Mastercard’s Scam Merchant Monitoring Program 2026
Mastercard’s Scam Merchant Monitoring Program, commonly referred to as SMMP, introduces a faster process for investigating merchants that display potential scam-related activity.
The programme is due to become enforceable on 24 July 2026. Under the updated approach, acquiring banks and payment facilitators may have just 72 hours to investigate certain merchant-risk signals. When an investigation confirms that a business is carrying out scam activity, its ability to accept Mastercard and Maestro payments must be stopped.
This does not mean that every merchant exceeding a particular ratio will automatically lose its merchant account. SMMP is an investigation process, and legitimate businesses should have an opportunity to explain unusual transaction patterns and provide supporting evidence.
However, the short investigation period makes it important for merchants to understand what is being monitored before a problem occurs.
What is Mastercard SMMP?
Mastercard SMMP is a merchant-monitoring programme designed to identify businesses that may be misleading customers, taking payments without providing the promised goods or services, or otherwise operating as scam merchants.
Certain warning signals can require a merchant’s acquiring bank or payment facilitator to begin an investigation within 72 hours.
For merchants within their first six months of Mastercard acceptance, one potential trigger is a combined refund and chargeback rate above 5% during a rolling 30-day period, provided the merchant has processed at least 500 purchase transactions.
The important point is that refunds and chargebacks are counted together for this particular new-merchant test.
Find Your New Processor
When does Mastercard SMMP take effect?
Industry programme guidance places the enforcement date on 24 July 2026. Mastercard’s public announcement confirms that its revised franchise standards begin in July 2026 and require investigations to start within 72 hours when potential scam activity reaches a specified risk threshold.
Merchants should also check the position directly with their acquiring bank, payment facilitator or payment service provider. Card-scheme requirements can be implemented differently depending on the merchant’s processing arrangement and market.
Why has Mastercard introduced SMMP?
SMMP is primarily intended to identify scam businesses earlier.
Examples may include fake online shops that advertise desirable or hard-to-find products, accept payment and then:
- Deliver nothing
- Supply counterfeit or significantly misrepresented goods
- Make cancellation or refund requests deliberately difficult
- Use misleading trials or subscription terms
- Collect payment details for fraudulent purposes
- Disappear before customer complaints and disputes build up
Mastercard says advances in technology, including generative AI, have made it easier for criminals to create convincing websites, advertisements, testimonials and online storefronts quickly.
Its updated monitoring approach is intended to identify suspicious merchants before large numbers of consumers lose money.
The important SMMP refund rule
The most widely discussed part of SMMP is the way refunds are treated during a merchant’s early processing history.
For a merchant within its first six months of Mastercard acceptance, an investigation may be triggered where:
- At least 500 purchase transactions have been processed during a rolling 30-day period; and
- More than 5% of those transactions have resulted in either a refund or a chargeback.
Refunds and chargebacks are combined for this calculation.
This is important because many well-run businesses use prompt refunds to resolve customer complaints and prevent those complaints from becoming formal chargebacks.
Under the SMMP new-merchant test, issuing a proactive refund may still increase the combined percentage.
Does this mean merchants should stop issuing refunds?
No.
A merchant should not delay, refuse or obstruct a legitimate refund simply to protect its SMMP figures. Doing so could increase customer complaints, chargebacks, regulatory risk and reputational damage.
Instead, businesses should focus on the reasons customers are requesting refunds in the first place. This may include improving:
- Product and service descriptions
- Delivery information
- Subscription disclosures
- Trial-to-paid communications
- Cancellation procedures
- Customer support response times
- Billing descriptors
- Order confirmation messages
The aim should be to reduce avoidable customer confusion and dissatisfaction, rather than making genuine refunds harder to obtain.
Find Your New Processor
Does the 5% threshold apply to every merchant?
No.
The combined 5% refund and chargeback test is reported to apply during the first six months of Mastercard acceptance and where the merchant has processed at least 500 purchase transactions within the relevant rolling 30-day period.
It should not be presented as a universal 5% limit applying to every established merchant.
Merchants with more than six months of Mastercard processing history may still be investigated under other SMMP warning signals, but they are not generally subject to this specific new-merchant calculation.
Businesses with several merchant identification numbers, acquiring relationships or trading entities should ask their provider how the six months is assessed for each account.
What can trigger an SMMP investigation?
The reported triggers fall into several broad categories.
1. A significant fall in authorisation rates
A sudden fall in the number of transactions being approved may resemble the activity associated with a fraudulent merchant, card-testing attack or compromised payment account.
Reported examples include:
- An approval rate falling by 50 percentage points or more within 72 hours
- An approval rate dropping below 30%
- The merchant processing a minimum number of purchase attempts during that period
A legitimate merchant could experience this following a technical fault, poorly configured payment routing, expansion into a new country or an aggressive card-retry process.
Merchants should therefore monitor authorisation performance by gateway, market, issuer, card type and sales channel rather than looking only at their overall approval rate.
2. Mastercard or issuer scam reports
An investigation may also follow intelligence received from Mastercard or from card-issuing banks.
This may include reports from more than one issuer suggesting that customers were manipulated, misled or charged as part of a scam.
The language used in customer complaints and chargeback documentation can matter. Clear marketing, accurate terms and accessible customer support can help prevent an ordinary service complaint from being interpreted as deliberate deception.
3. The new-merchant refund and chargeback test
For merchants in their first six months of Mastercard acceptance, a combined refund and chargeback rate above 5% may trigger an investigation when at least 500 purchase transactions have been processed during the rolling 30-day period.
4. Alerts from merchant-monitoring services
Acquirers and payment facilitators may receive alerts from approved merchant-monitoring providers.
These services can review transaction behaviour alongside external information, including website content, changes to a business’s online presence, products being advertised and other digital risk signals.
An alert does not necessarily prove wrongdoing, but it may require the acquirer to investigate.
What happens during the 72-hour investigation?
The 72-hour period is primarily an obligation placed on the acquiring bank or payment facilitator. It should not be viewed as a guaranteed three-day grace period for the merchant.
During the investigation, the provider may review:
- The merchant’s application and underwriting information
- Website content and marketing claims
- Products or services being sold
- Transaction and authorisation data
- Refund patterns
- Chargeback reason codes and supporting documents
- Customer service records
- Delivery or fulfilment evidence
- Subscription consent records
- Cancellation requests
- Billing descriptors
- Previous compliance concerns
Where the activity can be explained and the provider is satisfied that the merchant is legitimate, processing may continue.
Where scam activity is confirmed, Mastercard says the merchant must be stopped from accepting Mastercard transactions.
Depending on the circumstances, termination may also affect the merchant’s ability to obtain processing elsewhere. This is why merchants should respond honestly and provide complete evidence rather than attempting to hide transaction history or move unexplained activity between accounts.
Find Your New Processor
Mastercard SMMP versus Visa VAMP
SMMP and Visa’s Acquirer Monitoring Program, known as VAMP, are separate programmes.
|
Area
|
Mastercard SMMP
|
Visa VAMP
|
|
Main purpose
|
Identify and investigate potential scam merchants
|
Monitor fraud, disputes and enumeration
|
|
Basic structure
|
Trigger-led investigation
|
Monthly monitoring ratio
|
|
Refunds included?
|
Included in the specific 5% test for new merchants
|
Not included in the core VAMP ratio
|
|
Main calculation
|
Several potential scam signals
|
Fraud reports plus disputes divided by settled transactions
|
|
Investigation period
|
Acquirer may need to act within 72 hours
|
Remediation is managed through VAMP requirements
|
|
Possible outcome
|
Mastercard acceptance stopped if scam activity is confirmed
|
Monitoring, remediation and enforcement measures
|
Visa’s official VAMP calculation combines card-not-present fraud reports and disputes. Its excessive merchant threshold in the UK and EU is reduced to 1.5% from 1 April 2026, subject to the programme’s transaction and case-volume requirements.
A merchant that has prepared for VAMP may already monitor fraud and disputes closely. However, it may still need to introduce a separate rolling calculation that combines refunds and chargebacks for its early Mastercard processing history.
Which businesses may need to pay particular attention?
SMMP is not limited to particular merchant category codes, and operating in a certain sector does not mean a business is carrying out scam activity.
However, some business models naturally experience more refunds, disputes, unusual transaction patterns or customer confusion. These can include:
For example, a travel business may experience a concentrated period of refunds following cancellations. A subscription provider may receive complaints about forgotten renewals. A SaaS business may see refund requests following a trial conversion.
These patterns do not prove that the merchant is a scam. They do, however, make clear customer communication and accurate monitoring particularly important.
Seven checks merchants should complete
1. Confirm the age of each Mastercard account
Check when each Mastercard-accepting merchant account or MID began processing.
Do not assume that the age of the company or website is the relevant date. Ask the acquirer how it determines the first six months of acceptance.
2. Calculate the combined rolling rate
Merchants within the initial six-month period should calculate:
Number of refunds plus number of chargebacks ÷ number of purchase transactions × 100
This should be measured over a rolling 30-day period rather than only by calendar month.
Set an internal warning level below 5% so there is time to identify the cause of any increase.
3. Investigate the reason for refunds
Separate refunds by cause, such as:
- Customer cancellation
- Duplicate payment
- Failed delivery
- Product dissatisfaction
- Subscription renewal
- Technical issue
- Suspected fraud
- Customer-service complaint
This provides more useful information than monitoring one overall percentage.
4. Review billing descriptors
Customers should be able to recognise a transaction when it appears on their banking app or card statement.
The descriptor should match the business name or brand the customer expects to see. Where the legal company name differs from the trading name, this should be made clear during checkout and in order confirmations.
5. Review customer communications
Check that customers receive clear information about:
- The amount they will be charged
- The date payment will be taken
- Recurring or future payments
- Trial expiry dates
- Cancellation procedures
- Delivery times
- Refund eligibility
- Contact details
A reminder before a subscription renewal or delayed delivery update may prevent both a refund and a chargeback.
6. Prepare an evidence file
Keep the information that may be needed during an investigation accessible and organised.
This could include:
- Proof of delivery
- Service completion records
- Customer correspondence
- Terms accepted at checkout
- Subscription consent
- Cancellation logs
- Refund records
- Website screenshots
- Marketing approvals
- Supplier invoices
- Licence or regulatory information
The objective is to show quickly that the business is genuine and that its transaction pattern has a reasonable explanation.
7. Speak to the acquirer before a problem occurs
Merchants should make sure their acquiring bank or payment provider understands the business model.
Tell the provider about expected seasonality, promotions, geographic expansion, refund spikes, subscription structures or other changes that may affect transaction behaviour.
An unexplained change may look suspicious. A change discussed and documented in advance is easier to assess properly.
Should merchants have more than one acquiring route?
A secondary acquiring relationship can form part of a sensible business-continuity plan, particularly for merchants that rely heavily on online card payments.
However, it should not be treated as a way to avoid monitoring requirements.
Any additional merchant account should be:
- Legitimately required
- Accurately underwritten
- Transparent about the business model
- Correctly classified
- Operated in accordance with card-scheme rules
- Disclosed where required
Opening additional accounts to conceal refund levels, divide problematic activity or continue processing after a legitimate scheme termination could make the situation substantially worse.
A second acquirer may reduce dependence on one provider during an operational outage or account review. It cannot guarantee continued processing following a network-level finding, provider termination or industry database listing.
What should merchants avoid doing?
Businesses should not respond to SMMP by:
- Refusing legitimate refunds
- Making cancellation unnecessarily difficult
- Moving transactions between MIDs to disguise ratios
- Opening accounts using incomplete or misleading information
- Changing company names or descriptors without explanation
- Splitting transaction volume purely to avoid monitoring
- Applying repeatedly without disclosing previous termination
- Waiting until an investigation begins to organise evidence
The safest approach is accurate monitoring, transparent underwriting and clear communication with customers and providers.
Final thoughts
Mastercard SMMP represents a wider move towards earlier and faster merchant-risk intervention.
For most legitimate and established merchants, the programme should not be treated as a reason to panic. The widely discussed 5% combined refund and chargeback test is not a universal threshold applying to every business.
It is, however, a reason to improve visibility.
Merchants should understand the age of each processing account, monitor refunds and chargebacks together where relevant, investigate sudden authorisation changes and keep evidence ready before it is requested.
The businesses best placed to respond are not necessarily those with no refunds or complaints. They are the ones that can explain their figures, demonstrate fair customer treatment and show that their provider fully understands how the business operates.
Find Your New Processor
Independent merchant account guidance
Merchant Advice Service provides free, independent guidance for businesses comparing merchant accounts, payment gateways and acquiring options, including merchants with more complex processing or underwriting requirements.
We do not conduct Mastercard investigations or decide whether an application will be approved. We can help businesses understand their payment requirements and identify providers that may be suitable for their sector, transaction profile and processing model.
Programme rules, thresholds and provider requirements can change. Merchants should confirm the current position with their acquiring bank, payment facilitator or Mastercard representative before making operational decisions.
