Get answers to questions about the Visa and Mastercard monitoring programs.
Any chargeback where funds are moved count towards your program totals within a given month, regardless of the reason for the chargeback. Situations that don’t count as chargebacks:
The Visa Fraud Monitoring Program (VFMP) uses issuer-reported fraud (TC40) data, which we call Early fraud warnings (EFW). EFW are completely independent from the customer’s card issuer initiating a chargeback. Issuers are required to report fraud to the card network, but it’s up to the issuer to decide if and when to initiate the chargeback within the chargeback window. It’s not uncommon for a transaction that received a TC40 to not receive a chargeback, or receive the EFW and chargeback at the same time. Those conditions and situations vary based on the issuer, but some common scenarios include the charge having liability shift as it went through 3D-Secure verification, the issuer determining it to be more cost effective to write it off rather than initiate a chargeback, or that the issuer’s internal process initiates the chargeback at a later time and date. All issuer-reported fraudulent transactions (TC40 data) count toward the program, regardless of fraud type, dispute reason code and representment outcome (win or loss).
Chargebacks on fully-refunded payments still count towards your totals. This is because the chargeback can be raised before the refund has hit the cardholder’s account. In cases where the refund was issued well before we received the chargeback (that is, at least 10 days prior), we can sometimes ask to have the chargeback deducted from their account: the issuer may have missed the credit and raised the chargeback by mistake. However, this happens very rarely and we have yet to see a case where this would have prevented identification in a program.
No. Unfortunately the final outcome of the dispute representment has no impact on your final numbers. The card networks are ultimately looking to see what you’re doing to prevent chargebacks in the first place. Additionally, if the outcome mattered, identifications would take place months after the dispute-data month because you’d need the chargeback process to run its course first.
The short answer is no. Customers’ banks are required to report fraud on all captured payments, even if a refund has been issued. The only time this isn’t true is if the refund processes as a reversal, but that typically only happens if issued within 2 hours of charge capture.
Under certain circumstances, Stripe might auto-represent a chargeback on your behalf and not show it to you in your account. For example, Stripe does this if the payment was protected by liability shift, or if it appears the card network made an error and you shouldn’t be financially liable for the dispute. This can happen for a number of reasons, but by far the most common one is that you already fully refunded the payment before the customer disputed the charge. However, while you’re not liable for the cost of these disputes, or their fees, they still count toward your monthly network totals. If you tend to issue a lot of refunds, it can make your dispute numbers look lower in your account than on the networks’ end.
Identifications in a program often occur in the month after the disputes have been reported. The month a business is identified in a program is known as the Report/Reporting Month or Identification Month. The month the disputes were reported is known as the Data Month. This can be very confusing, especially for the Mastercard program which has two separate Data Months, one for disputes and another for sales. However, whenever we refer to the Report or Identification Month, we mean the month you were identified, which is usually one month after the data that’s being looked at.
Visa identifies merchants based on statement descriptor separated by market (that is, country) except in the EU where they evaluate each country’s volume in aggregate. For example, if you use several statement descriptors on a Canadian account, that account could get identified in monitoring programs multiple times if different statement descriptors exceed program thresholds. Further, if you also have a US account, the same statement descriptor can be identified twice if it exceeds program thresholds in each market. But if you have accounts in France and Ireland that both exceed program thresholds on the same descriptor, Visa would combine those accounts’ volume into one program identification as both accounts are in the EU.
Visa counts the total number of chargebacks raised within one month and divide this by the total number of payments captured in the same month. For example, chargebacks reported in February are divided by the total number of sales captured in February. The original transaction date of the disputed payments does not factor into this equation. If you meet or exceed 100 disputes and a dispute-to-sales count ratio of .9% in a data month, you qualify for the program at the Standard level. If your account is outside of the US, CA, Europe, AU, or BR, only international transactions are counted. Otherwise, both domestic and international transactions are included.
If your account is outside of the US, CA, Europe, AU, or BR, only international transactions are counted. Otherwise, both domestic and international transactions are included. Visa counts the total dollar amount (USD) of TC40s raised within one month and divide this by the total dollar amount of payments captured in the same month. For example, TC40 volume reported in February is divided by the total dollar amount of sales captured in February. The date the fraudulent payments were captured does not factor into this equation. If you meet or exceed 75,000 USD in fraud volume and a fraud-to-sales volume ratio of .9% in a data month, you qualify for the program at the Standard level.
This program applies only to US-based users. Visa counts the total dollar amount (USD) of TC40s raised within one month and divide this by the total dollar amount of payments captured in the same month. For example, 3DS volume that received TC40s reported in February is divided by the total dollar amount of 3DS sales captured in February. The date the fraudulent payments were captured does not factor into this equation. If you meet or exceed 75,000 USD in domestic 3D Secure-authenticated (3DS) fraud volume and a fraud-to-sales volume ratio of 0.9% in a reporting month, you qualify.
An Early Warning from Visa is just that: a warning. While you’re not officially in the program, you should still work towards bringing your rate down below 0.65% which is the limit to enter Visa’s Fraud Monitoring Program (VFMP).
The best way for you to calculate your chargeback rate is by exporting your Visa disputes. The US has a delay between when disputes are received from financial partners and when it was reported to Visa. To get a more accurate count you should start looking at disputes from the 5th of each month to the 5th of the following month, then divide this by sales captured starting on the first to the end of the month. For accounts in all other markets, you can start the dispute count at the beginning of the month up until the end. It’s important to note that dispute data may differ slightly from Visa’s official identification numbers due to this and other reporting discrepancies.
Visa can sometimes identify only a subset of transactions on a particular descriptor if the user uses more than one. To prevent this, you should start each descriptor with the same prefix, using the following format: BIZNAME* UNIQUE DESCRIPTOR. In this example, Visa would aggregate everything under BIZNAME*.
If you work with another processor under a different acquirer, the data is segregated. In some cases, multiple processors can use the same acquirer. When this happens, Visa aggregates your data across multiple processors and you could receive an identification, even if your totals on Stripe didn’t qualify for a program.
Mastercard counts the total number of chargebacks raised within one month and divides it by the total number of payments captured in the prior month. For example, chargebacks reported in February are divided by the total number of sales captured in January. The date the disputed payments were captured doesn’t factor into this equation. You qualify if you who meet or exceed 100 chargebacks and a chargeback-to-sales count ratio of 1% in a reporting month.
Acquirers are required to identify users that qualify for a program (segmented by market) and self-report this to Mastercard each month.
The best way to calculate the rate is by exporting your Mastercard disputes. The US has a delay between when disputes are received from financial partners and when they’re reported to Mastercard. To get a more accurate count, start looking at disputes from the 5th of each month to the 5th of the following month, then divide this by the previous month’s sales beginning on the first of that month. For accounts in all other markets, you can count disputes from the beginning of the month until the end of the month.
Unfortunately, it is required to report identifications to Mastercard at the account level, so even if aggregate rates across multiple accounts are below thresholds, you can still qualify if one of the accounts is not. However, if your business processes for similar services on multiple accounts, it can be requested that Mastercard reassess your situation.
To fully exit a program, you need 3 consecutive months below the Standard thresholds. For VDMP and VFMP, that means either 3 months below 100 chargebacks or 75,000 USD in fraud volume or a rate of 0.9%.
After being identified at Excessive thresholds, you will continue to be fined and placed in a “high-risk” timeline until the level gets below Standard thresholds. That means just 1 month at an Excessive designation could include several months of fines if you’re not below Standard thresholds. To fully exit, you need 3 consecutive months below Standard thresholds.
Issuers can raise fraud disputes on 3DS charges under Dispute Condition 10.5: Visa Fraud Monitoring Program 120 calendar days from the date of identification in the Visa Fraud Monitoring Program (for example, if you’re identified in month 2 of the VFMP-3DS program on January 5th). Then you must go 3 consecutive months without identifications (Feb-Apr), but issuers can still raise fraud disputes on 3DS charges up until May 5th.
There’s no exiting this program as there is with Visa: you’re either at thresholds or you’re not.
To fully exit, you need 2 consecutive months below ECM thresholds. For example, if you’re identified in January and are below ECM thresholds in February, but then you’re at ECM thresholds in March, you’ll be identified in ECM again. If you go 2 consecutive months below ECM thresholds, but are above again in the third, you will be placed back in CMM.
Stripe can pull all of the descriptors you’re using to see how they’re formatted. If you use the same prefix for each one, then they can reach out to Visa and ask them to aggregate going forward. If the descriptors are all very different from one another (for example, MONTHLY PLAN, YEARLY PLAN, and so on), then you should first edit your descriptor using the appropriate prefix format. It’s best if you do this at the end of the month, so sales don’t drop on the old descriptors causing dispute rates to spike.
This can happen if a user’s MID (processor’s merchant ID) gets updated partway through a month. Similar to how Visa relies on the statement descriptor, Mastercard’s program relies on MID. A change partway through the month could cause the sales count to appear much lower than it actually is.
Friendly fraud is not easy to spot at charge creation, since it’s often the legitimate cardholder making the payment. The best way to prevent these types of disputes is to collect as much information as possible at charge creation, clearly communicate shipping times and/or billing terms, require the cardholder to agree to the terms of service, ship only to verified billing addresses, and/or require a signature upon delivery of goods.
Less common disputes can indicate either that your statement descriptor is not recognizable or customers are confused by the way they’re billed. Often these will make up a small percentage of your total disputes. However, if any of these are one of the top three reasons, it could be an indication that some other issue is the root of the problem.
Not exactly. While an authenticated 3DS charge offers the benefit of liability shift on fraudulent disputes, fraud can still occur. When this happens, the issuer reports the fraud to the network (TC40s or SAFE) and this can count towards your fraud volume.
By default, Stripe allows all authenticated 3DS payments to go through. Users may want to adjust this rule so that 3DS payments flagged as high risk are still blocked. Additionally, they should rely on other signals like they would with normal charges, such as velocity, transaction size, and/or CVC/AVS checks.