From April 1, 2027, Mastercard will replace its current fraud and chargeback monitoring programs with the Global Merchant Audit Program (GMAP).
GMAP unifies previous Mastercard programs to evaluate combined fraud and dispute ratios at the acquirer, merchant, and sub-merchant levels.
Mastercard will also update its Questionable Merchant Audit Program (QMAP) – a separate mechanism used to target rapid, high-risk, or collusive fraud activity.
Updated Excessive Fraud and Chargeback monitoring programs
Under the GMAP, Mastercard will monitor the Excessive and High Excessive Chargeback Merchant (ECM / HECM) and Excessive Fraud Merchant (EFM) programs at the sub-merchant level.
If you’re a Payment Facilitator, Marketplace, ISV, or other merchant that onboards sub-merchants to Checkout.com, your sub-merchants may be placed in the EFM program if they breach the program thresholds, even if your MID stays below these thresholds.
Understanding the Excessive and High Excessive Chargeback Monitoring Programs (ECM / HECM)
Mastercard uses the Excessive and High Excessive Chargeback Monitoring Programs (ECM / HECM) to monitor and address high dispute rates. Mastercard calculates ECM and HECM thresholds monthly using the following formula:
(Current month's chargebacks / preceding month's sales count) * 10,000
Mastercard will reduce the ECM thresholds from 2029 onwards. The HECM threshold will remain at 3% of the chargebacks / sales formula above:
- 2027 and 2028: No change - 100+ chargebacks and 1.50% to 2.99% ECM/HECM ratio
- 2029: 100+ chargebacks and 1.30% to 2.99% ECM/HECM ratio
- 2030: 100+ chargebacks and 1.10% to 2.99% ECM/HECM ratio
- 2031: 100+ chargebacks and 0.90% to 2.99% ECM/HECM ratio
The table below shows the monthly noncompliance assessments under the ECM and HECM:
| Months above threshold | ECM | HECM |
| 1 | $0 | $0 |
| 2 | $1,000 | $1,000 |
| 3 | $1,000 | $2,000 |
| 4 to 6 | $5,000 | $10,000 + Issuer Recovery Fees* |
| 7 to 11 | $25,000 | $50,000 + Issuer Recovery Fees* |
| 12 to 18 | $50,000 | $100,000 + Issuer Recovery Fees* |
| 19+ | $100,000 | $200,000 + Issuer Recovery Fees* |
* Additional financial penalties based on the number of chargebacks.
If a merchant is in the ECM or HECM for more than six months (consecutive or non-consecutive), Mastercard may trigger a risk review and assess additional fees for this review. We will be required to advise on and mandate remediation actions to bring the merchant's ECM / HECM ratio down.
New High and Excessive Dispute Monitoring (HDM/EDM) programs
Mastercard will also introduce two new programs under the GMAP to cover spikes in fraud activity.
High Dispute Merchant Program
The High Dispute Merchant (HDM) program will apply to merchants that:
- Capture at least 5 transactions per month
- Experience more than 5,000 USD or more in fraud plus non-fraud chargebacks
- Have fraud plus non-fraud chargebacks that are 5% or more of their previous month’s sales volumes
Excessive Dispute Merchant Program
The Excessive Dispute Merchant (EDM) program will apply to merchants that:
- Capture at least 5 transactions per month
- Experience more than 10,000 USD or more in fraud plus non-fraud chargebacks
- Have fraud plus non-fraud chargebacks that are 50% or more of their previous month’s sales volume
Mastercard will apply the following monthly assessments for merchants assessed under the HDM and EDM:
| Months above threshold | HDM | EDM |
| 1 | $0 | $5,000 |
| 2 | $0 | $25,000 |
| 3 to 6 | $0 | $100,000 |
| 7 to 11 | $5,000 | $100,000 |
| 12 to 18 | $10,000 | $200,000 |
| 19+ | $25,000 | $300,000 |
If a merchant exceeds the EDM threshold for two months or more, they will also lose liability protection for all fraud-related chargebacks against transactions during the three months before identification, and transactions in the six months after identification.
Repeated identification may result in further action from Mastercard, including investigation, mandatory remediation, and termination.
Exiting the HDM and EDM
If a merchant falls into the HDM or EDM, their fraud and non-fraud chargeback rates must be below the HDM threshold for three consecutive months before the monthly counter resets. Until a reset, every month above the threshold will count towards the relevant counter, even if these are non-consecutive.
New High and Excessive Dispute Monitoring (HDA/EDA) programs
Mastercard will also introduce two new acquirer programs with similar monitoring criteria to the HDA/EDA. These will assess Checkout.com and other acquirers based on their fraud and non-fraud chargeback volume compared to their previous month’s processing volumes.
If an acquirer breaches the HDA/EDA thresholds, Mastercard will apply assessments, with similar exit criteria.
Updates to the Questionable Merchant Audit Program (QMAP)
The Questionable Merchant Audit Program is an active investigative mechanism used by Mastercard to target rapid, high-risk, or collusive fraud schemes. From 2027 Mastercard will strengthen this program and identify a merchant if they meet the following conditions:
- The merchant processed at least 10,000 USD in the past 30 days (previously 120)
- The merchant processed at least five transactions in the past 30 days (previously 120)
- At least 50 percent of the merchant’s volume originated from cards identified by issuers as being involved in ‘bust out’ fraud, where the cardholder accumulated a large credit limit through normal spending activity, spent up to the limit, and then disappeared
- At least two of the following apply:
- The merchant’s fraud-to-sales ratio is 70% or greater
- Issuers declined or referred 20% or more of the merchant’s transactions
- The total number or dollar amount of fraud, declines, and referrals exceeds the total number or dollar amount of authorized transactions
If Mastercard identifies a merchant under the QMAP, Mastercard will flag them in a global Security Bulletin. Issuers will have full recovery rights for covered transactions under Reason Code 4849 (Questionable Merchant Activity), including transactions where an earlier chargeback for a different reason was unsuccessful.
Additionally, acquirer fees will apply, and Mastercard will require us to re-perform full onboarding screening. We may suspend processing and / or offboard merchants identified under QMAP to stop the ongoing liability.