Mastercard has announced changes to its fraud and dispute monitoring programs that will take effect April 1, 2027 when the Acquirer Chargeback Monitoring Program (ACMP) will be replaced with the Global Merchant Audit Program (GMAP). Similar to the Visa Acquirer Monitoring Program (VAMP), GMAP will combine fraud and non-fraud disputes, which Mastercard has been tracking separately, into one performance score. New monitoring categories for merchants and acquirers will also be introduced and there will be a phased tightening of some monitoring thresholds. Simultaneously, Mastercard is strengthening the Questionable Merchant Audit Program (QMAP), which identifies and investigates merchants engaged in fraudulent activity. Changes include lowering the threshold that triggers an investigation, and the timeframe evaluated for fraudulent activity will be shortened. According to Mastercard, the changes to these programs are being made to address fraudulent activity and increase merchant and acquirer accountability.
GMAP Details
GMAP will introduce several changes, including:
- Fraud and non-fraud disputes will be combined into one monitoring framework with a new monthly performance score: (Fraud Reports + Nonfraud Chargebacks)/Previous Month Sales
- The existing ACMP categories Excessive Fraud Merchant (EFM), Excessive Chargeback Merchant (ECM) and High Excessive Chargeback Merchant (HECM) will be folded into GMAP, and there will be a phased tightening of some monitoring thresholds
- Four new categories, including two categories for acquirers, are being introduced: High Dispute Merchant (HDM), Excessive Dispute Merchant (EDM), High Dispute Acquirer (HDA), and Excessive Dispute Acquirer (EDA)
- Monitoring will be based on the submerchant ID when applicable, instead of the merchant ID, for some GMAP categories
To prepare for GMAP, Verisave recommends that merchants review their chargeback and fraud management policies and controls, and they are advised to confer with their processors as the introduction of thresholds for acquirers may cause them to impose new requirements on merchants so they can remain in compliance. Merchants should evaluate whether efforts undertaken to prepare for and comply with VAMP, which was announced in 2024 and launched in 2025, can be used as a template to prepare for GMAP. For more insight on why Mastercard is launching GMAP, how it compares with VAMP and tips on how a merchant can prepare for GMAP see the Verisave blog: GMAP: Frequently Asked Questions.
Details on the different GMAP categories and criteria are as follows:
Excessive Chargeback Merchant and High Excessive Chargeback Merchant Criteria
Starting in 2029, Mastercard is tightening the ECM threshold. According to Mastercard it is taking a phased approach to allow merchants time to adjust. Monitoring will occur at the submerchant level, when applicable. This will allow Payfacs to monitor risk at the submerchant level.
| Excessive Chargeback Merchant | High Excessive Chargeback Merchant | |
|---|---|---|
| # of Chargebacks | >100 chargebacks | >300 chargebacks |
| ECM/HCM Threshold* | No Change: 150-299 bps (1.5%-2.99%) | No Change: ≥300bps |
| 2029 | 130-299 bps (1.3%-2.99%) | No Change: ≥300bps |
| 2030 | 110-299 bps (1.1%-2.99%) | No Change: ≥300bps |
| 2031 | 90-299 bps (0.9%-2.99%) | No Change: ≥300bps |
*Threshold calculation: Mastercard chargebacks in current month/Mastercard sales transactions in previous month
Excessive Fraud Merchant Criteria
Merchants meeting or exceeding all four criteria in a month are classified as an Excessive Fraud Merchant. Monitoring will occur at the submerchant level, where applicable. This will allow Payfacs to monitor risk at the submerchant level.
| Excessive Fraud Merchant | |
|---|---|
| Transaction Volume | ≥1000 ecommerce transactions cleared in previous month |
| Fraud Volume | ≥$50,000 of fraud related chargebacks |
| Fraud Chargeback Threshold* | ≥50 bps (0.50%) |
| EMV 3DS Utilization | Merchant is in non-regulated country and % of clearing volume processed using 3DS is 10% or less, or Merchant is in a regulated country and % of clearing volume processed using 3DS is 50% or less |
*Fraud Chargeback Threshold Calculation: (Mastercard fraud-related chargebacks in the month/Number of Mastercard eCommerce transactions in the preceding month)
NEW – High Dispute Merchant and Excessive Dispute Merchant Criteria
The HDM and EDM categories assess combined fraud and dispute activity at the Merchant ID (MID) level. This includes all transactions reported as fraud to Mastercard's Fraud and Loss Database (including fraud that did not result in a chargeback), as well as non-fraud chargebacks. A merchant meeting or exceeding all three criteria in a month is classified as either a High Dispute Merchant or an Excessive Dispute Merchant, respectively.
| High Dispute Merchant (NEW) | Excessive Dispute Merchant (NEW) | |
|---|---|---|
| Minimum Activity | 5+ cleared transactions | 5+ cleared transactions |
| Combined Dollar Amount | At least $5,000 in fraud (as reported to the Fraud & Loss Database) plus non-fraud chargebacks | At least $10,000 in fraud (as reported to the Fraud & Loss Database) plus non-fraud chargebacks |
| HDM/EDM Threshold* | 500 bps (5.0%) | >5000 bps (50.0%) |
*Threshold Calculation: (Mastercard Fraud Reports + Mastercard Nonfraud Chargebacks)/Mastercard Previous Month Sales
Merchants classified as HDM and EDM will be charged monthly assessments that grow the longer a merchant remains noncompliant. For HDM merchant, fees eventually hit $25,000/month after 19 months, and for EDM, the assessment eventually hits $300,000/month after 19 months. Once a merchant becomes noncompliant for either threshold, an audit is opened, and the monthly counter starts. A merchant needs to stay below the program thresholds for three months to leave the program.
Additionally, when a merchant exceeds the EDM threshold for two months, the merchant will be liable for all fraud-related chargebacks associated with transactions occurring during the three months before identification and fraudulent transactions occurring during the next six months. Mastercard will publish a list of merchants classified as EDM along with the applicable timeframes and issuers will be able to recover 100% of the transaction amount. The liability does not apply to merchants classified as HDM.
NEW – High Dispute Acquirer and Excessive Dispute Acquirer Criteria
GMAP introduces acquirer level monitoring, similar to Visa's VAMP. An acquirer that meets or exceeds all three criteria in a month is classified as a High Dispute Acquirer or an Excessive Dispute Acquirer, respectively.
| High Dispute Acquirer (NEW) | Excessive Dispute Acquirer (NEW) | |
|---|---|---|
| Minimum Activity | ≥1,500 cleared transactions | ≥1,500 cleared transactions |
| Number of Transactions Reported as Fraud or charged back for non-fraud reasons | ≥1,500 | ≥1,500 |
| HDA/EDA Threshold* | ≥50 bps (0.5%) | ≥70 bps (0.7%) |
*Threshold Calculation: (Mastercard Fraud Reports + Mastercard Nonfraud Chargebacks)/Mastercard Previous Month Sales
Acquirers classified as HDA and EDA are charged monthly assessments which grow the longer they remain noncompliant. For HDA, fees eventually hit $50,000/month after 19 months, and for EDA, the assessment eventually hits $100,000/month after 19 months. Once an acquirer becomes noncompliant for either threshold, an audit is opened, and the monthly counter starts. An acquirer needs to stay below the program thresholds for three months to leave the program.
NEW Questionable Merchant Audit Program Framework – April 1, 2027
Effective April 1, 2027, Mastercard is also strengthening the Questionable Merchant Audit Program (QMAP). QMAP addresses merchants suspected of collusive, fraudulent, or otherwise inappropriate transaction activity. After the changes go into effect, QMAP will begin to reach smaller, older merchant accounts and will address fraud over shorter time periods.
Specific changes going into effect April 1, 2027 include reducing the minimum transaction volume for a QMAP case from $50,000 to $10,000 and shortening the standard case period from 120 days to 30 days. Additionally, Mastercard is removing restrictions that limited some criteria to MIDs less than six months old.
| NEW QMAP Framework Effective April 1, 2027 | |
|---|---|
| Transaction Volume | Merchant submitted at least $10,000 in transaction volume during case scope period |
| Transaction Count | Merchant submitted at least five transactions during case scope period |
| One of the Following Applies | For bustout-related situations: at least 50% of the merchant's transaction volume involved the use of cardholder bustout accounts, or Non-bustout conditions: at least two of the following apply — Fraud-to-sales transaction ≥70%; ≥20% of transactions were declined or referred by the issuer; total number or dollar amount of fraudulent transactions, declines, and referrals exceeds approved transactions |
