Visa VAMP 2026: New Chargeback Thresholds and How to Stay Under 1.5%
July 26, 2026
If you take card payments, the number that decides whether your processor sees you as a good account or a liability just got harder to hit. On April 1, 2026, Visa lowered the excessive merchant threshold under its Acquirer Monitoring Program (VAMP) from 2.2% to 1.5%. That is roughly a one-third cut to the headroom you have before fees and scrutiny kick in, and it landed overnight.
Here is the short version: VAMP now folds fraud reports and disputes into a single ratio, the ceiling for merchants is 1.5%, acquirers answer to a much tighter 0.5%, and the transactions you prevent or deflect before they become disputes are worth more than ever. The rest of this post walks through exactly how the ratio works, what counts, what does not, and what to actually do about it.
What VAMP replaced, and why it matters
For years Visa ran two separate programs. The Visa Dispute Monitoring Program (VDMP) watched your chargeback rate. The Visa Fraud Monitoring Program (VFMP) watched your reported fraud. You could be fine on one and in trouble on the other, and the two rarely talked to each other.
VAMP collapsed both into one measurement. Reported fraud and non-fraud disputes now sit in the same numerator, so a card-testing wave and a batch of angry-customer chargebacks push the same needle. For teams that used to treat fraud and disputes as separate problems owned by separate people, that consolidation is the real shift. There is now one number that captures both, and it is the number your acquirer watches.
The VAMP ratio, in plain terms
The formula is straightforward:
VAMP ratio = (TC40 fraud reports + TC15 disputes) / total settled sales
TC40 is the fraud advice record a card issuer files when a cardholder reports a transaction as fraudulent. TC15 is a non-fraud dispute, the classic chargeback for reasons like "product not received" or "not as described." Add them together, divide by the count of sales you settled that month, and that is your ratio.
A worked example makes the stakes concrete. Say you settle 40,000 transactions in a month. At the old 2.2% ceiling you could absorb up to 880 combined fraud and dispute events before hitting excessive status. At 1.5%, that budget falls to 600. Same business, same volume, 280 fewer problems allowed.
The 2026 thresholds you need to know
The thresholds differ depending on whether Visa is looking at you as a merchant or at your acquirer as a whole.
| Party | Tier | Ratio | Applies when |
|---|---|---|---|
| Merchant | Excessive | 1.5% (2.2% in CEMEA) | 1,500+ combined fraud/dispute items in a month |
| Acquirer | Above Standard | 0.5% to under 0.7% | 1,500+ combined items across the portfolio |
| Acquirer | Excessive | 0.7% and above | 1,500+ combined items across the portfolio |
Two dates matter. Acquirer above-standard enforcement began on January 1, 2026, and the tighter 1.5% merchant threshold took effect on April 1, 2026.
Notice the gap between the merchant number (1.5%) and the acquirer number (0.5%). That gap is the part most teams miss, and it is covered below.
Fees and the grace period
Once you cross a threshold and the minimum count applies, Visa assesses per-transaction fees on your card-not-present fraud and dispute items:
- Above Standard: $4 per item
- Excessive: $8 per item
Those add up fast. A merchant with 2,000 combined items in an excessive month is looking at $16,000 in fees on top of the lost revenue, the refunded amounts, and the operational cost of fighting the disputes in the first place.
There is one piece of breathing room. For a first-time violation inside a rolling twelve-month window, Visa grants a three-month grace period to remediate before fees apply. Treat that window as a countdown, not a reprieve. You are also expected to file a remediation plan quickly, typically within about fifteen days of notice.
Why Stripe and smaller merchants are not off the hook
Read the merchant floor again: enforcement applies once you hit 1,500 combined fraud and dispute items in a single month. Plenty of businesses never reach that. It would be easy to conclude VAMP is only an enterprise problem.
It is not, and the reason is the acquirer number. Your acquirer, and any processor sitting on top of it like Stripe, Adyen, or Braintree, has to keep its entire portfolio under 0.5% for the above-standard tier. One merchant running hot enough drags that portfolio ratio up and threatens everyone in the book. Processors will not accept that risk. So they push the enforcement downward, applying stricter internal dispute-rate limits to individual accounts, long before Visa would ever look at you directly.
In practice that means the effective ceiling you should manage to is not 1.5%. It is closer to the 0.65% to 0.9% range that processors already flag, and the safest position is comfortably below it. If you want a deeper walkthrough of hitting that target, we cover it in how to reduce your Stripe chargeback rate below 1%.
What does not count: the levers that actually move your ratio
The most useful detail in the 2026 rules is what Visa excludes from the numerator. Three things do not count against you:
- Disputes you resolve through Rapid Dispute Resolution (RDR).
- Disputes deflected via the Cardholder Dispute Resolution Network (CDRN) before they become chargebacks.
- Reason code 10.4 fraud disputes that you win using Compelling Evidence 3.0.
This changes the economics of prevention. Every dispute you stop or deflect before it settles is a dispute that never enters your ratio, which is worth far more than winning it after the fact. Prevention is not just cheaper than representment now, it is the only path that keeps the number itself down.
That splits your work into two tracks:
- Stop the transaction before it happens. Screen for stolen cards, mismatched geolocation, disposable emails, and high-risk IPs at checkout, so the fraudulent sale never settles and never generates a TC40. This is where a pre-transaction risk check earns its keep.
- Deflect and defend what slips through. Wire up RDR and CDRN so eligible disputes resolve outside the ratio, and prepare Compelling Evidence 3.0 responses for 10.4 fraud claims. Our guide on how to fight a Stripe chargeback and win covers the evidence side.
Do not forget the enumeration ratio
VAMP also tracks a separate enumeration ratio aimed squarely at card-testing attacks, where fraudsters run thousands of tiny authorizations to find live card numbers. It is measured as the count of enumerated transactions over total sales, independent of your fraud and dispute ratio.
Card testing is dangerous under VAMP for a compounding reason: the attack spikes your enumeration ratio now, and the successful guesses turn into fraudulent purchases and TC40 reports that hit your main ratio later. Blocking these attacks at the edge protects both numbers at once. If your checkout has seen bursts of small failed payments, start with preventing card-testing attacks.
A short playbook for the next quarter
None of this requires a fraud team. It requires putting a few checks in the right places and watching the right number.
- Measure the real ratio weekly. Pull your TC40 and TC15 counts against settled sales and track the combined figure, not fraud and disputes separately. If your processor only shows a monthly dispute rate, calculate the fraud side yourself.
- Add screening before the charge, not after. Validate the email, check the IP for VPN and proxy signals, and confirm the billing geolocation lines up before you capture payment. A single risk score at checkout removes most of the transactions that would otherwise become TC40 records.
- Turn on deflection. Enroll in RDR and CDRN so eligible disputes never enter the ratio.
- Standardize your evidence. Have a Compelling Evidence 3.0 template ready for 10.4 fraud claims so you are not assembling it under a deadline.
- Watch the trend, not just the month. VAMP looks at rolling performance. A single bad week is recoverable if the trend is down; a slow climb is what gets you flagged.
Where Fidro fits
Fidro is built for exactly the prevention track that VAMP now rewards. One API call at signup or checkout returns a clear risk score and recommendation from combined email validation, IP and geolocation analysis, blocklists, and Stripe-focused chargeback signals, so you can decline or challenge the risky transactions before they ever settle and count against your ratio.
If you are staring at a rising dispute rate under the new thresholds, that is the fastest lever you have. Start with the email checker to see the signal on a single address, read the fraud prevention use cases for patterns specific to your model, or wire it in with the API docs. For the broader strategy, how chargeback fraud works and how to prevent it is a good next read.
The 1.5% line is not going back up. The teams that stay comfortably under it in 2026 will be the ones that moved their fraud work upstream, into the moment before the charge, where a blocked transaction never becomes a number you have to explain.
