Mastercard SMMP: What Merchants Need to Know

Why Mastercard SMMP Deserves Your Attention

Chances are you’ve seen at least one alarming headline about Mastercard’s newest monitoring program. Some of them read like a countdown to the end of online selling. Mastercard SMMP is serious, and the consequences are steep. But the program targets a specific pattern of behavior, and its triggers are things you can monitor from your own reporting. The merchants most likely to be caught off guard are the ones who never looked.

One detail worth flagging now: the 5% refund and chargeback rule that gets so much attention doesn’t apply to every merchant. More on that later.

What Mastercard SMMP Is, in Plain Terms

SMMP is a global compliance program for card-not-present merchants. Mastercard introduced it through a July 2025 update to its Security Rules and Procedures, and full enforcement began on July 24, 2026.

The program covers sponsored merchants operating under payment facilitators, too. And onboarding requirements kicked in even earlier, in January 2026, so acquirers now screen new merchant websites before a first transaction is ever processed.

The core mechanic is simple. When a defined trigger fires, your acquirer has 72 hours to investigate and report back to Mastercard. If scam activity is confirmed, Mastercard and Maestro processing stops immediately.

How SMMP Differs From ECP and EFM

Mastercard already runs two well-known monitoring programs. The Excessive Chargeback Program (ECP) tracks chargebacks against transaction volume, and the Excessive Fraud Merchant (EFM) program tracks fraud. Both are ratio-based. Cross a threshold and you face fines, plus a window to bring your numbers back down.

SMMP plays by different rules. It looks for signals rather than ratios, and a confirmed finding carries no fine schedule, no remediation period, and no gradual escalation. Just termination.

All three programs run at the same time. So a merchant can sit comfortably below every ECP and EFM threshold and still face an SMMP review if its activity resembles a scam operation.

If this sounds familiar, it should. Visa moved in a similar direction with VAMP, its acquirer monitoring program, which pushes more accountability onto acquirers for the merchants they board. Mastercard SMMP follows that same thread, with a sharp focus on scams.

Four Signals That Can Trigger an SMMP Review

Mastercard defines a handful of trigger conditions, and any single one is enough to start the 72-hour clock. Some apply to every merchant, while one applies only to newer accounts. Here’s the quick version of each.

A Sharp Drop in Approval Rates

If you process at least 25 transactions in a 72-hour period and your approval rate falls by 50 or more percentage points, or dips below 30%, an investigation is required. A collapse like that often signals that issuing banks see something suspicious. Of course, a routing problem or an aggressive retry strategy can produce the same pattern. Drops caused by BIN attacks or acquirer-side technical issues are excluded.

A GRIP Letter From Mastercard

GRIP stands for Global Rules Investigation Program. A GRIP letter means Mastercard’s own intelligence has already connected a merchant account to suspected scam activity. Once an acquirer receives one, the investigation is already in motion.

Scam Signals on Newer Accounts

This trigger applies only to merchants with six months or less of Mastercard acceptance history. A review can follow if two different issuers report fraud tied to cardholder manipulation, or if chargebacks from two or more issuers include documentation referencing scams. It also fires when combined refunds and chargebacks exceed 5% of purchase transactions over any rolling 30-day period, as long as the merchant processed at least 500 transactions in that window.

An Alert From an Approved Monitoring Provider

Mastercard works with approved Merchant Monitoring Service Providers (MMSPs) that scan merchant websites and behavior. An alert from one of these providers can require an investigation on its own. That means signals from outside your transaction data, like misleading marketing claims or a wave of online complaints, can count too.

The 5% Rule, Put in Perspective

Here’s the thing. The combined 5% threshold has caused more anxiety than any other part of SMMP, and it applies to a fairly narrow group.

Only accounts with six months or less of Mastercard history fall under it. If your account is older than that, this specific trigger doesn’t apply to you, although the others still do.

Why the six-month window? Scam operations tend to follow a familiar arc. Open an account, push volume fast, collect complaints, and disappear before traditional ratios catch up. Counting refunds alongside chargebacks also closes a common workaround, where scammers issue partial refunds to stay under the radar.

So who should pay close attention? Newer merchants in verticals with naturally elevated refund activity, such as subscriptions, SaaS, digital goods, and travel. If that’s you, this number belongs on your dashboard starting today.

What Happens When a Flag Goes Up

A flag starts an investigation. Termination only follows if scam activity is confirmed.

During the 72-hour window, your acquirer looks at whether your activity matches your stated business model, whether complaints point to deception, and whether you can show real fulfillment, refund handling, and customer communication. If you’re cleared, processing continues under ongoing monitoring. If not, Mastercard and Maestro processing ends immediately, and the merchant can be placed on the MATCH list, which makes finding a new acquirer extremely difficult.

Three days goes by fast. Too fast to build a defense from scratch.

That’s why the work happens beforehand. Organized records and an acquirer who already understands how your business operates are what turn a stressful review into a quick clearance.

Winning a Chargeback Won’t Erase It

This one catches many merchants off guard.

Once a chargeback is filed, it counts toward your SMMP, ECP, and EFM metrics, no matter who wins the case. You can overturn it through representment, recover every dollar, and your monitoring exposure stays exactly where it was.

Representment still matters. It protects revenue. Prevention, meanwhile, protects your standing with the card networks by stopping disputes before they’re ever filed. At the end of the day, you need both working together.

A Quick SMMP Readiness Checklist

None of these steps require a massive overhaul. Most come down to visibility and communication.

• Track refunds and chargebacks as one combined metric on a rolling 30-day basis, with internal alerts set well below 5%
• Watch authorization approval rates for sudden swings, since that trigger applies to every merchant
• Review your billing descriptors so customers recognize charges and contact you instead of their bank
• Brief your acquirer on your business model, expected refund patterns, and seasonality
• Keep fulfillment, refund, and customer communication records organized and easy to pull

How Our Solutions Support SMMP Readiness

DEFLECT integrates Verifi Order Insight and Ethoca Consumer Clarity, sending transaction and fulfillment details to issuers and cardholders at the point of inquiry. When confusion is cleared up there, the case may never become a dispute, let alone one coded as fraud or scam-related.

RESOLVE consolidates dispute alerts from Verifi CDRN, Ethoca Alerts, and Visa RDR into one workflow. For newer merchants, that matters. Refunding every alert by reflex can push the combined refund and chargeback rate upward, so selective, informed decisions keep both numbers in check.

RECOVER automates representment using evidence pulled straight from your transaction stream. And that same organized evidence trail is exactly what an acquirer needs if an SMMP investigation ever opens.

Ready to Check Your Mastercard SMMP Exposure? We’re Here to Help

If Mastercard SMMP has you wondering where your business stands, that instinct is a good one, and acting on it early is a no-brainer. Whether you need help tracking your combined refund and chargeback rate, sharing transaction data with issuers before confusion turns into disputes, or organizing the documentation an acquirer would want during a 72-hour review, our team can help. Contact us and our chargeback management experts will assess your exposure against each SMMP trigger and build a prevention plan that fits your operation.

Why ChargebackHelp?

ChargebackHelp combines prevention, resolution, and recovery in one card-agnostic platform. We integrate the most effective dispute technology from Visa, Mastercard, Verifi, and Ethoca with your transaction stream, then automate the work that normally eats up your team’s time. The result is fewer disputes, fewer chargebacks, and more revenue recovered from first-party fraud and unwarranted claims. As card network rules keep shifting, you get a partner that tracks the changes and keeps your account aligned with network enforcement expectations, so you can stay focused on running your business.