Scheme Chargeback Rules 2026: Visa VCR, Mastercard, and Reason Codes

Both scheme rulebooks have changed more in the past eighteen months than in the preceding five years. Visa retired its two dispute monitoring programs and replaced them with a single, stricter framework. Compelling Evidence 3.0 went from a manual filing process to automatic qualification. Mastercard tightened arbitration rules and consolidated its reason code structure. Most operators are still running playbooks written against the old Visa VDMP/VFMP model — a model that no longer exists.

This article covers both schemes as of August 2026: dispute workflows, reason codes, monitoring program thresholds, pre-dispute tools, and the changes that actually matter operationally. It is the rules layer — which category a dispute falls into, what the deadlines and thresholds are, and what changed. For the evidence layer that sits on top of it — how to actually build and structure a representment package once you know which rule applies — see the Chargeback Evidence & Representment Operator Reference. If you want the merchant-side defense playbook, see Chargeback Representment: The Merchant Playbook. If you want the AI automation layer on top of this, see AI-Powered Chargeback Representment.

Sources: Compiled from operator and industry documentation — Chargebacks911, Ravelin, Checkout.com, Chargeblast, Chargeflow, Justt.ai, NMI, and Verifi guides (full citations in structured source record). Visa and Mastercard primary rulebooks are behind sign-in access; secondary operator sources used where primary docs require login. Verify thresholds, enforcement fees, and monitoring program rules with your acquirer before operational use.

Visa vs Mastercard at a glance

Operators running both networks cannot use a single dispute playbook. The two schemes differ in framework, workflow model, evidence mechanics, pre-dispute tooling, and monitoring structure — and the asymmetries have direct consequences for how you staff, template, and automate. Neither network is inherently better or harder; the operational impact depends on your dispute mix, region, issuer and acquirer handling, and evidence quality.

Operator note: This table is a structural, evergreen reference. Network rules, response windows, eligibility criteria, and monitoring thresholds vary by program, region, acquirer, and update cycle. Verify current details with your acquirer or the relevant network documentation before building or changing operational procedures.

One case deserves specific mention, because it is a common way merchants miss a deadline they thought they had: the response windows above are network rules, and your acquirer may impose a materially tighter one. Adyen, for example, documents merchant response deadlines well inside Visa's 30-day network window. The deadline you are actually operating against is your acquirer's, not the network's — confirm it in writing rather than assuming the network figure applies to you.

For the full reason-code maps, cardholder filing windows, and monitoring thresholds, see the Visa Reason Codes Reference and Mastercard Mastercom Dispute Categories Reference. For the operating-model decision — which platform layer handles alerts, representment, and managed recovery on each network — see Chargeback Management Compared: Alerts, Representment, and Recovery Models.

Visa Claims Resolution: the two workflows that matter

Visa launched VCR in April 2018, replacing 22 legacy chargeback codes with a four-category structure and introducing a critical operational distinction: two different workflows depending on dispute type.

Allocation workflow applies to Fraud (10.x) and Authorization (11.x) disputes. Visa uses its internal network data to assign liability automatically — to the issuer or to the merchant — without requiring a full evidence exchange between parties. The maximum resolution timeline is 70 days (reduced from 150 under the old process). Merchants have 30 days to respond (down from 45).

Collaboration workflow applies to Processing Errors (12.x) and Consumer Disputes (13.x). These require back-and-forth exchange between issuer, acquirer, and merchant. Maximum timeline is 100 days (down from 150). The 30-day initial response deadline applies here too.

The workflow your dispute falls into determines your defense strategy. Allocation disputes are faster and more binary — Visa is already assigning liability when you receive the notification. Collaboration disputes give you more room to negotiate and provide documentation, but they also require active engagement rather than automated response.

When the first response doesn't settle it: pre-arbitration and arbitration. Either party can escalate an unresolved dispute one step further. Visa allows a single pre-arbitration attempt, giving the responding party roughly 30 days to accept or decline. A decline escalates the case to arbitration, where Visa itself rules on the outcome. The stakes rise sharply at this stage: the party that did not meet the dispute conditions and requirements is typically liable for an arbitration filing fee of USD 600, charged on top of the disputed transaction amount. Because that fee applies regardless of the transaction's value, arbitration is rarely worth pursuing on low-value disputes — model the fee against the disputed amount before escalating rather than defaulting to it as the next step after a lost pre-arbitration.

Visa reason codes: the complete map

Visa's four categories contain 23 active dispute conditions in the 18 April 2026 edition of the Core Rules — 5 fraud, 3 authorization, 6 processing-error and 9 consumer-dispute conditions. (This article previously said ~14, and the sibling reference said 15. Both undercounted by eight; corrected 27 August 2026 against the rulebook itself.) The shape of your defense surface depends on which category each dispute falls under:

• Fraud (10.x) — Allocation workflow. Code 10.4 (Other Fraud, Card-Absent) dominates e-commerce exposure and is the only code eligible for CE 3.0 defense (see below).
• Authorization (11.x) — Allocation workflow. Code 11.3 absorbed Late Presentment (12.1) in the April 2024 consolidation and was renamed "No Authorization/Late Presentment." That was separate from VCR's 2018 launch, when the legacy two-digit codes were retired and redistributed — former code 72 (No Authorization) is the closest predecessor of today's 11.3, while former code 71 (Declined Authorization) maps to 11.2, not 11.3.
• Processing Errors (12.x) — Collaboration workflow. Thinner category after the 2024 consolidation moved Late Presentment to 11.3.
• Consumer Disputes (13.x) — Collaboration workflow. For SaaS and subscription businesses, 13.2 (Cancelled Recurring) is a primary exposure alongside 10.4. For e-commerce with physical fulfillment, 13.1 (Item Not Received) is the dominant non-fraud code.

For the full code-by-code map — every active VCR code with workflow, trigger, defense notes, and 2024–2026 consolidation history — see Visa Reason Codes: The Complete VCR Map.

CE 3.0: automatic dispute deflection changed in October 2025

Compelling Evidence 3.0 is Visa's mechanism for contesting 10.4 disputes using historical transaction evidence. It launched April 2023. What changed on October 17, 2025 is more significant than the original launch.

What CE 3.0 requires: To qualify, merchants must provide two prior transactions from the same cardholder that are 120 to 365 days older than the disputed transaction, were not previously reported as fraud, and share at least two matching data elements with the disputed transaction — purchase IP, device ID/fingerprint, account/user ID, or shipping address — with at least one of those being the IP address or device ID/fingerprint. This proves an established purchasing relationship — the cardholder has transacted with you before, without dispute, which undermines a claim of unauthorized use. For the full evidence-capture mechanics — what to log at checkout, login, and fulfilment so this evidence exists before a dispute ever arrives — see the CE 3.0 evidence-build guide.

The evidence submitted via Verifi Order Insight can include login details, IP addresses, device IDs, and delivery confirmations that tie the cardholder to those historical transactions.

Two defense paths:

• Pre-dispute path: Evidence shared via Order Insight before the issuer files the chargeback. If validated by the issuer, the dispute never becomes a chargeback at all. Critically, this means it does not affect your VAMP ratio.
• Post-dispute path: After a chargeback is filed, two historical transactions submitted via Visa Resolve Online. If validated, the chargeback is reversed.

What changed October 17, 2025: Prior to this date, CE 3.0 was a manual process — merchants had to identify eligible disputes and file the evidence themselves. From October 17, 2025, merchants enrolled in Visa Secure or Visa Data Only receive automatic qualification for eligible 10.4 disputes without any manual action. Visa's systems identify the historical transaction evidence and execute the CE 3.0 defense automatically.

The practical implication: if you are already on Visa Secure (3DS authentication), you are getting CE 3.0 automation for free on eligible disputes. If you are not on Visa Secure, you are leaving defense coverage on the table on your highest-volume fraud code. That "for free" changed on April 17, 2026: per Visa's own merchant business news, Visa introduced an associated fee for successful CE 3.0 qualifications from that date. The per-qualification dollar amount is not published in Visa's merchant-facing material — confirm the current fee with your acquirer before assuming auto-qualification remains costless.

VAMP: the new monitoring stakes

Visa retired the VDMP (Dispute Monitoring Program) and VFMP (Fraud Monitoring Program) on March 31, 2025, consolidating them into the Visa Acquirer Monitoring Program (VAMP), effective April 1, 2025. Per Visa's own VAMP fact sheet, the specific ratio formula below took effect 1 June 2025, with an advisory (no-fines) period running through 30 September 2025.

The VAMP formula: Count of [Fraud (TC40) + Disputes (TC15)] ÷ Count of Settled Transactions (TC05). The numerator is broader than either predecessor program — it captures both fraud-coded and non-fraud-coded disputes in a single metric. Disputes resolved through pre-dispute solutions and TC40 fraud qualified for Compelling Evidence 3.0 are excluded, contingent on the timing of the data extract.

Thresholds (per Visa's VAMP fact sheet):

Two things operators consistently miss: LAC merchants were already at the 1.5% threshold before the April 2026 change reached everyone else, and CEMEA runs on a materially lower minimum-volume floor (150 events and USD 75,000) rather than the 1,500-event floor used elsewhere — a small CEMEA merchant can enter monitoring at a fraction of the volume that would trigger it in the U.S. or EU.

Enforcement fees: $4 per disputed or fraudulent transaction at Above Standard, $8 per transaction at Excessive, with a 3-month grace period for first-time offenders (rolling 12-month window). Acquirer-level fees began October 1, 2025 (Excessive) with Above Standard fees phased in from January 2026. From April 1, 2026, the Excessive fee also applies directly to merchants — not only to their acquirer — coinciding with the threshold drop, so a merchant crossing from "compliant at 2.2%" to "Excessive at 1.5%" now faces a direct per-transaction cost rather than only a pass-through from their acquirer's contract.

Enumeration is tracked separately from the core VAMP ratio: a VAMP Enumeration Ratio of 20% (2,000 basis points) of authorization transactions (approved plus declined), applying once a merchant or acquirer has at least 300,000 enumerated transactions in a month.

The critical exclusion: RDR-resolved pre-disputes are excluded from the VAMP ratio. CE 3.0-resolved TC40 disputes are also excluded. This changes the ROI calculation on both tools significantly — they reduce your VAMP exposure, not just your chargeback volume.

Merchants in AP, Canada, EU, and the U.S. now operate under the 1.5% threshold: if your current ratio is between 1.5% and 2.2%, you are already in Excessive territory — with a direct merchant fee attached — and need to reduce it. For the full VAMP mechanics, fee structure, and remediation playbook, see the VAMP operator guide. For a step-by-step remediation checklist, see VAMP Remediation Checklist.

Mastercard Mastercom: dispute categories and timelines

Mastercard's dispute management runs through Mastercom, an end-to-end dispute management platform where acquirers are now mandatory participants — either through direct integration, a third-party vendor, or a certified platform. The 2024 consolidation reduced Mastercard's reason code fragmentation significantly. Most disputes now route through four umbrella codes. For the full code-by-code reference — cardholder filing windows, merchant response deadlines, defence notes, ECP/HECM thresholds, and 2024–2026 changes in table format — see Mastercard Mastercom Dispute Categories Reference.

Authorization — Code 4808

Sub-conditions: Required authorization not obtained, Expired protection period, Multiple authorization requests. Cardholder filing deadline: 90 days. Merchant response window: 45 days.

Point-of-Interaction Error — Code 4834

Sub-conditions: Duplicate processing, Paid by other means, Amount differs from authorized amount, Late presentment, ATM processing issues. Same 90-day / 45-day timeline as 4808.

Fraud — Codes 4837 and 4870

• 4837: No Cardholder Authorization (formerly 4755/4757 under pre-consolidation coding). The primary fraud code. Cardholder filing deadline: 120 days (up to 540 days in select cases). Merchant response: 45 days.
• 4870: Chip Liability Shift. Fraudulent transaction at a terminal that failed to process a chip card as chip. Same timelines as 4837.

Cardholder Disputes — Codes 4841, 4853, 4855

• 4841: Cancelled Recurring Transaction or Digital Goods. Transaction charged after cancellation of a recurring arrangement.
• 4853: General Cardholder Dispute (umbrella).
• 4855: Goods or Services Not Provided.

All three carry a 120-day cardholder filing deadline and 45-day merchant response window.

The 45-day merchant response window across all Mastercard categories is materially longer than Visa's 30-day window — operationally useful, but it should not create complacency. Evidence collection begins the moment you receive the notification, not when the deadline approaches.

A new authorization rule effective June 18, 2025: authorization types must be explicitly identified as pre-authorization or final. The previous "undefined" authorization type is no longer accepted. Mastercard did not hard-block undefined authorizations outright — instead it attached an escalating fee to them (per PayPal's merchant guidance on the mandate): 0.25% of the transaction (minimum $0.04) from July 1, 2025 when an undefined authorization is submitted for settlement but not cleared within 7 days, rising to 0.30% ($0.05 minimum) from January 2026 and 0.35% ($0.10 minimum) from January 2027. Acquirers and PSPs that haven't updated integrations to always specify an authorization type will see this show up as a line-item fee, not a declined transaction.

TLID keeps expanding past its 2024 introduction. The Transaction Linkage ID didn't stop at authorization messages: per Checkout.com's tracking of the rollout, Mastercard mandated acquirers pass TLID across lifecycle transactions (voids, refunds, captures) from October 2025, will generate TLIDs for economically-related transactions — merchant-initiated transactions, buy-now-pay-later — from June 2026, will require merchants to send TLID on those economically-related transactions from October 2026, and plans non-compliance fees for the data mandate from January 2027. An acquirer or PSP integration that only handled the original 2024 auth-message requirement is already behind this rollout.

Mastercard ECP and HECM: the monitoring thresholds

Mastercard's monitoring programs have two tiers, with no major threshold changes announced for 2025–2026.

Excessive Chargeback Merchant (ECM): Triggers when a merchant has at least 100 chargebacks in a calendar month AND a chargeback ratio of 1.5%–2.99%.

High Excessive Chargeback Merchant (HECM): Triggers at 300+ chargebacks AND a ratio at or above 3.00%.

Both tiers require the breach to persist for two consecutive months before fines start — not the first month of breach. Per an acquirer's own published fine schedule for the program (JPMorgan Merchant Services; most recently revised 2019 — treat as directional and confirm current amounts with your acquirer), fines then escalate by how many consecutive months the merchant stays in violation:

From an early violation month onward — this article no longer asserts which, because the underlying source column was ambiguous between month 3 and month 4, so confirm it with your acquirer rather than treating either as settled — an additional Issuer Recovery Assessment of $5 per chargeback over 300 in the month also applies — a merchant with 500 chargebacks in that window owes an extra $1,000 on top of the fine tier. A merchant exits the program once its ratio stays below the ECM threshold for three consecutive months.

The formula: chargebacks in month X divided by sales in month X–1 (one month lag). Both conditions — volume threshold AND ratio threshold — must be met simultaneously. A merchant with 300 chargebacks but a 1.4% ratio does not trigger HECM.

Unlike VAMP, Mastercard has not announced a threshold reduction for 2026. The 100/300-chargeback and 1.5%/3.0%-ratio thresholds have been stable since at least 2019 across the sources checked for this refresh; the fine amounts above carry more uncertainty given the age of the acquirer document they come from.

Pre-dispute tools: RDR, CDRN, and Ethoca

Three tools can stop chargeback representment before it starts by resolving disputes at the pre-chargeback stage. Understanding which applies to which network — and what exclusions they carry — is essential for VAMP management.

Visa RDR (Rapid Dispute Resolution) — launched April 2021, available through Verifi (a Visa company). When a cardholder contacts their issuer about a transaction, Visa sends a notification to the merchant's RDR rules engine. The merchant's pre-set rules evaluate whether to accept the dispute. If accepted within 72 hours, Visa issues a real-time refund and no chargeback is filed. The resolution is excluded from the VAMP ratio — this is the primary operational reason to use RDR beyond simple dispute reduction.

Verifi CDRN (Cardholder Dispute Resolution Network) — Verifi's proprietary alert network, separate from RDR. Covers approximately 95% of US Visa transactions; limited Mastercard coverage (approximately 32% reduction in Mastercard disputes claimed). Cost: $15–$40 per alert received. Gives merchants a 72-hour window to resolve before the chargeback is filed. CDRN is a subscription-based alerting service; RDR is Visa's official automated pre-dispute system. They are not the same thing.

Ethoca Alerts (Mastercard) — Mastercard's equivalent pre-dispute alert service. Covers approximately 95% of Mastercard transactions. Provides approximately 24 hours before the chargeback is formally filed, giving merchants the window to issue a refund and prevent escalation. In 2024, Mastercard integrated Ethoca data into its Financial Services Cloud for enhanced issuer visibility.

What's changed since VCR launched in 2018

If you last read a Visa or Mastercard dispute guide in 2018, 2020, or 2021, almost none of the operational specifics below survived unchanged. This is the full arc, not just the last year:

Fraud vs compliance chargebacks: a terminology note

Neither Visa nor Mastercard formally uses the term "compliance chargeback" in their reason code structure. The term is industry shorthand for disputes filed in violation of scheme rules — disputes that should not have been filed procedurally, independently of whether the underlying transaction was fraudulent.

Fraud chargeback: the cardholder makes a false claim about a legitimate transaction (true friendly fraud) or the transaction was genuinely unauthorized. For the full mechanics of how friendly fraud and first-party fraud patterns work and how to detect them, see first-party fraud and friendly fraud chargebacks.

Compliance chargeback: the dispute itself violates scheme rules — incorrect filing window, wrong reason code applied, missing required documentation, re-filed after a prior ruling. The merchant can challenge these on procedural grounds even without transaction-level evidence.

The operational distinction matters because your defense strategy differs. For a fraud chargeback you need transaction evidence; for a compliance chargeback you need scheme rule documentation showing the dispute was improperly filed. Your payment operations team needs to know the difference before building response templates.

For authorization rate optimization strategies that reduce upstream dispute risk, see Authorization Optimization: Lifting Card Acceptance.