VAMP Remediation Checklist: Steps to Exit Visa Acquirer Monitoring

Entering Visa VAMP monitoring — Above Standard (≥0.50%) or Excessive (≥0.70%) at the acquirer portfolio level — is a time-sensitive compliance situation. The VAMP programme replaced VDMP and VFMP in April 2025. The ratio it measures is: TC40 fraud plus TC15 disputes divided by TC05 settled transactions. A merchant can breach VAMP thresholds through elevated fraud, elevated disputes, or both simultaneously.

This is an operational checklist for payments, fraud, risk, and chargeback operations teams. It is not legal or network advice. Exact programme handling, exclusion timing for eligible pre-dispute solutions and CE 3.0-qualified fraud, and current thresholds should be verified with your acquirer and Visa representative. Acquirers manage their own portfolios against the Above Standard and Excessive thresholds and may set internal merchant ceilings below those levels; your acquirer's internal targets may differ from the published scheme thresholds.

First 48 Hours: Confirm the Numbers

Before changing any controls, confirm exactly what you are dealing with.

Request the full monitoring data from your acquirer. Specifically:

• The monitoring month and exact ratio reported
• Whether the breach is at the acquirer-portfolio level, the merchant-entity level, or both
• Which MIDs are in scope
• The TC40 count and TC15 count separately — not combined
• The TC05 settled transaction denominator used in the calculation
• Whether this is your first notification or a programme escalation

Reconcile the numerator. TC40 and TC15 may not be available in every PSP dashboard. If your acquirer provides monthly TC40 data, compare it with your internal fraud records and clarify any differences before modelling a remediation trajectory. Ask what breakdowns by MID and month are available and document any data limitations.

Identify the dominant driver. Once you have the TC40 and TC15 counts separately, calculate each as a share of TC05. A ratio where 70% of the numerator comes from TC40 requires a different remediation track than one driven primarily by TC15. If neither component dominates, plan work against both while confirming the reported data with your acquirer.

Confirm pre-dispute and CE 3.0 exclusion timing. Visa's fact sheet says pre-dispute solutions and qualifying CE 3.0 fraud can be excluded, contingent on data-extract timing. The solution, eligibility and reporting path matter; do not assume an alert or refund is excluded until your acquirer confirms the treatment for your transactions. If you use pre-dispute services, see the dispute remediation workstream section.

Separate enumeration from the core ratio. Card-testing and account enumeration are tracked under Visa's enumeration ratio — a separate programme with its own threshold — not inside the core VAMP ratio. Confirm with your acquirer whether you are in both VAMP monitoring and enumeration monitoring simultaneously. If so, the remediation plans are parallel but distinct.

Week 1: Stop the Ratio From Worsening

Once the data is confirmed, consider whether temporary, reversible controls are appropriate while the fraud and dispute workstreams investigate causes. Record the scope, owner and review date for any temporary change.

Identify the highest-risk cohorts first. Segment your transaction volume by:

• BIN country and issuer
• Payment method (card-present, CNP, wallet)
• Product or SKU — compare fraud and dispute patterns across your own product and fulfilment types
• Traffic source (organic, paid, affiliate, reseller, marketplace)
• Account age at transaction time
• Merchant entity and MID if operating multiple

The true cost of a chargeback can help quantify fees and operational effects. Use cohort data to assess whether a targeted change addresses the observed issue while limiting effects on other transactions.

Week 1 control decision guide. Match the pattern the segmentation reveals to the response:

Do not apply controls outside the scope identified by segmentation. A rule applied to your entire volume suppresses approval rate for clean traffic while only partially addressing the elevated cohort. If the cohort analysis does not clearly identify a driver, proceed directly to the fraud and dispute workstream sections — the Week 1 controls are supplementary to those workstreams, not a substitute.

Review refund-before-dispute execution. If you use Verifi CDRN, Ethoca or another pre-dispute service, confirm alert coverage, eligibility and response deadlines with the provider. Timely handling may let you resolve a customer issue before a dispute is filed; it does not guarantee exclusion from VAMP. Check performance against the provider's requirements and your acquirer's reporting.

Review billing descriptor clarity. For unrecognized-transaction disputes, check whether the statement descriptor matches the checkout experience and provides a useful support contact. Clear descriptors may help customers identify a charge but do not prevent every dispute. Review cancellation-related disputes separately in the cancellation workstream.

Freeze high-risk external channels if needed. If a specific reseller, affiliate partner, or marketplace channel accounts for a disproportionate share of dispute or fraud volume, a temporary pause is warranted while you investigate. Reactivation requires evidence that the channel's quality has changed, not just that time has passed.

Fraud Remediation Workstream

This workstream targets TC40 reduction. It runs in parallel with the dispute workstream, not after it.

Understand the fraud mix before changing rules. Review the transaction and fraud-type detail available from your acquirer. Different patterns may call for different controls; for example, an account-takeover pattern may warrant reviewing account-access signals as well as payment activity. Confirm which categories are actually present before tuning rules.

Account takeover. If account takeover appears in your fraud data, consider reviewing account-access signals alongside payment activity. Examples include unusual device or session changes, credential-stuffing patterns, and account changes shortly before a disputed transaction. Validate the signal against your own cases before applying controls.

Enumeration containment. Card-testing enumeration is tracked separately from the core VAMP ratio. Some fraudulent transactions following successful card tests may appear in TC40 data. If your data shows this pattern, test controls such as rate limits or velocity rules on the affected traffic and monitor both enumeration and fraud reporting. For the attack anatomy, see Card Testing and Enumeration Attacks.

Signal review. Depending on the fraud pattern, comparing several signals may help target controls more narrowly than a broad rule. Examples to investigate include:

• Device fingerprint: same device seen across multiple card credentials
• IP reputation: known fraud IP ranges, VPN/proxy/TOR exit nodes
• Email domain: disposable email domains at registration
• BIN risk: BIN corridors with historically elevated TC40 rates on your platform
• Behavioural signals: session speed, field completion patterns, checkout abandonment anomalies
• Account-level signals: new account age, first transaction on account, no prior purchase history

3DS2 deployment. 3DS may provide liability protection for certain eligible fraud-related disputes when the transaction meets scheme and processing requirements; it does not guarantee lower TC40, higher TC15 or a better VAMP ratio. Pilot a defined cohort, then compare fraud reports, disputes, approvals and completion with a suitable baseline and confirm reporting with your acquirer. The linked Fraud Operations KPIs are operational measures, not Visa-set VAMP thresholds or guaranteed outcomes.

False-positive monitoring. Fraud controls can also affect legitimate approvals and checkout completion. Track those outcomes by cohort alongside TC40. For example, compare the value of blocked transactions with the observed change in fraud reports before deciding whether to retain or expand a rule. Review a false-positive log regularly.

Dispute Remediation Workstream

This workstream targets TC15 reduction. Run it in parallel with the fraud workstream.

Cluster by reason code. Not all TC15 disputes have the same remediation path. Pull your dispute volume by Visa reason code for the monitoring month. Depending on your business, categories to investigate may include:

• 10.4 (Fraudulent transaction — card absent): Unauthorised use. Remediation is fraud controls and 3DS2 deployment.
• 13.1 (Merchandise not received) and 13.3 (Not as described): Fulfilment or customer expectation failures. Remediation is fulfilment evidence, customer support SLA, and refund policy execution.
• 13.7 (Cancelled merchandise or services): Subscription and cancellation disputes. Remediation is cancellation flow clarity and confirmation.
• 10.1/10.2 (EMV liability-shift fraud conditions): These are not generic card-absent codes. Check the current Visa condition, transaction type and evidence requirements before selecting a response; 3DS is not a universal remedy.

For reason-code reference and merchant defence requirements, see Scheme Chargeback Rules 2026: Visa VCR, Mastercard, and Reason Codes.

Refunds and dispute prevention. For a substantiated service issue, a prompt refund may resolve the customer's concern. Decide case by case using the reason, evidence, amount, applicable pre-dispute programme and refund policy; do not assume a refund is preferable to representment in every non-fraud dispute.

Customer support SLA. Some disputes may relate to unresolved customer-service issues. Measure response and resolution times, then compare them with dispute reasons and outcomes to see whether a pattern exists for your business.

Subscription and cancellation flows. If cancellation-related disputes such as Visa 13.7 appear in your data, review how customers cancel, what confirmation they receive and whether it matches the billing period. A clear, accessible cancellation path can reduce avoidable friction; measure its effect rather than assuming a particular change will reduce disputes.

Representment evidence quality. For disputes that are worth contesting — see Chargeback Representment: Why Merchants Lose Money They Could Recover for the contest-or-accept calculus — select evidence that directly addresses the claim in the reason code. For a delivery dispute, for example, a record linking delivery confirmation to the order, address and date may be more useful than unrelated order screenshots.

Pre-dispute programmes. Services such as Verifi CDRN, Visa RDR and Ethoca have different alert, eligibility and resolution mechanics. A timely resolution may prevent a dispute from being filed, but VAMP exclusion depends on Visa's criteria and the timing of data extracts. Confirm each service's handling and reporting with your provider and acquirer. See Chargeback Management Platforms: Alerts, Representment, and Recovery for a product comparison.

Acquirer Communication Checklist

Ask your acquirer what information it needs during monitoring. A weekly remediation pack can make your analysis and actions easier to review; it does not guarantee a particular enforcement decision.

Weekly remediation pack contents:

1. Current ratio estimate — your internal estimate of the VAMP ratio for the current month based on available TC40 and TC15 data, with TC40 and TC15 broken out separately
2. Root-cause narrative — a brief explanation of which segments, products, or traffic sources are driving the elevation and what the investigation found
3. Controls implemented — a table of every fraud or dispute control change, the date it went live, and the expected or observed impact on TC40/TC15 volume
4. Weekly ratio trend — a 4–6 week trailing table showing ratio movement since controls were deployed, with a projected trajectory to the target threshold
5. Action owner list — named individuals responsible for each open action, with expected completion dates
6. Escalation flag — if any action has been delayed or has not achieved the expected impact, flag it explicitly with the revised plan

The tone should be factual and operational. Clear data and documented actions help the acquirer assess the account and your response; they do not determine the enforcement outcome.

Weekly Operating Dashboard

Track these metrics weekly throughout the monitoring period. One table, owned by a named team member, reviewed in a standing meeting.

This table is the source of truth for the acquirer weekly pack. Do not send qualitative updates without supporting data.

For additional operational metrics and publisher-suggested target ranges, see Chargeback Operations KPIs: Metrics, Targets, and Escalation Triggers. Those benchmarks are not Visa-set VAMP thresholds.

30 / 60 / 90 Day Remediation Plan

VAMP monitoring status, enforcement timing and exit criteria depend on the applicable programme rules and acquirer handling. The public Visa fact sheet does not establish a universal three-month first-offender grace period or merchant exit timetable. Confirm your case-specific status and next steps with your acquirer.

Common Mistakes

Treating VAMP as only a chargeback problem. TC40 fraud reports are distinct from TC15 disputes and may not be visible in a standard PSP dashboard. Ask your acquirer what transaction-level and monthly data it can provide; a chargeback rate alone does not show the full VAMP numerator.

Ignoring TC40 data entirely. If TC40 is a substantial part of your numerator, reducing TC15 alone may not be enough to reach your target. Request the available TC40 data from your acquirer and include it in regular monitoring.

Confusing enumeration with the core VAMP ratio. Enumeration is a separate Visa monitoring programme with its own threshold. Remediating enumeration (card-testing defence) does not directly improve the core VAMP ratio — though it may reduce downstream TC40 from successful card tests. Do not conflate the two.

Over-tightening fraud rules without measuring revenue impact. Broad controls can affect both fraud and legitimate approvals. Measure approval and completion changes by cohort alongside fraud outcomes before expanding a rule; compare the observed costs with the applicable programme and provider charges.

Waiting for the acquirer to lead the remediation. Confirm responsibilities and requested actions with your acquirer, while investigating your own transaction data and documenting changes. The acquirer determines its programme response under applicable rules and agreements; a merchant plan alone does not determine that outcome.

Fixing global rules when the issue is localised. If 80% of TC40 exposure comes from one BIN corridor, one product type, or one reseller channel, a global rule change suppresses approval rate across your entire volume while only partially addressing the actual problem. Segment first, then apply the minimum scope of control necessary to address the elevated cohort.

Fixing the ratio without fixing the underlying problem. Refunds, authentication changes or transaction blocks may alter reported counts without resolving the cause of the underlying fraud or disputes. Review both the ratio and the customer or fraud outcomes, then retain controls that address an evidenced problem.