Get answers to questions about the Visa and Mastercard monitoring programmes.
Any chargeback where funds are moved count towards your programme totals within a given month, regardless of the reason for the chargeback. Situations that don't count as chargebacks:
The Visa Fraud Monitoring Programme (VFMP) uses issuer-reported fraud (TC40) data, which we call Early fraud warnings (EFW). EFW are completely independent from the customer's card issuer initiating a chargeback. Issuers are required to report fraud to the card network, but it's up to the issuer to decide if and when to initiate the chargeback within the chargeback window. It's not uncommon for a transaction that received a TC40 not to receive a chargeback, or receive the EFW and chargeback at the same time. Those conditions and situations vary based on the issuer, but some common scenarios include the charge having liability shift as it went through 3D Secure verification, the issuer determining it to be more cost effective to write it off rather than initiate a chargeback, or that the issuer's internal process initiates the chargeback at a later time and date. All issuer-reported fraudulent transactions (TC40 data) count towards the programme, regardless of fraud type, dispute reason code and representment outcome (win or loss).
Chargebacks on fully refunded payments still count towards your totals. This is because the chargeback can be raised before the refund has hit the cardholder's account. In cases where the refund was issued well before we received the chargeback (that is, at least 10 days prior), we can sometimes ask to have the chargeback deducted from their account – the issuer may have missed the credit and raised the chargeback by mistake. However, this happens very rarely and we have yet to see a case where this would have prevented identification in a programme.
No. Unfortunately, the final outcome of the dispute representment has no impact on your final numbers. The card networks are ultimately looking to see what you're doing to prevent chargebacks in the first place. In addition, if the outcome mattered, identifications would take place months after the dispute-data month, because you'd need the chargeback process to run its course first.
The short answer is no. Customers' banks are required to report fraud on all captured payments, even if a refund has been issued. The only time this isn't true is if the refund is processed as a reversal, but that typically only happens if issued within two hours of charge capture.
Under certain circumstances, Stripe might auto-represent a chargeback on your behalf and not show it to you in your account. For example, Stripe does this if the payment was protected by liability shift, or if it appears the card network made an error and you shouldn't be financially liable for the dispute. This can happen for a number of reasons, but the most common one by far is that you'd already fully refunded the payment before the customer disputed the charge. However, while you're not liable for the cost of these disputes or their fees, they still count towards your monthly network totals. If you tend to issue a lot of refunds, it may make your dispute numbers appear lower in your account than on the networks' end.
Identifications in a programme often occur in the month after the disputes have been reported. The month in which a business is identified in a programme is known as the Report/Reporting Month or Identification Month. The month in which the disputes were reported is known as the Data Month. This can be very confusing, especially for the Mastercard programme which has two separate Data Months, one for disputes and another for sales. However, whenever we refer to the Report or Identification Month, we mean the month that you were identified, which is usually one month after the data that's being looked at.
Visa identifies merchants based on statement descriptor separated by market (i.e. country), except in the EU, where they evaluate each country's volume in aggregate. For example, if you use several statement descriptors on a Canadian account, that account could get identified in monitoring programmes multiple times if different statement descriptors exceed programme thresholds. Furthermore, if you also have a US account, the same statement descriptor can be identified twice if it exceeds programme thresholds in each market. But if you had accounts in France and Ireland that both exceeded programme thresholds on the same descriptor, Visa would combine those accounts' volume into one programme identification as both accounts are in the EU.
Visa counts the total number of chargebacks raised within one month and divides this by the total number of payments captured in the same month. For example, chargebacks reported in February are divided by the total number of sales captured in February. The original transaction date of the disputed payments does not factor into this equation. If you meet or exceed 100 disputes and a dispute-to-sales count ratio of 0.9% in a data month, you qualify for the programme at the Standard level. If your account is outside the US, CA, Europe, AU or BR, only international transactions are counted. Otherwise, both domestic and international transactions are included.
If your account is outside the US, CA, Europe, AU or BR, only international transactions are counted. Otherwise, both domestic and international transactions are included. Visa counts the total dollar amount (USD) of TC40s raised within one month and divides this by the total dollar amount of payments captured in the same month. For example, TC40 volume reported in February is divided by the total dollar amount of sales captured in February. The date on which the fraudulent payments were captured is not factored into this equation. If you meet or exceed US$75,000 in fraud volume and a fraud-to-sales volume ratio of 0.9% in a data month, you qualify for the programme at the Standard level.
This programme only applies to US-based users. Visa counts the total dollar amount (USD) of TC40s raised within one month and divides this by the total dollar amount of payments captured in the same month. For example, 3DS volume that received TC40s reported in February is divided by the total dollar amount of 3DS sales captured in February. The date on which the fraudulent payments were captured is not factored into this equation. If you meet or exceed US$75,000 in domestic 3D Secure-authenticated (3DS) fraud volume and a fraud-to-sales volume ratio of 0.9% in a reporting month, you qualify.
An Early Warning from Visa is just that: a warning. While you aren't officially in the programme, you should still work towards bringing your rate down below 0.65%, which is the limit to enter Visa's Fraud Monitoring Programme (VFMP).
The best way for you to calculate your chargeback rate is by exporting your Visa disputes. The US has a delay between when disputes are received from financial partners and when they are reported to Visa. To get a more accurate count, you should start looking at disputes from the 5th of each month to the 5th of the following month, then divide this by sales captured starting on the first to the end of the month. For accounts in all other markets, you can start the dispute count at the beginning of the month up until the end. It's important to note that dispute data may differ slightly from Visa's official identification numbers due to this and other reporting discrepancies.
Visa can sometimes only identify a subset of transactions on a particular descriptor if the user uses more than one. To prevent this, you should start each descriptor with the same prefix, using the following format: BIZNAME* UNIQUE DESCRIPTOR. In this example, Visa would aggregate everything under BIZNAME*.
If you work with another processor under a different acquirer, the data is segregated. In some cases, multiple processors can use the same acquirer. When this happens, Visa aggregates your data across multiple processors and you could receive an identification, even if your totals on Stripe didn't qualify for a programme.
Mastercard counts the total number of chargebacks raised within one month and divides it by the total number of payments captured in the prior month. For example, chargebacks reported in February are divided by the total number of sales captured in January. The date on which the disputed payments were captured doesn't factor into this equation. You qualify if you meet or exceed 100 chargebacks and a chargeback-to-sales count ratio of 1% in a reporting month.
Acquirers are required to identify users that qualify for a programme (segmented by market) and self-report this to Mastercard each month.
The best way to calculate the rate is by exporting your Mastercard disputes. The US has a delay between when disputes are received from financial partners and when they're reported to Mastercard. To get a more accurate count, start looking at disputes from the 5th of each month to the 5th of the following month, then divide this by the previous month's sales beginning on the first of that month. For accounts in all other markets, you can count disputes from the beginning of the month until the end of the month.
Unfortunately, it is required to report identifications to Mastercard at the account level, so even if aggregate rates across multiple accounts are below thresholds, you can still qualify if one of the accounts is not. However, if your business processes for similar services on multiple accounts, it is possible to request that Mastercard reassess your situation.
To fully exit a programme, you need three consecutive months below the Standard thresholds. For VDMP and VFMP, that means either three months below 100 chargebacks or US$75,000 in fraud volume or a rate of 0.9%.
After being identified at Excessive thresholds, you will continue to be fined and placed in a "high-risk" timeline until the level gets below Standard thresholds. That means just one month at an Excessive designation could include several months of fines if you aren't below Standard thresholds. To fully exit, you need three consecutive months below Standard thresholds.
Issuers can raise fraud disputes on 3DS charges under Dispute Condition 10.5: Visa Fraud Monitoring Programme 120 calendar days from the date of identification in the Visa Fraud Monitoring Programme (for example, if you're identified in month 2 of the VFMP-3DS programme on 5 January). Then you must go three consecutive months without identifications (Feb – Apr), but issuers can still raise fraud disputes on 3DS charges up until 5 May.
There's no exiting this programme as there is with Visa: you're either at thresholds or you aren't.
To fully exit, you need two consecutive months below ECM thresholds. For example, if you're identified in January and are below ECM thresholds in February, but then you're at ECM thresholds in March, you'll be identified in ECM again. If you go two consecutive months below ECM thresholds, but are above again in the third, you will be placed back in CMM.
Stripe can pull all of the descriptors that you're using to see how they're formatted. If you use the same prefix for each one, then they can get in touch with Visa and ask them to aggregate in the future. If the descriptors are all very different from one another (for example, MONTHLY PLAN, YEARLY PLAN and so on), then you should first edit your descriptor using the appropriate prefix format. It's best if you do this at the end of the month so that sales don't drop on the old descriptors causing dispute rates to spike.
This can happen if a user's MID (processor's merchant ID) gets updated partway through a month. Similar to how Visa relies on the statement descriptor, Mastercard's programme relies on MID. A change partway through the month could cause the sales count to appear much lower than it actually is.
Friendly fraud is not easy to spot at charge creation, since it's often the legitimate cardholder making the payment. The best way to prevent these types of disputes is to collect as much information as possible at charge creation, clearly communicate delivery times and/or billing terms, require the cardholder to agree to the Terms of Service, only deliver to verified billing addresses and/or require a signature upon delivery of goods.
Less common disputes can indicate either that your statement descriptor is not recognisable or that customers are confused by the way they're billed. Often, these will make up a small percentage of your total disputes. However, if any of these are one of the top three reasons, it could be an indication that some other issue is the root of the problem.
Not exactly. While an authenticated 3DS charge offers the benefit of liability shift on fraudulent disputes, fraud can still occur. When this happens, the issuer reports the fraud to the network (TC40s or SAFE) and this can count towards your fraud volume.
By default, Stripe allows all authenticated 3DS payments to go through. Users may want to adjust this rule so that 3DS payments flagged as high risk are still blocked. In addition, they should rely on other signals as they would with normal charges, such as velocity, transaction size and/or CVC/AVS checks.