TL;DR Summary:
Visa’s new VAMP program is a big deal for e-commerce merchants. It merges the old fraud (VFMP) and dispute (VDMP) programs into one. It’s now tracked by a single VAMP Ratio (Fraud TC40s + Dispute TC15s) / Total Sales. If your business crosses the monthly thresholds (e.g., a 2.2% ratio and 1,500+ incidents), you face a 3-month grace period followed by heavy per-transaction fines. The best strategy is proactive compliance: monitoring your ratio in real-time, using fraud-prevention tools, and implementing pre-dispute resolution.
If you accept Visa card-not-present (CNP) payments online, a new program is fundamentally changing how fraud and disputes are monitored. It’s called the Visa Acquirer Monitoring Program (VAMP), and it represents one of the most significant shifts in payment compliance in years.
This new framework consolidates Visa’s previous fraud and dispute programs into one, creating a single, unified standard for risk. For merchants, this means it’s no longer enough to just manage chargebacks or fraud—you must now master both.
This guide will break down exactly what VAMP is, why it matters, the new metrics you must track, the costly penalties for non-compliance, and the actionable steps you can take to keep your business safe, secure, and successful.
What Is the Visa Acquirer Monitoring Program (VAMP)?
In simple terms, VAMP is Visa’s global program to monitor its acquiring partners (and by extension, their merchants) for excessive levels of fraud and disputes.
The primary goal is to protect the integrity of the entire Visa payment ecosystem. By identifying high-risk acquirers and merchants, Visa aims to reduce financial losses, prevent illegal transactions, and maintain the trust of cardholders.
The biggest change for merchants is that VAMP replaces and combines two older programs:
- Visa Fraud Monitoring Program (VFMP): This program tracked high levels of fraudulent transactions.
- Visa Dispute Monitoring Program (VDMP): This program tracked high levels of non-fraud customer disputes (chargebacks).
Under VAMP, these two are merged. Visa no longer views them as separate issues; they are two parts of a single risk profile, and they are now measured by one core metric.
How Does VAMP Work?
The New VAMP Ratio Explained
VAMP identifies high-risk merchants using a new, single calculation called the VAMP Ratio. It also introduces a separate metric for “enumeration” or card-testing attacks.
The VAMP Ratio Formula
This is the most important formula merchants need to understand. Your VAMP Ratio is calculated monthly as follows:
VAMP Ratio = (Count of Fraud [TC40] + Count of Disputes [TC15]) / (Count of Settled Transactions [TC05])
Let’s break down each component:
- TC40 (Fraud): This is a fraud report filed by a cardholder’s issuing bank. Critically, a TC40 can be generated even if a chargeback is never filed. It is a direct signal of reported fraud on your merchant account.
- TC15 (Disputes): These are non-fraud chargebacks. This includes all disputes filed under reason codes 11, 12, and 13, which typically cover issues like “Product Not as Described,” “Services Not Rendered,” or “Canceled Recurring Transaction.”
- TC05 (Settled Transactions): This is the total number of your completed, settled Visa sales transactions for that month.
The key takeaway is that your business is now measured on the total sum of reported fraud and customer disputes, not just one or the other.
The New Enumeration Ratio (Card Testing)
VAMP also takes aim at a specific type of fraud: enumeration, or card-testing attacks.
This is when fraudsters use bots to send high volumes of small, rapid transaction attempts to your payment gateway to “test” lists of stolen card numbers.
Under VAMP, a merchant can be flagged separately for enumeration if their card-testing attempts exceed a certain percentage (e.g., 20%) of their total transaction attempts and they meet a very high-volume minimum, such as 300,000 enumerated attempts in a month.
VAMP Thresholds: What Merchants Need to Know
VAMP sets risk thresholds for both merchants and their acquirers. Understanding both is critical, because the pressure from your acquirer will likely come long before you are formally flagged by Visa.
VAMP “Excessive Merchant” Thresholds
Visa will formally identify a merchant as “Excessive” if they meet both of the following criteria in a single month (thresholds effective from mid-2025):
- VAMP Ratio: Is greater than or equal to 2.2% (220 basis points) in major regions like the U.S., Canada, and Europe.
- Minimum Count: Has 1,500 or more combined fraud (TC40) and dispute (TC15) transactions.
You must cross both of these lines to be placed in the program by Visa. However, this is not the only number you should worry about.
Why Acquirer Thresholds Also Matter to You
Your acquirer (or payment processor) is also being monitored by Visa under VAMP, and their thresholds are significantly lower.
An acquirer can be flagged as “Above Standard” with a VAMP ratio as low as 0.5% (50 basis points).
This creates a “pass-down” effect. To protect its own portfolio and standing with Visa, your acquirer will proactively monitor its merchants. They will enforce stricter internal rules and may place your account on a watch list or demand action if your ratio starts to climb—even if you are nowhere near the 2.2% “Excessive Merchant” threshold.
What Are the Penalties for VAMP Non-Compliance?
The consequences for being identified in the VAMP are severe and escalate over time.
- Step 1: Identification & Grace Period: The first time a merchant is identified, they are typically given a 3-month grace period. This is a warning window to work with your acquirer and implement a plan to reduce your ratios.
- Step 2: Monthly Fines: If the ratios are not corrected after the grace period, heavy fines begin. These are applied per-transaction (up to $10 or more) for every fraud and dispute case that keeps you above the threshold. These fines can quickly add up to tens of thousands of dollars per month.
- Step 3: Increased Scrutiny & Remediation: You will be required to submit a formal “remediation plan” to your acquirer, detailing the exact steps you are taking to fix the problem.
- Step 4: Account Termination: This is the worst-case scenario. If a merchant fails to show improvement and continues to pose a risk, the acquirer may be forced to terminate their merchant account to protect the acquirer’s own portfolio from Visa penalties.
How to Stay Compliant and Avoid VAMP Penalties: A 5-Step Strategy
VAMP compliance requires a proactive, multi-layered strategy. Here are five essential steps every merchant should take.
- Monitor Your Ratios Proactively
You cannot manage what you do not measure. A standard “chargeback report” is no longer enough. You must have access to a reporting dashboard that specifically tracks your TC40 fraud reports and your TC15 dispute reports as separate data points. Monitoring this VAMP ratio monthly is the only way to know if you are approaching a danger zone.
- Implement a Multi-Layered Fraud Prevention Strategy
The best way to reduce your VAMP ratio is to stop fraudulent transactions before they happen. This requires more than just a basic CVV check. A modern fraud stack should include:
- 3D Secure 2.0 (3DS2): Provides an extra layer of authentication for CNP transactions.
- AVS (Address Verification Service): Matches the billing address to the one on file.
- Real-Time Fraud Scoring: Uses machine learning to analyze hundreds of data points (device, location, time) to score a transaction’s risk level.
- Focus on Pre-Dispute Resolution
Many customer disputes (TC15s) are preventable. Pre-dispute resolution tools work to stop a dispute before it becomes a chargeback. Solutions like Rapid Dispute Resolution (RDR) can be set up to automatically issue a refund for certain types of inquiries, preventing the dispute from ever being filed and counting against your VAMP ratio.
- Fight “Friendly Fraud” with Compelling Evidence (CE 3.0)
“Friendly fraud” is when a legitimate customer disputes a valid charge. Visa’s Compelling Evidence 3.0 (CE 3.0) program helps merchants fight this. By providing evidence of a valid purchase (like matching IP addresses, device IDs, or past purchase history), you can often get these disputes overturned so they don’t count against you.
- Improve Customer Communication and Service
A surprising number of disputes are simply misunderstandings.
- Use Clear Billing Descriptors: Ensure your company name on a customer’s credit card statement is easily recognizable.
- Be Accessible: Make your customer service phone number and email easy to find on every page of your site.
- Send Proactive Notifications: Send immediate order confirmations and shipping notifications with tracking numbers to keep your customers informed.
VAMP Is a Challenge, But Compliance Is an Opportunity
The new VAMP framework is undeniably a challenge, raising the stakes for every e-commerce merchant. But it’s not just a penalty box—it’s a push toward a healthier, more secure, and more trustworthy payment ecosystem.
Merchants who adapt to this new reality by investing in better fraud tools, proactive dispute management, and clearer communication will not only avoid costly fines. They will also reduce their total losses from fraud, lower their operational costs, and ultimately build greater, lasting trust with their customers.
A Partner Committed to Your Success
Navigating this landscape requires a partner that is as committed to your security and success as you are. As a certified Minority Business Enterprise (MBE), Payscout is built on a foundation of fostering diverse, supportive, and long-term relationships. We understand that compliance is complex, and our mission is to provide the “White Glove” service and cutting-edge technology that empowers you to thrive.
Understanding the “what” and “why” of VAMP is the first step. The next is implementing a specific strategy. Learn how Payscout’s solutions can help:
- How Payscout Helps You Stay Ahead of Visa’s Acquirer Monitoring Program (VAMP)
- From Compliance to Confidence: How Payscout Simplifies VAMP for Merchants
- Minimizing Risk, Maximizing Trust: Payscout’s Approach to VAMP Compliance
