales transactions
Timeline for 12-Month Card Monitoring Program
- Months 1-4
- Workout period
- No fines
- Months 5-9
- Visa fine of 50 USD per dispute
- Months 10-11
- Visa fine of 50 USD per dispute
- 25,000 USD review fee (non-EU merchants only)
- Might require audit
- Month 12+
- Visa fine of 50 USD per dispute
- 25,000 USD review fee
- Might require audit
- Merchant eligible for disqualification (can no longer process Visa payments)
- 1000 disputes, and 1.8% ratio of disputes to sales transactions
Timeline for 12-Month Card Monitoring Program
- Months 1-6
- Visa fine of 50 USD per dispute
- Months 7-11
- Visa fine of 50 USD per dispute
- Visa can begin to apply a 25,000 USD review fee (non-EU merchants only)
- Month 12+
- Visa fine of 50 USD per dispute
- Visa can begin to apply a 25,000 USD review fee (non-EU merchants only)
- Merchant eligible for disqualification (can no longer process Visa payments)
- 100 disputes, and 0.9% ratio of chargeback to sales transactions and
- One of the following:
- Merchant outlet moved from Visa standard threshold to High-Risk threshold based on a review of merchant performance and inappropriate business practices such as use of abusive free trial policies, negative renewal options, and more, or
- The merchant exceeds the standard program thresholds and is categorized or should be categorized by a high-brand risk MCC, High-Brand Risk MCCs (MCC 5962, 5966, 5967, 7995, 5912, 5122, 5993), or
- Met or exceeded the program’s Excessive threshold
VFMP
- US $50,000 or more in fraud dollar amount, and 0.65% or higher ratio of fraud to sales dollar amount
- US $75,000 in fraud amount, and 0.9% ratio of fraud to sales dollar amount
Timeline for 12-Month Card Monitoring Program
- Months 1-4
- No penalties
- Months 5-6
- Issuers able to raise fraudulent disputes on 3DS transactions (all markets)
- 25,000 USD
- Months 7-9
- Issuers able to raise fraudulent disputes on 3DS transactions (all markets)
- 50,000 USD
- Months 10-12
- Issuers able to raise fraudulent disputes on 3DS transactions (all markets)
- 75,000 USD
- Month 12+
- Issuers able to raise fraudulent disputes on 3DS transactions (all markets)
- Merchant eligible for disqualification (can no longer process Visa payments)
- US $250,000 in fraud amount, and 1.8% ratio of fraud to sales dollar amount
Timeline for 12-Month Card Monitoring Program
- Months 1-3
- Visa fine of 10,000 USD
- Issuers able to raise fraudulent disputes on 3DS transactions
- Months 4-6
- Visa fine of 25,000 USD
- Issuers able to raise fraudulent disputes on 3DS transactions
- Months 7-9
- Visa fine of 50,000 USD
- Issuers able to raise fraudulent disputes on 3DS transactions
- Months 10-12
- Visa fine of 75,000 USD
- Issuers able to raise fraudulent disputes on 3DS transactions
- Month 12+
- Visa fine of 75,000 USD+
- Issuers able to raise fraudulent disputes on 3DS transactions
- Merchant eligible for disqualification (can no longer process Visa payments)
- US $75,000 in fraud dollar amount, and 0.9% ratio of fraud to sales dollar amount, and
- One of the following:
- Merchant outlet moved from Visa standard threshold to High Risk threshold based on a review of merchant performance and inappropriate business practices such as use of abusive free trial policies, negative renewal options, and more, or
- The merchant exceeds the standard program thresholds and is categorized or should be categorized by a high-brand risk MCC, High-Brand Risk MCCs (MCC 5962, 5966, 5967, 7995, 5912, 5122, 5993), or
- Met or exceeded the program Excessive threshold
VFMP 3DS
- US $50,000 or more in fraud dollar amount, and 0.65% or higher ratio of fraud to sales dollar amount
- US $75,000 in fraud amount, and 0.9% ratio of fraud to sales dollar amount
VFMP-3DS Standard Program Timeline:
- Months 1-12
- No fines + Merchant loses liability shift protections until they exit the program.
VAMP
On April 1, 2025, Visa retired VDMP and VFMP and changed its fraud and dispute management approach. Visa consolidated those monitoring programs into the enhanced Visa Acquirer Monitoring Program (VAMP). VAMP aims to create more seamless controls and processes for acquirers and merchants to prevent fraud, avoid enumeration attacks, and effectively manage disputes, contributing to a more secure environment. The revised program introduces transaction-based metrics called the VAMP Ratio and VAMP Enumeration Ratio.
VAMP Ratio
This metric combines fraud and non-fraud chargebacks into one measure, offering a clearer view of overall risk.
Where:
- TC40: number of card-not-present fraud transactions
- Non-Fraud Disputes: number of disputes with reason codes under 11, 12, and 13 categories
- Total Sales Count: number of settled transactions
- Non-fraud disputes resolved through Rapid Dispute Resolution (
Guide
Quickly resolve disputes with instant refunds to customers RDR ) - Confirmed Compelling Evidence 3.0 (
Guide
Improve customer experience and prevent fraud chargebacks CE 3.0 )
Please note that TC40 associated with RDR are NOT excluded from threshold calculations.
The Visa monitoring metrics thresholds, categorized as Above Standard and Excessive, will be implemented in two phases, on 1 April 2025 and 1 January 2026.
Merchant VAMP Ratio
- Effective April 1, 2025: Greater than 1.5%
- Effective January 1, 2026: Greater than 0.9%
Acquirer VAMP Ratio
- Effective April 1, 2025: Greater than 0.5%
Acquirer VAMP Ratio
- Effective April 1, 2025: N/A
- Effective January 1, 2026: Greater than 0.3% but less than 0.5%
Additional criteria for merchant and acquirer thresholds: minimum of 1,000 monthly combined TC40 and Non-Fraud Disputes.
VAMP Enumeration Ratio
This metric measures the frequency of enumeration attacks, where fraudsters systematically test card details to uncover valid account information.
Where:
- Enumerated Transactions: number of enumerated authorization attempts, both approved and declined
- Total Sales Count: number of settled transactions
The Visa monitoring metrics threshold for the VAMP Enumeration Ratio is categorized only as Excessive.
Merchant Enumeration Ratio
- Effective April 1, 2025: Greater than 20%
Additional criteria for merchant and acquirer thresholds: minimum of 300,000 enumerated transactions, identified and confirmed through the Visa Account Attack Intelligence (
Glossary
Visa Account Attack Intelligence Score helps identify the likelihood of enumeration attacks in card-not-present transactions. It is able to detect patterns in data that are otherwise undetectable by humans, identifying instances of brute force payment account enumeration.
VAAI
) Score system.
Non-compliance may lead to corrective actions, including penalties, fees, and potential closure of merchant accounts.
VAMP penalties
Starting in the fourth month, fines will be applied to each transaction counted under the VAMP metric, including both fraud and non-fraud. Enforcement fees apply per dispute both fraud and non-fraud for acquirer portfolios that exceed the above standard threshold. Merchants that exceed such thresholds will face enforcement fees individually.
- Merchant Fees:
- Excessive (VAMP Ratio > 1.5%): $10 fee
- Excessive (VAMP Ratio > 0.9%): $10 fee, effective January 2026
- Acquirer Fees:
- Excessive (VAMP Ratio > 0.5%): $10 fee
- Above Standard (VAMP Ratio > 0.3%): $5, fee effective 2026
VAMP grace period
The grace period covers a 3-month grace timeframe for first-time identifications in a 12-month rolling period. That means remediation will be requested, but no penalties will be imposed during the first three months of exceeding the thresholds.
Participants will exit the program if they remain below the thresholds for one month.