VAMP stopped being a future problem on 1 April 2026. The merchant threshold dropped, the ratio now counts things it did not count before, and a shop that was comfortably compliant in March can be enrolled in April without changing a single thing about how it sells.
This is what the programme looks like now, what the numbers mean, and what to do if your ratio is drifting towards the line.
What VAMP is, in plain words
VAMP — the Visa Acquirer Monitoring Program — is how Visa watches fraud and disputes at the level of an acquirer and, inside it, at the level of individual merchants. It is not a law and not a court: it is a measurement with thresholds attached, run by the card scheme, and its output is enrolment, fees and pressure from your acquirer.
Nobody sends you a warning letter from Visa. You hear about it from your provider, usually with a deadline already attached.
What changed on 1 April 2026
- The merchant excessive threshold fell from 2,2% to 1,5%. That is a 32% tightening of the headline number in a single step.
- The acquirer thresholds tightened from 1 January 2026: 0,5% above standard, 0,7% excessive.
- The ratio counts fraud and disputes together. Reported fraud (TC40) plus disputes (TC15), divided by settled card-not-present transactions.
- Enrolment carries a fee of 8 USD per fraudulent or disputed transaction, and a first violation in a rolling twelve months gets a three-month grace period before enrolment takes effect.
These figures are the published state of the programme as of September 2026. Scheme rules change, and your acquirer may apply stricter internal limits than Visa does — so treat the numbers as the floor of the conversation, not the whole of it.
Why your ratio can rise without a single new chargeback
This is the part that catches people. Fraud reports are filed by issuers when a cardholder says a transaction was not theirs. Many of those never become chargebacks — the issuer writes it off, or the customer is refunded, or nothing further happens on your side at all.
Under the current ratio, those reports count anyway. So a merchant whose chargebacks are flat and whose refunds are prompt can still watch the number climb, because the numerator now includes events that never touched the dispute process.
Two practical consequences. First, refunding quickly no longer removes the whole problem: it prevents the dispute, not the fraud report. Second, your own dashboard is not enough — ask your provider for the fraud-report side of the number, because that is the half you cannot see.
The thresholds, in one place
- Merchant, excessive: 1,5% from 1 April 2026.
- Acquirer, above standard: 0,5%.
- Acquirer, excessive: 0,7%.
- Enumeration (card testing) is monitored separately, on its own ratio and volume triggers.
- Small merchants below the programme’s minimum monthly count of fraud and dispute events are not enrolled — but the acquirer can and does act long before Visa would.
Only card-not-present transactions go into the calculation, which is why this programme bites e-commerce and subscription businesses hardest.
Who is most exposed
Not the biggest merchants — the ones with a thin denominator and a lumpy numerator. A shop doing a few thousand transactions a month reaches 1,5% with a couple of dozen events. A campaign that brings unusual traffic, a product that generates «I did not recognise this» calls, a subscription that renews quietly: each of those moves the number faster than volume can dilute it.
How to stay below the line
- Make the descriptor recognisable. The shop name the buyer used, not a holding company. Unrecognised lines are the single largest source of fraud reports.
- Answer faster than the bank. A customer who reaches you does not reach their issuer.
- Refund the marginal cases the same day. It costs less than a dispute and it stops the escalation.
- Warn before every recurring charge, and make cancellation a single screen.
- Rate-limit card testing: caps on attempts per card, per address and per session, plus a hold on first orders.
- Read declines by reason, not as one percentage — a rising share from one issuer or one country is a signal, not noise.
A thirty-day plan when the number is drifting
Week one: get the exact definition from your provider — which month the fraud reports are counted in, which month the transactions are, and what is included. Fix the descriptor. Refund everything borderline.
Week two: sort the events by reason, product and traffic source. One row almost always dominates. Fix that row rather than tightening every rule you have.
Week three: recover the good declines — proper retries, full data in the authorisation, a second acceptance channel where it helps. Do not buy volume to dilute the ratio: it works for a month and produces the next letter two months later.
Week four: report your own progress to the provider, weekly, with the number and what you changed. A merchant who reports is treated differently from one who goes quiet.
A simplified example
A shop settles 20 000 card-not-present transactions in a month. Fraud reports: 180. Disputes: 140. The ratio is 320 divided by 20 000, which is 1,6% — above the 1,5% line, with chargebacks alone at only 0,7%. The half that pushed it over is the half most merchants never look at.
Where the cost lands
Programme fees are only part of the bill. On our side a chargeback costs 100,00 EUR on top of the returned amount and a refund 50,00 EUR, MDR runs 3%–5% depending on the type of business plus 0,50 EUR per transaction, settlement in EUR over SEPA is 0,20% at T+7, and the rolling reserve is 10% for 180 days. The published lines sit on the pricing page, and the exact figure is set per merchant.
The reserve exists precisely because of the risk this programme measures, which is why a stable ratio is the strongest argument you have when asking for it to be reviewed.
Align the ratio with your processing setup
Two things do most of the work here. A second acceptance channel means a retry can be routed rather than repeated into the same wall, and clean reporting means you see the number before your provider has to tell you about it. Both are part of how payment processing is set up rather than something bolted on afterwards.
What to put in place
- A weekly view of fraud reports and disputes as separate lines.
- A refund rule support can apply without asking anyone.
- Evidence collected at the time of sale, not at the time of dispute.
- A named owner for the number, and a date each month when it is read.
Then VAMP becomes a metric you manage, and the merchant account keeps the terms you signed up for. Conditions depend on the vertical, the documents and the processing history, and each case is assessed individually.