Payments · Guide8 min readUpdated November 2, 2026

Fraud Prevention and 3D Secure for High-Risk Merchants

The 2026 fraud limits from Visa and Mastercard (VAMP, Visa Secure, EFM, MATCH 5), what counts toward them, and where 3D Secure keeps you below them.

Nick Bonnassies, CMO at Tagada · checked against 8 sources

Article summary

TL;DR

Card networks measure your fraud, not just your chargebacks. In 2026, Visa flags US merchants at 1.5% fraud reports plus disputes, removes the 3DS liability shift above 0.9% fraud on authenticated sales, and Mastercard fines merchants with 0.5% fraud chargebacks and little 3D Secure. Use 3DS on risky orders, not everywhere, to stay below.

Visa's VAMP ratio adds fraud reports (TC40) to disputes; the merchant "Excessive" level is 1.5% and 1,500 cases in the US since April 1, 2026.
Visa Secure Excessive Fraud (US) starts at $75,000 and 0.9% fraud on 3DS-authenticated sales; you lose the liability shift on domestic 3DS payments until you exit.
Mastercard EFM applies from 1,000 ecommerce payments, over $50,000 and 0.50% fraud chargebacks, when 3DS covers 10% or less of payments (50% in regulated countries).
MATCH code 5 lists a closed merchant whose fraud reaches 8% of sales, with 10 or more fraud transactions and $5,000 or more in a month.
Under Visa's October 2026 rules, an issuer can dispute transactions flagged by a monitoring program for 120 days after the report.

Want to go further? Ask

On this page

This page is about the limits and the decisions they force. For how 3DS works, see what 3D Secure is. For the types of fraud and how to spot them, see ecommerce fraud prevention.

The fraud limits that matter in 2026

Five programs decide what happens to a merchant with too much fraud. Each counts something different, so check all five.

Program	What it counts	Merchant threshold, 2026	What follows
Visa VAMP	Fraud reports plus disputes, over captured card-absent payments, same month2	1.5% and 1,500 cases (US, Canada, EU, Asia Pacific, Latin America); 2.2%, 150 and $75,000 in CEMEA1 2	Fees above "Excessive"; possible fees from 0.5% and 5 cases2
Visa Secure Excessive Fraud (US only)	Fraud reports on domestic 3DS-authenticated payments, in dollars2	$75,000 and 0.9%2	NoFine, but no liability shift on domestic 3DS payments until you exit2
Mastercard EFM	Fraud chargebacks this month, over last month's ecommerce payments2	1,000 payments, over $50,000, over 0.50%, and 3DS on 10% or less (50% in regulated countries)2	Fines from month 2: $500, then up to $100,000 a month from month 192
MATCH code 5	Fraud to sales, in dollars, one month5	8%, 10 fraud transactions and $5,0005	Listed for 5 years after a closure5
VMSS code 21	Fraud to sales, in dollars, one month5	$250,000 and 1.8%, not remediated5	Listed for 5 years5

Fig. 1The fraud ratio that triggers each program

Mastercard EFM (fraud chargebacks)0.5%
Visa Secure Excessive Fraud (US)0.9%
Visa VAMP (fraud plus disputes)1.5%
VMSS code 211.8%
MATCH code 58%

Source: Visa and Mastercard thresholds as published by Visa and Stripe, 2026

the lowest bar is the one that bites first

Visa VAMP fact sheet; Stripe Docs, monitoring programs and terminated merchant files, read November 2, 2026. Each program also has a count or dollar minimum, listed in the table above.

The dispute side of the same programs, with Mastercard's ECM and HECM, is on chargebacks for merchants. Every program, its fines and exit rules: chargeback monitoring programs.

Watch out

Mastercard's rules are about to change. Checkout.com told its merchants that from April 1, 2027, a Global Merchant Audit Program (GMAP) replaces Mastercard's Acquirer Chargeback Monitoring Program, with stricter chargeback thresholds not yet published7.

What counts as fraud in your ratio

A fraud report counts even when no chargeback follows. Visa's TC40 reports, which Stripe shows as early fraud warnings, go into the VAMP count whatever their outcome2.

Fraud reported, you refunded the orderYes, in VAMPRefunds don't remove a fraud report. Stop the next order instead
Same payment reported as fraud and disputedYes, twice in VAMPOne bad order can weigh double
Fraud report covered by Compelling Evidence 3.0NoKeep device, IP and order history for repeat customers
Dispute resolved through a pre-dispute serviceNoAlerts such as RDR settle it before it counts
Suspicious authorization cancelled before captureNot reportedReview risky orders before you capture

Sources for each line: Stripe Docs, monitoring programs2. Issuers must report fraud on a captured payment, even refunded, but not on an authorization you reverse first2. That's why manual review works best between authorization and capture. How CE 3.0 works: compelling evidence. Alerts: chargeback alerts.

What happens when you cross a fraud limit

The consequences pile up month after month, and some reach back to old sales.

Your acquirer tells you and asks for a remediation plan with causes, controls and a timeline2.
Issuers can charge back flagged sales. Visa's dispute condition 10.5 lets an issuer dispute a transaction identified by a Visa monitoring program for 120 days after the program report3. Adyen notes that merchants in Visa Secure Excessive Fraud qualify for it6.
Fines start in month 2 in Mastercard's EFM and climb every month you stay2.
You lose the 3DS liability shift in Visa Secure Excessive Fraud, and Stripe says excessive fraud in a monitoring program can cost you the shift in general2 4.
The account can be closed, and a closure for excessive fraud can bring a MATCH or VMSS listing that stays 5 years5. See the MATCH list.

Visa Core Rules, October 24, 2026, sections 11.8.6 and 12.5.3.2; Stripe Docs, read November 2, 2026; Adyen Docs, read November 2, 2026.

You leave a Mastercard program after 3 consecutive months below its thresholds2.

If Visa determines that an Acquirer, a Merchant, a Sponsored Merchant, or a Third Party Agent changed, modified, or altered the Merchant name, Merchant data, or Merchant performance in any way to circumvent the Visa Acquirer Monitoring Program (VAMP) [...], Visa may [...] [i]mpose a non-compliance assessment of USD 25,000 per Merchant or Sponsored Merchant, per month to the Acquirer.

Visa Core Rules and Visa Product and Service Rules, October 24, 2026, section 12.5.3.2

Visa can also permanently disqualify the merchant and its principals3. Splitting volume or renaming the descriptor to dilute a ratio is not a fix. Lowering fraud is.

When to use 3D Secure

Ask for 3DS on the orders that carry the risk. Too little 3DS and Mastercard's EFM can catch you; fraud that gets through on authenticated payments, and Visa takes the shift away.

Fig. 2Where to ask for 3D Secure

Big first orders
A new customer, a basket well above your average.
Countries that don't match
Card country, IP and shipping address all different.
Several cards on one device
A sign of stolen cards being tried one after another.
Rush shipping to a new address
Fraudsters want the goods before the cardholder notices.
Soft declines asking for it
The issuer wants authentication: run 3DS, then retry.
Not your returning customers
A known card with clean history rarely needs a challenge.

authenticate the risk, let the rest through

Illustrative list of common risk signals.

In a few countries, the choice isn't yours. Visa requires acquirers to run Visa Secure on ecommerce sales in some markets3:

Country	Visa Secure required for
India	Domestic ecommerce transactions3
Malaysia	MCC 5977 (Cosmetic Stores), 5999, 4511 and 70113
Indonesia	MCC 4511, 4722 and 59993
Hong Kong, Macau	Ten MCCs, including 5999 and 58163

In Europe, strong customer authentication makes 3DS the default; exemptions remove the challenge and the liability shift with it. Details: strong customer authentication and payment authentication.

What 3D Secure doesn't cover

3DS protects the first payment against stolen cards. It does little for the rest of a high-risk business.

Renewals. Off-session payments, such as subscription renewals, don't support 3DS4. Consent at sign-up, reminders and easy cancellation do that job: see subscriptions.
Friendly fraud and non-fraud disputes. "Not as described" or "I cancelled" disputes follow the normal process4. See chargebacks.
A guaranteed shift. Liability shift "can be expected for successfully authenticated payments that later receive eligible fraud disputes, but it isn't guaranteed"4. Answer every inquiry on an authenticated payment: a no-reply can void it4.

How the shift works, card by card: liability shift. Fraud blocks also cost good customers, which shows up as declines: declined payments.

By industry

Industry	What changes	Guide
Supplements	Card testing on the cheapest product, stolen cards on big bundles, and renewals reported as fraud	Fraud and 3D Secure for supplement brands
Skincare	Card testing on minis, welcome-offer abuse, refills off-session; Malaysia requires 3DS on MCC 5977	Fraud and 3D Secure for skincare brands
Online pharmacy	Cancel a suspicious order during prescription review, before capture, so it stays out of Visa's fraud count; 3DS on risky first orders only	Fraud and 3D Secure for online pharmacies
Telehealth	Card testing and stolen cards on first orders; capture after the clinician approves, and remember 3DS never covers renewals	Fraud and 3D Secure for telehealth companies
Fitness	Stolen cards buy racks and treadmills to resell, cheap accessories attract card testing; 3DS doesn't cover "not received" disputes	Fraud and 3D Secure for fitness brands
Info products	Card testing on low-price offers, stolen cards on high-ticket programs, and buyers who use the course then claim fraud	Fraud and 3D Secure for info product businesses

How Tagada helps

3DS and fraud rules on the orders that need them

Native 3DS2, device intelligence and a rules engine, so you can ask for authentication on risky orders only.
Block rules on IP addresses, emails, BIN or card number patterns, customers or payment IDs, permanent or for 1 to 8,760 hours. Setup: Tagada block rules docs 8.
Routing across TagadaPay and processors such as Stripe, NMI and Airwallex with one logic.
TagadaPay underwrites every file and refuses businesses that try to get around chargeback rules.
PCI DSS Level 1, SOC 2, ISO 27001 and GDPR on the TagadaPay side.
From 2.9% + $0.29, no setup fees, no monthly minimums. High-risk verticals and edge cases are priced case by case.
24/7 human support on Slack Connect: "The person who reviews your application has a name, and so does the one who picks up when something breaks."

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Apply today · Go live in under 24 hours

Apply for processing

3DS and fraud rules on the orders that need them

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What is a fraud monitoring program?

A program run by Visa or Mastercard that flags merchants whose fraud passes a monthly threshold. Visa uses VAMP, which adds fraud reports to disputes, and Visa Secure Excessive Fraud for 3DS payments in the US. Mastercard uses EFM. Once flagged, you face a remediation plan, fees and, at worst, account closure.

Is the Visa Fraud Monitoring Program (VFMP) still active?

No. Visa merged VFMP and its dispute program into VAMP, which took effect on June 1, 2025. The merchant threshold dropped from 2.2% to 1.5% in the US, Canada, Europe and Asia Pacific on April 1, 2026. Articles that still quote VFMP thresholds are out of date.

Do refunded fraud transactions still count?

Yes. Once a payment is captured, the issuer reports the fraud even if you refund it, and Visa counts that report in your VAMP ratio. What doesn't count: fraud reports covered by Compelling Evidence 3.0, disputes settled through pre-dispute services, and authorizations you reverse before capture.

Should I use 3D Secure on every transaction?

Usually not, outside Europe and the few countries where Visa requires it. Ask for it on risky orders: big first baskets, mismatched countries, several cards on one device. Keep enough 3DS to stay out of Mastercard's EFM, which only applies when 3DS covers 10% or less of payments in non-regulated countries.

What fraud rate is too high for a merchant?

Watch the lowest limit that applies to you. Mastercard's EFM starts at 0.50% fraud chargebacks, Visa Secure Excessive Fraud at 0.9% on 3DS sales in the US, and Visa's VAMP at 1.5% fraud plus disputes. Each also needs a minimum count or dollar amount, so small stores can sit above a ratio without being flagged.

Sources

Checked November 2, 2026

TagadaPay

Keep fraud far from the network limits

Tell us what you sell and how you sell it. Each application is underwritten, and approval is not guaranteed.

Apply for processing See pricing

01Tell us what you sell and how
02Underwriting reviews your business
03Process through TagadaPay alongside your other processors