Preparing for Mastercard Scam Merchant Monitoring Rules

The Clock Runs Out July 24

Mastercard’s Scam Merchant Monitoring Program (SMMP) reaches full enforcement on July 24, 2026.

If you want the complete background on how the program works and why it exists, we covered that in our Mastercard SMMP explainer. The short version is this: when a scam signal fires, your acquirer has 72 hours to investigate, and a confirmed finding means immediate termination of Mastercard and Maestro processing plus placement on the MATCH list. No fines, no remediation window, no second chances.

That compressed timeline is exactly why preparation matters. 72 hours is not enough time to organize records, brief your acquirer, and explain your business model from a standing start. The merchants who come through investigations quickly are the ones who did the work before the question was ever asked.

Know Which Triggers Apply to You

Mastercard scam merchant monitoring does not treat every merchant the same way, and your preparation should match your situation. The dividing line is six months of Mastercard processing history.

If Your Account Is Under Six Months Old

Newer accounts face the strictest scrutiny, because scam operations tend to open accounts, process fast, and vanish before traditional chargeback ratios catch up. Three signals can trigger an investigation for accounts in this window. A combined refund and chargeback rate above 5% of purchase transactions in any rolling 30-day period with at least 500 transactions. Two different issuers reporting transactions under fraud reason code 56, Mastercard’s classification for Manipulation of Cardholder. Or chargebacks from two or more issuers with documentation that references scams or manipulation.

Your metric to watch this week: your combined refund and chargeback rate, calculated as one number over a rolling 30-day window. If you have never run that calculation, run it today. You may be closer to 5% than you think, especially in verticals like subscriptions, SaaS, and digital goods where refunds are a normal part of doing business.

If You Are an Established Merchant

Past the six-month mark, the 5% combined rule no longer applies to you. But you remain subject to every other trigger. A drop in authorization approval rates of 50 or more percentage points within 72 hours, or a rate that falls below 30%, with at least 25 transactions processed. A GRIP letter, meaning Mastercard’s own intelligence has flagged your account. Or an alert from an approved Merchant Monitoring Service Provider, which can be based on signals from outside your transaction data entirely, including your website content and patterns in online complaints.

Your metric to watch this week: your authorization approval rate. A routing change, a new marketing campaign, or an aggressive retry configuration can produce a drop that looks like fraud from the network’s vantage point, even when nothing fraudulent happened.

Get Your Combined Rate Under Control

Here is the mindset shift at the heart of Mastercard scam merchant monitoring. Refunds and chargebacks are now one number. Most merchants track them separately, in different reports, owned by different teams. Under the new rules, the combined figure is what matters, and there is only one stage of the transaction lifecycle where you can stop that figure from growing: before the refund or dispute ever happens.

Think about what feeds the combined rate. A cardholder sees a charge they do not recognize, calls their bank, and either receives a refund or files a dispute that becomes a chargeback. Every path from that phone call adds to the number. The only winning move is resolving the confusion before the call happens, or at the moment of inquiry itself.

That is precisely what our DEFLECT solution is built for. DEFLECT integrates Verifi Order Insight and Ethoca Consumer Clarity, sending your transaction and fulfillment details to cardholder banking apps and issuer call centers on demand. When a customer checks their statement and sees your product details, branding, and delivery status instead of a cryptic line item, the confusion resolves itself. When an issuing bank sees the data tying the cardholder to the purchase, the transaction is far less likely to be classified as fraud or referenced as a scam. Nothing gets logged against your combined rate, because nothing escalated in the first place.

And DEFLECT works in the background with no manual effort on your end. For merchants in their first six months, that quiet, continuous protection could potentially be the difference between staying invisible to the monitoring program and explaining yourself to an investigator.

Run Your Alerts With Discipline, Not Volume

Dispute alerts remain one of the most valuable protections you can have, and that has not changed. What has changed is the strategy behind them.

The old logic was simple: refund every alert, keep every dispute from becoming a chargeback, protect the ratio. But for newer merchants under the combined threshold, blanket refunding feeds the very metric it was meant to protect. A refund issued through an alert still counts toward the 5% figure. Volume refunding is no longer a strategy. Selectivity is.

Our RESOLVE solution makes that selectivity practical. RESOLVE consolidates dispute alerts from Verifi CDRN, Ethoca Alerts, and Visa RDR into a single workflow, connecting each alert directly to its source transaction. That connection is what allows smart decisions at speed: refund where the customer has a genuine issue and the resolution protects the relationship, escalate where your evidence is strong and the transaction was legitimate, and keep your combined rate in view the entire time. You can automate the rules, manage alerts in-house, or lean on our specialists to run the process for you.

The point is not fewer alerts. The point is that every alert decision now carries a compliance dimension it did not carry before, and your workflow should reflect that.

Build Your Investigation File Before Anyone Asks

If a flag ever fires, your acquirer becomes your advocate, and advocates need material to work with. An acquirer who understands your business model can explain a metric anomaly to Mastercard in a way that clears you fast. An acquirer staring at raw numbers with no context cannot.

Two preparation steps matter here, and both are best done now rather than mid-investigation.

First, talk to your acquirer. Brief them on your business model, your expected refund patterns, and any seasonality in your numbers. A subscription business with predictable churn and a seasonal retailer with post-holiday returns look completely different from a scam operation, but only if your acquirer knows that context before the 72-hour clock starts.

Second, get your records in order. Transaction histories, fulfillment confirmations, refund logs, cancellation records, customer communication trails. An investigation will examine whether your activity matches your stated business model and whether you can substantiate fulfillment and customer service. Here’s where preparation pays double: the same organized evidence that clears an investigation is the evidence that wins representment cases. Our RECOVER solution automates that data capture, pulling compelling evidence directly from your transaction stream and keeping it structured and ready. You build the file once, and it protects you in two directions: recovering revenue from unwarranted chargebacks and proving legitimacy if the monitoring program ever comes calling.

A Readiness Checklist for This Week

Preparation for Mastercard scam merchant monitoring comes down to a handful of concrete actions, and most of them can be completed in days:

• Calculate your current combined refund and chargeback rate over the trailing 30 days, and keep recalculating it on a rolling basis going forward
• Set an internal alert threshold well below 5% so a trend gets your attention while there is still time to act
• Check your authorization approval rate for recent swings, and flag any planned changes to routing, retries, or campaigns that could move it
• Audit your billing descriptors to confirm customers can recognize your charges at a glance
• Brief your acquirer on your business model, refund expectations, and seasonality
• Verify that your transaction, fulfillment, and refund records can be pulled quickly and tell a complete story

Ready Before the Deadline? We Can Help

Enforcement is here, but preparation is far from out of reach. If you would like help calculating your exposure against the new triggers, standing up point-of-inquiry data sharing through DEFLECT, tightening your alert workflows with RESOLVE, or building the automated evidence capture that keeps your investigation file ready, contact us today. Our team of chargeback management experts can assess where you stand and get the right protections running quickly, so the monitoring program stays something you read about rather than something you experience.

Why ChargebackHelp?

ChargebackHelp covers every preparation area in this piece within a single platform. DEFLECT resolves cardholder confusion at the point of inquiry so refunds and disputes never get logged. RESOLVE turns dispute alerts into disciplined, selective decisions instead of reflexive refunds. RECOVER automates representment while building the organized evidence trail that acquirers and card networks increasingly expect to see. Rather than assembling separate vendors for prevention, alert management, and recovery, you get one coordinated framework that keeps your ratios within acceptable bounds, protects your revenue, and keeps your merchant account aligned with card network enforcement expectations. We manage your disputes so you can manage your business.