Mastercard has announced it is replacing its existing fraud and dispute monitoring programs with the new Global Merchant Audit Program (GMAP), effective April 1, 2027.
Similar to the Visa Acquirer Monitoring Program (VAMP), GMAP will measure both fraud activity and disputes filed for non-fraud reasons. It also introduces new monitoring categories for merchants and acquirers, tightens thresholds for merchant chargeback monitoring, and introduces broader recovery rights for issuers in severe cases.
The Global Merchant Audit Program (GMAP) is Mastercard's new framework for monitoring fraud and disputes at the merchant and acquirer levels. It will replace the Acquirer Chargeback Monitoring Program (ACMP), and Mastercard’s current fraud and dispute monitoring programs for merchants will be folded into the new GMAP framework.
Mastercard will retire ACMP in its present form and move three existing categories into GMAP:
GMAP will also add four new categories centered on combined fraud and dispute activity:
Mastercard’s Excessive Fraud Merchant (EFM), Excessive Chargeback Merchant (ECM), and High Excessive Chargeback Merchant (HECM) categories will continue under the new Global Merchant Audit Program, but Mastercard will be implementing stricter monitoring thresholds for the ECM category. In addition, monitoring will now be based on the submerchant ID when available instead of the merchant ID (MID).
This last change is particularly relevant to payment facilitators and other acquiring arrangements in which many submerchants process under a shared MID. Monitoring at the submerchant level gives Mastercard and acquirers a clearer view of the business generating the problematic activity. It therefore makes it more difficult for high-risk business to “hide” from monitoring programs by being grouped with other merchants under the same MID.
Mastercard will lower the ECM ratio threshold in stages:
|
Effective period |
ECM ratio range |
|
2027 and 2028 |
No change: 150 to 299 basis points (1.5%-2.99%) |
|
2029 |
130 to 299 basis points (1.3%-2.99%) |
|
2030 |
110 to 299 basis points (1.1%-2.99%) |
|
2031 |
90 to 299 basis points (0.9%-2.99%) |
The minimum requirement of at least 100 chargebacks remains unchanged. The threshold for the HECM category will remain at 300+ basis points (3%).
The new HDM and EDM categories assess combined fraud and dispute activity at the Merchant ID (MID) level. The acquirer categories assess activity across an acquirer's portfolio using its Interbank Card Association number (ICA). For merchants, thresholds for these new categories are less strict than for the existing Excessive Chargeback Merchant category.
The new monitoring categories apply based on a measurement that includes all transactions reported as fraud to Mastercard's Fraud and Loss Database, including fraud that does not result in a chargeback, plus chargebacks filed for non-fraud reasons.
The High Dispute Merchant and Excessive Dispute Merchant categories use the same three-part structure: a minimum number of cleared transactions, a minimum combined dollar amount, and a ratio based on transaction counts. A merchant must meet or exceed all three criteria in a month to enter the applicable category.
|
Category |
Minimum activity |
Combined dollar amount |
Ratio |
|
High Dispute Merchant |
5+ cleared transactions |
At least $5,000 in reported fraud plus non-fraud chargebacks |
500+ basis points (5%+) |
|
Excessive Dispute Merchant |
5+ cleared transactions |
At least $10,000 in reported fraud plus non-fraud chargebacks |
5,000+ basis points (50%+) |
Unlike Mastercard's ECM standards, the HDM and EDM categories can capture merchants with a small transaction count when their fraud and dispute activity is severe. Five or ten sales can be enough when the dollar and ratio tests are also met.
HDM identification carries escalating monthly assessments:
|
Months exceeding the HDM threshold |
Monthly assessment |
|
1-6 |
$0 |
|
7-11 |
$5,000 |
|
12-18 |
$10,000 |
|
19+ |
$25,000 |
EDM assessments begin immediately and rise much faster:
|
Months exceeding the EDM threshold |
Monthly assessment |
|
1 |
$5,000 |
|
2 |
$25,000 |
|
3-11 |
$100,000 |
|
12-18 |
$200,000 |
|
19+ |
$300,000 |
Once a merchant becomes noncompliant, Mastercard opens an audit and starts a monthly counter. The merchant must remain compliant with both thresholds for three consecutive months before the audit closes and the counter resets. A later breach during that period can keep the audit open and allow assessments to increase.
The assessment schedule is only one part of EDM exposure. If a merchant exceeds the EDM threshold for two months, Mastercard the merchant becomes liable for all fraud-related chargebacks tied to transactions occurring during the three months before identification. The merchant will also be liable for fraudulent transactions occurring during the next six months.
Mastercard plans to publish a list of EDM merchants and the applicable timeframes. Issuers may use chargeback reason code 4849, Questionable Merchant, to recover 100% of the transaction amount whenever a dispute arises.
At the lower HDM threshold, the automatic liability doesn’t apply. However, Mastercard may notify issuers about merchants that exceed the HDM threshold for two consecutive months. That notice may bring additional issuer attention to the merchant's transactions even before the merchant reaches EDM status.
GMAP also measures each acquirer's portfolio. Both categories apply only to acquirers with at least 1,500 cleared transactions and at least 1,500 transactions reported as fraud or charged back for non-fraud reasons during the month.
An acquirer is classified as a High Dispute Acquirer when the combined transaction count equals at least 50 basis points, or 0.5% of sales from the previous month. The Excessive Dispute Acquirer threshold is 70 basis points, or 0.7%.
|
Months exceeding the HDA threshold |
Monthly assessment |
|
1 through 11 |
$0 |
|
12 through 18 |
$25,000 |
|
19+ |
$10,000 |
|
Months exceeding the EDA threshold |
Monthly assessment |
|
1-2 |
$0 |
|
3-6 |
$10,000 |
|
7-11 |
$25,000 |
|
12-18 |
$50,000 |
|
19+ |
$100,000 |
As with merchant audits, an acquirer must remain below both thresholds for three consecutive months before an audit closes and its counter resets.
An acquirer that remains noncompliant for at least 12 months may be required to complete a Franchise Management Program review at its own expense and correct identified problems. Noncompliance lasting at least 19 months can lead to restrictions, suspension, or termination of its Mastercard license.
Mastercard is also revising the Questionable Merchant Audit Program (QMAP) on the same April 1, 2027 effective date. QMAP addresses merchants suspected of collusive, fraudulent, or otherwise inappropriate transaction activity.
The minimum transaction volume for a QMAP case will fall from $50,000 to $10,000. The standard case period will decrease from 120 days to 30 days, although Mastercard may extend it to 60 days when further analysis is needed. Mastercard is also removing the rule that limited non-bustout merchant identification to businesses less than six months old.
Under the revised definition, a Questionable Merchant must submit at least five transactions totaling at least $10,000 during the case period. Bustout cases require at least half of the merchant's volume to involve cardholder bustout accounts. Other cases must satisfy at least two of three tests involving a fraud-to-sales ratio of 70% or higher, a decline or referral rate of at least 20%, or fraudulent transactions, declines, and referrals exceeding approved transactions by count or dollar amount.
These rules allow QMAP to reach smaller and older merchant accounts and address concentrated fraud over a shorter period.
GMAP will gradually bring a larger group of merchants within Mastercard’s chargeback monitoring programs. The most direct change comes from the phased reduction of the Excessive Chargeback Merchant (ECM) threshold. By the end of the implementation period, the threshold will have fallen all the way from 1.5% to 0.9%.
In addition, merchants operating primarily or exclusively through payment facilitators may receive closer scrutiny at the submerchant level under the revised monitoring rules.
For some merchants, chargeback ratio requirements may become stricter even before the ECM threshold is reduced. GMAP’s portfolio-level monitoring for acquirers, with a High Dispute Acquirer threshold of 0.5%, may put acquirers that primarily serve high-risk merchants at significant financial risk. Some of these acquirers may establish internal merchant limits below Mastercard’s published thresholds.
GMAP’s new dispute monitoring categories also require high-risk merchants to track a broader set of data than conventional chargeback ratios provide. Fraud reports can contribute to the new dispute categories even when no chargeback is filed. Merchants will therefore need Mastercard-specific reporting that incorporates data from Mastercard’s Fraud and Loss Database, non-fraud chargebacks, and the prior month’s sales count.
GMAP gives merchants and acquirers until April 2027 to prepare for the new dispute categories, while the staged ECM reductions begin in 2029. That interval provides time to establish reporting, set internal warning levels, revise merchant agreements where needed, and address recurring sources of fraud and disputes before the new standards take effect.