Mastercard ECP and EFM: thresholds, fines and how to get out

A merchant can spend a year watching its Visa ratio and still be caught out by Mastercard. The two schemes count different things, over different months, and Mastercard still runs chargebacks and fraud as separate programmes. A store that looks healthy on a same-month dashboard can sit above a Mastercard threshold because of how the sum is built.

This article explains Mastercard’s Excessive Chargeback Program and Excessive Fraud Merchant programme: the thresholds, the tiers, the assessments and how to leave. It also covers the scam programme enforced since July 2026 and the audit programme reported for April 2027. A note on sources: Mastercard’s own rule PDFs could not be opened for this article, so every figure comes from acquirer, processor and vendor documentation. For the Visa side, see our guide to VAMP.

How does Mastercard calculate the chargeback ratio?

Mastercard divides this month’s chargebacks by last month’s sales. Stripe’s documentation says a chargeback belongs to the month in which it is raised, not the month of the original payment, so February’s rate uses chargebacks raised in February over payments captured in January. Visa, by contrast, compares disputes and fraud with payments in the same calendar month.

Three counting rules follow, all from Stripe:

• Refunds do not remove a chargeback. Mastercard counts it even if a refund hid it from your own view.
• Liability shift does not remove it. A 3-D Secure payment still counts.
• Outcomes do not matter. A chargeback you win still counts.

The denominator is the trap for seasonal merchants. Chargebacks from a peak month arrive weeks later, when sales have dropped, so the ratio rises without any change in customer behaviour.

Example figures, for illustration only.

Month	Mastercard sales	Chargebacks raised	Previous month’s sales	Rate
December	30,000	120	18,000	0.67%
January	12,000	260	30,000	0.87%
February	14,000	200	12,000	1.67%

February’s 200 chargebacks are fewer than January’s 260, yet February is the month that crosses both the 100 count and the 1.5% rate. On a same-month basis, February would read 1.43% and look safe.

What are the Excessive Chargeback tiers and fines?

The Excessive Chargeback Program has two levels, and a merchant must meet both the count and the rate. Stripe gives the thresholds as follows.

Level	Chargebacks in the month	Rate
Excessive Chargeback Merchant (ECM)	100 to 299	1.5% to 2.99%
High Excessive Chargeback Merchant (HECM)	300 or more	3% or more

Shopify’s help pages list the same thresholds and fines. The monthly fine depends on how long the merchant has been above the threshold:

Months above threshold	ECM fine	HECM fine	Issuer recovery assessment
1	USD 0	USD 0	No
2	USD 1,000	USD 1,000	No
3	USD 1,000	USD 2,000	No
4 to 6	USD 5,000	USD 10,000	Yes
7 to 11	USD 25,000	USD 50,000	Yes
12 to 18	USD 50,000	USD 100,000	Yes
19 or more	USD 100,000	USD 200,000	Yes

The issuer recovery assessment adds USD 5 for each chargeback over 300. Stripe’s example is a merchant in month four of ECM with 400 disputes, assessed USD 5,500: the USD 5,000 fine plus 100 × USD 5.

Six months at ECM adds up to USD 17,000 in fines, and six months at HECM to USD 33,000, before any issuer recovery. The bigger risk is often commercial. Stripe warns that failing to meet a programme’s requirements within the set time can lead to the network refusing further payments. And as our article on single-PSP risk explains, excessive chargebacks are also a reason code for Mastercard’s MATCH list of terminated merchants, on a different test from the one above.

How does the Excessive Fraud Merchant programme work?

It targets merchants with heavy e-commerce fraud and little authentication. Checkout.com says a merchant is placed in the programme if, in the previous calendar month, it met all four conditions:

1. 1,000 or more Mastercard sales.
2. At least USD or EUR 50,000 in fraud chargebacks under reason code 4837.
3. A fraud chargeback to sales ratio of 0.5% or more.
4. Less than 10% of monthly clearing volume with 3-D Secure in non-regulated countries, or less than 50% in regulated ones. Checkout.com counts Data Only payments and Digital Secure Remote Payments towards this share.

Regulated countries, in Checkout.com’s definition, are those with a legal or regulatory requirement for strong cardholder authentication. Our article on 3DS2 exemptions covers when to request it.

Sources differ on small details, so read them together. Stripe also counts reason code 4863 and gives lower figures for Australia, USD 15,000 and 0.20%, which Braintree repeats. Stripe writes the volume and ratio as greater than the threshold, and Checkout.com as at or above it. Any merchant close to a line should ask its acquirer which reading it applies.

The fines are lower in the early months than for chargebacks, then match the ECM scale. Stripe, Checkout.com and Braintree give the same table: USD 0 in month one, USD 500 in month two, USD 1,000 in month three, USD 5,000 in months four to six, USD 25,000 in months seven to 11, USD 50,000 in months 12 to 18, and USD 100,000 from month 19. Six months come to USD 16,500.

What happens if a merchant is in both programmes?

The fraud programme takes precedence. Stripe says a merchant exceeding both is placed in the fraud programme but not the chargeback programme, while Mastercard tracks both. Its example: above both in March and April, then above only the chargeback threshold in May. In April the merchant is in month two of the fraud programme. In May it is in month three of the chargeback programme, so the months already served carry across.

Checkout.com adds that only the fraud assessments apply in a month with both, and that after 12 months in either programme, the highest programme assessment applies. Braintree also confirms that only fraud assessments apply in a shared month.

How do you get out of a Mastercard programme?

Stay within the thresholds for three consecutive months. Stripe and Checkout.com both say so. Stripe adds that a merchant in HECM that drops below HECM but still meets ECM moves down to ECM rather than out. For the fraud programme, Braintree says a month counts as compliant if either the count or the ratio is below its threshold, and that a merchant identified again after a full exit starts at month one.

Mastercard can also pause assessments. The sources describe this slightly differently:

Source	What it says
Stripe	A fine can be suspended once during an open case. If the merchant falls below the threshold for two months and exceeds it in the third, fines continue until it exits
Checkout.com	Extensions are granted case by case and may need an action plan. Assessments accrued during the extension are charged if the merchant exits early, for example by processing zero sales, or fails to reach three compliant months
Braintree	An extension holds assessments for six months. If the merchant is under the thresholds at the end, no fines are assessed; if over, all accrued fines are

The Checkout.com point closes an obvious shortcut. Stopping Mastercard sales for a month to force a clean ratio can trigger the accrued assessments.

How do you bring the numbers down?

Work on the part of the ratio you still control this month.

1. Rebuild the calculation daily. Stripe says networks count payments by capture date and disputes by creation date. Track Mastercard separately from Visa, and on Mastercard’s prior-month basis.
2. Plan for the post-peak month. Forecast chargebacks against the sales of the month before, not the current one.
3. Reverse before capture. Stripe notes that issuers are not required to report fraud on an authorisation reversed before capture. Hold risky orders until reviewed.
4. Resolve before a chargeback is raised. Stripe points to alert services such as Ethoca and Verifi, which let a merchant refund before a chargeback starts.
5. Raise the 3-D Secure share if you sit near the fraud programme’s lower bound. It affects the programme’s fourth test, not the chargeback count.
6. Fix the top reason codes. Our guide to chargeback management covers prevention by reason, and friendly fraud and compelling evidence covers disputes from genuine customers.
7. Stop card testing. Our article on card testing attacks lists the controls.
8. Send the acquirer a plan. Stripe says it can require details of your steps and timeline, and offers a remediation template.

What is the Scam Merchant Monitoring Program?

It is a separate programme based on investigation, not on a monthly ratio. Checkout.com says it applies globally to card-not-present transactions, except in Jordan, and covers payment facilitators and their sponsored merchants. Chargebacks911 dates acquirer onboarding requirements to January 2026 and full enforcement to 24 July 2026.

Checkout.com lists the triggers. For new merchants, with under six months of Mastercard history and more than 500 transactions a month, they include refunds and chargebacks above 5% of purchases over a rolling 30 days, or two or more issuers reporting fraud type 56 or raising chargebacks that mention a scam. For all merchants, they include an approval rate that drops by 50 percentage points or falls below 30% over 72 hours, on more than 25 purchases and excluding BIN attacks and outages, or a Mastercard GRIP letter. Checkout.com says it must investigate within 72 hours. A confirmed scam stops Mastercard and Maestro processing immediately and puts the merchant on the MATCH list.

A genuine merchant should note the refund trigger in particular: it counts refunds, so a new store with a generous returns policy could reach it. Keep records of your business model and refund policy ready for your acquirer.

What is changing with GMAP in 2027?

Mastercard has not published this in a public rulebook, so treat everything here as reported, not confirmed. IXOPAY says its guidance rests on industry summaries of a non-public Mastercard bulletin and that the official rulebook update has not been published. Justt notes that Mastercard has not presented the programme in a public forum. Chargeback Gurus, Justt and IXOPAY all give 1 April 2027 as the start of the Global Merchant Audit Program.

The reported points, as of those articles:

Reported change	Detail	Source
ECM lower bound steps down	1.5% in 2027 and 2028, 1.3% in 2029, 1.1% in 2030, 0.9% in 2031; the 100-chargeback minimum stays	Chargeback Gurus; IXOPAY
HECM	Stays at 300 chargebacks and 3%	Chargeback Gurus; Justt
High Dispute Merchant (new)	5 or more transactions, USD 5,000 of fraud plus non-fraud chargebacks, 5% ratio	Chargeback Gurus
Excessive Dispute Merchant (new)	5 or more transactions, USD 10,000, 50% ratio	Chargeback Gurus
Sub-merchant monitoring	ECM uses the sub-merchant ID where available, not the MID	Chargeback Gurus
Audit exit	Three consecutive months below both thresholds	Chargeback Gurus; IXOPAY

The practical reading: the 2029 step-down would bring more merchants into ECM, and the new merchant tiers would catch small merchants that the 100-chargeback minimum currently leaves out. Ask your acquirer for its own notice before you change any plan.

How does Omno help with Mastercard monitoring?

Omno is not an acquirer and does not report to Mastercard; your acquirers measure your figures. Omno helps with what reaches them. Fraud scoring runs on every transaction, and customer rules, customer blocking, card blocking, and amount and volume limits per provider and method stop risky payments first. The transaction trail shows every attempt and provider response, so a team can follow a payment across providers. The risk controls page lists what is available.