Visa VAMP 2025–2026: The Complete Merchant Guide to Staying Compliant

Visa's Acquirer Monitoring Program (VAMP) is a fraud and dispute tracking system that came into full effect in June 2025. It combines two previously separate measures — fraud reports (TC40) and disputes (TC15) — into a single ratio calculated against your total settled transaction count.

The threshold just got tighter. Starting April 1, 2026, the Excessive threshold for EU and US merchants dropped from 2.2% to 1.5% — a 32% reduction in margin. If you were sitting at 1.8% and feeling safe, you are now in violation territory.

How VAMP is calculated

The VAMP Ratio is straightforward:

• →TC40 — number of card-not-present fraud transactions reported by issuers
• →TC15 — number of card-not-present disputes filed
• →Total Sales Count — number of settled transactions in the same period

Two important exclusions from the calculation:

• ✓Disputes resolved through pre-dispute products (Verifi RDR, Order Insight)
• ✓Fraud reports where you have submitted qualifying Compelling Evidence 3.0

This means your actual exposure is often lower than the raw numbers suggest — but only if you are actively using these tools.

VAMP thresholds by region (as of April 2026)

Additional criteria: minimum 1,500 monthly transactions per descriptor to be assessed. Merchant Excessive level only applies if the acquirer's own VAMP ratio is below 50bps.

What happens when you breach the threshold

Breaching the VAMP threshold triggers a multi-stage process:

The two types of chargebacks driving your VAMP ratio

Understanding why your ratio is elevated is the first step to fixing it. Almost all VAMP issues trace back to two root causes.

Part 1: Reducing friendly fraud

1. Fix your billing descriptor first

When a customer sees an unfamiliar charge on their statement, they call their bank — not you. The billing descriptor is your first line of defense.

Visa allows up to 22 characters. Your descriptor should include your brand name (or website domain) and, if space allows, a support number. Test the descriptor yourself: make a small charge to your own card and check how it appears in your banking app.

• Descriptor matches your website/brand name exactly
• Contact info included if space allows
• Tested on mobile banking app (not just web)
• Same descriptor used consistently across all recurring charges

2. Set crystal-clear expectations at checkout

The most dangerous phrase in subscription commerce is "fine print." If billing terms require scrolling or clicking, customers will claim they never saw them.

• Trial terms visible without scrolling on desktop and mobile
• Active consent checkbox (not pre-ticked)
• Exact dates and amounts shown, not ranges
• Support contact visible on the checkout page

3. Send receipts and reminders on every charge

A receipt email arriving within minutes of a charge can prevent dozens of disputes per month. Some customers will cancel after a reminder — that's a good outcome. A cancelled subscriber costs you nothing; a disputed charge costs $15–$50 in fees alone, plus time.

Every receipt should include: amount charged, card last 4 digits, billing period, next charge date, and a one-click cancellation link. For trials, send a reminder 3–7 days before the paid conversion.

• Receipt sent within 5 minutes of every charge
• Receipt includes cancellation link
• Trial-end reminder scheduled 3–7 days before conversion
• Annual subscribers receive renewal reminder 14 days before

4. Make cancellation frictionless

If cancellation is hard, customers don't cancel — they dispute. This is the most reliable way to generate friendly fraud at scale.

• Cancel option findable within 2 clicks from account page
• No support contact required to cancel
• Cancellation confirmation email sent automatically
• Process tested manually every quarter

5. Use Visa's pre-dispute tools

This is the highest-leverage action most merchants haven't taken. Two Visa programs can remove disputes from your VAMP calculation entirely.

• Enrolled in Visa Order Insight
• RDR configured with appropriate auto-refund rules
• CE 3.0 data collection in place (device ID, IP, user ID stored per transaction)

Part 2: Reducing true fraud

6. Fraud screening and 3-D Secure

Every CNP transaction carries fraud risk. Your goal is to block stolen cards before they settle, without rejecting too many legitimate customers. Use a layered approach: basic validation (CVV, AVS), risk scoring (velocity checks, IP/billing country mismatch, disposable email detection), then selective 3DS for high-risk signals.

3DS doesn't just deter fraud — for authenticated transactions, fraud liability shifts to the issuer. TC40 reports for authenticated transactions don't count against you.

• Velocity limits configured (max failed attempts per IP per hour)
• 3DS enabled for high-risk countries and high-value transactions
• IP geolocation check active
• Device fingerprinting in use

7. Guard against card testing (Enumeration attacks)

Card testing bots use your checkout to validate stolen card numbers at scale. This inflates your TC40 count and — critically — your VAMP Enumeration Ratio, which has a separate 20% threshold.

• Rate limiting on payment attempts per IP (max 3–5 failed per 10-minute window)
• CAPTCHA or invisible bot detection on checkout
• Automatic IP blocking when threshold exceeded
• BIN-level monitoring in place

8. Police high-risk geographies and traffic sources

One rogue affiliate or one high-fraud geography can push your monthly ratio above threshold on its own. Apply stricter rules for first-time transactions from higher-risk regions (3DS, lower velocity limits, manual review for high values). This doesn't mean blocking — it means calibrating friction to risk.

Track chargeback rate by acquisition source. If a specific affiliate is sending traffic that converts at 4% chargeback rate, that affiliate is costing you far more than their commission. Set contractual thresholds and terminate sources that breach them.

• Geo-specific fraud rules configured for higher-risk markets
• Chargeback rate tracked by acquisition channel and affiliate
• High-fraud affiliates terminated or placed on contractual hold
• Consider local acquiring for high-volume high-risk markets

Full implementation checklist

Use this to audit your current setup. Each unchecked item is risk.

How ChargeMate helps with VAMP compliance

ChargeMate is built around the evidence that wins disputes and the workflows that prevent them.

• ✓AI-generated dispute responses — Built on Compelling Evidence 3.0 logic — pulling device ID, IP, and transaction history automatically to construct the strongest possible response or pre-dispute evidence package.
• ✓Dispute analytics — Show your VAMP ratio in real time, broken down by reason code, processor, and geography — so you see which disputes are affecting your ratio and which are excluded.
• ✓Works with any processor — Unlike tools that only function with Stripe or Shopify Payments, ChargeMate connects to any payment processor. Your VAMP risk does not depend on who processes your cards.
• ✓Flat $10/case pricing — No monthly fee, no percentage of revenue. You know exactly what dispute management costs.

VAMP vs VDMP: what changed in June 2025

If you're seeing "VDMP" in older contracts, acquirer documentation, or search results, it refers to the Visa Dispute Monitoring Program — the program VAMP replaced. VDMP existed alongside a separate program, VFMP (Visa Fraud Monitoring Program), which tracked fraud reports independently. VAMP merged both into a single combined ratio.

The practical takeaway: because VAMP's numerator includes fraud reports on top of disputes, a merchant with a clean dispute history but a rising fraud-report count can trigger VAMP even if they would have stayed under the old VDMP threshold. Don't assume your VDMP-era numbers still apply — recalculate using the VAMP calculator.

Frequently asked questions