Visa VAMP: how the ratio, fees and card testing rules work

The first sign of trouble with Visa is rarely a letter from Visa. It is a message from the acquirer: your ratio is rising, please send a remediation plan, and a reserve or a volume cap may follow. By then the month that caused it is over, and the merchant is trying to work out how a dispute rate that looked fine became a problem.

This article explains how the Visa Acquirer Monitoring Program (VAMP) counts, what it leaves out, the separate card testing ratio, why acquirers act before merchant thresholds are reached, what it costs and what to do in the month a warning arrives. The regional merchant thresholds and a CEMEA worked example are in our guide to chargeback management for cross-border merchants; this article goes underneath them.

What exactly does the VAMP ratio count?

Fraud reports and disputes, added together, over settled sales. Visa’s fact sheet defines it as the count of fraud reports (TC40) plus disputes (TC15), divided by the count of settled transactions (TC05), on card-not-present transactions, domestic and cross-border. It took effect on 1 June 2025 and merged the older VAMP, the Visa Fraud Monitoring Program and the Visa Dispute Monitoring Program into one global program.

Four counting rules matter in practice:

• Every TC40 counts. Visa’s announcement says all TC40s are counted in the new ratio. Stripe describes them as early fraud warnings, counted whatever their outcome.
• Double counting. Stripe’s documentation says the same fraudulent payment can appear in both reports, and a transaction in both is counted twice.
• All disputes count, fraud and non-fraud. Visa says it changed the formula to include non-fraud disputes.
• Refunds and outcomes do not matter. Stripe notes that monitoring programs ignore refunds when identifying disputes and do not wait for dispute outcomes.

Timing matters too. Stripe says Visa compares disputes and fraud with payments in the same calendar month, assigns each report to the month it was received, and reports its data with a one-month delay.

What is excluded from the count?

Two things, according to Visa: disputes resolved through pre-dispute solutions, and TC40 fraud reports that qualify for Compelling Evidence 3.0. Both exclusions are, in Visa’s words, contingent on the timing of the data extract, so a resolution that lands after Visa takes its monthly data may not help that month.

Item	Counted in VAMP?	Source
Dispute (TC15), fraud or non-fraud	Yes	Visa
Fraud report (TC40), even if refunded later	Yes	Visa; Stripe
Payment with both a TC40 and a TC15	Yes, twice	Stripe
Dispute resolved through a pre-dispute service such as RDR or CDRN	No	Visa; Chargebacks911
TC40 qualifying for Compelling Evidence 3.0	No	Visa
Unescalated inquiry with no funds returned	No	Stripe
Authorization reversed before capture	Not reported as fraud	Stripe

Chargebacks911 also lists inquiries resolved through Order Insight among the exclusions. The practical rule is that VAMP rewards resolving a problem before it becomes a dispute, not winning the dispute afterwards.

How does the enumeration ratio work?

It is a separate test for card testing. Visa defines the VAMP enumeration ratio as enumerated authorizations, approved and declined, divided by all authorizations. A merchant is caught when the ratio reaches 2,000 basis points (20%) and the count of enumerated transactions reaches 300,000 in a month. Both conditions must be met.

Stripe’s documentation adds that Visa identifies enumerated transactions with a machine learning model, that it monitors disputes and fraud separately from enumeration so an account enters monitoring only for the category it exceeded, and that Visa does not assess fines for enumeration monitoring. The indirect cost is real: Stripe notes that approved test payments lead to fraud warnings and disputes, and that a high decline rate can make issuers treat all your payments as riskier.

Why do acquirers act before you reach the merchant threshold?

Because the acquirer is measured first, and on a much tighter scale. Visa’s fact sheet identifies an acquirer’s whole portfolio as Above Standard at a VAMP ratio of 50 basis points (0.5%) or more and Excessive at 70 basis points (0.7%), with a minimum count of 1,500 in most regions, or 150 and USD 75,000 in CEMEA. The merchant thresholds of 150 or 220 basis points apply only if the acquirer is not itself Above Standard or Excessive.

That changes the arithmetic for a merchant. A merchant at 1.2% is below every merchant threshold, yet at more than twice the ratio at which its acquirer’s portfolio is flagged. Stripe’s documentation lists a lower non-compliant level, a VAMP ratio of 0.5% with a count of 5, at which Visa may assess fees. An acquirer with an Above Standard portfolio will look first at the merchants pulling the average up.

The tools acquirers use are commercial, not Visa’s. Chargebacks911 notes that acquirers may impose stricter controls, restrictions or account termination on merchants that put them at risk, and that lower dispute ratios can bring lower reserve requirements. Stripe warns that failing to meet a program’s requirements can lead to the network refusing to process further payments. A rolling reserve is the most common first step.

What does VAMP cost, and when did it start?

Visa’s public fact sheet sets the thresholds but not the fees, so the figures below come from PSP and industry summaries.

Date	Change	Source
April 2025	VAMP replaces the Visa Fraud and Dispute Monitoring Programs	Checkout.com
1 June 2025	New ratio and thresholds effective	Visa
30 September 2025	Advisory period ends	Visa
1 October 2025	Enforcement of fees begins	Chargebacks911
1 April 2026	Excessive Merchant ratio cut to 150 basis points in AP, Canada, EU and US; CEMEA stays at 220	Visa

Chargebacks911 reports fees of USD 4 per counted fraud report or dispute for an Above Standard acquirer, and USD 8 for an Excessive acquirer and an Excessive merchant. It also says acquirers must submit a remediation plan within 15 calendar days and that first-time identifications in a rolling 12 months get a three-month grace period. Ask your acquirer for its own figures, since it decides how much of any fee is passed on. Visa’s fact sheet says programs for Brazil, Chile and India will be announced later.

How does VAMP compare with Mastercard’s programs?

Mastercard still runs separate programs for chargebacks and fraud, and they count differently.

	Visa VAMP	Mastercard ECP	Mastercard EFM
What is counted	Fraud reports plus disputes	Chargebacks	Fraud chargebacks
Denominator	Settled transactions, same month	Transactions, previous month	E-commerce transactions, previous month
Entry level	150 or 220 basis points, with a count	100 chargebacks and 1.5%	1,000 payments, USD 50,000 fraud, 0.5%, low 3-D Secure share
Fines	Per counted item, via the acquirer	From month two, rising with time	From month two, rising with time

Stripe gives Mastercard’s escalation for the Excessive Chargeback Merchant level: no fine in month one, USD 1,000 in months two and three, rising to USD 100,000 from month 19. Checkout.com lists the Excessive Fraud Merchant program’s 3-D Secure condition: a 3-D Secure share below 10% of clearing volume in non-regulated countries or 50% in regulated ones. Using 3-D Secure therefore matters more for Mastercard’s fraud program than for VAMP, where a fraud report counts either way. Our article on 3DS2 exemptions covers when to request it.

Worked example: an electronics store in an excessive month

Example figures, for illustration only.

An online electronics store acquires in the EU, so since April 2026 its Excessive Merchant level is 1.5% with at least 1,500 counted items. In one month it settles 110,000 Visa card-not-present payments.

Line	Count
Disputes (TC15)	1,050
Less disputes resolved through a pre-dispute service	120
Fraud reports (TC40)	900
Less fraud reports qualifying for Compelling Evidence 3.0	40
VAMP count (1,050 minus 120, plus 900 minus 40)	1,790
VAMP ratio (1,790 ÷ 110,000)	1.63%

Both conditions are met, so the store is Excessive. At the USD 8 per item reported by Chargebacks911, the month would cost USD 14,320 if passed on in full (1,790 × 8). Note the overlap: 300 of the disputed payments also carried a fraud report, so if none of the exclusions touched them, the 1,790 counts come from 1,490 distinct payments.

The same month also had 90,000 card testing attempts among 400,000 authorizations, an enumeration ratio of 22.5%. That is over 20% but under the 300,000 count, so no enumeration identification. If the store had routed 300 more disputes through a pre-dispute service and reversed 150 suspect payments before capture, its count would have been 1,340 (1,790 minus 300 minus 150) and its ratio 1.22%: under both thresholds.

What should you do in the month you get a warning?

Work on what still counts this month, in this order:

1. Stop card testing first. Stripe recommends CAPTCHA on every request that can validate a card, rate limits per IP address, limits on cards per account and login before payment. Refund suspicious test payments that got through.
2. Reverse before capture. Stripe notes issuers are not required to report fraud on an authorization reversed before capture. Hold risky orders authorized, not captured, until reviewed.
3. Resolve before the dispute. Enrol in pre-dispute services and refund alerts quickly, so they fall before Visa’s data extract.
4. Collect Compelling Evidence 3.0 data. IP address, device ID and account ID on every payment, so friendly fraud reports can be excluded.
5. Retry carefully. Stripe warns that heavy retries with a low success rate can look like card testing.
6. Send the acquirer a plan. Stripe offers a remediation template; any plan should name causes, fixes and dates.

What are the common mistakes?

• Watching only disputes. Fraud reports count as much as disputes, and a refunded fraud report still counts.
• Fighting instead of preventing. Winning a dispute does not remove it from the count; resolving it before it becomes one does.
• Measuring against the merchant threshold only. Your acquirer is judged at 0.5% and 0.7% and will act long before you reach 1.5%.
• Assuming every country has the same rules. CEMEA has its own merchant thresholds, and Brazil, Chile and India are still to be announced.
• Cascading suspected fraud. Sending a code that signals fraud to a second acquirer adds authorizations that look like card testing.
• Reading last month’s report as this month’s news. Visa’s data arrives a month late, so track your own estimate daily.

How does Omno help with VAMP?

Omno is not an acquirer and does not report to Visa; your acquirers measure and report your VAMP figures. What Omno can do is control what reaches them. Card blocking stops cards linked to fraud before any provider sees them, PSP eligibility rules by customer group and verification level keep newer or riskier customers away from providers that will not accept them, and fraud scoring, customer rules and limits per provider and method stop risky payments before they are processed. The dashboard and data export show approvals and declines by provider, method and country. The risk controls page lists the settings.