# Visa VAMP Explained: Thresholds, Ratio, and Fees for Merchants

> Visa's Acquirer Monitoring Program (VAMP) explained: how the VAMP ratio is calculated, the 1.5% merchant threshold in force since April 2026, fees, and how to stay under it.
- **Author**: Deepak Jangir
- **Published**: 2026-10-22
- **Category**: Payments, Chargebacks, Compliance
- **URL**: https://dodopayments.com/blogs/en/visa-vamp-explained

---

The Visa Acquirer Monitoring Program (VAMP) is Visa's single program for policing fraud and disputes on card-not-present transactions. It measures each merchant's VAMP ratio, which is the number of fraud reports plus disputes divided by the number of settled transactions in a month. Since April 1, 2026, a merchant in the US, Canada, Europe, Asia Pacific, or Latin America is flagged as "Excessive" when that ratio reaches 1.5% and the merchant has at least 1,500 fraud reports and disputes in the month. Excessive merchants face fees per fraud report and dispute, plus required remediation.

VAMP replaced two older programs that most payment guides still describe: the Visa Fraud Monitoring Program (VFMP) and the Visa Dispute Monitoring Program (VDMP). The new program counts fraud and disputes together, counts by transaction rather than by dollar amount, and holds acquirers accountable for their whole portfolio. That shift changes which merchants get caught and what it takes to stay safe.

This guide explains how VAMP works, how the ratio is calculated, the thresholds and timeline, what it costs to be flagged, and the practical steps that keep an online business well below the line.

## What VAMP Is and Why Visa Created It

Visa announced VAMP as a consolidation of three earlier programs into one global framework. In Visa's words, the update consolidates "the existing VAMP, Visa Fraud Monitoring Program, and Visa Dispute Monitoring Program into a single global program", with the new thresholds effective June 1, 2025 and an advisory period that ended on September 30, 2025.

Under the old programs, fraud and disputes were tracked separately, and a merchant could sit just under both limits while still having a large combined problem. VAMP closes that gap by adding them together. It also measures **enumeration**, the automated card-testing attacks where fraudsters run thousands of small authorizations to find valid card numbers.

VAMP monitors two levels at once:

- **Acquirers**, the banks that hold merchant accounts, across their entire portfolio.
- **Merchants**, individually, when they cross the merchant thresholds.

That two-level structure matters. If an acquirer's portfolio is above Visa's standard, the acquirer starts passing pressure down to the merchants driving the problem, even merchants that have not crossed the merchant threshold themselves. For background on how those two bank roles differ, see our explainer on [acquiring bank vs issuing bank](https://dodopayments.com/blogs/acquiring-bank-vs-issuing-bank).

## How the VAMP Ratio Is Calculated

The core metric is a single count-based ratio:

```mermaid
flowchart LR
    A["TC40 fraud reports
(count)"] --> C["VAMP count"]
    B["TC15 disputes
(count)"] --> C
    C -->|"divided by"| D["TC05 settled
CNP transactions (count)"]
    D --> E["VAMP ratio"]
```

- **TC40** is a fraud report an issuing bank files with Visa when a cardholder says a transaction was fraudulent. It is filed whether or not the cardholder also disputes the charge.
- **TC15** is a dispute (chargeback) on a card-not-present transaction.
- **TC05** is a settled card-not-present transaction, both domestic and cross-border.

The ratio is calculated monthly from the previous calendar month's VisaNet data. A few details catch merchants out:

- **It is count-based, not dollar-based.** Ten disputed $5 orders count the same as ten disputed $500 orders. Businesses with many small transactions, like AI credits or low-priced apps, feel this most.
- **One bad transaction can count twice.** If a cardholder reports fraud (TC40) and also files a fraud dispute (TC15) on the same purchase, both count toward the numerator.
- **Some disputes are excluded.** Disputes resolved through pre-dispute products such as Visa Rapid Dispute Resolution (RDR), and fraud reports that qualify under Compelling Evidence 3.0, are excluded from the ratio, subject to data extract timing.
- **It only covers Visa card-not-present traffic.** Card-present sales and other networks are outside VAMP, although Mastercard runs its own monitoring programs.

A quick example: a merchant settles 120,000 Visa card-not-present transactions in March. In the same month it receives 1,200 TC40 fraud reports and 700 TC15 disputes. Its VAMP count is 1,900, which is above the 1,500 minimum, and its VAMP ratio is 1,900 / 120,000 = 1.58%. Under the April 2026 thresholds, that merchant is Excessive.

## VAMP Thresholds and Timeline

VAMP phased in its thresholds over 2025 and 2026. These are the merchant thresholds in force today.

| Region | Excessive merchant VAMP ratio | Minimum monthly fraud + disputes |
| --- | --- | --- |
| US, Canada, Europe, Asia Pacific | 1.5% (150 basis points) | 1,500 |
| Latin America and the Caribbean | 1.5% (150 basis points) | 1,500 |
| Central Europe, Middle East, and Africa (CEMEA) | 2.2% (220 basis points) | 150, with a fraud and dispute amount of at least $75,000 |

How the merchant threshold moved:

| Date | Change |
| --- | --- |
| June 1, 2025 | VAMP thresholds take effect: 2.2% for most regions, 1.5% for Latin America and the Caribbean |
| September 30, 2025 | Advisory period ends; enforcement begins |
| April 1, 2026 | Excessive merchant threshold drops to 1.5% in the US, Canada, Europe, and Asia Pacific |

At the acquirer level, Visa flags a portfolio as **Above Standard** at a VAMP ratio of 0.5% and **Excessive** at 0.7%, with the same minimum counts. That is a far tighter line than the merchant threshold. It means an acquirer with many low-risk merchants can still be pushed over by a handful of high-dispute accounts, and it will act on those accounts first.

## The Enumeration Ratio: Card Testing Counts Too

VAMP also tracks enumeration, the bot-driven card testing that often hits checkout pages with free trials or low-priced products.

- **VAMP enumeration ratio** = enumerated authorization attempts (approved and declined) / all authorization attempts (approved and declined).
- A merchant is Excessive at an enumeration ratio of **20% (2,000 basis points)** with at least **300,000 enumerated transactions** in the month.

Visa identifies enumerated transactions with its Visa Account Attack Intelligence model. Card testing does not need to succeed to count: declined attempts are in both the numerator and the denominator. If you have ever seen a sudden burst of $1 authorizations from random cards, that is exactly the pattern this metric catches. Our guide to [card testing fraud](https://dodopayments.com/blogs/card-testing-fraud) covers how to detect and block it.

## What Happens When a Merchant Crosses the Threshold

Being identified in VAMP has two kinds of cost: direct fees and the operational fallout.

**Enforcement fees.** Visa charges acquirers per fraud report and dispute when they or their merchants are in the program, and acquirers pass these costs on. Published acquirer guidance shows fees of $8 per fraud report or dispute for merchants identified as Excessive, and $4 or $8 per item at the acquirer level depending on whether the portfolio is Above Standard or Excessive.

**Grace period.** A merchant identified for the first time typically gets a 90-day remediation window before fees start, provided it has no VAMP identifications in the prior 12 months.

**Operational consequences.** Fees are often the smaller problem. An acquirer under VAMP pressure will tighten terms on the merchants driving its ratio: a rolling reserve, slower payouts, mandatory 3D Secure, or account termination. A terminated merchant can end up on Mastercard's MATCH list, which makes finding a new acquirer much harder. Our guides on [merchant underwriting](https://dodopayments.com/blogs/merchant-underwriting-explained) and [high risk merchant accounts](https://dodopayments.com/blogs/high-risk-merchant-account) explain how those reviews play out.

## Why VAMP Is Harder on Digital Businesses

VAMP applies to every card-not-present merchant, but a few features of software and digital goods businesses make the ratio climb faster:

- **Low average order values.** Because the ratio is count-based, a $3 credit pack that gets disputed weighs as much as a $3,000 annual plan. Businesses with many small transactions need proportionally fewer disputes to hit the line.
- **Friendly fraud.** Digital goods have no shipping record, so "I didn't buy this" claims are common, and each one can create both a TC40 and a TC15. Our guide to [friendly fraud prevention](https://dodopayments.com/blogs/friendly-fraud-prevention) covers the patterns.
- **Free trials and low-friction checkouts.** These attract card testing bots, which drive the enumeration ratio.
- **Forgotten subscriptions.** Customers who do not recognize a renewal charge often dispute instead of cancelling, which is why clear billing descriptors and renewal reminders matter.

## How to Keep Your VAMP Ratio Low

The goal is to stop disputes and fraud reports from being filed in the first place, and to resolve the ones that do arise before they count. Here is the practical checklist.

**1. Resolve disputes before they become chargebacks.** Pre-dispute tools are the single biggest lever, because disputes resolved through them are excluded from the VAMP ratio. Visa RDR refunds eligible disputes automatically, Ethoca alerts let you refund before a chargeback is filed, and Compelling Evidence 3.0 lets the issuer block fraud claims when the same customer has undisputed history with you.

**2. Use 3D Secure where it fits.** Authenticated transactions shift fraud liability to the issuer and discourage casual fraud claims. Our guide to [3D Secure payment authentication](https://dodopayments.com/blogs/3d-secure-3ds-payment-authentication) covers when to require it.

**3. Make charges recognizable.** A clear [statement descriptor](https://dodopayments.com/blogs/statement-descriptor), renewal reminders, and receipts that match the brand the customer knows all cut "don't recognize" disputes.

**4. Make cancellation and refunds easy.** A customer who can cancel in two clicks or get a refund from support does not need to call their bank. Our post on [chargeback vs refund](https://dodopayments.com/blogs/chargeback-vs-refund) explains why a refund almost always costs less.

**5. Block card testing at checkout.** Rate limits, bot detection, and blocking repeated small authorizations from the same device or IP protect the enumeration ratio.

**6. Read your reason codes.** The reason code on each dispute tells you whether you have a fraud problem, a billing clarity problem, or a fulfillment problem. Our [chargeback reason codes reference](https://dodopayments.com/blogs/chargeback-reason-codes) maps each Visa, Mastercard, and Amex code to its usual fix, and the [chargeback prevention guide for SaaS](https://dodopayments.com/blogs/chargeback-prevention-saas) covers the broader playbook.

## How VAMP Works When You Sell Through a Merchant of Record

When you sell through a [merchant of record](https://dodopayments.com/blogs/what-is-a-merchant-of-record), the merchant of record is the legal seller, so transactions run on its merchant accounts and are monitored under its VAMP figures rather than yours. The merchant of record manages the network relationship and runs prevention at the platform level. Your job is to keep your own dispute rate healthy so you stay a good fit for the platform.

On Dodo Payments, three prevention tools work together, and all three keep disputes from counting against VAMP:

- **Visa RDR** is enabled by default with a $100 threshold. Any Visa dispute at or below your threshold is refunded automatically before it becomes a chargeback, and RDR-resolved disputes are excluded from the VAMP count. RDR costs $18 per dispute, compared with $30 for a standard dispute.
- **Ethoca alerts** are opt-in and refund Mastercard and other non-Visa payments automatically when the issuer sends an alert, at $27 per alert.
- **Deflections** block fraud claims on Visa and Mastercard payments before they are filed, using Compelling Evidence 3.0 and Mastercard First-Party Trust. You keep the payment, and a $15 fee applies only when a dispute is actually deflected.

The [disputes documentation](https://docs.dodopayments.com/features/transactions/disputes) explains how to tune the RDR threshold and enroll in Ethoca, and the [pricing page](https://dodopayments.com/pricing) lists every fee.

You can also track disputes in your own systems through webhooks, so support and fulfillment react before a pattern builds. A dispute auto-resolved through RDR arrives as `dispute.lost` with `is_resolved_by_rdr: true`, which is expected and does not count toward VAMP:

```typescript
import DodoPayments from "dodopayments";

const client = new DodoPayments({
  bearerToken: process.env.DODO_PAYMENTS_API_KEY,
  webhookKey: process.env.DODO_PAYMENTS_WEBHOOK_KEY,
});

export async function handleDodoWebhook(rawBody: string, headers: Record<string, string>) {
  const event = client.webhooks.unwrap(rawBody, { headers });

  switch (event.type) {
    case "dispute.opened":
      // A formal dispute counts toward the VAMP numerator: flag the account
      await recordDispute(event.data.dispute_id, event.data.payment_id);
      await pauseAccessPendingReview(event.data.payment_id);
      break;
    case "dispute.lost":
      if (event.data.is_resolved_by_rdr) {
        // Refunded through Visa RDR before a chargeback: excluded from VAMP
        await recordRdrResolution(event.data.dispute_id);
      } else {
        await recordDisputeOutcome(event.data.dispute_id, "lost");
      }
      break;
    case "dispute.won":
      await recordDisputeOutcome(event.data.dispute_id, "won");
      break;
  }
}
```

The [dispute webhooks reference](https://docs.dodopayments.com/developer-resources/webhooks/intents/dispute) lists every event and field, and the [webhooks guide](https://docs.dodopayments.com/developer-resources/webhooks) covers signature verification.

## FAQ

### What is the VAMP threshold for merchants in 2026?

Since April 1, 2026, a merchant in the US, Canada, Europe, Asia Pacific, or Latin America is flagged as Excessive at a VAMP ratio of 1.5% with at least 1,500 fraud reports and disputes in the month. In Central Europe, the Middle East, and Africa the threshold is 2.2%, with at least 150 fraud reports and disputes worth $75,000 or more.

### Does VAMP replace VDMP and VFMP?

Yes. VAMP consolidated the Visa Dispute Monitoring Program and the Visa Fraud Monitoring Program into a single global program, with thresholds effective June 1, 2025 and enforcement after an advisory period that ended September 30, 2025. Older guides that quote separate dispute and fraud thresholds describe the retired programs.

### Do refunds count toward the VAMP ratio?

A normal refund issued before the customer contacts their bank does not create a dispute, so it does not count. Disputes resolved through pre-dispute products such as Visa RDR are also excluded, which is why automatic pre-dispute refunds are one of the most effective ways to protect your ratio.

### How long does a merchant stay in VAMP?

A merchant stays identified for every month its ratio remains above the threshold, and fees apply for each of those months after any grace period. First-time identifications usually get a 90-day remediation window, provided the merchant has no VAMP identifications in the prior 12 months.

### Does VAMP apply to Mastercard transactions?

No. VAMP covers Visa card-not-present transactions only. Mastercard runs its own excessive chargeback and fraud monitoring programs with different thresholds, so merchants need to watch both networks separately.

## Conclusion

VAMP is stricter than the programs it replaced: fraud and disputes are counted together, every transaction counts the same regardless of value, and the merchant threshold in most regions has been 1.5% since April 2026. For digital businesses with small transactions, friendly fraud, and trial-driven checkouts, staying under the line depends on stopping disputes before they are filed and resolving the rest before they count.

If you would rather not manage network monitoring yourself, a merchant of record runs that layer for you. [Dodo Payments](https://dodopayments.com) includes Visa RDR by default, offers Ethoca alerts and deflections, and handles disputes as the legal seller. Start with the [integration guide](https://docs.dodopayments.com/developer-resources/integration-guide) or compare costs on the [pricing page](https://dodopayments.com/pricing).
---
- [More Payments articles](https://dodopayments.com/blogs/category/payments)
- [All articles](https://dodopayments.com/blogs)