If your business takes credit card payments online, there’s an important update you need to know about. On April 1, 2025, Visa launched a new set of rules called VAMP, which is short for Visa Acquirer Monitoring Program. These rules are designed to help stop fraud, but they also mean stricter rules for businesses like yours.
Let’s review what’s changing and how you can stay out of trouble.
What is VAMP?
Visa used to watch for fraud and chargebacks separately, using two different programs. Now, they’re combining everything into one system called VAMP. It helps Visa track when merchants have too many payment problems—like fraud or disputes—so they can act quickly if something looks risky.
VAMP also looks at enumeration attacks, specifically. This is when bad actors try lots of small payments using stolen or guessed credit card numbers to see which cards work. Even if the payments end up declining, they still trigger an enumeration alert and risk lowering their approval rate.
Why is Visa doing this?
Visa wants to cut down on fraud and protect the payment network. Instead of trying to watch every business themselves, they are asking acquirers (the financial institutions that give businesses the ability to take card payments through merchant accounts) to do more of the work.
That means your acquirer will be keeping a much closer eye on your payment activity. If you have too many problems, you could face higher fees—or even lose your ability to process payments.
The Two New Ratios You Need to Know
Under VAMP, Visa will now track two important numbers for each business:
- The VAMP Ratio – This shows how many of your total transactions turn into fraud or disputes.
- Starting April 2025, you’ll be in trouble if this number is over 1.5%.
- In January 2026, the limit drops to 0.9%.
- The Enumeration Ratio – This shows how often your site gets hit with card testing attacks.
- If 20% or more of your transactions are flagged as possible fraud, you’ll be labeled high risk.
- If 20% or more of your transactions are flagged as possible fraud, you’ll be labeled high risk.
Here’s the twist: even declined payments will count toward these numbers. That means fraud attempts can hurt your business whether they succeed or not.
What Happens if you Don't Follow the Rules?
If your numbers go over the limits, Visa might take serious action. You could get hit with fines or face other penalties. In some cases, your business might even be added to Visa’s MATCH list, which makes it almost impossible to get a new merchant account in the future.
Previously, Visa penalized big companies or those who clearly ignored best practices. But under VAMP, even smaller businesses with just a few problems could get flagged. That’s because Visa is now watching the acquirers, and those acquirers will be extra strict with merchants to protect themselves.
How Can You Stay Compliant?
The key is to stop problems before they happen. You should:
- Use strong fraud tools that watch for things like too many signups from the same IP address or region.
- Make sure your payment systems are set up correctly so they don’t look suspicious to Visa.
- Watch your failed payments closely, and fix anything that could be causing declines.
- Take Enumeration Alerts seriously—these are warnings from Visa that fraud might be happening on your account.
In short: don’t just focus on getting new customers. You also need to protect your payment system from fraud and keep your chargeback numbers low.
Dive Deeper
Just before the Visa launched their program, we hosted a webinar diving into this topic that you can now In the webinar, we discuss the latest compliance requirements and what they mean for your business. And we outline the best practices you should implement to optimize renumeration rates while staying compliant.
We were happy to get questions from several attendees, as well as from people on LinkedIn. We wanted to ensure this information was accessible to the wider community, so here’s a roundup of these questions and our answers.
Questions and Answers
Q: Megan asked, “Is the chargeback ratio the same as the VAMP ratio?”
A: Not quite. They may sound similar, but they measure different things. The VAMP ratio adds up the dollar value of all your fraud and non-fraud disputes, then divides that by your total approved sales. For now, that number has to stay below 1.5%, and next year it drops to 0.9%.
Older systems used to separate out fraud and chargebacks and even track them by count. But with VAMP, Visa combines them into one simple calculation. It’s all about understanding how much of your approved revenue is tied to disputes—and keeping that number low.
Q: Yousaf asked, “Aren’t most acquirers already below the 30 basis points threshold?”
A: This year, Visa set the threshold for acquirers (merchant account providers like Checkout.com or Adyen) at 0.5%. Next year, it gets stricter at 0.3% (aka 30 basis points).
Yes, many acquirers are already under that limit—but a big reason is that much of their volume comes from low-risk transactions, like in-person payments. On the flip side, some acquirers work with high-risk businesses, which pay more in processing fees because they’re riskier to handle.
As Visa tightens the rules, those acquirers may need to rethink how much high-risk business they take on. The goal? Reduce overall fraud and keep the payment ecosystem healthy.
Q: Augustin asked, “How can subscription merchants turn VAMP compliance into a competitive edge?”
A: Great question! Staying compliant with VAMP isn’t just about avoiding penalties—it’s actually a smart way to stand out. Merchants who take fraud prevention seriously are more likely to be trusted by partners, customers, and card networks like Visa.
Using tools like smarter retry logic and proactive fraud filters doesn’t just reduce fraud—it can help you keep more customers and boost their lifetime value. In short, doing the right thing for compliance is also the right thing for your business growth.
Q: Alysson asked, “What should SaaS companies with embedded payments watch out for?”
A: Two big things: losing your MID (Merchant ID) and seeing your approval rates drop. Either one can seriously damage your business.
Losing your MID often comes from too many chargebacks, which tells payment processors your business is risky. Low approval rates are also a red flag—they mean less revenue and unhappy customers.
If you’re a SaaS company handling payments, you need a system that cuts down chargebacks and improves authorization success. (Psst—FlexPay can help with that!)
Q: Jared asked, “Do RDR and CDRN disputes count toward the VAMP ratio? And what’s the difference between TC40 and TC15?”
A: Only some do. RDR (Rapid Dispute Resolution) and CDRN (Cardholder Dispute Resolution Network) can affect your VAMP score, but only when the case is marked as a TC40—meaning it’s confirmed fraud.
If the dispute is a “friendly fraud” or something non-fraud-related, it won’t count. For context:
- TC40 = fraud chargeback
- TC15 = non-fraud chargeback
Right now, only TC40s count toward your VAMP ratio. But this guidance can change, so it’s important to stay in the loop.
Q: Yousef asked, “Will Visa change its mind about including RDR fraud alerts in the VAMP ratio?”
A: It doesn’t look like it. Visa originally said RDR and CDRN alerts wouldn’t count—but later clarified that confirmed fraud (TC40) cases will be included.
Visa wants to find and fix fraud-heavy accounts. That means if a fraud case comes in through RDR, it’s going to impact your VAMP score. If you want to avoid problems, the best move is to have a strong fraud prevention plan in place—ideally with help from a risk management partner.
Q: Megan asked, “How does Visa know when card testing is happening?”
A: Visa uses AI and rule-based systems to flag weird activity. For example, if you normally see 100 transactions a day and suddenly hit 1,000 in an hour—that’s a red flag.
Fraudsters often use stolen cards in bulk, trying to test which ones still work. These attacks are fast, intense, and often easy to spot. Visa looks for patterns like these and takes action.
Good news: Visa knows the difference between a legitimate business retrying a declined subscription payment and a scammer running card tests. Subscription retries are usually low-risk Merchant-Initiated Transactions (MITs), while card testing involves riskier Customer-Initiated Transactions (CITs). Visa focuses on the latter.
Q: Megan asked, “Is Visa mostly trying to stop large-scale card testing?”
A: Exactly. They’re focused on stopping attacks where a system is used to test thousands of stolen cards in a matter of minutes.
Q: Sebastien asked, “Are the 1.5% thresholds enforced per MID?”
A: Yes, mostly. Visa tracks the VAMP ratio on a per-MID (Merchant ID) basis. But if you have multiple MIDs under the same acquirer, and they’re not clearly separate businesses, those accounts might be grouped together.
Acquirers (your payment processor) have some say in how they enforce this. If they see that multiple MIDs are being used in risky ways, like passing transactions around to avoid penalties, they can treat them as a single entity.
If your MIDs are with totally different acquirers, they’ll be reviewed separately. But the key takeaway is the fact that acquirers are responsible for managing risk, and they’ll act based on the bigger picture.
Q: Kurt asked, “What’s the deal with the “1,000 dispute” number?”
A: That number relates to when Visa will apply its VAMP thresholds. Merchants or acquirers that hit 1,000 or more combined fraud and non-fraud disputes in a month may fall into Visa’s “Excessive” or “Above Standard” risk categories. If you’re over the VAMP ratio and also crossing that 1,000-dispute mark, it’s likely you’ll face scrutiny or enforcement actions.
Q: Kurt asked, “What is a TC40?”
A: TC40 is Visa’s way of marking a confirmed fraud case. When a fraud happens on a credit card, a TC40 report is created and used to help Visa and banks analyze and track fraud trends.
Final Thoughts
Visa’s new VAMP rules mean the bar has been raised for everyone. Even if you’ve never had issues before, now’s the time to check your systems, update your fraud tools, and make sure you’re playing by the rules. Being prepared now can help you avoid major problems later—and keep your payments rolling in smoothly.
Download our guide for the full story about VAMP and learn how to adapt your payment recovery to Visa’s new standards.
