Explore by subject
Identify the payment failure, dispute process or control you need to investigate, then check the applicable scheme, provider and jurisdiction.
Briefings, grouped by decision
The fraud types that drive losses for payment operators — how each attack works, who commits it, and the defences that contain it.
Card testing validates stolen credentials against your payment endpoint. Auth costs, fraud signals, and VAMP exposure — attack anatomy and operator defence.
First-party fraud now dominates dispute volume at most e-commerce merchants. Why it's growing, who commits it, and the playbook for evidence-based defence.
Dispute management, representment evidence, and the scheme monitoring programmes that determine merchant account continuity.
Visa VAMP threshold now 1.5%, CE 3.0 fee added April 2026. Mastercard tightened arbitration and reason codes. Updated 2026 dispute map for both schemes.
Build a reason-code-matched dispute response, use your PSP’s case deadline, and distinguish merchant evidence submission from network dispute stages.
KYC, KYB, AML, PCI DSS 4.0, SCA, sanctions screening, and the compliance obligations that vary by jurisdiction and merchant type.
How KYB's beneficial ownership complexity, UBO screening requirements, and orchestration tooling differ from KYC — and what that means for embedded.
51 new PCI DSS 4.0 requirements enforced March 31, 2025. First assessment cycles are finishing. The eight failure patterns showing up most in production.
3-D Secure 2 reduces fraud but adds checkout friction that taxes authorization and conversion — how operators measure and manage the authentication cost.
PSD3 and PSR status as of October 2026, the difference between agreed texts and application dates, and an operator checklist for fraud, SCA and open banking.
Other briefings in this topic
Who must register with the Bank of Canada under the Retail Payment Activities Act, what the application requires, and the obligations that follow registration.
How future-delivery merchants create acquirer credit exposure, how banks size it under OCC guidance, and what reserves and monitoring follow.
Visa sorts decline codes into four categories. Category 1 may never be resubmitted for the same credential; the rest are capped at 20 attempts in 30 days.
Nacha's ACH fraud-monitoring rules are fully in force. What they require, what they explicitly do not, and why they are not the UK reimbursement model.
Originate ACH through another platform rather than directly with a bank and Nacha likely classes you as a Nested Third-Party Sender — with your own duties.
Visa now requires acquirers in several regions to let merchants offer passkey authentication — and attaches fraud liability protection to it. Where it applies.
Visa's Third Party Agent definition is broader than most operators assume. What registration requires, who is exempt, and the 24 October 2026 change.
Mastercard's Excessive Chargeback Program (ECP, tiered ECM/HECM) and its separate Excessive Fraud Merchant program (EFM) never merged like Visa's VAMP did.
What evidence to assemble for fraud, non-receipt, not-as-described, cancellation, duplicate, and credit-not-processed chargebacks — and in what order.
How to request SCA exemptions issuers actually honor: exemption indicator mechanics, TRA fraud-rate bands, soft-decline recovery, and why requests get ignored.
A live fraud spike is an attack in progress, not a metric. An incident-command runbook to confirm, classify, contain with reversible controls, and recover.
The merchant you approved drifts. A lifecycle playbook for risk-tiering, re-screening, monitoring signals, graduated response, and offboarding.
Promo and referral abuse games growth rewards by exploiting eligibility, not stealing cards. An operator playbook for signals, controls, and response.
CE 3.0 fights Visa 10.4 fraud disputes with prior matching transactions — but the evidence must be captured before the dispute, not after.
What VoP and CoP results mean — Match, Close Match, No Match, Not Possible — the EU's four codes, the UK's reason codes, and how operators handle each.
Steps to exit Visa VAMP monitoring: confirm the TC40/TC15 ratio, stop it from worsening, and run parallel fraud and dispute remediation.
Chargeback management compared by operating model: network pre-dispute alerts (Verifi, Ethoca), representment automation, managed recovery, and in-house.
Compare Forter, Signifyd, Riskified, Sift, Kount and ClearSale by decision ownership, guarantee scope, pricing model and the questions to put in an RFP.
A scorecard for dispute and risk teams: 16 KPIs across compliance, operational, outcome, quality, and cost — with targets, cadence, and escalation logic.
Mastercard dispute categories, filing windows and provider deadlines, plus the public Merchant Edition basis for the ECP chargeback ratio.
Visa Claims Resolution explained: Allocation vs Collaboration workflows, filing deadlines, and CE 3.0 eligibility. Per-code lookup is in the reason-code tool.
Stack map
Six control layers between a transaction attempt and a compliant outcome. Each layer has distinct owners, distinct tooling, and distinct consequences for failure.
Fraud detection
Real-time scoring, behavioural signals, network intelligence — catches bad actors before authorisation.
Authentication
Check authentication evidence, credential controls and applicable liability conditions.
Authorisation
Issuer responses and retry controls; approval, clearing and settlement are separate states.
Chargebacks
Dispute response, CE 3.0 evidence, VAMP / ECM monitoring — the last line before scheme termination.
Compliance
PCI DSS 4.0, PSD3/PSR, KYC/KYB, AML monitoring — structural obligations that survive individual transactions.
Sanctions
Identify the applicable sanctions regimes, screening process and escalation responsibilities.
From topic to market
Reference
Identify the programme, region, entity being measured, measurement period and denominator before comparing a ratio with a threshold. Acquirer and merchant measures differ. Use the dedicated scheme-monitoring reference and your acquirer notice for the applicable scope, exclusions and remediation process.
Map the payment-page integration and card-data flow before determining assessment scope and responsibilities. Check the current standard, assessment form and provider responsibilities with your acquirer or assessor. An outsourced checkout does not by itself answer every merchant security question.
KYC concerns the identity of an individual; KYB concerns a business and the relevant people behind it. Determine the required ownership, control, authority and purpose checks for the actual entity and jurisdiction. Do not apply a single beneficial-ownership percentage or documentation list universally.
Identify the jurisdiction, payment activity, parties and transaction type. Authentication requirements, exemptions and out-of-scope transactions are distinct questions. Use the authentication and regulatory references for the specific flow, rather than treating 3DS completion as proof that every legal or scheme condition is satisfied.
Map the regulated activity and responsible entity, then identify the applicable monitoring, escalation, reporting and record-keeping requirements. Sanctions screening and suspicious-activity monitoring serve different purposes. Assign owners and retain the decision evidence required for the relevant jurisdiction.
Fraud decisions, disputes, scheme monitoring and regulatory obligations have different owners and evidence. Identify the failure you are handling before choosing a control or escalation path. A dispute response is not the same task as monitoring programme exposure or investigating suspicious activity.
For regulatory or scheme changes, distinguish proposals, final text, effective dates, implementation periods and the entity in scope. For card security, confirm the payment integration and assessment route. The dedicated references provide the detail needed to check applicability rather than assuming every obligation applies to every merchant.
The briefings in this topic cover the operational realities: how fraud models and rule engines work together, what chargeback thresholds mean for your merchant account, and which compliance requirements have teeth versus which are largely theoretical.