Dispute and fraud card monitoring programs

As part of your financial obligations to the card networks, you must ensure that disputes (also called chargebacks) and fraud are kept at acceptable levels. If these exceed the thresholds dictated by each network (for example, Visa or Mastercard), they place you into one of their monitoring programs. As part of a program, you can incur monthly fines and additional fees until you reduce your dispute or fraud levels in a sustained way.

Stripe can work with you on a remediation plan to reduce the levels of disputes or fraud related to your account. We also communicate directly with the networks and relay information on a monthly basis. Download our remediation template to get started.

While monitoring programs are comparatively rare, you should take them seriously. If you’re identified into one, you must take immediate action to address the situation. Failure to comply with the requirements of a program within the specified time period (what the networks call a timeline) can result in the network refusing to process further payments to you using their cards. Your entire ability to accept credit card payments could be at risk.

Visa monitoring programs

The Visa Fraud Monitoring Program (VFMP) and Visa Dispute Monitoring Program (VDMP) apply to businesses in all of our supported countries. The VFMP 3DS and VFMP Digital Goods programs are additional fraud programs enforced by Visa. Like VFMP and VDMP, VFMP Digital Goods is a global program while VFMP 3DS only applies to businesses based in the US.

Each program timeline spans a 12-month period and determines what actions to take on a monthly basis. At the beginning of each month, Visa reviews your previous month’s activity to see if it has exceeded any of their established thresholds. If so, we’ll reach out and discuss this with you.

For users in the US, Europe, Canada, Australia, and Brazil, domestic and cross-border activity counts towards their monthly totals. For users outside of those regions, only cross-border activity is counted.

Early warning notifications

Visa operates an early warning system that warns users—through Stripe—who are at risk of being placed into a monitoring program. Users who meet the early warning threshold aren’t immediately placed into the program. Instead, they’re given the opportunity to reduce the level of fraud on their account to avoid placement.

Remediation

Visa removes you from its programs when your level of disputes or fraud drops below the Standard threshold for 3 consecutive months. They consider these 3 months to be the “tracking” period. If you breach the Standard or Excessive threshold without completing the tracking period, your original timeline resumes (a new timeline doesn’t start).

Monitoring your dispute (chargeback) and fraud levels accurately is important. For example, Visa counts disputes regardless of whether the dispute was hidden due to a refund, regardless of liability shift, and regardless of whether you won the dispute. Disputes and fraud are counted by the date the dispute or early fraud warning notification arrives, not when the payment was made.

As part of the remediation process, you might be required to provide Stripe with details on the steps you’re taking and your timeline for implementation.

VDMP: Visa Dispute Monitoring Program

VDMP applies to users with an unusually high level of disputed payments on their account. Users are placed into this program if they meet or exceed the thresholds for both of the following criteria:

• The total number of payments that have been disputed (dispute count)
• The ratio of disputed payments to all payments (dispute rate)

VFMP: Visa Fraud Monitoring Program

VFMP applies to users with an excessive level of fraud on their account, which Visa calculates using early fraud warning data sourced from their “TC40” reporting. Users are placed into this program if they meet or exceed the thresholds for both of the following criteria:

• The total volume in US dollars of Visa payments that are fraudulent (Fraud Volume)
• The ratio of the volume in fraudulent Visa payments to all payments (Fraud Rate)

VFMP: Visa Fraud Monitoring Program-3DS (US-only)

VFMP-3DS applies to US users with an excessive level of domestic 3D-Secure fraud on their account. Users are placed into this program if they meet or exceed the thresholds for both of the following criteria:

• The total volume in US dollars of Visa 3DS domestic payments that are fraudulent (fraud volume)
• The ratio of the volume in fraudulent payments to 3DS domestic payments (fraud rate)

VFMP: Visa Fraud Monitoring Program (Digital Merchants)

The VFMP Digital Goods applies to small ticket and digital goods merchants with excessive levels of fraud on their account. The VFMP Digital Goods program focuses on small ticket and digital goods merchant fraud transactions with the following MCCs:

• 5735 — Record Stores
• 5815 — Digital Goods Media — Books, Movies, Digital artwork/images, Music
• 5816 — Digital Goods — Games
• 5817 — Digital Goods — Applications (Excludes Games)
• 5818 — Digital Goods — Large Digital Goods Merchant

Users are placed into this program if they meet or exceed the thresholds for all of the following criteria:

• The total volume in US dollars of Visa payments are fraudulent (Fraud volume)
• The total count of fraudulent transactions exceeds 300 (Fraud count)
• The ratio of volume in fraudulent payments to all payments (Fraud rate)

Mastercard monitoring programs

Mastercard’s Excessive Chargeback Program (ECP) consists of two levels: Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM), and it applies to users in all supported countries. The Excessive Fraud Merchant (EFM) Compliance Program is a separate program that applies to users in all supported countries besides Germany, India, and Switzerland.

If your account exceeds program thresholds, Mastercard places you into this program and Stripe notifies you. If you exceed both EFM and ECP thresholds, you’re placed in EFM but not ECP. For example, you exceed EFM and ECP thresholds in March and April but only exceed ECP thresholds in May. In April, you’d be placed in month 2 of EFM and fined accordingly. In May, you’d be placed in month 3 of ECP despite the EFM identifications taking precedent in prior months.

Remediation

You exit ECM as soon as your level of disputes drops below the ECM threshold for 3 consecutive months. If you’re in HECM and your dispute level drops but still exceeds ECM thresholds (between 1.5-2.99%), you move to that program. To be removed from EFM, you need to avoid at least one of the conditions for 3 consecutive months.

Monitoring your dispute (chargeback) and fraud levels accurately is important. For example, Mastercard counts disputes regardless of whether the dispute was hidden due to a refund, regardless of liability shift, and regardless of whether you won the dispute. Disputes and fraud are counted by the date the dispute or early fraud warning notification arrives, not when the payment was made.

As part of the remediation process, you must provide Stripe with details on the steps you’re taking to prevent disputes and your timeline for implementation.

ECP: Mastercard Excessive Chargeback Program

Users are placed into ECP if they meet or exceed the thresholds for both of the following criteria:

• The total number of Mastercard payments that have been disputed (chargeback count)
• The chargeback-to-transaction ratio (chargeback rate)

The chargeback rate is a ratio of disputed payments to all payments. It’s calculated as the number of Mastercard disputes received in a calendar month compared to the total number of Mastercard payments from the preceding month. You must exceed both thresholds to qualify for ECM.

ECM: Mastercard Excessive Chargeback Merchant

Issuer recovery assessment applies an additional 5 USD per chargeback fee for each chargeback over 300 chargebacks. For example, a merchant identified in month 4 of ECM with 400 disputes will be assessed a 5,500 USD fine (5,000 USD + (400-300) x 5 USD).

HECM: Mastercard High Excessive Chargeback Merchant

Mastercard communicates total fine amounts to merchants through Stripe.

EFM: Mastercard Excessive Fraud Merchant Compliance Program

Users are placed into EFM if they meet or exceed the thresholds for all of the following criteria:

• Number of e-commerce Mastercard payments
• The total volume in US dollars of Mastercard payments that result in fraudulent chargebacks (net fraud volume) calculated by dispute reason code (reason code 4837 and 4863)
• The fraud-count-to-transaction ratio (fraud chargeback rate)
• The ratio of 3DS Mastercard payments to all Mastercard payments

The fraud chargeback rate uses a similar calculation to the chargeback rate found in ECM or HECM. The only difference is that the fraud chargeback rate is calculated using only fraudulent chargebacks.

EFM applies to users who meet all of the following conditions:

• Minimum of 1,000 e-commerce Mastercard payments
• Net fraud volume is greater than 50,000 USD
• Fraud chargeback rate is greater than 0.50%
• Total 3DS Mastercard payment count is less than:
  • 10% of total Mastercard payment count (non regulated countries)
  • 50% of total Mastercard payment count (regulated countries)

You can request that Mastercard suspend an assessed fine once during an open case, meaning that the request should happen when you’re confident you’ll be below thresholds in the next 3 consecutive months. If you request a suspension of fines, avoid identification in the next 2 months, but then exceed the thresholds in the following month, fine assessments would continue until you exit the program.

AusPayNet monitoring programs

The AusPayNet (APN) Card-Not-Present (CNP) fraud mitigation program is designed to reduce CNP payments fraud within the Australian payment industry (AU-based users and cardholders only). Where user fraud rates exceed certain defined thresholds for two consecutive quarters, the APN reserves the option to mandate Strong Customer Authentication (SCA) for all transactions. Stripe notifies you if your account exceeds program thresholds for the preceding quarter.

FMP: APN Fraud Monitoring Program

Users who meet or exceed both the following criteria thresholds are placed into FMP:

• Fraud chargeback amount: Total value (in AUD) of fraudulent chargebacks received in the quarter is greater than 50,000 AUD.
• Fraud-to-sales ratio: The ratio of fraud chargeback amount to sales value in the quarter is greater than or equal to 0.20%

When your CNP transactions fall below the threshold criteria for FMP for one quarter, APN releases you from the FMP and SCA obligations.

SCA: Strong Customer Authentication

SCA is an authentication method in which you verify cardholder’s identity using at least two of the following factors:

• Knowledge factor: something only the cardholder knows, for example a password
• Possession factor: something only the cardholder possess, for example a mobile phone
• Inherence factor: something the cardholder is, for example fingerprint or facial recognition

SCA exemptions

APN exempts the following types of transactions from the SCA requirement:

• Recurring transactions: Series of repeated transactions with SCA applied on the first charge of the recurring series
• Trusted customer transactions: Transactions where you have previously identified/authenticated the cardholder and the cardholder uses the same card on file with matching identifiers
• Wallet transactions: Digital or mobile wallet transactions where the cardholder identity has been verified and each subsequent transaction is authorized by the cardholder using biometrics or a passcode