Visa's VAMP Explained: New Fraud and Dispute Thresholds

On this page 7 sections

1. What Happened: The Visa Acquirer Monitoring Program (VAMP) Replaced VDMP and VFMP
2. How the VAMP Ratio Is Calculated
3. VAMP Ratio Thresholds and the Enforcement Timeline
4. How Card-Testing and Enumeration Attacks Count Under VAMP
5. Analysis: Why Acquirers May Tighten Limits Before Visa Does
6. Steps to Lower Your Ratio: Alerts, RDR, and Fraud Filters
7. Next Steps

Key takeaways

• VAMP replaced Visa's separate dispute (VDMP) and fraud (VFMP) programs on April 1, 2025, with one count-based ratio for card-not-present transactions.
• Your ratio adds TC40 fraud reports to TC15 disputes, so it can be much higher than your chargeback rate alone.
• The U.S. merchant Excessive threshold dropped from 2.2% to 1.5% on April 1, 2026. Acquirer portfolios at 0.50% or higher count as Above Standard, and 0.70% or higher counts as Excessive.
• Acquirers may flag you before Visa does, so calculate your ratio monthly and use alerts, RDR, CE 3.0 and fraud filters to bring it down.

Visa changed how it watches card-not-present fraud and disputes in 2025, and the new rules are now fully in force. The Visa Acquirer Monitoring Program (VAMP) combined two older programs into one ratio. It has lower thresholds and charges per-event fees to merchants and acquirers who go over. This guide covers what Visa changed, how the ratio is calculated, which thresholds apply as of October 2026, how card-testing attacks are counted, and how to work out your own number before your acquirer raises it with you.

This article is general information about card network rules. It is current as of October 22, 2026, and based on the sources listed. Visa and your acquirer can change program terms, so confirm current details with your processor before you make decisions.

What Happened: The Visa Acquirer Monitoring Program (VAMP) Replaced VDMP and VFMP

For years Visa ran two separate programs for card-not-present risk: the Visa Dispute Monitoring Program (VDMP) and the Visa Fraud Monitoring Program (VFMP). Each had its own ratio and thresholds, so a merchant could stay under one while getting close to the other.

According to the Chargeflow VAMP timeline, VAMP replaced VDMP and VFMP on April 1, 2025, and an advisory period began that day. Practical Ecommerce reported that the advisory period ended September 30, 2025. Enforcement then came in phases:

Timeline compiled from Chargeflow, Chargeback Gurus, Ravelin and the Merchant Risk Council.

The word "acquirer" is in the program's name for a reason. Visa holds acquirers responsible for their whole portfolio, and acquirers pass that pressure down to the merchants who drive the numbers.

How the VAMP Ratio Is Calculated

Visa's own VAMP fact sheet defines the main metric as a count-based ratio. It covers card-not-present VisaNet transactions, both domestic and cross-border:

VAMP ratio = (count of TC40 fraud reports + count of TC15 disputes) ÷ count of TC05 settled transactions

Here's what those codes mean in plain English:

• TC40: a fraud report the cardholder's issuing bank files with Visa. An issuer can file one even when no chargeback follows.
• TC15: a dispute (chargeback).
• TC05: a settled sale.

Three details matter most:

1. It counts events, not dollars. A disputed $9 download weighs the same as a disputed $400 supplement order.
2. Fraud reports count even without a chargeback. Many merchants track only chargebacks, so their real VAMP ratio is higher than their dashboard suggests.
3. Some events are excluded. Visa's fact sheet says the ratio leaves out disputes resolved through pre-dispute solutions. It also leaves out TC40s that qualify for Compelling Evidence 3.0, depending on when the data is pulled.

Published guidance disagrees on one point: whether a fraud chargeback and its matching TC40 count once or twice. Sift says one transaction can appear in both datasets and count twice. Trust Payments' merchant guidance describes the formula as TC40s plus non-fraud TC15 disputes only. Ask your acquirer which method its VAMP report uses.

Calculate Your Own Ratio (Illustrative Example)

All numbers below are made up to show the math:

This hypothetical merchant is above 1.5% and above the minimum count discussed below, so it would be flagged. If it counted only the 800 chargebacks, it would get 0.67% and think it was fine.

To run your own numbers:

1. Pull one calendar month of Visa card-not-present settled transactions only. Leave out other card brands and card-present sales.
2. Ask your processor for the TC40 fraud report count for the same month. These often don't appear in a standard chargeback report.
3. Add your Visa dispute count, then subtract any disputes resolved through pre-dispute programs.
4. Divide, and track the result every month so you can see the trend.

VAMP Ratio Thresholds and the Enforcement Timeline

Visa's fact sheet sets two acquirer levels: Above Standard at 0.50% (50 basis points) or higher and Excessive at 0.70% (70 basis points) or higher. These levels apply to the acquirer's whole portfolio. Chargeback Gurus explains that they arrived in two stages. The 0.70% Excessive level was enforced from October 1, 2025. The stricter 0.50% Above Standard level started applying to acquirers on January 1, 2026.

For merchants, the Merchant Risk Council notes that the merchant threshold dropped from 2.2% to 1.5% on April 1, 2026. Chargeback.io says this change applies to merchants in Visa's Asia Pacific, Canada, Europe and U.S. regions.

Minimum count: Chargeback Gurus says merchants with fewer than 1,500 applicable fraud and dispute events in a month are excluded, and that the ratio is calculated monthly. Chargeflow notes that this standard 1.5% / 1,500-event test applies when your acquirer isn't flagged itself. When the acquirer is flagged, Chargeflow says processor documentation lists a much lower merchant trigger of a 0.5% ratio with at least 5 counted events. Ask your acquirer which test applies to you.

Fees: Visa's fact sheet doesn't publish fee amounts. Ravelin reports $8 per card-not-present dispute or fraud event for merchants at the Excessive level, and says Visa noted the fees could change. Chargeflow reports $4 per event for merchants flagged under an Above Standard acquirer. Practical Ecommerce reported different acquirer-level amounts. Your acquirer decides what it passes on to you, so check your merchant agreement and any program notices.

How Card-Testing and Enumeration Attacks Count Under VAMP

VAMP also has a second metric aimed at enumeration: bots running large batches of card numbers, often for tiny amounts, to find the ones that work.

Trust Payments' guidance defines the enumeration ratio as enumerated authorizations (approved and declined) divided by all authorizations (approved and declined). Sift says a merchant reaches the Excessive level when its enumeration ratio is at least 20% and it has more than 300,000 enumerated transactions. For help deciding which declines to stop retrying, see our guide to Visa decline code changes and fixing your retry logic.

These attacks matter even below those numbers:

• Declines count. The formula uses authorizations, so blocked attempts that reach the network can still raise your enumeration ratio.
• Approved test charges lead to fraud reports later. A card that passes a $1 test may show up in a TC40 when the real cardholder sees the charge.
• Some businesses are easier targets. Digital products with instant delivery, donation pages and low-priced subscription trials give bots a quick, cheap way to check cards.

Our guide to stopping card testing attacks at checkout covers CAPTCHA, velocity limits and gateway rules in detail.

Analysis: Why Acquirers May Tighten Limits Before Visa Does

This section is our analysis, not Visa policy.

Visa measures an acquirer's whole portfolio against the 0.50% Above Standard and 0.70% Excessive thresholds. Since January 1, 2026, crossing the lower 0.50% line has had consequences for the acquirer, not just crossing 0.70%. A few merchants running at 1.2% can push the portfolio average toward those lines, even though each one is under the 1.5% merchant threshold. Once an acquirer is flagged, its merchants can also face the much lower trigger described above. Chargeback Gurus notes that some acquirers may set merchant limits stricter than Visa's to protect their portfolio average.

In practice, your acquirer may contact you about your ratio well before Visa would flag you. You could be asked for a remediation plan, or you could face a reserve, lower processing limits or an account review. For what formal enrollment involves, see our guide to what happens if you're enrolled in an excessive chargeback program. Here's where that pressure tends to show up in common card-not-present business models:

• Subscriptions and memberships: forgotten renewals and hard-to-find cancellation lead to "cancelled recurring" and "not recognized" disputes. See how subscription sellers win cancelled recurring chargebacks.
• Nutraceuticals and supplements: trial-to-subscription offers and unclear billing descriptors can lead to both disputes and fraud reports. These merchants are often underwritten as high-risk nutraceutical accounts from the start.
• Digital products and services: instant delivery leaves little time to catch stolen cards, and "item not received" claims are hard to disprove without delivery logs.
• General e-commerce: shipping delays and slow refunds turn customer service problems into TC15s.

For more on how acquirers have traditionally viewed chargeback levels, read how close is too close for chargeback ratio thresholds.

Steps to Lower Your Ratio: Alerts, RDR, and Fraud Filters

Work on both parts of the formula: stop fraud before authorization, and resolve problems with unhappy customers before they file a dispute.

Resolve Disputes Before They Become TC15s

• Pre-dispute alerts and Rapid Dispute Resolution (RDR): Visa's fact sheet excludes disputes resolved through pre-dispute solutions. One caveat from Beast Insights: RDR and similar tools cancel the TC15, but a TC40 filed on the same transaction still counts.
• Order Insight-style data sharing: sending order details to the issuer can help a cardholder recognize a purchase. Chargeback Gurus notes this can often keep a TC40 from being filed, though that decision is up to the issuer.
• Compelling Evidence 3.0: for qualifying fraud disputes, Visa excludes TC40s that qualify for CE 3.0. Keep device, IP and order-history data ready to submit.

Cut Fraud Before It Settles

• Use 3D Secure authentication on riskier orders, and adjust your AVS and CVV decline settings.
• Set velocity limits per card, IP and device, and block repeated low-dollar attempts.
• Review orders that combine a new account, mismatched shipping and rushed delivery.

Remove the Reasons Customers Dispute

• Use a clear billing descriptor with a recognizable name and support contact.
• Send renewal reminders and offer easy online cancellation for recurring plans.
• Refund quickly when you know you'd lose the dispute anyway. Our guide to spotting and fighting friendly fraud can help you decide which cases to contest.

Next Steps

Start by calculating your VAMP ratio for each of the last three months using all three counts: TC40s, TC15s and settled Visa card-not-present transactions. If you can't get TC40 data, ask your processor for it. Also ask whether your acquirer applies limits stricter than Visa's. If your ratio is near 1%, treat that as a warning and act before your acquirer contacts you.

MannyPay supports high-risk merchant accounts and online payment processing with 3-D Secure and gateway options such as Authorize.net and NMI. To talk through your setup and processing statements, request a free quote. A MannyPay specialist responds within one business day. Approval and terms depend on underwriting.

Sources

1. Visa Acquirer Monitoring Program Fact Sheet (Visa)
2. Visa VAMP 2026: Ratio, Thresholds, Fees and Exclusions (Chargeflow)
3. Visa's VAMP Could Cost Banks and Merchants (Practical Ecommerce, Sept. 18, 2025)
4. Changes to Dispute Thresholds: Visa's New VAMP (Ravelin)
5. Stricter VAMP Ratio Thresholds Are Now in Effect (Merchant Risk Council)
6. Visa Acquirer Monitoring Program (VAMP): Full Guide (Chargeback.io)
7. Visa VAMP: Threshold Changes and How to Prepare (Sift)
8. VAMP Merchant Guidance (Trust Payments)
9. Visa Acquirer Monitoring Program (VAMP) (Chargeback Gurus)
10. VAMP Thresholds (Beast Insights)

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.